Search/Macfinger ClickFix campaign, (Tue, Sep 22nd)
● Story

Macfinger ClickFix campaign, (Tue, Sep 22nd)

A domain that has long appeared in software documentation, code examples, and developer test material is now being used to push a ClickFix attack against Windows users. A placeholder domain stands in for a website in an example. The best-known is probably example.com . Another, third-party[.]com , has often been used in documentation to represent an external website, API, or service. However, there is a very important difference between the two: example.com is reserved for documentation, while third-party[.]com is an ordinary domain. Anyone could register it, and someone did. Every document, test, and skill that hardcoded it now points readers and users to the attacker’s infrastructure. Researchers at Manifold Security found that third-party[.]com was serving a fake Cloudflare-style…

View graph Export
CVEs
0
Highest CVSS
—
In KEV
0
Sources
15
Connections
41 relationships
Russian state hackers use new RedFlick technique to push malware
The Russian state actor Star Blizzard has been using a new malware installation tactic dubbed "RedFlick" to deploy its signature CosmicPulse backdoor. [...]
bleepingcomputer.comSep 30, 2026extracted
Russia's Star Blizzard Ditches ClickFix to Widen Phishing Net
The APT actor is using a new tactic, dubbed "RedFlick," against Ukrainian-linked targets such as NGOs, think tanks, and journalists to deploy its CosmicPulse backdoor.
darkreading.comSep 30, 2026extracted
Russian FSB-linked hackers scale up phishing attacks against Ukraine supporters
Russian FSB-linked hackers scale up phishing attacks against Ukraine supporters A Russian state-backed hacking group has expanded its phishing operations this year, using a new technique that makes it easier to infect victims with malware, according to Microsoft. The hacking group, known as Star Blizzard, has targeted Ukrainian individuals and institutions, as well as international NGOs, think tanks, governments and financial institutions that support Ukraine politically or financially. In a report published Tuesday, Microsoft said the activity has affected more than 100 organizations, primarily in the U.S. and UK. Star Blizzard, also tracked as Callisto and ColdRiver, has previously been linked by Western governments to Russia’s Federal Security Service, or FSB. The group has been active since at least 2017 and is known for targeting government agencies, NGOs and organizations involved in international affairs. Since the beginning of 2026, researchers have seen the hackers significantly expand their operations, moving beyond highly targeted spear-phishing attacks to campaigns involving tens or hundreds of emails at a time. Researchers said the shift likely reflects Star Blizzard’s adoption of a mass-mailing phishing platform that allows the group to automate its attacks and reach more potential victims. Microsoft has identified at least 13 such large-scale campaigns since January. Star Blizzard has also changed how it sends phishing messages. Since March, researchers have observed hackers using accounts created on compromised websites to contact targets. The group previously tended to rely on free email services to create accounts impersonating people familiar to potential victims, such as political figures, academics or former diplomats. The earliest campaigns, detected in January and February, targeted users of the Ukrainian email provider Ukr.net. The hackers impersonated Ukrainian authorities and sent messages claiming that recipients faced a tax audit or had an unpaid fine. Beginning in March, Star Blizzard expanded its targeting beyond Ukraine, frequently sending fake invitations to conferences or events supposedly organized by reputable think tanks or NGOs. In some cases, the hackers targeted several people at the same organization and disguised the phishing emails as internal communications. “The actor’s shift from Ukraine-focused operations to global targets could indicate Star Blizzard initially targeted Ukraine to test their new capabilities,” Microsoft said. The hackers have also adopted a new way of delivering malware that Microsoft calls RedFlick. Once a victim responds to an initial phishing email, Star Blizzard typically sends a follow-up containing a password-protected archive. Opening a file inside the archive triggers RedFlick, which uses scheduled tasks on the victim’s computer to install the group’s CosmicPulse backdoor while making the activity harder to detect. The new method requires only one action from the victim. Star Blizzard’s previous infection method, known as ClickFix, required victims to complete several steps before CosmicPulse could be installed. “Combined with the actor’s shift toward large-scale phishing operations during the same period, these changes likely improve Star Blizzard’s ability to reach more targets, evade detection, and increase the likelihood of successful compromise,” Microsoft said. Daryna Antoniuk is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.
therecord.mediaSep 30, 2026extracted
Attackers Combine ChatGPT Feature Abuse With ClickFix to Deliver Trojan Malware
Cybersecurity researchers at Huntress identify campaign to deliver potent trojan which targets users searching for ChatGPT via Google
infosecurity-magazine.comSep 30, 2026extracted
Russian APT Star Blizzard Uses ‘RedFlick’ Infection Chain in Recent Attacks
The state-sponsored group has launched larger-scale phishing campaigns to deploy the CosmicPulse backdoor. The post Russian APT Star Blizzard Uses ‘RedFlick’ Infection Chain in Recent Attacks appeared first on SecurityWeek .
securityweek.comSep 30, 2026extracted
Custom ChatGPTs push ClickFix attacks to deploy RAT malware
Custom variants of OpenAI's ChatGPT promoted in sponsored Google results are directing unsuspecting users to malicious sites that use ClickFix attacks to deliver malware. [...]
bleepingcomputer.comSep 29, 2026extracted
Russia's Star Blizzard Targets 100+ Organizations With Fake Event Invites to Deliver Backdoor
Russian state hackers known as Star Blizzard have been using fake event invitations to trick people into installing a backdoor on their Windows computers, according to Microsoft. The campaigns, aimed at people and organizations tied to Ukraine, have affected more than 100 organizations since January, mostly in the U.S. and U.K. At least one computer was infected, but the number of breached
thehackernews.comSep 29, 2026extracted
Hackers Use ChatGPT Custom GPTs in ClickFix Attacks
The personalized versions of ChatGPT were used to impersonate legitimate products and trick users into executing PowerShell commands. The post Hackers Use ChatGPT Custom GPTs in ClickFix Attacks appeared first on SecurityWeek .
securityweek.comSep 29, 2026extracted
Copy, Paste, Compromised: How ClickFix Attacks Work and How CrowdStrike Stops Them
Consider this hypothetical scenario: An employee tries to join what looks like a routine video meeting. The page loads, but instead of the meeting, they see an error message along with a helpful fix: Copy the provided command, open the Windows Run dialog, paste it, and press Enter. The meeting never starts. The command does something else entirely. This is ClickFix, a social engineering technique that turns the victim into the mechanism for executing an attack. CrowdStrike Intelligence has observed adversaries including STARDUST CHOLLIMA and VOODOO BEAR using ClickFix in real-world operations. Further, the CrowdStrike 2026 Global Threat Report documented a 563% increase in incidents involving fake CAPTCHA lures in 2025. ClickFix is effective because it exploits something security teams cannot simply patch: a user's instinct to solve a problem. In this blog post, we explain what ClickFix is, how it works, and how CrowdStrike stops these attacks. What Is ClickFix? Instead of convincing someone to open a suspicious attachment, ClickFix gives them a seemingly legitimate reason to execute a command themselves. The “error” it presents might claim a meeting application needs to be repaired, a browser needs to be verified, or a CAPTCHA needs to be completed. Whatever the pretext, the objective is the same: Move malicious instructions from an adversary-controlled webpage into a trusted operating system tool. A typical ClickFix chain looks like this: The adversary creates the problem: The victim lands on a compromised site displaying a fake error, CAPTCHA, or system message. Depending on the sophistication of the attack, the adversary may use a phishing email or more targeted techniques to get them there. The website provides the "solution": The page instructs the user to copy a command. In some variants, malicious JavaScript may place the command directly onto the clipboard. The user crosses the security boundary: The victim is instructed to copy a command and paste it into the Windows Run dialog, PowerShell, Terminal, or another trusted system utility. The operating system executes the attacker's instructions: The command may launch PowerShell, VBScript, or another legitimate interpreter to retrieve or execute additional payloads. The initial command becomes an intrusion. Follow-on activity can include malware deployment, credential theft, persistence, command and control, data theft, or additional access into the environment, CrowdStrike observations show. Why ClickFix Works ClickFix takes advantage of common everyday enterprise behaviors. Employees regularly deal with broken meetings, authentication challenges, CAPTCHA prompts, browser errors, and application issues. A prompt telling someone to perform a quick troubleshooting step can feel far less suspicious than an unexpected executable or email attachment. The technique also relies on tools users recognize and trust. PowerShell, Windows Run, command shells, and scripting engines are legitimate parts of the operating system, and ClickFix takes advantage of them rather than asking the user to launch an unfamiliar program. Another defining characteristic is how the victim performs the critical action. Traditional phishing often depends on getting someone to download or open something malicious. ClickFix asks the victim to transfer the attack from the webpage into the operating system and initiate execution. By prompting the victim to run the command, the adversary evades security tools solely built to stop malicious files. The lure itself can also change quickly. A campaign does not need to depend on one long-lived phishing domain or one recognizable template. Adversaries can rotate domains, compromise legitimate websites, change the brands they impersonate, or swap a fake meeting error for a fake CAPTCHA while keeping the underlying technique the same. CrowdStrike Intelligence observed this kind of infrastructure diversity in VOODOO BEAR activity, including websites of diverse Ukrainian entities (such as local government, energy, agriculture, and logistics entities) likely compromised to serve fake CAPTCHAs. The appearance of the attack may change, but the core behavior remains consistent: Convince the user to copy, paste, and execute. STARDUST CHOLLIMA: From Fake Meeting to Malware CrowdStrike Intelligence observed a ClickFix scenario likely involving STARDUST CHOLLIMA that demonstrates how quickly a routine browser interaction can lead to endpoint compromise. In July 2026, STARDUST CHOLLIMA very likely targeted an employee at a financial services entity using infrastructure masquerading as a video conferencing site. When the employee attempted to join the meeting, they almost certainly encountered a fake technical issue accompanied by a command presented as the fix. Running that command triggered a PowerShell- and VBScript-based infection chain that deployed two previously unknown malware families: GeniexLoader and GeniexRAT. The lure worked by making a malicious command look like a reasonable fix for an ordinary meeting problem. VOODOO BEAR: A Different Approach with Fake CAPTCHAs VOODOO BEAR demonstrates how this technique can be packaged inside a different lure. In May and June 2026, CrowdStrike Falcon® Complete managed detection and response (MDR) detected likely VOODOO BEAR intrusions affecting employees believed to be Ukrainian at organizations in France, the United States, and Canada. CrowdStrike Intelligence assesses that VOODOO BEAR almost certainly used ClickFix social engineering to trick users into executing PowerShell commands that downloaded a VBScript payload. In this case, instead of using a fake meeting lure, the adversary compromised Ukrainian websites. Ukrainian visitors to those sites were likely served fake CAPTCHAs. The details of the lure were different, but the underlying mechanism was the same. The attacker tricked the user into turning a browser interaction into execution on the endpoint. How CrowdStrike Stops ClickFix ClickFix blurs the boundaries between phishing, browser activity, endpoint execution, and identity compromise. Once the victim executes the command, the activity moves into the endpoint. If credentials or tokens are stolen, it can become an identity attack. If the adversary uses those credentials to access SaaS applications, cloud environments, or additional systems, the intrusion expands again. That progression is part of what makes ClickFix challenging to treat as a single-point security problem. The initial browser interaction is only the beginning of the chain. Each subsequent stage creates a new opportunity for the adversary to establish persistence, steal information, or move further into the environment. This makes the browser an important control point. With CrowdStrike Falcon® Seraphic® Enterprise Browser, CrowdStrike can extend protection into the browser session where ClickFix begins, while connecting that activity with endpoint, identity, cloud, and SOC telemetry as the attack progresses. But it’s not the only capability defending against ClickFix. Here’s how Falcon platform modules disrupt this attack: Before execution: Falcon Seraphic Enterprise Browser provides visibility and enforcement inside the browser. This helps identify malicious web behavior and disrupt the copy-and-paste mechanism that ClickFix depends on. At execution: CrowdStrike Falcon® Prevent and CrowdStrike Falcon® Insight XDR can identify and prevent suspicious PowerShell, VBScript, process, command-line, and other behavioral activity associated with the attack chain. After initial access: CrowdStrike Falcon® Identity Threat Protection can help detect and stop credential abuse and lateral movement. CrowdStrike Falcon® Next-Gen SIEM can correlate activity across endpoint, identity, browser, cloud, and other telemetry so analysts see a connected intrusion rather than isolated events. And across the entire environment, CrowdStrike Falcon® Adversary OverWatch™ and Falcon Complete add continuous threat hunting, investigation, containment, and remediation. The value is defense in depth. If one stage succeeds, the Falcon platform is built to provide additional opportunities to prevent, detect, and respond as the intrusion progresses. The Takeaway Defending against ClickFix therefore requires more than identifying a bad URL or teaching users not to paste commands from websites. Organizations need controls that can disrupt the lure, stop malicious execution, identify credential abuse, connect activity across domains, and respond before initial access becomes a wider compromise. With Falcon Seraphic Enterprise Browser integrated into the CrowdStrike Falcon® platform, CrowdStrike extends protection to where ClickFix begins: the browser. From the initial browser interaction through endpoint execution and identity abuse, the Falcon platform provides multiple opportunities to break the attack chain before it becomes a breach. Additional Resources Learn more about Falcon Seraphic Enterprise Browser. Learn how Falcon Seraphic Enterprise Browser stops web attacks. Read the CrowdStrike Falcon Seraphic Enterprise Browser Data Sheet.
crowdstrike.comSep 29, 2026extracted
A Closer Look at Malware From the Macfinger ClickFix Campaign, (Fri, Sep 25th)
Introduction
isc.sans.eduSep 25, 2026extracted
Criminals turn placeholder domain into ClickFix trap
A domain that has long appeared in software documentation, code examples, and developer test material is now being used to push a ClickFix attack against Windows users. A placeholder domain stands in for a website in an example. The best-known is probably example.com . Another, third-party[.]com , has often been used in documentation to represent an external website, API, or service. However, there is a very important difference between the two: example.com is reserved for documentation, while third-party[.]com is an ordinary domain. Anyone could register it, and someone did. Every document, test, and skill that hardcoded it now points readers and users to the attacker’s infrastructure. Researchers at Manifold Security found that third-party[.]com was serving a fake Cloudflare-style verification page to Windows visitors. The page tries to persuade them to open the Windows Run box and paste a command it has copied to their clipboard.This command is designed to download and execute a PowerShell script. At the time of writing the domain hosting the script is not resolving. ClickFix is a social-engineering technique that turns the victim into the malware installer. Instead of relying on a malicious attachment or an obvious executable download, the attacker convinces someone to run a command themselves. Common lures include: A fake CAPTCHA or Cloudflare Turnstile check. A browser error that claims it needs a “manual fix.” A bogus video-player, document-viewer, or popular software download. A support scam page that tells the visitor to paste a command into Run, Command Prompt, Terminal, or PowerShell. ClickFix works because the command often uses legitimate Windows or Mac tools to download and execute the next stage. It also runs with the permissions of the person who has been convinced to enter it. The consequences can range from information theft to more serious compromise of a company network. In a recent campaign called TerminalFix , a fake Cloudflare CAPTCHA led victims to paste a PowerShell command into Windows Terminal or PowerShell. How to stay safe With ClickFix running rampant—and it doesn’t look like it’s going away anytime soon—it’s important to be aware, careful, and protected. Slow down.  Be wary of a webpage that urges you to run commands on your device, especially if it uses a countdown or other pressure tactic. Don’t run commands or scripts from untrusted sources.  Never run code or commands copied from websites, emails, or messages unless you trust the source and understand the action’s purpose. Verify instructions independently. If a website tells you to execute a command or perform a technical action, check through official documentation or contact support before proceeding. Check what you’re pasting.  A website may copy a command to your clipboard without showing you the full text. Don’t paste it into a command window. Secure your device.  Use an up-to-date, real-time  anti-malware solution  with a web protection component. Educate yourself on evolving attack techniques.  Understanding that attacks may come from unexpected vectors and evolve helps maintain vigilance. Keep reading our blog! Pro tip:  The free  Malwarebytes Browser Guard  extension warns you when a website tries to copy something to your clipboard. Stop threats before they can do any harm. Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →
malwarebytes.comSep 25, 2026extracted
Hacked Ukrainian Sites Serve Fake Cloudflare ClickFix Lures for Psychedelic Stealer
An active ClickFix campaign has been observed compromising legitimate Ukrainian business websites to inject bogus Cloudflare verification pages and trick victims into downloading a previously undocumented information stealer called Psychedelic. "When a visitor interacts with the page, the lure copies a Windows Installer command to the clipboard and instructs the visitor to paste it into the
thehackernews.comSep 24, 2026extracted
17,000 URLs Reveal How ClickFix Turns Trusted Websites Into Malware Traps: Report by CTM360
ClickFix has become the most common way attackers get into enterprise networks, and it does it without an exploit, an attachment, or a file on disk. Our new global threat report traces the technique from a novelty in late 2023 to a subscription product with on-chain infrastructure and a state-sponsored user base, and explains why blocking malicious domains is no longer a useful defense. Read
thehackernews.comSep 24, 2026extracted
Placeholder domain used in dev docs now serves ClickFix attacks
The "third-party.com" domain, commonly used as a placeholder in developer documentation and code examples, is serving a fake Cloudflare verification page that attempts to trick Windows users into executing PowerShell commands. [...]
bleepingcomputer.comSep 23, 2026extracted
Macfinger ClickFix campaign, (Tue, Sep 22nd)
Introduction
isc.sans.eduSep 23, 2026extracted
Related Stories
6
Macfinger ClickFix campaign, (Tue, Sep 22nd)
The "third-party.com" domain, commonly used as a placeholder in developer documentation and code examples, is serving a fake Cloudflare verification page that attempts to trick Windows users into executing PowerShell commands. The domain third-party.com has long been used in documentation to represent an arbitrary external website, API, or service, similar to how developers use domains such as example.com. However, unlike example.com, example.net, and example.org, which IANA reserves specifically for documentation, third-party.com is a normally registered domain whose content its owner can control. This difference is now a security concern after the domain began serving a ClickFix attack that impersonates a Cloudflare security check. Manifold Security first reported the malicious use of the domain after discovering it while examining public AI skills and MCP server documentation that referenced the domain. BleepingComputer has since confirmed that the page displays a fake Cloudflare "Performing security verification" CAPTCHA screen containing a "Verify you are human" prompt. After the user clicks the verification box, the site copies a malicious PowerShell command into the Windows Clipboard, and then instructs the user to press the Windows key + R, paste the contents of their clipboard using Ctrl+V, and press Enter. When the PowerShell command runs, it reconstructs the payload URL elxxvvx[.]xyz/f, downloads a PowerShell script from that address, and then executes it. This technique is commonly known as ClickFix, where attackers use fake errors, CAPTCHA prompts, or verification pages to convince victims to manually execute commands copied to their clipboard. ClickFix attacks have become a popular way to distribute malware, as the malware is installed via commands executed by the user rather than downloaded from websites or as email attachments. In some cases, this could allow malware to install while bypassing traditional antivirus software. At the time of BleepingComputer's testing, elxxvvx[.]xyz no longer resolved, leaving the current attack chain broken. However, a Hybrid Analysis report from May 2, 2026, shows the site distributed a PowerShell script configured to download a 134MB zip archive from: https://elxxvvx[.]xyz/update2.zip The PowerShell script saved the archive as update26.zip, extracted it, and then attempted to launch an executable named draw.io.exe. Because the update2.zip archive is no longer available, BleepingComputer couldn't determine what the payload does. Manifold's Ax Sharma says the attack specifically targets Windows users, and Linux and Mac visitors will see errors stating their operating system is unsupported. "A macOS or Linux user-agent gets none of that. It gets a near-identical page that stops at an error: "macOS is not supported. This website requires a Windows PC to access." No clipboard poisoning, no payload," explains Sharma. "The attacker only shows the weapon to the targets it works against, which is precisely why a casual look, or a scanner on a Linux datacenter IP, sees nothing wrong." A placeholder that wasn't reserved The more interesting aspect of the attack is the third-party.com domain chosen to host the ClickFix page. Public developer documentation has treated third-party.com as a generic example hostname for many years. For example, the W3C Geolocation specification currently demonstrates granting geolocation permissions to an external iframe using third-party.com as a placeholder domain: The W3C Compute Pressure specification similarly uses the domain when demonstrating how a website can enable the API for remote content: Chromium's documentation for its Telemetry Extension API also uses third-party.com as an example website permitted to communicate with a Chrome extension: Other examples go further and use the domain in code that would actually make network requests if copied literally. A PrivacyCG proposal on GitHub also uses the domain as the destination of a JavaScript fetch() request from a service worker. Posts online indicate that developers have copied these and similar examples into their own code and projects. In a 2015 Stack Overflow question, a developer said they had applied an asynchronous loading example containing https://third-party.com/resource.js to their website before discovering that it did not behave as expected after publishing the site. These examples do not mean that the associated projects or documentation are compromised. However, applications or test code that copied such placeholder URLs could now cause a browser or automated tool to contact the real third-party.com domain and potentially display the ClickFix attack in a browser or application. Unlike example.com, which IANA maintains for documentation and does not allow to be registered or transferred, the third-party.com domain has no such protection, and was clearly hijacked or registered at some point to conduct these ClickFix attacks. "third-party[.]com has been a generic documentation placeholder for years, the same role example.com plays," explains Manifold. "A public code search turns it up in skills, MCP-server docs, and over 1,500 files across 1,700+ repositories from names as trusted as Chromium, Sanity, and Vercel. Since at least June 2026 it's been serving the ClickFix lure." While the widespread use of third-party.com as a placeholder in documentation makes the domain attractive to attackers, there is no evidence that it was registered for malicious purposes. The domain was first registered in 1996, long before the current campaign, and BleepingComputer has not determined when or how control of the site changed. At this time, there have been no reports that these references to third-party.com have actually resulted in ClickFix attacks being executed on developer's devices or within their applications/webpages. However, as the domain remains live, it could easily be switched to a new, live payload domain and actively utilized in future attacks. Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed. Save your seat
16 shared
Sep 25, 2026
USN-8900-1: Go Networking vulnerabilities
Welcome back to PWNED, the weekly column where we highlight some of the lowlights in corporate security. This week, we’ll talk about two scenarios, one that ended in tragedy and another that shows the power of a good defense over dedicated phishing attacks. Have a story about someone leaving a gaping hole in their network? Share it with us at [email protected]. Anonymity is available upon request. Both stories come courtesy of Dave Hatter, a cybersecurity and compliance consultant with Intrust IT. In his many years of experience with the company, Hatter has had to work for a variety of small companies that needed help with their security, whether they knew it or not. One time several years ago, the new CFO at a small construction company phoned Intrust and expressed interest in hiring them. However, the proposal was vetoed by the owner of the company, an older gentleman who thought his business was too small to interest hackers and that his existing, one-person IT staff was all he could afford. “We got a guy, my brother’s uncle’s cousin does my IT, don’t need you guys,” Hatter quotes the owner as saying. “We hear this all the time. Thanks for shopping. You’re too expensive.” Three weeks later, Hatter got a call from a local accountant friend who begged him to help a client who'd been hit with a ransomware attack. Hatter said he couldn’t really give more than general guidance, but would talk to the victim anyway. As soon as he called the number, Hatter realized that the ransomware victim was actually the same construction company that had turned down his services a few weeks earlier. The business had an old unpatched Windows server that contained all its most important data. There was a backup drive, but it was connected to the same server, so both devices were encrypted by the ransomware. “Their entire backup is this external drive, which, of course, is now encrypted,” Hatter said. “So, literally, they can't pay their employees. They don't know who owes them money.” Hatter could not help the company, and he never found out whether it paid the ransom. However, the org, which had been around for years, went out of business within months. This sad story shows the importance of having real backups that are off-site or in the cloud and patching whatever servers you have. You can never assume that your company is too small to be attacked because ransomware gangs want your money and they are just as happy to take on small businesses as large ones, which are likely to be harder targets. The other incident involved two companies in the landscaping and construction business. Somebody broke into an executive’s email account at company one and started sending phishing emails to company number two. The miscreants had also set up email filtering rules in the first company’s account so that the messages from the phishing campaign were routed to buried folders where the real-life account holder would never see them. The phishing mails took the form of RFPs (requests for proposal) – a perfect lure, because who wouldn't want new business? They were perfectly crafted, with no grammar errors or obvious tells, and the return address matched company one's. However, instead of attaching the RFP as a PDF or PowerPoint file, it had a button for the user to click to download it. “If I can get in your email and send out emails as you, the recipients, especially if they've interacted with me before, aren't going to have any guard up,” Hatter said. “Especially if there's no crazy language or crazy requests in there because they've got an email from me before.” Upon clicking the download button, the user was transported to a Microsoft 365 login screen that looked identical to the real one but was not on the microsoft.com domain. The user was then invited to put in their email address and password to gain access to the desired file. Because the user had 2FA, this fake page also asked them for their limited-time 2FA code. Behind the scenes, the threat actors were transmitting the login to Microsoft so that Microsoft itself would send an SMS message to the victim at company number two. Then the victim would pass along the one-time passcode via the fake login site. A classic man-in-the-middle attack. It worked, and the threat actors now had access to the Microsoft 365 account and email for the victim at company number two. This could've allowed them to do almost anything using that person’s email. If the victim had access to bank accounts or customer data, the attackers could have initiated password resets from the account, then conducted fraudulent money transfers, or stolen personal information. At the very least, they could've used the victim's account to phish other contacts. Fortunately, Hatter's client had installed a piece of software his company made called TarBot, which runs in the Microsoft 365 environment and uses Entra ID P2 to help customers identify suspicious logins. “It throws off a bunch of telemetry, statistics, metrics, whatever you want to call it, that allows our software to say, this is an anomalous login, revoke the token, and make the user log in again,” Hatter said. He said his company is not the only one to make apps like TarBot that detect suspicious logins. So the bad guys were kicked out after just a few minutes. But Hatter says the better way to stop these attacks is to use phishing-resistant MFA, such as hardware keys (like the YubiKey line) or passkeys. With today’s AI-assisted phishing, telltale signs such as bad grammar or obviously fake login pages are becoming few and far between. ®
11 shared
Oct 8, 2026
Russia's Star Blizzard Ditches ClickFix to Widen Phishing Net
Russian FSB-linked hackers scale up phishing attacks against Ukraine supporters A Russian state-backed hacking group has expanded its phishing operations this year, using a new technique that makes it easier to infect victims with malware, according to Microsoft. The hacking group, known as Star Blizzard, has targeted Ukrainian individuals and institutions, as well as international NGOs, think tanks, governments and financial institutions that support Ukraine politically or financially. In a report published Tuesday, Microsoft said the activity has affected more than 100 organizations, primarily in the U.S. and UK. Star Blizzard, also tracked as Callisto and ColdRiver, has previously been linked by Western governments to Russia’s Federal Security Service, or FSB. The group has been active since at least 2017 and is known for targeting government agencies, NGOs and organizations involved in international affairs. Since the beginning of 2026, researchers have seen the hackers significantly expand their operations, moving beyond highly targeted spear-phishing attacks to campaigns involving tens or hundreds of emails at a time. Researchers said the shift likely reflects Star Blizzard’s adoption of a mass-mailing phishing platform that allows the group to automate its attacks and reach more potential victims. Microsoft has identified at least 13 such large-scale campaigns since January. Star Blizzard has also changed how it sends phishing messages. Since March, researchers have observed hackers using accounts created on compromised websites to contact targets. The group previously tended to rely on free email services to create accounts impersonating people familiar to potential victims, such as political figures, academics or former diplomats. The earliest campaigns, detected in January and February, targeted users of the Ukrainian email provider Ukr.net. The hackers impersonated Ukrainian authorities and sent messages claiming that recipients faced a tax audit or had an unpaid fine. Beginning in March, Star Blizzard expanded its targeting beyond Ukraine, frequently sending fake invitations to conferences or events supposedly organized by reputable think tanks or NGOs. In some cases, the hackers targeted several people at the same organization and disguised the phishing emails as internal communications. “The actor’s shift from Ukraine-focused operations to global targets could indicate Star Blizzard initially targeted Ukraine to test their new capabilities,” Microsoft said. The hackers have also adopted a new way of delivering malware that Microsoft calls RedFlick. Once a victim responds to an initial phishing email, Star Blizzard typically sends a follow-up containing a password-protected archive. Opening a file inside the archive triggers RedFlick, which uses scheduled tasks on the victim’s computer to install the group’s CosmicPulse backdoor while making the activity harder to detect. The new method requires only one action from the victim. Star Blizzard’s previous infection method, known as ClickFix, required victims to complete several steps before CosmicPulse could be installed. “Combined with the actor’s shift toward large-scale phishing operations during the same period, these changes likely improve Star Blizzard’s ability to reach more targets, evade detection, and increase the likelihood of successful compromise,” Microsoft said. Daryna Antoniuk is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.
11 shared
Oct 6, 2026
Cisco warns of new SD-WAN zero-day exploited in attacks
Attackers are exploiting a new critical zero-day flaw in Cisco Catalyst SD-WAN Manager, the system companies use to manage their Cisco SD-WAN networks, Cisco said in an advisory on September 30. The flaw, CVE-2026-76504, could allow a remote attacker with no login access to use the Manager's API as the admin user. Fixed releases are available, and there is no workaround. It carries a CVSS score of 9.8 out of 10. It sits in the part of the Manager's API that handles login sessions. The Manager mishandles URI encoding in an HTTP request. A crafted request can therefore bypass an authentication rule intended to restrict access to a single API endpoint. The attacker needs no credentials, only the ability to send that request to the Manager's API. Managers exposed to the internet are at risk of compromise, according to Cisco. By default, the admin user holds the netadmin role, which is allowed to perform all operations on the device. Cisco said its Product Security Incident Response Team "became aware of active exploitation of this vulnerability" in September 2026. The flaw was found while Cisco's Technical Assistance Center (TAC) was handling a support case. The advisory does not say how many customers were attacked, when the attacks began, who carried them out, or what the attackers did with the access. Who Needs to Upgrade The flaw affects SD-WAN Manager regardless of how the system is configured. No other product is listed as affected. These are the first fixed releases for each release train: CVE-2026-76504 is separate from three Cisco SD-WAN flaws fixed earlier: CVE-2026-20182 in May, and CVE-2026-20245 and CVE-2026-20262 in June. A comparison of the advisories shows that the fixed releases for those flaws are all older than the ones in the table above. So a Manager last upgraded for the May or June fixes still needs this update. The table does not list the 20.10, 20.11, 20.13, 20.14, or 20.16 release trains, which Cisco's May advisory did list. The advisory also does not name Cisco SD-WAN Cloud-Pro or Cisco SD-WAN for Government (FedRAMP), two deployment types named in the May and June advisories. Cisco SD-WAN Cloud (Cisco Managed) is already fixed in release 20.15.605, and customers on it need to take no action. Until an on-prem Manager is upgraded, Cisco advises restricting access to it from unsecured networks such as the internet. Where internet access is required, only known, trusted hosts should be allowed in, and the control components should sit behind a firewall. Cisco Catalyst SD-WAN Cloud Hosted environments already have this mitigation in place. The mitigation worked in a test environment, according to Cisco, which advises customers to assess its impact on their own networks before applying it. Cisco's SD-WAN hardening guide says administrative interfaces, such as ports 443, 22 and 830, should not be exposed directly to the internet. HTTPS access to the Manager should come only from a jump host or a management subnet. Checking for Signs of Compromise The signs of compromise Cisco describes involve j_security_check, the request path the Manager uses for session-based logins. In Cisco's example, one character of that path is URI-encoded, giving /%6a_security_check, where %6a stands for the letter j. Two log files are the places to look for j_security_check entries from unknown or unauthorized IP addresses: File: /var/log/nms/containers/service-proxy/serviceproxy-access.log File: /var/log/nms/vmanage-server.log, in particular entries for users whose names start with viptela-reserved- Names starting with viptela-reserved- belong to reserved system service accounts. Any one character in the request can be encoded, so %6a is only an example. The same entries can also appear during normal operation, and each match has to be checked against normal activity to avoid false positives. To help determine whether a Manager has been compromised, customers can open a Severity 3 case with Cisco TAC and include CVE-2026-76504 in the title. Cisco asks them to run request admin-tech on the Manager first, so the output file can be reviewed. The advisory includes no detection rule and does not say whether upgrading removes an attacker who already has access. Cisco's advisories for the May flaw and the first June flaw said an update alone would not resolve a confirmed compromise. They told customers to collect the admin-tech file before upgrading. CVE-2026-76504 follows a series of Cisco SD-WAN flaws flagged as exploited this year. As of September 30, the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities catalog listed eight Cisco SD-WAN flaws added in 2026.
10 shared
Oct 5, 2026
WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Microsoft SharePoint and Mikrotik RouterOS to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities in question are as follows - CVE-2026-65660 (CVSS score: 8.8) - A code injection vulnerability in Microsoft Office SharePoint that allows an authorized attacker to execute code over a network. CVE-2026-67279 (CVSS score: 6.9) - An improper enforcement of behavioral workflow vulnerability in Mikrotik RouterOS that could allow an unauthenticated client to open a session channel and send an exec request. As reported by The Hacker News earlier this week, CVE-2026-65660 was originally described by Microsoft as a spoofing vulnerability impacting SharePoint Server. The tech giant has since updated the advisory to state that it could be abused to obtain remote code execution. "As of 9/25/2026, Microsoft had reliable evidence of observed attacks against exploitation of this vulnerability," the Windows maker noted. Microsoft hasn't disclosed who was behind the exploitation efforts, when they started, how many organizations have been targeted, how many of them have been successful, and what attackers did once inside the vulnerable service. The second vulnerability to be added to the KEV catalog is CVE-2026-67279, which has been chained along with CVE-2026-86060, an argument injection flaw in the RouterOS login process, as part of an exploit codenamed MikroTrick. The exploit chain has been employed to take full administrative control of internet-exposed susceptible routers without the need for a password, per CERT Polska. "Combining the two vulnerabilities resulted in full unauthenticated access to the administrative console," the Polish cybersecurity agency said. "CVE-2026-67279 allowed an unauthenticated client to create a session channel, while CVE-2026-86060 allowed it to supply login with an attacker-controlled policy mask." In a separate analysis, Bishop Fox said it was able to reproduce the complete administrative takeover on vulnerable RouterOS 7.x builds. "MikroTrick combines two failures at different trust boundaries," security researcher Emilio Gallegos said. "The first allows an unauthenticated connection to reach functionality that RouterOS should expose only after login. The second causes the login process to treat data from that connection as a trusted administrative identity." "MikroTrick exposes a design risk in privileged software: a feature intended only for trusted local callers becomes a remote attack surface when an upstream component loses track of authentication state." It's worth noting that CISA added CVE-2026-86060 to its KEV catalog on September 11, 2026. Federal Civilian Executive Branch (FCEB) agencies have time until September 28, 2026, to apply the necessary fixes.
10 shared
Oct 1, 2026
US Tops Hit List as 396 SharePoint Systems Compromised Globally
Check Point Research (CPR) conducted a focused analysis of Storm-2603, a threat actor associated with recent ToolShell exploitations, together with other Chinese APT groups. Storm-2603 utilizes a custom malware Command and Control (C2) framework dubbed internally by the attacker as “ak47c2”. This framework includes at least two different types of clients: HTTP-based (dubbed by us “ak47http”) and DNS-based (dubbed by us “ak47dns”). Based on VirusTotal data, Storm-2603 likely targeted some organizations in Latin America throughout the first half of 2025, in parallel to attacking organizations in APAC. Some of the actor’s TTPs align with many other ransomware groups, and involve open-source tools such as PsExec and masscan. In addition, the threat actors use a custom tool that leverages the BYOVD (Bring Your Own Vulnerable Driver) technique to tamper with endpoint protections. Storm-2603 attacks involved multiple ransomware families, sometimes bundled together. Those are commonly deployed by abusing DLL hijacking. Check Point Research (CPR) has been closely monitoring the ongoing exploitation of a group of Microsoft SharePoint Server vulnerabilities collectively referred to as “ToolShell.” These active attacks leverage four vulnerabilities—CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771—and are attributed to multiple China affiliated threat actors. Among the threat groups identified by Microsoft, two are known APTs: Linen Typhoon (aka APT27) and Violet Typhoon (aka APT31). Another group is a newly observed, previously undocumented cluster called Storm-2603. While Microsoft linked this cluster’s activity to potential ransomware deployment, it was unable to assess the group’s objectives. As part of our ongoing investigation into ToolShell and its associated risks, we launched a targeted effort to better understand and characterize the threat posed by Storm-2603. Throughout our analysis, we uncovered several files likely tied to Storm-2603 intrusions, offering new insights that correspond to Microsoft’s description of the group. In this publication, we provide an in-depth examination of Storm-2603’s tactics, techniques, and procedures (TTPs), along with a technical breakdown of the ak47c2, a custom malware framework used in their attacks and their different ransomware payloads. Storm-2603 was first mentioned by Microsoft during investigations into a set of attacks on Microsoft SharePoint servers, known as the “ToolShell” campaign. While some activity was tied to known Chinese affiliated groups like Linen Typhoon (APT27) and Violet Typhoon (APT31), Storm-2603 appeared as a new, previously unreported actor. Microsoft linked the group to Lockbit and Warlock ransomware use. Figure 1 – Events associated with Storm-2603. Microsoft’s report provided only limited information about Storm-2603, including some of the TTPs associated with it, most of them quite generic. In addition, some of the reported indicators of compromise (IOCs) helped us uncover additional artifacts associated with previous Storm-2603 intrusions. One domain in particular, update.updatemicfosoft[.]com, linked to Storm-2603’s SharePoint exploitation, turned out to have been used in earlier campaigns dating back to March 2025. In those operations, it served as a C2 server for both DNS tunneling malware and an HTTP backdoor and was part of infrastructure used to deliver LockBit Black and Warlock/x2anylock ransomware. Our search for cases where the IOCs reported by Microsoft, revealed two incidents in which LockBit Black and WarLock ransomware variants were deployed together, in addition to multiple other tools, mostly open-source. In April 2025, a RAR archive named Evidencia.rar was uploaded to VirusTotal. The archive contains several artifacts likely extracted from compromised machines in a Storm-2603 case in a LATAM country. The artifacts in the archive provide a look at some of the open-source tools used by the actors in the intrusions which correlates with previous knowledge of the group: WinPcap – Captures and filters network traffic on Windows. PsExec – Executes commands on remote Windows systems. SharpHostInfo – Collects host and domain info on Windows environments. nxc – Exploits common vulnerabilities in network services. In addition to the open-source tools, the archive also contains the custom backdoor used by the group, as well as its unique ransomware payloads. dnsclient.exe – A custom backdoor utilized by Storm-2603 that communicates over DNS tunneling with update.updatemicfosoft[.]com, a domain associated with the group. See the next section for our analysis of the backdoor. 7z.exe & 7z.dll – Legitimate 7z executable side-loading malicious 7z.dll delivering X2anylock (aka Warlock), a ransomware used by Storm-2603. bbb.msi – An installer which uses clink_x86.exe to side-load clink_dll_x86.dll, leading to the execution of LockBit Black ransomware. Another MSI file uploaded to VirusTotal in April used a similar deployment method, starting with the MSI installer to launch multiple ransomware strains simultaneously: Figure 2 – MSI Multi-Ransomware Deployment. The MSI relies on the following files: MpCmdRun.exe & Mpclient.dll – Warlock Ransomware, deployed via DLL-hijacking. clink_x86.exe & clink_dll_x86.dll – LockBit Black ransomware, deployed via DLL-hijacking. z.exe & z.dll – x2anylock ransomware, deployed via DLL-hijacking. VMToolsEng.exe – Custom Antivirus Terminator. ServiceMouse.sys – Vulnerable driver used by VMToolsEng.exe for killing Antivirus processes. log.exe – A list of Antivirus processes to kill. msi.bat – Executes VMToolsEng.exe. 1.bat – Executes all the needed executables and the MSI. We attributed two custom backdoors to Storm-2306, both of which appear to be part of the framework named AK47 C2 based on the shared PDB path: C:\Users\Administrator\Desktop\work\tools\ak47c2\. When executed, the program immediately hides its console window, determines the host computer name (defaulting to unknown.local if that fails), and builds a DNS‑based command‑and‑control payload. It chooses a random five-character session ID, such as H4T14, and prefixes it with 1 for task requests or 2 for result uploads (e.g., 1H4T14 or 2H4T14). Each element, such as the task/result tag, a size flag (a for “all” when the entire message fits into one request), and the computer name, is XOR‑encoded with the ASCII key “VHBD@H”, converted to hexadecimal, and concatenated with dots before being prepended to the C2 domain update.micfosoft[.]com. This what the overall query looks like: DNS TXT and MG (a mail group member record type) record lookups (DnsQuery_A) are used to transmit and retrieve data. If the C2 server is unreachable, the client simply receives error 9003 (DNS_ERROR_RCODE_NAME_ERROR). Otherwise, the response text is decoded from hex, XOR‑decrypted, and parsed for the delimiter “:::”, which separates metadata from the actual command string. Commands run under cmd.exe /c 2>&1; a built‑in directive sleep n pauses execution for n seconds. For outputs larger than 0xFF bytes, the backdoor fragments data into 63‑byte sub‑segments. Each DNS query then follows: HttpClient backdoor has the pdb path C:\Users\Administrator\Desktop\work\tools\ak47c2\httpclient-cpp\x64\Release\httpclient-cpp.pdb and uses plain HTTP instead of DNS for the C2. It is built as a 64‑bit console program that also immediately hides its window on launch. On start‑up, the malware gathers the host computer name (similar to the DNS version, it defaults to unknown.local), then builds a JSON object with the fields cmd, cmd_id, fqdn, result, and type. For a task request, the object looks like this: {"cmd":"","cmd_id":"","fqdn":" ","result":"","type":"task"} After the host executes a command, the result is sent back with type:”result”. Before transmission, the entire JSON blob is XOR‑encrypted with the ASCII key “VHBD@H”, converted to hexadecimal, and placed in the body of an HTTP POST to “/” with generic headers (Content‑Type: text/plain, Accept: */*). The C2 replies with a similarly encoded JSON where the cmd field contains the next command. The implant executes it via cmd.exe /c 2>&1 and returns the output. We identified that during these attacks, several types of ransomware were deployed simultaneously. One is regular LockBit Black, and the second uses the.x2anylock extension. This extension was later used by the Warlock ransomware operator, mentioned in Microsoft’s report on the SharePoint exploitation. The Warlock ransom note is usually saved as How to decrypt my data.txt and looks like this: Figure 3 – Warlock Group ransom note. The ransom notes for all ransomware strains deployed by Storm-2603 are named How to decrypt my data.log (x2anylock) or .README.txt (LockBit Black) and have the same short content: Your decrypt ID: [redacted] Tox ID Support: 3DCE[redacted] Email Support: [redacted]@proton.me,[redacted]@proton.me,[redacted]@proton.me You can contact us in email or qtox. This ransom note’s name How to decrypt my data.log appeared in a recent LinkedIn post by Huntress, describing the case where multiple ransomware families were deployed together against the same target. While not a new tactic, this approach is rarely observed among established ransomware groups. An important part of the infection package described earlier is called Antivirus Terminator. It is a custom command line tool abusing a third-party signed legitimate driver to kill processes. From what we can see, it’s been in the wild since at least late 2024. The tool requires administrative privileges on the infected machine. The screenshot below shows how the listing is displayed in the console when the tool is run without parameters: Figure 4 – Antivirus Terminator supported arguments when run without parameters. The tool first creates a service called ServiceMouse, where the path to the service binary file is ServiceMouse.sys from the package. Next, the tool communicates with the installed service via IO control code 0x99000050, which is responsible for killing processes. The tool also has more capabilities, like deleting files and uninstalling drivers, and these use different IO control codes (0x990000D0 and 0x990001D0). Figure 6 – Antivirus Terminator kills process using third-party driver. The supplied third-party driver is a legitimate and signed component of Antiy System In-Depth Analysis Toolkit, originally named AToolsKrnl64.sys. The toolkit was developed by Antiy Labs, a Chinese security vendor, and features a graphical user interface that allows users, among others, to interact with and manipulate processes. The ability to kill processes is the most important feature which is abused by threat actors in this particular case. Figure 7 – Antiy System In-Depth Analysis Tookit GUI. The following piece of code in the driver handles the IO control code 0x99000050 mentioned above: Figure 8 – IO control code processing in the Antiy driver. The second function is the piece of code responsible for killing a process with a given PID. In this report we analyze Storm-2603, a relatively new threat actor first mentioned by Microsoft during investigations into the “ToolShell” campaign targeting SharePoint servers. While some of the exploitation activity was tied to known Chinese APT groups, Storm-2603 stood out as a previously undocumented group linked to ransomware deployment. By examining infrastructure indicators shared in public reporting, we were able to connect this actor to earlier campaigns involving LockBit Black and Warlock/X2anylock ransomware, dating back to at least March 2025. These earlier attacks used similar infrastructure and tools, including DNS tunneling and HTTP-based backdoors. Interestingly, multiple ransomware variants were deployed in the same attack. This behavior, along with the overlap in techniques, helps us better understand how Storm-2603 operates “The Turkish Rat” Evolved Adwind in a Massive Ongoing Phishing Campaign Check Point Research Publications August 11, 2017 “The Next WannaCry” Vulnerability is Here Check Point Research Publications March 12, 2026 “Handala Hack” – Unveiling Group’s Modus Operandi SUBSCRIBE TO CYBER INTELLIGENCE REPORTS We value your privacy! BFSI uses cookies on this site. We use cookies to enable faster and easier experience for you. By continuing to visit this website you agree to our use of cookies.
10 shared
Aug 1, 2025