Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections

Cybersecurity researchers are calling attention to a nefarious campaign targeting WordPress sites to make malicious JavaScript injections that are designed to redirect users to sketchy sites. "Site visitors get injected content that was drive-by malware like fake Cloudflare verification," Sucuri researcher Puja Srivastava said in an analysis published last week. The website security company said it began an investigation after one of its customer's WordPress sites served suspicious third-party JavaScript to site visitors, ultimately finding that the attackers introduced malicious modifications to a theme-related file ("functions.php"). The code inserted into "functions.php" incorporates references to Google Ads, likely in an attempt to evade detection. But, in reality, it functions as a remote loader by sending an HTTP POST request to the domain "brazilc[.]com," which, in turn, responds with a dynamic payload that includes two components - A JavaScript file hosted on a remote server ("porsasystem[.]com"), which, as of writing, has been referenced on 17 websites and contains code to perform site redirects A piece of JavaScript code that creates a hidden, 1x1 pixel iframe, within which it injects code that mimics legitimate Cloudflare assets like "cdn-cgi/challenge-platform/scripts/jsd/main.js" – an API that's a core part of its bot detection and challenge platform It's worth noting that the domain "porsasystem[.]com" has been flagged as part of a traffic distribution system (TDS) called Kongtuke (aka 404 TDS, Chaya_002, LandUpdate808, and TAG-124). According to information shared by an account named "monitorsg" on Mastodon on September 19, 2025, the infection chain starts with users visiting a compromised site, resulting in the execution of "porsasystem[.]com/6m9x.js," which then leads to "porsasystem[.]com/js.php" to eventually take the victims to ClickFix-style pages for malware distribution. The findings illustrate the need for securing WordPress sites and ensuring that plugins, themes, and website software are kept up-to-date, enforcing strong passwords, scanning the sites for anomalies and unexpected administrator accounts created for maintaining persistent access even after the malware is detected and removed. Create ClickFix Pages Using IUAM ClickFix Generator The disclosure comes as Palo Alto Networks Unit 42 detailed a phishing kit named IUAM ClickFix Generator that allows attackers to infect users with malware by leveraging the ClickFix social engineering technique and come up with customizable landing pages by mimicking browser verification challenges often used to block automated traffic. "This tool allows threat actors to create highly customizable phishing pages that mimic the challenge-response behavior of a browser verification page commonly deployed by Content Delivery Networks (CDNs) and cloud security providers to defend against automated threats," security researcher Amer Elsad said. "The spoofed interface is designed to appear legitimate to victims, increasing the effectiveness of the lure." The bespoke phishing pages also come with capabilities to manipulate the clipboard, a crucial step in the ClickFix attack, as well as detect the operating system used in order to tailor the infection sequence and serve compatible malware. In at least two different cases, threat actors have been detected using pages generated using the kit to deploy information stealers such as DeerStealer and Odyssey Stealer, the latter of which is designed to target Apple macOS systems. The emergence of the IUAM ClickFix Generator adds to a prior alert from Microsoft warning of a rise in commercial ClickFix builders on underground forums since late 2024. Another notable example of a phishing kit that has integrated the offering is Impact Solutions. "The kits offer creation of landing pages with a variety of available lures, including Cloudflare," Microsoft noted back in August 2025. "They also offer construction of malicious commands that users will paste into the Windows Run dialog. These kits claim to guarantee antivirus and web protection bypass (some even promise that they can bypass Microsoft Defender SmartScreen), as well as payload persistence." It goes without saying that these tools further lower the barrier to entry for cybercriminals, enabling them to mount sophisticated, multi-platform attacks at scale without much effort or technical expertise. ClickFix Becomes Stealthy via Cache Smuggling The findings also follow the discovery of a new campaign that has innovated on the ClickFix attack formula by employing a sneaky technique referred to as cache smuggling to fly under the radar as opposed to explicitly downloading any malicious files on the target host. "This campaign differs from previous ClickFix variants in that the malicious script does not download any files or communicate with the internet," Expel Principal Threat Researcher Marcus Hutchins said. "This is achieved by using the browser's cache to pre-emptively store arbitrary data onto the user's machine." Expel said it was unable to determine the final payload received as part of the attack. It's also currently not known how users are redirected to the phishing page, and if it involves techniques like malvertising or search engine optimization (SEO) poisoning. In the attack documented by the cybersecurity company, the ClickFix-themed page masquerades as a Fortinet VPN Compliance Checker, using FileFix tactics to deceive users into launching the Windows File Explorer and pasting a malicious command into the address bar to trigger the execution of the payload. The invisible command is designed to run a PowerShell script via conhost.exe. What makes the script stand apart is that it does not download any additional malware or communicate with an attacker-controlled server. Instead, it executes an obfuscated payload that passes off as a JPEG image and is already cached by the browser when the user lands on the phishing page. "The file extracted from the cache is used to set up a scheduled task, which is set to run after each reboot," Hutchins told The Hacker News. "When the task runs, it connects to a command-and-control server waiting for follow-up commands." "Neither the web page nor the PowerShell script explicitly downloads any files," Hutchins explained. "By simply letting the browser cache the fake 'image,' the malware is able to get an entire ZIP file onto the local system without the PowerShell command needing to make any web requests." "The implications of this technique are concerning, as cache smuggling may offer a way to evade protections that would otherwise catch malicious files as they are downloaded and executed. An innocuous-looking 'image/jpeg' file is downloaded, only to have its contents extracted and then executed via a PowerShell command hidden in a ClickFix phishing lure." (The story was updated after publication to include additional insights from Expel.)

In our previous analysis of the malicious RenPy campaigns, we identified a multi-stage loader deployed as part of the infection chain. Further threat hunting has since shown that the same loader, which we track as PavinLoader , is being used across several different campaigns, including ClickFix attacks and fake software downloads.  Despite differences in how these campaigns reach victims, we found several common elements. These include multi-stage infection chains involving heavily obfuscated and trojanized .NET DLLs; abuse of MSBuild, .csproj , and .bat files to execute them; and EtherHiding to retrieve the command-and-control (C2) domain.  What an attack looks like The campaigns don’t all start the same way. A victim might encounter a fake CAPTCHA that tells them to run a command, download what appears to be legitimate software, or install a malicious game. What happens next is much more consistent. PavinLoader uses legitimate Windows tools alongside malicious .NET files to run several stages of malware. It also uses EtherHiding, a technique that uses a blockchain to hide information about its infrastructure, to find the server from which it should retrieve additional malware. In the RenPy campaign we analyzed, that process ultimately led to Amatera Stealer , malware designed to steal information from an infected computer. We also observed PavinLoader infections delivering additional malware. PavinLoader appears across multiple campaigns We have identified PavinLoader in several campaign clusters:  Malicious RenPy campaigns, as analyzed in our earlier blog post Several ClickFix campaigns, including recent activity from the operator(s) covered in our previous analysis Fake software campaigns that used Dropbox to download PavinLoader.  The loader’s use across multiple campaigns raises the possibility that PavinLoader is offered as a Loader-as-a-Service. We also found several artifacts that support this possibility, although they are not enough to confirm it. One specific artifact on VirusTotal is shared by more than 200 files associated with PavinLoader, suggesting it may be a compilation artifact of the build process. We also found a PowerShell script uploaded to VirusTotal containing comments such as EDIT HERE and REPLACE with a real direct link to your .bat . The associated BAT file contains the string Automated builder helper . However, we haven’t found a build panel or sales channels that would confirm PavinLoader is being offered commercially. The PowerShell script . Click to enlarge Part of the BAT file . Click to enlarge   Although PavinLoader has changed over time, the campaigns we analyzed share several characteristics: Inno Setup or MSI installers generated with different builders that run the .bat and/or .csproj files Trojanized .NET DLLs, including DotNetZip, Nancy, Renci.SshNet, and OpenXML. In most of the cases analyzed, the inserted malicious methods follow a TwoWords or TwoWordsNumber naming pattern, such as DefaultEvaluator5 , and FallbackFactory5 A common obfuscation technique used across the .NET DLLs A naming convention based on two random words, such as  GollopDevest , UnbrandRunover , and PavinWide , for DLL names, functions, strings, C2 paths, and other artifacts EtherHiding to obtain the C2 domain, followed by HTTP requests using paths such as assets/{two random words}.json to retrieve subsequent stages. C2 domains commonly use the .lat , .icu , .shop , and .cfd top-level domains MSBuild mechanisms for loading and executing code from DLLs, including property functions such as [System.Reflection.Assembly]::Load(...) and UsingTask Recurring filename patterns such as name_4characters.cmd/bat/msi/exe —for example, prefetch_9a59.cmd , telemetry_55db.cmd , and bootstrap_64be.cmd —or random nine-character names such as aegZpQ4C7.bat . We also observed short names including Small.msi , small.bat , and small.cmd PavinLoader consists of several .NET DLLs, and in the cases analyzed we identified the following stages:  Loader DLL : A trojanized DLL—such as the Nancy one analyzed in our previous RenPy article—or a custom DLL. It performs anti-forensics and anti-analysis operations, changes network settings needed for the next operations, and loads the EtherHiding Loader EtherHiding Loader DLL : Obtains the C2 through EtherHiding and downloads the next stages from it  Anti-Analysis DLL : Performs extensive anti-analysis checks to detect virtualized environments.  PE Loader DLL : Loads the final PE payload. Intermediate payloads can vary depending on the campaign configuration. First, we’ll look at some of the methods used to distribute the initial PavinLoader stages. We’ll then return to the RenPy loader campaign we analyzed in our previous article to examine the loader’s later stages.  Technical analysis The rest of this article takes a closer look at how PavinLoader is distributed and how each stage of the loader works. How PavinLoader is delivered We have observed PavinLoader being delivered through several ClickFix campaigns. In particular, we detected that the ClickFix cluster analyzed in a previous article has recently started using PavinLoader. Abuse of MSBuild and the use of .csproj and .bat files remain common across the infection chains we observed. We covered one example in our previous RenPy analysis. Here, we’ll look at several other distribution methods.  The ClickFix Cloudflare page associated with this campaign . Click to enlarge   As we saw in our previous analysis of these ClickFix campaigns, the associated PowerShell scripts change frequently. We found several versions in this activity, including both obfuscated and unobfuscated scripts. The PowerShell script associated with the ClickFix campaign. Click to enlarge In this example, the downloaded MSI from the Cloudflare bucket is called Installer_57be78.msi.  MSI content . Click to enlarge The package contains: prefetch_2f76.exe : The legitimate MSBuild executable prefetch_2f76.csproj : Used to execute the Loader DLL through UsingTask DotNetZip.dll : The Loader DLL The .csproj file is executed with: "C:\Users\{USER}\AppData\Local\Logitech\Device Configuration Helper\prefetch_2f76.exe" /nologo "C:\Users\{USER}\AppData\Local\Logitech\Device Configuration Helper\prefetch_2f76.csproj" /nr:false The Loader DLL is a trojanized version of DotNetZip and is executed using the UsingTask element. “UsingTask” used to execute the DLL . Click to enlarge The malicious method inserted in the trojanized DLL. Click to enlarge.  Unlike the RenPy example discussed in our previous article, the EtherHiding Loader is extracted from the DLL itself. An embedded resource is used as an index to extract bytes directly from the DLL, rather than obtaining those indexes from the .csproj file. We detected another campaign that uses BAT files containing fake BUILD VERIFICATION REPORT comments, apparently intended to make analysis and detection more difficult. In this case, the MSI CustomAction executes the BAT script with: cmd.exe /c C:\Users\{USER}\AppData\Local\Conexant\lite_bootstrap_2.1.7\updater_8219.cmd /launched Fake comments inserted in the updater_8219.cmd . Click to enlarge The obfuscated code appears below the fake comments. It concatenates multiple strings and uses indices generated through simple mathematical operations to reconstruct them. We found this type of obfuscation in most of the BAT files we analyzed. The obfuscated part of the .cmd file . Click to enlarge The BAT file locates conhost.exe and relaunches itself with: "C:\WINDOWS\System32\conhost.exe" --headless cmd.exe /c "C:\Users\{USER}\AppData\Local\Conexant\lite_bootstrap_2.1.7\updater_8219.cmd" /launched It then sets the MSBUILDENABLEALLPROPERTYFUNCTIONS=1 environment variable, locates MSBuild.exe , and executes it using the same file as input: "C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe" "C:\Users\{USER}\AppData\Local\Conexant\lite_bootstrap_2.1.7\updater_8219.cmd" In this case, the Loader DLL is reconstructed by concatenating and decoding four Base64-encoded variables. Part of the CMD file showing the loading process. Click to enlarge The Loader DLL has a random name and appears to be an older version because it does not contain the custom bytecode and encrypted strings in its resources. As in the RenPy campaign analyzed previously, this stage retrieves the EtherHiding Loader stored between a Build-... marker in the CMD file through the _vezr environment variable, then decodes it using XOR with a 32-byte key. The extracted Loader DLL. Click to enlarge Having looked at several methods used to distribute PavinLoader’s first two stages, we will now return to the RenPy infection chain from our previous analysis and examine the loader itself in more detail. Analyzing PavinLoader The .NET DLLs associated with PavinLoader are heavily obfuscated using control-flow flattening, custom bytecode, indirect calls through calli / ldftn , string encryption with different algorithms, API hashing and delegates, redundant methods, and junk code and strings. We did not identify a known obfuscator associated with the samples, so to the best of our knowledge, PavinLoader uses a custom obfuscator. Because fully deobfuscating the samples would be complex, we used a hybrid approach combining dynamic analysis with method invocation through reflection. We identified important methods based on their imports and parameters, invoked them, and analyzed the resulting output. This approach does not provide complete coverage of the execution flow, but it allowed us to identify the loader’s core functionality and extract its intermediate stages. Because different functions frequently share the same names, we use metadata tokens to identify methods throughout the analysis. Nancy trojanized DLL: Loader DLL  We covered this stage in detail in our previous blog post, so we’ll provide only an overview here. In most of the cases analyzed, the Loader DLL is a trojanized legitimate DLL. The malicious method typically uses a {RandomWord} or {RandomWord_Number} naming convention. The DLL contains a resource associated with the custom bytecode interpreted by the main method, two resources containing encrypted strings, and, in some cases, additional resources used as an index for extracting the next stage. Other resources appear to be decoys designed to slow analysis. In the samples we analyzed, this DLL typically: Decrypts strings from resources using multi-key XOR Resolves APIs using API hashing and GetDelegateForFunctionPointer() Changes network settings, including disabling TLS certificate validation and setting the default system proxy Performs an anti-analysis timing check using CreateEventW() , GetTickCount() , and WaitForSingleObject() Performs anti-forensics operations Loads the EtherHiding Loader either by extracting it from a marker inside .csproj or BAT files, or by using a resource as an index to retrieve bytes directly from the DLL GollopDevest: EtherHiding Loader  The EtherHiding Loader has two main functions: obtaining the C2 domain through EtherHiding, and downloading and loading subsequent stages from that C2. Class 0x02000762 is responsible for decrypting strings associated with blockchain and network communication. The strings are decrypted by 0x060027BD as follows:  Function 0x060027BB initializes the S-box using the XOR of the master key activeValues and the Base64-decoded optionsCollection string Function 0x060027BE takes childSyncObject as input and returns index bytes using XOR and permutations based on header values encoded in the first two characters of the string Function 0x060027B9 returns the decrypted string using the indexes and the previously generated S-box This was the only class we found with encryption parameters encoded in this format. For the remaining strings, we identified functions that returned decrypted data based on their parameter signatures—for example, methods returning strings or bytes—and invoked them through reflection. This allowed us to recover more than 1,300 strings. Part of the decrypted strings . Click to enlarge   Among them were strings associated with AMSI and ETW patching: AmsiScanString System.Management.Automation.AmsiUtils System.Management.Automation.AmsiUtils+AmsiNativeMethods ntdll EtwEventWrite NtQueryInformationProcess NtSetInformationThread VirtualProtect More than 100 URLs belonging to legitimate services are also decrypted and used to generate HTTP requests and network noise. We did not observe this behavior in every sample, suggesting it may be build-specific. The Server class ( 0x02000052 ) generates the X-Timestamp , X-Nonce , and X-Signature HTTP headers and makes requests used to retrieve subsequent stages. Two HTTP requests are made to synchronize parameters and obtain the payload, with HMAC used to validate the requests. Using reflection, we executed method 0x06000A77 to obtain the header values needed to retrieve the subsequent stages. The C2 domain is obtained by making an ETH RPC (Remote Procedure Call) to bsc-dataseed.binance.org with the following JSON-RPC body: {"jsonrpc":"2.0","method":"eth_call","params":[{"to":" 0x328a1fadff154290f0ce1389a4e633698cdfdaa7 ","data":"0x06fdde03"},"latest"],"id":1783436775}  The next stages are downloaded from the resulting C2 domain. The XOR-encoded payload is stored in the JSON response under cache.content : {"type":"cache-binary","meta":{"version":"2.3.1","timestamp":"…","platform":"win32-x64"},"cache":{"id":"e2b69…"," content ":" 1c.. "}}  In this case, the C2 paths and XOR keys decrypted from this stage and the anti-analysis DLL are: Path   XOR key   Type/Function   /assets/ExponeAboard.json  QBBBfWow4lb  PavinWride .NET DLL, Anti-analysis   /assets/MailersKogasin.json  WjcsVTKmuoBRqe  GollopDevest .NET DLL, PE Loader  /assets/LanoseThrip.json  WwUX66Br  WPA.exe PE executable, Amatera Stealer  The next stage executed is the anti-analysis DLL.  PavinWride: Anti-analysis DLL  This DLL is responsible for performing several anti-analysis checks.  The anti-analysis DLL executes system calls in different ways:  Standard .NET Base Class Library (BCL) calls, including for registry and network operations Win32 P/Invoke calls, including GetCurrentThread , NtQueryInformationThread , NtQueryInformationProcess , and NtCurrentTeb Win32 APIs resolved through API hashing and a Process Environment Block (PEB) export table walk The function MenuItemService . ProcessDirectory ( 0x06000151 ) is the main method responsible for delegate caching and Win32 API resolution:   It checks if the delegate is already resolved using managerMap.TryGetValue()  If not, it calls ProcessDirectory (0x06000150) to obtain the HMODULE handle It calls ProcessDirectory (0x0600003A) that performs the PE export table walk and matches the hash. We detected that the same hashing output is obtained in several other methods (e.g., 0x06000039 , 0x0600003B , 0x0600004E ) It obtains the delegate with GetDelegateForFunctionPointer() and saves it in the dictionary Results of the API hashing script . Click to enlarge   We used the same reflection approach to get the strings.  Many strings are encrypted with the XOR key 4B729A1F5CE387D6 .  Part of decrypted strings. Click to enlarge   The loader obtains the system’s LCID using GetKeyboardLayoutList() and compares it against more than 17 languages, including Russian, Ukrainian, Belarusian, and Armenian. It also performs extensive system reconnaissance, including enumerating registry keys and calling Win32 APIs such as GetSystemFirmwareTable() and EnumSystemFirmwareTables() to identify virtualized environments. Category   Value   PCI vendor / device IDs   VEN_80EE , VEN_15AD , VEN_1AB8 , VEN_5853 , VEN_1AF4 , VEN_1234&DEV_111 , … SMBIOS/ACPI OEM IDs   VMWARE , VBOX , BOCHS , VRTUAL , MSFTVM , MSHYPR , Xen , Parall , BHYVE , AMAZON , Google ACPI table signatures   VBOX , BXPC , VMW , Xen , PRLS , AMZN , MICR BIOS/manufacturer/product strings   vmware , vmw , innotek , virtualbox , vbox , qemu , seabios , bochs , standard pc , kvm virtual machine , xen , hvm domu , parallels Strings associated with anti-analysis checks Part of the registry key enumeration . Click to enlarge We also observed decrypted references to APIs including GetCurrentProcess() , CreateToolhelp32Snapshot() , Process32First() , Process32Next() , and OpenMutex() , although we did not observe these functions being called during our execution flow. An HTTP request is also made to one of these services:  https://ipv4[.]ipleak[.]net/json/ https://get[.]geojs[.]io/v1/ip/geo[.]json https://ipapi[.]co/json/ https://api[.]ipapi[.]is/ https://ipinfo[.]io/json It also checks the returned data against 96 hosting or infrastructure providers and tests whether the region code is one of: RU , UA , BY , AM , KZ , KG , TJ , UZ , GE , AZ , or MD . Decrypted strings associated with providers . Click to enlarge If the anti-analysis checks pass, the next two stages are downloaded and decrypted using XOR keys. We patched SelectionScope.ProcessDirectory ( 0x06000014 ) to recover the C2 paths and XOR keys for those stages: /assets/MailersKogasin.json|WjcsVTKmuoBRqe|/assets/LanoseThrip.json|WwUX66Br GollopDevest: PE Loader DLL and Amatera Stealer The third DLL has the same name as the second, GollopDevest , but performs PE loading. Among its decrypted strings are: 'GollopMailers LDR DllBase VeneryCondole EdiyaFoully=0x{0:X} EdiyaStelae=0x{1:X}' 'GollopMailers LDR Flags missing IMAGE_DLL 0x{0:X8}' 'GollopMailers LDR SaranPisco invalid 0x{0:X}' 'GollopMailers LDR TlsIndex invalid {0}' 'GollopMailers LDR sanity exception: ' 'HIGHLOW relocation' 'Import DLL name' 'Import FunctusAurata' 'Import INT' 'Import descriptor' 'Import hint/name' 'Import thunk' 'LdrpHandleTlsData outside ntdll .text' 'LdrpReleaseTlsEntry outside ntdll .text' 'LoadConfig32' 'OK' 'PE headers' 'Required API resolve failed: type={0}, FreshBubals={1}, module=0x{2:X}' 'TLS32' 'TLS64' 'x86 disabled until ABI proof' ntdll.dll kernel32.dll LdrpInitializeTls "STATUS_SUCCESS" UNKNOWN(0x00000001) UNKNOWN(0x00000002) UNKNOWN(0x00000003) The ServerEditor.SortMemory method ( 0x06000014 ) checks the PE structure and flags before loading the payload. To confirm this behavior, we invoked the method through reflection using the downloaded WPA.exe file as input. The PE loaded successfully. The C++-compiled PE disguises itself as WPA.exe (Windows Performance Analyzer). We identified the payload as an obfuscated version of Amatera Stealer 4.2.3-alpha1 . It uses control-flow flattening, API hashing, anti-debugging checks, and opaque predicates to complicate analysis. We also detected use of the Heaven’s Gate technique, DNS-over-HTTPS (DoH) resolution through Google DNS, and raw sockets using \Device\Afd\Endpoint for network communication.  Part of the decrypted strings associated with Amatera . Click to enlarge After this stage executes, we also observed additional payloads being downloaded and run from C2 IP addresses. In some cases, WiX Burn bundles downloaded another payload associated with PavinLoader. In others, we detected HijackLoader. This gives the campaign operators the ability to deploy multiple payloads on a compromised machine. IOCs  SHA-256 hashes bdf313a019e025ebf58ccef4619444ee70e661bd444e0644ebeabd8f5caad14c  e3830f5747e3f46537d217124d80c9f3bb4d89f8d4f5138dce69ee54ea4fb6b9  a4f03272cf96732dc9f58bb466d16f358e7f50d46dba30526a9fbebfec11717b  bf04160dd1ce3571e0eb6d6dda1713c788797b5599399d4a93665a757eec376e  54fa8083c05334aa360256fbbb0ca901ce7e244a0359dd664cae78977371ec91  c1ea6d169565c70ac5d812e73483814929e9b3548ead6633595937e71a334adb  001337488c32d8610c2aef6f9330acca825f0afacd071bf6ebfc06b5a1a69f09  2837099af431e9afee76ce5e6ab5cb86bedce06e31c22be46250cb453cfdb978  252c5a3d150275013f52b4820097d7163ced4aa2f1be0fca032f8a5017673816  0c9c64b7383ec249bcf6271a4b73206d94de130ca401d16ab77fe01e5193a312  6700f62e1a3b33340cd678c388ecc8bac2e5943c0627df5d1b99b879c3ca42c9  IP addresses   93.152.224[.]75 : downloads PavinLoader  65.21.80[.]170 : downloads PavinLoader  195.63.142[.]49 : downloads PavinLoader  Domains   perfectverified[.]com : ClickFix  PavinLoader C2   catalyst-pro[.]lat  twigoamwu[.]cfd  trusaifi[.]cfd  stellar-minds[.]cfd  pinnacle-labs[.]lat  nexahub[.]lat  fimwoglea[.]shop  velodium[.]lat  rpcsecnoweb[.]pro  more-arpc[.]icu  echo-systems[.]cfd  kelemet[.]shop  zarwieciv[.]cfd  URLs   telegra[.]ph/Project-PySynth-06-28 : Amatera dead drop  Acknowledgements   Previous analysis of the loader: https://www.derp.ca/research/hellsuchecker-clickfix-etherhiding/#26-anti-sandbox-checks-and-a-nintendo-bypass (possible AI-generated content)  Possible related activity: https://cyberowi.pl/lumma-stealer-renpy-fitgirl-osmiowarstwowy-loader/   Possible related activity: https://medium.com/@djordje.brankovic/from-fake-captcha-to-in-memory-execution-unraveling-a-multi-stage-malware-chain-part-1-496c603f3641   Analysis of a forum user: https://forums.malwarebytes.com/topic/338102-solution-of-gollopdevestdll-renpy-loader-malware-from-malwarebytes-blog/   From reporting threats to removing them. Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by  downloading Malwarebytes today .

Check Point Research (CPR) conducted a focused analysis of Storm-2603, a threat actor associated with recent ToolShell exploitations, together with other Chinese APT groups. Storm-2603 utilizes a custom malware Command and Control (C2) framework dubbed internally by the attacker as “ak47c2”. This framework includes at least two different types of clients: HTTP-based (dubbed by us “ak47http”) and DNS-based (dubbed by us “ak47dns”). Based on VirusTotal data, Storm-2603 likely targeted some organizations in Latin America throughout the first half of 2025, in parallel to attacking organizations in APAC. Some of the actor’s TTPs align with many other ransomware groups, and involve open-source tools such as PsExec and masscan. In addition, the threat actors use a custom tool that leverages the BYOVD (Bring Your Own Vulnerable Driver) technique to tamper with endpoint protections. Storm-2603 attacks involved multiple ransomware families, sometimes bundled together. Those are commonly deployed by abusing DLL hijacking. Check Point Research (CPR) has been closely monitoring the ongoing exploitation of a group of Microsoft SharePoint Server vulnerabilities collectively referred to as “ToolShell.” These active attacks leverage four vulnerabilities—CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771—and are attributed to multiple China affiliated threat actors. Among the threat groups identified by Microsoft, two are known APTs: Linen Typhoon (aka APT27) and Violet Typhoon (aka APT31). Another group is a newly observed, previously undocumented cluster called Storm-2603. While Microsoft linked this cluster’s activity to potential ransomware deployment, it was unable to assess the group’s objectives. As part of our ongoing investigation into ToolShell and its associated risks, we launched a targeted effort to better understand and characterize the threat posed by Storm-2603. Throughout our analysis, we uncovered several files likely tied to Storm-2603 intrusions, offering new insights that correspond to Microsoft’s description of the group. In this publication, we provide an in-depth examination of Storm-2603’s tactics, techniques, and procedures (TTPs), along with a technical breakdown of the ak47c2, a custom malware framework used in their attacks and their different ransomware payloads. Storm-2603 was first mentioned by Microsoft during investigations into a set of attacks on Microsoft SharePoint servers, known as the “ToolShell” campaign. While some activity was tied to known Chinese affiliated groups like Linen Typhoon (APT27) and Violet Typhoon (APT31), Storm-2603 appeared as a new, previously unreported actor. Microsoft linked the group to Lockbit and Warlock ransomware use. Figure 1 – Events associated with Storm-2603. Microsoft’s report provided only limited information about Storm-2603, including some of the TTPs associated with it, most of them quite generic. In addition, some of the reported indicators of compromise (IOCs) helped us uncover additional artifacts associated with previous Storm-2603 intrusions. One domain in particular, update.updatemicfosoft[.]com, linked to Storm-2603’s SharePoint exploitation, turned out to have been used in earlier campaigns dating back to March 2025. In those operations, it served as a C2 server for both DNS tunneling malware and an HTTP backdoor and was part of infrastructure used to deliver LockBit Black and Warlock/x2anylock ransomware. Our search for cases where the IOCs reported by Microsoft, revealed two incidents in which LockBit Black and WarLock ransomware variants were deployed together, in addition to multiple other tools, mostly open-source. In April 2025, a RAR archive named Evidencia.rar was uploaded to VirusTotal. The archive contains several artifacts likely extracted from compromised machines in a Storm-2603 case in a LATAM country. The artifacts in the archive provide a look at some of the open-source tools used by the actors in the intrusions which correlates with previous knowledge of the group: WinPcap – Captures and filters network traffic on Windows. PsExec – Executes commands on remote Windows systems. SharpHostInfo – Collects host and domain info on Windows environments. nxc – Exploits common vulnerabilities in network services. In addition to the open-source tools, the archive also contains the custom backdoor used by the group, as well as its unique ransomware payloads. dnsclient.exe – A custom backdoor utilized by Storm-2603 that communicates over DNS tunneling with update.updatemicfosoft[.]com, a domain associated with the group. See the next section for our analysis of the backdoor. 7z.exe & 7z.dll – Legitimate 7z executable side-loading malicious 7z.dll delivering X2anylock (aka Warlock), a ransomware used by Storm-2603. bbb.msi – An installer which uses clink_x86.exe to side-load clink_dll_x86.dll, leading to the execution of LockBit Black ransomware. Another MSI file uploaded to VirusTotal in April used a similar deployment method, starting with the MSI installer to launch multiple ransomware strains simultaneously: Figure 2 – MSI Multi-Ransomware Deployment. The MSI relies on the following files: MpCmdRun.exe & Mpclient.dll – Warlock Ransomware, deployed via DLL-hijacking. clink_x86.exe & clink_dll_x86.dll – LockBit Black ransomware, deployed via DLL-hijacking. z.exe & z.dll – x2anylock ransomware, deployed via DLL-hijacking. VMToolsEng.exe – Custom Antivirus Terminator. ServiceMouse.sys – Vulnerable driver used by VMToolsEng.exe for killing Antivirus processes. log.exe – A list of Antivirus processes to kill. msi.bat – Executes VMToolsEng.exe. 1.bat – Executes all the needed executables and the MSI. We attributed two custom backdoors to Storm-2306, both of which appear to be part of the framework named AK47 C2 based on the shared PDB path: C:\Users\Administrator\Desktop\work\tools\ak47c2\. When executed, the program immediately hides its console window, determines the host computer name (defaulting to unknown.local if that fails), and builds a DNS‑based command‑and‑control payload. It chooses a random five-character session ID, such as H4T14, and prefixes it with 1 for task requests or 2 for result uploads (e.g., 1H4T14 or 2H4T14). Each element, such as the task/result tag, a size flag (a for “all” when the entire message fits into one request), and the computer name, is XOR‑encoded with the ASCII key “VHBD@H”, converted to hexadecimal, and concatenated with dots before being prepended to the C2 domain update.micfosoft[.]com. This what the overall query looks like: DNS TXT and MG (a mail group member record type) record lookups (DnsQuery_A) are used to transmit and retrieve data. If the C2 server is unreachable, the client simply receives error 9003 (DNS_ERROR_RCODE_NAME_ERROR). Otherwise, the response text is decoded from hex, XOR‑decrypted, and parsed for the delimiter “:::”, which separates metadata from the actual command string. Commands run under cmd.exe /c 2>&1; a built‑in directive sleep n pauses execution for n seconds. For outputs larger than 0xFF bytes, the backdoor fragments data into 63‑byte sub‑segments. Each DNS query then follows: HttpClient backdoor has the pdb path C:\Users\Administrator\Desktop\work\tools\ak47c2\httpclient-cpp\x64\Release\httpclient-cpp.pdb and uses plain HTTP instead of DNS for the C2. It is built as a 64‑bit console program that also immediately hides its window on launch. On start‑up, the malware gathers the host computer name (similar to the DNS version, it defaults to unknown.local), then builds a JSON object with the fields cmd, cmd_id, fqdn, result, and type. For a task request, the object looks like this: {"cmd":"","cmd_id":"","fqdn":" ","result":"","type":"task"} After the host executes a command, the result is sent back with type:”result”. Before transmission, the entire JSON blob is XOR‑encrypted with the ASCII key “VHBD@H”, converted to hexadecimal, and placed in the body of an HTTP POST to “/” with generic headers (Content‑Type: text/plain, Accept: */*). The C2 replies with a similarly encoded JSON where the cmd field contains the next command. The implant executes it via cmd.exe /c 2>&1 and returns the output. We identified that during these attacks, several types of ransomware were deployed simultaneously. One is regular LockBit Black, and the second uses the.x2anylock extension. This extension was later used by the Warlock ransomware operator, mentioned in Microsoft’s report on the SharePoint exploitation. The Warlock ransom note is usually saved as How to decrypt my data.txt and looks like this: Figure 3 – Warlock Group ransom note. The ransom notes for all ransomware strains deployed by Storm-2603 are named How to decrypt my data.log (x2anylock) or .README.txt (LockBit Black) and have the same short content: Your decrypt ID: [redacted] Tox ID Support: 3DCE[redacted] Email Support: [redacted]@proton.me,[redacted]@proton.me,[redacted]@proton.me You can contact us in email or qtox. This ransom note’s name How to decrypt my data.log appeared in a recent LinkedIn post by Huntress, describing the case where multiple ransomware families were deployed together against the same target. While not a new tactic, this approach is rarely observed among established ransomware groups. An important part of the infection package described earlier is called Antivirus Terminator. It is a custom command line tool abusing a third-party signed legitimate driver to kill processes. From what we can see, it’s been in the wild since at least late 2024. The tool requires administrative privileges on the infected machine. The screenshot below shows how the listing is displayed in the console when the tool is run without parameters: Figure 4 – Antivirus Terminator supported arguments when run without parameters. The tool first creates a service called ServiceMouse, where the path to the service binary file is ServiceMouse.sys from the package. Next, the tool communicates with the installed service via IO control code 0x99000050, which is responsible for killing processes. The tool also has more capabilities, like deleting files and uninstalling drivers, and these use different IO control codes (0x990000D0 and 0x990001D0). Figure 6 – Antivirus Terminator kills process using third-party driver. The supplied third-party driver is a legitimate and signed component of Antiy System In-Depth Analysis Toolkit, originally named AToolsKrnl64.sys. The toolkit was developed by Antiy Labs, a Chinese security vendor, and features a graphical user interface that allows users, among others, to interact with and manipulate processes. The ability to kill processes is the most important feature which is abused by threat actors in this particular case. Figure 7 – Antiy System In-Depth Analysis Tookit GUI. The following piece of code in the driver handles the IO control code 0x99000050 mentioned above: Figure 8 – IO control code processing in the Antiy driver. The second function is the piece of code responsible for killing a process with a given PID. In this report we analyze Storm-2603, a relatively new threat actor first mentioned by Microsoft during investigations into the “ToolShell” campaign targeting SharePoint servers. While some of the exploitation activity was tied to known Chinese APT groups, Storm-2603 stood out as a previously undocumented group linked to ransomware deployment. By examining infrastructure indicators shared in public reporting, we were able to connect this actor to earlier campaigns involving LockBit Black and Warlock/X2anylock ransomware, dating back to at least March 2025. These earlier attacks used similar infrastructure and tools, including DNS tunneling and HTTP-based backdoors. Interestingly, multiple ransomware variants were deployed in the same attack. This behavior, along with the overlap in techniques, helps us better understand how Storm-2603 operates “The Turkish Rat” Evolved Adwind in a Massive Ongoing Phishing Campaign Check Point Research Publications August 11, 2017 “The Next WannaCry” Vulnerability is Here Check Point Research Publications March 12, 2026 “Handala Hack” – Unveiling Group’s Modus Operandi SUBSCRIBE TO CYBER INTELLIGENCE REPORTS We value your privacy! BFSI uses cookies on this site. We use cookies to enable faster and easier experience for you. By continuing to visit this website you agree to our use of cookies.

On July 19–20, 2025, various security companies and national CERTs published alerts about active exploitation of on-premise SharePoint servers. According to the reports, observed attacks did not require authentication, allowed attackers to gain full control over the infected servers, and were performed using an exploit chain of two vulnerabilities: CVE-2025-49704 and CVE-2025-49706, publicly named “ToolShell”. Additionally, on the same dates, Microsoft released out-of-band security patches for the vulnerabilities CVE-2025-53770 and CVE-2025-53771, aimed at addressing the security bypasses of previously issued fixes for CVE-2025-49704 and CVE-2025-49706. The release of the new, “proper” updates has caused confusion about exactly which vulnerabilities attackers are exploiting and whether they are using zero-day exploits. Kaspersky products proactively detected and blocked malicious activity linked to these attacks, which allowed us to gather statistics about the timeframe and spread of this campaign. Our statistics show that widespread exploitation started on July 18, 2025, and attackers targeted servers across the world in Egypt, Jordan, Russia, Vietnam, and Zambia. Entities across multiple sectors were affected: government, finance, manufacturing, forestry, and agriculture. While analyzing all artifacts related to these attacks, which were detected by our products and public information provided by external researchers, we found a dump of a POST request that was claimed to contain the malicious payload used in these attacks. After performing our own analysis, we were able to confirm that this dump indeed contained the malicious payload detected by our technologies, and that sending this single request to an affected SharePoint installation was enough to execute the malicious payload there. Our analysis of the exploit showed that it did rely on vulnerabilities fixed under CVE-2025-49704 and CVE-2025-49706, but by changing just one byte in the request, we were able to bypass those fixes. In this post, we provide detailed information about CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771, and one related vulnerability. Since the exploit code is already published online, is very easy to use, and poses a significant risk, we encourage all organizations to install the necessary updates. The exploit Our research started with an analysis of a POST request dump associated with this wave of attacks on SharePoint servers. We can see that this POST request targets the “/_layouts/15/ToolPane.aspx” endpoint and embeds two parameters: “MSOtlPn_Uri” and “MSOtlPn_DWP”. Looking at the code of ToolPane.aspx, we can see that this file itself does not contain much functionality and most of its code is located in the ToolPane class of the Microsoft.SharePoint.WebPartPages namespace in Microsoft.SharePoint.dll. Looking at this class reveals the code that works with the two parameters present in the exploit. However, accessing this endpoint under normal conditions is not possible without bypassing authentication on the attacked SharePoint server. This is where the first Microsoft SharePoint Server Spoofing Vulnerability CVE-2025-49706 comes into play. CVE-2025-49706 This vulnerability is present in the method PostAuthenticateRequestHandler, in Microsoft.SharePoint.dll. SharePoint requires Internet Information Services (IIS) to be configured in integrated mode. In this mode, the IIS and ASP.NET authentication stages are unified. As a result, the outcome of IIS authentication is not determined until the PostAuthenticateRequest stage, at which point both the ASP.NET and IIS authentication methods have been completed. Therefore, the PostAuthenticateRequestHandler method utilizes a series of flags to track potential authentication violations. A logic bug in this method enables an authentication bypass if the “Referrer” header of the HTTP request is equal to “/_layouts/SignOut.aspx”, “/_layouts/14/SignOut.aspx”, or “/_layouts/15/SignOut.aspx” using case insensitive comparison. The code displayed in the image above handles the sign-out request and is also triggered when the sign-out page is specified as the referrer. When flag6 is set to false and flag7 is set to true, both conditional branches that could potentially throw an “Unauthorized Access” exception are bypassed. On July 8, 2025, Microsoft released an update that addressed this vulnerability by introducing additional checks to detect the usage of the “ToolPane.aspx” endpoint with the sign-out page specified as the referrer. The added check uses case insensitive comparison to verify if the requested path ends with “ToolPane.aspx”. Is it possible to bypass this check, say, by using a different endpoint? Our testing has shown that this check can be easily bypassed. CVE-2025-53771 We were able to successfully bypass the patch for vulnerability CVE-2025-49706 by adding just one byte to the exploit POST request. All that was required to bypass this patch was to add a “/” (slash) to the end of the requested “ToolPane.aspx” path. On July 20, 2025, Microsoft released an update that fixed this bypass as CVE-2025-53771. This fix replaces the “ToolPane.aspx” check to instead check whether the requested path is in the list of paths allowed for use with the sign-out page specified as the referrer. This allowlist includes the following paths: “/_layouts/15/SignOut.aspx”, “/_layouts/15/1033/initstrings.js”, “/_layouts/15/init.js”, “/_layouts/15/theming.js”, “/ScriptResource.axd”, “/_layouts/15/blank.js”, “/ScriptResource.axd”, “/WebResource.axd”, “/_layouts/15/1033/styles/corev15.css”, “/_layouts/15/1033/styles/error.css”, “/_layouts/15/images/favicon.ico”, “/_layouts/15/1033/strings.js”, “/_layouts/15/core.js”, and it can contain additional paths added by the administrator. While testing the CVE-2025-49706 bypass with the July 8, 2025 updates installed on our SharePoint debugging stand, we noticed some strange behavior. Not only did the bypass of CVE-2025-49706 work, but the entire exploit chain did! But wait! Didn’t the attackers use an additional Microsoft SharePoint Remote Code Execution Vulnerability CVE-2025-49704, which was supposed to be fixed in the same update? To understand why the entire exploit chain worked in our case, let’s take a look at the vulnerability CVE-2025-49704 and how it was fixed. CVE-2025-49704 CVE-2025-49704 is an untrusted data deserialization vulnerability that exists due to improper validation of XML content. Looking at the exploit POST request, we can see that it contains two URL encoded parameters: “MSOtlPn_Uri” and “MSOtlPn_DWP”. We can see how they are handled by examining the code of the method GetPartPreviewAndPropertiesFromMarkup in Microsoft.SharePoint.dll. A quick analysis reveals that “MSOtlPn_Uri” is a page URL that might be pointing to an any file in the CONTROLTEMPLATES folder and the parameter “MSOtlPn_DWP” contains something known as WebPart markup. This markup contains special directives that can be used to execute safe controls on a server and has a format very similar to XML. While this “XML” included in the “MSOtlPn_DWP” parameter does not itself contain a vulnerability, it allows attackers to instantiate the ExcelDataSet control from Microsoft.PerformancePoint.Scorecards.Client.dll with CompressedDataTable property set to malicious payload and trigger its processing using DataTable property getter. Looking at the code of the ExcelDataSet’s DataTable property getter in Microsoft.PerformancePoint.Scorecards.Client.dll, we find the method GetObjectFromCompressedBase64String, responsible for deserialization of CompressedDataTable property contents. The data provided as Base64 string is decoded, unzipped, and passed to the BinarySerialization.Deserialize method from Microsoft.SharePoint.dll. Attackers use this method to provide a malicious DataSet whose deserialized content is shown in the image above. It contains an XML with an element of dangerous type "System.Collections.Generic.List1[[System.Data.Services.Internal.ExpandedWrapper2[...], System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]", which allows attackers to execute arbitrary methods with the help of the well-known ExpandedWrapper technique aimed at exploitation of unsafe XML deserialization in applications based on the .NET framework. In fact, this shouldn’t be possible, since BinarySerialization.Deserialize in Microsoft.SharePoint.dll uses a special XmlValidator designed to protect against this technique by checking the types of all elements present in the provided XML and ensuring that they are on the list of allowed types. However, the exploit bypasses this check by placing the ExpandedWrapper object into the list. Now, to find out why the exploit worked on our SharePoint debugging stand with the July 8, 2025 updates installed, let’s take a look at how this vulnerability was fixed. In this patch, Microsoft did not really fix the vulnerability but only mitigated it by adding the new AddExcelDataSetToSafeControls class to the Microsoft.SharePoint.Upgrade namespace. This class contains new code that modifies the web.config file and marks the Microsoft.PerformancePoint.Scorecards.ExcelDataSet control as unsafe. Because SharePoint does not execute this code on its own after installing updates, the only way to achieve the security effect was to manually run a configuration upgrade using the SharePoint Products Configuration Wizard tool. Notably, the security guidance for CVE-2025-49704 does not mention the need for this step, which means at least some SharePoint administrators may skip it. Meanwhile, anyone who installed this update but did not manually perform a configuration upgrade remained vulnerable. CVE-2025-53770 On July 20, 2025, Microsoft released an update with a proper fix for the CVE-2025-49704 vulnerability. This patch introduces an updated XmlValidator that now properly validates element types in XML, preventing exploitation of this vulnerability without requiring a configuration upgrade and, more importantly, addressing the root cause and preventing exploitation of the same vulnerability through controls other than Microsoft.PerformancePoint.Scorecards.ExcelDataSet. CVE-2020-1147 Readers familiar with previous SharePoint exploits might feel that the vulnerability CVE-2025-49704/CVE-2025-53770 and the exploit used by the attackers looks very familiar and very similar to the older .NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability CVE-2020-1147. In fact, if we compare the exploit for CVE-2020-1147 and an exploit for CVE-2025-49704/CVE-2025-53770, we can see that they are almost identical. The only difference is that in the exploit for CVE-2025-49704/CVE-2025-53770, the dangerous ExpandedWrapper object is placed in the list. This makes CVE-2025-53770 an updated fix for CVE-2020-1147. Conclusions Despite the fact that patches for the ToolShell vulnerabilities are now available for deployment, we assess that this chain of exploits will continue being used by attackers for a long time. We have been observing the same situation with other notorious vulnerabilities, such as ProxyLogon, PrintNightmare, or EternalBlue. While they have been known for years, many threat actors still continue leveraging them in their attacks to compromise unpatched systems. We expect the ToolShell vulnerabilities to follow the same fate, as they can be exploited with extremely low effort and allow full control over the vulnerable server. To stay better protected against threats like ToolShell, we as a community should learn lessons from previous events in the industry related to critical vulnerabilities. Specifically, the speed of applying security patches nowadays is the most important factor when it comes to fighting such vulnerabilities. Since public exploits for these dangerous vulnerabilities appear very soon after vulnerability announcements, it is paramount to install patches as soon as possible, as a gap of even a few hours can make a critical difference. At the same time, it is important to protect enterprise networks against zero-day exploits, which can be leveraged when there is no available public patch for vulnerabilities. In this regard, it is critical to equip machines with reliable cybersecurity solutions that have proven effective in combatting ToolShell attacks before they were publicly disclosed. Kaspersky Next with its Behaviour detection component proactively protects against exploitation of these vulnerabilities. Additionally, it is able to detect exploitation and the subsequent malicious activity. Kaspersky products detect the exploits and malware used in these attacks with the following verdicts: UDS:DangerousObject.Multi.Generic PDM:Exploit.Win32.Generic PDM:Trojan.Win32.Generic HEUR:Trojan.MSIL.Agent.gen ASP.Agent.* PowerShell.Agent.*

August 2025 Patch Tuesday forecast: Try, try again July turned into a surprisingly busy month. It started slowly with a fairly ‘calm’ Patch Tuesday as I forecasted in my last blog. Although there were 130 new CVEs addressed across all the Microsoft releases, there was only one publicly disclosed CVE, so the risk was low. But a short time later, two CVEs in SharePoint were reported exploited, and the month started to heat up with hotfixes near the end of the month. Mix in some security configuration issues with Microsoft Exchange Server and some major updates from Google and Apple, and the month ended with lots of activity. CISA flags SharePoint flaws as Microsoft issues new fixes It can take a few iterations to completely fix a vulnerability. Microsoft found this out with a recent round of SharePoint vulnerability fixes. Earlier this year in the Berlin Pwn2Own contest, a series of vulnerabilities called the ‘ToolShell’ chain were exploited and subsequently fixed in the Microsoft July 2025 Patch Tuesday updates. The key vulnerabilities a CVE-2025-49704 SharePoint Remote Code Execution Vulnerability and CVE-2025-49706 SharePoint Server Spoofing Vulnerability. Not long after this release, Microsoft, Google, and others reported these fixes had been bypassed and many organizations had been compromised. On July 19th Microsoft released an update with a more ‘hardened’ fix with associated vulnerabilities CVE-2025-53770 and CVE-2025-53771. There are separate releases for Microsoft SharePoint Server Subscription Edition, Microsoft SharePoint Server 2019 and Microsoft SharePoint Enterprise Server 2016. In addition to applying the updates, Microsoft recommends you rotate the associated machine keys on the impacted servers. There is reported ransomware that is taking advantage of this ToolShell attack chain and CISA has included them in their catalog of exploited vulnerabilities for immediate fix by federal agencies. Anticipate these hotfixes will be included in the August Patch Tuesday releases as well. Zero-Day in Chromium, dozens of Apple CVEs fixed in latest releases Microsoft issued CVE-2025-53786 to address security issues with respect to Microsoft Exchange Server in hybrid environments. This CVE ties together the April update and security hotfix with a series of instructions on securing on-premise Microsoft Exchange Server and Exchange Online. They share credentials and data such as calendars, email contact lists, etc. which can lead to compromise with little logging to show what happened. This Exchange Server blog, provides extensive details on the upcoming EOL of Exchange products as well as migration options to a more secure configuration. There are a few other major non-Microsoft updates to be aware of since last July 2025 Patch Tuesday. Google continues with weekly updates to the Chromium browser with a release on July 16th to address several vulnerabilities including zero-day CVE-2025-6558. This vulnerability allowed a remote attacker to potentially perform a sandbox escape. Apple also released a series of major updates for its operating systems and applications. Of note, from these updates include Ventura 13.7.7 with 41 CVEs, Sonoma 14.7.7 with 50 CVEs, Sequioa 15.6 with 89 CVEs, and Safari for Ventura and Sonoma with 17 CVEs fixed. August Patch Tuesday forecast We know SharePoint will receive some important updates this month and don’t forget there is more to do than just applying the updates and walking away – you need to consider updating your machine keys. Expect all the usual OS and app updates, but it’s been a while so may see a security fix in.NET framework or maybe SQL Server this month. Adobe continues with a steady stream of updates for the Creative Cloud suite of products so expect more this month with maybe Photoshop being the focus. Apple released their major updates on July 29th, and since we haven’t heard of any major issues, we should have a break for another month or two. Just make sure you have all the latest updates deployed. Google releases Chrome updates almost every Patch Tuesday but be aware they are often seen late in the day. The last set of security releases from Mozilla was July 22nd, so we are due for the Firefox and Thunderbird updates along with their ESR versions. Fixing vulnerabilities in software can often seem like plugging holes in a dam – just when you get one fixed, another leak appears. Microsoft found that out with these recent SharePoint vulnerabilities, but we’ve seen it before (remember Print NightMare) and we’ll see it again. Let’s just hope this time they don’t need to try, try again.

Malware linked to break-ins at F5 BIG-IP Access Policy Manager appliances hides a PHP web shell in memory instead of in a file on disk, Sophos said in an analysis published on September 7. When Apache loads any of the three appliances' own PHP scripts, the malware adds the web shell to the copy held in memory, so a check of the file on disk can come back clean. Those three scripts are the same ones F5 pointed customers to in March, when it said changes to them alone do not show a break-in. A web shell is usually a small script an attacker drops into a web server's folders to run commands through ordinary web requests. Because it sits on disk, defenders look for it by scanning files and comparing them against known-good copies. That approach does not work here. As the researchers put it, the web shell "does not need to exist in its final form on disk." The three scripts are apm_css.php3, full_wt.php3 and webtop_popup_css.php3, part of the BIG-IP APM webtop. F5 named all three in March in a published list of indicators of compromise for the malware it tracks as c05d5254, and said at the time that their presence alone does not point to a security problem. F5 also said it had seen cases where a web shell was written to disk, but that the web shells "have been observed to work in memory only," which means the files it listed might not be modified. The Sophos analysis explains how both statements can be true at once. Sophos examined a single sample. Its analysis names no victim and does not say how the sample was obtained. F5 has linked the c05d5254 activity to appliances affected by CVE-2025-53521, Sophos said. F5 first published that flaw on October 15, 2025, as a denial-of-service problem. On March 27, 2026, F5 said new information had led it to reclassify the flaw as remote code execution, and that it had been exploited. An attacker needs no login to use it, and F5 rates it 9.8 on CVSS 3.1 and 9.3 on CVSS 4.0. CISA added it to its Known Exploited Vulnerabilities catalog the same day, giving U.S. federal civilian agencies until March 30 to act. The flaw applies where a BIG-IP APM access policy is set on a virtual server. The UK's National Cyber Security Center calls BIG-IP APM a common component, especially in large organizations. F5's advisory lists the affected and fixed releases. The patch that fixes this is nearly a year old. Ireland's National Cyber Security Center said in a March 31 advisory that the patch released in October is still valid and will protect against exploitation. The web shell is the last step in a longer chain, and the earlier steps do touch the disk. Sophos said a separate installer, found in a sample named umount, infects the Apache web server program at /usr/sbin/httpd by adding malicious code to the front of the real file. The size of that added code matches the payload carried inside the installer, which Sophos said strongly suggests the installer puts it there. ESET, which analyzed related samples in April and named the malware PoisonedRefresh, said the installer is meant to be run as root and turns off SELinux. It also infects umount, httpd and rc.local inside BIG-IP install images, which ESET said was presumably done to spread the malware to other systems through the installation media. Because the malware sits inside the Apache program, it runs before Apache's own code starts. Sophos said it hooks an Apache Portable Runtime function, apr_dso_load, and does nothing until Apache loads the PHP module, libphp. Once PHP is loaded, the malware reads /proc/self/maps to find the module in memory, briefly makes those memory pages writable, rewrites the calls the module uses to open, size, and map files, then puts the original permissions back. From that point, it controls what PHP sees when it opens one of the three scripts. When the file is mapped into memory, the malware places the web shell in front of the original content. The web shell reads the raw body of a request, checks it for a short marker, decrypts the rest, and runs it. It replies with HTTP status 201 and a CSS content type, so the exchange looks like a request for a stylesheet. The malware also opens a local socket at /run/bigtlog.pipe. After checking for a fixed token, it connects that socket to /bin/bash, giving an interactive shell without opening a network port. Sophos said it could not find any code in the sample for connecting to that socket, and no other use of the token, so the two ways in look like separate features. It has no evidence either way on whether the attacker reaches the socket through the web shell. What Defenders Can Check Sophos said its behavioral signals are leads to investigate, not proof on their own, and should be read alongside file, process, and memory evidence. The list below combines them with the indicators F5 published in March. File: /run/bigtlog.pipe or /run/bigstart.ltm present Binary: hash, size or timestamp mismatch on /usr/bin/umount or /usr/sbin/httpd against a known good copy. F5 notes that sizes and timestamps differ between releases and engineering hotfixes Tool: sys-eicheck failing because one of those two files has changed Log: an entry in /var/log/restjavad-audit showing a local user reaching the iControl REST API from localhost Log: an entry in /var/log/auditd showing SELinux being switched off by the same route Log: an entry in /var/log/audit showing a bash command run through iControl REST. F5 says these lines show base64 data written into a file and /run/bigstart.ltm being run Traffic: HTTP 201 responses carrying a CSS content type from the appliance Host behavior: an Apache worker reading /proc/self/maps, changing memory permissions around libphp, binding a socket under /run, or starting /bin/bash SHA-256: 26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9 File, weak on its own: changes to the three .php3 scripts. F5 says their presence alone does not show a problem, and the Sophos analysis explains why: the file does not have to change at all F5's list also includes items the Sophos analysis does not cover, among them /run/bigstart.ltm and the changes affecting sys-eicheck. Neither account describes the whole intrusion. If You Have Already Patched Patching does not settle whether an appliance was compromised before the patch went on. Ireland's NCSC said no timeline for exploitation is available, and that it expects some exploitation was or could have been happening before the flaw and its fix were first published in October 2025. The UK's NCSC advises investigating for compromise "regardless of when the system was updated." Run F5's built-in sys-eicheck integrity check. F5's own indicators say the changes to /usr/bin/umount and /usr/sbin/httpd make this tool fail, so a failure is itself the signal. Collect a qkview report, send it to F5 and raise a case. Ireland's NCSC said F5 can check that report for signs of compromise, and that raising an associated case brings a quicker and fuller response. Compare the contents of modules in memory against the copies on disk, which Sophos recommends adding to incident response playbooks for critical web servers. Where a full investigation is not possible, the UK NCSC advises isolating the appliance and rebuilding it as new, and says this may cause an outage. Three things are still unknown. F5 has not said when exploitation began. None of the published advisories or analyses say whether upgrading an appliance to a fixed release removes malware already installed on it, and both Sophos and ESET describe a component designed to survive upgrade images. And no one has named an attacker: Sophos said it does not have enough evidence to name a group, and ESET said in April that it had not settled the question either.