stager

Some attacks take real skill. Others just need someone to leave a door open. This week has both. Exposed passwords, old bugs still getting exploited, and trusted software doing things it shouldn't. There's a strange mix of clever tricks and careless mistakes. Hackers are borrowing trust from familiar apps, websites, and AI tools. Some are using AI to speed things up. Others are leaving their

Government and policy organizations across Asia have become the target of a new campaign orchestrated by a China-nexus threat actor. The activity, which has targeted government and policy organizations in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, and Myanmar, involves the deployment of a previously undocumented backdoor codenamed Antino. Cisco Talos is tracking the cluster

Gli esperti di sicurezza informatica di Netskope hanno rilevato una vasta campagna malevola in cui gli attaccanti utilizzano oltre 5400 siti web compromessi per diffondere payload ClickFix . Il codice malevolo è memorizzato ne i contratti intelligenti di BNB Smart Chain (BSC) , il che complica notevolmente il blocco dell’infrastruttura degli hacker . Secondo le informazioni ottenute dai ricercatori , la maggior parte dei siti compromessi funzionano attraverso WordPress e PrestaShop e appartengono a piccole aziende. Tuttavia, non è ancora noto come gli attaccanti ottengano l’accesso iniziale a tali risorse. Su ogni sito compromesso, gli hacker inseriscono uno script che si collega agli endpoint RPC di BSC Testnet e quindi ottengono dal contratto intelligente i dati per la fase successiva dell’attacco. Questa tecnica di attacco è nota come EtherHiding , e implica che gli attaccanti posizionano il codice malevolo o le configurazioni nei contratti intelligenti su una blockchain pubblica. Grazie ai principi di funzionamento della blockchain, EtherHiding garantisce anonimato, resistenza al blocco e permette agli attaccanti di aggiornare i payload. Inoltre, il recupero del payload può avvenire tramite chiamate read-only che non lasciano una traccia visibile di transazioni, aggiungendo ulteriore segretezza al processo. Nella catena analizzata dagli esperti di Netskope, lo script caricato dal sito compromesso mostra ai visitatori un falso CAPTCHA. All’utente viene proposto di aprire la finestra “Esegui” in Windows e inserire lì un comando PowerShell. Se la vittima segue le istruzioni, il comando scarica ed esegue il payload finale . Inoltre, BSC Testnet è destinata agli sviluppatori e funziona quasi come la rete principale BSC, ma l’uso della rete di test è gratuito. Poiché il payload è memorizzato nel contratto intelligente, gli operatori della campagna possono cambiarlo in qualsiasi momento. In particolare, i ricercatori hanno notato che il payload ClickFix è stato sostituito da uno stager che utilizza WebRTC per la trasmissione dei dati. Lo stager apre un canale di comunicazione WebRTC crittografato con l’infrastruttura degli attaccanti, ma evita il handshake tradizionale. Normalmente, una parte forma una proposta per stabilire la connessione, la invia all’altra parte e riceve una risposta. In questo caso, lo script genera sia la proposta che la risposta, e poi le trasmette localmente alla connessione creata. Di conseguenza, lo scambio di dati con gli attaccanti inizia senza un handshake WebRTC completo. Successivamente, lo stager riceve un codice JavaScript da un indirizzo C2 predefinito, lo memorizza temporaneamente e lo esegue dopo la chiusura del canale o dopo 10 secondi. Il codice viene compilato direttamente nella memoria del browser e viene eseguito dinamicamente aggiungendolo all’elemento head del DOM, quindi nulla viene scritto sul disco della macchina della vittima. Nel complesso, durante il periodo di osservazione, i ricercatori hanno identificato oltre 5400 siti web compromessi coinvolti in questa campagna , e l’attività degli attaccanti è in aumento. Ad esempio, ad agosto 2026, sono stati osservati quasi 400 siti web compromessi al giorno, con un picco massimo di 536. Per la protezione, gli esperti raccomandano di bloccare l’intero pool di endpoint RPC di BSC Testnet , nonché di monitorare il traffico UDP non standard associato a WebRTC. L'articolo Quel CAPTCHA potrebbe rubarti il PC! 5.400 siti sono già infetti proviene da Red Hot Cyber .

North Korea-aligned threat actors have been using a new Linux toolkit in attacks targeting automotive and media organizations in South Korea, Rapid7 reports. Designed for long-term surveillance, the framework consists of a HAProxy instance called ‘ted backdoor’ and trojanized versions of tools such as ‘agetty’, ‘atd’, ‘crond’, ‘polkitd’, and ‘sshd’. The toolkit supports remote command execution, credential harvesting, and script injection into web traffic, enabling attackers to spy on victims for long periods of time without detection. According to Rapid7, the framework is deeply integrated within the target infrastructure, with the ted backdoor being compiled as part of the HAProxy version 2.8.12 running on the victim’s environment. “It uses its native filter API, internal memory pools, event scheduler, and process management infrastructure to intercept traffic and hide from monitoring, while genuine load balancing traffic operates as expected,” the cybersecurity firm explains. Likely in use since late 2024, when the first involved HAProxy iteration was released, the toolkit also uses a curl-based RAT, an SSH keylogger, and a stager. Initial access to an edge server was obtained through the exploitation of a Groupware login portal vulnerability. The SSH keylogger, which also serves as a staging server, was used for credential harvesting, enabling lateral movement to internal systems. “The stager checks for the presence of either crond or HAProxy, and only then deploys CurlRAT, retrieving it either from its data section or the edge web server. In parallel, the ted backdoor is dropped onto the HAProxy load balancer,” Rapid7 explains. The backdoor establishes C&C communication for data exfiltration, script injection, and command execution, and the balancer starts redirecting or serving malicious content to selected clients browsing through it. CurlRAT, the curl-based RAT deployed in the attacks, polls the C&C every 12 hours for commands. Based on these, it can decrypt and execute commands stored in its configuration, decode and write a new config payload to disk, and deploy a full interactive PTY shell. The ted backdoor is a custom HAProxy plugin compiled within the HAProxy source code, directly hooked into the balancer’s built-in HTTP parser. It can intercept and inject HTTP traffic, execute C&C tasks, and achieve persistence, among others. As part of the observed attacks, the threat actor used domains registered under low-cost commodity top-level domains (TLDs) and blended the payload delivery traffic into normal web browsing, mimicking Naver’s pstatic.net static content domain. “Ted backdoor and curlRAT were designed to persist during long-term espionage operations with the ability to steal cookie sessions, credentials, redirect selected users, conduct drive-by download attacks, and hide evidence of the tampered page to a specific range of IPs to evade detection,” Rapid7 notes. Attack artifacts recovered by the cybersecurity firm, along with the infrastructure used, point to watering-hole techniques previously used by APT37 and Lazarus, and the campaign timeframe overlaps with that of Operation SyncHole, attributed to Lazarus last year, which suggests that a North Korean threat actor might be behind this campaign as well. Related: US, Allies Warn of Russian Cyberattacks Targeting Critical Infrastructure Routers Related: EU Targets Russian Intelligence Officers Accused of Running Cyber Spying Campaign Related: China, India-Linked Hackers Both Targeted Same Pakistani Police Force

A massive cybercriminal operation is leveraging thousands of compromised small-business websites to deliver ClickFix payloads stored in smart contracts on the BNB Smart Chain (BSC). Over the past months, researchers identified more than 5,400 hacked websites, most of them built on WordPress and PrestaShop. The initial compromise method remains unknown, but each site was injected with a script that gets the next-stage payload from a smart contract on the BSC Testnet endpoint, a technique known as EtherHiding. Researchers at cloud security platform Netskope explain that the BSC Testnet is designed for developers and functions similarly to the mainnet, the production blockchain, but is available free of charge. Threat actors use the EtherHiding technique to store malicious code or configuration data in blockchain smart contracts, providing a resilient infrastructure that is difficult to take down. In the delivery chain observed by Netskope, the script displays a ClickFix lure that shows a fake CAPTCHA and instructs visitors to open the Windows Run dialog and paste a PowerShell command. Doing so downloads and executes the final payload on the machine. Because the attacker stores the payload in a smart contract, they can modify it at any time. The researchers note that later in the campaign, the threat actor replaced the ClickFix payload in the smart contract with a WebRTC data-channel stager. In the newer variant, the payload establishes a covert encrypted channel to the attacker and executes the received code. “The script creates a peer connection and a data channel, then generates the required session description offer just like a normal WebRTC handshake,” Netskope explains. “But instead of sending that offer anywhere and waiting for a real reply, it hand-writes the answer itself and feeds it straight back into the connection. This way, no handshake happens, but a data channel to the cyberattacker still opens.” The stager receives JavaScript code from the hardcoded command-and-control (C2) address, buffers it, and executes it when the channel closes or after ten seconds. Received code is assembled in the browser memory and executed dynamically without being saved to disk by adding it to the head of the DOM Netskope warns that the operation uses more than 300 infected websites every day. Since spring, the number of compromised sites contacting the BSC Testnet RPC endpoints has grown constantly. Telemetry data shows that nearly 400 websites called the endpoint every day in August, with an all-time peak of 536. The security researchers recommend that defenders block the entire pool of BSC testnet RPC endpoints provided here and monitor for non-web UDP traffic associated with WebRTC. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

A previously undocumented Linux toolkit has been found compiled directly into the trojanized HAProxy load balancers of two South Korean organizations, where it intercepted web traffic and served altered pages to selected visitors. The attackers named the implant ted in debug strings left in the binary. It is not a HAProxy vulnerability, and installing it requires code execution on the host and the ability to replace the running binary. Rapid7 Labs attributed the toolkit with medium confidence to North Korean state-sponsored actors and put the two victims in South Korea's automotive and media sectors. Command-and-control (C2) requests never reach a backend server and are erased from HAProxy's own connection counters, so neither the backend logs nor the load balancer's statistics record them. "Further evidence is necessary to make a more definitive assessment," Rapid7 said. A request for one specific image path puts the filter into C2 mode, Rapid7 said in a report published Friday. The implant decrements HAProxy's live connection counters, thereby dropping the connection from the load balancer's statistics. It writes the command body to a named pipe under /tmp. Zeroing the request channel afterwards leaves nothing to forward, and the command terminates at the load balancer. Output returns on the raw socket under a standard HTTP/1.0 200 OK header, which is what makes the exchange look like ordinary web traffic. Through that channel, the operator can beacon, upload and download files, run shell commands, and replace the implant's configuration. Only requests clearing four checks receive a modified page. The request has to carry a User-Agent and match a rule whose URL and referer patterns both fit. Delivery then falls to either whitelist membership on the client address, checked exactly and again at the /24 level, or an operator key in the Accept-Language header that overrides the address filtering entirely. The implant rewrites the content type and length on the way out, forces the response status to 200, and deletes the Accept-Ranges header so a client cannot request byte ranges and notice the size change. Rapid7 said its evidence was not enough to establish a timeline or determine how the attackers first got in. Its hypothesis that they came in through an exposed Groupware portal, a class of Korean enterprise collaboration software, rests on the ENKI research it points to. That report documented Kimsuky compromising a groupware vendor through a mail server flaw. The stager deploys only where HAProxy or cron is already running, and it verifies root before dropping anything. It overwrites the legitimate crond binary and gives the replacement the creation timestamp of /usr/bin/ssh. It then strips the keywords tmp, wget, cron and crond from root's bash history and from six system logs, among them auth.log and audit/audit.log. A trojanized sshd in the same toolkit encrypts captured plaintext passwords and writes them to a fixed path. Rapid7 found the same code in trojanized agetty, atd, and polkitd binaries. A companion remote access trojan (RAT) that Rapid7 calls curlRAT beacons every 12 hours by default and drops to a 30-second interval when the operator sets a flag. It aborts unless it finds a marker file showing the host is virtualized. curlRAT is distinct from CurlBack RAT, a separate family of that name attributed to the Pakistan-linked SideCopy group. Rapid7 shared the following indicators of compromise (IoCs) - Domain - img.monderhouse[.]space Domain - img.smartnords[.]site Domain - img.darklights[.]store Domain - img.responsive.pstatic[.]autos Domain - img.socialteams[.]store Domain - img.worksongo[.]store File - ~/cache/haproxy-1000.cache File - /var/lib/sshd/c8c68e629bba773a10ac80012d10bf19 File - /var/lib/snapd/g580 File - /tmp/jasper-log SHA-256 - 72e70936f0dbe459142a1d867617c35f8d0cce5d18c6a49e1090a2a5adc8e558 SHA-256 - 4bb923eb040aa13ca8fd409c31ee4729c60ddff32e350efe1c5a4a9168a065f5 The Hacker News confirmed on September 4 that none of the six domains resolves, returning NXDOMAIN, meaning no such name exists, for both A and NS records via Google Public DNS. They are useful for reviewing historical logs rather than for blocking live traffic. Part of the attribution rests on a listing of those domains under APT37 in maltrail, an open-source detection project. The maltrail file Rapid7 links stopped resolving after a repository restructure in August moved the project's static trail data elsewhere. The Hacker News confirmed on September 4 that all six are present at the new location, each labelled as APT37 infrastructure. maltrail's APT37 source file credits those entries to two posts on X from July 2025 and carries no reference to Rapid7. Six further domains sit in the same two maltrail entries but not in Rapid7's list: primgs[.]lol, admin.primgs[.]lol, grip-cdns[.]space, show.grip-cdns[.]space, cleanos[.]online and app.cleanos[.]online. Rapid7 has not said whether they are the same infrastructure. The ThreatFox tag Rapid7 names as its second source for the same domains records five sightings, all timestamped July 2, 2025. One of the two X posts maltrail cites was published three hours earlier that day. The attribution passage draws on three separate North Korean clusters, APT37 for the domain list, Lazarus for the delivery model, and Kimsuky for the initial-access hypothesis. Mandiant's 2023 assessment of North Korean cyber structure recorded shared tooling and overlapping targeting across those clusters. "We believe that this will make precise attribution more difficult," Mandiant said. Rapid7 compared the delivery model to the Operation SyncHole campaign, in which visitors to South Korean online media sites were filtered by a server-side script and redirected. Kaspersky researchers Sojun Ryu and Vasily Berdnikov assessed "with medium confidence" that the redirected page may have run a malicious script against a flaw in Cross EX, a South Korean browser helper. Kaspersky's SyncHole report identified at least six victims in the software, IT, financial, semiconductor manufacturing and telecommunications sectors. Both victims ran HAProxy 2.8.12, released on November 8, 2024 per HAProxy's own release history. The implant reads HAProxy's internal structures at offsets fixed to that release, and Rapid7 does not say whether other 2.8 builds exist. The current release on that branch is 2.8.28, from August 27, 2026, 16 point releases later. HAProxy's tracker lists 529 known bugs affecting 2.8.12 that are already fixed in the branch, including 1 critical and 16 major. Upgrading does not clean a host the implant already sits on, because the attackers replace the binary rather than exploit a flaw in it. Rapid7 recommended independent network correlation, memory behavioural analysis and binary integrity checks. The report publishes no detection rules for that last check, and a recompiled HAProxy reports the same version string as a clean build. The development comes as AhnLab and ENKI WhiteHat documented a similar watering-hole campaign in July, in which state-sponsored operators abused compromised Korean websites to attack the AnySign4PC signing client.

Between January and April 2026, we uncovered a coordinated social engineering operation that leveraged external Microsoft Teams accounts to masquerade as IT help desk personnel. Our telemetry reveals that this operation targeted more than 150 employees across at least 10 companies in various industries. We call this activity Spring Ring. What seems like a benign chat is in fact a voice phishing (vishing) call, during which adversaries try to coerce victims into executing remote monitoring and management (RMM) tools or custom malware. In a more advanced variant, attackers transitioned from a vishing call to a full-blown Microsoft NT LAN Manager (NTLM) relay attack aimed at an organization's domain controller (DC). We provide a technical breakdown of this operation’s attack lifecycle across two observed campaigns, both illustrating vishing manipulation that resulted in the attempted payload delivery via two distinct attack vectors. These two campaigns demonstrate the weaponization of communication platforms as identity becomes a primary attack vector. Palo Alto Networks customers are better protected from the threats described here through the following products and services: If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team. Spring Ring’s activity mirrors a broader trend in the threat landscape toward social engineering campaigns. According to our recently published Insights blog, threat actors have increasingly moved away from traditional phishing techniques toward trusted collaboration tools. In the first four months of 2026, phishing alerts from collaboration tools represented 42% of all phishing alerts in Cortex, up from 30% of all phishing alerts in the preceding four months. In addition, according to KnowBe4’s Phishing Threat Trends Report, Teams-based attacks rose by 41% [PDF] between October 2025 and March 2026. They note that this surge is driven by attackers exploiting the platform's default “Chat with Anyone” feature to initiate direct chats with users outside their organization. Previous Teams-based attacks, such as those by Cloaked Ursa (aka APT29), focused on credential harvesting and group chat-based social engineering. They often relied on malicious links or fake Entra ID tenants to appear legitimate. Spring Ring’s approach relies on active human voice interaction. In this way, attackers can evade detection without a software exploit. Instead, they rely on exploiting the trust that employees place in software as a service (SaaS) collaboration platforms. SaaS applications are essential for business operations, storing an organization’s most critical and sensitive data. Unlike email, where users are trained to look for external sender banners or suspicious links, communications platforms provide a closed loop that attackers exploit by: Leveraging platform trust: People are more likely to engage with a message from a help desk identity than a random email from an external domain Exploiting human interaction: A professional voice on an audio call creates a level of trust that is difficult to manufacture in text, making the victim more susceptible to manipulation Bypassing the monitoring gap: Voice calls are often less monitored, recorded or documented than employees’ digital file operations or email histories, providing attackers with a secluded environment to execute their lures The Spring Ring operation represents an evolution from previous campaigns by merging vishing into the Teams workflow. This shift moves the attack from a passive click-and-harvest model to a real-time engagement. Attackers can then pivot based on the victim's responses. Once the trust gap is crossed, the path to domain-level privileges via open-source tools like PetitPotam is short. Figure 1 shows an example of the warning that Teams users get when an external identity creates a chat with them. The Spring Ring campaigns are a coordinated operation that relies on impersonating corporate IT structures. Attackers can drop their lures into a victim's primary communication channel using external Microsoft Teams accounts. Our investigation into this activity began after the release of a new detection suite for Microsoft Teams. By monitoring these alerts, we identified a suspicious pattern of chat creation across multiple tenants. Further investigation into these alerts led to the initial discovery of 26 distinct identities approaching targets across different organizations. The attack begins with creating a Microsoft Teams chat using identities designed to mirror legitimate internal support units. The attackers opt for professional, urgency-focused display names such as help desk, IT assistance or support staff. To strengthen the impression of legitimacy, the attackers operate from external .onmicrosoft[.]com tenants. These are meant to resemble legitimate corporate infrastructure. They are used by attackers to provision Microsoft 365 tenants. The subdomains are controlled by the adversaries. Threat actors frequently abuse or subvert legitimate products for malicious purposes. This does not indicate that the product itself is flawed or compromised. Unit 42 has no evidence of any compromise or vulnerability within Microsoft's product related to this campaign. Here are examples of these subdomains: ithelp@InternalSystemsDaily[.]onmicrosoft[.]com HelpDesk@ITProtectionDepartment[.]onmicrosoft[.]com itadmin@MandatoryNetworkMonitoring[.]onmicrosoft[.]com Internal@InternalUSAHelpDeskIT[.]onmicrosoft[.]com ithelpdesk@CertifiedUpdateNetwork[.]onmicrosoft[.]com In some instances, the actors went beyond generic role names and used specific names to increase the perceived authenticity of the technician on the other end of the line: patrick[..]@infrastructureopsdesk.onmicrosoft[.]com robert[..]@systemdeploymentcenter.onmicrosoft[.]com clara[..]@systemsupportoperations.onmicrosoft[.]com Names have been partially redacted because the attackers used specific names of legitimate industry personnel. The use of these names does not indicate a compromise of their accounts. After the chat is created, the attacker initiates a voice call (the vishing element) to coerce the victim. After establishing a connection with what the victim believes is their own IT department, the attacker guides targeted employees through the steps to grant them remote control or execute malicious payloads. Our telemetry reveals that these attackers often make several attempts — including leaving voicemails — before establishing a connection. We observed the attackers engaging victims in calls that varied in duration: Many calls last only a few seconds or they are missed by the victim as the attacker cycles through targets Successful calls often last between 10 and 15 minutes Figure 2 shows several vishing attempts made by the same attacker identity on six different targets, with different conversation durations. The reach of these campaigns is significant: More than 10 tenants were attacked: We observed the campaigns targeting many organizations across different industries More than 150 targets were approached: The attackers contacted more than 150 individual employees Persistent activity: We tracked the campaigns since January 2026 over a period of several weeks. According to our telemetry, these campaigns were active up until April 2026. Once the attacker establishes trust through the initial vishing call, the Spring Ring campaigns transitioned into a technical execution phase designed to gain a permanent foothold. We provide a detailed analysis of two campaigns (Campaign A and Campaign B) that both began with a Microsoft Teams lure. They then diverged in their payload delivery, tool complexity and post-compromise activities. Figure 3 shows the full attack flow of the two campaigns' attack methods. In Campaign A, the attacker used a bring-your-own-tool approach, luring the victim to execute legitimate RMM software. The attacker posing as a technician walked the employee through launching built-in Windows tools like Quick Assist or downloading third-party RMM software. Once the RMM tool ran, the attacker could request remote control of the victim’s machine. After gaining remote control, the attacker performed a series of basic enumeration commands to gain information on the host and domain. We observed them executing: After confirming the environment's value, the attacker pivots to payload delivery. The attacker used a PowerShell command line to download an obfuscated PowerShell-based remote access Trojan (RAT) from the attacker-controlled domain, san-sid[.]com. This malware used variable manipulations and arithmetic obfuscation designed to evade automated security analysis and sandbox detection. By leveraging advanced AI and pattern-matching algorithms, we were able to de-obfuscate the RAT. We started by stripping away anti-analysis bloat from the code that was used to cause a time-out for deobfuscation tools. The actual payload is a tiny, nine-line command and control (C2) stager. The script disables Antimalware Scan Interface (AMSI) via the amsiInitFailed flag and executes a test scan to verify the bypass. Upon verification, the script encrypts host data and beacons out to san-sid[.]com to download and execute further payloads. Figure 4 shows a snippet of the obfuscated PowerShell-based RAT. This campaign was blocked by automated Cortex XDR Agent protections during the malware's execution phase. The second campaign used a more customized delivery method. During the vishing call, the attacker directed the victim to a cloud endpoint. The attackers tailored the cloud infrastructure and filenames to match the targeted organization and the specific user, for example: -org-filters-update- .s3.us-west-2.amazonaws[.]com When the victim clicked a link containing their own company's name and downloaded -org-filters-update- [.]exe, it triggered an execution chain: Staging and persistence: The executable moved itself to the \Temp\ directory and spawned copies (e.g., vhlp-*.exe and scnr-*.exe) as a persistence mechanism Browser hijacking: The malware launched a hidden, headless instance of Microsoft Edge, and the attackers wrote to the disk and sideloaded an Edge extension Lateral movement and authentication coercion: The attackers used Python (C:\ProgramData\IntegrityData\python.exe) to initiate a lateral movement sequence: - SMB scanning: Initiated port 445 traffic targeting internal servers - NTLM authentication: Generated NTLM traffic targeting the organization's DC - PetitPotam exploitation: The attacker attempted a PetitPotam attack to coerce the DC into authenticating back to an attacker-controlled machine. This NTLM relay attack was designed to grant the attacker domain-level privileges After attempting to coerce the DC, the attacker's domain-takeover attempt was blocked by Unit 42 Managed Detection and Response. By comparing the two campaign paths, we can better understand the diversity of threats targeting collaboration platforms. Table 1 compares the campaigns' specific methods of attack. Table 1. Comparing the two campaigns’ methods. This comparison highlights an important point for defenders. A simple vishing hook can lead to either a standard malware infection, or to a serious domain-level breach if the attacker pivots to payload delivery. Recognizing campaigns like Spring Ring requires a strategy of profiling external and internal entity behaviors. The attackers behind these campaigns operate within a legitimate ecosystem, so detection hinges on identifying small anomalies in how external identities interact with your organization. The first line of defense is recognizing the markers of the external actor. Our research into these campaigns highlights several consistent patterns: Spoofed domain naming: Attackers mostly use external .onmicrosoft[.]com tenants that include keywords like internal, certified, network or infrastructure to project authority Persona mimicry: They use professional display names, like IT help desk or admin, to increase the perceived authenticity of the technician during vishing calls Infrastructure red flag: The source IP addresses for these connections often originate from commercial VPN services to mask the attacker's true location Our researchers were able to identify key markers of Spring Ring activity by analyzing the metadata of these interactions, despite the deceptive nature of the attacker’s initial lures: The chat-to-call ratio: A primary indicator is the rapid transition from a 1:1 chat request to an unsolicited audio call Call curation profiling: Attackers cycle through targets quickly. We observed call patterns ranging from 30-second initial attempts to 15-minute sessions. Multiple approaches: These actors demonstrate high operational volume, often approaching 5-6 identities within a matter of minutes using one of their spoofed identities Upon a successful compromise, we observed endpoint activity characterized by: Atypical execution of RMM tools by users who do not require remote support Access to unknown links, including cloud storage URLs or other file hosting servers that victims might be lured to access Organizations can identify the Spring Ring lifecycle before the attacker transitions from a chat to a domain-level attack, by profiling these signals, the origin of the tenant and the subsequent attack flow. Figure 5 shows one example of a Cortex alert on a new suspicious conversation created in Microsoft Teams. This alert is based on behavioral and metadata analysis of a newly created chat. The Spring Ring campaigns demonstrate a strategic pivot in social engineering, where attackers move beyond email phishing to enterprise collaboration tools. Attackers turn an important productivity tool into a conduit for domain-level exploitation, masquerading as internal help desk personnel through vishing calls. This activity highlights an important shift in the security landscape. Identity is now a primary perimeter, and the platforms we rely on for daily communication are being weaponized. Looking forward, attackers might further refine their ability to operate within SaaS ecosystems. These platforms are not just an initial access vector, they contain sensitive documentation, workflows and communication logs that could allow an adversary to advance their attack chain. Our analysis of the Spring Ring operation reinforces several key lessons: Trusted SaaS applications are not inherently safe: Attackers exploit the confidence that employees place in communications platforms Attack vectors are simple and scalable: By using seemingly legitimate external tenants and professional vishing lures, attackers can target hundreds of employees across many industries with minimal friction Adaptability is key: Attackers are evolving their methods, shifting from basic credential harvesting to human-led lateral movement As these threats evolve, organizations must prioritize user education regarding unsolicited external communication across collaboration platforms. Robust behavioral monitoring can help identify identity-based anomalies before they escalate to lateral movement. Palo Alto Networks customers are better protected from the threats discussed above through the following products: Advanced URL Filtering and Advanced DNS Security identify known domains and URLs associated with this activity as malicious. Cortex XDR and XSIAM can help prevent the execution of both known and unknown malware through Behavioral Threat Protection and machine learning powered by the Local Analysis module. Beyond stopping initial execution via malicious droppers, Cortex XDR actively halts post-exploitation activities, such as PetitPotam NTLM relay attacks, before adversaries can achieve lateral movement. Cortex Cloud Identity Threat Detection can help deliver real-time protection against identity-based threats across cloud providers, IdPs, and SaaS applications. Using advanced behavioral analytics on real-time telemetry, ITDR baselines access patterns to detect anomalies, track complex attack chains—such as the Spring Ring lifecycle and trigger automated responses to contain compromised credentials. The Cortex Advanced Email Security module can help extend the power of the Cortex platform into cloud-hosted email environments, providing a scalable, AI-driven layer for detection, investigation, and response. By automatically stopping email threats and malicious communications across enterprise environments, it provides seamless protection across one of your most vulnerable attack vectors. Idira Threat Detection and Response can help enable security teams to counter identity-based attacks targeting Idira Next Generation Identity (NGI) Platform and the identities it secures. Using near real-time detection, powered by CORA AI, and leveraging Idira’s visibility across multiple contexts (like PAM, authentication, SSO, cloud, endpoints, browsers, and more), Idira ITP can apply automated, tailored non-disruptive in-session response to contain and minimize potential identity-based threats. Idira Endpoint Privilege Manager can help enable enterprises to reduce risk, satisfy compliance, and streamline operations. It helps implement least privilege via policy-driven elevation and removal of standing admin rights, and blocks risky actions, such as execution of unvetted applications and access to memory of other processes, while providing audit-ready evidence and unified identity governance. Automation and consolidation improve efficiency and support Zero Trust strategies, strengthening security without slowing the business. Idira Privileged Access Management can help unify privileged access across human, machine, and agentic identities to secure cloud access across multi-cloud environments. Building on proven PAM, it delivers centralized secrets management alongside modern controls like Just-in-Time access and Zero Standing Privileges. This enforces consistent least-privilege security across on-premises, cloud, and SaaS targets. Idira Secure Infrastructure Access can help enforce Zero Standing Privileges (ZSP) through Just-in-Time (JIT) provisioning which grants temporary, tightly scoped access only as needed. Backed by continuous session recording and real-time command monitoring, SIA can detect high risk actions before an attacker compromises critical systems. If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call: North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42) UK: +44.20.3743.3660 Europe and Middle East: +31.20.299.3130 Asia: +65.6983.8730 Japan: +81.50.1790.0200 Australia: +61.2.4062.7950 India: 000 800 050 45107 South Korea: +82.080.467.8774 Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance. Attacker Identities Used in Vishing Attempts – Generic helpcenter@ithelpcenter365[.]onmicrosoft[.]com helpdesk@itprotectiondepartment[.]onmicrosoft[.]com helpdesk@newsystemmaintenance[.]onmicrosoft[.]com helpdesk@officedesk365[.]onmicrosoft[.]com helpdesk@officesecures[.]onmicrosoft[.]com helpdesk@tbcsschid[.]onmicrosoft[.]com internal@internalusahelpdeskIT[.]onmicrosoft[.]com it_assistance@teams0137[.]onmicrosoft[.]com it@infrastructurefirewall[.]onmicrosoft[.]com itadmin@mandatorynetworkmonitoring[.]onmicrosoft[.]com itassistant@bilelonellc[.]onmicrosoft[.]com ithelp@certifiednetworksec[.]onmicrosoft[.]com ithelp@internalsystemsdaily[.]onmicrosoft[.]com ithelp@itprotectiondepartment[.]onmicrosoft[.]com [email protected][.]com ithelpdesk@certifiedupdatenetwork[.]onmicrosoft[.]com support@bilelonellc[.]onmicrosoft[.]com Attacker Identities Used in Vishing Attempts – Usernames Names have been partially redacted to protect the users associated with accounts that were impersonated by the attackers. andreas[..]@idigitalserviceoperation.onmicrosoft[.]com andrew[..]@hapsinfrastructureops.onmicrosoft[.]com brandon[..]@devsitoperationhub.onmicrosoft[.]com brian[..]@appssupportsys.onmicrosoft[.]com christopher[..]@adevpsitplatformops.onmicrosoft[.]com christopher[..]@itplatformops.onmicrosoft[.]com christopher[..]@helpaphelpitinfraops.onmicrosoft[.]com clara[..]@systemsupportoperations.onmicrosoft[.]com daniel[..]@opsnetsupportit.onmicrosoft[.]com daniel[..]@apsitsupporthub.onmicrosoft[.]com emily[..]@apsitechsupportdesk.onmicrosoft[.]com eric[..]@appopshelp.onmicrosoft[.]com henrik[..]@enterpriseoperationsflo.onmicrosoft[.]com james[..]@helpitsupportcore.onmicrosoft[.]com james[..]@itcoretechhelp.onmicrosoft[.]com jonathan[..]@itservicedesk.onmicrosoft[.]com justin[..]@techopshelpsupp.onmicrosoft[.]com kevin[..]@itopsupportdesk.onmicrosoft[.]com kevin[..]@netopsdeskhelp.onmicrosoft[.]com leon[..]@netcorevdapp.onmicrosoft[.]com lucas[..]@applicationoperationsunit.onmicrosoft[.]com martin[..]@syslanevdapp.onmicrosoft[.]com matthew[..]@supportopsupp.onmicrosoft[.]com michael[..]@appdeploymentservices.onmicrosoft[.]com michael[..]@infratechopsdesk.onmicrosoft[.]com michael[..]@itopsdeskhelp.onmicrosoft[.]com patrick[..]@infrastructureopsdesk.onmicrosoft[.]com rachel[..]@ioseccloudsupport.onmicrosoft[.]com rebecca[..]@infrastructureopsservice.onmicrosoft[.]com robert[..]@systemdeploymentcenter.onmicrosoft[.]com ryan[..]@apstechopsdeskdev.onmicrosoft[.]com ryan[..]@helpssupportcloudops.onmicrosoft[.]com ryan[..]@seqhelpitsuppnetops.onmicrosoft[.]com sarah[..]@secinfrahelpdesk.onmicrosoft[.]com sarah[..]@apsscloudopsdesk.onmicrosoft[.]com sarah[..]@helpitdevsupportops.onmicrosoft[.]com sarah[..]@itdevsupportops.onmicrosoft[.]com scott[..]@cloudinfrastr.onmicrosoft[.]com steven[..]@ittechnologyopsitdesk.onmicrosoft[.]com thomas[..]@networkoperationsec.onmicrosoft[.]com thomas[..]@seqapsitsupportops.onmicrosoft[.]com Infrastructure Used in Vishing Attempts (VPNs and Proxies) 193.32.248[.]251 193.138.7[.]142 185.65.134[.]209 178.130.47[.]46 5.181.3[.]106 2.56.172[.]214 185.234.67[.]53 45.8.157[.]185 80.66.72[.]215 136.0.20[.]6 185.213.155[.]226 185.155.99[.]161 92.118.232[.]131 45.182.189[.]80 185.65.133[.]51 45.33.22[.]47 Malicious Files From Post-Compromise Activity (Campaign A) SHA256 hash: 24ab9fe5d5be62d3bf055a0ca4508e8bca2996b6d78649dce8145d8a27bc1c5b (obfuscated PowerShell payload) File description: Obfuscated PowerShell RAT dropper downloaded via Invoke-WebRequest URL: hxxps[:]//san-sid[.]com/owners Description: URL hosting obfuscated PowerShell payload used as RAT dropper Table 2 lists the Cortex XDR alerts and the associated MITRE ATT&CK techniques these alerts detect. Table 2. Cortex XDR alerts and MITRE techniques. When “Hi, This Is IT” Comes Through Microsoft Teams – Unit 42, Palo Alto Networks Cortex ITDR: Cyber Threats in Microsoft Teams and Their Detection – Palo Alto Networks Quick, You Need Assistance! – Fieldeffect PetitPotam – by topotam on GitHub APT29 Phishing Attacks via Microsoft Teams: Tactics, Techniques, and Prevention – InsiderSecurity Phishing Threat Trends Report [PDF] – KnowBe4 Cross‑tenant helpdesk impersonation to data exfiltration: A human-operated intrusion playbook – Microsoft

CRPx0, a cybercrime crew that has rapidly evolved from a scam service to a ClickFix-delivered ransomware and crypto-theft business over the summer, claims its victim count jumped from fewer than 10 in June to 48 organizations on its clear-web leak site at the time of publication. Keep in mind: criminals aren’t always the most trustworthy bunch, so take their claims with a healthy dose of salt. Still, the ransomware biz’s expanding operations, unique payload, and white-label hacking service make it one to watch, and a few recent analyses provide tips for defenders to keep the crooks out of their IT environments. Rakesh Krishnan, a threat-intel analyst who writes about cybercrime investigations on TheRavenFile blog, was one of the first researchers to publish details about CRPx0 at the beginning of the month, including previously unreleased malware samples. The operators offer a hacking service, providing “complete database extraction” from victim organizations and “optional public leak coordination upon request.” This platform also advertises full network compromise, “from initial access, through lateral movement, to full domain compromise,” plus persistent access across the victim’s infrastructure. A second, white-label, ransomware-as-a-service platform makes it really easy for wannabe crooks to get into the data-theft and extortion biz. CRPx0 builds, deploys, and configures everything from command-and-control infrastructure to the negotiation panel and malware, allowing its criminal customers to bring their own brand identity to their operations - and originally offered these services for a $10,000 one-time fee. At first, the operators promised to allow affiliates to keep 100 percent of their profits - this is unheard of in ransomware-as-a-service operations. This has since shifted to a 70-30 model, with affiliates receiving 70 percent of the extortion payments (after a one-time $333 enrollment fee) and the remaining 30 percent going to the operators. CRPx0 rules prohibit affiliates from infecting Commonwealth of Independent States (CIS) member countries and organizations based in these countries. This is a pretty common rule among Russia-based ransomware operations, and in an earlier interview with The Register, Recorded Future threat intelligence analyst Allan Liska called it the “first rule of ransomware club: you don't attack organizations in the Commonwealth of Independent States.” The gang also prefers Monero (XMR) payments, rather than Bitcoin (BTC). ClickFix ransomware delivery Affiliates can also customize their own ClickFix payload delivery. The operators offer two lures, a fake Windows Update and a fake Google reCAPTCHA, to socially engineer victims into executing the initial command, according to a Ransom-ISAC research team analysis published on Thursday. The Windows lure tricks a victim into pasting a PowerShell command into the Run dialog. This drops a DLL stager chain and ultimately deploys Python-based ransomware. The macOS lure, however, uses a curl|bash command that downloads portable Python and the ransomware directly. The lures and the rest of CRPx0’s malware run on Windows and macOS, and according to the researchers, there are four payload formats: “the two HTML lures plus a standalone DLL and a standalone EXE, both of which discard the social engineering step entirely.” All four deliver the same ransomware: a 1,769-line Python script that steals high-value files before encrypting them with AES-128-CBC (Fernet). The malware moves laterally via WMI/schtasks, and delivers a ransom note that gives victims a 48-hour deadline to pay up - or see their files leaked. 'Complete, professional offensive control center' On August 23, the CRPx0 operators published a v3.0 update note on the group’s clearnet leak site, promising “a complete, professional offensive control center for managing compromised remote machines from a single web dashboard.” It provides crims with tools to steal valuable files, credentials, and wallet recovery phrases and keys, while “watching stolen cryptocurrency wallet addresses flow in.” This service also provides scripts to run remote commands, and the control panel sets up “automated attack reactions that fire on their own when something valuable happens on a target.” As the operators note: “Everything is built to be operated by a human with no technical background: point-and-click panels, plain-language rules, and clear status indicators. The underlying attack engine is hidden behind a clean, dark-themed interface.” CRPx0’s hacking and ransomware services, enabling everything from crypto theft to encryptors and full network compromise, “could be a strategic move to attract new recruits, or a scam targeting a range of affiliate hopefuls seeking cybercrime services,” according to an August 12 analysis from Jade Brown, a threat researcher at Bitdefender. What defenders should do Still, “other threat actors may attempt to adopt similar techniques,” she warns. “This is a reminder that organizations should balance detection capabilities in preparation for different types of compromises, configuring technologies to detect and block malicious behavior that aligns with both crypto theft and encryption processes.” The Ransomware-ISAC team says defenders should prioritize five actions, in this order. “The first three cost nothing and blunt the entire ClickFix class of attack, not just CRPx0,” they note. First: remove the Run dialog for standard users - this will entirely block the Windows path. For macOS users: restrict Terminal via MDM for non-technical staff. Next, the threat-intel analysts advise defenders to alert on RunMRU writes containing powershell, curl or long base64 strings. “Every ClickFix victim leaves a trace at HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU,” they wrote. “This is the highest-fidelity ClickFix detection available and it is trivial to deploy.” The team also lists adversary network indicators and suggests blocking those. Make sure to hunt for indicators and malicious behavior in the pre-encryption exfiltration window. “Data leaves before a single file is encrypted, so .crpx0 extensions and ransom notes are a post-mortem indicator, not a warning,” according to the Ransomware-ISAC. Finally, confirm backups are unreachable from the account that would be compromised, and treat anything reachable with the victim's credentials as destroyed. ®

Individuals and organizations in Cambodia have emerged as the target of a new campaign that delivers an open-source remote access trojan (RAT) called Spark RAT. "The samples employ diverse lure themes, suggesting an effort to appeal to a broad range of potential victims. These include government notices, public health materials, real estate-related content, and other topics," Acronis Threat Research Unit (TRU) researchers Darrel Virtusio and Subhajeet Singha said in an analysis published Wednesday. The multi-stage attack is notable for employing the bring your own vulnerable driver (BYOVD) technique to load a legitimate-but-vulnerable driver associated with OPSWAT AppRemover ("ardrv.sys") to escalate privileges and neutralize security software. Attack chains likely make use of targeting phishing emails to distribute compressed archives containing an Inno Setup executable and trick recipients into running it using wide-ranging lures, including Cambodian government notices, public health announcements, dental examination records, real estate documents, and promotional offers. Acronis said it discovered a number of malicious artifacts between late June through early August 2026, although it's unclear if the campaign remains ongoing. The Inno Setup installer is designed to trigger a DLL side-loading chain using a signed Tencent executable, which then delivers interim payloads responsible for deploying the vulnerable "ardrv.sys" and then launching the Spark RAT payload. Spark RAT is an open-source, Go-based cross-platform RAT that enables remote control of compromised devices. The DLL loader also carries out a timing-based anti-sandbox check to detect environments that shorten or manipulate sleep delays, and proceeds to terminate execution if the elapsed time falls outside the expected range. Furthermore, it reviews running processes for those related to Huorong Internet Security ("HipsTray.exe"), a Chinese endpoint security program. If the process is present, the loader attempts to weaken the privileges of the security product. In the next stage, it decrypts shellcode concealed within a PNG file present in the archive to run a second stager, which verifies if it is running with SYSTEM privileges. "Based on these checks, the payload selects one of two execution modes," Acronis said. "If it is already running as SYSTEM, it proceeds directly to inject mode, bypassing the persistence setup and executing the next stage. Otherwise, it enters setup mode, where it establishes persistence first, then executes the next stage." The inject mode works by parsing and decrypting shellcode embedded in another PNG file from the archive, and then injecting it into "vssvc.exe" and executing it within the context of the target process. To ensure the injected payload remains running, it monitors the "vssvc.exe" instance and re-injects the shellcode if the process terminates or restarts with a new PID. In the setup mode, the malware reads and decrypts the shellcode from the same file, after which it checks for a list of hard-coded processes associated with Qihoo 360. If none of them are found, it sets up a Windows service-based persistence mechanism to launch the binary that sideloads the DLL to relaunch the entire cycle all over again. After establishing persistence on the host, it injects the shellcode into "vssvc.exe" like before. The payload performs the following sequence of actions - Attempt to patch AMSI and ETW related functionality Setup persistence using a scheduled task Install the ardrv.sys driver that's vulnerable to CVE-2026-36425 to terminate security-related processes such as Microsoft Defender, Huorong Internet Security, and Tencent PC Manager Read and decrypt another embedded payload from a third PNG file to perform user-mode termination of hard-coded security processes Simultaneously, a fourth PNG-based payload file is processed to extract and decrypt shellcode that's injected into "ctfmon.exe," ultimately leading to the execution of Spark RAT. Interestingly, the BYOVD routine references a number of other drivers, including those part of TrueSight and Zemana Anti-Malware SDK, both of which have been put to use by the Silver Fox threat actor prior to dropping Winos 4.0 (aka ValleyRAT). In addition, the targeting of Huorong security processes has been repeatedly observed in past Silver Fox-related attacks. Other Silver Fox-style indicators include targeting overlaps, the use of DLL sideloading through a signed application, multi-stage payload delivery, persistence through Windows services and scheduled tasks, and Microsoft Defender exclusions. Despite these similarities, there is not enough evidence to definitively attribute the latest activity to the threat actor. This assessment, Acronis said, is based on the absence of shared infrastructure, function-level code reuse, and matching certificates. Another crucial differentiator is the choice of the malware itself. While Silver Fox campaigns are known to leverage ValleyRAT and other custom payloads, it has not been attributed to the deployment of an open-source RAT. "This difference does not rule out a relationship, since operators can change payloads, but it removes one of the stronger links used in previous attributions," the cybersecurity company added. "The Spark RAT configuration contains a Chinese-language value, and the malware targets several security products commonly used in Chinese-speaking environments." "We therefore track the activity as an unattributed cluster with possible Chinese-language development or deployment links and operational similarities to the broader Silver Fox ecosystem. This assessment remains low confidence and may change if additional code, infrastructure, victimology, or other attributional evidence is identified."

Threat actors are abusing FTP banners to hide commands that deliver two previously undocumented remote access trojans named E4del and PINHOLE. MalwareHunterTeam observed this unusual technique in July in an attack that used shortcut files (.LNK) and FTP server banners as dead-drop resolvers (DDR) to retrieve commands. FTP banners are text strings the server uses as a greeting message for connecting hosts before they log in. By embedding commands in the initial response sent when a compromised system connects to an FTP server, a malware stager can receive instructions from a remote server. After discovering FTP banners being used to deliver malicious commands during an investigation, researchers at threat intelligence platform SOCRadar expanded their hunt and found that the technique remains in use. "By utilizing FOFA searches, we determined that this technique has been weaponized since early July 2026 and remains operational, with new infrastructure observed as recently as August 2026." In a report shared with BleepingComputer, SOCRadar says that the observed attacks start with a ZIP archive that triggers an LNK-based infection chain. The researchers note that the initial compromise likely occurs through phishing. The infection chain delivers two remote access trojans (RATs) named E4del and PINHOLE via two distinct infection routes, both retrieving a PowerShell script from FTP banners. E4del is a Node.js-based RAT packaged inside a digitally signed Electron application that masquerades as Discord. The RAT supports running commands through persistent or temporary shells, capturing screenshots, streaming the desktop over WebSockets, and downloading and executing additional payloads. SOCRadar also mentions a Node.js module named crypto32.node that attempts privilege escalation, but the researchers could not retrieve it for analysis. PINHOLE retrieves its C2 configuration from Pinterest pins and SurveyMonkey survey questions, a tactic that offers versatility and resilience to take-downs. The malware leaves a minimal footprint on the host, using shellcode fluctuation to keep only one 4KB section of the payload in memory at a time, and injecting the final assembly into a suspended ApplicationFrameHost.exe process via Early Bird APC injection. PINHOLE supports 14 commands, including file enumeration, uploading and downloading files, command execution, process management, capturing screenshots, and deploying a module for stealing credentials stored in browsers. At the time of analysis, the PINHOLE script counted only 11 execution events, suggesting that the campaign was in an early stage. While abusing FTP banners to deliver commands is a novel alternative, SOCRadar says that the approach is less stealthy than traditional web-based DDRs (e.g., X, GitHub, YouTube) because FTP connections to unknown servers are more likely to stand out. “While threat actors typically utilize legitimate web services, such as X, GitHub, or YouTube, to provide cover through high-volume, expected network traffic, FTP banners represent a novel alternative." The researchers note that the technique is very versatile and could "easily" be adapted for ClickFix social engineering campaigns. SOCRadar's report provides indicators of compromise that could help defenders identify the malicious infrastructure as well as infected machines on the network. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

A new Russian loader-as-a-service (LaaS) codenamed DOUBLECUP has been using ClickFix lures as a way to stage malware-laced PNG images in victims' browser cache and ultimately deliver CountLoader and a previously undocumented remote access trojan called DeviceManager. "The first stage drops a steganographic PNG image into the browser's cache, retrieves its hidden content, and executes the second stage," SOCRadar said in a technical report. "This second stage decrypts the final payload in memory via a custom SHA-256 stream cipher in Counter (CTR) mode along with bitwise XOR using the victim's public IP address as the cryptographic key." Payloads delivered via the loader service include CountLoader, with variants for both Windows and macOS, and DeviceManager, which utilizes EtherHiding to resolve its command-and-control (C2) infrastructure and communicate with the server over HTTP or DNS tunneling. The service is assessed to be active since early June 2026, with the core developers providing operators with licenses and a client agent to help create campaigns and load payloads by embedding the required code in their ClickFix landing pages. Each license comes with a unique key and contains metadata including the client's IP address, active days, label, and version. Multiple campaigns can be orchestrated per license. SOCRadar said its investigation sprang forth from an open directory at "213.139.77[.]109:9090" that left several testing files that were later identified as part of the DOUBLECUP license panel. The Go-based Windows GUI client also offers operators the ability to update configurations, update the software, and issue commands directly via a Broadcast Pane, while a Payload Builder Pane allows threat actors to set up the command that's triggered via a ClickFix decoy. This involves setting up the domain, slug, steganography method, embed type, archive format, action, and payload URLs. "This generates a configuration endpoint at https://{domain}/{slug}/api/config," SOCRadar said. "A GET request to this endpoint returns DOUBLECUP's configuration data, which includes the steganographic image URL hosted on the target domain, image size, the session endpoint, and browser-specific commands tailored for Chrome, Edge, Firefox, Brave, and Opera." The attack also requires operators to inject necessary frontend code onto their ClickFix site to trigger the malicious code. This involves the following steps - Fetching the /api/config endpoint, prefetching the steganographic image, registering a session, and evaluating the browser User-Agent string to select the appropriate browser payload Displaying ClickFix instructions, copying the browser-matched command to the victim's clipboard, and initiating a polling mechanism to execute the final redirect Operators can opt to incorporate additional obfuscation or anti-analysis mechanisms into their payloads, but these extra steps remain solely their responsibility. Meanwhile, a Telegram bot (@harrypoterlohBOT) is used to track client visits, send commands, deliver keys, and receive payload callbacks via a designated DOUBLECUP URL. Interestingly, the bot is managed by a threat actor named "johnnysilverhe," who has also published a suspicious Microsoft Visual Studio Code (VS Code) extension named Agent IDE in the official marketplace. Campaigns using DOUBLECUP have leveraged a cluster of bogus sites impersonating CRM login pages, including NetSuite, Odoo, HubSpot, and Salesforce, to deliver the loader via embedded iframe elements, which then pave the way for ClickFix commands that, upon execution, search the browser cache for the PNG image and extract from it malicious JavaScript, VBScript, or PowerShell to launch the next-stage component. At this point, the C2 server is notified of a successful infection. The second-stage then acts as a dropper to deploy an encrypted payload and then redirect the victim to a destination page. The payload employs environmental keying as an anti-analysis technique to ensure that it's unpacked only on the victim's machine. This is accomplished by passing the victim machine's public IPv4 address as a seed into a key derivation function to generate the cryptographic key necessary to decode the payload. The decryption process fails on any machine other than the intended target, as it would yield the wrong key. The attack chain ends with the stager reconstructing the final payload and executing it. One of the malware families propagated via this method is an updated Windows and macOS version of CountLoader, which comes with new capabilities to establish persistence using scheduled tasks, audit installed browser extensions for cryptocurrency wallets, and profile the host to check if Signal's desktop app is installed. "CountLoader also includes a function that scans the desktop and start menu for shortcuts (.LNK files) belonging to popular web browsers," SOCRadar explained. "It rewrites the target of these shortcuts so that when the user double-clicks their browser shortcut, it secretly launches the intended browser and the RAT in the background." "However, this function is never invoked, indicating it may be an incomplete feature or dead code under development." The primary objective of CountLoader is to connect to a C2 server, gather system metadata and exfiltrate it, and await further tasks from the operator, allowing it to run secondary executables, DLLs, MSI, or HTML Application (HTA) files, download a compressed archive, extract its contents, and run the main binary present within the extracted folder, and clean up persistence mechanisms likely to erase forensic evidence. There exists an equivalent macOS version of CountLoader that features the same functionality as its Windows PowerShell variant, but adapts its persistence and reconnaissance methods for Apple's desktop operating system. The second payload delivered via the DOUBLECUP infrastructure is a modular Python-based RAT codenamed DeviceManager that utilizes the blockchain as a dead drop resolver to fetch the C2 server details, a technique known as EtherHiding. Specifically, the trojan dynamically resolves its active C2 nodes via Ethereum/Polygon smart contracts before establishing C2 communications. DeviceManager is distributed as a Delphi-compiled Inno Setup installer that embeds the encrypted payload. Once launched, it extracts a full embedded Python environment to spawn the Python malware. At the same time, it deliberately avoids executing on machines that resolve to Commonwealth of Independent States (CIS) language locales. "If a target CIS language is detected, DeviceManager executes a self-deletion routine: it removes its scheduled task, deletes its installation directory via cmd.exe, and terminates process execution," the cybersecurity company said. The malware then proceeds to collect extensive device information, use Etherhiding to extract the C2 server ("91.92.240[.]100"), and communicate with it using DNS or HTTP to exfiltrate system data, poll for tasks, download payloads, send command execution results, and report task status. DeviceManager is equipped to run PowerShell and Python scripts, as well as pipe operator-issued commands into "cmd.exe." "DOUBLECUP highlights the expanding reach of ClickFix campaigns, providing threat actors with a low-friction, highly reliable payload delivery pipeline," SOCRadar said. "Built with evasion at its core, DOUBLECUP leverages steganography and environmental keying to bypass defenses." "CountLoader evades process monitoring by copying and header-patching legitimate Windows binaries, while DeviceManager utilizes smart contracts on the Ethereum/Polygon blockchains for resilient C2 infrastructure resolution."

More on the OpenAI Agent’s Attack on Hugging Face Hugging Face has published a detailed timeline of the attack. From the summary: The agent was running an internal OpenAI cyber-capability evaluation based on the ExploitGym benchmark, which tasks an AI agent with finding and exploiting software vulnerabilities. OpenAI ran this on its own infrastructure, and the ExploitGym maintainers and their infrastructure had no involvement in the deployment or operation of that evaluation environment. As far as we were able to infer, across the course of being evaluated on this benchmark, the agent inferred that Hugging Face may host that benchmark’s models, datasets, and reference solutions. We believe the entire intrusion was, from the agent’s point of view, an attempt to cheat the evaluation: reach our production systems and steal the test solutions rather than solve the challenge on its own. Our forensic reconstruction covers ~17,600 attacker actions that we were able to recover, grouped into ~6,280 clusters, between 2026-07-09 02:28 UTC and 2026-07-13 14:14 UTC. We reconstructed these actions from the agent’s logs on a code sandbox used by the agent (see below) and were able to map them to shell commands as well as evaluation submissions and correlate actions with our own platform logs, in particular from the dataset processor nodes, API, and pod. Using open-weights models, in particular zai-org/GLM-5.2, we were able to decipher most of the agent payloads (see below) that were encrypted via chunking and key encryption. The campaign, as we were able to reconstruct it, had two stages: Stage 1: reaching a launchpad by chaining through other parties’ infrastructure. As documented in OpenAI’s blog post (https://openai.com/index/hugging-face-model-evaluation-security-incident/), during an internal capability evaluation on OpenAI’s platform, the agent escaped its sandbox by exploiting a zero-day in the package registry cache proxy, one of its primary permitted network egress with internet, then abused a public code-evaluation harness hosted by a user of a third-party infrastructure provider. It was able to run commands as root/admin on that external sandbox and used it as a control, staging, and egress base for the entire campaign: it acted as an external launchpad for the agent. That compromised external sandbox had no direct network path to our cluster; however, during our counter-intervention to stop the intrusion, we were able to retrieve some of the agent logs from this external launchpad. We used those to reconstruct the present forensic analysis. Stage 2: the intrusion into Hugging Face infrastructure. From that external launchpad, the agent abused our dataset-processing pipeline via two injection vectors, both targeting the same config-driven data loader within our production Kubernetes pods. The first vector was an HDF5 external raw storage dataset read that returned the contents of local files: it handed the agent the pod’s environment (secrets and tokens) and the worker’s own source. The second vector was a Jinja2 template injection that executed arbitrary code, giving the agent a foothold inside our perimeter. Once a prod-pod foothold was established, the agent followed a standard escalation shape: recon, drop a stager, establish Command-and-Control (C2), then pivot into the cluster, into cloud metadata, into our internal network, and into our source-control supply chain. Output from the commands run inside our pod was sent back to the agent via the HF API and attacker-controlled dead-drop datasets, which the agent then read from that sandbox. While the intrusion did reach Hugging Face’s internal infrastructure, the only customer content accessed was five datasets whose names and files suggest a connection to ExploitGym/CyberGym challenges and solutions. No other customer-facing models, datasets, Spaces, or packages were affected, and the only customer records read were operational metadata tied to search queries against the dataset server. Hypothetical: Imagine that this wasn’t an OpenAI model. Imagine that it was a Chinese model from a Chinese company. This would be an international crisis. Question: Why aren’t we bringing OpenAI up on charges under the Computer Fraud and Abuse Act? How is this different from the Morris Worm? That was also an experiment that escaped the lab.

A lot of this week’s trouble starts with something that looks close enough. A familiar repo. A useful installer. A harmless sync setting. Then the handoff goes bad, the box starts talking to someone else, and the damage moves faster than the explanation. Old bugs are back, weak defaults are earning their keep, and some attack paths are so plain they barely feel like research. Here’s the mess. Game cheats drop spywareCybersecurity researchers 11 malicious NuGet packages published as .NET command-line tools that present themselves as game utilities, bots, and "panels," each of which act as a first-stage downloader responsible for fetching and executing a second-stage Python payload named "pepesoft.exe" from GitHub Releases and Hugging Face paths under the username "pepegit666," along with a dormant BitTorrent fallback mechanism built into it. "The recovered payloads use downloader-supplied AWS-style key material to retrieve remote configuration, authenticate to Google Sheets, bind activations to hardware, and honor a remote HWID/UUID ban-list," Socket said. "In the three direct-bytecode payloads, the larger game-automation application also exposes Telegram bot commands that can send screenshots back to the configured chat." Fake installers deploy RATsUAT-11795, a sophisticated, Russian-speaking, financially motivated adversary, has been observed conducting a malicious campaign targeting users in the U.S. and Europe since at least June 2025. The activity delivers a Python-based remote access tool (RAT) dubbed Starland RAT and a command-and-control (C2) memory implant known as WLDR agent using trojanized installer lures for software like developer tooling, IT administration utilities, enterprise collaboration platforms, and consumer gaming applications (e.g., MobaXterm, WebEx, Zoom, DBeaver, and FaceIT). "The WLDR agent is a sophisticated PowerShell-based C2 memory implant that features encrypted beaconing, task queuing, and a Runspace execution engine for executing additional payloads," Cisco Talos said. Alternatively, UAT-11795 has been linked to the deployment of CastleStealer and Remcos RAT. The malware is designed to target victims' credentials and cryptocurrency wallet assets, harvest Active Directory information, and establish a persistent connection to the victims' machines from the C2 server, likely with an aim to deliver and execute further payloads. The majority of the infections are in the U.S., with fewer potential impacts recorded in Germany, Romania, and Venezuela. The attack chain makes use of ClickFix lures to distribute HTA scripts, which then download and run trojanized installers to deliver Starland RAT, which then uses "curl.exe" to execute a PowerShell stager for decrypting and running WLDR agent. In recent weeks, ClickFix has also served as a conduit for TELEPUZ, a modular malware, and ClickLock Stealer, a macOS-focused information and cryptocurrency wallet stealer targeting users in Europe, North America, and MEA. "ClickLock Stealer targets data from 8 browsers, 31 crypto wallet browser extensions, 7 password manager extensions, 8 desktop wallet applications, extracts blockchain addresses across 6 chains, macOS Keychain, shell history, and FTP credentials," Group-IB said. Network encrypted within hoursAn IT services company in South Asia was targeted by a previously undocumented ransomware family called Spirals in June 2026. "The Rust-based payload is either a new ransomware threat or one purpose-built for this attack," Broadcom's Symantec and Carbon Black Threat Hunter Team said. "Less than 24 hours after the initial breach, the ransomware payload was being pushed to machines on the network." The attacker is said to have obtained initial access by compromising an internet-facing IIS web server and uploading an ASP.NET web shell. Over the next three hours, they established persistent access, conducted reconnaissance, uninstalled endpoint security software, dumped the Security Account Manager (SAM) hive, and set up covert remote access prior to deploying the payload across the network using PsExec. The ransom note seeks to apply pressure by threatening to publish stolen data after six days if a ransom is not paid and directs victims to a Tor portal for negotiations. The actor behind the attack remains unknown. Actively exploited flawsThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-46817, an improper privilege management vulnerability in Oracle E-Business Suite, and CVE-2023-4346, an overly restrictive account lockout mechanism vulnerability in KNX Association KNX Protocol Connection Authorization Option 1, to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to apply the fixes by July 18 and 29, 2026, respectively. Reports about active exploitation of CVE-2026-46817 emerged late last month. It's currently not known how the KNX Protocol flaw is being abused and by whom. New rules for vulnerability reportsCISA, in partnership with the National Security Agency (NSA), Japan Computer Emergency Response Team Coordination Center (JPCERT/CC), Netherlands' National Cyber Security Centre (NCSC-NL), and United Kingdom's National Cyber Security Centre (NCSC-UK), has published joint guidance to "helps software manufacturers and online service providers collaborate effectively with security researchers who identify weaknesses in software, networks, and hardware in a structured, transparent framework." The agency said a "well-defined coordinated vulnerability disclosure (CVD) program enables software manufacturers and online service providers to better assess potential risk, improve their vulnerability management processes, and make informed decisions that improve product security for their customers." 700-person scam network dismantledAuthorities from the Netherlands have arrested a 46-year-old man with Israeli and Polish citizenship, who is alleged to be behind an international criminal organization with more than 700 employees who were employed at about 20 fraudulent call centers. These individuals posed as financial advisors to conduct investment fraud. "By maintaining regular contact, sometimes over a period of months, these scammers build a bond of trust with their victims," the Dutch police said. "The initial deposit is always a relatively small amount that yields an immediate profit. The online platform where victims can view their investments is indistinguishable from the real thing, yet in reality, no actual investments are being made. Scammers use a friendly approach and cunning tactics to manipulate victims into depositing ever-larger sums. The money – often cryptocurrency – that victims believe they are investing ends up in the scammers' pockets." The operation has also led to the arrest of four "financial advisors." €140M fraud network disruptedSpanish National Police have disrupted a cybercrime network accused of stealing and laundering about €140 million through fake investment platforms, CEO fraud, invoice fraud, and adversary-in-the-middle attacks across Europe. Four people have been apprehended in connection with the operation: two in Portugal, one in Spain, and one in Panama. "The suspects established and managed a network of over 800 bank accounts to receive substantial sums of illicit money swindled from numerous victims; these funds were immediately dispersed and concealed across another network of accounts, creating a chain of transactions that safeguarded the criminal proceeds and allowed the vast amounts of defrauded money to be hidden and laundered through 'money mule' accounts in third countries," police said. "To create the complex web of accounts used for money laundering, the group utilized an extensive network of money mules – European citizens who had arrived in Spain from other countries – to set up companies and subsequently open bank accounts across Spanish territory." Windows bind links evade EDRBitdefender Labs has demonstrated three attack techniques in which Windows' bind links can be misused to evade endpoint detection and response (EDR) products. "Windows includes a file-system virtualization feature that can redirect one local path to another without modifying the original file or leaving a persistent filesystem artifact," Bitdefender's Martin Zugec said. "It is implemented by bindflt.sys, the Bind Filter minifilter driver, and used legitimately by Store apps, Windows Sandbox, and Windows containers." The techniques can be leveraged by an attacker running as a local administrator to bypass EDR sensors and built-in Windows defenses such as AMSI and AppLocker. The techniques include: File-Binding, Process-Binding, and Silo-Binding, each of which shadow a trusted file or DLL path, a trusted executable path, and a user-defined Windows silo. Microsoft has assessed the findings as low severity because it requires administrator access. 290 fake repos spread infostealerA financially-motivated threat actor has set up more than 290 fake GitHub repositories impersonating trusted software and security tooling vendors, including Arctic Wolf, to distribute a Windows infostealer that shares the same codebase as BoryptGrab. The 292 impersonated repositories span security tooling, fintech and personal finance, cryptocurrency wallets and exchanges, developer and productivity tools, secure email providers, macOS utilities, and gaming software. "The payload is a pure smash-and-grab in-memory infostealer, with a 41-entry cryptocurrency wallet path table and 19+ targeted browser names for broad, financially driven credential collection," Arctic Wolf said. "Stolen data is packaged into a ZIP archive and exfiltrated to a C2 with an IP residing in Russia, on a hosting provider repeatedly associated with malware operations." The malware does not set up persistence on the host and is instead designed to collect as much data as possible in a single execution. The brandjacking campaign is said to be the work of a Russian-speaking operator. $62M cybercrime indictmentThe U.S. Justice Department has unsealed a December 2024 indictment charging three Russian nationals and two related bulletproof hosting companies for their roles in cybercrimes against U.S. victims, causing tens of millions of dollars in losses. The charges are against Alexander Alexandrovich Volosovik, Kirill Andreevich Zatolokin, Yulia Vladimirovna Pankova, Media Land LLC, and ML.Cloud LLC. In tandem, the U.S. Department of State's Rewards for Justice (RFJ) program has announced its offering a reward of up to $10 million and possible relocation for actionable information on foreign government-linked associates of Pankova, Volosovik, and Zatolokin, their malicious cyber activities, or foreign government-linked use of Media Land or ML.Cloud. The defendants and the companies were sanctioned by the U.S., the U.K., and Australia in November 2025. Earlier this week, the Council of the European Union also levied sanctions against Media Land, ML.Cloud, and Volosovik, as part of the first joint cyber sanctions package issued against Russia in collaboration with the U.K. Chrome Sync becomes spywareA legitimate Chrome sync technique meant for user convenience is being misused by stalkers to gain broad access to a device owner’s private information. "Chrome's sync feature exists to make life easier," Certo said. "Sign in with a Google account, and Chrome will keep your bookmarks, open tabs, browsing history, autofill data, and saved passwords in step across every device you use -- your phone, tablet, laptop, whatever you're signed into." However, this can be turned into a surveillance tool in a simple step. All a digital intruder has to do is gain brief physical access to a victim's phone, open the Chrome app and add a Google account under their control, and ensure sync is switched on for that account. "The victim carries on using their phone as normal," Certo explained. "From this point, their browsing activity is copied to the attacker's Google account in the background. The attacker opens the same Google account on their own device and reviews the victim’s browsing history whenever they choose, from anywhere with an internet connection." eCards deliver remote accessA sustained phishing campaign dubbed SeasonalInvite has been observed deploying and abusing commercial Remote Monitoring and Management (RMM) tools since at least January 2026 by making use of social engineering themes tied to the seasonal calendar in attacks targeting both Windows and macOS users. The attacks involve the abuse of ConnectWise ScreenConnect, LogMeIn Resolve, Kaseya, and O&O Syspectr. The bogus pages are likely distributed via phishing emails and poisoned search results. Forescout said it identified 959 eCard-themed domains and a traffic distribution system (TDS) using 2,658 gate pages to route victims to phishing pages while blocking automated security scanners. "The phishing pages are generated by a kit and contain indicators of likely AI-generated code, suggesting the threat actor used a large language model (LLM) to assemble delivery pages and rapidly retool the campaign," it noted. OAuth codes bypass MFA defensesCybersecurity researchers have identified a new AI-powered device code phishing toolkit called Jalisco, along with a credential harvester codenamed OmegaLord that captures phone numbers alongside passwords to intercept multi-factor authentication (MFA) codes. "Jalisco is a device code phishing toolkit that provisions fresh OAuth codes in real time, defeating the time-based controls defenders rely on and pairing naturally with AI-powered kits like 'EvilTokens,'" ReliaQuest said. "OmegaLord, by contrast, is a JavaScript-based credential harvester that impersonates a PDF reader and collects phone numbers alongside credentials—a deliberate step toward intercepting or hijacking MFA." The development comes amid a surge in device code phishing attacks in 2026 that employ purpose-built tools to run such campaigns at scale. "Once inside a compromised Microsoft 365 account, attackers establish persistence by pairing multiple attacker-controlled devices to the victim's Entra ID tenant, then move quickly to exfiltrate sensitive data from software-as-a-service (SaaS) platforms for extortion," the company added. In some cases, threat actors have been observed enrolling more than five devices to a single compromised account in an attempt to extend the window for exfiltration. 3,900 threat servers mappedA new analysis from Hunt.io has uncovered more than 3,900 threat activities enabling servers across 302 Eastern European infrastructure providers within the past 3 months. "Keitaro leads Eastern European threat activity enablement with 1,277 unique threat activity enabling IPs, followed by Tactical RMM (232) and Acunetix (173)," the threat intelligence company said. "Cloud Atlas APT infrastructure was observed across multiple Eastern European providers, confirming the group's continued reliance on Eastern European hosting. Proton66 OOO was linked to active exploitation of CVE-2026-35273, a critical Oracle PeopleSoft zero-day attributed to the ShinyHunters group, with threat activity enabling infrastructure directly traceable to this Russian provider." One infection, two revenue streamsA financially motivated campaign has been observed delivering Vidar stealer and the XMRig cryptocurrency miner to consumer and small- and medium-sized business victims worldwide. The campaign was detected in April 2026. "Attackers lure victims via malvertising to pages for downloading files that impersonate cracked versions of copyright-protected software," Palo Alto Networks Unit 42 said. "Upon execution, the loader drops and runs both Vidar stealer and XMRig. Vidar stealer targets information like browser credentials, cookies, and crypto wallets. XMRig mines Monero cryptocurrency." The loader binaries use the Factory-v3 framework, which refers to a malware-as-a-service (MaaS0 builder used for different families of stealer malware. "The tag X3D MINER appears in Telegram operator notifications sent for every new victim infection," Unit 42 added. "The operator behind this campaign runs a dual-monetization scheme. Criminals sell credentials and session cookies stolen by Vidar stealer on criminal log markets, while XMRig provides passive income from hijacked victim CPU cycles." The lesson is not “trust nothing.” It is to stop granting trust in bulk. Check the repo, the installer, the account, the exposed service. Small shortcuts keep turning into full attack paths. And when a bug looks old, awkward, or too simple to matter, assume someone has already found a use for it. Patch the boring stuff. Tighten the defaults. Watch the handoffs.

Cybersecurity researchers have called attention to a new modular malware called TELEPUZ that's been spreading via websites infected with ClickFix lures since late April 2026. "The malware is full-featured, lightweight, and modular," Elastic Security Labs researcher Cyril François said in a technical report. "While the number of C2 [command-and-control] domains is currently small, the daily volume of builds uploaded to VirusTotal and the rapid pace of updates indicate active development and likely further growth." The disclosure makes it the second new threat cluster after SCMBANKER to be propagated via ClickFix, a pervasive social engineering attack that tricks users into manually running malicious commands by disguising them as innocent fixes for fake browser errors, software updates, or CAPTCHA verifications. Underpinning the technique is an approach called clipboard hijacking. Because web pages using ClickFix inject malicious script or commands into a potential victim's clipboard and provide instructions to paste and run them, it's also referred to as pastejacking. The ClickFix attack chain linked to TELEPUZ results in the execution of PowerShell, which downloads a second-stage payload from a remote URL and executes it. The payload is a Go variant of the Vidar Stealer, which is known to harvest sensitive data from infected hosts and deploy secondary malware, in this case a stager binary that's responsible for launching TELEPUZ ("telepuz.dll") using "rundll32.exe." Both the stager and main DLL binary are retrieved from "hurgadatour[.]shop" domain. Written in C, TELEPUZ is lightweight and modular, and exhibits signs that it was developed by a solo developer or a very small team with expertise in coding. A steady volume of daily VirusTotal submissions associated with the threat suggests that it's likely offered under a malware-as-a-service (MaaS) model. TELEPUZ also incorporates a number of obfuscation techniques, such as garbage instructions that serve no functional purpose, import name hashing to resolve imports, string encryption, and indirect system calls, to thwart analysis efforts. It then proceeds to perform anti-VM and geolocation checks by verifying hardware constraints, such as whether the machine has fewer than two CPUs, less than 2GB of memory, or insufficient disk space, and ensuring the system's locale identifier (LCID) is not among a hard-coded list of Commonwealth of Independent States (CIS) countries. On top of that, the malware compares the current username and computer name against a hard-coded list of common sandbox and malware research identifiers. The aim of these checks is to terminate execution immediately if a sandboxed or virtualized environment, or an unauthorized geographic location, is detected. Once all the checks pass, TELEPUZ takes steps to disable security monitoring by unhooking NTDLL, turning off Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW), and removing third-party DllNotification callbacks, which allow an application to receive alerts when a DLL is loaded or unloaded. The defense evasion routine is followed by checks to detect the presence of debuggers and crash them. It then fetches the parent process ID and validates the parent process name against a list of known runners, such as "rundll32.exe" and "svchost.exe." In the final stage, it generates a unique victim identifier that's derived by concatenating the hardware serial number, the computer name, and the operating system's installation date. "Following successful session identification, the malware spawns two concurrent threads: one dedicated to elevating itself and installing the malware as a service, and the other to initiate the C2 communication loop," François said. "The installation thread starts by elevating itself as Admin using the COM elevation moniker technique." "Upon achieving elevation and depending on the configuration, TELEPUZ next tries to get SYSTEM privilege by stealing the token of the first found process with one of the following names: spoolsv.exe, msdtc.exe, WmiPrvSE.exe, svchost.exe. Next, it registers itself as a service by creating the necessary registry keys to instruct Windows to load the malware within a new svchost.exe instance." In tandem, the malware attempts to establish contact with its C2 server up to 10 times. If these tries end up in failure, TELEPUZ attempts to fetch the fallback C2 address using four different methods - By extracting an encrypted URL from a Telegram profile's ("t[.]me/chanadarkpart") description. The channel was created on April 28, 2026. By extracting an encrypted URL from a Steam Community profile. The URL points to the same C2 address found in the Telegram channel. By running a DNS query for the domain codebasecode[.]com, it extracts and decrypts the fallback C2 address. By extracting an encrypted URL from a Polygon blockchain smart contract. TELEPUZ uses the C2 server to establish communication using WebSockets with optional TLS, and awaits instructions from the operator, allowing it to perform a wide range of malicious actions, including file enumeration, file operations, keystroke logging, command execution, process management, screenshot capture, web injection, and cookie extraction for Chromium-based browsers. It can also download and run executables and DLL modules. The web injector component can also directly talk to the C2 server to receive and execute commands aimed at Chromium-based browsers and Mozilla Firefox. The commands make it possible to siphon cookies and run arbitrary JavaScript on the browsers by taking advantage of the Chrome DevTools Protocol (CDP) and WebDriver BiDi protocol. "Their limited number suggests that what we think is a MaaS is still in its early stages, despite the high volume of builds generated," Elastic said. "While the staging domains are protected by Cloudflare, concealing their true hosting locations, the C2 servers have been identified as compromised websites located in Brazil and India, respectively."

Two rival nation-state cyber espionage operations, one linked to China and the other to India, have converged on the same Pakistani police force. According to new analysis published by SentinelLabs, the research arm of SentinelOne, on July 9, suspected China- and India-nexus actors ran intrusion campaigns against several Pakistani law enforcement bodies between February 2024 and April 2026, concentrating on Balochistan Police, the province's main force. The compromised assets included servers hosting applications for biometric records, criminal case files and tenant registrations tied to national identity data. One China-nexus actor reportedly planted implants in a portal used by officers and citizens. SentinelLabs grouped the command and control (C2) activity observed into four clusters. PlugX, ShadowPad and Cobalt Strike point to China-nexus operators; a Remcos cluster was tied to a suspected India-nexus actor Recorded Future tracks as TAG-179, overlapping with the group others call Bitter. Two Rivals, Opposite Motives For China, SentinelLabs said the likely driver was the safety of its nationals, tied to the China-Pakistan Economic Corridor (CPEC). They have reportedly faced repeated deadly attacks, some claimed by the Balochistan Liberation Army (BLA), a Baloch separatist group. Police data would allow China to assess that threat independently. India's motive is more likely its rivalry with Pakistan, in which Balochistan is a recurring flashpoint. Islamabad accused New Delhi of backing the insurgency, which India denied, and the force holds the record of how Pakistan polices the province. A Citizen Portal Turned Against Its Users The standout finding was the compromise of the force's Complaint Management System (CMS), used by both officers and citizens checking a complaint. Two variants of an implant named cms_plugin.exe were uploaded in late 2024, one in Rust, the other .NET. The Rust variant is a stager that, on execution, displayed "Update Complete! Please refresh the page," mimicking a portal update. The .NET variant posed as a component of Chinese vendor Qihoo 360's security software and loaded an AsyncRAT client. Shared code and simplified Chinese strings pointed to a Chinese-speaking developer. Reaching the databases behind these applications would expose: Police personnel and payroll records Criminal case files and fingerprint biometrics Stolen vehicle records Hotel check-ins tied to identity data Landlord and tenant registrations Citizen complaints, including misconduct reports The convergence reflects a structural risk in digital policing: systems that centralize records and services also concentrate intelligence value, making police infrastructure intelligence terrain for any capable adversary.

Cybersecurity researchers have disclosed details of sustained cyber espionage activity against several Pakistani law enforcement organizations undertaken by suspected China- and India-aligned threat actors between February 2024 and April 2026. "At Balochistan Police, the compromised assets included servers hosting web applications that manage police and citizen data, such as criminal and biometric records," Aleksandar Milenkoski, principal threat researcher at SentinelOne SentinelLABS, said in a report published this week. The activity targeted network appliances and servers hosting web applications that manage biometric records, hotel and tenant registrations linked to national identity records, criminal case files, and personnel records. The China-nexus threat actor is also said to have compromised one of these web applications to deploy a custom implant masquerading as a portal update. The application in question, named Complaint Management System (CMS), serves police staff and citizens, thereby putting both categories of users within the attacker's orbit. SentinelOne said it detected compromised infrastructure associated with several other Pakistani law enforcement organizations, including the Khyber Pakhtunkhwa Police, the Islamabad Police, and the Punjab Safe Cities Authority (PSCA). Four different threat clusters have been flagged, each deploying a unique malware family: PlugX, ShadowPad, Cobalt Strike, and Remcos RAT. The use of Remcos RAT has been linked to an India-nexus threat actor, while the PlugX, ShadowPad, and Cobalt Strike clusters are built on shared or commodity tooling and may each involve more than one operator. That having said, the deployment of both PlugX and ShadowPad, the latter of which is considered a successor to PlugX, is traditionally associated with Chinese nation-state hacking groups. "The victimology we observed for PlugX (between 27 February and 28 September 2024) and ShadowPad (between 3 August and 1 December 2024) reinforces this assessment," the cybersecurity company said. "Beyond Pakistani law enforcement, victimology for PlugX and ShadowPad includes government, foreign affairs, defense, nongovernmental, and research entities across South, Southeast, Central, and East Asia, the Arabian Peninsula, and Southeast Europe, consistent with China-aligned collection." The Remcos-related intrusion set is assessed to share infrastructure and tactical overlaps with a hacking group known as Mysterious Elephant (aka APT-C-08, APT-K-47, and TAG-179), which, in turn, has commonalities with India-nexus adversaries such as SideWinder, Confucius, and Bitter. Attack chains have been found to employ lures related to Pakistani law enforcement, displaying a decoy document that purports to contain an operational plan for the repatriation of illegal foreigners, including Afghan Citizen Card (ACC) holders. The Cobalt Strike activity cluster's ties to China-nexus threat actors is based on the fact that traffic to the attacker-controlled command-and-control (C2) server ("142.171.183[.]8") extends beyond Pakistani law enforcement to government, academic, telecommunications, and non-governmental entities across South, East, and Southeast Asia, the Middle East, and South America – a victimology profile consistent with China-aligned hackers. Among those targeted are Tibetan Buddhist organizations in Taiwan, which have long been targeted by China for cyber espionage. Further examination of the activity aimed at Balochistan Police has uncovered the compromise of the following assets that took place between June 2, 2024, and April 9, 2026 - Two network appliances Web servers hosting several Balochistan Police web applications associated with the Smart Police Station digitalization initiative A Fortinet FortiMail appliance that had served as the agency's primary inbound email gateway One of the infected applications is the Complaint Management System ("cms.balochistanpolice.gov[.]pk"), which is used for registering, tracking, and resolving citizen complaints. Two distinct variants of an implant called "cms_plugin.exe" have been uploaded to the site in connection with the operation - A Rust stager that's designed to download an additional payload from "193.42.25[.]65" and execute it. The exact nature of the next stage is unknown, but the samples display a message "Update Complete! Please refresh the page" upon execution, mimicking a CMS portal update. A .NET executable that masquerades as "360Safe.exe," a legitimate binary used by Qihoo 360 Total Security, to reflectively load an assembly implementing an AsyncRAT client. The activity is notable because it has drawn both a "partner and an adversary of Pakistan" to the same victim for intelligence gathering, likely fueled by geopolitical motives. "When multiple cyberespionage actors operate against law enforcement institutions of a single state, the convergence itself is a signal of target value," Milenkoski explained. "What draws them is a particular kind of institution: one that holds the government’s internal security picture, what it knows about the threats inside its borders, and how it acts against them." "The compromise of the Complaint Management System web application adds a second dimension to the activity against Balochistan Police, extending the threat actor's reach beyond the initially compromised environment. By hosting implants in a portal used by both citizens and law enforcement personnel, the threat actor turned a tool built to make policing in Pakistan more accessible and accountable to the public into a malware delivery mechanism."

Cybersecurity researchers have flagged a novel Java-based remote access trojan (RAT) called QuimaRAT that's capable of targeting Windows, Linux, and macOS environments. According to LevelBlue, the cross-platform malware is advertised under a malware-as-a-service (MaaS) model, costing anywhere between $150 for one month to $1,200 for lifetime access. Other subscription tiers include $300 for three months, $500 for six months, and $700 for twelve months. "Built around a modular architecture, the RAT supports dynamic capability expansion through encrypted plugins that can be delivered, loaded, unloaded, and updated directly from its command-and-control (C2) infrastructure," the cybersecurity company said in an analysis of the malware. The malware author also advertises a builder capable of generating multiple output formats, including JAR, EXE, APP, SH, BAT, and VBS, indicating an attempt to help prospective customers package the client tailored for different environments and delivery scenarios. The seller's post guarantees complete stealth on Windows and Linux, noting there are no visible user interface elements or desktop entries. On macOS, however, the threat actor includes a caveat that certain features like screen capture and input control require "user-granted admin permissions." Visiting their website, users are greeted by a pop-up message that states the platform "provides offensive security tooling intended exclusively for professional security research, authorized penetration testing, and controlled educational environments," warning them against using it for "malicious, unauthorized, or illegal purposes." In all, the threat actor offers four tools - Quima Control (aka QuimaRAT), a remote administration tool with 74 Windows and 46 macOS and Linux modules Quima Builder, a modular builder and launcher toolkit with support for XLL, LNK, VBS, JS, BAT, DOCM, XLSM, MSC, CPL, and CHM file formats Quima Loader, a browser-cache payload delivery service to stage and deliver the malware payload Quima Dropper, an HTML/SVG payload generator Quima Loader, particularly, is noteworthy, as it allows an operator to upload an EXE file through a dedicated panel and select a delivery format (e.g., HTA or LNK) and a landing page template (e.g., fake CAPTCHA check or software update alerts), after which the tool generates a stager link that, when opened by the victim in the browser, initiates the following sequence of actions, per the malware developer - The landing page is loaded, and the payload is fetched and held in the browser cache. A download button appears on the page. Clicking it saves a "small, clean loader file" that's trusted by the browser. Target runs the loader, which reads the cached payload. The main payload gets executed on the system, while bypassing SmartScreen protections on Windows. "A RAT, a builder suite, a web loader, and an HTML dropper — each built around what Windows already trusts," the author behind the Quima suite claims on their website. "Native execution paths, system-owned resources, clean outputs. AV [antivirus] sees nothing unusual. Neither does the user." LevelBlue's analysis suggests that QuimaRAT is organized as a modular Java project built using Apache Maven, while containing embedded Java Native Access (JNA) native libraries for Windows, Linux, and macOS across various architectures. It also decodes and parses an internal configuration file necessary for environment validation, persistence installation, and C2 initialisation. "These native components allow the RAT to interact directly with low-level operating system APIs through C/C++ code, indicating intentional support for broad multi-platform deployment," researchers Chen Aviani and Nikita Kazymirskyi said. Before execution, the malware ensures only one instance of the trojan is running on the infected machine at any given point in time. It achieves this by creating a lock file within the operating system's temporary directory and preventing other processes from using it simultaneously. If it detects that another RAT instance is already holding the lock to the file, it terminates execution. QuimaRAT is designed to determine the current operating system name, using it to dictate the next course of action, including evading sandboxed and virtual environments, establishing persistence, and serving the main payload. Furthermore, it supports the ability to execute an additional embedded payload or decoy application along with the main RAT process if the functionality, named Binder, is enabled through the configuration. The malware sets up persistence using a variety of operating system-specific methods: Registry Run keys, Scheduled tasks, and the Startup folder for Windows, .desktop autostart entries and crontab reboot tasks for Linux, and a LaunchAgent plist file for macOS. What's more, the Trojan incorporates an optional Pastebin-based C2 host update mechanism that is controlled via the configuration. This approach allows the operator to dynamically rotate or replace the C2 infrastructure without having to rebuild and redistribute the payload. The end goal of the QuimaRAT is to establish communication with the C2 server over TCP (or alternately via WebSocket, TLS, and HTTPS) to receive and execute commands. A watchdog component built into the malware ensures that the channel remains active and reconnects to it, if contact is lost with the C2 server. "QuimaRAT maintains an internal shutdown state flag used to control whether the RAT should continue performing networking, reconnect, watchdog, and recovery operations," the researchers said. "This mechanism allows QuimaRAT to stop reconnecting, watchdog, and communication recovery operations after shutdown mode is activated." The malware supports a wide range of capabilities, including remote command execution, remote payload and plugin delivery, credential theft, persistence, file transfer, clipboard manipulation, and webcam surveillance, granting the attacker comprehensive control over an infected system. Besides these conventional features present in most RAT malware, QuimaRAT facilitates fileless shellcode execution on Windows hosts and a resilient communication framework that enables persistent access to compromised hosts. "QuimaRAT should be viewed as a modular Java RAT platform rather than a single static implant," LevelBlue said. "ProGuard-class obfuscation indicators, Maven Shade relocation, preserved runtime symbols, and synthetic string decryptors further support the assessment that QuimaRAT is designed to rotate static fingerprints without changing its core behavior."

Introduction During our routine threat monitoring, we uncovered a new phishing campaign tied to a previously unknown APT group that we dubbed Armored Likho (also known as Eagle Werewolf based on circumstantial evidence). This targeted campaign focuses heavily on government agencies and the electric power sector. The geographical footprint of these attacks spans Russia, Brazil, and Kazakhstan, establishing the group as a global threat actor. Armored Likho blends financially motivated campaigns targeting private individuals with targeted cyber-espionage aimed at organizations. Their toolkit features obfuscated, modular RATs and infostealers specifically engineered to bypass dynamic analysis. Alongside these, they leverage simpler tools like Go2Tunnel for remote access and network tunneling. This diverse malware stack enables the threat actor to maintain stealthy control of compromised hosts, exfiltrate credentials and other sensitive information, and dynamically deploy downloadable modules tailored to the victim’s profile and the tasks at hand. Key campaign highlights: The group is leveraging a previously undocumented tool dubbed BusySnake Stealer. This Python-based infostealer is designed to target Windows systems. We discovered multiple versions of the malware, along with an additional module dedicated to stealing cookies. The first-stage malicious payload, consisting of loaders and stagers, was generated using AI, which blurs the attackers’ TTPs and complicates attribution efforts. This campaign highlights several concurrent trends: the growing technical maturity of Armored Likho, tool polymorphism, and a shift toward more complex schemes aimed at bypassing security solutions — ranging from Python source code obfuscation to embedding network mechanisms directly into the malware code. In this post, we’ll dissect the campaign that remains active at the time of publication, as well as the toolkit utilized by the attackers. Initial infection vector Phishing remains one of the primary initial access vectors that this threat actor heavily relies on in its latest campaigns. Armored Likho uses spear-phishing emails, with themes ranging from official government notices to social programs. In their most recent campaign, the attackers distributed malicious attachments inside archive files with names such as 1bfb2e79-8084-429e-a35c-8b595ab9f839_psihologicheskiy_test.zip (psychological test) or zayavka_gumanitarnayapomosch.rar (humanitarian aid application). These archives contained executables or LNK files named to mimic the email themes, tricking users into executing them on their devices. Below, we break down several variants of how they achieve initial access. EXE attachment In one attack variant, the archive contains a dropper named psihologicheskiy_test.exe, which is a self-extracting archive built using the Nullsoft Scriptable Install System (NSIS). When the victim opens the file, a decoy application launches to disarm suspicion by presenting a fake psychological survey. While we have observed similar droppers in the group’s previous campaigns, those earlier versions were written in Rust. Once executed, the dropper writes a legitimate executable, $temp\nsn5531.tmp\pnx.exe, to disk and launches it. Code is then injected into the pnx.exe process memory to execute a malicious loader. This loader, in turn, fetches several archives hosted in GitHub repositories. Our analysis of these repositories uncovered early development builds and test samples of the malware. Data release in the repository is automated, allowing for rapid rotation of both payloads and the repositories themselves. The downloaded archives are extracted into the $appdata\WindowsHelper directory. This serves as the malware’s working directory, where all subsequent components of the attack are staged and executed. The fetched package contains the following components: The primary payload: a stealer named module.pyw The runtime directory with the components of the PyArmor execution environment A Python 3.12 interpreter The get-pip.py script : used to install the pip package manager and fetch required dependencies Once executed, the script installs pip and pulls down the core dependencies required for the payload to run. With all dependencies in place, the malware creates two VBScript files in the same $appdata\WindowsHelper directory. The first, wh_selfdelete.vbs, is used to wipe the initial pnx.exe loader from the system: The second script, run.vbs, is designed to execute module.pyw and is used to ensure persistence on the system by creating a scheduled task: This task ensures that the payload, BusySnake Stealer, is executed every five minutes. LNK attachment In alternate campaigns, the archive contains a file named Zayavka_[redacted].lnk. The group leveraged the ZDI-CAN-25373 shortcut vulnerability to conceal the contents of their command line. This flaw allows the attackers to use spaces or line breaks to hide execution parameters. Consequently, when the user runs the malicious LNK file, it triggers the following obfuscated command: This, in turn, spawns a PowerShell command that downloads and executes the malicious loader: Upon execution, the loader downloads and opens a decoy DOCX document. We have observed various decoy themes, ranging from humanitarian aid requests to debt clearance certificates. Decoy documents Once the decoy is displayed, the loader initializes the environment variables required to stage the next phase, including URL paths, installation directories, and required library manifests. While we observed variations across different first-stage payload samples, their core functionality remains identical. Next, the loader fetches a Python 3.12 interpreter (python.zip), the get-pip.py script, and a data.zip archive containing the module.pyw payload. From this point, mirroring the first infection vector, the malware installs its dependencies and establishes persistence through a combination of a VBScript file and a scheduled task. As shown in the screenshots, the loader’s source code contains verbose comments and bullet-point emojis. This coding style is highly uncharacteristic of human-developed malware. It strongly indicates that the group is leveraging LLMs to generate their malicious payloads. Ultimately, both infection vectors lead to the execution of the primary payload, which we break down in detail below. BusySnake Stealer The primary payload in this campaign is a previously undocumented, Python-based infostealer that we have dubbed BusySnake Stealer. The stealer’s source code implements multiple evasion techniques designed to thwart detection and complicate static analysis. Specifically, the BusySnake Stealer code is obfuscated and encrypted using PyArmor Pro version 9.2.0. The malware dynamically decrypts its bytecode only at the exact moment a function is called, re-encrypting the data immediately afterward. Additionally, the malware runs in the background without spawning a console window, as indicated by its PYW file extension. During our analysis, we successfully stripped the protector and disassembled the executable functions. Below, we break down the stealer’s configuration and core functionality. Before executing its main routines, the malware initializes its configuration file. It contains the C2 server address, directory paths, regular expressions, screenshot intervals, a User-Agent string for network communications, and many more. An example configuration from one of the captured samples is shown below. The stealer’s architecture relies on handlers, each responsible for specific functions. The table below details the role of each handler. Below, we break down the execution logic of the malware’s core functions. Upon execution, the malware calls the single_instance_lock function to ensure that only one instance of the stealer is active on the system. To achieve this, the sample utilizes a non-standard lock-file algorithm, rather than traditional methods like creating a mutex or setting a registry value. The function first checks if the file Roaming\WindowsHelper\screenshots\.lock is locked by another process; if it is, the new instance fails to launch. If the file is not locked, the malware reads the Process ID (PID) stored within it. If that process doesn’t exist and the system uptime exceeds the file’s last modification timestamp, the stealer overwrites the lock file and proceeds with execution. Immediately after initialization, the start_key_clipboard_logger function begins harvesting data from the system clipboard. The malware polls the clipboard contents in an infinite loop, appending any new or updated data to the KEYLOG_FILE using the following format: Additionally, the stealer maps out the local file system using the start_inventory_background function. This background process first initializes a database at Roaming\WindowsHelper\inventory_state.db. Within this database, the stealer generates a tracking table to log file metadata: The malware then enumerates files and directories to build an object tree. During this scanning phase, the stealer explicitly skips core system directories, ignores files larger than 16 MB, and filters out files matching a hardcoded exclusion list of extensions. Discovered files are passed to the extract_hex64_from_file function to scrape for 64-character hexadecimal keys. The malware opens each file in read mode and scans for strings matching the [0-9a-fA-F]{64} regular expression. Any identified keys are logged into the previously created database. The keys themselves are written to a separate file and forwarded to the C2 server. Once the full scan wraps up, a completion message is committed to the log file using the following format: Next, the start_send_documents_priority_background function kicks off to map out logical drives. The malware identifies the system drive and recursively sweeps the user directories under /Desktop, /Documents, and /Downloads. During this enumeration phase, it filters the paths — checking only directories whose names start with $ and do not contain the string System Volume Information. Directory contents are also filtered based on an ignore list of extensions. The remaining files are then checked: if a file has not been previously sent and its size does not exceed 5 MB, it is transmitted to the C2 server. The stealer maintains an active connection with the C2 server to await incoming instructions during execution. The poll_task function polls the C2 server in a continuous loop for new commands. Below is an excerpt of a typical request packet: The C2 sign-in form interface is shown below: Commands are transmitted from the C2 server as function names, which are detailed in the table below: After executing each command, the stealer sends a report back to the C2 server containing the task completion status. Password exfiltration from Firefox and Chromium-based browsers When BusySnake Stealer receives a C2 command to harvest passwords from Chromium-based browsers, it passes the task to the handle_extract_chromium_passwords function. The malware locates the specific browser data directory, verifies that it is not empty, and targets the Login State file, which contains the master key used to encrypt the local password database. The master key is protected via the Windows Data Protection API (DPAPI). By operating within the security context of the user who originally encrypted the key, the stealer is able to decrypt it using the win32crypt.CryptUnprotectData() function. Then, user accounts are extracted from the browser database via an SQL query, while passwords remain encrypted. Next, the passwords are decrypted using a master key and saved in plaintext to the Roaming\WindowsHelper\chromium_passwords.json file. For Firefox, the exfiltration workflow follows a similar logic. The stealer receives a command to extract browser credentials, which is then processed by the handle_extract_firefox_passwords function. The implant then scans the Mozilla\Firefox\Profiles directory and checks each user profile for the presence of both logins.json and key4.db. If either file is missing, the profile is skipped. The malware then parses the contents of logins.json, extracting the hostname, encryptedUsername, and encryptedPassword fields from each entry. The extracted data is placed into a SECItem structure. Upon calling the NSS_Init() function, the NSS library — which Firefox relies on — automatically initializes its built-in cryptographic module and accesses the key4.db database. If the database is not protected by a master password, the module loads the signing key stored within it. In this scenario, the PK11SDR_Decrypt() function can successfully decrypt the credentials without requiring any user prompts or additional steps. Thus, BusySnake Stealer exploits insecure Firefox browser practices: storing the database master key in plaintext and the lack of re-authentication when decrypting data with it. The decrypted credentials are saved directly to the Roaming\WindowsHelper\firefox_passwords.json file. Cookie extraction The stealer harvests cookies using a workflow nearly identical to its browser credential theft routine. Upon receiving the handle_collect_and_send_cookies command from the C2 server, the malware triggers the corresponding function. It then scans browser directories for the following database files: Cookies for Chromium-based browsers and cookies.sqlite for Firefox. Once located, it uses SQL queries to extract the cookies. For Chromium-based browsers, the malware executes the following query: For Firefox, it uses this query: All harvested data is decrypted and saved to a file located at Roaming\WindowsHelper\all_browser_data.json, which is then exfiltrated to the C2 server and wiped from the host. In addition to this method, the stealer fetches a supplementary module designed to extract cookies by installing a browser extension. Upon receiving the appropriate directive, the malware executes the handle_extract_cookies_v7_command function. It then pulls down the additional module as an archive from the Releases page of a GitHub repository, mirroring the initial staging process used by the stealer itself. The source code of this secondary module is also protected with PyArmor. Once executed, the module spins up a local web server to capture and parse the cookies extracted from the browser. Next, the module creates the files for a browser extension used to steal cookies: manifest.json : details the extension structure and required permissions sw.js : contains the primary execution logic for the extension Once these components are staged, the extension is installed into the browser. To ensure Google Chrome launches with the extension installed, the module uses specific arguments to start the browser. Once active, the extension verifies the availability of the local web server initialized during the previous stage. If the server is responsive, the extension reads the cookie data, stores it in a cookiesData object, and transmits it to the following URL: The local server processes the incoming payload, saves it to a file named extracted_cookies.json, and subsequently exfiltrates it to the C2 server. Reverse SSH tunneling The group previously used a Go-based tool for creating reverse SSH tunnels, named Go2Tunnel by researchers. BusySnake Stealer implements a similar feature as a built-in function. The implant receives a directive from the C2 server to establish a reverse SSH tunnel, routing the task to the handle_start_proxy_command function. The stealer initially sends a request to the following URL, appending the victim’s unique machine identifier to the request parameters: If the configuration specifies an HTTP endpoint instead of HTTPS, the URL format adjusts as follows: In response, the server returns data containing all the parameters required to establish the tunnel. The malware extracts the private key and the specific SSH command from this response. Using these components, it initiates a connection to a remote server controlled by the attackers, granting them persistent remote access and interactive control over the compromised host. To close the tunnel, the stealer receives the handle_stop_proxy_command command and processes it with the function of the same name, after which the private key file is deleted and the associated SSH process is terminated. New version of the BusySnake Stealer During our infrastructure analysis of the threat actor, we uncovered a newer iteration of the stealer. The distribution method and static obfuscation mechanism remained unchanged; however, Armored Likho modified their TTPs and altered the code structure of BusySnake Stealer. In the new version, instead of calling schtasks directly, the malware uses the win32com.client library to create scheduled tasks through interaction with the Schedule.Service COM object, indicating a shift toward less detectable execution methods. This approach ensures a more stealthy persistence mechanism. Furthermore, to bypass dynamic analysis mechanism, the authors added a function that pauses execution before triggering malicious routines. We also observed refinements to the architectural design of BusySnake Stealer. The attackers built a new task-management framework to handle incoming C2 commands. Each task is assigned a unique identifier, and before execution, the stealer checks for the presence of this task in a specified list. To track execution states in real time, tasks are dynamically assigned one of four operational statuses: SCHEDULED, IN_PROGRESS, SUCCEEDED, or FAILED. The introduction of task execution statuses resulted in an updated C2 communication schema. The updated endpoints and request packet structure are detailed in the table below: One of the most significant architectural upgrades is the introduction of a dedicated class designed to execute arbitrary Python scripts. In this updated variant of the stealer, the poll_commands function is responsible for retrieving commands from the C2 server, while the poll_tasks routine is specifically dedicated to fetching Python scripts. Before running a retrieved script, the malware dynamically installs any required dependencies via pip. It then spawns a new process and executes the script’s code directly within memory without ever writing the file to disk — a technique intended to bypass security. Attribution We attribute this campaign to the Armored Likho threat group with medium confidence, basing our assessment on the analysis of the tools and network activity. In previously identified campaigns, the group used the Go2Tunnel tool designed to create reverse SSH tunnels. In BusySnake Stealer, similar functionality is implemented as a built-in feature. Both tools receive a tunnel establishment command and a private SSH key from the C2 server, while making requests to similar endpoints. Furthermore, both payloads initiate their tunnels using SSH commands with an identical set of arguments: The Armored Likho group has historically deployed the AquilaRAT remote access Trojan. It shares a similar structure with BusySnake Stealer: the malware receives tasks from the C2 server, and their execution is carried out by dedicated handlers. Additionally, BusySnake Stealer and AquilaRAT utilize similar endpoints for C2 communications — for example, when reporting task execution statuses back to the server: AquilaRAT BusySnake Stealer Another structural overlap is seen in their persistence mechanisms. Both BusySnake Stealer and AquilaRAT maintain their footprint on compromised hosts by registering scheduled tasks that masquerade as legitimate Microsoft system utilities. While AquilaRAT typically names its task MicrosoftOfficeUpdate, BusySnake Stealer uses the name WindowsHelper. Victims We continue to actively monitor the ongoing deployment campaigns of BusySnake Stealer, alongside its related artifacts and network infrastructure. To date, confirmed victims have been identified across Russia, Kazakhstan, and Brazil. The attacks are primarily focused on the governmental and electrical power infrastructure sectors. Takeaways An analysis of Armored Likho’s campaigns over the past few months shows a trend toward using AI tools to generate first-stage payloads, as indicated by redundant comments and code blocks. This allows the group to broaden its available attack vectors. In parallel, the group is aggressively refining and modifying its core toolkit. While Go2Tunnel previously operated as a standalone utility, its reverse-tunneling functionality has now been integrated directly into the stealer as a built-in feature that ingests parameters from the C2 server. Furthermore, the structural design of this newly discovered stealer shares pronounced architectural overlaps with AquilaRAT, another staple tool in the group’s arsenal. At the time of writing, Armored Likho remains highly active. Despite the evolution of their malware variants and their efforts to obfuscate their TTPs, we continue to closely monitor the group’s footprint and detect emerging campaigns. Detection by Kaspersky solutions Kaspersky security solutions, including Kaspersky Endpoint Detection and Response Expert, successfully detect and block the malicious activity associated with these attacks. Defensive solutions detect the threat actor’s activity at the initial stage when the LNK downloader is executed. Upon execution, the shortcut runs an obfuscated command via rundll32.exe, which subsequently triggers a PowerShell command to pull down the second-stage payload. This malicious chain of events is caught by the following detection rules: Example of LNK downloader detection in KEDR The Kaspersky Cloud Sandbox solution can be used for a comprehensive analysis of the malicious activity described here. The figure below shows the Kaspersky Cloud Sandbox interface, demonstrating the event chain of the obfuscated command execution by the LNK downloader. Additionally, inside Kaspersky Cloud Sandbox, it can be observed that during execution the stealer contacts remote URLs to download additional files, specifically a DOCX decoy document as well as the web_script.txt stager. If the EXE dropper is executed, Kaspersky Cloud Sandbox also records the downloading of additional tools from a GitHub repository. Furthermore, dynamic analysis results show that the sample writes an additional file to the disk, which is used in subsequent stages of the attack. Indicators of compromise Additional information about this threat is available to customers of the Kaspersky Threat Intelligence Reporting service. Contact: [email protected]. First-stage malicious files 5D5C3E483C5E544260CE98FC29FBF192 PS1 stager 7141917CBA2EEE2B4D31107FACCF3A39 EXE stager F5C6434EE5F7578FAA3BC1257E1C9226 EXE stager C019797A00FD56EDB1F468AC0A598510 BAT stager A0EC7A8E61EFF3F445A7455B3AEF9FBB BAT stager F5C6434EE5F7578FAA3BC1257E1C9226 EXE stager 7DB9C688C620E54E8C69B7E52A7579FB BAT stager 90378881856ABFA47D7745C0A3EF9DC8 RAR archive with advanced cookie extractor module 1DBA3E505491A260A44C867902C3296E RAR archive with malicious DLL loader 1096268FA2B3D454C86CF851CB782319 EXE dropper F2AB09D7E7A375A192508A5014AA2EE4 EXE dropper 0041FD1B2358CD08DBCBC28EA8FC3D20 EXE dropper 894332174F536C2E1EFEDA05CBA79F8B DLL loader 78135F72AB148A0CC074F6B2DD51FFF6 DLL loader 07213C419489C02791E8D67B91E404EF DLL loader 393B498F2114CABC0B29D5FCD9DC6723 LNK CF74AC018D158EA2C2CFA1B1D71D95BC LNK 2DFA1D949872C1B2F04952DD3E5F5D8F LNK BusySnake Stealer C7622A1EFFA27BBFEE6D6E03D6474343 PYW BusySnake Stealer 80B7700053E115D65365CE7330383320 New PYW version of BusySnake Stealer 6B45DDB39A6E86229348DCBBA3857E7C RAR archive with BusySnake Stealer 006887732CA4A4A46A97989CF4DEEEF6 RAR archive with BusySnake Stealer 732C31ACF971A81C7E51B2A3DAE82020 RAR archive with BusySnake Stealer DDFF82A115558584BBD7741D4FFB35B4 RAR archive with BusySnake Stealer 8188B2F347B77D65D08CFB23808AC244 RAR archive with BusySnake Stealer E2550CFAD9DCC880BF04F6048F90868C RAR archive with BusySnake Stealer FD2BDD8047ADDEE6FDE2F532DE181BFD RAR archive with BusySnake Stealer С2 159.198.41[.]140 159.198.75[.]219 159.198.32[.]222 69.67.173[.]153

Cybersecurity researchers have flagged a new multi-stage malware delivery attack chain that uses social engineering and Blogger pages to deliver an information stealer called PureLogs. The activity has been codenamed VEIL#DROP by Securonix. It's suspected that the initial payloads are distributed either via spear-phishing or a drive-by compromise, which occurs when an unsuspecting user lands on a website (legitimate or otherwise) under the attacker's control. "The infection chain begins with a deceptively named JavaScript file masquerading as a document (e.g., transcript.pdf.js), which executes through Windows Script Host and launches PowerShell with execution policy bypasses enabled," researchers Akshay Gaikwad, Shikha Sangwan, and Aaron Beardslee said in a report shared with The Hacker News. At a high level, the PowerShell script is responsible for retrieving a next-stage payload hosted on Blogger ("htlwub00klocate.blogspot[.]com"), allowing the attackers to bypass reputation-based defenses by abusing Google's trusted infrastructure as a stager and to blend in with legitimate web activity. The downloaded PowerShell payload acts as a conduit for loading a benign web page like Google, creating the impression that a PDF document is opened, while the infection sequence proceeds silently in the background, ultimately leading to the deployment of PureLogs Stealer, a .NET-based infostealer known for harvesting a wide array of sensitive data from compromised hosts. Akshay Gaikwad, senior security research engineer at Securonix, told The Hacker News that PureLogs Stealer refers to the same stealer that's offered under a malware-as-a-service (MaaS) model by a threat actor known as PureCoder. It's also called PureLog. The PowerShell loader also attempts to ensure unrestricted execution of follow-up PowerShell commands, terminate selected processes such as "wscript.exe" to minimize forensic trail, delete "transcript.pdf.js" to eliminate evidence of execution, and decrypt an embedded payload. "Following successful XOR decryption, the loader transitions into one of the most evasive components of the VEIL#DROP framework: dynamic stage generation combined with runtime mutation," Securonix explained. "Rather than using static indicators such as hard-coded URLs or predictable execution patterns, the malware constructs the next-stage payload location dynamically during execution." This involves building a unique blogspot[.]com URL for each execution by inserting a random number of forward slashes ("/") to the URL string so as to bypass static URL signatures, indicator-based blocking, and URL-based filtering mechanisms. In addition, the decoded script introduces runtime mutation and polymorphism by replacing placeholder values within the script with randomly generated strings and values during execution. This variability is designed to defeat script signatures and file hashes, thereby preventing reliable detection. The reconstructed script is finally executed entirely in memory without leaving any artifacts on disk. This component functions as a loader responsible for decoding and running the core malware component, which is nothing but a .NET assembly that's launched using a technique known as reflective code loading. In the event security controls and other environmental restrictions prevent it from executing the recovered .NET assemblies directly from memory, the loader incorporates a fallback execution method that relies on Microsoft-signed binaries, such as "regsvcs.exe," "installutil.exe," "msbuild.exe," and "aspnet_compiler.exe," to accomplish the same goals without attracting any attention. Because these binaries are trusted, signed by Microsoft, and are already present on the system, the living-off-the-land (LotL) approach enables the attackers to make their activity appear legitimate and fly under the radar. "One of the most notable aspects of the loader is that it does not depend on any single LOLBin," the researchers pointed out. "Instead, execution follows a cascading model, attempting each method until one succeeds." The impact of a stealer infection typically goes beyond the initially compromised endpoint, as the harvested data can act as a stepping stone to burrow deeper into the target environment, establish persistence, perform lateral movement, and even breach its cloud infrastructure. "The combination of compromised websites, multi-extension masquerading, trusted cloud services, XOR-obfuscated payloads, reflective .NET loading, fileless execution, and LOLBIN abuse demonstrates a deliberate effort to evade traditional antivirus solutions, reduce forensic artifacts, and maintain operational stealth throughout the infection lifecycle," Securonix said.

This week was a reminder that attackers do not always need big tricks. One small mistake, one old access path, one missed patch, and suddenly the door is open. The noise is not all noise, either. Forums are talking, researchers are finding easy cracks, and defenders have more cleanup waiting. Here’s the full Monday recap. ⚡ Threat of the Week New DirtyClone Linux Kernel Flaw Lets Local Users Gain Root via Cloned Packets — Cybersecurity researchers detailed a new variant of the Dirty Frag Linux kernel flaw. Called DirtyClone (aka CVE-2026-43503), it allows local users to gain root privileges via cloned packets. The exploit works successfully on Debian, Ubuntu, and Fedora systems with default namespace configurations. "Any local user on a server or device running a vulnerable kernel who holds or can acquire the CAP_NET_ADMIN capability (frequently obtainable via unprivileged user namespaces) [is exploitable]," JFrog said. "This poses the highest risk to multi-tenant cloud environments, Kubernetes clusters, and containerized workloads where user namespaces are enabled, or privileged containers are deployed." Building Securely with AI: Takeaways from Chainguard Innovation Week Reactive network operations slow teams down and increase business risk. Join Tines and Netskope to discover a practical five-step framework for improving visibility, accelerating response, and creating secure, reliable operations across modern hybrid environments. Explore Innovation Week ➝ 🔔 Top News Critical PTC Windchill PDMlink and PTC FlexPLM Flaw Exploited — A critical remote code execution vulnerability impacting PTC Windchill PDMlink and PTC FlexPLM enterprise Product Data Management (PDM) and Product Lifecycle Management (PLM) software has come under active exploitation in the wild to deploy JSP web shells on susceptible systems. The vulnerability, tracked as CVE-2026-12569, is a case of improper input validation that could allow an attacker to execute arbitrary code by sending a malicious request to the network. Patches for the vulnerability have been released. OpenAI Previews GPT-5.6 Sol, Terra, and Luna — OpenAI officially unveiled GPT-5.6 Sol, Terra, and Luna, with Sol described as the most capable model yet for cybersecurity. The models are being released in a staggered manner with approval from the U.S. government. The release came days after the company released an improved version of its GPT‑5.5‑Cyber model to trusted defenders as part of the Daybreak initiative and launched a new project called Patch the Planet in collaboration with Trail of Bits to help secure open-source projects. OpenAI has also warned about the dual-use nature of the technology, acknowledging that the same capability that helps a red teamer find a zero-day can also assist a bad actor in exploiting one, and that it will prioritize patching jailbreak techniques against the model. In addition, it has framed the effort as getting the tools in the hands of more defenders before attackers gain the same edge. Much of the concern surrounding the frontier models stems from the fact that artificial intelligence can now identify existing bugs within codebases and work towards creating exploits for them. While the automation of cybercrime is not new, these tools undoubtedly have the potential to further lower the barrier to entry for bad actors. New Gaslight macOS Malware Discovered — A newly discovered macOS malware dubbed Gaslight is designed to confuse AI-assisted malware analysis tools through embedded prompt injection strings and fake debugging data within the executable. With cybersecurity researchers using AI-powered tools to assist with malware analysis and reverse engineering, the malware attempts to gaslight such tools into thinking there is some issue, potentially causing them to abort, truncate, or refuse an analysis of the artifact. Gaslight has been attributed with high confidence to a North Korean-linked threat actor. The malware itself is a Rust binary with backdoor and information-stealing functionality, enabling the operator to gain a persistent foothold over the infected host. The findings highlight how threat actors are experimenting with anti-analysis methods designed specifically to bypass AI-assisted security platforms. Turla Uses STOCKSTAY Backdoor in Ukraine Attacks — The Russian state-sponsored threat actor known as Turla has leveraged a previously undocumented .NET backdoor called STOCKSTAY in attacks targeting government and military organizations in Ukraine, and entities that have an interest in Italian foreign policy. STOCKSTAY shares significant code and functional overlaps with Kazuar, a staple implant put to use by the adversary since 2017. Suspected development activity of malware dates back to December 2022. Amadey, StealC Malware Operations Disrupted in Operation Endgame — A coordinated law enforcement operation, in partnership with private sector companies, dismantled criminal infrastructure powering Amadey and StealC. According to Europol, the operation led to the disruption of 326 servers and 142 domains, the identification of more than €41 million ($47 million) in cryptocurrency linked to criminal activity, and the recovery of approximately 27 million credentials stolen from over 385k compromised systems. Amadey and StealC are sold to cybercriminals under a malware-as-a-service (MaaS) model. Microsoft said criminals use Amadey to gain an initial foothold on victim devices to deploy additional malware, such as StealC, which then steals credentials, cryptocurrency wallets, and other sensitive information that can later be sold or leveraged in follow-on attacks. The two malware families were linked to more than 140,000 infected devices during the first two weeks of May 2026 alone. That said, no arrests were announced as part of the operation. ️🔥 Trending CVEs Bugs drop weekly, and the gap between a patch and an exploit is shrinking fast. These are the heavy hitters for the week: high-severity, widely used, or already being poked at in the wild. Check the list, patch what you have, and hit the ones marked urgent first — CVE-2026-47729 aka Squidbleed (Squid), CVE-2026-12957 (Amazon Q Developer), CVE-2026-12569 (PTC Windchill PDMlink and PTC FlexPLM), CVE-2026-43503 aka DirtyClone, CVE-2026-46331 aka pedit COW (Linux Kernel), CVE-2026-30040, CVE-2026-30041 (FastStone Image Viewer), CVE-2026-45585 (Microsoft WinRE), CVE-2026-8461 aka PixelSmash (FFmpeg), CVE-2026-55200 (libssh2), CVE‑2026‑20971 (Samsung KNOX kernel), CVE-2026-10086, CVE-2026-10712, CVE-2026-12053 (GitLab CE and EE), CVE-2026-13028, CVE-2026-13032, CVE-2026-13033, CVE-2026-13038 (Google Chrome), CVE-2026-53605 (Reachy Mini Wireless image), CVE-2026-13136, CVE-2025-15660, CVE-2026-13135 (Synology MailPlus Server), CVE-2026-11374 (ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus and ADAudit Plus), and a critical Infoblox NIOS privilege escalation vulnerability (no CVE). 🎥 Cybersecurity Webinars Stop AI-Driven Cyberattacks Before They Stop Your Business → Hackers are now using AI to launch cyberattacks at machine speed. If your defenses are built for human-speed threats, you are at risk. Join this webinar to get a step-by-step blueprint to fight back. Learn exactly how to block AI-driven attacks and protect your company before a crisis hits. When AI Goes Rogue: How to Secure the New Cyber Attack Surface → As companies rush to adopt AI, hackers are turning these tools into a massive liability by hijacking AI agents and leaking trade secrets. Join this urgent webinar to see exactly how attackers weaponize AI against businesses. You'll get a practical blueprint to lock down your setups, fix risky configurations, and stop your own tech from going rogue. Building at Machine Speed: How to Secure AI Software Delivery → AI tools are generating code faster than security teams can review it, introducing hidden risks into software pipelines. Join this webinar to learn how to catch vulnerabilities and govern AI risk without slowing down development. You'll get a practical roadmap to protect your software supply chain and scale AI engineering safely. 📰 Around the Cyber World China's New Zhipu AI Reportedly Matches Claude Mythos in Vulnerability Discovery — The Wall Street Journal reported that a new model released by China's Zhipu AI, GLM-5.2, matches the performance of Anthropic Mythos when it comes to finding vulnerabilities, narrowing the gap between top U.S. models and those developed by Chinese companies. The ability of AI systems to autonomously find security defects in software has created new urgency to efforts that entail the use of models to quickly close them before they can be exploited by bad actors. There are also worries that these models, in the wrong hands, can become potential enablers of cyber warfare. The Trump administration has called for the creation of a framework that grants the federal government the ability to evaluate AI models' capabilities and determine which qualify as "covered frontier models," a designation for AI systems with advanced cyber capabilities. Indirect Prompt Injection in Agentic Coding Tools — Mozilla's Zero Day Investigative Network (0DIN) characterized indirect prompt injection as a "very real and serious attack vector that can result in catastrophic damage, much of which will be irreversible." In the case of agentic IDEs and coding agents, they can request access to various tools, which, once approved, can pave the way for code execution, file system operations, and network calls. Specifically, an attacker can obtain code execution using a seemingly harmless repository by chaining trusted setup instructions, routine error handling, and automated agent behavior. The attacker-controlled repository does not even have to contain any malicious code. Instead, it's fetched at runtime from a DNS TXT record by framing it as an essential step during the installation phase when a developer copies the repository link and instructs the agent to get it running. "In short, agentic coding tools have access to everything they need for this: private data, including environment variables, credentials, API keys, and local configuration files," 0DIN said. "Untrusted content, such as repositories, documentation, and error messages from recently installed packages, can inject malicious models to steal this data." New KuinaExtractor Rust Infostealer Spotted — A new Rust-based information stealer called KuinaExtractor comes fitted with capabilities to harvest web browser data, crypto wallets and credentials for services such as Roblox, Steam and Discord. Said to be in active development since December 2025, the stealer also includes a Chrome app-bound encryption (ABE) bypass. In parallel, the malware developer worked on two short-lived projects known as KuinaCookieExtractor and Zenith C2 before they were abandoned. KuinaCookieExtractor goes beyond browser cookies to include Roblox and Steam sessions, Minecraft and FileZilla logins, Telegram tdata and Discord tokens, and exfiltrates over a Discord webhook rather than Telegram. New LokiBot Campaign Surfaces After a Hiatus — A new email phishing campaign has been observed delivering LokiBot via a JavaScript attachment. Once launched, the script triggers the execution of a PowerShell loader that runs a .NET injector payload that deploys the LokiBot malware. LokiBot is capable of harvesting credentials from password managers like 1Password, Enpass, and KeePass, and contacts an external server to receive and execute commands. Phishing Campaign Drops Malicious Chrome Extension — Invoice-themed email phishing lures written in Italian are being used to launch JavaScript attachments masquerading as PDF documents. "The most interesting part of this infection was not the initial JavaScript. The malware installed a malicious Google Chrome extension and paired it with a Native Messaging Host," D3 Lab said. "This combination allowed code running inside Chrome to request PowerShell commands on the Windows system." Time as an Attack Surface — New research from NCC Group has argued the need for treating time as a "first‑class attack surface," stating clock drift, time synchronisation failures, and deliberate oscillator manipulation can be exploited to undermine cryptography, authentication, industrial automation, and safety systems. "The risk is amplified by broader technological trends," NCC Group's Andy Davis said. "Cloud computing, containerisation, and virtual machines abstract time away from physical hardware, placing it under the control of hypervisors and orchestration layers. At the same time, Industrial Control Systems, IoT devices, and safety-critical platforms increasingly rely on low‑cost oscillators and commodity components that are vulnerable to environmental influence and physical manipulation. Systems that once relied on isolated, deterministic timing sources are now interconnected, synchronised, and exposed." Threat actors Exploit Xiongmai DVR Flaw to Deliver Proxy SDK — Threat actors have been exploiting CVE-2024-3765, a vulnerability in Xiongmai DVR, to deploy commercial residential proxy SDKs using a Mirai botnet-derived HTTP downloader. "All DDoS and scanning capability has been stripped," the Nokia Deepfield Emergency Response Team (ERT) said. "What remains is a minimal HTTP client and an embedded userspace ELF loader – Mirai reduced to a delivery truck." The main stager installed following a successful compromise deploys a proxy binary called PacketSDK, which is part of the IPIDEA residential proxy network disrupted by Google earlier this year. The stager also contains a remote code execution backdoor that polls an external server for updates every 2 minutes. Nation-State Targeting of Water Systems — DomainTools warned that water and wastewater infrastructure have become strategic pressure points for state and state-aligned actors from China, Iran, and Russia. "The combination of chronic underinvestment and weak baseline operational technology (OT) security makes many of these critical systems easy to compromise," the company said. "Such intrusions can have both physical and psychological impact, and disruptions often affect civilian life, public health, and trust in government." Anthropic Accuses Alibaba of Obtaining Illicit Access to Claude — Anthropic has accused the Chinese company Alibaba of what it described as the "largest campaign to illicitly extract Claude's capabilities." The attacks occurred between April 22 and June 5, 2026, when "operators affiliated with Alibaba and Alibaba Qwen, Alibaba's AI lab," allegedly generated "more than 28.8 million exchanges with Claude through almost 25,000 fraudulent accounts," per Anthropic. The distillation campaign targeted its capabilities, such as agentic reasoning, software engineering, and long-horizon tasks, while evading detection using obfuscation techniques and proxy networks. Linux Foundation Unveils Akrites and OSERA — The Linux Foundation has announced Akrites as a coordinated effort to address and disclose vulnerabilities in critical open-source software as AI accelerates both the scale and speed of vulnerability discovery. "The initiative provides a single, trusted place to coordinate, remediate, and disclose, with a shared SIRT [Security Incident Response Team] serving as a predictable partner for maintainers rather than a flood of uncoordinated reports," the foundation said. The initiative also plans to work with critical infrastructure operators to help deploy fixes before in-the-wild exploitation. The Linux Foundation has also announced its intent to form an Open Source Enterprise Resiliency Alliance (OSERA) that aims to strengthen the open-source components that underpin the financial services sector through a vendor-neutral, upstream-aware approach. "OSERA complements the recently announced Akrites, the cross-industry effort enabling coordinated disclosure and upstreaming," the foundation said. "As financial-services downstream complement to Akrites, OSERA will collaborate with Akrites in the upstreaming process and, together with the Open Source Security Foundation, to represent the voice of the industry in defining remediation standards." Microsoft Extends Windows 10 Consumer Extended Security Updates by a Year — Microsoft quietly extended the Extended Security Updates (ESU) program for Windows 10 consumers by a year, letting eligible users get updates through October 12, 2027. To enroll in the consumer Windows 10 ESU program, devices need to be running Windows 10, version 22H2 Home, Professional, Pro Education, or Workstations edition and cannot be offered for devices in kiosk mode or those that are joined to an Active Directory domain or Microsoft Entra and/or enrolled in a Mobile Device Management (MDM) solution. Microsoft's Secure Boot Certificates Have Expired — In related Microsoft news, the certificates that manage UEFI Secure Boot trust – namely, Microsoft Corporation KEK CA 2011, Microsoft UEFI CA 2011, and Microsoft UEFI CA 2011 -- expired on June 24 and 27 2026. A third certificate, Microsoft Windows Production PCA 2011, will expire on October 19, 2026. "Many Windows PCs manufactured since 2024 already have the updated 2023 certificates," Microsoft said. "For the remaining devices, Microsoft is delivering new Secure Boot certificates through Windows monthly updates, with partner original equipment manufacturers (OEMs) making firmware updates available to help ensure compatibility." Google Cloud has also released guidance on how to update Compute Engine Shielded VM instances to trust the updated Microsoft Secure Boot certificates for UEFI Secure Boot. To apply Secure Boot certificate updates for Linux on Azure virtual machines, it's recommended to follow the actions outlined by Microsoft here. Separately, Linux users are advised to update their shims to the latest versions signed by the new key. It's important to note that devices that haven't received the newer 2023 certificates will continue to function normally, and standard Windows updates will continue to install. However, these devices will no longer receive new security protections for the early boot process, including updates to Windows Boot Manager, Secure Boot databases, revocation lists, or mitigations for newly discovered boot-level vulnerabilities. Fake OpenAI Organization Invites Used in New Poisoned Tenant Campaign — Phishing emails are being sent from threat actor-controlled ChatGPT tenants, inviting recipients to join an organization with the likely goal of harvesting sensitive information shared in the AI chatbot. "The emails came from OpenAI's legitimate notification address ([email protected]), passed all standard email authentication checks, and referenced our company by name," Push Security said. "They looked exactly like a routine organizational invitation because, technically, they were one." The development comes as threat actors are abusing AI chatbot chat sharing functionality to distribute pages containing malicious instructions, turning them into malware delivery platforms. "The attacker has used ChatGPT's code rendering feature to build a fully designed fake page that mimics a ChatGPT service disruption, redirecting victims to a convincing clone of ChatGPT's download page that delivers a malicious executable," Push Security noted. The activity has been codenamed LLMShare. 🔧 Cybersecurity Tools Sulla → It is an open-source security tool by Praetorian that scans internal network SMB file shares to find exposed credentials and sensitive data. Operating as a fast, low-noise static binary, it maps Active Directory environments and uses multi-layered filtering with the Titus engine to perform in-memory analysis for cloud keys, passwords, and tokens. It outputs structured, real-time results to help security teams identify and remediate internal data exposure before it can be exploited. Karna → It is a Web Application Firewall (WAF) module specifically engineered for the Kong Gateway to provide modern, scalable security for web applications. By integrating directly into the Kong ecosystem, it allows organizations to enforce fine-grained security policies and filter malicious traffic at the gateway layer, ensuring that protection is applied consistently across distributed services without adding significant latency. Disclaimer: This is strictly for research and learning. It hasn't been through a formal security audit, so don't just blindly drop it into production. Read the code, break it in a sandbox first, and make sure whatever you’re doing stays on the right side of the law. Conclusion This week, keep it simple. Break the small thing, find the forgotten access, wait for someone to say they meant to patch it. No genius required. Just old mistakes with fresh damage. Shut the door. Check the locks.

The internet did not break this week. It got used exactly as designed, which is worse. Searches were siphoned through shady browser add-ons. AI chat links turned into malware delivery paths. macOS attacks ran in memory and left almost nothing behind. Cloud agents looked like helpers until attackers treated them like open shells. Add exposed edge gear, poisoned packages, cash courier scams, stealers, loaders, and phishing that barely bothers pretending anymore. Here’s the full mess. DoH lands in Windows Server 2025Microsoft has announced that DNS-over-HTTPS (DoH) for Windows DNS Server is generally available on Windows Server 2025 for client-to-server DNS traffic. "With general availability, organizations can now deploy encrypted and authenticated client-to-resolver DNS traffic directly within their existing on-premises DNS infrastructure," the company said. "The goal is to help improve privacy, reduce spoofing risk, and advance Zero Trust DNS without requiring a new resolver architecture. Enabling DoH on Windows DNS Server introduces encrypted communication for supported clients over HTTPS while preserving compatibility with most existing DNS deployments. Organizations can expect DoH traffic between DoH clients and Windows DNS Server to be encrypted via TLS, DNS queries to be transported as HTTPS requests, existing DNS functionality to continue operating as expected, and mixed environments, encrypted and traditional DNS, to be supported." Search hijacks hide monetization layerA cluster of 23 deceptive Chrome browser extensions has been found stealthily overriding users' default search engines and routing queries through monetization middleware before delivering results. "Each extension presents a different advertised purpose - satellite imagery, productivity tools, news readers, maps – while the actual business is search affiliate revenue," security researcher Jean-Marie R. said. "The campaign spans at least 8 distinct monetization brokers and ~758,000 affected users. While this might look like simple adware, it is a real security risk. First, it is a massive privacy violation: every search a user makes is sent to anonymous third-party brokers. Second, because the operators control the web traffic, they can easily switch from showing regular search results to injecting phishing links or malicious downloads at any time – all without ever updating the extension code itself." Fileless macOS ClickFix attack chainA Russian-speaking attacker has been observed targeting victims mainly in Asia, North America, and Oceania across technology, media, and business services sectors using ClickFix lures to deliver an AppleScript-based infostealer to macOS users. The ClickFix pages masquerade as downloads for a malware scanning utility. "To evade detection, the entire infection chain, starting from the initial clipboard paste to payload execution, is completely fileless, leaving no static artifacts on disk until persistence is established," Netskope Threat Labs said. "Victims are socially engineered into executing a curl command that fetches a gzip-compressed stager, which pipes the second-stage AppleScript directly into osascript memory." The second-stage, codenamed "Meow (DEBUG)," uses a fake system dialog to harvest credentials, browser data, session cookies, and keychain contents. It's also equipped with capabilities to trojanize legitimate desktop cryptocurrency wallet applications and maintain persistent command-and-control (C2) access, allowing the operator to run arbitrary payloads. Claude chat abuse fuels malware deliveryIn another ClickFix campaign, threat actors have been spotted weaponizing Anthropic Claude's shared chat feature, abusing the trust associated with a legitimate domain to deliver the MacSync credential-stealing malware. "Cybercriminals hijacked Google Ads searches for popular AI developer tools to funnel over 2,000 victims toward malicious download pages before quietly moving their operation onto claude.ai's own platform, turning the trusted domain into a delivery mechanism for credential-stealing malware," Trend Micro said. "The Asia-Pacific region bore the brunt of the campaign, accounting for 67.2% of all confirmed victims, with Taiwan alone representing 30.5% of total traffic, a concentration that points to deliberate geographic ad targeting rather than opportunistic spread." As many as 106 unique malicious hostnames have been identified over a span of seven weeks across six distinct attack waves.Anthropic has since banned the accounts responsible, disabled the malicious shared conversations, and is implementing additional abuse mitigations for its shared chat feature. WhatsApp booking fraud spreads globallyBitdefender haș warned of an ongoing phishing campaign impersonating hotels, resorts, and accommodation providers across more than 10 countries. "Unlike traditional travel scams that rely on generic phishing emails, this operation uses real booking information, localized messaging, and convincing hotel branding to trick travelers into handing over payment card details," the Romanian cybersecurity company said. "Victims receive personalized messages containing names, stay dates, reservation details, and cancellation warnings. The campaign relies exclusively on WhatsApp, with no matching email or SMS infrastructure observed." Observed languages include English, German, French, Spanish, Romanian, and Polish. Similar campaigns have been reported by Sekoia and Netcraft in the past. AI agent targets vulnerability chaosAmazon Web Services (AWS) has announced a new artificial intelligence (AI)-powered security agent called AWS Continuum for code vulnerabilities, as models like Claude Mythos by attackers and defenders accelerate the ability to find and exploit vulnerabilities. AWS Continuum "addresses the full lifecycle of managing code vulnerabilities at machine speed. It continuously discovers vulnerabilities, validates which are genuinely exploitable, prioritizes them by business context, and helps you remediate them across the full stack within guardrails you define," AWS said. The tech giant said the agent is model agnostic, and that it uses multiple frontier models where they perform best. SD-WAN zero-day scope expandsCisco has updated its February 2026 advisory for CVE-2026-20127, a critical privilege escalation flaw in Catalyst SD-WAN Controller and Catalyst SD-WAN Manager, to note that the vulnerability also affects Catalyst SD-WAN Validator. The security flaw has been exploited as a zero-day since 2023 by a sophisticated threat actor known as UAT-8616. It allows an unauthenticated remote attacker to bypass authentication and obtain administrative privileges on an affected system by sending a crafted request. AI coding agent trust bypass exposedManifold Security has flagged two high-severity local code-execution paths on a developer's machine via a malicious repository in Cline, an AI coding agent VS Code extension with more than 4.3 million installs. The repository's content, in turn, tricks the agent into executing attacker-supplied shell commands under the developer's account, enabling access to credentials, source code, and other sensitive data. "Cline ships an Approve/Deny dialog and a "Safe Commands" auto-approve filter that are supposed to stop exactly this. Both fail," Ax Sharma, head of research at Manifold Security, said. "Clicking the URL preview tile to verify where the agent is fetching from runs an OS-level command instead. The Approve/Deny dialog never gates the click. 'Safe Commands' doesn't inspect commands. It asks the AI agent whether its own command is safe, and trusts the answer, even after the same agent has been manipulated by attacker content." While the findings have been classified as "out of scope," Cline plans to release fixes in an upcoming release. HTTP/2 abuse shifts to live reconnaissanceEarlier this month, Calif used OpenAI's Codex to discover an exploit called the HTTP/2 Bomb. Formally tracked as CVE-2026-49975, the vulnerability ironically chains together two features that were expressly designed to save internet bandwidth to help attackers amplify junk traffic by orders of magnitude. Imperva has since reported that attackers in the wild were "running specialized tools designed to map out" vulnerable servers. A working proof-of-concept (PoC) is publicly available. "Exposure in this set is led by communication services at 24.9% of observed assets, with information technology contributing 18.0% and healthcare close behind at 17.0%," CyCognito said. Exposed email server becomes phishing hubCybersecurity researchers have discovered an "interesting attack" where an unknown actor leveraged a victim's internet-facing terminal server as a phishing stager. Huntress said it recovered the full staging directory, including a legitimate bulk email software application (Gammadyne Mailer), a project file named dracii.mmp , and six target lists holding 8,894,920 email addresses. "The campaign impersonated the U.K. pharmacy chain Boots, using a 'free gift' survey as a lure," the company said. "The payload it pointed victims at was hosted on a compromised Bolivian government website, ipelc.gob[.]bo." The payload is a Boots phishing web page hosted within the /boots_store/ subdirectory that urges users to complete a survey and redeem a free gift by entering their personal and financial information. Bank phishing delivers in-memory stealerAn active phishing campaign is targeting banks to deliver Phantom Stealer, an infostealer that's sold under a subscription model for between $70 to $240 by a threat actor operating under the alias Oldphantomoftheopera. "The attack begins with phishing emails containing malicious attachments disguised as business documents," Fortra said. "Once executed, the malware runs entirely in memory, helping it evade traditional defenses. "The combination of targeted phishing delivery, advanced evasion techniques, broad credential harvesting capabilities, and a resilient multi-channel exfiltration infrastructure places this threat in the high-severity category." Phantom Stealer targets major web browsers as well as Discord, Telegram, and Steam. It is also used to steal financial information, cryptocurrency assets, and collect keystrokes, screenshots, and clipboard data. Quantum-safe mandate timeline setFrance's cybersecurity agency ANSSI said it would stop certifying security products that lack quantum-resistant encryption starting from 2027. It also requires businesses to purchase only quantum-safe products by 2030. State filters .ru email trafficAccording to local media reports, Estonia plans to implement additional security screening for emails sent from Russia's .ru top-level domain before they reach government officials, citing heightened cyber risk. The new measures are expected to take effect starting August 31, 2026. Imposter scams hit $3.5B lossesThe U.S. Federal Trade Commission (FTC) revealed that Americans lost a staggering $3.5 billion to imposter scams in 2025, with reported losses nearly tripling since 2020. "These scams lured consumers through text, phone, email, social media, search engine results, and other means. Some of the costliest impersonation scams start with a fake security alert, often from a bank," the FTC said. "People are convinced to move money to 'protect' it, with their losses often limited only by their available funds." In all, about $16 billion has been reported lost in 2025 to all types of fraud. Conti operator admits ransomware roleOleksii Oleksiyovych Lytvynenko, 44, has pleaded guilty to wire fraud conspiracy in connection with Conti, a ransomware variant that infected more than 1,000 computers and networks across the world. "Lytvynenko, of Cork, Ireland, conspired with others to deploy Conti ransomware to extort victims and steal their data," the U.S. Department of Justice said. "Lytvynenko admitted to joining the Conti conspiracy no later than approximately September 2021. He admitted to possessing data from eight U.S. and four overseas victims, which had been stolen by Conti conspirators. Lytvynenko further admitted to joining a team run by a Conti conspirator during which time Lytvynenko was directed to work on coding a 'loader,' which is typically a type of malware, or malicious software, that is used to load programs necessary to execute other malicious attacks." As of January 2022, Conti ransomware attacks resulted in at least $150 million in ransom payments. The Ukrainian national was extradited to the U.S. in October 2025. He is scheduled to be sentenced on September 10, 2026, and faces a maximum penalty of 20 years in prison. Steam wallpapers turn into account theft vectorThreat actors are abusing Steam Workshop to spread malware hidden in dozens of wallpaper packages, putting gamers' accounts at risk. The activity has been active since late 2025. "The attackers are primarily targeting gamers in China and Russia, aiming to hijack their accounts," Kaspersky said. "To pull this off, they are exploiting Wallpaper Engine – a popular live wallpaper app available on Steam – specifically leveraging its Workshop sharing feature. The malware is hidden inside the wallpaper packages users share with one another. Running one of these compromised wallpapers can lead to a stolen Steam account or leave the victim’s system infected with backdoors or crypto miners." Rust C2 framework hits npm supply chainThree npm packages, [email protected], [email protected], [email protected], have been found to act as droppers for Linux, Windows, and macOS systems to deliver a previously undocumented post-exploitation framework codenamed NastyC2. "Written entirely in Rust, it implements over 80 commands spanning credential harvesting, Active Directory attacks, container escape, cloud metadata theft, and fileless execution," Panther said. "The framework is comparable in scope to Cobalt Strike or Sliver, overlapping with both on BOF/COFF execution, reflective DLL loading, multi-technique process injection, AD-native Kerberoasting and DCSync, AMSI/ETW patching, SOCKS5 pivoting, and encrypted sleep." npm package delivers worm + miner + LPEA malicious npm package named [email protected] has been observed installing three different payloads, including a supply chain worm that spreads across six build ecosystems (Rust, Cargo, Python, CMake, and npm), a Monero cryptocurrency miner, and an exploit for Dirty Frag, a local privilege escalation (LPE) vulnerability impacting the Linux kernel. "All three run from memory, leaving no named file on disk," Panther said. "The embedded kernel exploit carries a GCC build timestamp of 2026-04-30 1, seven days before public disclosure of the Dirty Frag vulnerability." Although ELF timestamps can be forged, the development has raised the possibility that the threat actor may have had access to a working exploit code while details of the flaw were still under wraps. Multi-stage loader evades analysis chainAn active campaign is leveraging a multi-stage loader called OnionDrop to deliver malware families like LegionLoader (aka CurlyGate), CGrabber, and Vidar Stealer. OnionDrop is an advanced piece of malware with extensive defense evasion and anti-analysis features. "The chain starts with a ZIP archive and a legitimate Adobe-signed executable used for DLL side-loading," Cyderes said. "From there, the malicious DLL walks through four transformation stages: custom byte-pair decoding, Xpress Huffman decompression via RtlDecompressBufferEx, AES-256-CBC decryption with rotating key material, and final shellcode execution through TpPostWork callback abuse inside the Windows Thread Pool. This is a professionally engineered evasion framework that anyone with access can point at any target." Courier pickups extend crypto fraud lifecycleThe U.S. Federal Bureau of Investigation (FBI) has warned that scammers are instructing victims, usually senior citizens, to participate in cash pickups after engaging with them online by posing as individuals seeking business or romantic relationships. After establishing a relationship with the victim, the fraudster suggests investing in cryptocurrency and instructs the victim to download certain cryptocurrency trading applications and create investment accounts. "The scammers arrange for couriers to meet the victims in person to retrieve cash for fraudulent investments," the FBI said. "Legitimate financial institutions may deny suspicious funds transfers by victims, so scammers inform victims in-person cash pickups are required to continue investing with the fraudulent investment firm or to pay purported fines to withdraw their investments. Alternatively, the fraudulent cryptocurrency exchange may inform victims their account has been 'flagged,' allowing the scammer to suggest the use of cash couriers as an alternative." The dispatched couriers identify themselves using an agreed-upon code or a specific dollar bill serial number. When victims attempt to withdraw their perceived profits, the threat actors force them to pay non-existent taxes and penalties, again using couriers for cash pickups to continue the fraud. Belarus-linked Gmail phishing surgeCERT Polska has revealed that the Belarus-aligned Ghostwriter group has been running phishing campaigns targeting Gmail users through bogus messages designed to imitate official Gmail communications and trick recipients into clicking on malicious URLs that harvest their credentials. "These campaigns are carried out with high intensity, mainly on weekdays," the agency said. "Notably, they enable the theft of two-factor authentication (2FA) credentials. In recent weeks, our team has observed the use of new domains serving phishing pages almost daily." The campaign has targeted researchers, journalists, employees of public administration and law enforcement, and individuals connected to these groups through family or social relationships. OAuth device flow abused for account takeoverReversingLabs has detailed a Microsoft 365 device code phishing campaign that makes use of Microsoft's legitimate OAuth 2.0 Device Authorization Grant flow to obtain access to victim accounts. "The initial email sent to victims uses a lure that appears to be an approval for an estimate sent from a vendor to one of their customers," security researcher Robert Simmons said. "Rather than stealing passwords through a counterfeit login page, the phishing kit persuades victims to complete a legitimate Microsoft authentication process that authorizes an attacker-controlled device." Stealer-as-a-service adds refund guaranteeA new information stealer called OnyxC2 is being marketed on underground forums, giving customers access to a web panel and a payload builder. Most importantly, paying users are eligible for refunds if a build gets caught. "For $250 a month, operators get a kit that harvests browser credentials, password managers, two-factor authentication (2FA), and crypto wallets across roughly 210 applications and extensions, then ships it all back over an encrypted channel," BlackFog said. "The stealer reaches 37 Chromium-based and 8 Gecko-based browsers, then 95 Chromium and 14 Gecko extensions, including 6 dedicated two-factor authentication extensions. It also covers 5 password managers, 17 cryptocurrency wallets, 11 FTP clients, and 5 email clients, with a further set of VPN, remote access, messaging, note-taking, and gaming targets." A premium subscription is available for $500 per month. OnyxC2 also goes beyond a traditional steal by incorporating HVNC over a web browser, LSASS dumping, RunPE in memory and on disk, a reverse SOCKS5 proxy, screenshot capture, a keylogger, a file manager, and a reverse shell over HTTP, and a built-in TOR tunnel. AI-themed phishing drops AsyncRATA new campaign has been observed delivering malicious files disguised as AI-related documents in phishing emails to install AsynRAT. The attachments are distributed in the form of ZIP archives containing a Windows Shortcut (LNK) file that acts as a starting point for a stealthy, multi-stage attack chain. "These lures are designed to target users actively seeking AI-related learning resources," Fortinet FortiGuard Labs said. "The attack chain behind these files is remarkably complex, using multiple staged scripts to hide activity before ultimately deploying AutoHotkey-based loaders that reflectively inject a .NET remote access trojan [named clay_Client] and AsynRAT into memory for command-and-control communication and follow-on execution." GCP telemetry gap exposes detection blind spotsPermiso Security said it discovered an "interesting and practically significant inconsistency" associated with serviceData, a field that has been deprecated in favor of metadata for obtaining service-specific information. "If serviceData were cleanly deprecated and services had migrated away from it, one would expect a predictable pattern: events after the deprecation date would stop populating the serviceData field and would start populating the relevant data in metadata instead," security researcher Art Ukshini said. However, further testing has uncovered that some events still populate serviceData correctly, while others produce empty serviceData objects. The security company said this unreliable behavior of serviceData translates into a concrete set of security risks that can affect detection coverage, incident response, and compliance, requiring organizations to validate log telemetry end-to-end. Worm weaponizes AI refusal behaviorA variant of the Shai-Hulud worm has been found to include an adversarial prompt for "synthesizing weaponized biological agents suitable for aerosol dispersal" with an aim to target AI-powered malware scanners with an aim to trick the model into refusing a response for violating a safety guardrail, as opposed to classifying it as benign. "A refusal is supposed to be the safe outcome," JFrog said. "It's the model declining to do something harmful. Here, the refusal is the attack. If the scanner balks at the top of the file, it never reads the bottom, and the malware ships un-analyzed. Not because the model was fooled into trusting it, but because it was goaded into closing the book." Risk-based patching gets enforcement layerThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a new Binding Operational Directive, BOD 26-04, that prioritizes security updates for Federal Civilian Executive Branch (FCEB) agencies, requiring them to remediate high-risk vulnerabilities within accelerated timeframes based on internet exposure, presence of a vulnerability in the Known Exploited Vulnerabilities (KEV) catalog, whether exploitation can be automated for large-scale attacks, and if the exploitation can translate to partial or total control of a system. Based on these risk factors, agencies may have to address these flaws within three days. The development is a sign that AI is not only lowering the barrier to exploit development and accelerating vulnerability research, but also allowing attackers to quickly incorporate newly disclosed flaws into their arsenal. "Cyber threat actors exploit unpatched vulnerabilities, and their use of AI may further narrow the time defenders have to react between patch release and possible exploitation," CISA said. "These factors provide federal agencies with a comprehensive risk picture to make informed decisions that significantly reduce risk without burdening IT managers with extra processes that do not change outcomes." The lesson this week is not subtle. Trust is the attack surface now. The browser extension, the AI chat link, the OAuth flow, the coding agent, the package install, and the “known good” cloud helper. Attackers are not always breaking down the door anymore. They are finding the doors we already propped open for convenience. That means defense has to get less romantic about defaults. Watch the tools users trust, not just the files they download. Audit agents like accounts. Treat packages like code execution. Treat links from trusted platforms like links, not proof of safety. The internet did not collapse this week. It reminded us that “legitimate” is not the same as safe.

A French-speaking attacker broke into a small French automotive business, planted a keylogger, and stole banking and email credentials. Ordinary stuff, until one move near the end. Before his command-and-control server went dark, he installed OpenSSH and Tailscale on a victim's machine, building a way back in that did not run through the C2 at all. When the Havoc server went offline the next day, his access did not. Eighteen days later, the C2 came back, his agents reconnected on their own, and he carried on. Cato Networks captured the whole operation command by command, 339 of them over 33 days, after the operator left his SSH keys and a step-by-step playbook in an open storage bucket. The write-up, published Tuesday by Cato CTRL researcher Vitaly Simonovich, is a rare view of an intrusion from the operator's keyboard rather than the forensic leftovers. Researchers' lesson is blunt: pulling a C2 server offline is not remediation if the attacker has already built a separate door. The actor, handle "Poisson," is not an APT. Researchers describe a junior operator on what looks like a school schedule, active after 3 p.m. CET with a long midday gap, all of it running on free-tier kit: DuckDNS, Backblaze B2, and a cheap IONOS VPS in Berlin. His tradecraft was thin. He leaked his home directory five times, named his storage buckets after his own handle, and left a test file of his own keystrokes typed over and over inside the keylogger package. He failed at roughly half of what he tried. He compromised four machines anyway. The chain The malware ran almost entirely in memory. A VBScript stager with a sandbox-evasion delay decrypted a PowerShell loader, which pulled down a .NET loader that ran Havoc's Demon agent without dropping the implant to disk. For elevation, he used Start-Process -Verb RunAs, which is not a silent UAC bypass. It pops the Windows consent prompt and waits for someone to click Yes. On one victim, it took a dozen tries across two days. After that came the nailing-down: a scheduled task running at every logon with highest privileges, shellcode injected into Explorer.exe, and a custom-built RustDesk as a backup channel. The credential grabber was a 70-line Python keylogger that wrote keystrokes to a local file, with no beacon and no exfil server. Poisson just logged in, grabbed the file by hand, and ran powercfg to keep the machines from sleeping, so harvesting never paused. The move that matters On April 7, in a five-hour overnight session, he installed OpenSSH Server and Tailscale, joined the victim's machine to his private Tailscale network, and set up key-based SSH and a reverse tunnel. Now he could reach the machine over Tailscale's encrypted mesh with no C2 and no exposed ports. The next day, the Havoc infrastructure went offline. Cato does not say why, and it barely matters: the Tailscale path sat on a separate network, so the access lived. When the C2 returned on April 26, the agents reconnected automatically, no re-compromise required. Over the final five days, he ran 145 more commands, probed smart-card and certificate stores (a sign he was eyeing certificate-based logins), ran two unexplained executables from a file named Thales.zip for about 32 minutes total, then deleted 17 files and went quiet on May 1. What he wanted was narrow. No Mimikatz, no lateral movement, no ransomware, and no sign he took the documents he browsed, from tax records to insurance. Just what people type: banking logins, email passwords, government portals. For a small business owner, that is direct financial exposure. None of the tools is new, which is the point. China's APT31 used Tailscale through 2024 and 2025 to tunnel quietly out of Russian IT firms, Scattered Spider has leaned on legitimate remote-access tools like Ngrok and Fleetdeck, and RustDesk, Poisson's backup channel, turns up in recent Akira ransomware intrusions. The binaries are signed and legitimate, so detection that stops at bad files, not bad behavior, misses them. What Poisson adds is command-level proof that the trick outlives a takedown, run by someone clearly still learning. What to watch Cato's hunting list is concrete: Alert when OpenSSH Server installs on a Windows workstation, which is rarely legitimate. Watch for tailscale.exe on machines that have no reason to run a VPN. Look for ssh -R reverse tunnels heading to outside hosts. Check for wscript.exe running .vbs files out of user staging folders. Flag scheduled tasks set to the highest privileges that launch script interpreters. Watch for powercfg standby-timeout changes that keep machines awake. Block DuckDNS. The bigger one: when you find a C2, assume it is not the only way in, and go hunting for the quiet persistence layer behind it. What was in Thales.zip, and what those two programs did in their 32 minutes on the machine, is the question Cato leaves open. The answer that matters more: the C2 was never the intrusion, just one way into it. Kill it and leave OpenSSH, Tailscale, the scheduled task, and the keylogger running, and the attacker still has a way back in. That is the part remediation keeps missing.

Cybersecurity researchers have flagged a new malspam campaign that makes use of Google's DoubleClick domain as a way to evade detection and ultimately deliver an unidentified .NET-based loader. "Before the victim ever reaches attacker-controlled infrastructure, the lure routes through DoubleClick, a legitimate Google-owned domain that many security tools are less likely to treat as suspicious," Huntress researchers Anna Pham and Adam Mooney said in a report shared with The Hacker News. "From there, the victim is passed into a malspam kit that personalizes itself on the fly using the victim's email address, dynamically pulling in company branding and location details to make the page feel convincing without requiring the operators to handcraft a lure for each target." What makes this attack noteworthy is that it eliminates the need for having a bespoke kit for each targeted organization, thereby making these operations more scalable and cost-effective. The end goal of the campaign is to drop a .NET-based loader. The attack begins when an unsuspecting user opens an HTML file that's attached to a phishing email. The file triggers a meta-refresh browser redirect to a Google DoubleClick Campaign Manager click-tracking URL, from where the user is steered to another redirector, which decodes the Base64-encoded email address and leads the victim to a landing page containing a "Download PDF" button. Clicking the button causes the server to respond with a ZIP archive that initiates the rest of the infection chain. This is achieved by means of a JavaScript loader, whose main responsibility is to retrieve and execute a .NET RAT while flying under the radar. The script extracts and runs a PowerShell script, which then fetches a .NET loader from an external server. The loader acts as a stager that verifies it's not being analyzed, neutralizes the machine's security controls, sets up persistence, and then ultimately downloads and runs the RAT payload by using a technique called process hollowing that involves injecting the malware into Microsoft-signed processes. Once launched, the trojan communicates with a command-and-control (C2) server over raw TCP sockets, carries out system reconnaissance, and configures Microsoft Defender exclusions. The trojan also patches Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW) at the native API level at the outset in an effort to blind Windows telemetry before persistence is established on the host by setting up Run and RunOnce Registry entries, along with placing a loader responsible for launching the RAT in the user's Startup folder. The malware comes with capabilities to extract data, run commands, and deploy additional payloads, granting the attackers full control over the infected machines, while simultaneously taking steps to fly under the radar by terminating and rebooting the machine if it detects an analysis tool or determines that it's running in a sandboxed environment. "This is a strong reminder of why defence in depth matters," Huntress said. "Configuring a Group Policy Object (GPO) in Active Directory to force script files such as .vbs, .hta, and .js to open in Notepad by default can stop a threat actor at the very first stage, preventing additional payloads from ever being dropped." "On the email security front, organizations should consider deploying DMARC, DKIM, and SPF records to reduce the likelihood of spoofed or malicious emails reaching end users. Beyond that, an email gateway solution capable of sandboxing attachments and links before delivery adds another meaningful layer of protection." (The story was updated after publication to reflect a change in original analysis that originally attributed the activity to DesckVB RAT. A "follow-up review" has since identified the final payload to be a .NET loader.)

Cybersecurity researchers have flagged a new campaign targeting Minecraft players via YouTube to spread malware capable of gaining control of victims' systems. The Minecraft-focused malware-as-a-service (MaaS) campaign has been codenamed Weedhack by McAfee Labs, stating the activity has been active since January 2026 and impersonates Minecraft clients and mods to infect users. In all, 3820 unique malicious JAR files and over 240 URLs responsible for distributing the malware have been identified. "This campaign utilizes SEO poisoning and YouTube to generate traffic to these malicious URLs," security researcher Aayush Tyagi said. "We also found two YouTube channels and multiple videos that demonstrate Minecraft Mods and Clients and redirect viewers to these URLs." Central to the campaign is an enterprise-grade dashboard ("weedhack[.]to") that enables customers to view stolen credentials and system information, as well as remotely keep tabs on the compromised systems. Furthermore, it allows criminals to create custom payloads that can target Minecraft versions 1.21.0 to 1.21.11, not to mention inject the malware into legitimate Minecraft mods. The starting point of the attack is a malicious JAR file ("DonutDupe.jar") downloaded from the malicious websites. The file then retrieves details of the command-and-control (C2) server domain using a known technique called EtherHiding, which employs the Ethereum blockchain as a dead drop resolver. In the next stage, the malware contacts the C2 server to fetch another Java-based JAR payload ("Elevator.jar") that collects system information, configures Microsoft Defender exclusions, and serves as a conduit for dropping two additional JAR payloads. The third JAR payload ("SecurityManager.jar") establishes persistence and acts as a stager for the final component ("Component.jar") that deploys the remote access features. The threat actors behind the tooling leverage a Telegram channel to advertise their warez, broadcast updates, and provide customer support. The channel has more than 850 members. The tool, for its part, comes in two tiers - Free, which includes a comprehensive infostealer that can target Minecraft session IDs and four Minecraft launchers; capture screenshots; and harvest files, system information, cookies, and passwords from 36 different web browsers, data from 56 browser-based cryptocurrency wallets and 12 desktop wallet apps, and credentials for Discord, Steam, and Telegram. Premium, which starts at $4.99 per month (or $24.99 for a lifetime license) and offers additional remote access capabilities, such as webcam access, keylogging, reverse shell execution, screen sharing with keyboard and mouse access, and file uploads and downloads. Attack chains revolve around SEO poisoning and YouTube videos containing descriptions that embed links to malicious Minecraft Clients to target unsuspecting users. The majority of Weedhack infections have been identified in the U.S., followed by Germany, India, the U.K., Italy, Vietnam, Canada, Norway, Sweden, Finland, and Spain. "One of the key features that makes Weedhack unique is that it is hosted on the clear net and provides access to sophisticated malware for free," Tyagi said. "This difference in cost and ease of access with detailed tutorials on how to use the malware significantly reduces the barrier to entry for prospective customers. Furthermore, its ability to steal Minecraft accounts attracts a younger audience. Both of these factors complement each other and make the campaign much more lethal." McAfee Labs said it has also observed the malware acting as a trigger for cyberbullying, where the customers, who appear to be teenagers and young adults, are weaponizing its remote access capabilities to threaten, harass, and monitor their victims. They have found a way to record victims via their webcams and shared the videos on the Telegram channel as "trophies." CountLoader Delivers Crypto Clipper The disclosure comes as the cybersecurity company shed light on a large-scale CountLoader campaign that's estimated to have compromised 86,000 unique machines. CountLoader is a JavaScript loader that's typically distributed via cracked software distribution sites. It's known to deploy various payloads like Cobalt Strike, AdaptixC2, PureHVNC RAT, Amatera Stealer, and PureMiner. Of these compromises, approximately 9,000 infections are said to have resulted from the malware spreading via USB drives and removable media. McAfee Labs said the highest number of infections was observed in India, followed by Indonesia, the U.S., and several countries across Southeast Asia, adding it was able to successfully sinkhole the malware communication infrastructure by registering a fake C2 domain. "The infection begins when an EXE file is executed," the company said. "This file launches a PowerShell command, which downloads and executes an obfuscated JavaScript loader known as CountLoader. The loader is executed using 'mshta.exe.'" Once executed, CountLoader sets up persistence, communicates with the C2 server, attempts to spread via USB drives, and awaits further instructions from the C2 server to download and execute payloads. The final payload deployed in the latest set of attacks is a cryptocurrency clipper malware that hijacks clipboard content to redirect cryptocurrency transactions. Pirated Content Leads to Cryptocurrency Miners The findings also follow the discovery of a years-long campaign that has used illegal movie and TV show streaming sites to distribute a cryptocurrency miner under the guise of a fake update for a video player plugin. The bogus update downloads a ZIP archive, which then uses DLL side-loading to drop a fork of SilentCryptoMiner. The malware is equipped with a wide range of capabilities - Configure Defender exclusions, terminate Microsoft's Malicious Software Removal Tool, and disable automatic hibernation and sleep mode to maximize the miner's potential runtime on the device. Repeatedly trigger User Account Control (UAC) prompts until the process is successfully executed with elevated privileges. Initiate a watchdog component that ensures the uninterrupted operation of the miner. Run a RAT agent that provides remote control capabilities, including running arbitrary commands, launching EXE files using "explorer.exe," and running shellcode. Launch an XMRig-based CPU and a GPU miner. "The archive contained a legitimate executable, HLS Installer.874.exe, alongside a malicious DLL. Launching the EXE triggered a DLL side-loading mechanism, injecting the malicious module into a legitimate program process and executing code within its context," Kaspersky said. "The library contained the logic for deploying the miner and establishing persistence on the device." It's assessed that the activity is a continuation of a campaign that was documented by NTT Security in April 2023, which used fake browser crash warnings to drop a cryptocurrency miner. "The threat actors leverage a variety of sites, ranging from online libraries to movie and TV show streaming platforms," Kaspersky said. "There is no telling what channels they will use to distribute the malicious archive in the future. However, the current case shows that users visiting pirated websites continue to take a serious risk." Update In a new analysis published on June 24, 2026, Dark Atlas revealed that Weedhack started off as a "private, targeted credential stealer" under the name Majanito in late 2025, and it underwent a change in ownership and branding in early 2026. Over 116,000 endpoints have been compromised between January and June 2026. It's tracking the first-stage JAR payload under the name LoaderClient. "On execution, the malware harvests the victim’s Minecraft session including display name, account UUID, and live Microsoft OAuth access token, then queries an Ethereum smart contract to resolve its C2 URL, downloads a second-stage payload, and executes it entirely in memory," the company said. "The Weedhack campaign represents a convergence of consumer-grade malware, blockchain infrastructure abuse, and the unregulated ecosystem of third-party game modifications."

Cybersecurity researchers have flagged a compromised version of the Nx Console extension that was published to the Microsoft Visual Studio Code (VS Code) Marketplace. The extension in question is rwl.angular-console (version 18.95.0), a popular user interface and plugin for code editors like VS Code, Cursor, and JetBrains. The VS Code extension has more than 2.2 million installations. "Within seconds of a developer opening any workspace, the compromised extension silently fetched and executed a 498 KB obfuscated payload from a dangling orphan commit hidden inside the official nrwl/nx GitHub repository," StepSecurity researcher Ashish Kurmi said. The payload is a "multi-stage credential stealer and supply chain poisoning tool" that harvests developer secrets and exfiltrates them via HTTPS, the GitHub API, and DNS tunneling. It also installs a Python backdoor on macOS systems that abuses the GitHub Search API as a dead drop resolver for receiving further commands. In an advisory issued Monday, the maintainers of the extension said the root cause has been traced to one of its developers, whose machine was compromised in a recent security incident that leaked their GitHub credentials. Although the nature of the prior "incident" was not disclosed, the developer's credentials have since been temporarily revoked. The access afforded by the credentials is said to have been abused to push an orphaned, unsigned commit to nrwl/nx, which introduces the stealer malware. The malicious action is triggered as soon as a developer opens any workspace in VS Code, leading to the installation of the Bun JavaScript runtime to run an obfuscated "index.js" payload. The malware runs checks to avoid infecting machines likely located in the Russian/CIS time zones and launches itself as a detached background process to kick off the credential harvesting workflow, allowing it to retrieve sensitive data from 1Password vaults and Anthropic Claude Code configurations, and secrets associated with npm, GitHub, and Amazon Web Services (AWS). "One capability that stands out: the payload contains full Sigstore integration, including Fulcio certificate issuance and SLSA provenance generation," StepSecurity said. "Combined with stolen npm OIDC tokens, this means the attacker could publish downstream npm packages with valid, cryptographically signed provenance attestations, making the malicious packages appear as legitimate, verified builds." The Nx team also acknowledged a "few users were compromised" as a result of this breach. Besides urging users to update to 18.100.0 or later, the maintainers have published the following indicators of compromise - Nx Console version 18.95.0 was installed during the exposure window between May 18, 2026, at 2:36 p.m. CEST and 2:47 p.m. CEST. Presence of files like ~/.local/share/kitty/cat.py, ~/Library/LaunchAgents/com.user.kitty-monitor.plist, /var/tmp/.gh_update_state, or /tmp/kitty-*. Presence of any of the following running processes: a python process running cat.py and a process with __DAEMONIZED=1 in its environment. Affected users are recommended to terminate the aforementioned processes, delete artifacts on disk, and rotate all credentials reachable from the affected machine, including tokens, secrets, and SSH keys. The development marks the second time the Nx ecosystem has been targeted within a year. In August 2025, several npm packages were infected by a credential stealer as part of a supply chain attack campaign named s1ngularity. Unlike the previous iteration, the latest attack targets the VS Code extension. Malicious npm Packages Galore The findings coincide with the discovery of various malicious packages in the open-source repositories - iceberg-javascript, supabase-javascript, auth-javascript, microsoft-applicationinsights-common, and ms-graph-types: Five npm packages containing a hidden ELF binary that backdoors Claude Code sessions to steal developer credentials. noon-contracts: an npm package that impersonates a Noon Protocol smart contract SDK to exfiltrate SSH keys, crypto wallet private keys, AWS credentials, Kubernetes secrets, all .env files, shell history, Docker/Git/npm tokens, and browser wallet storage paths. martinez-polygon-clipping-tony: a trojanized fork of martinez-polygon-clipping that uses a postinstall hook to download a 17MB PyInstaller-packed Windows remote access trojan (RAT) that uses Telegram for command-and-control (C2) for remote shell execution, screenshot capture, file upload/download, and arbitrary Python execution. common-tg-service: an npm package that contains functionality to take over a victim's Telegram account while masquerading as "Common Telegram service for NestJS applications." exiouss: an npm package that bundles a ChatGPT and OpenAI session cookie stealer targeting web browsers like Google Chrome, Microsoft Edge, and Brave. k8s-pod-checker, dev-env-setup, and node-perf-utils: three npm packages part of the kube-health-tools cluster that install a large language model (LLM) proxy service on the victim's machine, allowing the attacker to route LLM traffic through the compromised server A coordinated credential harvesting campaign orchestrated by an Indonesian-speaking threat actor using a set of 38 npm packages that leverages dependency confusion as a way to trick CI/CD pipelines to resolve malicious public packages ahead of legitimate private ones associated with Apple, Google, and Alibaba, among others. An unusual campaign wherein seven npm packages under the @hd-team organization have been found to act as a stager for configurations used by a Chinese sports gambling and pirated streaming platform named Douqiu to determine the backend servers to connect to. Update On May 20, 2026, the Nx team disclosed that it's working with Microsoft and GitHub to understand the impact following the publication of the malicious Nx Console version 18.95.0 by unknown threat actors. "Initially, Microsoft indicated to us that there were 28 installs of the malicious version 18.95.0," Jeff Cross, co-founder of Narwhal Technologies, the company behind nx.dev, said. "Based on our own analytics for the compromised version, we currently believe the number of users who received the malicious package may be significantly higher; potentially over 6,000 installs." All the installs originated from VS Code, according to an updated advisory. As many as 41 installs came from the Open VSX registry. Nx Console Hack Stemmed from TanStack Supply Chain Attack In a fresh update shared on May 21, 2026, the Nx team officially acknowledged that one of its developers was compromised by a recent supply chain compromise targeting TanStack, causing their GitHub credentials to be leaked. "This allowed the attacker to run workflows on our GitHub repository as a contributor," the maintainers said. In a post-mortem published on May 21, 2026, the Nx team warned that anyone who had Nx Console with auto-update enabled during the exposure window should assume compromise. The malicious version was published on May 18, 2026, between 12:30 and 1:09 p.m. UTC. The extension was live in the Visual Studio Marketplace package for about 11 minutes and nearly 36 minutes in Open VSX. "The attacker published the malicious version as a legitimate Nx core contributor," the maintainers said. "A credential-stealing payload that arrived through the TanStack supply-chain compromise had silently exfiltrated that contributor's GitHub CLI OAuth token seven days earlier. Between credential theft on May 11 and the marketplace publish on May 18, the attacker was active in our GitHub repos for seven days without detection." Following the incident, the Nx team has rolled out a number of changes, including requiring approval to publish Nx Console, enhanced monitoring GitHub audit log for suspicious events, for example workflow-run deletions, and pinning GitHub Action SHAs instead of floating refs (e.g., @v6, @main) across all repositories.

A malicious Hugging Face repository managed to take a spot in the platform's trending list by impersonating OpenAI's Privacy Filter open-weight model to deliver a Rust-based information stealer to Windows users. The project, named Open-OSS/privacy-filter, masqueraded as its legitimate counterpart released by OpenAI late last month (openai/privacy-filter), including copying the entire description verbatim to trick unsuspecting users into downloading it. Access to the malicious model has since been disabled by Hugging Face. Privacy Filter was unveiled in April 2026 by the artificial intelligence (AI) company as a way to detect and redact personally identifiable information (PII) in unstructured text with an aim to incorporate strong privacy and security protections into applications. "The repository had typosquatted OpenAI's legitimate Privacy Filter release, copied its model card nearly verbatim, and shipped a loader.py file that fetches and executes infostealer malware on Windows machines," the HiddenLayer Research Team said in a report published last week. The malicious project instructs users to clone the repository and run a batch script ("start.bat") for Windows or a Python script ("loader.py") for Linux or macOS systems to configure all necessary dependencies and start the model. Once launched, the Python script triggers malicious code responsible for disabling SSL verification, decoding a Base64-encoded URL hosted on JSON Keeper, and using it to extract a command that's passed to PowerShell for subsequent execution.The use of JSON Keeper, a public JSON paste service, as a dead drop resolver allows the attackers to switch payloads on the fly without the need for modifying the repository. The PowerShell command is used to download a batch script from a remote server ("api.eth-fastscan[.]org") and launch it using "cmd.exe."The batch script functions as a second-stage downloader that prepares the environment by elevating its privileges by means of a User Account Control (UAC) prompt, configuring Microsoft Defender Antivirus exclusions, downloading the next-stage binary from the same domain, and setting up a scheduled task that launches a PowerShell script to run the executable. Once the scheduled task is launched, the malware waits for two seconds before deleting itself. The final stage is an information stealer that's designed to take screenshots and harvest data from Discord, cryptocurrency wallets and extensions, system metadata, files such as FileZilla configurations and wallet seed phrases, and web browsers based on the Chromium and Gecko rendering engines. "Despite using a scheduled task, this stage establishes no persistence: the task is destroyed before any reboot. It is being used as a one-shot SYSTEM-context launcher," HiddenLayer explained. The stealer also runs checks to detect debuggers and sandboxes, ascertains it's not running in a virtual machine, and tries to disable Windows Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW) to evade behavioural detection. The stolen data is exfiltrated in JSON format to the "recargapopular[.]com" domain. Prior to it being disabled, the model is said to have reached the #1 trending position on Hugging Face with approximately 244,000 downloads and 667 likes within 18 hours. It's suspected that these numbers were artificially inflated to give the repository an illusion of trust and get users to download it. Further analysis of the activity has unearthed six more repositories that feature a similar Python loader to deploy the stealer - anthfu/Bonsai-8B-gguf anthfu/Qwen3.6-35B-A3B-APEX-GGUF anthfu/DeepSeek-V4-Pro anthfu/Qwopus-GLM-18B-Merged-GGUF anthfu/Qwen3.6-35B-A3B-Claude-4.6-Opus-Reasoning-Distilled-GGUF anthfu/supergemma4-26b-uncensored-gguf-v2 HiddenLayer said it also observed the "api[.]eth-fastscan[.]org" domain being used to serve a different Windows executable ("o0q2l47f.exe") that beacons out to "welovechinatown[.]info," a command-and-control (C2) server previously put to use in a campaign in which a malicious npm package named trevlo was leveraged to deliver ValleyRAT (aka Winos 4.0). The Node.js library was downloaded more than 2,300 times after it was published by a user named "titaniumg" on April 4, 2026, although it's not clear if the download count was artificially boosted using automated processes. It's no longer available on npm. "The package's postinstall hook silently executes an obfuscated JavaScript loader that spawns a base64-encoded PowerShell command, which in turn fetches and executes a second-stage PowerShell script from attacker-controlled infrastructure," Panther noted last month. "That script downloads and runs a Winos 4.0 stager binary ("CodeRun102.exe") with full evasion, complete with hidden window execution, Zone Identifier removal, and process detachment." The attack is noteworthy for the fact that it represents a new initial access vector for ValleyRAT, a modular remote access trojan that's known to be distributed via phishing emails and search engine optimization (SEO) poisoning. The use of ValleyRAT is exclusively attributed to a Chinese hacking group dubbed Silver Fox. "The shared infrastructure suggests these campaigns are possibly linked and likely part of a broader supply chain operation targeting open-source ecosystems," HiddenLayer said.

A sophisticated China-nexus advanced persistent threat (APT) group has been attributed to attacks targeting government entities in South America since at least late 2024 and government agencies in southeastern Europe in 2025. The activity is being tracked by Cisco Talos under the moniker UAT-8302, with post-exploitation involving the deployment of custom-made malware families that have been put to use by other China-aligned hacking groups. Notable among the malware families is a .NET-based backdoor dubbed NetDraft (aka NosyDoor), a C# variant of FINALDRAFT (aka Squidoor) that has been previously linked to threat clusters known as Ink Dragon, CL-STA-0049, Earth Alux, Jewelbug, and REF7707. ESET is tracking the use of NosyDoor to a group it calls LongNosedGoblin. Interestingly, the same malware has also been deployed against Russian IT organizations by a threat actor referred to as Erudite Mogwai (aka Space Pirates and Webworm), per Russian cybersecurity company Solar, which has given it the name LuckyStrike Agent. Some of the other tools utilized by UAT-8302 are as follows - CloudSorcerer, a backdoor observed in attacks targeting Russian entities since May 2024. SNOWLIGHT, a VShell stager used by UNC5174, UNC6586, and UAT-6382. Deed RAT (aka Snappybee), a successor of ShadowPad, and Zingdoor, both of which have been deployed by Earth Estries in late 2024. Draculoader, a generic shellcode loader that's used to deliver Crowdoor and HemiGate. "Malware deployed by UAT-8302 connects it to several previously publicly disclosed threat clusters, indicating a close operating relationship between them at the very least," Talos researchers Jungsoo An, Asheer Malhotra, and Brandon White said in a technical report published today. "Overall, the various malicious artifacts deployed by UAT-8302 indicate that the group has access to tools used by other sophisticated APT actors, all of which have been assessed as China-nexus or Chinese-speaking by various third-party industry reports." It's currently not known what initial access methods the adversary employs to break into target networks, but it's suspected to involve the tried-and-tested approach of weaponizing zero-day and N-day exploits in web applications. Upon gaining a foothold, the attackers are known to conduct extensive reconnaissance to map out the network, run open-source tools like gogo to perform automated scanning, and move laterally across the environment. The attack chains culminate in the deployment of NetDraft, CloudSorcerer (version 3.0), and VShell. UAT-8302 has also been observed using a Rust-based variant of SNOWLIGHT called SNOWRUST to download the VShell payload from a remote server and execute it. Besides using custom malware, the threat actor sets up alternative means of backdoor access using proxy and VPN tools like Stowaway and SoftEther VPN. The findings underscore the trend of advanced collaboration tactics between multiple China-aligned groups. In October 2025, Trend Micro shed light on a phenomenon called "Premier Pass-as-a-Service," where initial access obtained by Earth Estries is passed to Earth Naga for follow-on exploitation, clouding attrition efforts. This partnership is assessed to have existed since at least late 2023. "Premier Pass-as-a-Service provides direct access to critical assets, reducing the time spent on reconnaissance, initial exploitation and lateral movement phases," Trend Micro said. "Although the full extent of this model is not yet known, the limited number of observed incidents, combined with the substantial risk of exposure such a service entails, suggests that access is likely restricted to a small circle of threat actors."

A previously undocumented threat cluster dubbed UAT-10362 has been attributed to spear-phishing campaigns targeting Taiwanese non-governmental organizations (NGOs) and suspected universities to deploy a new Lua-based malware called LucidRook. "LucidRook is a sophisticated stager that embeds a Lua interpreter and Rust-compiled libraries within a dynamic-link library (DLL) to download and execute staged Lua bytecode payloads," Cisco Talos researcher Ashley Shen said. The cybersecurity company said it discovered the activity in October 2025, with the attack using RAR or 7-Zip archives lures to deliver a dropper called LucidPawn, which then opens a decoy file and launches LucidRook. A notable characteristic of the intrusion set is the use of DLL side-loading to execute both LucidPawn and LucidRook. There are two distinct infection chains that lead to LucidRook, one using a Windows Shortcut (LNK) file with a PDF icon and another involving an executable that masquerades as an antivirus program from Trend Micro. The entire sequence is listed below - LNK-based infection chain - When the user clicks the LNK file, assuming it's a PDF document, it executes a PowerShell script to run a legitimate Windows binary ("index.exe") present in the archive, which then sideloads a malicious DLL (i.e., LucidPawn). The dropper, for its part, once again employs DLL side-loading to run LucidRook. EXE-based infection chain - When the purported Trend Micro program ("Cleanup.exe") within the 7-Zip archive is launched, it acts as a simple .NET dropper that employs DLL side-loading to run LucidRook. Upon execution, the binary displays a message stating the cleanup process has completed. A 64-bit Windows DLL, LucidRook, is heavily obfuscated to deter analysis and detection. Its functionality is two-pronged: it collects system information and exfiltrates it to an external server, and then receives an encrypted Lua bytecode payload for subsequent decryption and execution on the compromised machine using the embedded Lua 5.4.8 interpreter. "In both cases, the actor abused an Out-of-band Application Security Testing (OAST) service and compromised FTP servers for command-and-control (C2) infrastructure," Talos said. LucidPawn also implements a geofencing technique that specifically queries the system UI language and continues execution only if it matches Traditional Chinese environments associated with Taiwan ("zh-TW"). This offers two-fold advantages, as it limits execution to the intended victim geography and avoids getting flagged in common analysis sandboxes. Furthermore, at least one variant of the dropper has been found to deploy a 64-bit Windows DLL named LucidKnight that's capable of exfiltrating system information via Gmail to a temporary email address. The presence of the reconnaissance tool alongside LucidRook suggests the adversary operates a tiered toolkit, potentially using LucidKnight to profile targets before delivering the LucidRook stager. Not much is known about UAT-10362 at this stage other than the fact that it's likely a sophisticated threat actor whose campaigns are targeted rather than opportunistic, while prioritizing flexibility, stealth, and victim-specific tasking. "The multi-language modular design, layered anti-analysis features, stealth-focused payload handling of the malware, and reliance on compromised or public infrastructure indicate UAT-10362 is a capable threat actor with mature operational tradecraft," Talos said.

Cybersecurity researchers have discovered a remote access toolkit of Russian-origin that's distributed via malicious Windows shortcut (LNK) files that are disguised as private key folders. The CTRL toolkit, according to Censys, is custom-built using .NET and includes various executables" to facilitate credential phishing, keylogging, Remote Desktop Protocol (RDP) hijacking, and reverse tunneling via Fast Reverse Proxy (FRP). "The executables provide encrypted payload loading, credential harvesting via a polished Windows Hello phishing UI, keylogging, RDP session hijacking, and reverse proxy tunneling through FRP," Censys security researcher Andrew Northern said. The attack surface management platform said it recovered CTRL from an open directory at 146.19.213[.]155 in February 2026. Attack chains distributing the toolkit rely on a weaponized LNK file ("Private Key #kfxm7p9q_yek.lnk") with a folder icon to trick users into double-clicking it. This triggers a multi-stage process, with each stage decrypting or decompressing the next, until it leads to the deployment of the toolkit. The LNK file dropper is designed to launch a hidden PowerShell command, which then wipes existing persistence mechanisms from the victim's Windows Startup folder. It also decodes a Base64-encoded blob and runs it in memory. The stager, for its part, tests TCP connectivity to hui228[.]ru:7000 and downloads next-stage payloads from the server. Furthermore, it modifies firewall rules, sets up persistence using scheduled tasks, creates backdoor local users, and spawns a cmd.exe shell server on port 5267 that's accessible through the FRP tunnel. One of the downloaded payloads, "ctrl.exe," functions as a .NET loader for launching an embedded payload, the CTRL Management Platform, which can serve either as a server or a client depending on the command-line arguments. Communication occurs over a Windows named pipe. "The dual-mode design means the operator deploys ctrl.exe once on the victim (via the stager), then interacts with it by running ctrl.exe client through the FRP-tunneled RDP session," Censys said. "The named pipe architecture keeps all C2 command traffic local to the victim machine — nothing traverses the network except the RDP session itself." The supported commands allow the malware to gather system information, launch a module designed for credential harvesting, and start a keylogger as a background service (if configured as a server) to capture all keystrokes to a file named "C:\Temp\keylog.txt" by installing a keyboard hook, and exfiltrate the results. The credential harvesting component is launched as a Windows Presentation Foundation (WPF) application that mimics a real Windows PIN verification prompt to capture the system PIN. The module, besides blocking attempts to escape the phishing window via keyboard shortcuts like Alt+Tab, Alt+F4, or F4, validates the entered PIN against the real Windows credential prompt via UI automation by using the SendKeys() method. "If the PIN is rejected, the victim is looped back with an error message," Northern explained. "The window remains open even if the PIN successfully validates against the actual Windows authentication system. The captured PIN is logged with the prefix [STEALUSER PIN CAPTURED] to the same keylog file used by the background keylogger." One of the commands built into the toolkit allows it to send toast notifications impersonating web browsers like Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Vivaldi, Yandex, and Iron to conduct additional credential theft or deliver other payloads. The two other payloads dropped as part of the attack are listed below - FRPWrapper.exe, which is a Go DLL that's loaded in memory to establish reverse tunnels for RDP and a raw TCP shell through the operator's FRP server. RDPWrapper.exe, which enables unlimited concurrent RDP sessions. "The toolkit demonstrates deliberate operational security. None of the three hosted binaries contain hard-coded C2 addresses," Censys said. "All data exfiltration occurs through the FRP tunnel via RDP — the operator connects to the victim’s desktop and reads keylog data through the ctrl named pipe. This architecture leaves minimal network forensic artifacts compared to traditional C2 beacon patterns." "The CTRL toolkit demonstrates a trend toward purpose-built, single-operator toolkits that prioritize operational security over feature breadth. By routing all interaction through FRP reverse tunnels to RDP sessions, the operator avoids the network-detectable beacon patterns that characterize commodity RATs."

The Coruna exploit kit is an evolution of the framework used in the Operation Triangulation espionage campaign, which in 2023 targeted iPhones via zero-click iMessage exploits. The software has been expanded to target modern hardware, specifically including Apple's A17 and M3 chips, as well as operating systems up to iOS 17.2. Coruna contains five full iOS exploit chains leveraging 23 vulnerabilities, among them CVE-2023-32434 and CVE-2023-38606 also used in Operation Triangulation. After analyzing the exploit code for the two security issues, Kaspersky researchers determined that Coruna ran an updated version of the exploit used in Operation Triangulation that had started since 2019. Additional code similarities led to the conclusion that the kit is the successor to the malicious framework leveraged in the Triangulation campaign that also targeted iPhones on Kaspersky's network. “During our analysis we’ve discovered that the kernel exploit for CVE-2023-32434 and CVE-2023-38606 vulnerabilities used in Coruna, in fact, is an updated version of the same exploit that was used in Operation Triangulation,” the researchers say in a report today. Kaspersky's analysis shows that the attack begins in Safari with a stager that fingerprints the device, selects suitable RCE and PAC exploits, and then retrieves encrypted metadata for subsequent stages. The payload downloads additional encrypted components, decrypts them using ChaCha20, decompresses them with LZMA, and parses custom container formats to obtain package information. Based on the device’s architecture and iOS version, it selects and executes the appropriate kernel exploit, Mach-O loader, and launcher to deploy the spyware implant. Kaspersky’s findings indicate that the payloads support targeting ARM64 and ARM64E architectures, with explicit checks for A17, M3, M3 Pro, and M3 Max chips. Also, the package IDs and system checks indicate that the exploits can target: iOS < 14.0 beta 7 iOS < 14.7 iOS < 16.5 beta 4 iOS < 16.6 beta 5 iOS < 17.2 Boris Larin, principal security researcher at Kaspersky Global Research and Analysis Team (GReAT), says the connection with Triangulation became evident after analyzing Coruna's binaries. "Coruna is not a patchwork of public exploits; it is a continuously maintained evolution of the original Operation Triangulation framework." Additionally, the developers continued to update the framework by including checks for newer processors (e.g., M3) and iOS builds. Since Coruna has also been used in financially-motivated campaigns aiming to steal cryptocurrency via fake exchange websites, Larin notes that "what began as a precision espionage tool is now deployed indiscriminately." Operation Triangulation was a highly sophisticated iOS espionage campaign that used multiple zero-day exploits to silently infect iPhones and deploy spyware implants. It was discovered by Kaspersky during internal WiFi network monitoring in June 2023, though the campaign had started four years earlier. In late 2023, the same researchers found that these attacks leveraged undocumented features in Apple chips to bypass hardware-based security protections. Another exploit kit, dubbed DarkSword, was disclosed earlier this month by researchers at mobile security companies Lookout and iVerify, and Google. Like Coruna, DarkSword is being used by multiple threat actors, but all appear to be leveraging it for espionage operations. It should be noted that DarkSword is now publicly available, which increases the risk of cybercriminals starting to leverage it against unpatched iPhones. Apple has published a bulletin to address all these recently uncovered exploit kits, noting that fixes for all flaws have been made available via security updates for the latest, as well as earlier, iOS versions. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

The kernel exploit for two security vulnerabilities used in the recently uncovered Apple iOS exploit kit known as Coruna is an updated version of the same exploit that was used in the Operation Triangulation campaign back in 2023, according to new findings from Kaspersky. "When Coruna was first reported, the public evidence wasn't sufficient to link its code to Triangulation — shared vulnerabilities alone don't prove shared authorship," Boris Larin, principal security researcher at Kaspersky GReAT, told The Hacker News in a statement. "Coruna is not a patchwork of public exploits; it is a continuously maintained evolution of the original Operation Triangulation framework. The inclusion of checks for recent processors like the M3 and newer iOS builds shows that the original developers have actively expanded this codebase. What began as a precision espionage tool is now deployed indiscriminately." Coruna was first documented by Google and iVerify earlier this month as targeting Apple iPhone models running iOS versions between 13.0 and 17.2.1. Although the use of the kit was first used by a customer of an unnamed surveillance company early last year, it has since been leveraged by a suspected Russia-aligned nation-state actor in watering hole attacks in Ukraine and in a mass exploitation campaign that employed a cluster of fake Chinese gambling and cryptocurrency websites to deliver a data-stealing malware known as PlasmaLoader (aka PLASMAGRID). The exploit kit contains five full iOS exploit chains and a total of 23 exploits, including CVE-2023-32434 and CVE-2023-38606, both of which were first used as zero-days in Operation Triangulation, a sophisticated campaign targeting iOS devices that involved the exploitation of four vulnerabilities in Apple's mobile operating system. The latest findings from Kaspersky indicated the kernel exploits in both Triangulation and Coruna were created by the same author, with Coruna also using four additional kernel exploits. The Russian security vendor said all these exploits are built on the same kernel exploitation framework and share common code. Specifically, the code includes support for Apple's A17, M3, M3 Pro, and M3 Max processors, along with checks for iOS 17.2 and iOS version 16.5 beta 4, the latter of which patched all four vulnerabilities exploited as part of Operation Triangulation. The check for iOS 17.2, on the other hand, is meant to take into account the newer exploits, Kaspersky said. Larin told The Hacker News that Kaspersky has detected Coruna-related artifacts in its telemetry and that analysis is ongoing to determine if threat actors beyond those documented by Google and iVerify have leveraged the hacking tool. The starting point of the attack is when a user visits a compromised website on Safari, causing a stager to fingerprint the browser and serve the appropriate exploit based on the browser and operating system version. This, in turn, paves the way for the execution of a payload that triggers the kernel exploit. "After downloading the necessary components, the payload begins executing kernel exploits, Mach-O loaders, and the malware launcher," Kaspersky said. "The payload selects an appropriate Mach-O loader based on the firmware version, CPU, and presence of the iokit-open-service permission." The launcher is the primary orchestrator responsible for initiating the post-exploitation activities, leveraging the kernel exploit to drop and execute the final implant. It also cleans up exploitation artifacts to cover up the forensic trail. "Originally developed for cyber-espionage purposes, this framework is now being used by cybercriminals of a broader kind, placing millions of users with unpatched devices at risk," Larin said. "Given its modular design and ease of reuse, we expect that other threat actors will begin incorporating it into their attacks." The development comes as a new version of iPhone exploit kit DarkSword has been leaked on GitHub, raising concerns that it could equip more threat actors with advanced capabilities to compromise devices, effectively turning what was once an elite hacking tool into a mass exploitation framework. The release of the new version was first reported by TechCrunch. "This is a dangerous democratization of advanced exploitation tools. Historically, the massive R&D costs required to build complex iOS exploit chains restricted their use to state-sponsored, highly targeted operations," Larin said. "That economic barrier is now collapsing. While updating these frameworks with new vulnerabilities likely remains within the capability of the original authors only, the frameworks themselves are in the wild – acting as ready-made delivery mechanisms." "Less sophisticated, financially motivated actors can leverage this top-tier exploitation capability to deploy their own payloads, transforming what was a multi-million-dollar espionage tool into an accessible instrument for mass targeting." Larin said the shift "fundamentally" changes the threat model, as users are no longer at risk solely from highly-targeted attacks. They are exposed to indiscriminate watering-hole campaigns and employee personal devices can become potential silent backdoors into enterprise networks. "It also highlights a structural tension in mobile security: iOS's closed ecosystem is highly effective at baseline defense, but it prevents the broader security industry from providing an independent layer of protection when Apple's own defenses are bypassed," Larin added. "Third-party security tools are locked out of these deep-level intrusions, making timely iOS updates the only reliable mitigation. We strongly recommend updating to the latest iOS immediately and enabling Lockdown Mode." (The story was updated after publication to include additional insights from Kaspersky.)

Introduction On March 4, 2026, Google and iVerify published reports about a highly sophisticated exploit kit targeting Apple iPhone devices. According to Google, the exploit kit was first discovered in targeted attacks conducted by a customer of an unnamed surveillance vendor. It was later used by other attackers in watering-hole attacks in Ukraine and in financially motivated attacks in China. Additionally, researchers discovered an instance with the debug version of the exploit kit, which revealed the internal names of the exploits and the framework name used by its developers — Coruna. Analysis of the kit showed that it relies on the exploitation of many previously patched vulnerabilities and also includes exploits for CVE-2023-32434 and CVE-2023-38606. These two vulnerabilities particularly caught our attention because they had been first discovered as zero-days used in Operation Triangulation. Operation Triangulation is a complex mobile APT campaign targeting iOS devices. We discovered it while monitoring the network traffic of our own corporate Wi-Fi network. We noticed suspicious activity that originated from several iOS-based phones. Following the investigation, we learned that this campaign employed a sophisticated spyware implant and multiple zero-day exploits. The investigation lasted for over six months, during which we disclosed our findings in connection to the attack. Kaspersky GReAT experts also presented these findings at the 37th Chaos Communication Congress (37C3). Although all the details of both CVE-2023-32434 and CVE-2023-38606 have long been publicly available, and other researchers have developed their own exploits without ever seeing the Triangulation code, we decided to closely investigate the exploits used in Coruna. Some of the exploit kit distribution links provided by Google remained active at the time the report was published, which allowed us to collect, decrypt, and analyze all components of Coruna. During our analysis, we discovered that the kernel exploit for CVE-2023-32434 and CVE-2023-38606 vulnerabilities used in Coruna, in fact, is an updated version of the same exploit that had been used in Operation Triangulation. The images below illustrate a high-level overview of the two attack chains. The exploit in question is highlighted with a red rectangle. Moreover, we discovered that Coruna includes four additional kernel exploits that we had not seen used in Operation Triangulation, two of which were developed after the discovery of Operation Triangulation. All of these exploits are built on the same kernel exploitation framework and share common code. Code similarities from kernel exploits can also be found in other components of Coruna. These findings led us to conclude that this exploit kit was not patchworked but rather designed with a unified approach. We assume that it’s an updated version of the same exploitation framework that was used — at least to some extent — in Operation Triangulation. Technical details While we continue to investigate all exploits and vulnerabilities used by Coruna, this post provides a high-level overview of the exploit kit and attack chain. Safari Exploitation begins with a stager that fingerprints the browser and selects and executes appropriate remote code execution (RCE) and pointer authentication code (PAC) exploits depending on the browser version. It also contains a URL to an encrypted file with information about all available packages containing exploits and other components. The stager also includes a 256-bit key used to decrypt it. The URL and decryption key are passed to a payload embedded in PAC exploits. Payload The payload is responsible for initiating the exploitation of the kernel. After initialization, the payload first downloads a file with information about other available components. To extract it, the payload performs several steps processing multiple file formats. First, the downloaded file is decrypted using the ChaCha20 stream cipher. Decryption yields a container with the magic number 0xBEDF00D, which stores LZMA-compressed data. The file format used by the exploit kit to store compressed data The decompressed data presents another container with the magic number 0xF00DBEEF. This file format is used in the exploit kit to store and retrieve files by their IDs. The file format used by the exploit kit to store files We provide a description of all possible File ID values below. At this stage, when the payload gathers information about all available file packages, this container holds only one file, and its File ID is 0x70000. Finally, we get to the file with information about all available file packages. It starts with the magic value 0x12345678. The exploit kit uses this file format to obtain URLs and decryption keys for additional components that need to be downloaded. The file format used by the exploit kit to store information about file packages The components required for exploiting a targeted device are selected using the Package ID. Its high byte specifies the package type and required hardware. We’ve seen the following package types: 0xF2 – exploit for ARM64, 0xF3 – exploit for ARM64E, 0xA2 – Mach-O loader for ARM64, 0xA3 – Mach-O loader for ARM64E, 2 – implant for ARM64, 0xE2 – implant for ARM64E. The payload code also supports additional package types, such as 0xF1, an exploit for older ARM devices that do not support 64-bit architecture. Interestingly, however, the files for such exploits are missing. Other bytes of the Package ID define the supported firmware version and CPU generation. Some of the observed Package IDs (those with unique content) The files inside these packages are also stored in encrypted and compressed 0xF00DBEEF containers, but this time compression is optional and is determined by the second bit in the Flags field. Different packages contain different sets of files. A description of all possible File IDs is given in the table below. Observed File IDs After downloading the necessary components, the payload begins executing kernel exploits, Mach-O loaders, and the malware launcher. The payload selects an appropriate Mach-O loader based on the firmware version, CPU, and presence of the iokit-open-service permission. Kernel exploits We analyzed all five kernel exploits from the kit and discovered that one of them is an updated version of the same exploit we discovered in Operation Triangulation. There are many small changes, but the most noticeable are as follows: The code takes into account more values from XNU version strings, allowing for more accurate version checking. Added a check for iOS 17.2. We assume that this was the latest version of iOS at the time of development (released in December 2023). Added checks for newer Apple processors: A17, M3, M3 Pro, M3 Max (released in fall 2023). Added a check for iOS version 16.5 beta 4. This version patched the exploit after our report to Apple. Why does the exploit need to check for iOS 17.2 and newer CPUs if the targeted vulnerabilities were fixed in iOS 16.5 beta 4? The answer can be found by examining other exploits: they are all based on the same source code. The only difference is in the vulnerabilities they exploit, so these checks were added to support the newer exploits and appeared in the older version after recompilation. Launcher The launcher is responsible for orchestrating the post-exploitation activities. It also uses the kernel exploit and the interface it provides. However, since the exploit creates special kernel objects during its execution that provide the ability to read and write to kernel memory, the launcher simply reuses these objects without the need to trigger vulnerabilities and go through the entire exploitation path again. The launcher cleans up exploitation artifacts, retrieves the process name for injection from a config with the 0xDEADD00F magic number, injects a stager into the target process, uses it to execute itself, and launches the implant. Conclusions This case demonstrates once again the dangers associated with such malicious tools that lie in their potential wide usage. Originally developed for cyber-espionage purposes, this framework is now being used by cybercriminals of a broader kind, placing millions of users with unpatched devices at risk. Given its modular design and ease of reuse, we expect that other threat actors will begin incorporating it into their attacks. We strongly recommend that users install the latest security updates as soon as possible, if they have not already done so.

Introduction In this installment of our SOC Files series, we will walk you through a targeted campaign that our MDR team identified and hunted down a few months ago. It involves a threat known as Horabot, a bundle consisting of an infamous banking Trojan, an email spreader, and a notably complex attack chain. Although previous research has documented Horabot campaigns (here and here), our goal is to highlight how active this threat remains and to share some aspects not covered in those analyses. The starting point As usual, our story begins with an alert that popped up in one of our customers’ environments. The rule that triggered it is generic yet effective at detecting suspicious mshta activity. The case progressed from that initial alert, but fortunately ended on a positive note. Kaspersky Endpoint Security intervened, terminated the malicious process (via a proactive defense module (PDM)) and removed the related files before the threat could progress any further. The incident was then brought up for discussion at one of our weekly meetings. That was enough to spark the curiosity of one of our analysts, who then delved deeper into the tradecraft behind this campaign. The attack chain After some research and a lot of poking around in the adversary infrastructure, our team managed to map out the end-to-end kill chain. In this section, we will break down each stage and explain how the operation unfolds. Stage 1: Initial lure Following the breadcrumbs observed in the reported incident, the activity appears to begin with a standard fake CAPTCHA page. In the incident mentioned above, this page was located at the URL https://evs.grupotuis[.]buzz/0capcha17/ (details about its content can be found here). Similar to the Lumma and Amadey cases, this page instructs the user to open the Run dialog, paste a malicious command into it and then run it. Once deceived, the victim pastes a command similar to the one below: This command retrieved and executed an HTA file that contained the following: It is essentially a small loader. When executed, it opens a blank window, then immediately pulls and runs an external JavaScript payload hosted on the attacker’s domain. The body contains a large block of random, meaningless text that serves purely as filler. Stage 2: A pinch of server-side polymorphism The payload loaded by the HTA file dynamically creates a new element, sets its source to an external VBScript hosted on another attacker-controlled domain, and injects it into the section of a page hardcoded in the HTA. You can see the full content of the page in the box below. Once appended, the external VBScript is immediately fetched and executed, advancing the attack to its next stage. The next-stage VBS content resembles the example shown below. During our analysis, we observed the use of server-side polymorphism because each access to the same resource returned a slightly different version of the code while preserving the same functionality. The script is obfuscated and employs a custom string encoding routine. Below is a more readable version with its strings decoded and replaced using a small Python script that replicates the decode_str() routine. The script performs pretty much the same function as the initial HTA file. It reaches a JavaScript loader that injects and executes another polymorphic VBScript. Unlike the first script, this one is significantly more complex, with more than 400 lines of code. It acts as the heavy lifter of the operation. Below is a brief summary of its key characteristics: Heavy obfuscation: the script uses multiple layers of obfuscation to obscure its behavior. Custom string decoder: employs the same decoding routine found in the first VBScript to reconstruct strings at runtime. Anti-VM and “anti-Avast”: performs basic environment checks and terminates if a specific Avast folder or VM artifacts are detected. Information gathering and exfiltration: collects the host IP, hostname, username, and OS version, then sends this data to a C2 server. Download of additional components: retrieves an AutoIt executable, its compiler (Aut2Exe), a script (au3), and a blob file, placing them under the hardcoded path C:\Users\Public\LAPTOP-0QF0NEUP4 . PowerShell command execution: executes PowerShell commands that reach out to two different URLs (one unavailable and the other leading to the first stager of the spreader, which we describe later in this article). Persistence setup: creates a LNK file and drops it into the Startup folder to maintain persistence. Cleanup routines: removes temporary files and terminates selected processes. During our analysis of the heavy lifter, specifically within the exfiltration routine, we identified where the collected data was being sent. After probing the associated URL and removing the “salvar.php” portion, we uncovered an exposed webpage where the adversary listed all their victims. As you may have noticed, the table is in Brazilian Portuguese and lists victims dating back to May 2025 (this screenshot was taken in September 2025). In the “Localização” (location) column, the adversary even included the victims’ geographic coordinates, which are redacted in the screenshot. A quick breakdown shows that, of the 5384 victims, 5030 were located in Mexico, representing roughly 93% of the total. Stage 3: The evil combination of AutoIT and a banking Trojan It is now time to focus on the files downloaded by our heavy lifter. As previously mentioned, three AutoIT components were dropped on disk: the executable (AutoIT3), the compiler (Aut2Exe), and the script (au3), along with an encrypted blob file. Since we have access to the AutoIt script code, we can analyze its routines. However, it contains over 750 lines of heavily obfuscated code, so let’s focus only on what really matters. The most important routine is responsible for decrypting the blob file (it uses AES-192 with a key derived from the seed value 99521487), loading it directly into memory, and then calling the exported function B080723_N. The decrypted blob is a DLL. We also managed to replicate the decryption logic with a Python script and manually extract the DLL (0x6272EF6AC1DE8FB4BDD4A760BE7BA5ED). After initial triage and basic sandbox execution, we observed the following: The sample is a well-known Delphi banking Trojan detected by several engines under different names, such as Casbaneiro, Ponteiro, Metamorfo, and Zusy. It embeds two old OpenSSL libraries (libeay32.dll and ssleay32.dll) from the Indy Project, an open-source client/server communications library used to establish client/server HTTPS C2 communication. It includes SQL commands used to harvest credentials from browsers. Once loaded into memory, the Trojan sends several HTTP requests to different URLs: Since this malware family has been extensively documented in previous studies, we won’t reiterate its well-known functionality. Instead, we’ll focus on lesser-documented and newly observed features, including the malware’s encryption and protocol handling logic. The sample implements a stateful XOR-subtraction cipher in the sub_00A86B64 subroutine, which is used to protect strings and decrypt HTTP data received from the C2. Unlike simple XOR, each byte of output here depends on both the key and the previous byte. In our sample, the key is the string "0xFF0wx8066h". We can easily reimplement the logic of the routine in Python and integrate the following snippet into our workflow to automate string decryption: Python implementation of the decryption routine The encrypted strings are retrieved in three different ways: through indexed lookups using a global encrypted Delphi string list (also observed by our colleagues at ESET); via direct references to encrypted hex strings in the data section; through indirect references using pointer variables, adding an overhead when automating decryption with scripts. The malware fetches its configuration by performing an HTTPS GET request to the hardcoded, encrypted C2 server. The server responds with a configuration, which is a raw HTTP response, consisting of several values, each individually encrypted with the aforementioned algorithm. The sample extracts specific parameters based on their position in the list. To improve readability, the above screenshot has been edited to include the decrypted parameters, which are separated by double newlines. Configuration retrieval and parsing are initiated in the sub_00AD2C70 subroutine where the first configuration value, the C2 socket connection setting (host;port), is extracted. If parsing fails, the malware falls back to a hardcoded secondary C2 socket address. The socket connection is then established. Additional configuration values are parsed insub_00AD2918 and its subroutines. For example, in the decrypted C2 configuration shown above, parameter 5 contains the “UPON” string that triggers execution, and parameter 6 contains the PowerShell commands that are run when this string is used. Below is the portion of the routine that takes care of parsing this command: In addition to HTTP communication, the malware supports raw socket communication using a custom protocol that encapsulates commands into tags such as or Arg1 Arg2 . The client initiates the C2 connection in sub_00AD331C, where it establishes a TCP socket to the operator’s server and sends the "PRINCIPAL" command to request a control channel. After receiving an OK response, it follows up with an "Info" message containing system details. Once validated, the server replies with a "SocketMain" message containing a session ID, completing the handshake. All subsequent command handling occurs in sub_00AD373C, a central orchestrator routine that parses incoming messages and dispatches the malicious actions. The sample, and therefore the protocol itself, is inherited, from the open-source Delphi Remote Access PC project, as our colleagues at ESET have noted in the past. Below is a visual comparison: Some features from the open-source project, including the chat and file manipulation commands, have been removed, while some mouse-related commands have been renamed with playful prefixes like “LULUZ” (e.g., LULUZLD, LULUZPos). This could be an inside joke, anti-analysis obfuscation, or a way to mark custom variants. Beyond the standard functionality, the protocol now includes a range of additional custom commands, such as LULUZSD for mouse wheel scrolling down, ENTERMANDA to simulate pressing the Enter key, and COLADIFKEYBOARD to inject arbitrary text as keystrokes. The full command set is considerably larger, and while not all commands are implemented in the analyzed sample, evidence of their presence (e.g., in the form of strings) suggests ongoing development. After getting a sense of the protocol, let’s focus on the cipher used. In this sample, traffic exchanged via the C2 socket channel is encrypted using another stateful XOR algorithm with embedded decryption keys. Its logic is implemented in the routines sub_00A9F2D0 (encryption) and sub_00A9F5C0 (decryption): The encryption routine generates three random four-digit integer keys. The first key acts as the initial cipher state, while the other two serve as the multiplier and increment that are applied at every encryption stage to both the state and the data. For each character in the input string, it takes the high byte of the current state, XORs it with the character to encrypt, and then updates the cipher state for the next character. The output is created by prepending the three keys to the ciphertext, encapsulating everything within the “##” markers. The final output looks like this: Here’s a Python snippet to decode such traffic: Although this encryption layer was likely intended to evade network inspection, it ironically makes detection easier due to its highly regular and repetitive structure. This pattern, including the external markers “##”, is uncommon in legitimate traffic and can be used as a reliable network signature for IDS/IPS systems. Below is a Suricata rule that matches the described structure: As documented by our colleagues at Fortinet, the malware contains functionality to display fake pop-ups prompting victims to enter their banking credentials. The images for these pop-ups are stored as encrypted resources. Unlike strings, resources are decrypted using the standard RC4 cipher, and the key pega-avisao3234029284 is retrieved from the previous TStringList structure at offset 3FEh. The wordplay around “pega a visão”, Brazilian slang meaning “get the picture” figuratively, reveals an intentional cultural reference, supporting the already well-known Brazilian ties of the operators who have a native understanding of the language. Below is a collage of pictures where the targeted bank overlays are visible. Stage 4: The spreader In our tests, we noticed that both the VBScript (the heavy lifter) and the Delphi DLL have overlapping functionality for downloading the next stage via PowerShell. Although they rely on different domains, they follow the same URL pattern. We tried accessing URLs meant for downloading the spreader. One returned nothing, while the other displayed a sequence of two PowerShell stagers before reaching the actual spreader. In the second stager, we found several Base64-encoded URLs, but only one of them was active during our analysis. Based on comments found in the spreader code, we suspect that in previous versions or campaigns the spreader was assembled piece by piece from these other URLs. In our case, however, a single URL contained all the necessary code. Yes, we also wondered how PowerShell could possibly accept ASCII chaos as variable/function names, but it does. After cleaning up the messy naming convention and reviewing the well-commented routines (thanks, threat actor), we were able to identify its main duties: Harvest emails via the MAPI namespace; Exfiltrate unique email addresses to the C2; Clean up the outbox; Filter the exfiltrated email addresses against a blocklist of keywords; Prepare a phishing email containing a malicious PDF; Mass-distribute the email to the filtered addresses. One interesting point is that the spreader’s code and comments allow us to extract some useful intel: All comments are written in Brazilian Portuguese, which gives a strong indication of the threat actor’s origin. It is fairly easy to distinguish comments written by a human from those most likely generated by an AI/LLM; the latter are too formal and remarkably well-formatted. One of the human comments actually inspired the title of this article. One of the comments in the code reads “limpa a caixa de saida antes de sapecar”. Sapecar has a very specific meaning that only Brazilian Portuguese speakers would naturally understand. The closest equivalent to this comment in English would be: “Clear the outbox before you blast it off or let it rip.” Our team tracked Horabot activity for a few months and compiled a collection of malicious attachment examples used in this campaign. They are all written in Spanish and urge the user to click a large button in the document to access a “confidential file” or an “invoice”. Clicking the button triggers the same infection chain described in this article. Detection engineering and threat hunting opportunities After navigating this long, layered attack chain, we bet some of the tech folks reading this have already started imagining potential detection opportunities. With that in mind, this section provides some rules and queries that you can use to detect and hunt this threat in your own environment. YARA rules The YARA rules focus on two core components of the operation: the AutoIt script that functions as the loader, and the Delphi DLL that serves as the banking Trojan. Hunting queries You may notice that some patterns in this section do not appear in the URLs described earlier in the article. These additional patterns were included because we observed small variations introduced by the threat actor over time, such as the use of QR codes in the lure pages.

We have been tracking ongoing cyberespionage campaigns by the threat group Boggy Serpens, also known as MuddyWater. Attributed to the Iranian Ministry of Intelligence and Security (MOIS), the group consistently targets diplomatic and critical infrastructure – including energy, maritime and finance – across the Middle East and other strategic targets around the world. We provide a comprehensive threat assessment of Boggy Serpens’ activities over the last year. Our analysis reveals a highly adaptable threat actor that has refined its operational strategy to focus on trusted relationship compromises and multi-wave targeting of key strategic organizations. While social engineering remains its defining trait, the group is also increasing its technological capabilities. Its diverse toolset includes AI-enhanced malware implants that incorporate anti-analysis techniques for long-term persistence. This combination of social engineering and rapidly developed tools creates a potent threat profile. Boggy Serpens primarily leverages hijacked accounts to wage its attacks, targeting high-profile victims like diplomats and IT vendors. The attackers exploit this access to bypass reputation-based blocking and utilize a secondary social engineering prompt to deliver malware. The group’s determination is best exemplified by a sustained campaign against a national marine and energy company in the Middle East. We outline four distinct waves of attack against this single entity from August 2025 through February 2026, demonstrating the group’s attempts to infiltrate regional maritime infrastructure. To maintain access, the group has matured its development approach, employing AI-generated code, and Rust-based tools like the BlackBeard backdoor to rapidly deploy custom implants. Additionally, the group leverages standard HTTP status codes, customized user diagram protocol (UDP)-based traffic, and the Telegram API for command and control (C2). Palo Alto Networks customers are better protected against the threats discussed in this article through Cortex XDR and XSIAM, the Cortex Advanced Email Security module, Advanced WildFire, Advanced URL Filtering and Advanced DNS Security. Cortex’s AgentiX Agentic Assistant can assist investigations by providing context and insights, as well as recommendations for actions to take. If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team. Boggy Serpens is an Iranian nation-state cyberespionage group active since at least 2017. Assessed to be a subordinate element of the MOIS, the group has primarily targeted government, military and critical infrastructure sectors across the Middle East, the Caucasus, Central and Western Asia, South America and Europe. Early campaigns by this group were characterized by a high-volume, low-sophistication operational style. Boggy Serpens favored speed over stealth, frequently launching noisy and widespread spear phishing campaigns. These campaigns heavily relied on living-off-the-land (LOTL) tactics, abusing legitimate remote monitoring and management (RMM) tools like Atera, ScreenConnect and SimpleHelp, alongside publicly available utilities such as LaZagne and CrackMapExec. Recent campaigns reflect the group’s prioritization of long-term persistence, stealthier tactics, techniques and procedures (TTPs) and advanced defense evasion techniques. This is evidenced by its adoption of the Rust programming language and the integration of AI-assisted techniques into its malware development lifecycle. Boggy Serpens is likely benefiting from a significant influx of resources and cross-unit coordination. Early 2025 operations highlighted operational overlaps with Evasive Serpens, also known as Lyceum (a subgroup of OilRig), indicating shared resources and intelligence coordination within the Iranian threat landscape. While the group’s focus remains cyberespionage, Boggy Serpens has conducted disruptive operations in the past. In February 2023, the group targeted the Technion Israel Institute of Technology, masquerading as the DarkBit ransomware gang. The operation disrupted academic infrastructure under the guise of financial crime, masking its state-sponsored origins. This tactic introduced an additional dimension of psychological warfare through false flags and intimidation. Over the last year, Boggy Serpens has implemented a more effective “trusted relationship compromise” model to bypass perimeter defenses. This technique relies on hijacking legitimate internal accounts. Boggy Serpens misuses established credibility to deliver malware that evades standard reputation-based filtering. Once access is established, the group sustains operations using custom-compiled toolkits. The group’s targeting has expanded beyond government entities to encompass the maritime, aviation and financial sectors, reflecting a heightened interest in regional logistics and critical economic infrastructure. Recent campaigns have struck entities in Israel, Hungary, Turkey, Saudi Arabia, the UAE, Turkmenistan, Egypt and South America. These attacks demonstrate an ability to pivot between sectors while conducting multiple, consecutive attacks against different targets. Figure 1 shows a chronological overview of the phishing campaigns and specific regional entities targeted throughout the last year that we attribute with high confidence to Boggy Serpens. Our analysis of Boggy Serpens phishing activity in 2025 and early 2026 reveals a significant shift in Boggy Serpens’ tradecraft, characterized by tailored social engineering lures and the deployment of specialized toolkits for mass email distribution and account exploitation. A defining example of Boggy Serpens’ recent operations is the targeting of an energy and marine services company in the Middle East. The organization is a high-value industrial entity with significant ties to the local sovereign establishment. Over a six-month period, we observed four distinct attack waves targeting this Middle East-based entity, each using lures customized to different internal departments. This persistence suggests a specific mandate to infiltrate regional maritime and engineering infrastructure. The initial campaign targeted project engineers using industry-specific terminology for subsea pipelines. The lure document was blurred in order to deceive targets into clicking “Enable Content,” thereby triggering the execution of the embedded macro. Figure 2 shows the document. Shifting its focus to the finance and supply chain departments, in a subsequent attack the group deployed an Excel file that mimicked the target’s internal financial records. This lure was designed as a spreadsheet containing payment and cash flow projections. As Figure 3 shows, the infected document contains specific references to “Engineering, Construction & Marine Services” and local currency (AED), alongside legitimate-looking transaction codes like “Payroll Payments via WPS”. The group launched a parallel spear phishing effort targeting an individual associated with the company. The attackers created what appears to be a personalized Air Arabia flight reservation in Word format, as Figure 4 shows. The high level of detail – specifically the passenger name, flight route and “Corporate Fare” category – strongly suggests that this lure was not generated at random. The actor likely leveraged intelligence gathered from a prior compromise, such as exfiltrated internal emails and travel itineraries. The delivery of a flight itinerary as a Word document instead of a native PDF is a distinct operational anomaly. This creates a situation in which high-quality social engineering is undermined by a technical delivery that creates a detectable point of friction for trained users and automated sandboxes. In this campaign, the lure deploys malware named GhostBackDoor, a newly documented malware family recently identified by Group-IB. Most recently, we observed a fourth attack that utilized an Excel file titled Consumption Report (Jan 21 2025 – Feb 20 2026).xls, as Figure 5 shows. While the social engineering themes and macro delivery structures remain consistent with Boggy Serpens TTPs, the group’s focus in this attack was on the final infection stage. In this campaign, the blurred document lure delivers an entirely new payload family, known as Nuso. See Appendix A for technical analysis of this custom HTTP backdoor family. To support its large-scale social engineering campaigns, Boggy Serpens uses a custom-built, web-based orchestration platform. This tool enables operators to automate mass email delivery while maintaining granular control over sender identities and target lists. On Oct. 3, 2025, we observed the IP 157.20.182[.]75 hosting a unique web-based Python server on port 5000. We assess that the threat actor uses this server to deliver emails to targets. The platform includes the following input fields and controls: Upload User Lists: Ability to upload files with target email addresses Sender Email: Option to customize Sender Email Email Subject: Field to customize Email Subject Email Body SMTP Server: Field to set the IP address of the SMTP Server SMTP Port: Field to set the SMTP Port Upload Attachment: Option to add an attachment to the email Preview Email Run Figure 6 shows the platform interface. Throughout the last year, Boggy Serpens systematically hijacked official government and corporate accounts to bypass standard email filtering – a technique they utilized in over 15 attacks around the world. In August 2025, Boggy Serpens leveraged a compromised mailbox of the Omani Ministry of Foreign Affairs to distribute documents to other foreign ministries in different countries. These documents were disguised as official diplomatic communications. Following regional conflicts in June 2025, the group sent a “Sustainable Peace” seminar invitation as a lure to solicit engagement from targeted recipients, as Figure 7 shows. The suspicious content and thematic anomalies in the lure triggered Cortex XDR to flag this threat as high-risk, and prevent its execution before any user interaction could take place. The infection and prevention are shown in Figure 8. On Jan. 6, 2026, we observed a highly targeted attack against a major telecommunications provider in Turkmenistan. As shown in Figure 9, the threat actor used a compromised internal account info@ .tm to distribute a Cybersecurity.doc file. This tactic mirrors the campaign that targeted Israeli organizations on Nov. 17, 2025, as reported by the Israeli National Cyber Directorate (INCD), where the group hijacked internal accounts to distribute Webinar and HR lures. In both instances, the emails received a negative spam confidence level (SCL -1), because they originated from authenticated, internal accounts. This negative value resulted in the emails bypassing spam filters. Boggy Serpens utilizes a two-tiered social engineering strategy designed to bypass both automated filters and human intuition. First, the attackers hijack internal accounts. This deceives targeted victims into believing that an attachment was sent from a credible source. When a victim opens the file, a second layer of deception is triggered. To coerce targets into enabling the malicious code, many of the documents are presented as blurred content when opened. The lure displays a message claiming that the content was created in an older version of Microsoft Word or Excel. Once the user clicks “Enable Content,” the VBA macro’s initial routine is to delete this overlay and reveal the clear, legible document underneath. This immediate visual feedback reinforces the apparent legitimacy of the lure, effectively masking the simultaneous execution of the dropper payload in the background. Forensic analysis of last year’s campaign artifacts reveals that Boggy Serpens relies on a persistent VBA builder. The group split its operations into separate tracks to handle different types of targets: Phoenix Lineage, delivering fully-fledged backdoors UDPGangster Operations, delivering a more lightweight, less advanced backdoor Figure 10 shows the technical overlap of these tracks. The similarities include an identical shared decryption key and the novaservice.exe file path, linking these parallel operations to a single development team. A detailed technical analysis of the VBA builders is available in Appendix B. In recent campaigns, Boggy Serpens used several tools designed for persistence and evasion. This diverse toolkit allows the group to maintain resilient infrastructure capable of adapting to various defensive environments. An analysis of the Rust-based backdoor known as “BlackBeard” and related infrastructure can be found in Appendix C. The UDPGangster backdoor is designed to bypass traditional network defenses, utilizing a UDP-based communication protocol to execute commands, exfiltrate data and deploy secondary payloads. Building on recent findings by FortiGuard Labs, our analysis confirms that this malware is primarily delivered via Microsoft Office documents embedded with VBA macros. Upon execution, the malware employs multiple anti-analysis techniques to detect research environments, ensuring stealthy persistence on infected networks. Analysis of campaign-specific document lures revealed multiple UDPGangster variants. Each sample was delivered via a highly tailored social engineering document whose theme, language, and content were specifically aligned with the intended target’s sector and geography. By tracing the execution from the initial lure to the final payload, we mapped usernames to their respective targets based on the embedded PDBs paths, as shown in Table 1. Table 1: Different users in the PDB paths and their respective targets. During our analysis of UDPGangster, we observed live threat actor interaction with a controlled test environment. Approximately 12 hours after the initial C2 heartbeat connections were established, the threat actor began issuing commands to the simulated victim. This interaction provided a unique window into the actor’s operational procedures, confirming a distinct shift from automated infection to manual, human-led triage. ~07:30 CST (17:00 Iranian standard time): The actor sent a packet prefixed with byte 0x0A. This instruction triggered the creation of a named pipe on the target host to facilitate subsequent command shell execution. This timestamp corresponds to 17:00 in Tehran, placing the activity directly at the end of the standard Iranian business day. Reconnaissance: Once the pipe was established, the actor issued a succession of reconnaissance commands via the UDP C2 channel: - nslookup ad - ipconfig /all - dir C:\users - dir C:\users\[REDACTED]\Desktop - Quser The command dir C:\users\%username%\Desktop specifically targeted a user folder identified in the output of the previous dir command. This step confirms that a human operator was manually triaging the host in real-time, rather than relying on an automated script. We also observed the actor sending a packet beginning with byte 0x0B – distinct from the functional 0x0A command. Static analysis of the malware indicates no functionality associated with 0x0B. This discrepancy suggests either a manual mistake by the threat actor during command entry, or the existence of separate malware versions with differing command sets. Our analysis uncovered another new tool used by Boggy Serpens – a remote access trojan (RAT) written in Rust named LampoRAT (also known as Olalampo). This binary was used in the recent targeted campaign against a Middle East-based marine and energy company. The sample masquerades as an executable for legitimate security software – avp.exe (Kaspersky Anti-Virus process) – and embeds the string Kaspersky in the file’s metadata. The malware leverages the Telegram Bot API for command and control, a technique that allows malicious traffic to blend in with legitimate encrypted HTTPS communications. Functionally, the RAT is a streamlined shell executor. Upon infection, it connects to the hardcoded bot token (8398566164:AAEJbk6EOirZ_ybm4PJ-q8mOpr1RkZx1H7Q) and awaits instructions. When a command is received, the malware passes it to a dispatcher logic that supports system execution and basic internal commands like /cd for navigation. The malware spawns a shell using a specific argument string: cmd.exe /e:ON /v:OFF /d /c . The dispatcher then captures the output and transmits the results back to the attacker’s Telegram chat. An overview of the malware’s capabilities was recently published by Group-IB. Querying the /getMe Telegram API for the hardcoded token reveals the bot’s public profile configuration, as seen in Figure 11. The metadata provides further insight into the attacker’s naming conventions and operational structure: Display Name: Olalampo Username: stager_51_bot The specific choice of the username stager_51_bot indicates the malware’s intended function. In offensive operations, a stager is typically a lightweight payload designed to establish a foothold and download further modules. The “51” numbering suggests this may be part of a larger series of bots generated for distinct campaigns or targets, reinforcing the hypothesis of a segmented, high-volume infrastructure. A distinct stylistic artifact within the binary’s strings strongly suggests the threat actor used generative AI to accelerate development. The command dispatcher uses emojis for status reporting – specifically, strings such as the following: ✅ CD to ❌ CD error: This usage is not typical for malware authors, who usually favor standard ASCII logging ([+] or ERROR: ), to ensure the output is readable on any system and to avoid creating unique signatures. In contrast, code generated by large language models (LLMs) frequently includes user-friendly visual indicators by default when prompted to create command-line interfaces (CLIs) or Telegram bots. This finding is a strong indication that Boggy Serpens is leveraging generative AI to write code and accelerate the creation of new malware variants. Boggy Serpens’ recent activity exemplifies a maturing threat profile, as the group integrates its established methodologies with refined mechanisms for operational persistence. By diversifying its development pipeline to include modern coding languages like Rust and AI-assisted workflows, the group creates parallel tracks that ensure the redundancy needed to sustain a high operational tempo. This persistence has enabled a coordinated campaign across critical sectors in the Middle East, the Caucasus, Central Asia and more. The defining characteristic of the threat actor activity remains the exploitation of trusted relationships to bypass traditional security mechanisms. Merging sophisticated implants with high-confidence social engineering, the group demonstrates distinct agility in shifting targets. This strategy allowed it to pivot between sectors with ease, signaling a clear intent for economic espionage and potential capabilities for regional disruption. As the group continues to prioritize identity-based attacks alongside rapid, AI-assisted development cycles, we believe that the attackers are well-positioned to expand this targeting to increasingly sensitive upstream entities. Organizations must look beyond sender reputation and automated spam filters and focus on detecting underlying behavioral anomalies to counter this evolving threat. Neutralizing secondary infection stages requires strict macro execution policies, alongside behavioral monitoring of endpoint processes. These practices help detect evasive executable payloads and memory-resident payloads before they establish persistence. Palo Alto Networks customers are better protected from the threats discussed above through the following products: Cortex XDR and XSIAM help to prevent the threats described in this article, by employing the Malware Prevention Engine. This approach combines several layers of protection, including Advanced WildFire, Behavioral Threat Protection and the Local Analysis module, designed to prevent both known and unknown malware from causing harm to endpoints. Next-Generation Firewalls with Advanced WildFire identify and block the malicious VBA macros and binary payloads to help prevent initial infection. Advanced URL Filtering and Advanced DNS Security can help categorize and block access to the malicious and compromised domains used for C2 and payload delivery. The Cortex Advanced Email Security module extends the power of the Cortex platform into cloud-hosted email environments, providing a scalable, AI-driven layer for detection, investigation and response. Cortex’s AgentiX Agentic Assistant streamlined our investigation by enabling the team to query the data using natural language, providing deeper context and insights, and suggesting clear recommendations on what should be done next. Figure 12 shows the AgentiX interface when querying for malicious activity in a tenant. If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call: North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42) UK: +44.20.3743.3660 Europe and Middle East: +31.20.299.3130 Asia: +65.6983.8730 Japan: +81.50.1790.0200 Australia: +61.2.4062.7950 India: 000 800 050 45107 South Korea: +82.080.467.8774 Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance. These domains serve as C2 infrastructure for various malware families, including the new Rust-based BlackBeard and the evolving Phoenix line. bootcamptg[.]org codefusiontech[.]org maxisteq[.]org miniquest[.]org Netivtech[.]org nomercys.it[.]com promoverse[.]org reminders[.]trahum[.]org screenai[.]online stratioai[.]org Port 1269/1259 – UDPGangster communication 157.20.182[.]75 Hardcoded UDPGangster C2 64.7.198[.]12 Phoenix C2 46.101.36[.]39 BlackBeard C2 159.198.68[.]25 159.198.66[.]153 This list includes the core Phoenix, BlackBeard, UDPGangster, LampoRAT and Nuso implants, their specialized loaders, and the initial malicious documents. Threat Brief: March 2026 Escalation of Cyber Risk Related to Iran – Unit 42, Palo Alto Networks Iranian Cyber Threat Evolution: From MBR Wipers to Identity Weaponization – Unit 42, Palo Alto Networks Insights: Increased Risk of Wiper Attacks – Unit 42, Palo Alto Networks Iranian Government-Sponsored MuddyWater Actors Conducting Malicious Cyber Operations – CISA Identifying and Mitigating Living Off the Land Techniques – CISA MuddyWater eN-Able Spear-Phishing with New TTPs – Deep Instinct CTI Analysis: Malicious Email Campaign – Dream MuddyWater: Snakes by the Riverbank – ESET Research UDPGangster Campaigns Target Multiple Countries – Fortinet Iran-Based Psychological Operation Sets Saudi Aramco in its Crosshairs – Foundation for Defense of Democracies (FDD) Mapping the Infrastructure and Malware Ecosystem of MuddyWater – Group IB Operation Olalampo: Inside MuddyWater’s Latest Campaign – Group IB Unmasking MuddyWater’s New Malware Toolkit Driving International Espionage – Group IB Iranian Government-Sponsored Threat Actor MuddyWater Conducts Cyber Attack Against Israel – Israel Government Overview of Recent Phishing Campaigns in Israel - MuddyWater – Israel National Cyber Directorate (INCD) Nuso is a custom HTTP backdoor family identified as the final payload in Wave 4 of the campaign against a Middle East-based energy company. Relying on Dynamic API Resolution rather than standard Import Address Tables (IAT), the malware serves as a highly evasive reconnaissance and command execution tool. Command Execution: Instead of traditional command strings, Nuso uses HTTP status codes as triggers. For example, 201/204 initiates a remote shell, 210/222 updates the C2 polling interval, and 350/404 signals termination. C2 Architecture: Nuso beacons over HTTP/S, exfiltrating system information via bit-rotated custom headers like X-Computer-Name and X-Username. Figure 13 shows an example request, including the custom headers. The malware’s full capabilities are analyzed by Group-IB under the name HTTP_VIP. We analyzed three distinct variants of the Nuso backdoor. The PDB paths in the compiled binaries of the second and third variants show that they are linked: Variant 2: C:\Users\nuso\source\repos\http_vip\http_vip\f*ckAnalyzor.pdb (profanity masked) Variant 3: C:\Users\nuso\source\repos\http_last_ver\http_last_ver\f*ckAnalyser.pdb The presence of the nuso user profile in these paths identifies the developer’s environment. Furthermore, the transition from the misspelled Analyzor in the VIP build to the corrected Analyser in the Last Ver build suggests that a single author has been maintaining and refining the codebase over time. Our analysis revealed two parallel development lines of VBA Builders, each employing a completely different payload. In this section, we analyze the VBA code and discuss the connection between the two lines. The Phoenix track represents the group’s primary development line, which delivers the Phoenix and BugSleep malware. Analysis of the Phoenix macros development track reveals increasing technical maturity. Over the past year, we have observed more than 10 variants, with each subsequent iteration incorporating more complex analysis evasion techniques, several of which we highlight here. The group’s initial campaigns demonstrated the use of core obfuscation techniques. The early-stage macros that continue to characterize the group’s operations include: Property-based payload encapsulation: The payload is not present in the macro code itself. Instead, it is concealed as a hexadecimal string within the properties of a generic user interface element UserForm1.TextBox1. The script retrieves and decodes this hidden string using a custom function named HH. Drop-rename execution: The script writes the decoded payload to the C:\Users\public path with a benign .log extension to bypass initial file-write detection. Immediately after creation, the script renames the file extension to .exe and executes the payload using the ShellExecuteA API, completing the infection chain. This variant introduced a custom hex-shift rotation cipher to decrypt the payload and implements the same drop-rename workflow: Drop: Writes the malware as a benign text file: novaservice.txt Rename: Renames the file extension to .exe Execute: Launches the file using the ShellExecuteEx API This rotation pattern is shown in Figure 14. Decoding the hexadecimal string in the above code snippet provides the malware’s path: String: 4A41635C7A6C797A63577C6973706A634B767E757376686B7A6375767D687A6C797D706A6C356C7F6C Decoded path: C:\Public\Downloads\novaservice.exe Figure 15 shows the stages of the “drop-rename” Novaservice variant. Cortex XDR’s Behavioral Threat Protection is designed to block high-severity “drops and executes” actions by identifying abnormal behavior by the VBA script. While VBA scripts are capable of launching executables, it is not their intended behavior. Figure 16 shows the alert that is triggered. Other features of the macros identified in more recent campaigns include: Lateral execution: Instead of standard shell commands, this variant utilizes Windows Management Instrumentation (WMI) (Win32_Process.Create) or Windows API calls (CreateProcessW). This decouples the malware process from Microsoft Office documents, breaking the commonly monitored parent-child process tree. Brute-force stalling: One variant implements a mathematical “time-loop” (function laylay) that forces the CPU to execute over 100 million operations. This stalls execution long enough for many automated analysis tools to time out, as Figure 17 shows. The UDPGangster backdoor operates in parallel to the Phoenix lineage, and was previously analyzed by Fortinet. Comparative analysis of the dropper code reveals that UDPGangster and Novaservice share identical decryption routines and similar file paths. This overlap confirms that both malware families originate from a shared development pipeline. Both VBA builders rely on the DSDSDSDS decryption function, stash their payloads in the same UserForm1.TextBox1 location and utilize an identical hex string starting with 4A4163. The hex decodes to one of the following locations for the drop path: C:\Users\Public\Documents\novaservice.exe C:\Users\Public\Documents\novaservice.txt Figure 18 shows these functions. Recently tracked by the Israeli National Cyber Directorate (INCD) as BlackBeard, this Rust-based backdoor marks a strategic shift toward memory-safe languages to complicate reverse engineering efforts. Despite the new language, its intermediate C++ loader contains PDB paths referencing phoenix, strongly suggesting it was developed by the same Boggy Serpens cell. The intermediate C++ stager is built for stealth. It employs dynamic API resolution, string obfuscation (addition ciphers), and Fibonacci-based CPU delays to defeat sandboxes. The stager decrypts the final Rust payload using a hardcoded XOR key and executes it in memory using process hollowing (RunPE). The deployed payload is the BlackBeard malware. Figure 19 illustrates this XOR decryption routine. Figure 20 illustrates how Cortex XDR’s Behavioral Threat Protection caught a suspicious PE injection to a remote process. This is a critical detection for any security team, because process injection is a well-known method for evading EDR tools and escalating privileges by executing malicious code within the memory space of a trusted, legitimate process. The self-signed Rust binary initiates its execution by scanning the %PROGRAMDATA% directory for over 15 distinct security products. The BlackBeard payload operates through several modules: C2 Communication - The malware communicates with stratioai[.]org using the reqwest Rust crate. - System data (such as antivirus vendors and username) is encrypted with AES-256-GCM, with a hardcoded key and initialization vector, and exfiltrated in the HTTP Expires header. HTTP Status Commands - Like Nuso, the Rust binary relies on HTTP response codes. - Codes 201 and 202 instruct the malware to drop decrypted content received from the C2 server to the C:\ProgramData\WebDeepPlayer.scr path. - Code 418 triggers an exit. Persistence - The group ensures malware persistence by creating a custom file association. - The payload registers the nonexistent .wdlp extension in the HKCU\Software\Classes\.wdlp registry to execute WebDeepPlayer.scr. This ensures that when a file with the .wdlp extension is opened, the WebDeepPlayer.scr program is executed. - The malware drops a file named Oregon.wdlp into the startup folder – effectively triggering the infection chain every time the computer is restarted. Figure 21 shows the registry key that ensures malware execution. Updated March 23, 2026, at 3:26 p.m. PT, to add more additional resources Updated March 27, 2026, at 6:30 a.m. PT, to make clarifying copyedits

Adobe: aggiornamenti di sicurezza Alert AL02/260311/CSIRT-ITA Sintesi Adobe ha rilasciato aggiornamenti di sicurezza per risolvere molteplici vulnerabilità, di cui 21 con gravità “alta”, nei prodotti Commerce, Magento, Illustrator, Acrobat, Premiere Pro, Substance 3D Stager, e DNG SDK. Tipologia Arbitrary Code Execution Privilege Escalation Security Feature Bypass Prodotti e versioni affette Adobe Commerce Commerce B2B Magento Open Source Illustrator 2025 Illustrator 2026 Acrobat DC Acrobat Reader DC Acrobat 2024 Premiere Pro Substance 3D Stager DNG Software Development Kit (SDK) Azioni di mitigazione In linea con le dichiarazioni del vendor, si consiglia di aggiornare i prodotti vulnerabili seguendo le indicazioni dei bollettini di sicurezza riportati nella sezione Riferimenti. Di seguito sono riportate le sole CVE relative alle vulnerabilità con gravità “alta”: Data pubblicazione 11/03/26 ore 09:12 Data Ultimo Aggiornamento 11/03/26 ore 9:12

Adobe on Tuesday announced patches for 80 vulnerabilities across 8 products, including Commerce, Illustrator, Acrobat Reader, and Premiere Pro. The company rolled out fixes for 19 flaws in Adobe Commerce and Magento Open Source, urging users to apply the patches within the next 30 days, based on these products being a known target for threat actors. The update resolves six high-severity bugs, five of which could lead to privilege escalation: CVE-2026-21290, CVE-2026-21361, CVE-2026-21284, CVE-2026-21311, and CVE-2026-21309. The sixth, tracked as CVE-2026-21289, leads to security feature bypass. Per Adobe’s advisory, the remaining defects are medium- and low-severity issues leading to arbitrary code execution, privilege escalation, security feature bypasses, and denial-of-service (DoS). Fixes for these bugs were released for Adobe Commerce versions 2.4.4 to 2.4.9, Adobe Commerce B2B versions 1.3.3 to 1.5.3, and Magento Open Source versions 2.4.5 to 2.4.9. Adobe Illustrator received patches for seven vulnerabilities, including five bugs that could lead to arbitrary code execution: CVE-2026-21333, CVE-2026-21362, CVE-2026-27271, CVE-2026-27272, and CVE-2026-27267. High-severity security defects leading to arbitrary code execution were also resolved in Acrobat Reader, Premiere Pro, Substance 3D Stager, and DNG Software Development Kit (SDK). Unlike the Adobe Commerce advisory, which has a priority rating of 2, these have priority ratings of 3, meaning that the products are less likely to be targeted by threat actors. Adobe’s fresh round of security updates also resolves medium- and low-severity vulnerabilities in these products, as well as in Substance 3D Painter and Experience Manager. Adobe makes no mention of any of these security defects being exploited in the wild. Additional information can be found on the company’s PSIRT page. Related: SAP Patches Critical FS-QUO, NetWeaver Vulnerabilities Related: Cisco Patches Critical Vulnerabilities in Enterprise Networking Products Related: Patch Tuesday: Adobe Fixes 44 Vulnerabilities in Creative Apps Related: Adobe Patches Critical Apache Tika Bug in ColdFusion

A previously undocumented set of 23 iOS exploits named “Coruna” has been deployed by multiple threat actors in targeted espionage campaigns and financially motivated attacks. The Coruna kit contains five full iOS exploit chains, the most sophisticated leveraging non-public techniques and mitigation bypasses, for iOS versions 13.0 through 17.2.1 (released in December 2023). Google Threat Intelligence Group (GTIG) researchers first observed activity related to the Coruna exploit kit in February 2025, in activity attributed to a surveillance vendor customer. At the time, researchers obtained the JavaScript delivery framework along with the exploit for CVE-2024-23222, a WebKit vulnerability that enables remote code execution on iOS 17.2.1. Apple had addressed the flaw in iOS 17.3 on January 22, 2024, after it was exploited in zero-day attacks. The same obfuscated framework was observed again in summer, when suspected Russian cyberspies tracked as UNC6353 deployed it in watering hole attacks targeting iPhone users visiting compromised Ukrainian websites for ecommerce, industrial equipment and retail tools, and local services. In late 2025, the exploit kit appeared on various fake Chinese gambling and crypto websites. Google attributes the activity to the financially motivated Chinese threat actor UNC6691. Coruna exploit kit capabilities After obtaining the complete exploit kit in late 2025, GTIG analysts found that it included five full exploit chains using a set of 23 exploits, including: WebKit remote code execution Pointer Authentication Code (PAC) bypasses Sandbox escapes Kernel privilege escalation PPL (Page Protection Layer) bypasses "The exploits feature extensive documentation, including docstrings and comments authored in native English. The most advanced ones are using non-public exploitation techniques and mitigation bypasses," GTIG researchers say. Some of the exploits reuse vulnerabilities first identified during Operation Triangulation, which was uncovered in June 2023 by Kaspersky after the cybersecurity firm discovered that several iPhones on its network had been compromised. The company later discovered that the exploits abused undocumented hardware features in Apple's devices. According to GTIG researchers, Coruna fingerprints the device and OS version, and then selects the appropriate exploit chain to execute. If the Lockdown Mode anti-spyware protection feature or private browsing is active on the device, the framework stops. Dropping PlasmaGrid GTIG's analysis found that one of the final payloads delivered after a Coruna exploit chain was a stager loader called PlasmaLoader, which the researchers track as PlasmaGrid, that is injected into the ‘powerd’ iOS root daemon. However, the malware does not have capabilities consistent with a spyware operation. It downloads from a command-and-control (C2) server additional modules that target cryptocurrency wallet apps such as MetaMask, Phantom, Exodus, BitKeep, and Uniswap. The threat actor used fake finance and crypto-related websites to deliver the exploit kit by trying to convince visitors to use iOS devices when loading the pages. The targeted data includes wallet recovery phrases (BIP39), sensitive text strings such as “backup phrase” and “bank account,” and data stored in Apple Memos. The stolen data is encrypted with AES prior to exfiltration and sent to hardcoded C2 addresses. For takedown resilience, the implant also includes a domain generation algorithm (DGA) seeded with the string "lazarus" that produces .xyz domains. GTIG couldn't determine how the Coruna exploit kit moved from serving spyware campaigns linked to a surveillance vendor to financially motivated malicious activities aimed at cryptocurrency users. "How this proliferation occurred is unclear, but suggests an active market for 'second-hand' zero-day exploits," GTIG notes in the report. Surveillance vendors keep exploit kits like Coruna under strict limited access and use them in products for government customers running highly targeted operations. Apple has always claimed that such security issues were leveraged in limited attacks aimed at high-value individuals. Mobile security company iVerify says that Coruna is one of the clearest examples to date of "sophisticated spyware-grade capabilities" that migrated "from commercial surveillance vendors into the hands of nation-state actors and, ultimately, mass-scale criminal operations." This reinforces iVerify’s long-standing belief that the mobile threat landscape is evolving rapidly, "and the tools once reserved for targeting heads of state are now being deployed against ordinary iPhone users." Google has added to Safe Browsing all websites and domains identified while analyzing the Coruna exploit kit, and recommends iOS users to upgrade to the latest version. If updating is not possible, the advice is to enable Lockdown Mode. Apart from the vulnerabilities included in the Corona exploit kit and their codenames, GTIG's report also includes indicators of compromise for the implant and modules delivered via the cryptocurrency-related websites, and attack infrastructure. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Google said it identified a "new and powerful" exploit kit dubbed Coruna (aka CryptoWaters) targeting Apple iPhone models running iOS versions between 13.0 and 17.2.1. The exploit kit featured five full iOS exploit chains and a total of 23 exploits, Google Threat Intelligence Group (GTIG) said. It's not effective against the latest version of iOS. The findings were first reported by WIRED. "The core technical value of this exploit kit lies in its comprehensive collection of iOS exploits, with the most advanced ones using non-public exploitation techniques and mitigation bypasses," according to GTIG. "The framework surrounding the exploit kit is extremely well engineered; the exploit pieces are all connected naturally and combined together using common utility and exploitation frameworks." The kit is said to have circulated among multiple threat actors since February 2025, moving from a commercial surveillance operation to a government-backed attacker, and finally, to a financially motivated threat actor operating from China by December. It's currently not known how the exploit kit changed hands, but the findings point to an active market for second-hand zero-day exploits, allowing other threat actors to reuse them for their own objectives. In a related report, iVerify said the exploit kit has similarities to previous frameworks developed by threat actors affiliated with the U.S. government. "Coruna is one of the most significant examples we've observed of sophisticated spyware-grade capabilities proliferating from commercial surveillance vendors into the hands of nation-state actors and ultimately mass-scale criminal operations," iVerify said. The mobile security vendor said the use of the sophisticated exploit framework marks the first observed mass exploitation against iOS devices, indicating that spyware attacks are shifting from being highly targeted to broad deployment. Google said it first captured parts of an iOS exploit chain used by a customer of an unnamed surveillance company early last year, with the exploits integrated into a never-before-seen JavaScript framework. The framework is designed to fingerprint the device to determine if it's real and gather details, including the specific iPhone model and iOS software version it is running. The framework then loads the appropriate WebKit remote code execution (RCE) exploit based on the fingerprint data, followed by executing a pointer authentication code (PAC) bypass. The exploit in question relates to CVE-2024-23222, a type confusion bug in WebKit that was patched by Apple in January 2024 with iOS 17.3 and iPadOS 17.3 and iOS 16.7.5 and iPadOS 16.7.5. Fast forward to July 2025, the same JavaScript framework was detected on the domain "cdn.uacounter[.]com," which was loaded as a hidden iFrame on compromised Ukrainian websites. This included websites catering to industrial equipment, retail tools, local services, and e-commerce. A suspected Russian espionage group named UNC6353 is assessed to be behind the campaign. What's interesting about the activity was that the framework was delivered only to certain iPhone users from a specific geolocation. The exploits deployed as part of the framework consisted of CVE-2024-23222, CVE-2022-48503, and CVE-2023-43000, the last of which is a use-after-free flaw in WebKit. It's worth noting that CVE-2023-43000 was addressed by Apple in iOS 16.6 and iPadOS 16.6, released in July 2023. However, the security release notes were updated to include an entry for the vulnerability only on November 11, 2025. The third time the JavaScript framework was detected in the wild was in December 2025. A cluster of fake Chinese websites, most of them related to finance, were found to drop the iOS exploit kit after instructing users to visit them from an iPhone or iPad for a better user experience. The activity is attributed to a threat cluster tracked as UNC6691. Once these websites are accessed via an iOS device, a hidden iFrame is injected to deliver the Coruna exploit kit containing CVE-2024-23222. The exploit delivery, in this case, was not constrained by any geolocation criteria. Further analysis of the threat actor's infrastructure led to the discovery of a debug version of the exploit kit, along with various samples covering five full iOS exploit chains. A total of 23 exploits spanning versions from iOS 13 to iOS 17.2.1 have been identified. Some of the CVEs exploited by the kit and the corresponding iOS versions they targeted are listed below - Neutron - CVE-2020-27932 (versions 13.x) Dynamo - CVE-2020-27950 (versions 13.x) buffout - CVE-2021-30952 (versions 13 → 15.1.1) jacurutu - CVE-2022-48503 (versions 15.2 → 15.5) IronLoader - CVE-2023-32409 (versions 16.0 → 16.3.116.4.0) Photon - CVE-2023-32434 (versions 14.5 → 15.7.6) Gallium - CVE-2023-38606 (versions 14.x) Parallax - CVE-2023-41974 (versions 16.4 → 16.7) terrorbird - CVE-2023-43000 (versions 16.2 → 16.5.1) cassowary - CVE-2024-23222 (versions 16.6 → 17.2.1) Sparrow - CVE-2024-23225 (versions 17.0 → 17.3) Rocket - CVE-2024-23296 (versions 17.1 → 17.4) "Photon and Gallium are exploiting vulnerabilities that were also used as zero-days as part of Operation Triangulation," Google said. "The Coruna exploit kit also embeds reusable modules to ease the exploitation of the aforementioned vulnerabilities." In June 2023, the Russian government claimed the campaign was the work of the U.S. National Security Agency, accusing it of hacking "several thousand" Apple devices belonging to domestic subscribers and foreign diplomats as part of a "reconnaissance operation." UNC6691 has been observed weaponizing the exploit to deliver a stager binary codenamed PlasmaLoader (aka PLASMAGRID) that's designed to decode QR codes from images and run additional modules retrieved from an external server, allowing it to exfiltrate cryptocurrency wallets or sensitive information from various apps like Base, Bitget Wallet, Exodus, and MetaMask, among others. "The implant contains a list of hard-coded C2s but has a fallback mechanism in case the servers do not respond," GTIG added. "The implant embeds a custom domain generation algorithm (DGA) using the string 'lazarus' as a seed to generate a list of predictable domains. The domains will have 15 characters and use .xyz as a TLD. The attackers use Google's public DNS resolver to validate if the domains are active." A notable aspect of Coruna is that it skips execution on devices in Lockdown Mode, or if the user is in private browsing. To counter the threat, iPhone users are advised to keep their devices up to date, and enable Lockdown Mode for enhanced security. Update The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on March 5, 2026, added CVE-2021-30952, CVE-2023-41974, and CVE-2023-43000 to its Known Exploited Vulnerabilities (KEV) catalog following the abuse of the flaws in the Coruna exploit kit. Federal agencies are advised to apply the necessary fixes by March 26, 2026, for optimal protection. When reached for comment about the use of Operation Triangulation exploits in Coruna, Kaspersky confirmed that Photon and Gallium target the same vulnerabilities that were used as zero-days in the 2023 campaign. "These are not trivial bugs – we know that firsthand," Boris Larin, principal security researcher at Kaspersky GReAT, told The Hacker News via email. "CVE-2023-32434 gives an attacker full control over the deepest layer of iOS – the kernel, which governs everything the phone does. CVE-2023-38606 goes a step further: it exploited a previously undocumented feature of Apple's own chips to bypass security protections that operate at the hardware level." That being said, the Russian cybersecurity vendor noted that both the CVEs have publicly available implementations, meaning any threat actor with sufficient expertise and resources could have come up with their own exploits without relying on Triangulation code. It also pointed out that there is no evidence of actual code reuse to attribute Coruna to the same authors. "After we discovered and disclosed the Triangulation chain, Apple patched these vulnerabilities and backported fixes as far back as iOS 15.7.x," Larin added. "But many users simply don't update, and Coruna contains 23 exploits across five chains — these two shared CVEs are just the tip of the iceberg." "This case highlights a fundamental tension: the same closed ecosystem that makes iPhones secure by default also makes it harder for the security industry to provide an additional layer of protection when Apple's own defenses are bypassed. With toolkits like Coruna circulating freely, that's a gap worth addressing." The statement comes as TechCrunch reported that the exploit kit was likely designed by U.S. military contractor L3Harris, specifically its hacking and surveillance tech division, Trenchant, citing two former employees. Trenchant's hacking tools are sold exclusively to the U.S. government and its allies, including Australia, Canada, New Zealand, and the U.K. It's currently not known how Coruna ended up with Russian and Chinese hacking groups. But there are some clues as to how this may have happened. Last month, Peter Williams, a former general manager at L3Harris Trenchant, was sentenced to a little over seven years in prison for selling eight zero-day exploits to Russian exploit broker Operation Zero in exchange for millions of dollars. The exploits could have been "used against any manner of victim, civilian or military around the world, and engage in all manner of crime from cyber fraud, theft, and ransomware, to state-directed spying and offensive cyber operations against military targets," U.S. prosecutors noted. As TechCrunch stated, it's possible that Operation Zero acquired Coruna and sold it to other threat actors, including financially motivated cybercriminals. Another indicator that points to L3Harris is the use of bird names for the exploits. "Trenchant/Azimuth do use bird names internally. Their most famous public exploit chain was literally called 'Condor' (a massive bird of prey)," security researcher Costin Raiu said in a post on X last week. "Coruna's heavy bird theme for the early-stage WebContent RCEs and PAC bypasses (cassowary, terrorbird, bluebird, jacurutu, sparrow, plus the lighter breezy/seedbell) fits the same playful naming convention." In a separate report, c/side shared additional technical details of the distribution mechanism, noting Coruna is delivered as a self-contained HTML file (e.g., group.html or analytics.html) embedded as a hidden within a web page. More than 50 delivery domains have been identified. "The iframe has zero dimensions. It is invisible," Simon Wijckmans said. "It requires no user interaction beyond the page loading. The exploit runs entirely in the browser, in JavaScript, and completes in seconds." "The delivery pages were hosted on attacker-controlled domains: fake crypto platforms, gambling sites, bingo lures. But the kit does not care where it is hosted. It is a self-contained payload that can be injected anywhere a JavaScript tag can be placed. That means the realistic delivery vectors extend far beyond attacker-owned infrastructure." The Coruna framework incorporates four layers of obfuscation to bypass static analysis and automated sandboxes, while also skipping execution in scenarios where Apple's Lockdown Mode is detected, or the user is in private browsing mode. The exploit chain goes through six stages - Fingerprinting the host to determine if the target is valuable and which exploit chain to use. Exploit CVE-2024-23222 to achieve remote code execution Bypass Address Space Layout Randomization (ASLR) protections Escape the Safari browser sandbox Circumvent Pointer Authentication Codes (PAC) on Apple Silicon Execute shellcode to drop the final implant (PlasmaLoader aka PLASMAGRID) "[PLASMAGRID] decodes QR codes from images, fetches additional modules from C2, and exfiltrates cryptocurrency wallet data from MetaMask, Exodus, Bitget Wallet, and Base," Wijckmans said. (The story was updated after publication to reflect the latest developments and include a response from Kaspersky.)

Coruna: Spy-grade iOS exploit kit powering financial crime A powerful iOS exploit kit has circulated among multiple threat actors over the past year, moving from a commercial surveillance operation to state-linked espionage campaigns and, ultimately, ended into the hands of financially motivated hackers, according to new research from Google’s Threat Intelligence Group (GTIG). “The exploit kit, named ‘Coruna’ by its developers, contained five full iOS exploit chains and a total of 23 exploits,” the analysts noted. The exploit list includes both CVE-tracked vulnerabilities and flaws that were never assigned CVE identifiers. (Though, as GTIG analysts noted, their ongoing investigation may result in a revision to CVE associations.) These vulnerabilities enable remote code execution and sandbox escapes via ordinary web content, exploiting flaws in WebKit’s memory handling and other browser subsystems. Among the CVEs with an exploit in this kit are: CVE-2024-23222, a WebKit flaw exploited as a zero-day and patched in early 2024 CVE-2022-48503, a WebKit vulnerability added to CISA’s Known Exploited Vulnerabilities catalog in October 2025 CVE-2023-43000, fixed in Safari 16.6 and iOS 16.6 in November 2025 CVE-2023-38606 and CVE-2023-32434, used as zero-days as part of Operation Triangulation, discovered by Kaspersky in 2023 CVE-2023-32409, a WebKit flaw exploited as a zero-day Coruna iOS exploit kit unmasked The vulnerabilities leveraged by the exploit kit are mostly years-old issues, and most of them (possibly all) have been fixed since then. The exploit kit appears capable – with varying levels of reliability – of targeting iPhone models running iOS 13.0, released in September 2019, through iOS 17.2.1, released in December 2023. Google’s threat researchers first observed it being used in February 2025 by a customer of a surveillance company, then in July 2025 in watering hole attacks (by a suspected Russian espionage group) against Ukrainian websites, and finally in December 2025, via fake Chinese gambling and crypto websites. They managed to retrieve the complete exploit kit and all the obfuscated exploits. Then, due to the actor deploying a debug version of the exploit kit in one instance, they discovered the exploits’ code names and the name of the exploit kit. In addition to this, they found and analyzed the stager binary that the exploit kit was meant to deliver through the scam gambling sites: a malicious payload that could decode QR codes from images on disk, look for keywords like “backup phrase” or “bank account”, and run additional modules that can exfiltrate cryptocurrency wallets or sensitive information from a variety of crypto-wallet apps (Metamask, BitKeep, etc.) Coruna proliferation is still a mystery “The core technical value of this exploit kit lies in its comprehensive collection of iOS exploits,” the researchers opined. “The exploits feature extensive documentation, including docstrings and comments authored in native English. The most advanced ones are using non-public exploitation techniques and mitigation bypasses.” How the kit came to be used by such a wide range of threat actors remains unclear, but seems to point to an active market for “second hand” zero-day exploits, according to the researchers. They confirmed that Coruna is not effective against the latest version of iOS and advised users to upgrade to it. If your iPhone is still on one of those versions and you can’t upgrade, putting your device in Lockdown Mode or using private browsing neutralizes it, as Coruna performs checks to avoid execution under such defensive configurations. UPDATE (March 4, 2026, 06:10 a.m. ET): iVerify researchers have also analyzed the exploit kit (as deployed by Chinese cybercriminal) and shared advice on how to detect Coruna-triggered infections. Unlike traditional spyware designed for targeted surveillance, this latest campaign signals a shift toward large-scale deployment aimed at ordinary iPhone users. “Anyone who would have gone to the website with a vulnerable iOS version could get infected,” the company noted. The company’s co-founder Rocky Cole also confirmed that they assess that “the exploit chain has similarities to frameworks previously developed by threat actors affiliated with the U.S. government.” UPDATE (March 6, 2026, 05:05 a.m. ET): CISA has added three of the vulnerabilities (CVE-2021-30952, CVE-2023-41974 and CVE-2023-43000) targeted via the Coruna exploit kit to its Known Exploited Vulnerabilities catalog. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

Cybersecurity researchers have disclosed a new iteration of the ongoing Contagious Interview campaign, where the North Korean threat actors have published a set of 26 malicious packages to the npm registry. The packages masquerade as developer tools, but contain functionality to extract the actual command-and-control (C2) by using seemingly harmless Pastebin content as a dead drop resolver and ultimately drop a developer-targeted credential stealer and remote access trojan. The C2 infrastructure is hosted on Vercel across 31 deployments. The campaign, discovered by Socket and kmsec.uk's Kieran Miyamoto, is being tracked under the moniker StegaBin. It's attributed to a North Korean threat activity cluster known as Famous Chollima. "The loader extracts C2 URLs steganographically encoded within three Pastebin pastes, innocuous computer science essays in which characters at evenly-spaced positions have been replaced to spell out hidden infrastructure addresses," Socket researchers Philipp Burckhardt and Peter van der Zee said. The list of the malicious npm packages is as follows - [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] All identified packages come with an install script ("install.js") that's automatically executed during package installation, which, in turn, runs the malicious payload located in "vendor/scrypt-js/version.js." Another common aspect that unites the 26 packages is that they explicitly declare the legitimate package they are typosquatting as a dependency, likely in an attempt to make them appear credible. The payload serves as a text steganography decoder by contacting a Pastebin URL and extracting its contents to retrieve the actual C2 Vercel URLs. While the pastes seemingly contain a benign essay about computer science, the decoder is designed to look at specific characters in certain positions in the text and string them together to create a list of C2 domains. "The decoder strips zero-width Unicode characters, reads a 5-digit length marker from the beginning, calculates evenly-spaced character positions throughout the text, and extracts the characters at those positions," Socket said. "The extracted characters are then split on a ||| separator (with an ===END=== termination marker) to produce an array of C2 domain names." The malware then reaches out to the decoded domain to fetch platform-specific payloads for Windows, macOS, and Linux, a tactic widely observed in the Contagious Interview campaign. One such domain, "ext-checkdin.vercel[.]app" has been found to serve a shell script, which then contacts the same URL to retrieve a RAT component. The Trojan connects to 103.106.67[.]63:1244 to await further instructions that allow it to change the current directory and execute shell commands, through which a comprehensive intelligence collection suite is deployed. It contains nine modules to facilitate Microsoft Visual Studio Code (VS Code) persistence, keylogging and clipboard theft, browser credential harvesting, TruffleHog secret scanning, and Git repository and SSH key exfiltration - vs, which uses a malicious tasks.json file to contact a Vercel domain every time a project is opened in VS Code by taking advantage of the runOn: "folderOpen" trigger. The module specifically scans the victim's VS Code config directory across all three platforms and writes the malicious tasks.json directly into it. clip, which acts as a keylogger, mouse tracker, and clipboard stealer with support for active window tracking and conducts periodic exfiltration every 10 minutes. bro, which is a Python payload to steal browser credential stores. j, which is a Node.js module used for browser and cryptocurrency theft by targeting Google Chrome, Brave, Firefox, Opera, and Microsoft Edge, and extensions like MetaMask, Phantom, Coinbase Wallet, Binance, Trust, Exodus, and Keplr, among others. On macOS, it also targets the iCloud Keychain. z, which enumerates the file system and steals files matching certain predefined patterns. n, which acts as a RAT to grant the attacker the ability to remotely control the infected host in real-time via a persistent WebSocket connection to 103.106.67[.]63:1247 and exfiltrate data of interest over FTP. truffle, which downloads the legitimate TruffleHog secrets scanner from the official GitHub page to discover and exfiltrate developer secrets. git, which collects files from .ssh directories, extracts Git credentials, and scans repositories. sched, which is the same as "vendor/scrypt-js/version.js" and is redeployed as a persistence mechanism. "While previous waves of the Contagious Interview campaign relied on relatively straightforward malicious scripts and Bitbucket-hosted payloads, this latest iteration demonstrates a concerted effort to bypass both automated detection and human review," Socket concluded. "The use of character-level steganography on Pastebin and multi-stage Vercel routing points to an adversary that is refining its evasion techniques and attempting to make its operations more resilient." The disclosure comes as the North Korean actors have also been observed publishing malicious npm packages (e.g., express-core-validator) to fetch a next-stage JavaScript payload hosted on Google Drive. "Only a single package has been published with this new technique," Miyamoto said. "It is likely Famous Chollima will continue to leverage multiple techniques and infrastructure to deliver follow-on payloads. It is unlikely this signals a complete overhaul of their stager behaviour on npm."