outlook.com

Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Miners

Threat actors are delivering malicious loaders and cryptocurrency miners under the guise of artificial intelligence (AI) desktop applications for Anthropic Claude and OpenAI ChatGPT as part of a campaign dubbed Yoba. The activity involves creating fake GitHub projects that claim to be desktop applications like GPT-5.6 Sol, GPT-6 Astra, and Claude Opus, only to deliver a malware family called

thehackernews.comOct 29, 2026extracted

Tricks from the Past deployed via signed ChatGPT and Claude binaries

research.checkpoint.comOct 27, 2026extracted

China-Linked GopherWhisper Infects 12 Mongolian Government Systems with Go Backdoors

Mongolian governmental institutions have emerged as the target of a previously undocumented China-aligned advanced persistent threat (APT) group tracked as GopherWhisper. "The group wields a wide array of tools mostly written in Go, using injectors and loaders to deploy and execute various backdoors in its arsenal," Slovakian cybersecurity company ESET said in a report shared with The Hacker News. "GopherWhisper abuses legitimate services, notably Discord, Slack, Microsoft 365 Outlook, and file.io for command-and-control (C&C) communication and exfiltration." The group was first discovered in January 2025 following the discovery of a never-before-seen backdoor codenamed LaxGopher on a system belonging to a Mongolian governmental entity. GopherWhisper is assessed to be active at least since November 2023. Besides LaxGopher, some of the other malware families part of the threat actor's arsenal are Golang-based tools to receive instructions from the C&C server, execute them, and send the results back. Also used by the threat actor is a file collection tool to gather files of interest and exfiltrate them in compressed format to the file[.]io file sharing service and a C++ backdoor that offers remote control over compromised hosts. Telemetry data from ESET shows that about 12 systems associated with the Mongolian governmental institution were infected by the backdoors, with C&C traffic from the attacker-controlled Discord and Slack servers indicating dozens of other victims. Exactly how GopherWhisper obtains initial access to the target networks is currently not known. But a successful foothold is followed by attempts to deploy a wide range of tools and implants - JabGopher, an injector that executes the LaxGopher ("whisper.dll") backdoor. LaxGopher, a Go-based backdoor that uses Slack for C2 to execute commands via "cmd.exe" and publish the results back to the Slack channel, as well as download additional malware. CompactGopher, a Go-based file collection utility dropped by LaxGopher to filter files of interest by extensions (.doc, .docx, .jpg, .xls, .xlsx, .txt, .pdf, .ppt, and .pptx.), compress them into ZIP files, encrypt the archives using AES-CFB-128, and exfiltrate them to file[.]io. RatGopher, a Go-based backdoor that uses a private Discord server to receive C&C messages, execute commands, and publish the results back to the configured Discord channel, as well as upload and download files from file[.]io. SSLORDoor, a C++-based backdoor that uses OpenSSL BIO for communication via raw sockets on port 443 to enumerate drives, perform file operations, and run commands based on C&C input via "cmd.exe." FriendDelivery, a malicious DLL that serves as a loader and injector for BoxOfFriends. BoxOfFriends, a Go-based backdoor that uses the Microsoft Graph API to craft draft emails for C2 using hard-coded credentials, with the earliest Outlook account created for this purpose ("barrantaya.1010@outlook[.]com") created on July 11, 2024. "Timestamp inspection of the Slack and Discord messages showed us that the bulk of them were being sent during working hours, i.e., between 8 a.m. and 5 p.m., which aligns with China Standard Time," ESET researcher Eric Howard said. "Furthermore, the locale for the configured user in Slack metadata was also set to this time zone. We therefore believe that GopherWhisper is a China-aligned group."

thehackernews.comApr 23, 2026extracted

GopherWhisper APT group hides command and control traffic in Slack and Discord

GopherWhisper APT group hides command and control traffic in Slack and Discord Attackers continue to lean on everyday collaboration platforms to hide command and control traffic inside normal enterprise noise. A newly identified China-aligned APT group pushes that trend further, running its operations through Slack workspaces, Discord servers, Outlook drafts, and the file.io sharing service. GopherWhisper toolset overview ESET researchers have named the group GopherWhisper and tied it to an intrusion at a Mongolian governmental entity. The name draws on two elements: most of the group’s tooling is written in Go, whose mascot is a gopher, and one of its side-loaded components ships as whisper.dll. A toolset built mostly in Go GopherWhisper operates a set of custom loaders, injectors, and backdoors. The Go-based components include three backdoors, LaxGopher, RatGopher, and BoxOfFriends, along with the JabGopher injector, the CompactGopher exfiltration utility, and the FriendDelivery loader. A C++ backdoor called SSLORDoor rounds out the arsenal. Each backdoor pairs with a different legitimate service for command and control. LaxGopher pulls instructions from a private Slack workspace and posts results back to the same channel. RatGopher mirrors that design on Discord. BoxOfFriends takes a different route, using the Microsoft Graph API to exchange commands through Outlook draft messages. SSLORDoor communicates directly with the operators over an encrypted channel on port 443. The supporting tools handle the rest of the chain. JabGopher and FriendDelivery load the backdoors into memory, and CompactGopher packages selected files and ships them out through the file.io sharing service. Operator messages pulled from Slack, Discord, and Outlook The group’s reliance on commercial platforms for C&C cut both ways. After recovering multiple Slack and Discord API tokens during analysis, ESET retrieved a large volume of operator traffic from those services. “During our investigation, we managed to extract thousands of Slack and Discord messages, as well as several draft email messages from Microsoft Outlook. This gave us great insight into the inner workings of the group,” said ESET researcher Eric Howard, who discovered the new threat group. The Slack channel tied to LaxGopher carried mostly disk and file enumeration commands. It also contained links to public GitHub repositories covering Go service installation, process injection on x86 and x64, and encryption and compression utilities. ESET assesses that operators consulted these repositories during development. RatGopher’s Discord channel held Go source code that appears to be an earlier iteration of the backdoor, along with output from enumeration runs on operator machines. One of those machines was a VMware virtual machine whose install and boot timestamps line up with UTC+8. Message timestamps from both Slack and Discord cluster between 8 a.m. and 5 p.m. UTC+8, matching China Standard Time. The configured user locale in Slack metadata pointed to the same zone, supporting the China-aligned attribution. Outlook drafts reveal an infrastructure timeline Extraction of Outlook content exposed operational housekeeping failures on the attacker side. The welcome email from Microsoft, sent when the mailbox was provisioned, remained in place. That message confirmed that the account barrantaya.1010@outlook[.]com was created on July 11, 2024. The FriendDelivery DLL that loads BoxOfFriends was compiled 11 days later, on July 22, 2024. Investigators also determined that the Slack and Discord servers began life as test environments for the backdoors, and were later pressed into service as live C&C channels for LaxGopher and RatGopher across multiple compromised systems. Logs from the testing phase were never cleared, giving defenders a longer window into the group’s development and deployment activity. ESET has published indicators of compromise in its GitHub repository. Guide: Breach and Attack Simulation & Automated Penetration Testing

helpnetsecurity.comApr 23, 2026extracted

Iran-Linked Hackers Breach FBI Director’s Personal Email, Hit Stryker With Wiper Attack

Threat actors with ties to Iran successfully broke into the personal email account of Kash Patel, the director of the U.S. Federal Bureau of Investigation (FBI), and leaked a cache of photos and other documents to the internet. Handala Hack Team, which carried out the breach, said on its website that Patel "will now find his name among the list of successfully hacked victims." In a statement shared with Reuters, the FBI confirmed Patel's emails had been targeted, and noted necessary steps have been taken to "mitigate potential risks associated with this activity." The agency also said the published data was "historical in nature and involves no government information." The leak includes emails from 2010 and 2019 allegedly sent by Patel. Handala Hack is assessed to be a pro-Iranian, pro-Palestinian hacktivist persona adopted by Iran's Ministry of Intelligence and Security (MOIS). It's tracked by the cybersecurity community under the monikers Banished Kitten, Cobalt Mystique, Red Sandstorm, and Void Manticore, with the group also operating another persona called Homeland Justice to target Albanian entities since mid-2022. A third persona linked to the MOIS-affiliated adversary is Karma, which is said to have been likely completely replaced by Handala Hack since late 2023. Data gathered by StealthMole has revealed that Handala's online presence extends beyond messaging platforms and cybercrime forums like BreachForums to publicize its activities, maintaining a layered infrastructure that includes surface web domains, Tor-hosted services, and external file-hosting platforms such as MEGA. "Handala has consistently targeted IT and service providers in an effort to obtain credentials, relying largely on compromised VPN accounts for initial access," Check Point said in a report published this month. "Throughout the last months, we identified hundreds of logon and brute-force attempts against organizational VPN infrastructure linked to Handala-associated infrastructure." Attacks mounted by the proxy group are known to leverage RDP for lateral movement and initiate destructive operations by dropping wiper malware families such as Handala Wiper and Handala PowerShell Wiper via Group Policy logon scripts. Also used are legitimate disk encryption utilities like VeraCrypt to complicate recovery efforts. "Unlike financially motivated cybercriminal groups, Handala-associated activity has historically emphasized disruption, psychological impact, and geopolitical signaling," Flashpoint said. "Operations attributed to the persona frequently align with periods of heightened geopolitical tension and often target organizations with symbolic or strategic value." The development comes against the backdrop of the U.S.-Israel-Iran conflict, prompting Iran to go on a retaliatory cyber offensive against Western targets. Notably, Handala Hack claimed credit for crippling the networks of medical devices and services provider Stryker by deleting a huge trove of company data and wiping thousands of employee devices. The attack is the first confirmed destructive wiper operation targeting a U.S. Fortune 500 company. In an update issued on its website this week, Stryker said "the incident is contained," adding it "reacted quickly to not only regain access but to remove the unauthorized party from our environment" by dismantling the persistence mechanisms installed. The breach, it stated, was confined to its internal Microsoft environment. The threat actors have been found to use a malicious file to run commands that allowed them to conceal their actions. However, the file does not possess any capabilities to spread across the network, Stryker pointed out. Palo Alto Networks Unit 42 said the primary vector for recent destructive operations from Handala Hack likely involves the "exploitation of identity through phishing and administrative access through Microsoft Intune." Hudson Rock has found evidence that compromised credentials associated with Microsoft infrastructure obtained via infostealer malware may have been used to pull off the hack. In the wake of the breach, both Microsoft and the Cybersecurity and Infrastructure Security Agency (CISA) have released guidance on hardening Windows domains and fortifying Intune to defend against similar attacks. This includes using the principle of least privilege, enforcing phishing-resistant multi-factor authentication (MFA), and enabling multi-admin approval in Intune for sensitive changes. Flashpoint has characterized the attack on Stryker as a dangerous shift in supply chain threats, as state-linked cyber activity targeting critical suppliers and logistics providers can have cascading impacts across the entire healthcare ecosystem. DoJ Takes Down Pro-Iranian Hacker Domains Handala Hack's leak of Patel's personal emails comes in response to a court-authorized operation that led to the seizure of four domains operated by MOIS since 2022 as part of an effort to disrupt its malicious activities in cyberspace. The U.S. government is also offering a $10 million reward for information on members of the group. The names of the seized domains are listed below - justicehomeland[.]org handala-hack[.]to karmabelow80[.]org handala-redwanted[.]to "The seized domains [...] were used by the MOIS in furtherance of attempted psychological operations targeting adversaries of the regime by claiming credit for hacking activity, posting sensitive data stolen during such hacks, and calling for the killing of journalists, regime dissidents, and Israeli persons," the U.S. Department of Justice (DoJ) said. This included the names and sensitive information of about 190 individuals associated with or employed by the Israeli Defense Force (IDF) and/or Israeli government, and 851 GB of confidential data from members of the Sanzer Hasidic Jewish community. In addition, an email address linked to the group ("handala_team@outlook[.]com") is alleged to have been used to send death threats to Iranian dissidents and journalists living in the U.S. and elsewhere. In a separate advisory, the FBI revealed that Handala Hack and other MOIS cyber actors have employed social engineering tactics to engage with prospective victims on social messaging applications to deliver Windows malware capable of enabling persistent remote access using a Telegram bot by masquerading the first-stage payload as commonly used programs like Pictory, KeePass, Telegram, or WhatsApp. Using Telegram (or other legitimate services) as C2 is a common tactic by threat actors to hide malicious activity among normal network traffic, and significantly reduce the likelihood of detection. Related malware artifacts found on compromised devices have revealed added capabilities to record audio and screen while a Zoom session was active. The attacks have targeted dissidents, opposition groups, and journalists, per the FBI. "MOIS cyber actors are responsible for using Telegram as a command-and-control (C2) infrastructure to push malware targeting Iranian dissidents, journalists opposed to Iran, and other opposition groups around the world," the bureau said. "This malware resulted in intelligence collection, data leaks, and reputational harm against the targeted parties." Handala Hack has since resurfaced on a different clearnet domain, "handala-team[.]to," where it described the domain seizures as "desperate attempts by the United States and its allies to silence the voice of Handala." The ongoing conflict has also prompted fresh warnings that it risks turning critical infrastructure sector operators into lucrative targets, even as it has triggered a surge in DDoS attacks, website defacements, and hack-and-leak operations against Israel and Western organizations. Hacktivists entities have also engaged in psychological warfare and influence operations with an aim to sow fear and confusion among the targeted populations. In recent weeks, the energy sector in the Middle East has drawn the attention of a relatively new cybercriminal group called Nasir Security. The group, instead of directly targeting energy companies, has gone after their contractors and third-parties to leak internal data, leading to "incorrect assumptions" about the origin of hacks. "The group is attacking supply chain vendors involved in engineering, safety, and construction," Resecurity said. "The supply chain attacks attributed to Nasir Security are likely carried out by cyber-mercenaries or individuals hired or sponsored by Iran or its proxies." "The cyber activity tied to this conflict is becoming increasingly decentralized and destructive," Kathryn Raines, cyber threat intelligence team lead for the National Security Solutions at Flashpoint, said in a statement. "Groups like Handala and Fatimion are targeting private-sector organizations with attacks designed to erase data, disrupt services, and introduce uncertainty for both businesses and the public. At the same time, we're seeing a greater use of legitimate administrative tools in these cyber operations, making it significantly harder for traditional security controls to detect." That's not all. MOIS-linked actors have been increasingly engaging with the cybercrime ecosystem to support its objectives and provide a cover for its malicious activity. This includes Handala's integration of Rhadamanthys stealer into its operations and MuddyWater's use of the Tsundere botnet (aka Dindoor) and Fakeset, the latter of which is a downloader used to deliver CastleLoader. "Such engagement offers a dual advantage: it enhances operational capabilities through access to mature criminal tooling and resilient infrastructure, while complicating attribution and contributing to recurring confusion around Iranian threat activity," Check Point said. "The use of such tools has created significant confusion, leading to misattribution and flawed pivoting, and clustering together activities that are not necessarily related. This demonstrates that the use of criminal software can be effective for obfuscation, and highlights the need for extreme caution when analyzing overlapping clusters."

thehackernews.comMar 28, 2026extracted

APT28 Uses Microsoft Office CVE-2026-21509 in Espionage-Focused Malware Attacks

The Russia-linked state-sponsored threat actor known as APT28 (aka UAC-0001) has been attributed to attacks exploiting a newly disclosed security flaw in Microsoft Office as part of a campaign codenamed Operation Neusploit. Zscaler ThreatLabz said it observed the hacking group weaponizing the shortcoming on January 29, 2026, in attacks targeting users in Ukraine, Slovakia, and Romania, three days after Microsoft publicly disclosed the existence of the bug. The vulnerability in question is CVE-2026-21509 (CVSS score: 7.8), a security feature bypass in Microsoft Office that could allow an unauthorized attacker to send a specially crafted Office file and trigger it. The Microsoft Threat Intelligence Center (MSTIC), Microsoft Security Response Center (MSRC), and Office Product Group Security Team, along with Google Threat Intelligence Group (GTIG), have been credited with discovering and reporting the flaw. "Social engineering lures were crafted in both English and localized languages (Romanian, Slovak, and Ukrainian) to target the users in the respective countries," security researchers Sudeep Singh and Roy Tay said. "The threat actor employed server-side evasion techniques, responding with the malicious DLL only when requests originated from the targeted geographic region and included the correct User-Agent HTTP header." The attack chains, in a nutshell, entail the exploitation of the security hole by means of a malicious RTF file to deliver two different versions of a dropper, one that's designed to drop an Outlook email stealer called MiniDoor, and another, referred to as PixyNetLoader, that's responsible for the deployment of a COVENANT Grunt implant. The first dropper acts as a pathway for serving MiniDoor, a C++-based DLL file that steals a user's emails in various folders (Inbox, Junk, and Drafts) and forwards them to two hard-coded threat actor email addresses: ahmeclaw2002@outlook[.]com and ahmeclaw@proton[.]me. MiniDoor is assessed to be a stripped-down version of NotDoor (aka GONEPOSTAL), which was documented by S2 Grupo LAB52 in September 2025. In contrast, the second dropper, i.e., PixyNetLoader, is used to initiate a much more elaborate attack chain that involves delivering additional components embedded into it and setting up persistence on the host using COM object hijacking. Among the extracted payloads are a shellcode loader ("EhStoreShell.dll") and a PNG image ("SplashScreen.png"). The primary responsibility of the loader is to parse shellcode concealed using steganography within the image and execute it. That said, the loader only activates its malicious logic if the infected machine is not an analysis environment and when the host process that launched the DLL is "explorer.exe." The malware stays dormant if the conditions are not met. The extracted shellcode, ultimately, is used to load an embedded .NET assembly, which is nothing but a Grunt implant associated with the open source .NET COVENANT command-and-control (C2) framework. It's worth noting that APT28's use of the Grunt Stager was highlighted by Sekoia in September 2025 in connection with a campaign named Operation Phantom Net Voxel. "The PixyNetLoader infection chain shares notable overlap with Operation Phantom Net Voxel," Zscaler said. "Although the earlier campaign used a VBA macro, this activity replaces it with a DLL while retaining similar techniques, including (1) COM hijacking for execution, (2) DLL proxying, (3) XOR string encryption techniques, and (4) Covenant Grunt and its shellcode loader embedded in a PNG via steganography." The disclosure coincides with a report from the Computer Emergency Response Team of Ukraine (CERT-UA) that also warned of APT28's abuse of CVE-2026-21509 using Word documents to target more than 60 email addresses associated with central executive authorities in the country. Metadata analysis reveals that one of the lure documents was created on January 27, 2026. "During the investigation, it was found that opening the document using Microsoft Office leads to establishing a network connection to an external resource using the WebDAV protocol, followed by downloading a file with a shortcut file name containing program code designed to download and run an executable file," CERT-UA said. This, in turn, triggers an attack chain that's identical to PixyNetLoader, resulting in the deployment of the COVENANT framework's Grunt implant. Update In a new report published February 4, 2026, Trellix said it observed APT28 leveraging the Microsoft Office 1-day within 24 hours of its public revelation to target European military and government entities, particularly targeting maritime and transport organizations across Poland, Slovenia, Turkey, Greece, the U.A.E., and Ukraine. "This campaign features a multi-stage infection chain and novel payloads, including a simple initial loader, an Outlook VBA backdoor (NotDoor), and a custom C++ implant dubbed 'BEARDSHELL,'" researchers Pham Duy Phuc and Alex Lanstein said. "The threat actors abuse legitimate cloud storage (filen[.]io) as command-and-control (C2) infrastructure, blending malicious traffic with normal user activity." A variation of this exact attack chain was previously detailed by both the Computer Emergency Response Team of Ukraine (CERT-UA) and Sekoia last year. In these attacks, phishing emails with geopolitically-charged narratives related to transnational weapons smuggling, military training programs, and meteorological emergency bulletins contain weaponized documents that exploit CVE-2026-21509 as soon as they are opened, triggering the execution of malicious code without requiring macros or user interaction. This includes downloading a Microsoft Shortcut (LNK) and a DLL codenamed SimpleLoader that's responsible for either dropping NotDoor or the COVENANT Grunt Beacon that then contacts a filen[.]io endpoint to deliver the BEARDSHELL backdoor. "The entire chain is designed for resilience and evasion, utilizing encrypted payloads, legitimate cloud services for C2, in-memory execution, and process injection to minimize forensic artifacts," Trellix said. "This multi-layered approach demonstrates APT28's evolved tradecraft in maintaining persistent access while evading detection across enterprise environments." (The story was updated after publication on February 4, 2026, with insights from Trellix.)

thehackernews.comFeb 3, 2026extracted