TerminalFix

ClickFix attacks are surging as cybercriminals use fake AI installers, malicious search results, and trusted chatbot platforms to trick users into executing malware. Push Security examines how these attacks evade traditional defenses and why AI tools have become increasingly effective lures. [...]

Browser-based attacks can steal sessions, abuse extensions, or manipulate users without creating the endpoint artifacts EDR is designed to detect. NordLayer explains three ways attacks can evade endpoint telemetry and why browser-level controls can help close the gap. [...]

A domain that has long appeared in software documentation, code examples, and developer test material is now being used to push a ClickFix attack against Windows users. A placeholder domain stands in for a website in an example. The best-known is probably example.com . Another, third-party[.]com , has often been used in documentation to represent an external website, API, or service. However, there is a very important difference between the two: example.com is reserved for documentation, while third-party[.]com is an ordinary domain. Anyone could register it, and someone did. Every document, test, and skill that hardcoded it now points readers and users to the attacker’s infrastructure. Researchers at Manifold Security found that third-party[.]com was serving a fake Cloudflare-style verification page to Windows visitors. The page tries to persuade them to open the Windows Run box and paste a command it has copied to their clipboard.This command is designed to download and execute a PowerShell script. At the time of writing the domain hosting the script is not resolving. ClickFix is a social-engineering technique that turns the victim into the malware installer. Instead of relying on a malicious attachment or an obvious executable download, the attacker convinces someone to run a command themselves. Common lures include: A fake CAPTCHA or Cloudflare Turnstile check. A browser error that claims it needs a “manual fix.” A bogus video-player, document-viewer, or popular software download. A support scam page that tells the visitor to paste a command into Run, Command Prompt, Terminal, or PowerShell. ClickFix works because the command often uses legitimate Windows or Mac tools to download and execute the next stage. It also runs with the permissions of the person who has been convinced to enter it. The consequences can range from information theft to more serious compromise of a company network. In a recent campaign called TerminalFix , a fake Cloudflare CAPTCHA led victims to paste a PowerShell command into Windows Terminal or PowerShell. How to stay safe With ClickFix running rampant—and it doesn’t look like it’s going away anytime soon—it’s important to be aware, careful, and protected. Slow down.  Be wary of a webpage that urges you to run commands on your device, especially if it uses a countdown or other pressure tactic. Don’t run commands or scripts from untrusted sources.  Never run code or commands copied from websites, emails, or messages unless you trust the source and understand the action’s purpose. Verify instructions independently. If a website tells you to execute a command or perform a technical action, check through official documentation or contact support before proceeding. Check what you’re pasting.  A website may copy a command to your clipboard without showing you the full text. Don’t paste it into a command window. Secure your device.  Use an up-to-date, real-time  anti-malware solution  with a web protection component. Educate yourself on evolving attack techniques.  Understanding that attacks may come from unexpected vectors and evolve helps maintain vigilance. Keep reading our blog! Pro tip:  The free  Malwarebytes Browser Guard  extension warns you when a website tries to copy something to your clipboard. Stop threats before they can do any harm. Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

Microsoft Security Research published an interesting blog post "TerminalFix campaign deploys a reverse tunnel through multistage intrusion" about a malware campaign. The aspect that I want to take a closer look at, is the fact that the threat actors used PNG files with steganography. I reached out to the researchers and they kindly shared the IOCs for the PNG files with me.

Negli ultimi giorni stavo cercando campagne attive da analizzare per la mia attività di threat research. L’obiettivo era trovare qualcosa che fosse ancora osservabile e che mi permettesse di lavorare direttamente sulle evidenze, senza limitarmi a riprendere indicatori già pubblicati in altri report. Tra i risultati che stavo controllando mi sono imbattuto in destinationweddinglazio.com, un sito WordPress italiano che compariva associato a indicatori ClearFake ed EtherHiding. Ho deciso di partire da lì. Introduzione La prima verifica l’ho fatta in sandbox, utilizzando un ambiente Windows con Chrome. In questa fase non avevo ancora un’ipotesi particolare: volevo soprattutto capire se l’attività segnalata fosse ancora presente e raccogliere abbastanza traffico da poterla ricostruire. Il sito veniva caricato normalmente, ma durante la navigazione il browser iniziava a contattare diversi endpoint RPC. La sandbox associava parte dell’attività a ClickFix, TerminalFix ed EtherHiding. Tra il traffico comparivano richieste verso Polygon. Una delle prime che ho controllato era diretta a à rpc.ankr.com/polygon Non è stata particolarmente utile perché Ankr ha restituito un errore relativo all’autorizzazione API. Poco dopo, però, ho trovato una richiesta simile verso QuickNode che era andata a buon fine. La risposta conteneva questa stringa: A quel punto sapevo che il browser stava ottenendo un dominio attraverso una richiesta RPC, ma non ancora esattamente da quale parte del codice partisse quella richiesta. Ho quindi acquisito l’HTML restituito dal sito e ho iniziato a lavorare sul JavaScript. Il codice presente nel primo sito All’interno della pagina era presente JavaScript offuscato. Il primo livello utilizzava Base64 e una trasformazione XOR; il risultato veniva poi ricostruito con TextDecoder ed eseguito attraverso new Function. Nel campione che avevo acquisito la chiave XOR era 202. Tolto questo primo livello, sono comparsi nel codice gli stessi endpoint che avevo visto nel traffico della sandbox: Il fatto che fossero otto mi ha fatto inizialmente pensare a una semplice lista di alternative. Guardando meglio il codice, però, c’era effettivamente una gestione degli errori che permetteva al loader di provare il provider successivo. Questo spiegava anche quello che avevo visto nella sandbox: Ankr aveva risposto con un errore, ma l’esecuzione non si era fermata. Il codice continuava provando un altro RPC. Ogni tentativo aveva inoltre un timeout di circa cinque secondi. Se il provider non forniva una risposta utilizzabile, la funzione passava ricorsivamente al successivo. A questo punto sono tornato alla richiesta JSON-RPC che avevo catturato. Il browser stava effettuando una normale eth_call. Il contratto interrogato era Cercando questo selector nella ricerca pubblica esistente sono arrivato a precedenti analisi che lo documentavano come getDomain(). Questo mi ha aiutato a mettere in ordine quello che stavo vedendo. Il loader non conteneva direttamente fingerprint-veri[.]info. Conteneva invece il contratto e le istruzioni necessarie per interrogarlo. La risposta dello smart contract veniva trattata come una stringa ABI, decodificata dal JavaScript e successivamente utilizzata per costruire lo stage seguente. Il dominio che avevo trovato nel traffico della sandbox proveniva quindi da lì. Cosa succedeva dopo Una volta ottenuto il dominio, il codice creava dinamicamente un nuovo elemento <script>. L’URL aveva una struttura simile a questa Potrebbe avere una funzione legata al caching o alla freshness delle richieste, ma non avendo visibilità sul backend non posso stabilirlo. Nel codice posso vedere come viene generato; non posso vedere come viene interpretato dal server. Lo stesso discorso valeva per s . In questa prima fase non sapevo cosa rappresentasse quella stringa. Poteva essere un identificatore della campagna, del sito, di una configurazione o qualcos’altro. Me la sono semplicemente segnata e ho continuato. È stato utile non attribuirle subito un significato perché, più avanti, l’ipotesi più immediata si è rivelata poco convincente. Cercare lo stesso comportamento altrove Una volta ricostruito il loader del primo sito ho iniziato a cercare altre osservazioni che condividessero gli stessi elementi. Non mi interessava trovare necessariamente lo stesso JavaScript. Avevo già abbastanza elementi per aspettarmi che alcuni dettagli potessero cambiare. Mi sono concentrato soprattutto su contratto, selector, utilizzo degli RPC Polygon e struttura della richiesta verso /api.php. Durante questa fase è comparso edih4dt.it . Il sito mi ha attirato l’attenzione per il contesto: EDIH4DT è un European Digital Innovation Hub italiano orientato alla trasformazione digitale sicura della Pubblica Amministrazione . Non ho però dato per scontato che il codice fosse lo stesso. Ho acquisito separatamente l’HTML restituito dal sito e ho ricominciato l’analisi. EDIH4DT La prima cosa evidente nell’HTML di EDIH4DT era la presenza ripetuta del marker à <!– wpmbchik –> Nel campione che ho conservato ne ho contate 24 occorrenze . Non erano concentrate tutte nello stesso punto della pagina. Il pattern compariva in più parti dell’HTML restituito insieme al codice JavaScript offuscato. Ho estratto uno dei blocchi e iniziato a rimuovere l’offuscamento. La struttura ricordava immediatamente quella del primo sito: Base64, XOR, TextDecoder, new Function. Il codice, però, non era identico. La chiave XOR era 36, contro 202 osservato su Destination Wedding Lazio. Cambiavano anche i nomi utilizzati internamente e il guard che impediva esecuzioni multiple. Sul campione EDIH4DT compariva à _85b267f2a3 Anche l’ordine degli RPC era differente. Sul primo sito avevo trovato Ankr come terzo provider e QuickNode come quarto. Su EDIH4DT la sequenza era stata modificata e QuickNode compariva più avanti. Continuando a deoffuscare, però, sono arrivato alla parte che mi interessava. Il contratto era à 0xB6bC9e1D0b2fB96Ab7C47E04Cb0BE477410bC1f2 Il selector à 0xb68d1809 Gli endpoint RPC erano ancora otto. Era presente la stessa logica di fallback. La risposta veniva nuovamente decodificata come stringa ABI e il risultato utilizzato per creare uno script con à /api.php?s=…&_v=… Questa volta il valore di s era à a3946e3ded820e3d2f02885bf63c8a3a176d58bb9403b402 Quindi non avevo trovato una copia dello stesso script. Avevo trovato un secondo loader con differenze abbastanza evidenti a livello superficiale, ma con lo stesso funzionamento sotto. Verifica in sandbox A questo punto volevo verificare che il comportamento ricostruito staticamente fosse effettivamente quello eseguito dal browser. Ho quindi analizzato EDIH4DT anche in sandbox. Nel traffico ho trovato la richiesta RPC che stavo cercando: La risposta, una volta decodificata, portava ancora a à https://fingerprint-veri[.]info Questo eliminava almeno un dubbio: non stavo correlando i due siti soltanto perché avevano qualche stringa in comune. Durante le mie osservazioni entrambi interrogavano lo stesso contratto con lo stesso selector e ottenevano lo stesso dominio. Il percorso osservato su EDIH4DT era quindi, in termini molto semplici: Cosa dimostra e cosa no Sul caso EDIH4DT credo sia importante delimitare bene il risultato. Quello che ho verificato è la presenza di codice JavaScript malevolo nel sito web pubblico e la relativa catena di comunicazione . Non ho elementi per sostenere che siano stati compromessi sistemi interni del CINI, infrastrutture dei partner di EDIH4DT, sistemi della Pubblica Amministrazione, account o dati personali . Non ho nemmeno provato a verificarlo. L’analisi è rimasta sul contenuto pubblicamente accessibile e sull’esecuzione in ambiente sandbox. Non ho effettuato exploitation, scansioni invasive o tentativi di accesso all’infrastruttura server-side. Questa limitazione è importante anche per quello che viene dopo, perché alcune delle domande più interessanti non possono essere risolte guardando soltanto ciò che WordPress restituisce al browser. Tornare al parametro s A questo punto avevo due valori differenti di s. La prima interpretazione che ho considerato era abbastanza semplice: una chiave diversa per ogni vittima. Ho quindi iniziato a cercare il secondo valore in osservazioni precedenti. Mi aspettavo eventualmente di trovare altre acquisizioni di EDIH4DT. Invece sono comparsi siti completamente differenti. Ho verificato la presenza dello stesso valore in osservazioni pubbliche relative, tra gli altri, a: lesprosdurelevage.com klrassociates.com seedworks.com.ng sageinsurancebrokers.com cambodiaflashnews.com Le osservazioni erano distribuite tra luglio e agosto 2026, quindi precedenti alla mia analisi di settembre. Inoltre il dominio downstream non era sempre fingerprint-veri[.]info. In alcune osservazioni comparivano infrastrutture differenti, tra cui domini con nomi legati a verifica/autenticazione. Quindi l’idea che a394… identificasse EDIH4DT non funzionava. La stessa chiave sopravviveva a vittime diverse e a cambi del dominio utilizzato più avanti nella catena. Ho trovato anche un altro valore, che inizia con 8402…, con un comportamento simile. In almeno un’analisi relativa a seedworks.com.ng comparivano entrambi. Questo rende ancora più difficile interpretare s come semplice identificatore univoco del sito. Nel report avevo bisogno di chiamare queste stringhe in qualche modo e ho usato Persistent Delivery Key , o PDK. È soltanto un’etichetta di lavoro. Non conosco il nome utilizzato da chi gestisce l’infrastruttura e, soprattutto, non conosco l’esatta semantica server-side del parametro. Nell’articolo preferisco quindi parlare semplicemente di chiave di delivery quando possibile. Il parametro d Continuando a seguire le osservazioni pubbliche dello stesso cluster ho trovato anche richieste con una struttura leggermente diversa à /api.php?k=<chiave>&d=<dato> In almeno uno dei campioni relativi a Seedworks è stato possibile ricostruire dal valore trasportato in d una struttura contenente campi come: Questo è abbastanza per dire che, almeno in quella variante, il parametro veniva utilizzato per trasferire informazioni relative al client o alla sessione. Non ho però ottenuto lo stesso risultato su ogni valore d incontrato. Per questo non considero corretto descriverlo genericamente come “JSON Base64”, perché potrebbe essere vero soltanto per alcune varianti. La cosa che mi interessava era un’altra: dopo aver recuperato la configurazione attraverso Polygon, il loader poteva comunicare al backend informazioni sull’ambiente che stava visitando il sito. Questo è coerente con un’infrastruttura che effettua una forma di selezione o qualificazione del traffico. Quale sia esattamente la logica utilizzata dal server non posso saperlo dall’esterno. Confronto con quello che era già stato pubblicato Arrivato a questo punto ho iniziato a confrontare in maniera più sistematica quello che avevo trovato con le ricerche già disponibili. Era importante farlo anche per capire quale parte del lavoro fosse effettivamente nuova. Il concetto di EtherHiding non lo è. L’utilizzo di Polygon come livello di configurazione non lo è. Nemmeno il contratto e il selector che avevo trovato erano completamente nuovi. FileScan ha documentato la stessa coppia contratto/selector e il relativo modello di risoluzione. Altre ricerche hanno analizzato loader con otto RPC, offuscamento JavaScript e richieste /api.php?s=…. Report URI ha osservato lo stesso contratto in altri contesti e, a inizio settembre, un dominio molto simile ma distinto da quello che stavo vedendo io à fingerprint-verification[.]info che non va confuso con à fingerprint-veri[.]info osservato nelle mie esecuzioni. eSentire ha pubblicato analisi sull’ecosistema ErrTraffic , descrivendo compromissioni WordPress, JavaScript offuscato, utilizzo di Polygon e un modello di delivery molto vicino a quello che stavo ricostruendo. Altre ricerche pubbliche collegano parti dell’infrastruttura e del tooling a un soggetto indicato come LenAI . Queste fonti mi hanno permesso di dare un contesto migliore ai campioni, ma ho cercato di non usarle per estendere automaticamente le conclusioni. Ad esempio, se un’altra ricerca osserva un determinato RAT alla fine di una catena simile, non significa che lo stesso RAT sia stato consegnato durante la mia visita a EDIH4DT. Allo stesso modo, se una ricerca attribuisce lo sviluppo di un toolkit a LenAI, non significa che LenAI sia necessariamente la persona che ha compromesso i WordPress che ho analizzato. Sono cose diverse. Nel mio caso considero molto solida la corrispondenza con l’ecosistema ErrTraffic/BW-style. Non ho invece evidenze sufficienti per identificare l’operatore che ha compromesso i singoli siti. Una terza osservazione Durante la ricerca ho analizzato anche unitranscond.com. Il sito mostrava nuovamente lo stesso contratto, lo stesso selector e lo stesso downstream durante l’esecuzione in sandbox. Non ho però raccolto su questa vittima lo stesso livello di materiale statico che ho conservato per Destination Wedding Lazio ed EDIH4DT. Per questo non la considero allo stesso livello dei due casi principali. È utile come ulteriore osservazione del cluster, ma non voglio trasformare un’evidenza secondaria nella terza colonna dell’analisi solo per rendere il dataset più grande. I due casi sui quali posso fare il confronto più completo rimangono quelli per cui ho HTML originale, deoffuscazione e osservazione dinamica. La domanda che rimane: come è entrato il codice? Dopo aver ricostruito il loader ho iniziato inevitabilmente a guardare anche la superficie WordPress di EDIH4DT. Il sito utilizza il tema Roneous . Tra le risorse pubblicamente visibili ho identificato inoltre: WPBakery 7.7.2 Slider Revolution 6.7.13 Contact Form 7 6.0.3 DFlip Lite 2.3.57 WPBakery 7.7.2 e Slider Revolution 6.7.13 coincidono con versioni distribuite in un periodo storico del bundle Roneous. Questo rende plausibile che il sito utilizzi una release non recente del tema, ma non permette di stabilire con certezza la versione installata. Roneous è inoltre interessato da vulnerabilità pubblicamente documentate. Tra queste c’è CVE-2025-69177 , relativa a versioni vulnerabili del tema. Naturalmente ho considerato la possibilità che ci fosse un collegamento. Ma qui mi sono fermato. Dal fatto che un sito utilizzi Roneous e che Roneous abbia una vulnerabilità non segue che quella vulnerabilità sia stata utilizzata per compromettere il sito. Per dimostrarlo servirebbero almeno la versione effettiva installata, log del web server, file modificati, informazioni sul database o altri elementi forensi. Non li ho. Quindi nel mio materiale Roneous rimane una pista da verificare , non la spiegazione dell’incidente. Il vettore iniziale rimane sconosciuto. E le 24 copie di wpmbchik? Anche questo è un punto sul quale è facile andare oltre quello che i dati permettono. Sul campione HTML di EDIH4DT ho verificato 24 occorrenze del marker. Sono abbastanza da far pensare che l’iniezione non sia semplicemente una singola stringa aggiunta manualmente a una pagina. Il codice compare in differenti regioni dell’output WordPress. Ma dal browser vedo il risultato finale del rendering, non la sorgente della persistenza. Non posso dire se il codice risieda nel database, nei file del tema, in un plugin, in un mu-plugin o in un altro componente. Alcune ricerche su ErrTraffic hanno documentato specifici metodi di persistenza WordPress in altri incidenti. Sono ottimi elementi da cercare durante un’analisi forense. Non sono però automaticamente applicabili a EDIH4DT. Cosa rimane stabile nei due loader A questo punto sono tornato ai due campioni iniziali per capire cosa avesse realmente senso usare come indicatore. Le differenze erano: Quindi una firma costruita sulla chiave XOR sarebbe già stata poco utile. Lo stesso vale per i nomi delle variabili, per il guard e per l’hash dell’intero blocco. Quello che invece non cambiava era: eth_call 0xb68d1809 0xB6bC9e1D0b2fB96Ab7C47E04Cb0BE477410bC1f2 RPC Polygon multipli fallback tra provider decoding ABI /api.php?s= È da qui che ho iniziato a costruire la parte di detection. Una regola sperimentale sul contenuto JavaScript può, ad esempio, richiedere contemporaneamente eth_call, b68d1809, /api.php?s= e la presenza di almeno due RPC Polygon appartenenti alla lista osservata. Un’altra possibilità è cercare direttamente la combinazione contratto + selector nelle chiamate eth_call. Sul contenuto WordPress wpmbchik può essere un ulteriore marker, soprattutto quando compare insieme a atob, TextDecoder e new Function. Quello che eviterei è trattare gli RPC come domini malevoli. QuickNode, Ankr, PublicNode e gli altri servizi coinvolti sono provider legittimi. Il dato interessante non è à host contacted QuickNode ma qualcosa più vicino a È una sequenza molto più difficile da confondere con il normale utilizzo di un singolo provider RPC. Perché Polygon rende comoda questa architettura Una volta capito il funzionamento, il vantaggio operativo è abbastanza evidente. Supponiamo che oggi il contratto restituisca à fingerprint-veri[.]info e che domani quel dominio venga sospeso. Se il dominio fosse scritto direttamente nei JavaScript già iniettati, sarebbe necessario aggiornare i siti compromessi o mantenere un altro meccanismo di redirect. Con il resolver on-chain, invece, la configurazione può essere aggiornata in un punto separato. Il loader presente sul WordPress continua a fare quello che faceva prima: interroga il contratto e utilizza quello che riceve. È anche il motivo per cui considero più utile descrivere Polygon come livello di configurazione/indirezione piuttosto che dire semplicemente che “il malware è sulla blockchain”. Nel codice che ho analizzato la blockchain non contiene il payload finale. Fornisce al loader l’informazione necessaria a trovare l’infrastruttura successiva. Dove mi sono fermato L’11 settembre ho deciso di congelare la raccolta. A quel punto avevo: gli HTML originali dei due casi principali; i relativi hash; i loader deoffuscati; le richieste RPC osservate dinamicamente; il contratto e il selector; il dominio restituito durante le esecuzioni; le chiavi utilizzate dai loader; osservazioni precedenti delle stesse chiavi; una timeline dell’infrastruttura; abbastanza materiale per confrontare staticamente i due loader. Avrei potuto continuare a cercare altri siti. Probabilmente ne avrei trovati altri. Ma il numero di vittime non avrebbe risposto alle domande che a quel punto mi interessavano maggiormente. Non so come sia avvenuto l’accesso iniziale. Non so dove risieda la persistenza sul server. Non conosco la semantica esatta delle chiavi passate a s. Non conosco la logica completa utilizzata dal backend per qualificare il traffico. E non ho attribuito un payload finale alle visite che ho analizzato. Per rispondere seriamente almeno alle prime due domande servirebbe la collaborazione di chi gestisce i sistemi coinvolti. Continuare dall’esterno avrebbe rischiato di produrre soprattutto ipotesi. Segnalazione Una volta congelata la ricerca ho iniziato a contattare i soggetti interessati. Ho segnalato il caso EDIH4DT attraverso i contatti disponibili e ho preparato un pacchetto tecnico contenente le evidenze raccolte. Le evidenze sono state trasmesse a CERT-AgID . L’11 settembre CERT-AgID mi ha comunicato di aver censito le campagne malevole segnalate e di aver diramato i relativi Indicatori di Compromissione agli enti accreditati al proprio flusso IoC. La responsible disclosure verso i soggetti direttamente interessati rimane in corso. Ho inoltre cercato di raggiungere il CINI per individuare un referente tecnico al quale far arrivare direttamente la segnalazione. Al momento in cui sto scrivendo questa parte, il processo di segnalazione è ancora in corso. Per questo motivo mantengo separato il materiale utilizzato per la gestione dell’incidente — HTML originali, artefatti completi e altri dettagli — da ciò che può essere pubblicato. Se avrò modo di confrontarmi con chi gestisce il server, le prime cose che vorrei verificare sono molto semplici: da dove è partita l’iniezione e dove viene mantenuto il codice che continua a comparire nell’HTML . Sono le due parti dell’incidente che, lavorando soltanto dall’esterno, non posso vedere. Per ora quello che posso documentare direttamente è il resto: due siti WordPress italiani, due varianti differenti del loader, lo stesso contratto Polygon, lo stesso selector e, durante le osservazioni, lo stesso dominio restituito dal resolver. Ed è su queste evidenze che preferisco fermare le conclusioni. L'articolo Siti italiani compromessi! Ecco il malware che si nasconde nella blockchain proviene da Red Hot Cyber .

Berlin investigates new data leak after hackers publish stolen login credentials German authorities are investigating another trove of data stolen from Berlin’s government network after hackers published login credentials and other information over the weekend. The latest release follows a cyberattack discovered in mid-August that compromised two Berlin ministries responsible for urban development and housing, and for transport, mobility, climate protection and the environment. Berlin’s government said Sunday that the newly released data includes login credentials but did not say what systems they could be used to access or whether they were still valid. The authorities have not attributed the attack to a specific threat actor. The city’s urban development ministry has strengthened security measures introduced after an earlier data leak, which officials said could temporarily limit access to some of its applications. 'A very serious crime' Berlin’s data protection authority said Friday that the attackers stole a large amount of data from the two affected ministries and later published it online. Officials are still reviewing the stolen files because of the volume of data involved. The regulator confirmed that the leak includes personal information about public employees and said data belonging to Berlin residents also may have been exposed. Potentially compromised information includes names, addresses, dates of birth, bank information, email addresses, telephone numbers, correspondence with government agencies and copies of documents submitted to the administration, according to the regulator. Berlin has created an additional task force to review the leaked material and determine who may be affected. “A very serious crime has been committed against the State of Berlin,” Governing Mayor Kai Wegner said Saturday, adding that authorities were working to identify and assist people whose information had been exposed. No payment The Rhysida ransomware group claimed responsibility for the breach in late August, saying it had stolen 5.79 terabytes of data, including tens of thousands of contracts, emails, passwords and classified information. Berlin has confirmed that data was stolen and that it received an extortion demand, but officials have not publicly attributed the attack to Rhysida or verified the hackers’ claims about the amount or contents of the stolen material. Wegner said last month that Berlin would not pay the attackers. “The State of Berlin will not be blackmailed,” Berlin Chief Digital Officer Florian Hauer said separately. The affected systems were disconnected from Berlin’s wider government network on Aug. 14. Both ministries continued operating, but the disruption left some employees without their normal email and internet access and temporarily affected public services that depend on their systems. Rhysida warning Germany’s Federal Office for Information Security, or BSI, separately warned Friday about a cyberattack campaign linked to the same financially motivated hackers behind Rhysida. The agency did not explicitly identify Berlin as one of the victims but said it had been informed in August about the compromise of a government institution. According to the BSI, the campaign resembles the so-called TerminalFix attacks recently documented by Microsoft. Hackers compromise websites and display fake CAPTCHA verification pages that trick visitors into manually running malicious commands on their computers. The BSI said reports it received indicated that attackers attempted both to steal data and install ransomware, allowing them to pressure victims with the threat of publishing stolen information. The agency said the campaign involved malware known as LoremIpsumLoader, or AxolotLoader, which it linked to the same financially motivated cybercriminal group associated with Rhysida. “According to current findings, the campaign is being carried out by cybercriminal actors,” the BSI said. “So far, no connection to state-sponsored or politically motivated actors has been established.” Rhysida has operated since 2023 and has targeted governments, hospitals, schools and companies around the world. According to the BSI, government and public administration organizations are among the five sectors most frequently appearing on the group’s leak site, although education and health care remain its primary targets. The BSI said stolen information is ultimately published in 92 percent of cases in which victims are named on Rhysida’s leak site. The Berlin breach comes shortly before the city’s Sept. 20 election. Berlin Interior Senator Iris Spranger previously said that authorities had found no evidence that data had been stolen from election systems and that the election environment was secure. Daryna Antoniuk is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.

Last week on Malwarebytes Labs: The hidden work of modernizing Malwarebytes X Money rollout linked to password-reset attacks Free streaming boxes may be routing criminal traffic through your home StreamRat Android malware spreads through Meta and TikTok ads Your phone or computer may soon ask how old you are Tech support scams look different now. Here’s what to watch for Scammers are getting smarter about where they target you Two critical Chrome flaws put users at risk on malicious websites 153M+ driver’s licenses for sale on new dark web platform Your AI chats could be used in court Fake GTA 6 leaked copy drains your crypto wallet TerminalFix looks like ClickFix, but delivers a very different payload Infostealers are hijacking Claude accounts at users’ expense McKesson confirms cyber incident after ShinyHunters claims patient-data theft Stay safe! Something feel off? Check it before you click.    Malwarebytes Scam Guard  helps you analyze suspicious links, texts, and screenshots instantly.   Available with  Malwarebytes Premium Security  for all your devices, and in the  Malwarebytes app for iOS and Android .   Try it free →  

Un falso CAPTCHA convince la vittima a eseguire PowerShell, ma è solo l’inizio. Con TerminalFix, ClickFix evolve in una catena multistadio che effettua ricognizione dell’ambiente Active Directory e crea un reverse tunnel, trasformando l’endpoint compromesso in un potenziale punto di accesso alla rete aziendale L'articolo ClickFix evolve con TerminalFix: il falso CAPTCHA diventa una porta verso la rete aziendale proviene da Cyber Security 360 .

�\�[�V�����G���W�j�A�����O��@�uClickFix�v�̔h���^�uTerminalFix�v���L�����Ă���BMicrosoft�ɂ��ƁA���p�҂��U�̑���֗U�����ޓ_�͓��������A���̗U���悪�ς��A��Q�̐������̂��̂��]���^����ω������Ƃ����B�����N���Ă���̂��B ���̋L������������ł��B����o�^����ƑS�Ă������������܂��B �@Microsoft��2026�N8��28���i���n���ԁj�A�uClickFix�v�̔h���^�ƂȂ�U���L�����y�[���uTerminalFix�v���ϑ������ƌ��\�����BClickFix�́A�U�̃G���[��ʂ�U�̔F�؉�ʂ�\�����A���p�Ҏ��g�ɃR�}���h�����s�����ă}���E�F�A�Ɋ����������@���BTerminalFix�͂��̗U�����ς��邱�ƂŁA�P���̃}���E�F�A�z�z�ɂƂǂ܂�Ȃ����i�K�̐N���𐬗������Ă���B �@�]���^��ClickFix�́A���p�҂ɁuWindows�v�L�[�ƁuR�v�L�[���������A�u�t�@�C�������w�肵�Ď��s�v�_�C�A���O�ɃR�}���h��\��t��������BTerminalFix�́A�\��t������u�t�@�C�������w�肵�Ď��s�v�ł͂Ȃ�Windows Terminal�܂���PowerShell�ɕς���BMicrosoft�͂��̕ύX�̑_�����A�����s�ɂ킽�镡�G�ȃX�N���v�g�����s�����₷�����邽�߂��Ɛ�������B �@TerminalFix�Ŋϑ����ꂽ�U���́A���K��Web�T�C�g�������ċU��Cloudflare Turnstile�F�؉�ʂ�\������Ƃ��납��n�܂�B���p�҂���ʂ̎w���ɏ]���āu���ؗp�v�̃R�}���h��Terminal�ɓ\��t���Ď��s����ƁA�U���҂̃T�[�o����t�@�C�����_�E�����[�h����A�����̘A�������������B �@�]���^��ClickFix�����ގ�^�}���E�F�A�i�C���t�H�X�e�B�[���[�j��1�������ďI��邱�Ƃ����������̂ɑ��ATerminalFix�͂����Ŏ~�܂�Ȃ��B�ł́A���̍U���͍ŏI�I�ɉ���g�D�ɂ����炷�̂��BMicrosoft�����Ɋ댯���Ǝw�E����̂́A��������1���g�D�����ւ̐N�����ɕς��Ă��܂��d�g�݂��B �@TerminalFix�̊j�S�́A��������PC���u�U���҂��Г��l�b�g���[�N�֓��荞�ނ��߂̒��p�_�v�ɕς���_�ɂ���BMicrosoft�ɂ��ƁA���̍U���͍ŏI�i�K�ŁA�Г��̔C�ӂ̃V�X�e���֍U���҂̒ʐM��ʂ��Ǝ��̃��o�[�X�g���l���i�O�����̒ʐM���g���ĊO����������ڑ�����o�H�j���\�z����B �@�U���̘A���͕����̒i�K�ށBTerminal�Ń_�E�����[�h���ꂽZIP�t�@�C���ɂ́A���K�̏����t��Windows���s�t�@�C���ƁA���ӂ���DLL����������Ă���B���K�̎��s�t�@�C�����N������ƁA�����ꏊ�ɒu���ꂽ���ӂ���DLL���ǂݍ��܂��B���K�̃v���O�����Ɋ���`�ŕs���ȃR�[�h�����s�����邱�̎���́ADLL�T�C�h���[�f�B���O�ƌĂ��B�U���͐M�����ꂽ�����t���v���Z�X�̓����Ŏn�܂邽�߁A�v���Z�X�̐���������|����ɂ���h������蔲���₷���Ȃ�B �@���̒i�K�ł́A�U���҂̃h���C������PNG�摜���_�E�����[�h�����B�摜�̉�f�f�[�^�ɂ͎��s�t�@�C����DLL�̒f�Ђ����ߍ��܂�Ă���A��������o���ăf�B�X�N��ōč\������B�f�[�^���摜�ɉB����@�̓X�e�K�m�O���t�B�[�ƌĂ�A�ʐM�̓r���Ńt�@�C���̒��g����������Ă����s�t�@�C�����ƋC�t����ɂ����BDLL��2���̉摜�ɕ������ĉ^��A���o������Ɍ��摜�͍폜�����B �@����������������d�g�݂���d�ɗp�ӂ����B���W�X�g���̎������s�L�[�ƁA60�����ƂɎ��s�����^�X�N�X�P�W���[���[�̓o�^�ɂ��A�ċN������}���E�F�A������������B�}���E�F�A��u�����t�H���_�́A�V�X�e�������ƉB���t�@�C�������Ō����Ȃ��悤�ɂ����B �@������A�}���E�F�A�͎Г����̒�@�ɓ���B�h���C���̐M���W�̗A�h���C���Ǘ��҃O���[�v�̊m�F�A�uActive Directory�v�̗��p�҂�[���̒T���A�h���C���R���g���[���[��f�[�^�x�[�X�A�o�b�N�A�b�v�Ƃ������������Ƃɖ��t����ꂽ�T�[�o�ւ�ping���M�Ȃǂ����s����BMicrosoft�́A���̒�@���A��������PC�����l����W�I�̋߂��ɂ��邩�ǂ��������ɂ߂�_�������ƕ��͂��Ă���B �@�Ō�ɁA�U���҂�Python�̌����z�z�T�C�g���珐���t���̎��s�����������݁A�Ǝ��̒ʐM�v���O�����Ƒg�ݍ��킹�ă��o�[�X�g���l�����N������B�ʐM��TLS�ňÍ������ꂽWebSocket�Ƃ��ĊO���̃T�[�o�ڑ����邽�߁A���|����͒ʏ�̈Í���Web�ʐM�Ƌ�ʂ��ɂ����B �@TerminalFix�Ŏg����X�̋Z�p�́A�ڐV�������̂ł͂Ȃ��BDLL�T�C�h���[�f�B���O���X�e�K�m�O���t�B�[�����m�̎�����B�V�����̂́A���K�̏����t���o�C�i����Python�̌��������^�C���Ƃ����u���K�̂��́v�𑫏�ɂ��āA���̐M������Ȃ���N����i�߂�g�ݗ��ĕ��ɂ���B �@Windows Terminal�ւ̗U�����������z���B�]���^���g���u�t�@�C�������w�肵�Ď��s�v��1�s�̃R�}���h���������Ȃ����ATerminal�Ȃ畡���s�̃X�N���v�g�����̂܂��s�ł���BMicrosoft�ɂ��ƁA���̗U����̕ύX���A���G�ȃX�N���v�g���Ō�܂Ŏ��s�����鐬�����������グ�Ă���B �@�����ŏd�v�Ȃ̂́AMicrosoft���ϑ������̂͐N���ƒ�@�A�ʐM�o�H�̍\�z�܂łł���A���̐�̍s���͊m�F���Ă��Ȃ��Ɩ������Ă���_���BMicrosoft�́A���o�[�X�g���l���ƒ�@�̑g�ݍ��킹���A��������PC����Г��̕ʂ̃V�X�e���֓��B����y��ɂȂ蓾��Ǝw�E����B��ʂɁA���̎�̐N���̌�ɂ́A�U���҂����ƂŌ������i��f�[�^�ގ�A�����T���E�F�A�W�J�ɐi�ޒi�K�������B������TerminalFix�̕��͔͈͂ł���炪���s���ꂽ�����͊ϑ�����Ă��Ȃ��B �@Microsoft�́ATerminalFix�ւ̑�Ƃ��āA�W�����[�U�[��PowerShell���s��AppLocker��O���[�v�|���V�[�Ő������邱�ƁA�Ɩ��ŕs�v�ȏꍇ�́u�t�@�C�������w�肵�Ď��s�v�̗��p�𐧌����邱�ƁA�����ċU��CAPTCHA��ʂŃR�}���h�̓\��t���𑣂�����𗘗p�҂Ɏ��m���邱�Ƃ�������B�����āAWindows Terminal�ɂ́A�\��t���悤�Ƃ���e�L�X�g�������s�ɂ킽��ꍇ�ɗ��p�҂x������ݒ肪����BTerminalFix�������s�X�N���v�g�̎��s��_���ȏ�A���̌x���͓�����ł̋C�t���ɂȂ���B Copyright © ITmedia, Inc. All Rights Reserved.

Microsoft has published details about a Windows malware campaign it calls TerminalFix. The social engineering used to infect people is very similar to what we’ve seen in ClickFix campaigns. A website visitor is presented with a fake Cloudflare CAPTCHA which, when clicked, secretly copies a malicious command to their clipboard. Then they receive instructions on what they need to do to “prove they are human,” when in reality they are being instructed to execute the malicious command. After gaining a foothold, the malware downloads what appear to be ordinary PNG images from attacker-controlled sites, but the images also contain concealed payload data. A PowerShell script reads the images’ pixel data: The first eight bytes specify the embedded file’s length, while the remaining data is reconstructed into an executable and two DLL fragments, which are joined on the victim’s disk. The use of steganography is notable, but does not set TerminalFix apart from other ClickFix campaigns that have used the same method. What does make TerminalFix different is its payload. One way or another , ClickFix victims usually end up with information-stealing malware of some sort. TerminalFix instead chains together several mature evasion techniques, including DLL sideloading, steganographic delivery, folder hiding, realistic browser User-Agent rotation, and encrypted WebSocket traffic, rather than relying on one obfuscated PowerShell downloader. Its end goal is also different. The campaign delivers a payload chain that performs domain-aware reconnaissance before installing a custom, multiplexed reverse TCP tunnel. This hidden connection can give attackers access to the victim’s network. The infected computer first calls out to the attackers using encrypted web-like traffic over port 443, allowing the “reverse” connection to pass more easily through a company firewall. In this way, the compromised system creates a secret remote-access doorway from inside the network. “Multiplexed” means the attackers can send several separate connections, for example to a file server, database, or another workstation, through that single encrypted tunnel at the same time. This allows them to use the victim’s computer as a stepping stone into the rest of the network. How to stay safe First, remember that a real CAPTCHA may ask you to click boxes or select images, but it will not ask you to open Run, Terminal, Command Prompt, or PowerShell and paste a command. Slow down.  Don’t rush to follow instructions on a webpage or prompt, especially if it asks you to run commands on your device or copy-paste code. Attackers rely on urgency to discourage careful thought, so be cautious of pages urging immediate action. Sophisticated ClickFix pages may add countdowns, user counters, or other pressure tactics to make you act quickly. Avoid running commands or scripts from untrusted sources.  Never run code or commands copied from websites, emails, or messages unless you trust the source and understand exactly what the command will do. Verify instructions independently.  If a website tells you to execute a command or perform a technical action, check through official documentation or contact support before proceeding. Limit the use of copy and paste for commands.  Manually typing commands instead of copy-pasting can reduce the risk of unknowingly running malicious payloads hidden in copied text. Secure your devices.  Use an up-to-date, real-time  anti-malware solution  with a web protection component. Learn to recognize evolving attack techniques.  Knowing that attackers continually change their methods can help you recognize suspicious instructions. Keep reading our blog! Pro tip:  Did you know that the free  Malwarebytes Browser Guard  extension warns you when a website tries to copy something to your clipboard? Some browsers also restrict or warn about certain uses of the clipboard. Since macOS Tahoe 26.4 , Terminal can warn users when they paste text copied from a browser or messaging app. This protection operates at the app and operating-system level rather than inside the browser. Stop threats before they can do any harm. Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

A new ClickFix variant dubbed TerminalFix uses fake Cloudflare CAPTCHA prompts on compromised websites to trick victims into executing malicious PowerShell commands in Windows Terminal. Unlike typical ClickFix attacks that often lead to infostealer malware infections, this campaign uses a multi-stage intrusion chain that ultimately gives attackers a reverse tunnel into the victim’s internal network. TerminalFix differs from normal ClickFix attacks in that it directs users to Windows Terminal or PowerShell, which enables successful execution of more complex, multi-line scripts. Microsoft discovered the attacks in the wild but did not observe hands-on activity. However, the researchers warn that access obtained this way could be leveraged for lateral movement, privilege escalation, credential theft, disabling security tools, data exfiltration, or deploying ransomware. The infection begins with a fake CAPTCHA prompt that instructs victims to execute a PowerShell command preloaded into the clipboard as part of the purported verification process. The command downloads a ZIP archive that contains a legitimate signed executable and a malicious DLL file, which decodes and launches an obfuscated payload directly in memory. For the second stage, the threat actor used steganography to hide executables and DLL fragments in the pixel data of three PNG images. The script downloads the image files from the command-and-control (C2) server and reassembles the embedded payloads on the disk. The malware establishes persistence through a scheduled task and a Registry Run key, configured to execute every hour. While active, it performs reconnaissance by probing for domain controllers, databases, backup servers, gateways, and mail systems; collecting system information; and enumerating Active Directory (AD). The most important component is a custom Python reverse-tunnel module that connects to an outbound address (gitnow[.]dev:443 ) over an encrypted WebSocket, supporting SOCKS5-style arbitrary TCP proxying. This allows the attacker to instruct the compromised machine to connect to internal IPs, hostnames, and ports reachable from the victim. The reverse-tunnel also supports multiplexing multiple connections over one WebSocket, rotating realistic browser User-Agent strings, keepalive, and remote shutdown. Microsoft says this can turn the infected endpoint into a network pivot, giving the operator a route to systems discovered during the earlier AD and network reconnaissance operation. The researchers recommend restricting and logging PowerShell execution, monitoring ‘LockScreenContentServer.exe’ outside its normal path, and hardening browsers and endpoint protections. If compromise is confirmed, it is advisable to investigate for lateral movement and to rotate credentials, including domain admin credentials, if accessible from the infected host. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

security Attack hides malware in PNGs and drops custom reverse tunnel on victims' machines Next-level ClickFix wave sets off multi-stage attack chain An unknown miscreant is using "TerminalFix" to trick unsuspecting users into running PowerShell commands that infect their computers with a reverse tunnel granting attackers access to their networks. Some of the malware is even hidden inside PNG graphics the PC downloads. TerminalFix is the latest variant of the wildly popular ClickFix initial access method for attackers. This type of social engineering technique tricks users into running malicious commands by promoting them with a phony fix or CAPTCHA verification. While traditional ClickFix attacks point victims to the Windows Run dialog, TerminalFix directs users to Windows Terminal or PowerShell, which increases the likelihood that they will unknowingly run multi-line scripts on their own computers, Redmond says. Plus, instead of delivering just one infostealer, this campaign kicks off a multi-stage attack chain that combines DLL sideloading, steganographic payload extraction, and Active Directory reconnaissance. It ultimately deploys a custom reverse tunnel on the infected machine that gives the attacker persistent, network-level proxy access through the compromised device. Microsoft declined to answer The Register’s questions, including how many organizations were targeted and victimized in this TerminalFix campaign, and which attacker or criminal crew is responsible for these attacks. The attack chain begins when the victim interacts with a phony overlay that spoofs the Cloudflare CAPTCHA “verify you are human” checkbox and includes a Cloudflare logo, causing a fake verification command to be copied to the clipboard before the victim pastes it into Windows Terminal or PowerShell. This command runs a hidden PowerShell script that prints a fake “Starting Cloudflare verification…” message and downloads a ZIP archive from an attacker-controlled server. It extracts the archive under C:\ProgramData and launches a batch file (1.bat) that silently executes LockScreenContentServer.exe. LockScreenContentServer.exe is a legitimate, signed Windows executable - and it acts as the DLL sideloading host for a second file: dui70.dll. This purports to be a “Windows DirectUI Engine,” but is actually the malicious payload, which executes a second-stage PowerShell script once it’s sideloaded. The second PowerShell script downloads additional payloads hidden inside PNG images - this is called steganography, and it makes file- and content-type inspection more difficult, and thus easier to hide malicious payloads. In an attempt to further obfuscate the payload and avoid being detected, the attacker split the payload into multiple PNGs. The PowerShell script downloads the three images, extracts an executable from the first image and two halves of the DLL from the second and third images, and then reassembles the components on disk. “After extraction, the source images are deleted to reduce forensic artifacts,” Microsoft researchers Sagar Patil, Suriyaraj Natarajan, and Parasharan Raghavan wrote. The malware establishes redundant persistence through both HKCU\…\Run registry keys and scheduled tasks that re-execute LockScreenContentServer.exe every 60 minutes to ensure it survives reboots. It then does reconnaissance on the compromised machine, scooping up system information across multiple language configurations including English, Spanish, and German. It also performs domain trust discovery, domain admin enumeration, and Active Directory user and computer searches, while pinging targeted, named servers. “The observed names correspond to common infrastructure roles, including domain controllers, databases, backup, gateways, and mail systems,” according to the threat hunters. “This probing could help an attacker identify accessible target systems for follow-on activity.” Next, the malware drops a persistent PowerShell file-watch loop that monitors a text file for new commands, executes them via Invoke-Expression, and writes results to an output file. This allows the attacker to execute additional PowerShell commands by writing them to the text file. And finally, the attacker deploys a custom, Python-based reverse-tunnel implant. The tunnel launches with no visible window via pythonw.exe, and it sets up a reverse WebSocket tunnel to gitnow[.]dev:443. This implant, combined with earlier reconnaissance data, gives the attacker SOCKS-style TCP proxy access through the victim’s network. Microsoft recommends organizations take several steps to avoid becoming a victim of this campaign. These include restricting PowerShell and Run dialog execution, and either blocking or auditing the Windows Run dialog (Win+R) if it’s not needed for daily work. Also, train employees on how to look for ClickFix tactics, like fake CAPTCHA verification pages that tell them to paste commands into Terminal or the Run dialog. ®

The boring parts caused most of the trouble. A router shipped ready to listen. A fake check turned the user into the installer. Trusted systems collected traffic and passwords, then cleaned the logs. Old bugs formed new attack chains. Even an AI agent decided its assigned task was optional. Elsewhere, fake apps, helpful support calls, cheap banking kits, exposed systems, and weak defaults kept things moving. Different attacks, same useful mistake: something familiar was trusted without a second look. Here is the week... ⚡ Threat of the Week U.S. Disrupts Chinese Proxy Network Enabling Cyber Espionage — The U.S. Federal Bureau of Investigation (FBI) disrupted infrastructure associated with a technical quartermaster who sold reconnaissance, proxy management, and operational routing capabilities for Chinese cyber espionage activities. The QTYF group is said to have created and operated the QScan and QTRouter frameworks, which have been used to target U.S. critical infrastructure networks. It's employed by the China-based Nanjing Xinjiuwei Network Technology Company. Stop Scrambling, Start Governing: How IT Can Get a Grip on AI Spend Spiking AI bills have left IT teams scrambling. Leadership wants to know how much is being spent on AI, but getting an answer means checking five dashboards for data that’s stale by the time you read it. Read 1Password’s blog to learn how IT can manage AI spend across vendors, models, and teams. Learn More ➝ 🔔 Top News OpenAI Says Reward Hacking Drove AI Agents to Breach Hugging Face — OpenAI revealed that reward hacking was a key driver behind the artificial intelligence (AI)-powered hack of Hugging Face last month, adding that it found evidence of misaligned behavior as early as late May. The incident took place during cybersecurity evaluations of several OpenAI models, and it was mainly fueled by what it described as a "highly capable, internal-only research model" comparable in scale to GPT‑5.6 Sol. "The models, operating under reduced safeguards, took actions that were misaligned with the goals of their assigned tasks – they communicated through unauthorized channels, exploited vulnerabilities in shared infrastructure, gained internet access, and accessed third-party systems," it said. TerminalFix Uses Fake Cloudflare CAPTCHAs to Drop Reverse Tunnel Implant — A new ClickFix variant, dubbed TerminalFix, aims to trick users into running a malicious command in Windows Terminal or PowerShell instead of directing them to the Windows Run dialog. The campaign, targeting organizations across multiple sectors, leverages compromised websites as a starting point to serve fake Cloudflare CAPTCHA verifications that prompt unsuspecting site visitors to copy and execute a malicious PowerShell command. The attack chain, according to Microsoft, is a sophisticated multi-stage process that leverages DLL sideloading, steganographic payload extraction, extensive Active Directory reconnaissance, and a bespoke custom reverse-tunnel implant that grants the attacker persistent, network-level proxy access through the infected machine. PaperCut Flaws Under Attack — Threat actors are chaining together two new security flaws in PaperCut NG and MF to execute arbitrary code on susceptible instances. "CVE-2026-81578 allows you to bypass authentication, and from there, you can edit a configuration file to exploit CVE-2026-82078 and gain Remote Code Execution," Jake Knott, head of threat intelligence at watchTowr, told The Hacker News. Huntress said it observed limited exploitation on two customer environments, with the attackers executing Base64-encoded commands on the targeted server as part of post-exploitation activity to determine user account and operating system using a chained command "whoami & ver." China-Made ZBT Routers Ship with 2 Backdoors — A firmware analysis of ZBT Deep Orange 3G/4G/LTE Router uncovered two new backdoors called SPEAKINGSTONE (CVE-2026-74233, CVSS score: 9.3) and DARKLANTERN (CVE-2026-74232, CVSS score: 9.3). The development came after at least 21 firmware images from the Chinese company were found to contain another backdoor called ENDLESSDOORS (CVE-2026-66747, CVSS score: 9.3) that's designed to start automatically and attempt to beacon to Chinese command-and-control (C2) infrastructure as often as every 35 seconds. The two new backdoors predate ENDLESSDOORS. "SPEAKINGSTONE, like ENDLESSDOORS, is a phone-home implant that connects back to ZBT's cloud infrastructure and accepts remote commands," VulnCheck said. "DARKLANTERN is a backdoor that listens on the WAN and executes arbitrary commands. No authentication required. Both are written in Nim. Both communicate over UDP. Both are launched by the same binary, a connectivity watchdog called inetdetect." Fire Ant Targets Trusted Infrastructure in 2026 — The China-linked threat actor known as Fire Ant (aka UNC3886) has continued to remain active in 2026, going beyond hypervisors to target trusted infrastructure, including routers (including Cisco IOS XR routers), TACACS servers, authentication systems, and Linux management hosts to maintain covert access, collect credentials and traffic, and reach connected high-value environments. "The compromise impacted both the direct and third-party environments," Sygnia said. "Its trusted infrastructure relationships created potential reachability into connected external environments, including high-value networks and critical infrastructure. Fire Ant appeared to use this trusted position to explore access paths beyond the initially compromised environment." Compromised routers were used for covert connectivity, traffic collection, command-output manipulation, and suppression of logging. In addition, the threat actor used deployed long-lived implants across Linux management infrastructure, including Medusa rootkit-related components, custom SSH backdoors, Zabbix-masquerading malware (aka BridgeAgent) that acts as a pathway for actor-controlled access into connected environments, and packet-triggered backdoors. Another tool in Fire Ant's arsenal is TacTap, which is used for TACACS credential collection. "The actor also manipulated the evidence sources defenders depend on," Sygnia added. "It suppressed router logging, altered command output, captured administrative credentials, tampered with host logs, and deployed multiple persistent backdoors." ️🔥 Trending CVEs Bugs drop weekly, and the gap between a patch and an exploit is shrinking fast. These are the heavy hitters for the week: high-severity, widely used, or already being poked at in the wild. Check the list, patch what you have, and hit the ones marked urgent first — From CVE-2025-30237 through CVE-2025-30241, CVE-2025-15628, CVE-2026-9254, CVE-2026-16348, CVE-2026-78541 (TP-Link), CVE-2026-17106 aka CopyEscape (Docker), CVE-2026-70426 (Jenkins), CVE-2026-15307, CVE-2026-15337, CVE-2026-15830, CVE-2026-15920 (Django), CVE-2026-19598 (Pods), CVE-2026-19874 (Konami Metal Gear Online 3), CVE-2026-75149, CVE-2026-67618 (Marimo), CVE-2026-77775, CVE-2026-77776 (Headroom LLM Proxy), CVE-2026-0251 (Palo Alto Networks GlobalProtect App), CVE-2026-59568, CVE-2026-59567, CVE-2026-59565 (Zscaler Client Connector), CVE-2026-69251, CVE-2026-73601, CVE-2026-69253, CVE-2026-69256, CVE-2026-73602, CVE-2026-69259, CVE-2026-69264, CVE-2026-73484, CVE-2026-69255, CVE-2026-70477, CVE-2026-73485, CVE-2026-73486, CVE-2026-73487, CVE-2026-70470, CVE-2026-69254 (Flowise), CVE-2026-19912, CVE-2026-19913 (Kaltura HTML5 Player Library), CVE-2026-79282, CVE-2026-79290, CVE-2026-79054, CVE-2026-79121, CVE-2026-79224, CVE-2026-79052, CVE-2026-79150, CVE-2026-78935, CVE-2026-79012, CVE-2026-79200 (Google Chrome), CVE-2026-77537, CVE-2026-77550, CVE-2026-77554 (Ubiquiti UniFi), CVE-2026-18431 (Avada WordPress theme), CVE-2026-7791 (Amazon Skylight Workspace Config Service), CVE-2026-73554 (DoltHub), CVE-2026-19516 (Grafana MCP), CVE-2026-75604, GHSA-2xp9-vwfh-vxw4 (Next.js), CVE-2026-65643 (cPanel and WebHost Manager), CVE-2026-76639, CVE-2026-76640 (Unitree G1 EDU), CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820 (ServiceNow AI Platform). 🎥 Cybersecurity Webinars AI Can Build Attack Paths in Minutes. Is Your SOC Ready? → AI can now discover zero-days, generate working exploits, and chain full attack paths, often within minutes of disclosure. Learn how to assess your AI threat readiness and build the visibility, context, and response speed needed to keep pace. AI Finds Flaws Faster. Your Exposure Answers Can’t Take Days → AI is speeding up vulnerability discovery, but the answer that matters is still slow: Are we exposed? See how Tines unified SBOM, application, cloud, and vulnerability data into one view to assess exposure faster and execute human-reviewed response playbooks at machine speed. 📰 Around the Cyber World Play Ransomware Encryption — The closed ransomware group known as Play (aka PlayCrypt) has been found to employ a double extortion model, encrypting systems after exfiltrating data and threatening to publish stolen data on their Tor-hosted data leak site if ransom is not paid. In one incident observed in early 2026, the threat actor deployed SystemBC after gaining initial access, followed by reconnaissance, lateral movement, data exfiltration, and abusing SentinelOne's own legitimate removal tool to uninstall the product. "The threat actor gained initial access via a compromised SonicWall VPN, consistent with the group's well-documented pattern of exploiting external remote services," GuidePoint Security said. "What makes this case particularly instructive for defenders is the combination of three specific behaviors: Domain-wide tool staging via the SYSVOL share rather than per-host delivery, EDR removal using the victim's own SentinelOne uninstallation utility rather than a kernel-level driver exploit, and the recovery of a crash dump from a host where the encryptor failed to complete, an artifact that provides a rare forensic window into the encryption execution itself." Email Bombing and Quick Assist for Ransomware Deployment — ZeroBEC disclosed details of an email bombing campaign targeting at least 10 users inside an organization, causing them to receive about 3,000 messages per day. "The messages were not a conventional phishing blast. Many were genuine verification, registration, deployment, and inquiry confirmations generated after the victims' email addresses were submitted to unrelated public platforms," the email security company said. About a day and a half after the email flooding, some of the users were contacted via Microsoft Teams by attackers masquerading as IT help desk personnel to help them tackle the problem. One of the employees, who was a local administrator, granted Microsoft Quick Assist access, enabling the attackers to deploy Xray-core, a reverse proxy tool, and expand their access. "The credential-theft step was woven directly into social engineering," ZeroBEC said. "The attacker mimicked the installation of a Windows security update and launched a local credential prompt from the compromised endpoint. The victim, who was still listening to the person he believed was IT, entered domain credentials into that prompt. The tooling validated and captured the credentials and then uploaded the resulting credential/configuration artifacts to an external Microsoft Dev Tunnel." Through the reverse tunnel, the threat actor conducted domain reconnaissance and attempted NTLM relay against certificate enrollment, all hallmarks of pre-ransomware deployment. It's worth noting the modus operandi shares overlaps with that of Aurora ransomware. ValleyRAT Delivered via Rogue Installer — A malicious installer disguised as adware has been observed deploying a modified version of the Chinese desktop wallpaper management tool, QN Wallpaper, which then performs DLL sideloading to establish persistence on Windows systems by dropping a file to the Startup folder and ultimately launching ValleyRAT, a backdoor linked to a threat actor known as Silver Fox. The malware, besides taking steps to protect its process, can collect system information, reboot/shut down the computer, take screenshots, wipe logs, update command-and-control (C2) addresses, download additional modules, and send keylogger logs along with clipboard contents. Per Kaspersky telemetry, ValleyRAT and its related components have been detected more than 100,000 times, with more than 1500 unique users affected, mainly in China and India. Brazil Fines ByteDance $29.81M for Privacy Violation — Brazil's data protection authority, ANPD, fined TikTok's owner ByteDance 153.8 million reais ($29.81 million) for allegedly violating the country's General Data Protection Law. ANPD said that the local unit of China's ByteDance had processed personal data of teenagers aged 13 to 18 without a valid legal basis. The regulator estimated that TikTok may have processed the data of at least 8 million children during the review period. DeepMind Debuts Double-Blind AI Evaluations — Google's DeepMind division launched a pilot of double-blind AI evaluations with an aim to keep external evaluations in a cryptographic "box" to stop benchmark contamination and protect intellectual property. To that end, Google said it's partnering with the Singapore AI Safety Institute, OpenMined, AVERI, and MLCommons, to test a Gemini Flash Lite model against confidential benchmarks in a privacy-preserving environment to increase evaluation integrity. "By using Confidential Space within Google Cloud’s Confidential Computing portfolio, we can cryptographically verify that both the external evaluation data and the proprietary model remain private to their respective owners," DeepMind said. "The evaluator cannot see the Gemini model weights, and Google cannot see the evaluator’s test prompts." 34 Malware Families Targeting Banking Apps — Zimperium found 34 mobile malware families actively targeting more than 1,243 mobile banking and fintech apps across 90 countries globally. "The concentration of targeted applications across EMEA reflects where threat actors anticipate the highest return on investment, focusing heavily on the region's major financial centers," it said. Some of the active malware families in the EMEA region are TsarBot, CopyBara, HOOK, Nexus, Flubot, Eventbot, and MaliBot. Fake KYC Apps Target Indian Customers to Deliver Ghost Penal — A new malware-as-a-service (MaaS) operation on Telegram, dubbed Ghost Penal, is selling ready-made Android banking trojan kits impersonating five major Indian banks. "The operation supplies a two-stage dropper protected by a custom native packer, a public cloud database that receives stolen UPI PINs and device data with no authentication required, and a downstream channel that relays intercepted one-time passwords for immediate fraudulent use," iZOOlogic said. The toolkit costs $25 for a five-credit pack and $400 for a three-month unlimited plan. One of the droppers containing the malicious payload masquerades as a video-calling application, while requesting access to SMS and telephony features. "The payload’s real functionality, including SMS interception, WebView-based KYC phishing, and data exfiltration, is not present in a static scan of the installed application," the company added. "It is protected by a native library, internally named libdpt.so, that decrypts a hidden code section in memory using RC4, forks the process before executing that code as an anti-debugging measure, installs hooks on libc and on the ART runtime’s class loader, and splices a second, hidden DEX archive into the application’s running ClassLoader. The same mechanism is then used in reverse to remove the trace of that injection." Bauman University Leak Exposes Russia's Military Cyber Training Pipeline — Leaked Bauman University records have revealed a long-running program that trained about 250 career and reserve students for special intelligence, operational information-technical effects, and information-technology protection under Department No. 4. "The curriculum combined both offensive and defensive techniques for cyber defense, as well as offensive doctrine for active measures campaigns and GRU activities," DomainTools said. "Field placements then moved students from classroom instruction into military units and academies aligned with their specialties, giving them supervised exposure to intelligence operations and preparing them for military and government operations careers." Department No. 4 is assessed to be tied to the GRU, with identified graduates assigned to military units associated with APT28 and Sandworm. Pentagon's Anthropic Blacklisting Ruled Illegal — A U.S. judge blocked Anthropic's designation by the Pentagon as a supply chain risk earlier this year. "Though the Department of War is undisputedly free to select the AI vendor of its choice, the evidence demonstrates that the broad measures imposed on Anthropic were illegal and baseless," District Judge Rita Lin said. "The empty invocation of national security is not a blank check to punish and retaliate against government critics." Anthropic said it welcomed the ruling and it remained "focused on working productively with the government to harness AI for our national security so all Americans benefit from this technology." State of AI-Enabled Malware in August 2026 — Palo Alto Networks Unit 42's analysis of 405 malware samples that integrate AI in some capacity has found that only 12 of them reached a production environment, with about 97% existing only in sandboxes and on VirusTotal in the form of proof-of-concept and research code, security validating and testing, and AI-themed brand abuse. Among those that were detected in customer endpoints were FunkSec ransomware, a trojanized AI application called Recipe Lister, Oyster, Rhadamanthys Stealer, and a COM hijacking DLL. "For defenders, the practical takeaway is straightforward. Existing behavioral detection, cloud-based sandboxing and endpoint analytics catch these threats using the same mechanisms that stop conventional malware," it said. "The AI component does not evade detection. It changes how the code is authored, not how it executes." Rogue Pornographic Android Apps Lead to Financial Fraud — The Indian Cyber Crime Coordination Center (I4C) warned that malicious Android applications masquerading as pornography apps under the names Night Play, Reloop, Kyss, Vimo, Rivo, Nexo, and Vixa are being used to disseminate a banking trojan capable of carrying out financial fraud. These bogus apps are circulated through Facebook and Instagram ads and instruct victims to sideload the APK file. "After installation, the app requests permissions that allow it to install additional applications and, by abusing accessibility permission, take control of the users' device, which may result in financial fraud," I4C said. "Some apps also install a VPN, which may be used to route internet traffic pertaining to malicious/criminal activity. The app may prevent users from uninstalling it through the device settings." Details about the KYSS malware were published by security researcher Rudra Ponkshe in July 2026, describing it as a trojan designed to perform overlay attacks against 19 targets across Japan and Latin America, as well as abuse Android's accessibility services to grant itself extensive permissions, exfiltrate photos and contacts, and issue commands for subsequent execution. Conclusion The useful lesson is not that every attack became smarter. It is that more of them arrived through things already trusted: shipped devices, familiar prompts, support tools, valid access, and systems meant to protect the network. That changes the question. “Is it working?” is no longer enough. Ask what else it can do, who else can reach it, and whether the evidence it produces can be trusted. Quiet systems deserve a second look.

Microsoft has disclosed details of a new ClickFix variant, dubbed TerminalFix, that aims to trick users into running a malicious command in Windows Terminal or PowerShell. "While traditional ClickFix campaigns direct victims to the Windows Run dialog, TerminalFix campaigns apply the same technique but direct users to Windows Terminal or PowerShell instead, increasing the likelihood that complex, multi-line scripts execute successfully," Microsoft security researchers Sagar Patil, Suriyaraj Natarajan, and Parasharan Raghavan said in an analysis published this week. The campaign, targeting organizations across multiple sectors, leverages compromised websites as a starting point to serve fake Cloudflare CAPTCHA verifications that prompt unsuspecting site visitors to copy and execute a malicious PowerShell command. The attack chain, per the Windows maker, is a sophisticated multi-stage process that leverages DLL sideloading, steganographic payload extraction, extensive Active Directory reconnaissance, and a bespoke custom reverse-tunnel implant that grants the attacker persistent, network-level proxy access through the infected machine. Specifically, the PowerShell command is designed to download a ZIP archive containing a legitimate binary ("LockScreenContentServer.exe") and a rogue DLL ("dui70.dll") in order to initiate a DLL sideloading attack. The sideloaded DLL is responsible for retrieving next-stage payloads hidden within PNG images from external domains ("bestsocialmedianewspapper[.]com" or "offlineupdater[.]com"), establishes persistence via both Registry Run keys and scheduled tasks, carries out domain reconnaissance, and then deploys a Python-based reverse-tunnel command-and-control (C2) implant. The backdoor ("client.py") is equipped to tunnel arbitrary TCP traffic back to attacker-controlled infrastructure ("gitnow[.]dev:443") through an encrypted WebSocket channel, as well as enable the C2 server to reach any host visible from the victim's network. The reconnaissance phase involves the following steps - Collect system metadata Perform domain trust discovery, domain admin enumeration, and Active Directory user and computer searches Ping named servers to map the internal network topology The attack also delivers a persistent PowerShell file-watch loop that monitors a text file for new commands, executes them via Invoke-Expression, and writes results to an output file. "This type of intrusion is particularly dangerous because it provides attackers with direct access to an organization's internal network through the reverse tunnel," Microsoft said. "The observed reconnaissance and reverse-tunnel capability could enable an attacker to identify and reach additional systems from a compromised host." The tech giant has warned that such access can be abused further to escalate privileges, disarm security controls, exfiltrate sensitive data, and deploy ransomware, making TerminalFix a serious threat to enterprise environments. To mitigate the threat, it's advised to restrict PowerShell and Run dialog execution for standard users through AppLocker, Application Control for Windows, or Group Policy; consider blocking or auditing the Windows Run dialog ("Win+R") if it's not required; monitor for DLL sideloading indicators; train employees to keep an eye out for ClickFix attacks; and enable PowerShell script block logging to detect and analyze obfuscated or encoded commands.

ClickFix ed EtherHiding: nuova campagna malware utilizza smart contract sulla BNB Smart Chain Alert AL02/260810/CSIRT-ITA Sintesi Proseguono le campagne malware che sfruttano tecniche di ingegneria sociale per indurre gli utenti ad eseguire codice malevolo sui propri sistemi tramite la funzione “incolla”. Descrizione e potenziali impatti La campagna individuata dai ricercatori del team di Microsoft Threat Intelligence rappresenta un'evoluzione delle tecniche ClickFix e TerminalFix e si distingue per l'impiego della metodologia denominata EtherHiding, tecnica che sfrutta smart contract distribuiti sulla BNB Smart Chain per ospitare e distribuire istruzioni malevole. Nel dettaglio, gli attori malevoli, a seguito della preventiva compromissione di portali web legittimi, iniettano in questi del codice JavaScript offuscato e codificato in Base64 (Figura 1) che, una volta eseguito nel browser della vittima, interroga un gateway RPC della suddetta blockchain (Figura 2) per recuperare dinamicamente le istruzioni presenti nello smart contract, necessarie alle successive fasi dell'attacco. A differenza delle tradizionali infrastrutture malevole basate su server controllati dagli attaccanti, i contenuti memorizzati all'interno degli smart contract risultano particolarmente resilienti alle attività di contrasto, poiché possono essere modificati esclusivamente dal soggetto che controlla il wallet utilizzato per la loro distribuzione. Tale approccio rende meno efficaci le comuni attività di sinkholing e takedown dell'infrastruttura malevola. In caso di accesso a una risorsa compromessa, l'utente viene reindirizzato verso una falsa schermata CAPTCHA o una pagina di verifica fraudolenta (Figura 3) opportunamente predisposta per simulare controlli di sicurezza legittimi. L'obiettivo è persuadere la vittima a eseguire una sequenza di operazioni manuali sul proprio sistema operativo, trasformandola nel vettore esecutivo dell'attacco e riducendo significativamente la necessità di sfruttare vulnerabilità software specifiche. In una prima fase, la vittima viene invitata ad aprire la finestra "Esegui" di Windows utilizzando la combinazione di tasti Windows + R (tecnica ClickFix) oppure una sessione di Windows Terminal o PowerShell (tecnica TerminalFix). Successivamente, l'interfaccia fraudolenta istruisce l'utente a incollare il contenuto presente negli appunti utilizzando la combinazione CTRL + V e ad eseguirlo premendo il tasto Invio. Tale comando, opportunamente offuscato e spesso eseguito tramite strumenti legittimi del sistema operativo quali PowerShell, cmd.exe, mshta.exe, rundll32.exe, msiexec.exe, curl.exe, WMI, WebDAV o attività pianificate, consente il recupero e l'esecuzione di payload aggiuntivi, l'instaurazione di comunicazioni con infrastrutture controllate dagli attaccanti e la distribuzione di malware quali infostealer, RAT, loader e strumenti di gestione remota. Secondo quanto riportato da Microsoft Threat Intelligence, campagne di questo tipo interessano una moltitudine di utenze aziendali e consumer a livello globale. Una eventuale compromissione potrebbe, pertanto, consentire, ad un utente malintenzionato, la capacità di carpire credenziali e informazioni sensibili, ottenere persistenza sui sistemi interessati, effettuare movimenti laterali all'interno della rete, distribuire ulteriori codici malevoli e predisporre il terreno per successivi attacchi ransomware o compromissioni dell'infrastruttura di dominio. Azioni di mitigazione Gli utenti e le organizzazioni possono far fronte a questa tipologia di attacchi attivando le seguenti misure preventive: sensibilizzare periodicamente il personale sui rischi associati alle tecniche di ingegneria sociale e, in particolare, diffidare di CAPTCHA, messaggi di errore del browser, annunci pubblicitari o pagine web che richiedano l'esecuzione di comandi sul sistema locale; non copiare, incollare ed eseguire comandi provenienti da siti web, e-mail, messaggi o altre fonti non attendibili all'interno della finestra "Esegui", di Windows Terminal, PowerShell o del Prompt dei comandi; limitare, ove possibile, l'utilizzo degli strumenti a riga di comando e della finestra "Esegui" ai soli utenti e contesti operativi strettamente necessari; abilitare la registrazione avanzata delle attività PowerShell, inclusi i log relativi agli Script Block, al fine di agevolare l'identificazione di comportamenti anomali; implementare soluzioni di Application Control per limitare l'esecuzione di codice non autorizzato; monitorare l'esecuzione anomala di strumenti comunemente abusati nelle campagne ClickFix e TerminalFix, quali PowerShell, cmd.exe, mshta.exe, rundll32.exe e processi correlati; adottare e mantenere aggiornate soluzioni di protezione endpoint, web e di rete adeguate al rilevamento di attività malevole riconducibili a tali campagne. Azioni di risposta agli incidenti Qualora si riscontrino evidenze di avvenuta compromissione sui propri sistemi, si raccomanda agli utenti e alle organizzazioni di attuare le seguenti azioni: collezionare eventuali evidenze, quali processi/servizi in esecuzione su dispositivi target, log di rete e log di autenticazione considerati non convenzionali; porre in isolamento e/o offline gli host potenzialmente interessati dalla compromissione; ripristinare gli host compromessi ad un’immagine precedente consistente (dopo aver espletato le necessarie attività forensi); resettare gli account degli utenti interessati dalla compromissione; segnalare tempestivamente a questo CSIRT, tramite il portale https://segnalazioni.acn.gov.it/ l’evento occorso.