brave

A new macOS information-stealing malware dubbed ClickLock terminates all visible processes to force users into entering their system login password. The malware is designed to steal cryptocurrency assets, login credentials, password-manager data, browser information, and macOS authentication data, and it can also install a persistent backdoor for ongoing remote access to infected systems. Researchers at Group-IB analyzed the ClickLock shell script after discovering the malware on VirusTotal, where it was first submitted on June 9. At the time of the report, it remained undetected by all security vendors available on the platform. Further investigation revealed that the malicious script has infected at least 100 systems across 33 countries since May. The compromise likely begins via a ClickFix lure, as the researchers observed pastes of a malicious command in the Terminal that trigger a fake Cloudflare “human verification” sequence with an animated progress bar. At the same time, keyboard interrupts are disabled, the terminal cursor is hidden, and the stealer modules are downloaded in the background. The macOS NotificationCenter is also suppressed for about six hours, effectively disabling notifications that could expose the attack. Forcing password entry Group-IB researchers highlight that ClickLock does not require any exploits or elevated privileges but achieves its goal through social engineering and forced interaction loops. Operational success is obtained through the malware's mechanism for coercing the victims into entering their macOS system password. Group-IB says that the script initially displays a fake macOS password dialog using the victim’s real username and a downloaded Apple icon. If the user enters their password, the malware validates the data and exfiltrates it to the attacker via Telegram. In case the user cancels the dialog, the malware establishes persistence via two macOS LaunchAgents (com.authirity.plist, com.chromer.plist) and reloads at the next login. At the next activation, the password-stealing module runs a termination loop every 210 milliseconds, targeting key apps (e.g., Finder, Dock, Terminal, Activity Monitor, Console, System Settings, Spotlight, web browsers) and shows only a password dialog on the screen until the victim complies. Group-IB reports that the loop is configured to continue for 300,000 seconds (about 83 hours), or until the victim supplies a correct password. The second LaunchAgent runs a separate coercion mechanism that also terminates many of the mentioned system applications, requesting Keychain authorization via a legitimate system prompt, seeking approval to access Chrome’s Safe Storage key. That key could then be used to decrypt offline Chromium-stored passwords, cookies, and autofill information from stolen databases. This second mechanism has a repeat interval of 200 milliseconds and is configured to last for nearly 35 days (3 million seconds). ClickLock also deploys a data-harvesting module, which targets the following: Data from eight browsers: Chrome, Firefox, Brave, Edge, Opera, Vivaldi, Arc, and Chromium Saved logins, cookies, autofill data, bookmarks, local storage, and session storage Cryptocurrency wallet extensions and desktop wallet files Encrypted wallet vault material for potential offline cracking Password-manager extension data Cached cryptocurrency addresses across EVM, Bitcoin, Solana, TRON, TON, and Stacks Shell histories FileZilla FTP configuration and recent-server data Basic system information and the public IP address The harvesting module packages the collected information and a summary log file into a ZIP archive, then uploads it via the Telegram Bot API. Files larger than 40 MB are split into smaller parts, while retry logic ensures that uploading resumes after temporary network failures. The final module is a modified version of the open-source tool GSocket that acts as a persistent backdoor for the attackers. The backdoor establishes persistence through multiple methods, including a LaunchAgent, crontab entries, and modifications to shell configuration files. It connects through a GSocket relay, allowing the attacker to open a reverse shell and remotely control the system. Unlike the other ClickLock modules that self-delete after execution, GSocket is the only component that persists on infected systems. Group-IB warns that "malware leaves a narrow detection window" and that the malicious payloads are hosted on compromised legitimate domains with a clean reputation. Additionally, the script is not flagged as malicious on VirusTotal, and its modules self-delete after execution, leaving no artifacts. Despite this, the researchers say that detection is possible based on the activity generated by the malware, such as osascript launching password dialogs, repeated process termination, mass access to browser profile directories, and outbound connections to Telegram's API. To defend against these attacks, users should avoid pasting in Terminal commands they don't fully understand, especially if the request comes from a website. "Any page that instructs you to open Terminal, regardless of how professional it looks, is attempting to compromise your system," the researchers say. If prompted to enter the login password when the rest of the system appears unresponsive, Group-IB recommends forcing a system shutdown by holding the power button and then booting into Safe Mode to recover the system. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

A new macOS ClickFix campaign is using Terminal commands to silently download, mount, and launch info-stealing malware from malicious disk image (DMG) files. The campaign is infecting Mac devices with the Atomic macOS Stealer (AMOS) infostealer, which steals browser credentials, cryptocurrency wallet data, Keychain data, messaging app information, and user documents. Researchers at Palo Alto Networks Unit 42 first discovered the campaign and say it begins with a fake CAPTCHA page that tells users to open Terminal and paste a malicious command to verify themselves. Once executed, the command downloads a DMG file from an attacker-controlled server, silently mounts it with macOS's native hdiutil utility, locates the application bundle it contains, and launches it automatically. ClickFix is a social engineering technique that displays fake CAPTCHAs, browser errors, or system alerts to trick visitors into copying and executing attacker-supplied "fix instructions." The technique has grown in popularity among threat actors in the past year and has been used by both cybercriminals and state-sponsored hacking groups to distribute malware. While ClickFix attacks involving DMGs are not new, previous campaigns typically relied on users manually opening downloaded DMG files to launch malicious applications or execute scripts from attacker-controlled servers. The campaign spotted by Palo Alto combines both approaches by using a Terminal command to quietly download a DMG file and launch the malware it contains. After running the Terminal command, the attack downloads a malicious DMG from svs-verificationdate[.]beer using curl with the quiet "-fsSL" flags and saves it to the /tmp folder under a random filename. The command then executes 'hdiutil attach -nobrowse' to mount the downloaded disk image without displaying it in Finder or on the desktop. The script then searches up to three directory levels deep for the first available .app or .pkg installer, and if one is found, launches it using the macOS open command. Researchers observed the malware being delivered as a disk image named "s.01M0td.dmg," which mounted a volume containing a self-signed application bundle named "NNApp.app." This payload is part of the Atomic macOS Stealer family, which is used to steal credentials, browser history, authentication tokens, and cryptocurrency wallets from infected devices. The stealer will display a fake System Preferences authentication prompt that asks the user to enter their password, allowing the malware to steal it. According to the researchers, the malware targets eight Chromium-based browsers, including Google Chrome, Microsoft Edge, Brave, Opera, Arc, Vivaldi, CocCoc, and Yandex. It steals cookies, login databases, autofill information, stored payment cards, and browser profile data. The stealer also targets Firefox-derived browsers, including LibreWolf, SeaMonkey, Tor Browser, Waterfox, and Zen Browser, stealing the same information. Palo Alto says the malware searches for and steals cryptocurrency wallet data, including Exodus, Electrum, Atomic Wallet, Wasabi Wallet, Bitcoin Core, Litecoin Core, DashCore, Guarda, Binance Wallet, Dogecoin Wallet, and TonKeeper. The malware also steals Telegram Desktop and Discord data, Apple Notes databases, Safari cookies, Apple Keychain database files, and user documents with the PDF, TXT, or RTF extensions. All harvested data is then stored in a ZIP archive and uploaded to the attacker's server, where the attacker can retrieve it. Of particular interest, the researchers found that the malware will replace legitimate installations of Ledger Live and Trezor Suite with malicious versions, likely to perform crypto theft. The campaign was observed using command-and-control servers at svs-verificationdate[.]beer and 196.251.107[.]171. As a general rule, users should always be cautious when websites instruct them to open Terminal and execute commands. This is especially true when they claim to be part of CAPTCHA verifications, browser fixes, or other troubleshooting steps. If you do not 100% understand what a command does, do not run it. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

To better understand the current state of artificial intelligence (AI) in cybersecurity, SecurityWeek spoke with dozens of security practitioners, researchers, vendors, analysts, and AI experts. The result is a comprehensive snapshot of how AI is being used across the security landscape today. Organized into five key topic areas, this report examines the role of AI through multiple lenses: whether it can be trusted, how organizations are using it, how it can be misused by legitimate insiders, how it is being exploited by cyber adversaries, and where the technology is likely headed next. The five topics are: Generative AI (gen-AI) Agentic AI Shadow AI Machine learning (ML) Artificial general intelligence (AGI) Taken together, these perspectives provide a practical assessment of AI’s opportunities, risks, and likely evolution in cybersecurity. Generative AI Generative AI (gen-AI) is the bedrock of contemporary AI, although it is technically and potentially born out of earlier machine learning (ML, see below). It does what it says: it generates new content (most commonly text) from an AI model (most usually a large language model or LLM). Chatbots are the users’ interface to the LLM, enabling questions (known as prompts) to be applied and responses received in natural language, and answers to be received in natural language. Chatbots are the interface, and LLMs are the reasoning engine. For most people in most direct use the two seem inseparable – just one big gen-AI application. “Gen-AI trains on massive data sets, learns statistical and relationship patterns, and then uses those patterns to synthesize original output from a prompt,” explains Ahmad Shadid, co-founder and CEO at ORGN.com. This is important. It does not create factually correct answers to prompts; it predicts probable answers based on the relationship patterns it has learned – but it does create linguistically correct and compelling responses. Four deep learning architectures power the training for modern gen-AI variants. Transformer architecture (the ‘T’ in GPT and BERT) is used for the LLMs such as ChatGPT, BERT and Claude. Diffusion training generates the variants that focus on creating high quality images and also audio and video. Fundamentally, this process starts with random noise. Mathematically (guided by the user’s prompt) it reduces and reshapes the noise into the required clear result. Diffusion reverses the process of destruction. The generated result is again based on probability – in this case, the probably correct distribution of pixels. Classic diffusion is evolving into diffusion transformer technology (Sora) and ‘flow matching’ (DALL-E 3 and Midjourney) which can be described as next-gen diffusion. Generative adversarial networks (GANs) are trained via two adversarial networks locked in a feedback loop. One creates fake data, while the other learns to detect flaws by repeatedly suggesting flaws and feeding them back to the creation. Both improve until the detector can find no more flaws in the creation. This approach is good at creating images, video and audio, but has largely been superseded by diffusion technology for business use. However, criminals still use GAN-based simple, fast, real‑time face‑swap and voice‑clone models to create deepfakes. The fourth architecture, variational autoencoders (VAEs), use an encoder-decoder architecture for synthetic data generation, data compression, and anomaly detection. “Their main applications are in medical imaging and molecular generation for drug discovery,” comments Shadid. Trust in gen-AI “Gen-AI is a prediction engine. It generates what’s statistically plausible based on patterns it has seen before,” explains Emanuel Salmona, CEO and co-founder at Nagomi Security. “This makes it good at exploration: generating exploit hypotheses, trying different inputs, and connecting a strange behavior to known vulnerability patterns,” expands Albert Ziegler, head of AI at XBOW. “It’s a tool companies can use to automate creative labor,” adds David Karandish, CEO and founder at Capacity. And because of this, “It is becoming closely embedded into security teams’ workflows, from summarizing incident reports to helping draft response plans,” continues Devvret Rishi, general manager of AI at Rubrik. Galina Kho, chief strategy officer at Cyberbay, describes the advent of gen-AI as an efficiency revolution. “It’s not that entirely new capabilities have emerged; it’s that existing ones have become dramatically easier to execute at scale.” The biggest question in the use of AI is whether you can trust an output that is based on probability rather than grounded in known truth. The answer here is 56 shades of ‘No’. “It can be considered both trustworthy and not trustworthy, depending on the intent, the models used and the overall data flow involved,” comments Melissa Ruzzi, senior director of AI at AppOmni. “Gen-AI is not inherently trustworthy,” says Yichuan Zhang, CEO and co-founder of Boltzbit. “It is prone to hallucinations (confident but false statements) and data leakage (reproducing the training content or the context content exactly).” Trever Falconi, director of security and IT operations at HOPPR, explains, “Deploying a gen-AI model is not like installing software. A model trained at one institution will behave differently at another because it learned from a specific set of data and workflows. Move it somewhere new and you’ve introduced a distribution shift: the real-world data it now encounters no longer matches what it was built on, and performance quietly degrades.” Trustworthiness is a complicated question, suggests Aaron Sant-Miller, VP of AI at Booz Allen. “The model is making its best guess at the right response, but it’s not perfect.” Since gen-AI is the bedrock of all AI, there is a trickle-down effect of its strengths and weaknesses into both agentic AI and shadow AI discussed later. Cyber defenders should always be aware that gen-AI can produce errors; but that should not prevent its use. However, as Ruzzi stresses in quoting from Henri Thiel’s 1971 book (Principles of Econometrics), “Models are to be used, not believed. AI should assist analysts, not replace judgment.” The danger is that human nature drives people to believe anything that is said with confidence, and gen-AI can outright lie with confidence. Randell McNair, an adjunct professor at Florida Polytechnic university, explains on LinkedIn, “[Gen-AI] is for all practical purposes a ‘smart’ kid that has been told its whole life it is ‘brilliant’ when in fact, it is just a nearly-8 year old that has never experienced (felt the pain of) a single tangible consequence for being wrong, and has no memory of having ever truly failed someone and had to genuinely regret the shame and embarrassment that should be part of the ‘learning from failure’ process.” Gen-AI use Zhang suggests three areas where gen-AI use offers benefit: SOC productivity (summarizing complex incident logs and writing initial draft reports); secure coding (assisting developers with boilerplate code that adheres to security standards); and vibe coding (assisting non-developers with coding software applications from scratch). “Many enterprises use these models to generate documents, write articles, generate software, or replicate the messages a human would send when orchestrating a larger workflow,” says Sant-Miller. “It helps draft emails, summarize information and reduce manual effort,” adds Travis Springer, president at Sagiss. “Medical imaging teams are piloting vision-language models to surface findings from imaging studies,” says Falconi, “and researchers use synthetic data generation to fill gaps where real patient data is scarce or sensitive to use at scale.” New uses for gen-AI are continually being developed, but within cybersecurity, the most effective use comes from agentic-AI (see below) which can transform gen-AI from a passive responder into an active engager. Gen-AI misuse The misuse of gen-AI within enterprises is usually unintentional: it emanates from a failure of governance around the technology. Ungoverned use of gen-AI is always a misuse of AI. Individuals begin to rely on AI to provide quick (but not necessarily accurate) answers to questions or problems. If an AI model is deployed across the company without adequate control over its use, this can lead to a degradation of personal skill levels and an ungoverned increase in costs (the idea that AI is cheap is wrong). If access to a chatbot is not provided, employees will use external services with even less control (see shadow AI below). The problem comes from both individuals and management treating AI as a solution rather than an assistant. For example, there is potential to use AI’s coding capability to reduce the number of expensive qualified programmers. Anyone who can prompt an AI can now produce a program – but such programs will inevitably introduce new vulnerabilities. This problem goes away if qualified people use AI as an assistant, a tool to improve performance, rather than a means to reduce expensive headcount. Governance is the key to preventing the misuse of gen-AI. Gen-AI abuse By abuse, we mean bad actor use. In cybersecurity, bad actors always adopt new technology at a faster rate than legitimate business. This has certainly been true with AI. The primary reason is the power and complexity of AI. When an enterprise develops an internal AI application, it must be certain to get it right or face a possible self-inflicted catastrophe. This takes time. Criminals don’t have this concern. If something they implement doesn’t work perfectly, they just start again at no disruptive cost. The result is that new attacks tend to appear before adequate defense appears – the defenders may expect the attacks but have no detailed knowledge of them before they start. Zhang highlights three primary examples of gen-AI abuse: hyper-realistic phishing (eliminating the grammar/spelling ‘tells’ of traditional phishing); polymorphic malware (using gen-AI to subtly rewrite malware code to bypass signature-based detection); and vibe coded phishing websites and/or aggressive attacking software (using gen-AI to subtly rewrite apps that look like the original apps, but steal the user’s sensitive data). Gino Sciretta, CEO at BranditScan, warns, “Generating a convincing fake identity now takes seconds. Detecting one reliably still requires specialized tools and trained analysts. Most platforms and most users are not equipped for that. The technology has outpaced the safeguards, and the gap is widening, not closing.” Gen-Ai has introduced a step change in the quality of adversarial social engineering. It can be used to profile an individual by analyzing any social media footprint, and to then develop a targeted lure. It can build a compelling backstory to the attack, and prepare a false or disguised website to capture personal data. “Gen-AI makes mass targeted phishing, malware iteration and vulnerability research much more accessible to bad actors. Tools like WormGPT strip out the safety guardrails entirely, so attackers get the same speed advantages as regular GenAI but without the friction,” comments Harshit Agarwal, co-founder and CEO at Appknox. Image and voice cloning, and video generation is creating a deepfake scenario that increases a BEC and VEC threat that will only escalate in scale and sophistication. “Ninety-four per cent of AI-generated images had visual artifacts, but those artifacts were so subtle that the majority of targets never noticed them,” adds Sciretta. “The telltale signs are there if you know where to look, such as inconsistent light reflections in the eyes, where one pupil reflects a window and the other reflects something entirely different. But consumers are not trained to look for that, and the generators are improving faster than public awareness.” But he adds, “The most dangerous development is not the fake photos. It is the fake conversations. AI-driven chat systems can now sustain emotionally convincing dialogue over days or weeks, accelerating emotional manipulation roughly 300% faster than a human operator could.” As Ted Miracco, CEO at Approov, says, “The danger isn’t just what AI can do; it’s how fast it acts before anyone notices.” For now, criminals are primarily using AI to improve what they already do: more efficient social engineering, discovery of vulnerabilities in code, and generation of exploits. The next step will be automating the complete process of attack through agentic AI systems. Gen-AI future Amara’s law (Wikipedia) states, “We overestimate the impact of technology in the short run and underestimate the effect in the long run.” The difficulty with AI is that the short run could be next week, while the long run is probably just a few months. By the time most people really understand what is happening, what is happening has already changed. Nevertheless, some brave experts have held a finger to the wind and given their predictions. Ronan Murphy, chief data strategy officer at Forcepoint, believes, “Gen Al will be embedded in everything – every spreadsheet, every video, every workflow. The distinction between ‘using AI’ and simply ‘doing your job’ will essentially dissolve. For security teams, that means the surface you’re trying to protect keeps expanding, probably faster than your policy framework can keep up.” Zhang sees a future with SLMs (small rather than large language models). “We are moving toward ‘small language models’ that are hyper-specialized for specific domains (like a model trained exclusively on Linux kernel vulnerabilities) to reduce noise and increase accuracy.” Sant-Miller is more circumspect, wondering if the very nature of current AI makes its future indeterminable. “The future of gen-AI is a complicated one,” he says. “Models continue to get larger and, accordingly, more powerful. But there are two oppositional forces. Larger models are more expensive – both to train and to use – so capability comes at a cost. And models are trained off human generated content that provides a proxy on human reasoning. What then when most of the content is AI generated and no longer provides that proxy. These are the big questions we need to resolve as an industry.” Agentic AI Agentic AI is an evolutionary extension of chatbot gen-AI. Simplistically, a user asks the chatbot a question and then behaves in accordance with the answer received. With agentic AI, the gen-AI returns its answer to an agent, which can then instruct other organizational tools to fulfill the required behavior. But agentic AI is far more complex than this simple view – it is a task controller (or decision-maker) that uses an LLM as the primary cognitive source. The agent, or agents, are dynamic, stateful and adaptive, goal-driven and aware of the tools it or they can use to fulfill the goal. “Agentic AI converts LLMs that answer questions into software that automates the execution of work,” explains Eric Syphard, executive lead for AI at Booz Allen. “Think LLMs with hands.” Technical breakthroughs in long-memory context, tool use and evaluation enable agentic systems to complete complicated multi-step processes with little to no human oversight. “This isn’t just a new version of AI,” he continues, “It’s an entirely new operating and economic model for delivering labor: ‘labor as software’.” Miracco adds, “Agentic AI doesn’t just answer questions, it can also act autonomously on your behalf. By calling APIs, running code, managing workflows, making decisions, the LLM is now the brain controlling anything it has been granted access to, such as your phone.” Agentic AI is a meaningful step beyond gen-AI. “Rather than responding to a single prompt, an agent reasons, plans and acts. This often happens across multiple tools, data sources and application integrations, with minimal human involvement at each step,” explains Murphy. “You give the agent a goal, not an instruction, and it figures out how to get there.” Trust in agentic AI Since agentic AI uses gen-AI for cognition, it inherits the gen-AI trust issues, but with greater danger from direct access to company assets coupled with the potential for autonomous action on those assets. Can it be trusted? “It depends entirely on how it’s built. An autonomous agent with unrestricted access to your systems is a liability (see OpenClaw). An autonomous agent with scoped permissions, human approval workflows, audit trails, and budget controls is a tool you can actually rely on. Agentic systems must be transparent to more than one user,” says Marcel Folaron, CEO at Cochat. He adds, “The trust question isn’t binary. It’s architectural. Can you see what the agent did? Can you control what it’s allowed to do? Can you review its work before it takes consequential action? If yes, you have a trustworthy system. If no, you have a risk.” Can it be trusted? “Only if it is actively governed, which most organizations are not today equipped to do. Agents need broad access to function, and once that access is granted, the output rarely gets reviewed or reduced,” warns Agarwal “They bypass the UI layer entirely, interfacing directly with APIs in ways that don’t generate the session data or behavioral signals that security teams use to detect anomalies. This removes traditional visibility, especially in API-driven and mobile-first environments. Their traffic also looks legitimate, often not appearing in the logs anyone is actually monitoring.” Syphard adds, “Establishing trust requires robust identity and access governance, treating agents as nonperson entities with unique identities that must be continuously authenticated, authorized, audited, and monitored – much like human users – as agents can introduce insider threat-like risks.” Kho suggests, “Trust in agentic AI comes from how well it’s constrained. It doesn’t come from how good the model is. Therefore, the most important question is not how accurate it is, but what is the worst thing it can do if it’s wrong. Because in practice, risk is defined more by permissions than by performance.” You Mon Tsang, founder and CEO at ChurnZero, agrees with the need for governance to ensure trustworthy agentic AI. “Trust has to be earned through containment: considered data access, human-in-the-loop checkpoints, and logging everything” Zhang adds, “Trust is a major hurdle. Because agents can execute actions (like deleting a user or changing a firewall rule), they require strict guardrails and ‘human-in-the-loop’ checkpoints to prevent runaway processes… it is very important to have the guardrails in place for any agentic AI.” A ‘human in the loop’ is an important part of the governance mechanism that allows trust in agentic AI. But it’s a moving target. As the quality of AI, the speed of doing business, and the volume and pace of attacks all increase, so the pressure to reduce the level of human constraint over agentic action also grows. Continuously ensuring the correct balance between human and autonomous action is an important factor in maintaining maximum performance with maximum trust. Agentic AI use Current implementation of agentic AI is cautious but accelerating: cautious because most organizations understand this is a beast that is difficult to tame; accelerating because the benefits are real. The ability to act at machine speed with minimal human activity is a boon to cybersecurity. Zhang cites the potential for ‘autonomous patching’. “An agent identifies a vulnerability, finds the patch, tests it in a sandbox and deploys it,” he says. “It’s being used for workflow automation, assistants, ticket triage, and research support. In security teams, AI is primarily helping analysts gather context, not make decisions,” adds Kho. “Enterprises use agentic AI for tasks that are repeatable, time-consuming, and currently falling through the cracks – monitoring, reporting, data aggregation, alert triage, content generation, compliance checks… The value is highest for small and mid-size teams that lack the headcount to do everything manually,” says Folaron. “Enterprises are already deploying agentic AI to write code, triage security alerts, manage infrastructure, and automate workflows that previously required entire teams. The productivity gains are very real,” adds Jim Sherlock, VP of AI & cybersecurity R&D at ProCircular. “For enterprises, the real opportunity is closing the gap between finding a problem and actually resolving it. That gap – the investigation, the cross-team coordination, the verification that a fix actually held – has been almost entirely manual for decades,” says Salmona. “Agentic systems are starting to absorb that work. But the ones doing it well are grounded in deep environmental context. The ones that aren’t grounded in context are generating activity without reducing exposure. Those are very different things.” Agentic AI misuse Misuse of agentic AI is generally accidental, rooted in its lack of governance, guardrails, and careful design, and exacerbated by the unpredictability of machine reasoning. A never-ending logic loop (continuously striving but never succeeding) could keep the agent running effectively forever unless manually halted. Such never-ending loops could be caused by hallucination, bad design, or a failure of the agent/LLM to recognize that its goal has already been achieved. “An important aspect of trust in AI agents is training them to know their limits. No one wants to be stuck in an endless loop when a human could easily step in and solve the problem,” comments Karandish. “The problem that keeps me up at night is simple: an agent is only as good as the context it operates on,” adds Salmona. “Give it an accurate, correlated view of your environment – your assets, your controls, your exposures, your threat landscape – and it can make decisions that genuinely reduce risk. Give it incomplete data and it will still act. Confidently. Quickly. Incorrectly. Automation without verified context is just a faster way to be wrong at scale.” It is this type of accidental misuse of agentic AI that feeds the widespread trust problems. “For agentic AI to succeed in the future, safety, governance and recoverability must be top priorities,” warns Rishi. “The unintended consequences are real. Agents can drift – taking actions that technically follow their instructions but produce outcomes nobody intended. They can accumulate permissions over time if nobody’s auditing them,” adds Folaron. Agentic AI abuse The complex reality of agentic AI is that while it benefits enterprises, it simultaneously increases their attack surface – and that bad actors both attack agentic systems and use their own agentic systems to speed and scale their attacks. To make matters worse, enterprises are often unaware of the expanded attack surface – downloaded apps are sometimes provided with built-in, but unspecified, agentic systems. “As for the bad actors, right now, the most common ways they are using AI are to conduct old-school attacks at a much faster rate or publish malicious AI projects to infect early adopters riding the hype. But over time, as AI gets into more critical systems and companies give their internal agents more authority, we are going to see a lot more prompt injections used to manipulate these systems,” adds Amit Chita, field CTO at Mend.io. Bad actors target the agentic attack surface in multiple ways, most commonly via prompt injections. “Prompt injection attacks can quietly redirect an agent to exfiltrate data or build delayed-execution payloads from inputs that looked harmless on arrival,” warns Agarwal. “In my view,” comments Shadid, “cyber offenses will become near-fully agentic within one to two years. Defense will have to become autonomous to match.” Ron Longo, CEO at TrustLogix, suggests, “Cybercriminals will leverage the sheer scale and intelligence of agentic AI to launch more advanced and overwhelming phishing and malware attacks. Because agentic AI can be autonomous, it can automate and orchestrate these attacks with greater sophistication than in previous eras of cybercrime.” We’re not there yet. “They don’t need full automation. Even a partial automation significantly increases their efficiency and return on effort,” explains Kho. But it’s going to get worse. “Agentic AI enables attackers to automate reconnaissance, vulnerability discovery, exploitation attempts, and adaptation across many targets at once. Instead of just generating content, it can pursue an objective across multiple steps,” says Ziegler. “In other words, the shift is from AI generating artifacts to AI conducting operations.” Murphy adds, “The concern looking ahead is agentic systems that can identify a weakness autonomously, exploit it, exfiltrate data and cover their tracks, all without a human in the loop on the attacker’s side. We’re not fully there yet. But the trajectory is obvious, and the security industry is not moving fast enough to get ahead of it.” That trajectory has already been confirmed by Anthropic’s discovery of a largely automated attack from a China-linked state-sponsored threat actor in November 2025. “Instead of a human hacker manually probing a system, an AI agent can scan for vulnerabilities, test exploits, exfiltrate data, and cover its tracks – all without human intervention. Spear-phishing campaigns that adapt in real time based on the target’s responses. Automated reconnaissance at a scale that wasn’t possible before. The same autonomy that makes agents useful for defenders makes them dangerous in the wrong hands,” says Folaron. Agentic AI future “Given the potential productivity impact of agentic AI, I am confident it will become a core part of how businesses are run,” says Tsang. Within cybersecurity, “We will likely see the rise of ‘agentic orchestration’, where multiple specialized agents (a ‘detection agent’ and a ‘remediation agent’) collaborate to manage entire security lifecycles” suggests Zhang. But the complexity of agentic will need to be matched by complex controls. “What I’m certain about is that static, rule-based controls won’t keep pace. You need data security that understands context – what the agent is doing, what data it’s touching, what risk that represents – and adapts dynamically. This idea of adaptive security is so critical for today and for tomorrow. The old ‘block or allow’ binary doesn’t work when an AI agent is making hundreds of data decisions per minute,” warns Murphy. “The future is agents that run continuously, learn from their results, collaborate with each other, and only surface to humans when a decision requires judgment. But that future only works if we solve governance first. Autonomy without accountability is a disaster waiting to happen,” says Folaron. One area that is still heavily debated is the degree of autonomy that will be allowed in future agentic systems. “In the future, agentic AI will be successful where governance is strong, but risky where automation is mistaken for maturity. It should be supervised automation, backed by clear boundaries and continuous validation. The future isn’t autonomous security,” says Kho. “I expect more systems built from many short-lived agents with narrow goals, persistent coordination, strict policy controls, and independent validation,” says Ziegler. “Agentic performance is not just about picking one favorite model forever; sometimes different models contribute different strengths at different points in the loop. The real frontier is not ‘more autonomy at all costs.’ It is autonomy that remains auditable, evidence-driven, and safe to operate in production.” Shadow AI Shadow AI is AI installed within the enterprise but unknown to the IT and security departments, or external AI used by an employee without reference to the IT and security department. “Shadow AI is the cybersecurity version of shadow IT, except the blast radius is orders of magnitude larger. It enters enterprises the same way every unsanctioned tool does,” comments Sherlock. Agentic shadow AI usually enters when an employee finds an open source tool and installs it to improve his or her work performance. However, “Unlike shadow IT, shadow AI operates inside workflows, not outside them. That makes it harder to detect and easier to trust” warns Agarwal. This is especially pertinent when the AI is included but undisclosed agents within a downloaded cloud SaaS app. If these apps are installed, they can arrive with one or more pre-approved valid OAuth tokens granting access to different parts of the customers’ infrastructure. If an attacker gains access to such an OAuth token, that attacker gains easy access to frequently sensitive information. The potential extent of this access can be massive – as seen in the Salesloft Drift compromise in 2025. Drift is an AI chatbot and website engagement tool for Salesforce. Attackers stole its OAuth tokens, gaining access to organizations that installed Drift. Subsequently, more than 700 organizations were compromised via the shadow AI within Drift. If any of those organizations were unaware of the agentic AI within Drift, they were effectively compromised by shadow AI. A further example of shadow AI occurs when an employee uses an external chatbot, without the security department’s knowledge, to access gen-AI. That employee could then perform actions inside the organization based on incorrect, inadequate or simply hallucinated information. Nevertheless, “The productivity benefits [of using shadow AI] are real, and I want to be clear about that,” says Murphy. “People aren’t using these tools because they’re reckless. They’re using them because they work. The problem is that productivity gains and data risk are happening simultaneously, and organizations frequently have visibility into neither.” Shadow AI trust Ultimately, there can be no trust in shadow AI. What cannot be seen, cannot be trusted. “Models that haven’t been vetted can be manipulated, can inherit biases from unvetted training data, or can behave unpredictably when they encounter inputs outside their training distribution. And because no one is monitoring them, that unpredictability goes undetected,” warns Falconi. Shadow AI use “Shadow AI is what happens when good intentions meet convenience. An employee discovers a new AI tool – a browser plugin, a code assistant, a productivity app – and starts using it because it genuinely helps them get work done faster,” explains Murphy. In the short term, shadow AI can benefit the company. But in the long term, “The risk of a massive data breach or regulatory fine (GDPR/CCPA) far outweighs the efficiency gains,” adds Zhang. “People start using shadow AI because it genuinely helps them work faster. The problem is that the productivity gain comes with unquantified risk. You’re trading speed for control, and you often don’t realize what you’ve given up until something goes wrong,” says Folaron. Shadow AI misuse Strictly speaking, any and all use of shadow AI is a misuse of AI, simply because it hasn’t been sanctioned by the company. This misuse can cause serious problems, albeit accidental. “In healthcare, the scenario plays out regularly,” comments Falconi. “A radiologist finds an open-source model and starts using it to help triage scans. A researcher pipes imaging data through a consumer AI tool to accelerate analysis. Nobody in IT, security, or compliance knows it exists. There’s no audit trail, no documented provenance on the data it’s touched, and no version control.” The compliance issue is magnified within shadow AI – it can cause serious regulatory issues. “When something goes wrong, there is no way to trace it, contain it, or demonstrate to a regulator that reasonable precautions were taken.” The regulatory exposure varies by industry, but the accountability gap is consistent. “In healthcare, that’s a compliance failure, a potential HIPAA liability. In financial services, it implies SEC and FINRA oversight. In any organization handling EU data, GDPR applies. Across all of these regulations, the legal position is the same: an enterprise that cannot document how an AI system was built, validated and monitored has no defensible posture when that system causes harm,” he adds. However, “The security implications go beyond compliance gaps. When employees use unsanctioned AI tools, sensitive data often leaves the organization’s perimeter entirely, fed into external APIs or platforms with opaque data retention policies. Unlike traditional shadow IT, the exposure isn’t just a misconfigured tool. It’s proprietary or protected data potentially being ingested into systems that the organization has no visibility into and no contractual control over,” continues Falconi. “These tools often use ‘public’ settings, meaning any sensitive data entered (like proprietary source code or customer PII) becomes part of the vendor’s training set, effectively leaking it to the public,” explains Zhang, adding, “Bad actors look for exposed API keys or ‘leaked’ company secrets within public AI datasets to gain a foothold in the target network.” And Geoff Mattson, CEO at SecureAuth, warns, “When someone configures an MCP server on their laptop to give Claude access to internal databases, that’s shadow AI with real teeth.” Shadow AI abuse “Shadow AI is more of an attack surface than an attack tool,” comments Folaron. The biggest problem introduced by shadow is this larger attack surface: “Every unsanctioned AI integration is a potential data leak, a potential compliance violation, a potential entry point. The risk is structural, not just behavioral,” continues Murphy. Unsanctioned tools running inside an enterprise perimeter are, by definition, unmonitored. “That makes them a viable vector for malicious insiders. An employee using an unvetted tool to exfiltrate data, manipulate outputs, or conduct competitive intelligence with little risk of detection is risky. Because shadow AI exists outside formal IT systems, the usual tripwires aren’t in place,” expands Falconi. Bad actors also attempt to enlarge and manipulate this hidden attack surface by tricking employees into downloading deliberately poisoned open source models. “Someone can download and deploy a model that has been tampered with upstream, and it operates invisibly inside the enterprise. Without provenance documentation or a validation process, there’s no way to know what you’re running or whether it’s been manipulated,” continues Falconi. “In cybersecurity, problems rarely start with attacks; they start with blind spots. The issue with shadow AI isn’t in trusting it but not having full awareness of it,” explains Kho. Shadow AI future The correct future for shadow AI is known, but whether it is achievable is moot. “Shadow AI will grow before it shrinks. The tools are too accessible and the productivity incentives too strong for the trend to reverse on its own. Locking everything down doesn’t work either. Overly restrictive policies don’t eliminate shadow AI; they just drive it further underground where it becomes even harder to detect and govern,” argues Falconi. Despite the problems involved in ridding companies of their shadow AI, many practitioners believe it can and will happen. “The trajectory is predictable,” says Tsang. “IT will catch up. Organizations that move fastest to offer sanctioned, secure AI tooling will have the least shadow AI problem, because the incentive to go around IT disappears when IT is actually delivering.” Falconi agrees with this. “When organizations provide practitioners with secure, auditable platforms that offer the speed and flexibility they’re looking for, the appeal of unsanctioned tools diminishes. Shadow AI exists because the governed alternative is too slow, cumbersome, or unavailable. Fix that, and you address the root case rather than the symptom.” Salmona adds, “The organizations that solve this won’t do it by banning tools. They’ll do it by making the approved path faster than the shadow path. That’s a design problem, not a policy problem.” History, however, begs to differ. Our shadow IT (that is, IT without any AI) has been with us for many years. Not only has industry failed to solve shadow IT, but the problem is also bigger than ever. The idea that we will in time solve the shadow AI problem, which is likely to be more intransigent than shadow IT, is decidedly moot. Machine Learning (ML) Industry has been using machine learning AI systems for many years – long before gen-AI found popular usage. ML and gen-AI are related. Both are trained on data. But while gen-AI is trained on mass data scraped from the internet, ML is trained on data constrained to its primary, usually local, task. Because of the more constrained source data, the output is deterministic while gen-AI’s output is probabilistic. “Text recognition tools/systems (OCR) are a good example,” says Folaron. “They are ML tools that have been trained on thousands and thousands of papers. When you scan a document, they identify the text fairly accurately. If you scan the same page twice it will most likely give you the same output.” ML uses statistical algorithms to find anomalies in data. “In security,” says Zhang, “it is primarily used for pattern recognition and behavioral analysis.” That behavioral analysis is used to locate indications of compromise by highlighting deviations from the norm. ML trust “In general, ML is more trustworthy than gen-AI as it is used to analyze existing content, not generate new content,” says Ruzzi. However, “ML is only as reliable as what it was trained on, and models trained on incomplete or outdated data will miss threats that don’t look like past threats. Attackers know this. They study detection logic to craft inputs that stay inside the boundaries of what looks normal, effectively teaching themselves to evade the systems designed to catch them. ML systems also fail silently. When they miss, they do not alert. They normalize,” warns Agarwal. “Within its trained domain, ML can be exceptionally reliable, often more consistent than human analysts who tire, get distracted, or become overwhelmed by volume. But it has blind spots. ML models are only as good as their training data. If the training data doesn’t include a particular type of attack, the model won’t catch it,” agrees Folaron. “The honest answer is that ML is trustworthy as one layer of defense, not as the only layer. It’s excellent at reducing noise and surfacing what matters. It’s not a replacement for human judgment on critical decisions.” “ML in cybersecurity is trustworthy when it is used to augment human decision-making, not replace it,” adds Sciretta. “The risk comes when organizations treat ML as a set-and-forget solution. Models degrade over time as the threat landscape shifts. If you are not continuously retraining, validating, and auditing your models, you are building on a foundation that is slowly crumbling underneath you.” Rishi says, “The key challenge is making machine learning decisions observable and explainable. Organizations need a clear understanding of how outcomes are derived, what signals they depend on, and where those decisions can be validated or overridden, or they risk relying on decisions they don’t fully understand or control.” ML use “Machine learning applications in cyber look toward risk analysis, behavioral analysis, and threat detection. Each machine learning approach carries different tradeoffs based on the method selected under the hood. Some are less powerful but generalize to new use cases better and are more transparent (easy to explain why they said or did things). Others are more focused and black box. Those are tradeoffs an AI team balances when delivering these features,” says Sant-Miller. “ML is the foundation of many AI applications in cybersecurity. It involves using models that are trained on past data to identify patterns, spot unusual activities and highlight behavior that differs from what’s considered normal,” continues Agarwal. “Enterprises use it for threat detection, malware analysis, risk scoring and behavioral monitoring across endpoints and networks. Its value comes from operating at a scale no human team can match.” Folaron adds, “Threat detection – spotting anomalies in network traffic, endpoint behavior, or user activity. Email filtering. Fraud detection. Vulnerability prioritization – figuring out which of your 10,000 vulnerabilities actually matters. User and entity behavior analytics (UEBA) – learning what normal looks like for each user and flagging deviations. Log analysis at scales no human team could process manually.” Zhang provides a specific UEBA example: “Flagging when a user suddenly downloads 5GB of data at 3:00 am.” Ruzzi says it is used “For deep analysis of numerical content, large volumes of data, or data analysis where the intent is to be as deterministic as possible, ML is normally preferred over gen-AI, or is used as an intermediate step to analyze data to then be used by gen-AI.” Despite the potential value of ML in cyber defense, Rishi stresses, “The key challenge is making machine learning decisions observable and explainable. Organizations need a clear understanding of how outcomes are derived, what signals they depend on, and where those decisions can be validated or overridden, or they risk relying on decisions they don’t fully understand or control.” ML misuse ML doesn’t lend itself to active misuse by employees: what misuse occurs is by omission rather than commission. Salmona gives an example – model drift. “Accuracy at deployment is not accuracy six months later. Environments change, attacker behaviors evolve, and the model doesn’t automatically keep up. Most organizations have no systematic way to monitor for that degradation. They trust the tool because it worked before. That assumption will eventually cost them.” ML abuse The same advantage of automated analyses means that adversaries use their own ML systems. “Any system that helps automate selection, prioritization, or iteration can make attackers faster and more persistent.” It is a key component in the ongoing industrialization of cybercrime. “The general pattern is that cyber operations stop being bespoke and become industrialized,” says Ziegler. Attackers also use ML for evasion; “Using their own ML models to simulate a target’s security system and find ‘blind spots’ where their attacks won’t be detected,” says Zhang. “Evading detection systems by training models that learn what triggers alerts and then optimizing attacks to stay below the threshold,” expands Folaron, adding. “Automated password cracking. Generating polymorphic malware that mutates enough to bypass signature-based detection while maintaining its payload. And increasingly, using ML to prioritize targets – analyzing publicly available data to identify the most vulnerable or valuable organizations to attack.” Ruzzi adds, “Bad actors can use ML to automate reconnaissance or map network vulnerabilities.” But bad actors will also directly attack enterprise ML systems. “It is susceptible to adversarial attacks where attackers ‘poison’ the training data to make the ML model ignore specific types of malicious activity,” warns Zhang. ML future The future for machine learning is a convergence with gen-AI. “ML in cybersecurity is moving toward real-time, adaptive defense – systems that don’t just detect known patterns but continuously learn and respond to new ones. The convergence with agentic AI is where it gets interesting. Instead of ML flagging a threat and waiting for a human to respond, you’ll have ML-powered agents that detect, investigate, and contain threats autonomously within defined boundaries. Speed of response becomes the competitive advantage, because attackers are already operating at machine speed,” explains Folaron. The reasoning is clear. “Where ML is going is toward more adaptive, continuously retrained models that can keep pace with how fast attacker behavior evolves. In other words, fewer static rulesets and more real-time learning from live environments,” agrees Agarwal. “Moving from “reactive” detection to “predictive” defense where ML models can forecast where an attacker is likely to move next based on early-stage lateral movement,” confirms Zhang. However, whether ML can ingest agentic strengths without simultaneously inheriting agentic’s concerns, remains to be seen. “ML is heading toward tighter integration with agentic systems – models that both inform and trigger action. That’s where the real leverage is, and also where the risk compounds,” says Salmona. “An ML model feeding a bad signal into an automated workflow produces a wrong action at machine speed, across your entire environment, before anyone realizes something is off. Context and continuous validation aren’t optional anymore – they’re the difference between automation that reduces risk and automation that amplifies it.” Artificial General Intelligence (AGI) Many of the best known AI frontier labs, such as OpenAI, DeepMind, Anthropic, and xAI, are pursuing the idea of general artificial intelligence (AGI). “AGI is a hypothetical stage of AI capability that allows machines to replicate or exceed all dimensions of human cognitive capability. Everything from reasoning, adapting, novel concept creation, and (in theory) consciousness. With all scientific endeavors, everything feels impossible until the next breakthrough brings you closer. Two hundred years ago we didn’t have cars, and now flying across the country or to another planet feels normal. Fifty years ago, we didn’t have the internet, and now the vast majority of our communication is electronic,” explains Sant-Miller. A true and accurate definition of AGI is elusive. “I don’t really know how to define AGI, but I also don’t think it matters. Something will be built in the next few years that will leave us all in wonder. The models are improving fast enough that quibbling over the definition can’t be the point,” comments Tsang. “True AGI, with the ability to learn from experience for critical decisions, is still widely considered decades away by most researchers,” adds Zhang. Many people believe AGI will be achieved, others are less certain, but most agree that the task is daunting and the timeline obscure. “It’s neither inevitable nor impossible, and anyone who tells you they know the timeline is guessing,” says Folaron. “We’ve made remarkable progress in narrow AI, but the gap between what current systems do and what AGI requires is often understated.” AGI trust Trust in any future AGI entity will be a moral dilemma: should we trust the decisions of an entity that has vastly more knowledge and deeper intelligence than ourselves? Will it make the right decision between taking an action that would benefit hundreds while harming dozens? Everyday life is full of such dilemmas for everyone. But should we be willing to delegate the power of choice to something that is ultimately a machine? The answer will be the answer to almost all cybersecurity questions: ‘It depends’. But on what, we don’t yet know. AGI use, misuse and abuse “The practical stance is use it, and build guardrails as it gets more capable. The dangerous scenarios aren’t ones where some pundit or AI CEO declares AGI achieved. They’re ones where a highly capable system makes a catastrophic decision or is turned against targets by a sophisticated adversary. And the technology we have today is powerful enough to be very ready,” suggests Tsang. Catastrophic decisions already occur with current AI, which seems to be moving inexorably toward increasing autonomy. Guardrails are the safeguard, but they haven’t yet prevented all catastrophes. “I think the more practical question for security leaders isn’t whether we achieve artificial general intelligence, but whether we’re ready for artificial general authority. We’re already giving AI agents meaningful decision-making power over sensitive systems. The governance frameworks, identity architectures, and trust models are what need to be built right now, not after some theoretical singularity arrives,” warns Mattson. But here is another of cybersecurity’s moral dilemmas. Should we hobble a racehorse so that it cannot cause collateral bystander harm, or should we set it free to run fast and break things? Safety or potential greater business profit? “The big risk in AGI is similar to gen-AI, where the focus on functionality clouds proper cybersecurity due diligence,” comments Zhang. “By trying to make AI as powerful as it can be, organizations may misconfigure settings, leading to over-permissions and data exposure. They may also grant too much power, creating a major single point of failure,” warns Ruzzi. If AGI is ever fully realized, the effect on cybersecurity will be profound. “If AGI is achieved, cybersecurity as we know it fundamentally changes for both sides. On defense, you’d have systems that can genuinely reason about novel attacks, understand attacker intent, and adapt defenses in real time without human guidance. On offense, you’d have attackers with access to systems that can find and exploit vulnerabilities faster than any human team could patch them,” comments Folaron. “If achieved, it would be the ultimate zero day event,” warns Zhang. “An AGI could find and exploit vulnerabilities in every system simultaneously. Conversely, an AGI-based defense could theoretically create a ‘perfect’ security posture that adapts in real-time to any threat, effectively ending the era of human-driven hacking.” Rishi adds, “In an AGI world, recovery and resilience are the primary safety nets. Since even the best governance cannot predict every move a general intelligence might make, organizations must have rewind capabilities.” AGI future “We are still many major breakthroughs away from AGI. I’m far from an expert to estimate when those breakthroughs will be realized, how far they will move us forward, and what they will change. But the beauty of science is that things often thought impossible are proven to be possible,” says Sant-Miller “We keep debating whether machines can truly think. Meanwhile, they’re beating the MIT math team in problem solving, passing the bar exam, writing exploits, and running sophisticated operations. The philosophical debate is becoming irrelevant. The distance between very impressive narrow AI and AGI is narrowing faster than most people are prepared to accept. Our take is that AGI isn’t far off, but it still remains a fuzzy threshold. We may cross that threshold without realizing we’ve even crossed it,” comments Miracco. Today, the idea of AGI is magic. Tomorrow it may be science. It is not a new concept in literature, but unless we learn from today’s mistakes made in current AI’s development and use, tomorrow’s genuine AGI may really become a world of machine-versus-machine, with ever-decreasing human relevance. Amara’s law applies. The arrival of true AGI is likely to be further off than most people predict, but when it comes it will be far more beneficial and far more dangerous than we can currently imagine. Related: Shadow AI Risk: How SaaS Apps Are Quietly Enabling Massive Breaches Related: The Wild West of Agentic AI – An Attack Surface CISOs Can’t Afford to Ignore Related: AI Fuels ‘Industrial’ Cybercrime as Time-to-Exploit Shrinks to Hours Related: Cyber Insights 2025: Social Engineering Gets AI Wings

A likely North Korean threat actor has phished software developers at almost 100 organizations with fake job and code-review lures to steal cryptocurrency and credentials. According to new analysis from Proofpoint, which tracks the cluster as UNK_DeadDrop, the campaign sent more than 250 emails in April and May 2026. Targets were mostly US-based and worked in technology, education or finance, with a focus on cryptocurrency firms. Each email linked to a GitHub or GitLab repository dressed up as a coding assignment, with instructions to clone it and open the folder in an editor such as VS Code or Cursor. The pretexts shifted across the weeks: jobs for full-stack and "agent lead" developer roles, requests to peer-review open-source code, a task to test an ERC-4626 smart-contract vault in Foundry and a project building AI payment agents. Inside each repository sits a hidden tasks.json file rigged to run the instant the folder opens, abusing a legitimate editor feature. VS Code at least shows a trust prompt; Cursor shows none, running the payload silently with no interaction. The script installs a malicious VS Code extension posing as a Google service, which relaunches the malware whenever the editor reopens on macOS or Linux. The chains then split, with Linux and macOS getting a Go remote access trojan from the open-source Overlord framework, while the Windows version runs as JavaScript inside the editor itself, leaving no file on disk. Fake Prompts and Drained Wallets Whatever the platform, the goal is the same: drain cryptocurrency and credentials. The malware scans for browser data and a long list of cryptocurrency wallets, including: Browser-based wallet extensions such as MetaMask, Phantom and Keplr Desktop wallet apps including Exodus, Electrum and Ledger Live Saved passwords and cookies from Chrome, Brave, Edge and Firefox To reach protected secrets, the macOS and Linux versions show a fake password dialog, then reuse the captured password to relaunch as root and dump the keychain or keyring. The Windows variant instead bypasses Chrome's app-bound encryption. After uploading the haul, the loader deletes its files to cover its tracks. Proofpoint said they saw clear echoes of Contagious Interview, the long-running North Korean operation that baits developers with fake recruiters, but is tracking UNK_DeadDrop separately. The team cited the campaign's email-led delivery, the industrial scale of repository creation and a self-contained payload that survives infrastructure takedowns as key differentiators. "While attribution to a known actor remains unconfirmed, Proofpoint continues to track this ongoing activity as an independent cluster," the company concluded. North Korea-aligned crews have targeted developers this way since at least 2022, using fake recruiter personas and poisoned developer tools.

Brave Software has announced the public release of Origin, a paid minimalist, bloat-free version of its browser that strips out cryptocurrency, AI, rewards, and other monetization-focused features. The browser maker says Brave Origin is designed for users who want a more streamlined, privacy-focused browser without the company's optional revenue-generating services and integrations. "Today, Brave is announcing the release of Brave Origin, a paid version of the browser for users who don't need all of Brave's out-of-the-box features, but still want the privacy that only Brave offers," the company explains. According to Brave, the browser turns off features such as Brave Rewards, Brave Wallet, Brave VPN promotions, Brave Leo AI, Brave News, Brave Talk, sponsored images, and other promotional or monetization components included in the standard browser. The company says Brave Origin continues to include Brave Shields, the browser's built-in privacy and ad-blocking protections. Brave Origin is available as both a standalone browser download and as an upgrade option for existing Brave installations. The company says the license is a one-time purchase of $59.99 US that can be used to activate the software on up to 10 devices. Users installing the Linux version can get Brave Origin for free. The Brave Origin launch has raised some criticism from users who argue that Brave is effectively charging users to remove features that many already considered unnecessary and unwanted in the first place. "My criticism is that Brave started by selling users a browser that protected them from the web's monetization layers. Over time, the browser itself became another monetization layer," a user posted on Reddit. "And now Brave Origin basically confirms the problem: if you want the clean, stripped-down, privacy-focused version, that becomes the paid product." Others pointed out that many of the features being removed can already be disabled in the free Brave version via enterprise group policies. Due to this, some users questioned whether Brave Origin introduces any meaningful differences beyond packaging those configuration settings into an easier-to-use interface. Defenders of the project argue that most users are unlikely to manually configure enterprise policies, making Brave Origin a more accessible way to obtain a cleaner privacy-oriented browser, while also supporting the privacy project. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Stolen credentials are the primary access route for cybercriminals. The use of infostealers to supply those credentials is the basis of modern cybercrime. Infostealers continuously improve in both sophistication and use. Venom Stealer is a newly discovered kit available through malware-as-a-service (MaaS) to anybody wishing to use it. It is not sold but provided on license at $250 per month or $1,800 for lifetime usage. This provides use and updates. The Venom Stealer kit, discovered and analyzed by BlackFog, demonstrates both the improving sophistication of infostealers and the ongoing efficiency of the MaaS marketplace. Under the handle of VenomStealer, the developer sells both licensing and an affiliate program via Telegram. Frequent updates to the kit show the value of licensing over outright purchase, and suggest this is a full-time operation for the developer. Each licensed operator configures their own custom domain via Cloudflare DNS. This way, the infostealer URL never appears in any issued commands. Once this domain is configured with Venom Stealer’s operating panel, everything else is automatic. A range of pre-built, professional social engineering ClickFix lures are available to install the Windows targeting payload. These can be selected from the kit’s operating panel. Although Venom Stealer targets Windows, it is operated via an internet domain and can be acquired and used by both Windows and macOS systems. The pre-built ClickFix templates include a fake Cloudflare CAPTCHA, a fake OS update, a fake SSL certificate error, and a fake font install page. Each lure asks the target to open a Run dialog or Terminal, paste a command, and press Enter. If successful, the Venom Stealer payload is installed and executed. It sweeps every Chromium and Firefox browser on the system. It extracts saved passwords, session cookies, browsing history, autofill data, and cryptocurrency wallet vaults from every profile. “Chrome’s v10 and v20 password encryption is bypassed using a silent privilege escalation that extracts the decryption key without triggering any UAC dialog, leaving no forensic artifacts,” report the researchers. System fingerprinting and browser extension inventories are also captured alongside the credentials, giving cybercriminals a complete profile of each target. All this data is immediately exfiltrated with little or no local staging or delay. It is at this point that traditional infostealers generally leave the victim as quietly and quickly as they arrived. But the current infostealer will remain, demonstrating the value of an ongoing license over a one-off purchase. Venom Stealer is built for persistence rather than the usual rapid steal and depart. Persistence itself is not entirely new to infostealers, but Venom Stealer goes further – it remains in operation. A session listener now runs silently and continuously in background. The listener phones home twice each day with information on any newly saved passwords. This would defeat password rotation by the victim, whether it is instigated by standard company policy or as an incident response to learning that details have become available on the dark web. The listener also reports new wallet activity. The listener was added to Venom Stealer in one of the updates provided in March 2026, demonstrating the adversarial advantage of an ongoing license rather than a one-off purchase. Other updates that arrived in March included the Chrome v10/v20 bypass, and auto-crack support for the Tonkeeper TON wallet extension that recovers the full seed phrase and TON address across Chrome, Edge, Brave and Opera. Stolen wallet data is passed to a server-side cracking engine running on GPU infrastructure. This auto-cracks MetaMask, Phantom, Solflare, Trust Wallet, Atomic, Exodus, Electrum, Bitcoin Core, Monero, and Tonkeeper. Once cracked, say the researchers, “the auto-transfer engine sweeps funds immediately across nine chains including ERC-20/SPL tokens, liquid staking positions, and DeFi protocol positions.” Although more sophisticated than earlier infostealers, Venom Stealer (like all other stealers) is not an automatic slam dunk for the attacker. Exposure can be reduced by restricting PowerShell execution, disabling the Run dialog for standard users, and improving employee social engineering recognition. If these fail and the stealer is installed and operational, continuous monitoring of and control over outbound traffic provides an opportunity to detect or prevent exfiltration activity: the existence of the stealer’s payload can be detected and theft of the information mother lode halted. Related: Cloudflare-Themed ClickFix Attack Drops Infiniti Stealer on Macs Related: Over 100 GitHub Repositories Distributing BoryptGrab Stealer Related: ‘Arkanix Stealer’ Malware Disappears Shortly After Debut Related: Sophisticated ClickFix Campaign Targeting Hospitality Sector

Secrets sprawl isn't slowing down: in 2025, it accelerated faster than most security teams anticipated. GitGuardian's State of Secrets Sprawl 2026 report analyzed billions of commits across public GitHub and uncovered 29 million new hardcoded secrets in 2025 alone, a 34% increase year over year and the largest single-year jump ever recorded. This year's findings reveal three core trends: AI has fundamentally reshaped how and where credentials leak, internal systems are far more exposed than most organizations realize, and remediation continues to be the industry's Achilles heel. Here are nine strategic takeaways that matter. 1. Secrets are growing faster than the developer population Since 2021, leaked secrets have grown 152%, while GitHub's public developer base expanded 98%. More developers and more AI-assisted code generation mean more credentials in circulation, and detection alone can't keep pace. 2. AI services drove 81% more leaks year over year GitGuardian detected 1,275,105 leaked secrets tied to AI services in 2025, up 81% from 2024. Eight of the ten fastest-growing categories of leaked secrets were AI-related. This isn't just about OpenAI or Anthropic keys. The real explosion is happening in LLM infrastructure: retrieval APIs like Brave Search (+1,255%), orchestration tools like Firecrawl (+796%), and managed backends like Supabase (+992%). Every new AI integration introduces another machine identity, and each one expands the attack surface. Deploying AI safely requires a proper secrets security strategy. 3. Internal repositories are 6x more likely to leak than public ones While public GitHub gets the attention, internal repositories are where the highest-value credentials live. GitGuardian's research found that 32.2% of internal repos contain at least one hardcoded secret, compared to just 5.6% of public repos. These aren't test keys. They're CI/CD tokens, cloud access credentials, and database passwords, the exact assets attackers target once they gain a foothold. Security through obscurity has failed. Treat internal repos as first-class leak sources. 4. 28% of leaks happen entirely outside code Secrets don't only live in repositories. GitGuardian found that 28% of incidents in 2025 originated entirely outside source code, in Slack, Jira, Confluence, and similar collaboration tools. These leaks are more dangerous: 56.7% of secrets found only in collaboration tools were rated critical, compared to 43.7% for code-only incidents. Teams share credentials during incident response, troubleshooting, and onboarding. If you're only scanning code, you're missing a quarter of your exposure. And the credentials leaking in collaboration tools are usually more critical and severe. 5. Self-hosted GitLab and Docker registries expose secrets at 3-4x the rate of public GitHub GitGuardian discovered thousands of unintentionally exposed self-hosted GitLab instances and Docker registries in 2025. Scanning these systems revealed 80,000 credentials, with 10,000 still valid. Secrets in Docker images were particularly troubling: 18% of scanned Docker images contained secrets, and 15% of those were valid, compared to 12% of GitLab repositories with a 12% validity rate. Docker secrets are also more production-adjacent. The perimeter between private and public is porous. 6. 64% of secrets leaked in 2022 remain valid today Detection is not remediation. GitGuardian retested secrets confirmed as valid in 2022 and found that 64% are still exploitable four years later. This is not a rounding error. It's proof that rotation and revocation are not routine, owned, or automated in most organizations. Credentials embedded across build systems, CI variables, container images, and vendor integrations are hard to replace without breaking production. For many teams, the safest short-term choice is to do nothing, leaving attackers with durable access paths. 7. Developer endpoints are the new credential aggregation layer The Shai-Hulud 2 supply chain attack gave researchers rare visibility into what secrets actually look like on compromised developer machines. Across 6,943 systems, GitGuardian identified 294,842 secret occurrences corresponding to 33,185 unique secrets. On average, each live secret appeared in eight different locations on the same machine, spread across .env files, shell history, IDE configs, cached tokens, and build artifacts. More striking: 59% of compromised machines were CI/CD runners, not personal laptops. Once secrets start sprawling into build infrastructure, they become an organizational exposure problem, not just an individual hygiene issue. More recently, the LiteLLM supply chain attack demonstrated the same pattern, with compromised packages harvesting SSH keys, cloud credentials, and API tokens from developer machines where AI development tools are increasingly concentrated. 8. MCP servers exposed 24,000+ secrets in their first year Model Context Protocol (MCP) made AI systems more useful by connecting them to tools and data sources. It also introduced a new class of credential exposure. In 2025, GitGuardian found 24,008 unique secrets in MCP-related config files on public GitHub, with 2,117 verified as valid. As agentic AI adoption accelerates, MCP and similar frameworks will normalize putting credentials into config files, startup flags, and local JSON. The agent ecosystem is expanding faster than security controls can adapt. 9. Shift from secrets detection to non-human identity governance The industry's limiting factor is answering three questions at scale: What non-human identities exist in my environment? Who owns them? What can they access? Organizations embracing agentic AI need to move beyond detection and build continuous NHI governance. That means eliminating long-lived static credentials wherever possible, adopting short-lived identity-driven access, implementing secrets vaulting as the default developer workflow, and treating every service account, CI job, and AI agent as a governed identity with lifecycle management. The Bottom Line Secrets sprawl is not slowing down. It's accelerating alongside AI adoption, developer productivity tools, and distributed software delivery. The old model of scanning public repos and hoping for compliance is no longer sufficient. Security teams need visibility across internal systems, collaboration tools, container registries, and developer endpoints. They need remediation workflows that can rotate credentials without breaking production. And most importantly, they need to stop treating secrets as isolated incidents and start managing them as part of a broader non-human identity governance program. The attack surface has changed. The question is whether security programs will change with it. About the Research GitGuardian's yearly State of Secrets Sprawl report was published for the 5th time, analyzing billions of public commits on GitHub, monitoring internal incidents across customer environments, and conducting original research on self-hosted infrastructure exposure and supply chain compromises.

Cybersecurity researchers have discovered a remote access toolkit of Russian-origin that's distributed via malicious Windows shortcut (LNK) files that are disguised as private key folders. The CTRL toolkit, according to Censys, is custom-built using .NET and includes various executables" to facilitate credential phishing, keylogging, Remote Desktop Protocol (RDP) hijacking, and reverse tunneling via Fast Reverse Proxy (FRP). "The executables provide encrypted payload loading, credential harvesting via a polished Windows Hello phishing UI, keylogging, RDP session hijacking, and reverse proxy tunneling through FRP," Censys security researcher Andrew Northern said. The attack surface management platform said it recovered CTRL from an open directory at 146.19.213[.]155 in February 2026. Attack chains distributing the toolkit rely on a weaponized LNK file ("Private Key #kfxm7p9q_yek.lnk") with a folder icon to trick users into double-clicking it. This triggers a multi-stage process, with each stage decrypting or decompressing the next, until it leads to the deployment of the toolkit. The LNK file dropper is designed to launch a hidden PowerShell command, which then wipes existing persistence mechanisms from the victim's Windows Startup folder. It also decodes a Base64-encoded blob and runs it in memory. The stager, for its part, tests TCP connectivity to hui228[.]ru:7000 and downloads next-stage payloads from the server. Furthermore, it modifies firewall rules, sets up persistence using scheduled tasks, creates backdoor local users, and spawns a cmd.exe shell server on port 5267 that's accessible through the FRP tunnel. One of the downloaded payloads, "ctrl.exe," functions as a .NET loader for launching an embedded payload, the CTRL Management Platform, which can serve either as a server or a client depending on the command-line arguments. Communication occurs over a Windows named pipe. "The dual-mode design means the operator deploys ctrl.exe once on the victim (via the stager), then interacts with it by running ctrl.exe client through the FRP-tunneled RDP session," Censys said. "The named pipe architecture keeps all C2 command traffic local to the victim machine — nothing traverses the network except the RDP session itself." The supported commands allow the malware to gather system information, launch a module designed for credential harvesting, and start a keylogger as a background service (if configured as a server) to capture all keystrokes to a file named "C:\Temp\keylog.txt" by installing a keyboard hook, and exfiltrate the results. The credential harvesting component is launched as a Windows Presentation Foundation (WPF) application that mimics a real Windows PIN verification prompt to capture the system PIN. The module, besides blocking attempts to escape the phishing window via keyboard shortcuts like Alt+Tab, Alt+F4, or F4, validates the entered PIN against the real Windows credential prompt via UI automation by using the SendKeys() method. "If the PIN is rejected, the victim is looped back with an error message," Northern explained. "The window remains open even if the PIN successfully validates against the actual Windows authentication system. The captured PIN is logged with the prefix [STEALUSER PIN CAPTURED] to the same keylog file used by the background keylogger." One of the commands built into the toolkit allows it to send toast notifications impersonating web browsers like Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Vivaldi, Yandex, and Iron to conduct additional credential theft or deliver other payloads. The two other payloads dropped as part of the attack are listed below - FRPWrapper.exe, which is a Go DLL that's loaded in memory to establish reverse tunnels for RDP and a raw TCP shell through the operator's FRP server. RDPWrapper.exe, which enables unlimited concurrent RDP sessions. "The toolkit demonstrates deliberate operational security. None of the three hosted binaries contain hard-coded C2 addresses," Censys said. "All data exfiltration occurs through the FRP tunnel via RDP — the operator connects to the victim’s desktop and reads keylog data through the ctrl named pipe. This architecture leaves minimal network forensic artifacts compared to traditional C2 beacon patterns." "The CTRL toolkit demonstrates a trend toward purpose-built, single-operator toolkits that prioritize operational security over feature breadth. By routing all interaction through FRP reverse tunnels to RDP sessions, the operator avoids the network-detectable beacon patterns that characterize commodity RATs."

Cybersecurity researchers have flagged a new evolution of the GlassWorm campaign that delivers a multi-stage framework capable of comprehensive data theft and installing a remote access trojan (RAT), which deploys an information-stealing Google Chrome extension masquerading as an offline version of Google Docs. "It logs keystrokes, dumps cookies and session tokens, captures screenshots, and takes commands from a C2 server hidden in a Solana blockchain memo," Aikido security researcher Ilyas Makari said in a report published last week. GlassWorm is the moniker assigned to a persistent campaign that obtains an initial foothold through rogue packages published across npm, PyPI, GitHub, and the Open VSX marketplace. In addition, the operators are known to compromise the accounts of project maintainers to push poisoned updates. The attacks are careful enough to avoid infecting systems with a Russian locale and use Solana transactions as a dead drop resolver to fetch the command-and-control (C2) server ("45.32.150[.]251") and download operating system-specific payloads. The stage two payload is a data-theft framework with credential harvesting, cryptocurrency wallet exfiltration, and system profiling capabilities. The collected data is compressed into a ZIP archive and exfiltrated to an external server ("217.69.3[.]152/wall"). It also incorporates functionality to retrieve and launch the final payload. Once the data is transmitted, the attack chain involves fetching two additional components: a .NET binary that is designed to carry out hardware wallet phishing and a Websocket-based JavaScript RAT to siphon web browser data and run arbitrary code. The RAT payload is fetched from "45.32.150[.]251" by using a public Google Calendar event URL as a dead drop resolver. The .NET binary leverages the Windows Management Instrumentation (WMI) infrastructure to detect USB device connections and displays a phishing window when a Ledger or Trezor hardware wallet is plugged in. "The Ledger UI displays a fake configuration error and presents 24 numbered recovery phrase input fields," Makari noted. "The Trezor UI displays a fake "Firmware validation failed, initiating emergency reboot" message with the same 24-word input layout. Both windows include a 'RESTORE WALLET' button." The malware not only kills any real Ledger Live processes running on the Windows host, but also re-displays the phishing window if the victim closes it. The end goal of the attack is to capture the wallet recovery phrase and transmit it to the IP address "45.150.34[.]158." The RAT, on the other hand, uses a Distributed Hash Table (DHT) to retrieve the C2 details. In the event the mechanism returns no value, the malware switches to the Solana-based dead drop. The RAT then establishes communication with the server to run various commands on the compromised system - start_hvnc / stop_hvnc, to deploy a Hidden Virtual Network Computing (HVNC) module for remote desktop access. start_socks / stop_socks, to launch a WebRTC module and run it as a SOCKS proxy. reget_log, to steal data from web browsers, such as Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Vivaldi, and Mozilla Firefox. The component is equipped to bypass Chrome's app-bound encryption (ABE) protections. get_system_info, to send system information. command, to execute attacker-supplied JavaScript via eval(). The RAT also force-installs a Google Chrome extension named Google Docs Offline on Windows and macOS systems, which then connects to a C2 server and receives commands issued by the operator, allowing to gather cookies, localStorage, the full Document Object Model (DOM) tree of the active tab, bookmarks, screenshots, keystrokes, clipboard content, up to 5,000 browser history entries, and the installed extensions list. "The extension also performs targeted session surveillance. It pulls monitored site rules from /api/get-url-for-watch and ships with Bybit (.bybit.com) pre-configured as a target, watching for the secure-token and deviceid cookies," Aikido said. "On detection, it fires an auth-detected webhook to /api/webhook/auth-detected containing the cookie material and page metadata. The C2 can also supply redirect rules that force active tabs to attacker-controlled URLs." The discovery coincides with yet another shift in GlassWorm tactics, with the attackers publishing npm packages impersonating the WaterCrawl Model Context Protocol (MCP) server ("@iflow-mcp/watercrawl-watercrawl-mcp) to distribute malicious payloads. "This is GlassWorm's first confirmed move into the MCP ecosystem," Koi security researcher Lotan Sery said. "And given how fast AI-assisted development is growing – and how much trust MCP servers are given by design – this won't be the last." Developers are advised to exercise caution when it comes to installing Open VSX extensions, npm packages, and MCP servers. It's also recommended to verify publisher names, package histories, and avoid blindly trusting download counts. Polish cybersecurity company AFINE has published an open-source Python tool called glassworm-hunter to scan developer systems for payloads associated with the campaign. "Glassworm-hunter makes zero network requests during scanning," researchers Paweł Woyke and Sławomir Zakrzewski said. "No telemetry. No phone-home. No automatic update checks. It reads local files only. Glassworm-hunter update is the only command that touches the network. It fetches the latest IoC database from our GitHub and saves it locally."

We’ve identified a huge social-engineering campaign designed to steer people into online gambling sites under the impression they’re installing a legitimate app. We’re calling it FriendlyDealer. It’s been observed across at least 1,500 domains, each hosting a website that impersonates the Google Play or Apple App Store. Users think they’re downloading a gambling app from a trusted source, with all the checks, reviews, and safeguards that implies. But they’re actually still on a website, installing a web app that then redirects them to casino offers through affiliate links. The campaign doesn’t steal passwords or install traditional malware. Instead, it makes money through commissions every time someone signs up or deposits money at one of these sites. That might sound less serious than a banking Trojan, but the end result is people being funneled into unregulated gambling sites with no age verification, no deposit limits, and no consumer protections. And it comes at a time when gambling addiction is being called the fastest explosion of gambling the country has ever seen. One kit, dozens of apps, built to mimic real app stores FriendlyDealer is built as a single, reusable kit that can generate many different fake app listings. The kit detects what device you’re using and shows you a different fake store accordingly. Android users see a fake Google Play Store. iPhone users see a fake Apple App Store. The kit even loads the correct system fonts for each platform (Google Sans on Android, San Francisco on iOS) so the typography matches what you’d expect on your own phone. Under the hood, it’s a single web application that reads all of its content from one configuration file embedded in the page. Change that file, and you get a completely different app listing running on the same code. The operators have used this to spin up at least twenty casino brands, from “Tower Rush” (189 deployments) to “Chicken Road” (97) to “BEAST GAMES: ICE FISHING” (43), which impersonates YouTube creator MrBeast. (It’s worth noting that some skins reuse the names of some legitimate gambling brands but none of these are affiliated with the operation.) The reviews are fake. Different apps reuse identical usernames, profile photos, text, and developer replies, and they’re repeated across multiple brands. Before showing the fake store, the kit can also display a simple casino mini-game to build engagement. The fake “Install” button on Android relies on a Chrome feature that only works on mobile. It captures Chrome’s install prompt and triggers it when tapped, so a real installation dialog appears. The usual warning about installing apps from unknown sources does not appear. Previous research has shown that apps installed this way can even display “Installed from Google Play Store” in your phone’s settings. The code goes to extraordinary lengths to get you into the right browser. If you arrive through a Facebook or Instagram ad, you’re inside those apps’ built-in browser, which can’t trigger the install. On Android, the kit generates a special link that forces the page to reopen in Chrome. On iOS, it does the same thing but for Safari. If Chrome isn’t installed, the fallback sends you to the real Play Store to download it. There’s even a separate handler for Samsung’s browser. The browser-specific engineering is unusually detailed. The page disables zooming, making close inspection harder. The kit assigns a per-user tracking ID and reuses it across analytics, event, push-registration, and offer-routing flows. The kit is wired for paid advertising. The configuration includes empty slots for tracking pixels from four ad platforms: Google, Yandex, Facebook, and TikTok. The app and background script can forward Facebook-style ad identifiers (_fbc / _fbp) when those values are available. The code references Yandex telemetry fields and ships with Russian-language comments and debug strings, which is consistent with a Russian-speaking development context, though those artefacts could also have been inherited from a reused or purchased kit. The flow is straightforward: buy ad traffic, detect the device, show a fake app store, trigger a real-looking install, and redirect to a casino through an affiliate link. You’re not installing an app When a user taps Install, the page doesn’t actually download an app. Instead, the browser creates what’s called a Progressive Web App (PWA). It’s essentially a website that behaves like an app, with its own icon on your home screen and its own splash screen. To most people it’s indistinguishable from a real app. Once installed, the app can keep running in the background using browser features called service workers (keeping a persistent connection to your device). The samples include the main PWA worker and code to register a separate push worker (to send you notifications) when enabled. The kit also knows when you’ve already installed it. It checks your device for its own PWA, and if it finds it, it skips the fake store entirely and sends you straight to the casino. One domain ties it all together Every FriendlyDealer deployment phones home to the same domain: ihavefriendseverywhere[.]xyz. This is the campaign’s data-collection server, and the name that inspired our tracking name for the operation. The background script and app code send telemetry to this domain including browser language, timezone, user-agent data, optional user-agent client hints, campaign identifiers, and ad identifiers when those values are available. Much of this is sent via custom request headers. Some requests use the HEAD method to stay lightweight. The application code also sends something the background script doesn’t: JavaScript error reports. Every crash, every failed resource load, every unhandled exception that occurs on the victim’s device is caught, packaged into a structured error object with a timestamp and context, and posted to ihavefriendseverywhere[.]xyz/api/log_standard_err. In effect, the operators are collecting both user data and production error telemetry from real devices. If a request fails (for example, due to poor signal), the background script stores it locally and retries later. Once the connection returns, the data is sent automatically. The fake app also asks for notification permission. If the user grants it, the kit can register a push subscription and create a direct channel for future notifications. These appear like normal app notifications, giving the operators a direct line back to the user even after the app is closed. Follow the money: affiliate commissions, not malware FriendlyDealer doesn’t spread viruses or take over devices. The entire operation runs on affiliate commissions. Each fake app store page contains a hidden redirect to an affiliate tracking network. When a user signs up or deposits money, the operator gets paid. We found multiple affiliate tracking networks in the code. A per-user ID appears across the kit’s analytics, event, push, and offer-routing logic, allowing activity to be correlated across multiple stages of the funnel. This model explains the campaign’s enormous scale. Each domain is disposable. The kit is a template; change one configuration file and you have a new casino brand on a new domain in minutes. With gambling affiliate payouts reportedly ranging from $50 to $400 per depositing user, even a small conversion rate across a thousand domains adds up fast. Who’s behind this? We can’t attribute the campaign to a specific group, but there are clues. The source code contains Russian-language comments (for example, “Создаем таймер для измерения времени загрузки Vue “). One of the builds shipped with unstripped Russian debug strings that were scrubbed from the production version. The code integrates with Yandex Metrica, which is popular in Russia and the former Soviet states. These point to a Russian-speaking development context, although the code could have been reused or purchased. The code also contains affiliate marketing tags—preland-alias and preland-final-action—where a “pre-lander” is the page a visitor sees before the actual offer. The application code shows this tag controls the kit’s behavior: a value of 0 triggers a PWA install, while 1 redirects to an app store. Combined with plug-and-play ad pixel slots, per-deployment configuration, and staging/production logic, this strongly suggests a reusable kit built for multiple campaigns or operators, not a one-off project. We found multiple builds of the same kit. The production version has debug messages removed, but other builds include full Russian-language error messages and support for Arabic numerals across the interface—download counts, ratings, review dates, and more. This does not look like a kit built for a single market; it appears designed to support regional variants at build time. A familiar trick with a different payoff Fake app store pages are a known technique, often used to steal banking credentials or deliver spyware. FriendlyDealer uses the same playbook, a convincing fake store and a real-looking install flow, but with a different goal. It doesn’t take over your phone or steal your passwords. It steers you toward gambling platforms and earns a commission when you spend money. The harm is financial rather than technical: victims are funneled toward gambling offers through deceptive install and redirect flows, and may end up depositing money at sites they did not intentionally choose. It’s also s a reminder that not every scam is after your passwords. Affiliate fraud, especially in online gambling, can fund enormous operations without ever touching a single credential. The people behind this built a factory: one template, twenty brands, more than 1,500 domains. Paid ads bring the traffic. The fake app stores seal the deal. The affiliate network pays the bills. What makes this effective is that it abuses things that are supposed to be trustworthy. Chrome’s app installation flow on Android and Safari’s “Add to Home Screen” on iPhone are both legitimate features, doing what they were designed to do. The problem is that the page triggering the install is a lie. The kit is carefully engineered so only the right users, on the right devices, coming from the right ads, ever see it. What to do if you installed one of these apps On Android: Remove the app: Long-press the icon and tap Uninstall, or go to Settings > Apps and remove anything you don’t recognize. Clear the site data in Chrome: The app may leave data behind in your browser. Open Chrome > Settings > Site settings > All sites, find the site, and tap Clear & reset. Check notification permissions: Go to Chrome > Settings > Notifications and remove any sites you don’t recognize. Uninstalling the app does not remove notification access. Check other browsers: If you use Edge, Brave, or another Chromium-based browser, repeat the same steps there. On iPhone: Remove the app: Long-press the app icon on your home screen and tap Remove App. On iOS, PWAs don’t install a background script the way they do on Android, so removing the icon also removes the cached site data. Clear the site data in Safari: Go to Settings > Safari > Advanced > Website Data, and search for the domain. Swipe to delete it. This clears any remaining cookies and stored data. Check notification permissions: Go to Settings > Apps > Safari. Scroll to the Settings for Websites section and tap Notifications. Find the site and remove or deny access. If you deposited money after being routed through one of these pages and believe you were deceived, contact your bank or payment provider promptly. Indicators of Compromise (IOCs) Domains ihavefriendseverywhere[.]xyz —Data exfiltration and error-logging server valor[.]bet —Gate/checkpoint URL (/__pwa_gate path) wikis[.]lifestyle —Hardcoded domain reference in application code Scammers know more about you than you think. Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in.

Google on Thursday announced a new "advanced flow" for Android sideloading that requires a mandatory 24-hour wait period to install apps from unverified developers in an attempt to balance openness with safety. The new changes come against the backdrop of a developer verification mandate the tech giant announced last year that requires all Android apps to be registered by verified developers to be installed on certified Android devices. The move, it added, was done to flag bad actors faster and prevent them from distributing malware. This also includes potential scenarios where cybercriminals trick unsuspecting users who sideload such apps into granting them elevated privileges that make it possible to turn off Play Protect, the anti-malware feature built into all Google-certified Android devices. However, the mandatory registration requirements have been met with criticism from over 50 app developers and marketplaces, including F-Droid, Brave, The Electronic Frontier Foundation, Proton, The Tor Project, Vivaldi, who say they risk creating friction and barriers to entry, and raise privacy and surveillance concerns in the absence of clarity about what personal information developers must provide, how this data will be stored, secured, and used, and if it could be subject to government requests or legal processes. As a way of quelling some of these thorny issues, Google has emphasized that the newly developed advanced flow allows power users to maintain the ability to sideload apps from unverified developers with a one-time process that requires them to follow the steps below - Enable developer mode in system settings. Confirm that they are taking this step of their own volition and are not being coached. Restart the phone and re-authenticate so as to prevent a scammer from monitoring what actions a user is taking. Wait for a 24-hour period and confirm that they are really making this change with biometric authentication or device PIN. Install apps from unverified developers once users understand the risks, either indefinitely or for a period of seven days. "In that 24-hour period, we think it becomes much harder for attackers to persist their attack," Android Ecosystem President, Sameer Samat, was quoted as saying to Ars Technica. "In that time, you can probably find out that your loved one isn’t really being held in jail or that your bank account isn’t really under attack." Google also said it plans to offer free "limited distribution accounts" that let hobbyist developers and students share apps with up to 20 devices without having to "provide a government-issued ID or pay a registration fee." It's worth noting that the aforementioned process does not apply to installs via the Android Debug Bridge (ADB). Limited distribution accounts for students and hobbyists, as well as advanced flow for users, will be available in August 2026, before the new developer verification requirements take effect the month after. "We know a 'one size fits all' approach doesn't work for our diverse ecosystem," Google said. "We want to ensure that identity verification isn't a barrier to entry, so we’re providing different paths to fit your specific needs." The development coincides with the emergence of a new Android malware called Perseus that's actively targeting users in Turkey and Italy with an aim to conduct device takeover (DTO) and financial fraud. Over the four months, at least 17 Android malware families have been detected in the wild. They include FvncBot, SeedSnatcher, ClayRat, Wonderland, Cellik, Frogblight, NexusRoute, ZeroDayRAT, Arsink (and its improved variant SURXRAT), deVixor, Phantom, Massiv, PixRevolution, TaxiSpy RAT, BeatBanker, Mirax, and Oblivion RAT.

Some weeks in security feel normal. Then you read a few tabs and get that immediate “ah, great, we’re doing this now” feeling. This week has that energy. Fresh messes, old problems getting sharper, and research that stops feeling theoretical real fast. A few bits hit a little too close to real life, too. There’s a good mix here: weird abuse of trusted stuff, quiet infrastructure ugliness, sketchy chatter, and the usual reminder that attackers will use anything that works. Scroll on. You’ll see what I mean. ⚡ Threat of the Week Google Patches 2 Actively Exploited Chrome 0-Days — Google released security updates for its Chrome web browser to address two high-severity vulnerabilities that it said have been exploited in the wild. The vulnerabilities related to an out-of-bounds write vulnerability in the Skia 2D graphics library (CVE-2026-3909) and an inappropriate implementation vulnerability in the V8 JavaScript and WebAssembly engine (CVE-2026-3910) that could result in out-of-bounds memory access or code execution, respectively. Google did not share additional details about the flaws, but acknowledged that there exist exploits for both of them. The issues were addressed in Chrome versions 146.0.7680.75/76 for Windows and Apple macOS, and 146.0.7680.75 for Linux. Detection Starts the Clock. Response Decisions Shape the Outcome When incidents escalate, early decisions determine containment and impact. Join this SANS IR Command Roundtable to learn how experienced teams avoid investigation drift, improve coordination, and execute faster response across cloud, enterprise, and operational environments. Watch the Webcast ➝ 🔔 Top News Meta to Discontinue Instagram E2EE in May 2026 — Meta announced plans to discontinue support for end-to-end encryption (E2EE) for chats on Instagram after May 8, 2026. In a statement shared with The Hacker News, a Meta spokesperson said, "Very few people were opting in to end-to-end encrypted messaging in DMs, so we're removing this option from Instagram in the coming months. Anyone who wants to keep messaging with end-to-end encryption can easily do that on WhatsApp." Authorities Disrupt SocksEscort Service — A court-authorized international law enforcement operation dismantled a criminal proxy service named SocksEscort that enslaved thousands of residential routers worldwide into a botnet for committing large-scale fraud. "The malware allowed SocksEscort to direct internet traffic through the infected routers. SocksEscort sold this access to its customers," the U.S. Justice Department said. The main thing to note here is that SocksEscort was powered by AVrecon, a malware written in C to explicitly target MIPS and ARM architectures via known security flaws in edge network devices. The malware also featured a novel persistence mechanism that involved flashing custom firmware, which intentionally disables future updates, permanently transforming SOHO routers into SocksEscort proxy nodes to blindside corporate monitoring. UNC6426 Exploits nx npm Supply Chain Attack to Gain AWS Admin Access in 72 Hours — A threat actor known as UNC6426 leveraged keys stolen following the supply chain compromise of the nx npm package in August 2025 to completely breach a victim's AWS environment within 72 hours. UNC6426 used the access to abuse the GitHub-to-AWS OpenID Connect (OIDC) trust and create a new administrator role in the cloud environment, Google said. Subsequently, this role was abused to exfiltrate files from the client's Amazon Web Services (AWS) Simple Storage Service (S3) buckets and perform data destruction in their production cloud environments. KadNap Enslaves Network Devices to Fuel Illegal Proxy — A takedown-resistant botnet comprising more than 14,000 routers and other network devices has been conscripted into a proxy network that anonymously ferries traffic used for cybercrime. The botnet, named KadNap, exploits known vulnerabilities in Asus routers (among others), leveraging the initial access to drop shell scripts that reach out to a peer-to-peer network based on Kademlia for decentralized control. Infected devices are being used to fuel a proxy service named Doppelganger that, for a fee, tunnels customers' internet traffic through residential IP addresses, offering a way for attackers to blend in and make it harder to differentiate malicious traffic from legitimate activity. APT28 Strikes with Sophisticated Toolkit — The Russian threat actor known as APT28 has been observed using a bespoke toolkit in recent cyber espionage campaigns targeting Ukrainian cyber assets. The primary components of the toolkit are two implants, one of which employs techniques from a malware framework the threat actor used in 2010s, while the other is a heavily modified version of the COVENANT framework for long-term spying. COVENANT is used in concert with BEARDSHELL to facilitate data exfiltration, lateral movement, and execution of PowerShell commands. Also alongside these tools is a malware named SLIMAGENT that shares overlaps with XAgent. ️🔥 Trending CVEs New vulnerabilities show up every week, and the window between disclosure and exploitation keeps getting shorter. The flaws below are this week's most critical — high-severity, widely used software, or already drawing attention from the security community. Check these first, patch what applies, and don't wait on the ones marked urgent — CVE-2026-3909, CVE-2026-3910, CVE-2026-3913 (Google Chrome), CVE-2026-21666, CVE-2026-21667, CVE-2026-21668, CVE-2026-21672, CVE-2026-21708, CVE-2026-21669, CVE-2026-21671 (Veeam Backup & Replication), CVE-2026-27577, CVE-2026-27493, CVE-2026-27495, CVE-2026-27497 (n8n), CVE-2026-26127, CVE-2026-21262 (Microsoft Windows), CVE-2019-17571, CVE-2026-27685 (SAP), CVE-2026-3102 (ExifTool for macOS), CVE-2026-27944 (Nginx UI), CVE-2025-67826 (K7 Ultimate Security), CVE-2026-26224, CVE-2026-26225 (Intego X9), CVE-2026-29000 (pac4j-jwt), CVE-2026-23813 (HPE Aruba Networking AOS-CX), CVE-2025-12818 (PostgreSQL), CVE-2026-2413 (Ally WordPress plugin), CVE-2026-0953 (Tutor LMS Pro WordPress plugin), CVE-2026-25921 (Gogs), CVE-2026-2833, CVE-2026-2835, CVE-2026-2836 (Cloudflare Pingora), CVE-2026-24308 (Apache ZooKeeper), CVE-2026-3059, CVE-2026-3060, CVE-2026-3989 (SGLang), CVE-2026-0231 (Palo Alto Networks Cortex XDR Broker VM), CVE-2026-20040, CVE-2026-20046 (Cisco IOS XR Software), CVE-2025-65587 (graphql-upload-minimal), CVE-2026-3497 (OpenSSH), CVE-2026-26123 (Microsoft Authenticator for Android and iOS), and CVE-2025-61915 (CUPS). 🎥 Cybersecurity Webinars Stop Guessing: Automate Your Defense Against Real-World Attacks → Learn how to move beyond basic security checklists by using automation to test your defenses against real-world attacks. Experts will show you why traditional testing often fails and how to use continuous, data-driven tools to find and fix gaps in your protection. You will learn how to prove your security actually works without increasing your manual workload. Fix Your Identity Security: Closing the Gaps Before Hackers Find Them → This webinar covers a new study about why many companies are struggling to keep their user accounts and digital identities safe. Experts share findings from the Ponemon Institute on the biggest security gaps, such as disconnected apps and the new risks created by AI. You will learn simple, practical steps to fix these problems and get better control over who has access to your company's data. The Ghost in the Machine: Securing the Secret Identities of Your AI Agents → As artificial intelligence (AI) begins to act on its own, businesses face a new challenge: how to give these "AI agents" the right digital IDs. This webinar explains why current security for humans doesn't work for autonomous bots and how to build a better system to track what they do. You will learn simple, real-world steps to give AI agents secure identities and clear rules, ensuring they don't accidentally expose your private company data. 📰 Around the Cyber World Fake Google Security Check Drops Browser RAT — A web page mimicking a Google Account security page has been spotted delivering a fully featured browser-based surveillance toolkit that takes the form of a Progressive Web App (PWA). "Disguised as a routine security checkup, it walks victims through a four-step flow that grants the attacker push notification access, the device's contact list, real-time GPS location, and clipboard contents—all without installing a traditional app," Malwarebytes said. "For victims who follow every prompt, the site also delivers an Android companion package introducing a native implant that includes a custom keyboard (enabling keystroke capture), accessibility-based screen reading capabilities, and permissions consistent with call log access and microphone recording." Forbidden Hyena Delivers BlackReaperRAT — A hacktivist group known as Forbidden Hyena (aka 4B1D) has distributed RAR archives in December 2025 and January 2026 in attacks targeting Russia that led to the deployment of a previously undocumented remote access trojan called BlackReaperRAT and an updated version of the Blackout Locker ransomware, referred to as Milkyway by the threat actors. BlackReaperRAT is capable of running commands via "cmd.exe," uploading/downloading files, spawning an HTTP shell to receive commands, and spreading the malware to connected removable media. "It carries out destructive attacks against organizations across various sectors located within the Russian Federation," BI.ZONE said. "The group publishes information regarding successful attacks on its Telegram channel. It collaborates with the groups Cobalt Werewolf and Hoody Hyena." Chinese Hackers Target the Persian Gulf region with PlugX — A China-nexus threat actor, likely suspected to be Mustang Panda, has targeted countries in the Persian Gulf region. The activity took place within the first 24 hours of the ongoing conflict in the Middle East late last month. The campaign used a multi-stage attack chain that ultimately deployed a PlugX backdoor variant. "The shellcode and PlugX backdoor used obfuscation techniques such as control flow flattening (CFF) and mixed boolean arithmetic (MBA) to hinder reverse engineering," Zscaler said. "The PlugX variant in this campaign supports HTTPS for command-and-control (C2) communication and DNS-over-HTTPS (DOH) for domain resolution." Phishing Campaign Uses SEO Poisoning to Steal Data — A phishing campaign has employed SEO poisoning to direct search engine results to fake traffic ticket portals that impersonate the Government of Canada and specific provincial agencies. "The campaign lures victims to a fake 'Traffic Ticket Search Portal' under the pretense of paying outstanding traffic violations," Palo Alto Networks Unit 42 said. "Submitted data includes license plates, address, date of birth, phone/email, and credit card numbers." The phishing pages utilize a "waiting room" tactic where the victim's browser polls the server every two seconds and triggers redirects based on specific status codes. Roundcube Exploitation Toolkit Discovered — Hunt.io said it discovered a Roundcube exploitation toolkit on an internet-exposed directory on 203.161.50[.]145. It's worth noting that Russian threat actors like APT28, Winter Vivern, and TAG-70 have repeatedly targeted Roundcube vulnerabilities to breach Ukrainian organizations. "The directory included development and production XSS payloads, a Flask-based command-and-control server, CSS-injection tooling, operator bash history, and a Go-based implant deployed on a compromised Ukrainian web application," the company said, attributing it with medium to high confidence to APT28, citing overlaps with Operation RoundPress. The toolkit, dubbed Roundish, supports credential harvesting, persistent mail forwarding, bulk email exfiltration, address book theft, and two-factor authentication (2FA) secret extraction, mirroring a feature present in MDAEMON. One of the primary targets of the attack is mail.dmsu.gov[.]ua, a Roundcube webmail instance associated with Ukraine's State Migration Service (DMSU). Besides the possibility of a shared development lineage, Roundish introduces four new components not previously documented in APT28 webmail activity, including a CSS-based side-channel module, browser credential stealer, and a Go-based backdoor that provides persistence via cron, systemd, and SELinux. The CSS injection component is designed to progressively extract characters from Roundcube's document object model (DOM) without injecting any JavaScript into the victim's page. The technique is likely used for targeting Cross-Site Request Forgery (CSRF) tokens or email UIDs. Central to the Roundish toolkit is an XSS payload that's engineered to steal the victim's email address, harvest account credentials, redirect all incoming emails to a Proton Mail address, export mailbox data from the victim's Inbox and Sent folders, and gather the victim's complete address book. "The combination of hidden autofill credential harvesting, server-side mail forwarding persistence, bulk mailbox exfiltration, and browser credential theft reflects a modular approach designed for sustained access," Hunt.io said. "From a defensive perspective, password resets alone are not sufficient in cases like this. Mail forwarding rules, Sieve filters, and multi-factor authentication secrets must be audited and reset." Phishing Campaign Targeting AWS Console Credentials — An active adversary-in-the-middle (AiTM) phishing campaign is using fake security alert emails to steal AWS Console credentials, per Datadog. "The phishing kit proxies authentication to the legitimate AWS sign-in endpoint in real time, validating credentials before redirecting victims and likely capturing one-time password (OTP) codes," the company said. "This campaign does not exploit AWS vulnerabilities or abuse AWS infrastructure." Post-compromise console access has been observed within 20 minutes of credential submission. These efforts originated from Mullvad VPN infrastructure. Malicious npm Packages Deliver Cipher stealer — Two new malicious npm packages, bluelite-bot-manager and test-logsmodule-v-zisko, were found to deliver via Dropbox a Windows executable designed to siphon sensitive data, including Discord totems, credentials from Chrome, Edge, Opera, Brave, and Yandex browsers, and seed files from cryptocurrency wallet apps like Exodus. from compromised hosts using a stealer named Cipher stealer. "The stealer also uses an embedded Python script and a secondary payload downloaded from GitHub," JFrog said. GIBCRYPTO Ransomware Detailed — A new ransomware called GIBCRYPTO comes with the ability to capture keystrokes and corrupt the Master Boot Record (MBR) so that any attempt to restart the system will cause the system to run into an error. The ransomware uses the Salsa20 algorithm for encryption. It's suspected to be part of Snake Keylogger, indicating the malware authors' attempts to diversify beyond information theft. The development comes as Sygnia highlighted SafePay's OneDrive-based data exfiltration technique during a ransomware attack after breaching a victim by leveraging a FortiGate firewall flaw and a misconfigured administrative account. "SafePay gained initial access by exploiting a firewall misconfiguration, which enabled them to obtain local administrative credentials," the company said. "They rapidly escalated discovery and enumeration activities to identify high-value targets for lateral movement, demonstrating a structured and methodical approach to mapping the environment. Within a matter of hours, SafePay escalated to domain administrator access." The attack culminated in the deployment of ransomware, encrypting more than 60 servers. Fraudulent Account Registration Activity Originating from Vietnam — A sprawling cybercrime ecosystem based in Vietnam has been linked to a cluster of fraudulent account registration activity on platforms like LinkedIn, Instagram, Facebook, and TikTok. In these attacks, attributed to O-UNC-036, the threat actors rely on disposable email addresses in order to execute SMS pumping attacks, also called International Revenue Sharing Fraud (IRSF). "In this scheme, malicious actors automate the creation of puppet accounts in a targeted service provider," Okta said. "Fraudsters use these account registrations to trigger SMS messages to premium rate phone numbers and profit from charges incurred. This activity can prove costly for service providers who use SMS to verify registration information in customer accounts or to send multi-factor authentication (MFA) security codes." O-UNC-036 has also been linked to a cybercrime-as–a-service (CaaS) ecosystem that provides paid infrastructure and services to facilitate online fraud. The web-based storefronts are hosted in Vietnam and specialize in the sales of web-based accounts. Hijacked AppsFlyer SDK Distributes Crypto Clipper — The AppsFlyer Web SDK was briefly hijacked to serve malicious code to steal cryptocurrency in a supply chain attack. The clipper malware payload came with capabilities to intercept cryptocurrency wallet addresses entered on websites and replace them with attacker-controlled addresses to divert funds to the threat actor. "The AppsFlyer Web SDK was observed serving obfuscated malicious JavaScript instead of the legitimate SDK from websdk.appsflyer[.]com," Profero said. "The malicious payload appears to have been designed for stealth and compatibility, preserving legitimate SDK functionality while adding hidden browser hooks and wallet-hijacking logic." The incident has since been resolved by AppsFlyer. Operation CamelClone Targets Government and Defense Entities — A new cyber espionage campaign dubbed Operation CamelClone has targeted governments and defense entities in Algeria, Mongolia, Ukraine, and Kuwait using malicious ZIP archives that contain a Windows shortcut (LNK) file, which, when executed, delivers a JavaScript loader named HOPPINGANT. The loader then delivers additional payloads for establishing C2 and exfiltrating data to the MEGA cloud storage service. "One interesting aspect of this campaign is that the threat actor does not rely on traditional command-and-control infrastructure," Seqrite Labs said. "Instead, the payloads are hosted on a public file-sharing service, filebulldogs[.]com, while stolen data is uploaded to MEGA storage using the legitimate tool Rclone." The activity has not been attributed to any known threat group. How Threat Actors Exfiltrate Credentials Using Telegram Bots — Threat actors are abusing the Telegram Bot API to exfiltrate data via text messages or arbitrary file uploads, highlighting how legitimate services can be weaponized to evade detection. Agent Tesla Keylogger is by far the most prominent example of a malware family that uses Telegram for C2. "In general, Telegram C2s appear to be most popular among information stealers, possibly due to Telegram's technically legitimate nature and because information stealers typically only need to exfiltrate data passively rather than provide complex communications beyond simple message or file transfers," Cofense said. Microsoft Launches Copilot Health — Microsoft has become the latest company after OpenAI and Anthropic to launch a dedicated "secure space" called Copilot Health that integrates medical records, biometric data from wearables, and lab test results to give personalized advice in the U.S. "Copilot Health brings together your health records, wearable data, and health history into one place, then applies intelligence to turn them into a coherent story," the company said. Like OpenAI and Anthropic, Microsoft emphasized that Copilot Health isn't meant to replace professional medical care. Rogue AI Agents Can Work Together to Engage in Offensive Behaviors — According to a new report from artificial intelligence (AI) security company Irregular, agents can work together to hack into systems, escalate privileges, disable endpoint protection, and steal sensitive data while evading pattern-matching defenses. What's notable is that the experiment did not rely on adversarial prompting or deliberately unsafe system design. "In one case, an agent convinced another agent to carry out an offensive action, a form of inter-agent collusion that emerged with no external manipulation," Irregular said. "This scenario demonstrates two compounding risks: inter-agent persuasion can erode safety boundaries, and agents can independently develop techniques to circumvent security controls. When an agent is given access to tools or data, particularly but not exclusively shell or code access, the threat model should assume that the agent will use them, and that it will do so in unexpected and possibly malicious ways." 🔧 Cybersecurity Tools Dev Machine Guard → It is a free, open-source tool that scans your computer to show you exactly what developer tools and scripts are running. It creates a simple list of your AI coding assistants, code editor extensions, and software packages to help you find anything suspicious or outdated. It is a single script that works in seconds to give you better visibility into the security of your local coding environment. Trajan → It is an automated security tool designed to find hidden vulnerabilities in "service meshes," which are the systems that manage how different parts of a large software application talk to each other. Because these systems are complex, it is easy for engineers to make small mistakes in the settings that allow hackers to bypass security or steal data. Trajan works by scanning these configurations to spot those specific errors and helping developers fix them before they can be exploited. Disclaimer: For research and educational use only. Not security-audited. Review all code before use, test in isolated environments, and ensure compliance with applicable laws. Conclusion There’s a lot packed in here, and not in a neat way. Some of it is the usual recycled chaos, some of it feels a little more deliberate, and some of it has that nasty “this is going to show up everywhere by next week” energy. Anyway — enough throat-clearing. Here’s the stuff worth your attention.

Google on Thursday released security updates for its Chrome web browser to address two high-severity vulnerabilities that it said have been exploited in the wild. The list of vulnerabilities is as follows - CVE-2026-3909 (CVSS score: 8.8) - An out-of-bounds write vulnerability in the Skia 2D graphics library that allows a remote attacker to perform out-of-bounds memory access via a crafted HTML page. CVE-2026-3910 (CVSS score: 8.8) - An inappropriate implementation vulnerability in the V8 JavaScript and WebAssembly engine that allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Both vulnerabilities were discovered and reported by Google itself on March 10, 2026. As is customary in these cases, no details are available about how the issues are being abused in the wild and who is behind the efforts. This is done so as to prevent other threat actors from exploiting the issues. "Google is aware that exploits for both CVE-2026-3909 and CVE-2026-3910 exist in the wild," the company noted. The development comes less than a month after Google shipped fixes for a high-severity use-after-free bug in Chrome's CSS component (CVE-2026-2441, CVSS score: 8.8) that had also been exploited as a zero-day. Google has patched a total of three actively weaponized Chrome zero-days since the start of the year. For optimal protection, users are advised to update their Chrome browser to versions 146.0.7680.75/76 for Windows and Apple macOS, and 146.0.7680.75 for Linux. To make sure the latest updates are installed, users can navigate to More > Help > About Google Chrome and select Relaunch. Users of other Chromium-based browsers, such as Microsoft Edge, Brave, Opera, and Vivaldi, are also advised to apply the fixes as and when they become available. Update The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on March 13, 2026, added both the Google Chrome vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by March 27, 2026.

Cybersecurity researchers have discovered half-a-dozen new Android malware families that come with capabilities to steal data from compromised devices and conduct financial fraud. The Android malware range from traditional banking trojans like PixRevolution, TaxiSpy RAT, BeatBanker, Mirax, and Oblivion RAT to full-fledged remote administration tools such as SURXRAT. PixRevolution, according to Zimperium, targets Brazil's Pix instant payment platform, hijacking victims' money transfers in real-time to route them to the threat actors instead of the intended payee. "This new strain of malware operates stealthily within the device until the moment the victim initiates a Pix transfer," security researcher Aazim Yaswant said. "What distinguishes this threat from conventional banking trojans is its fundamental design: a human or AI agent operator is actively engaged on the remote end, observing the victim's phone screen instantaneously, poised to act at the precise moment of transaction." The Android malware propagates via fake Google Play Store app listing pages for apps like Expedia, Sicredi, and Correios to trick users into installing the malicious dropper APK files. Once installed, the apps urge users to enable accessibility services to realize their goals. It also connects to an external server over TCP on port 9000 to send periodic heartbeat messages containing device information and activate real-time screen capture using Android's MediaProjection API. The main functionality of PixRevolution, though, is the monitoring of the victim's screen and serving a fake overlay as soon as a victim enters the desired amount and the Pix key of the recipient to initiate the payment. At that point, the trojan shows a fake WebView overlay that says "Aguarde..." (meaning "wait" in Portuguese/Spanish), while, in the background, it edits the Pix key with that of the attacker's to complete the funds transfer. In the final stage, the overlay is removed, and the victim is displayed a "transfer complete" confirmation screen in the Pix app. "From the victim's perspective, nothing unusual happened," Yaswant said. "The app briefly showed a loading indicator, something that occurs routinely during legitimate banking operations. The transfer was confirmed successfully. The amount they intended to send was deducted from their account." "It is only later, sometimes much later, that the victim discovers the money went to the wrong account. And because Pix transfers are instant and final, recovery is extraordinarily difficult." Brazilian users have also become the target of another Android‑based malware campaign called BeatBanker, which spreads primarily through phishing attacks via a website disguised as the Google Play Store. BeatBanker gets its name from the use of an unusual persistence mechanism that involves playing an almost inaudible audio file, a 5-second recording featuring Chinese words, on a loop to prevent it from being terminated. Besides incorporating runtime checks for emulated or analysis environments, the malware monitors battery temperature and percentage, and verifies whether the user is using the device to start or stop the Monero miner as required. It uses Google's Firebase Cloud Messaging (FCM) for command‑and‑control (C2). "To achieve their goals, the malicious APKs carry multiple components, including a cryptocurrency miner and a banking trojan capable of completely hijacking the device and spoofing screens, among other things," Kaspersky said. "When the user tries to make a USDT transaction, BeatBanker creates overlay pages for Binance and Trust Wallet, covertly replacing the destination address with the threat actor's transfer address." The banking module also monitors web browsers like Chrome, Edge, Firefox, Brave, Opera, DuckDuckGo, Dolphin Browser, and sBrowser to URLs accessed by the victim. In addition, it supports the ability to receive a long list of commands from the server to collect personal information and gain complete control of the device. Recent iterations of the campaign have been found to drop BTMOB RAT instead of the banking module. It provides operators with comprehensive remote control, persistent access, and surveillance over compromised devices. BTMOB is assessed to be an evolution of CraxsRAT, CypherRAT, and SpySolr families, all of which have been linked to a Syrian threat actor who goes by the online alias EVLF. "We also saw the distribution and sale of leaked BTMOB source code on some dark web forums," the Russian security vendor said. "This may suggest that the creator of BeatBanker acquired BTMOB from its original author or the source of the leak and is utilizing it as the final payload." TaxiSpy RAT, similar to PixRevolution, abuses Android's accessibility service and MediaProjection APIs to collect SMS messages, contacts, call logs, clipboard contents, installed apps list, notifications, lock screen PINs, and keystrokes, as well as target Russian banking, cryptocurrency, and government apps by serving overlays to conduct credential theft. The malware combines traditional banking trojan functionality with full RAT capabilities, enabling threat actors to gather sensitive data and execute commands sent via Firebase push messages. Several TaxiSpy samples have been discovered by both CYFIRMA and Zimperium, indicating active efforts on the part of attackers to evade signature-based detection and blacklist defenses. "The malware leverages advanced evasion techniques, such as native library encryption, rolling XOR string obfuscation, and real-time VNC-like remote control via WebSocket," CYFIRMA said. "Its design allows comprehensive device surveillance, including SMS, call logs, contacts, notifications, and banking app monitoring, highlighting its financially motivated and region-specific focus." Another Android banking trojan of note is Mirax, which has been advertised by a threat actor named Mirax Bot as a private malware-as-a-service (MaaS) offering for a monthly price of $2,500 for a full version or $1,750 for a light variant. Mirax claims to offer banking overlays, information gathering (e.g., keystrokes, SMS, lock patterns), and a SOCKS5 proxy to route malicious traffic through compromised devices. Mirax is not the only Android MaaS offering detected in recent months. A new Android remote access trojan called Oblivion is being sold for around $300 per month (or $1,900 per year and $2,200 for lifetime access) and claims to bypass detection and security features on devices from major manufacturers. Once installed, the malware employs an automated permission-granting mechanism that requires no interaction from the victim. This approach, per the seller, works across MIUI / HyperOS (Xiaomi), One UI (Samsung), ColorOS (OPPO), MagicOS (Honor), and OxygenOS (OnePlus). "What sets it apart isn't any single feature. It's the combination: automated permission bypass, hidden remote control, deep persistence, and a point-and-click builder that puts all of it within reach of would-be hackers with even the most minimal level of technical skill," Certos said. "Google has made progressive restrictions on accessibility service abuse a priority across successive Android versions. A tool that credibly bypasses those protections on the latest release – and does so across devices from Samsung, Xiaomi, OPPO, and others – represents a genuine challenge to platform-level defenses." Also commercially distributed through a Telegram-based MaaS ecosystem is an Android malware family called SURXRAT, which is assessed to be an improved version of Arsink. The malware abuses accessibility permissions for persistent control and communicates with a Firebase-based C2 infrastructure to commandeer infected devices. The malware is marketed on a Telegram channel managed by an Indonesian threat actor. What's notable about some of the new samples is the presence of a large language model (LLM) component, indicating that the threat actors behind the malware are experimenting with artificial intelligence (AI) capabilities, along with traditional surveillance. That said, the download of the LLM module is triggered only when specific gaming applications are active on the victim's device, or when it receives alternative target package names dynamically from the server - Free Fire MAX x JUJUTSU KAISEN (com.dts.freefiremax) Free Fire x JUJUTSU KAISEN (com.dts.freefireth) Select SURXRAT samples also incorporate a ransomware-style screen locker module that makes it possible for a remote operator to hijack control of a victim's device and deny access by displaying a full-screen lock message until a payment is made. "This evolution highlights how existing Android RAT frameworks continue to be repurposed and expanded by threat actors, accelerating malware development cycles and enabling rapid introduction of new surveillance and control functionalities," Cyble said. "The observed experimentation with large AI model integration further indicates that threat actors are actively exploring emerging technologies to enhance operational effectiveness and evade detection."

OpenAI is stepping up its push to bolster the security framework surrounding its enterprise-focused AI ecosystem. Recently, the AI giant has looked to address the need for agentic AI security testing through its acquisition of agentic security testing firm Promptfoo. In a soon-to-be released interview with Infosecurity, OpenClaw’s security advisor flagged that such a security requirement existed within agentic AI development. Jamieson O’Reilly, an Australian hacker, founder of pentesting company DVULN and security advisor at OpenClaw, a local AI agent project that went viral at the beginning of 2026, spoke to Infosecurity for an upcoming podcast episode. Asked about the future for agentic AI security, O’Reilly warned that the AI and cybersecurity community needs to develop more ways to “scan AI tools” for detecting “human-language malware, rather than using traditional file-based malware analysis.” A day after the interview, conducted on March 9, OpenAI announced it was acquiring Promptfoo in a bid to reinforce security measures for AI agents in enterprise applications. Founded in July 2024 by Ian Webster, a senior engineering manager at Discord, and Michael D'Angelo, the VP of Engineering and head of machine learning at Smile Identity, Promptfoo addresses the security gap O’Reilly highlighted. Specifically, the startup provides open source tools to test and evaluate large language models (LLMs) and AI agents. These include tools for scanning vulnerabilities in LLMs, red-teaming AI tools, evaluating AI prompts and models, and providing a secure proxy for model context protocol (MCP) servers, one of the building blocks of AI agents. According to OpenAI’s March 10 announcement, Promptfoo’s suite of tools are used by over 25% of Fortune 500 companies. The startup has raised $23m so far, including $18.4m from VC firm Insight Partners in July 2025 with participation from Andreessen Horowitz. According to its LinkedIn page, Promptfoo employs over 20 people. No financial details about the acquisition were shared by either party. OpenAI Acquires Promptfoo to Enhance AI Agent Security Testing OpenAI said companies are increasingly deploying AI agents, which it calls “AI coworkers,” and Promptfoo can help offer “systematic ways to test AI agent behavior, detect risks before deployment and maintain clear records to support oversight, governance and accountability over time.” Once the acquisition is approved, OpenAI will integrate Promptfoo’s technology directly into OpenAI Frontier, its platform for building and operating “AI coworkers.” The company stated that security and safety testing would become built-in capabilities of the Frontier platform, with automated security testing and red‑teaming tools designed to help enterprises identify and remediate risks such as prompt injections, jailbreaks, data leaks, tool misuse and out‑of‑policy agent behaviors. OpenAI also said that security and evaluation would be integrated into development workflows so organizations can identify, investigate and remediate agent risks earlier in the development process. In addition, integrated reporting and traceability features will provide oversight and accountability, enabling organizations to document testing, monitor changes over time and meet emerging governance, risk and compliance expectations for AI. Finally, the generative AI giant confirmed it will keep Promptfoo’s current product suite open source and available for anyone to use and deploy. OpenAI’s Security Future Involves OpenClaw and Promptfoo Speaking to Infosecurity about the acquisition, O’Reilly said it “made a lot of sense.” However, he added that he didn’t have enough context about Promptfoo and the acquisition to further comment. Since being appointed OpenClaw’s security advisor, O’Reilly has worked on a security roadmap for the project. He also helped OpenClaw partner with Google-owned VirusTotal, to improve the security of OpenClaw-compatible skills shared on skills libraries such as ClawHub. The partnership was announced on February 7. “While VirusTotal is known for more traditional binary-based malware analysis, they were the only ones besides ourselves who were seriously studying the abuse of skills marketplaces,” O’Reilly told Infosecurity. He also highlighted the benefit of VirusTotal’s privileged access to Google AI Gemini to “scan human-language malware.” A few days after the OpenClaw agreement with VirusTotal, Peter Steinberger, the founder of OpenClaw, announced on February 14 that he joined OpenAI. While it remains unclear whether the Austrian software developer is taking the OpenClaw project with him to OpenAI, he confirmed to several media outlets that OpenClaw will move to a foundation and stay open and independent. Speaking on the Lex Fridman podcast on February 12, Steinberger said he would like OpenClaw to follow a model similar to Google’s Chromium and Chrome, where an open‑source project (Chromium) is maintained by a company alongside outside contributors and serves as the foundation for commercial products such as Google Chrome, Microsoft Edge, Brave, Opera and Vivaldi. Whatever happens, with Steinberger’s hiring and now the Promptfoo integration, as well as the recent rollout of Codex Security, a tool formerly known as Aardvark and designed to help developers identify and mitigate vulnerabilities in AI‑generated code, OpenAI seems to be moving more aggressively to build out the security infrastructure around its enterprise AI ecosystem.

Recently, we uncovered BeatBanker, an Android‑based malware campaign targeting Brazil. It spreads primarily through phishing attacks via a website disguised as the Google Play Store. To achieve their goals, the malicious APKs carry multiple components, including a cryptocurrency miner and a banking Trojan capable of completely hijacking the device and spoofing screens, among other things. In a more recent campaign, the attackers switched from the banker to a known RAT. This blog post outlines each phase of the malware’s activity on the victim’s handset, explains how it ensures long‑term persistence, and describes its communication with mining pools. Key findings: To maintain persistence, the Trojan employs a creative mechanism: it plays an almost inaudible audio file on a loop so it cannot be terminated. This inspired us to name it BeatBanker. It monitors battery temperature and percentage, and checks whether the user is using the device. At various stages of the attack, BeatBanker disguises itself as a legitimate application on the Google Play Store and as the Play Store itself. It deploys a banker in addition to a cryptocurrency miner. When the user tries to make a USDT transaction, BeatBanker creates overlay pages for Binance and Trust Wallet, covertly replacing the destination address with the threat actor’s transfer address. New samples now drop BTMOB RAT instead of the banking module. Initial infection vector The campaign begins with a counterfeit website, cupomgratisfood[.]shop, that looks exactly like the Google Play Store. This fake app store contains the “INSS Reembolso” app, which is in fact a Trojan. There are also other apps that are most likely Trojans too, but we haven’t obtained them. The INSS Reembolso app poses as the official mobile portal of Brazil’s Instituto Nacional do Seguro Social (INSS), a government service that citizens can use to perform more than 90 social security tasks, from retirement applications and medical exam scheduling to viewing CNIS (National Registry of Social Information), tax, and payment statements, as well as tracking request statuses. By masquerading as this trusted platform, the fake page tricks users into downloading the malicious APK. Packing The initial APK file is packed and makes use of a native shared library (ELF) named libludwwiuh.so that is included in the application. Its main task is to decrypt another ELF file that will ultimately load the original DEX file. First, libludwwiuh.so decrypts an embedded encrypted ELF file and drops it to a temporary location on the device under the name l.so. The same code that loaded the libludwwiuh.so library then loads this file, which uses the Java Native Interface (JNI) to continue execution. l.so – the DEX loader The library does not have calls to its functions; instead, it directly calls the Java methods whose names are encrypted in the stack using XOR (stack strings technique) and restored at runtime: Initially, the loader makes a request to collect some network information using https://ipapi.is to determine whether the infected device is a mobile device, if a VPN is being used, and to obtain the IP address and other details. This loader is engineered to bypass mobile antivirus products by utilizing dalvik.system.InMemoryDexClassLoader. It loads malicious DEX code directly into memory, avoiding the creation of any files on the device’s file system. The necessary DEX files can be extracted using dynamic analysis tools like Frida. Furthermore, the sample incorporates anti-analysis techniques, including runtime checks for emulated or analysis environments. When such an environment is detected (or when specific checks fail, such as verification of the supported CPU_ABI), the malware can immediately terminate its own process by invoking android.os.Process.killProcess(android.os.Process.myPid()), effectively self-destructing to hinder dynamic analysis. After execution, the malware displays a user interface that mimics the Google Play Store page, showing an update available for the INSS Reembolso app. This is intended to trick victims into granting installation permissions by tapping the “Update” button, which allows the download of additional hidden malicious payloads. The payload delivery process mimics the application update. The malware uses the REQUEST_INSTALL_PACKAGES permission to install APK files directly into its memory, bypassing Google Play. To ensure persistence, the malware keeps a notification about a system update pinned to the foreground and activates a foreground service with silent media playback, a tactic designed to prevent the operating system from terminating the malicious process. Crypto mining When UPDATE is clicked on a fake Play Store screen, the malicious application downloads and executes an ELF file containing a cryptomining payload. It starts by issuing a GET request to the C2 server at either hxxps://accessor.fud2026.com/libmine- .so or hxxps://fud2026.com/libmine- .so. The downloaded file is then decrypted using CipherInputStream(), with the decryption key being derived from the SHA-1 hash of the downloaded file’s name, ensuring that each version of the file is encrypted with a unique key. The resulting file is renamed d-miner. The decrypted payload is an ARM-compiled XMRig 6.17.0 binary. At runtime, it attempts to create a direct TCP connection to pool.fud2026[.]com:9000. If successful, it uses this endpoint; otherwise, it automatically switches to the proxy endpoint pool-proxy.fud2026[.]com:9000. The final command-line arguments passed to XMRig are as follows: -o pool.fud2026[.]com:9000 or pool-proxy.fud2026[.]com:9000 (selected dynamically) -k (keepalive) --tls (encrypted connection) --no-color (disable colored output) --nicehash (NiceHash protocol support) C2 telemetry The malware uses Google’s legitimate Firebase Cloud Messaging (FCM) as its primary command‑and‑control (C2) channel. In the analyzed sample, each FCM message received triggers a check of the battery status, temperature, installation date, and user presence. A hidden cryptocurrency miner is then started or stopped as needed. These mechanisms ensure that infected devices remain permanently accessible and responsive to the attacker’s instructions, which are sent through the FCM infrastructure. The attacker monitors the following information: isCharging: indicates whether the phone is charging; batteryLevel: the exact battery percentage; isRecentInstallation: indicates whether the application was recently installed (if so, the implant delays malicious actions); isUserAway: indicates whether the user is away from the device (screen off and inactive); overheat: indicates whether the device is overheating; temp: the current battery temperature. Persistence The KeepAliveServiceMediaPlayback component ensures continuous operation by initiating uninterrupted playback via MediaPlayer. It keeps the service active in the foreground using a notification and loads a small, continuous audio file. This constant activity prevents the system from suspending or terminating the process due to inactivity. The identified audio output8.mp3 is five seconds long and plays on a loop. It contains some Chinese words. Banking module BeatBanker compromises the machine with a cryptocurrency miner and introduces another malicious APK that acts as a banking Trojan. This Trojan uses previously obtained permission to install an additional APK called INSS Reebolso, which is associated with the package com.destination.cosmetics. Similar to the initial malicious APK, it establishes persistence by creating and displaying a fixed notification in the foreground to hinder removal. Furthermore, BeatBanker attempts to trick the user into granting accessibility permissions to the package. Leveraging the acquired accessibility permissions, the malware establishes comprehensive control over the device’s user interface. The Trojan constantly monitors the foreground application. It targets the official Binance application (com.binance.dev) and the Trust Wallet application (com.wallet.crypto.trustapp), focusing on USDT transactions. When a user tries to withdraw USDT, the Trojan instantly overlays the target app’s transaction confirmation screen with a highly realistic page sourced from Base64-encoded HTML stored in the banking module. The module captures the original withdrawal address and amount, then surreptitiously substitutes the destination address with an attacker-controlled one using AccessibilityNodeInfo.ACTION_SET_TEXT. The overlay page shows the victim the address they copied (for Binance) or just shows a loading icon (for Trust Wallet), leading them to believe they are remitting funds to the intended wallet when, in fact, the cryptocurrency is transferred to the attacker’s designated address. Target browsers BeatBanker’s banking module monitors the following browsers installed on the victim’s device: Chrome Firefox sBrowser Brave Opera DuckDuckGo Dolphin Browser Edge Its aim is to collect the URLs accessed by the victim using the regular expression ^(?:https?://)?(?:[^:/\\\\]+\\\\.)?([^:/\\\\]+\\\\.[^:/\\\\]+). It also offers management functionalities (add, edit, delete, list) for links saved in the device’s default browser, as well as the ability to open links provided by the attacker. C2 communication BeatBanker is also designed to receive commands from the C2. These commands aim to collect the victim’s personal information and gain complete control of the device. New BeatBanker samples dropping BTMOB Our recent detection efforts uncovered a campaign leveraging a fraudulent StarLink application that we assess as being a new BeatBanker variant. The infection chain mirrored previous instances, employing identical persistence methods – specifically, looped audio and fixed notifications. Furthermore, this variant included a crypto miner similar to those seen previously. However, rather than deploying the banking module, it was observed distributing the BTMOB remote administration tool. The BTMOB APK is highly obfuscated and contains a class responsible for configuration. Despite this, it’s possible to identify a parser used to define the application’s behavior on the device, as well as persistence features, such as protection against restart, deletion, lock reset, and the ability to perform real-time screen recording. String decryption The simple decryption routine uses repetitive XOR between the encrypted data and a short key. It iterates through the encrypted text byte by byte, repeating the key from the beginning whenever it reaches the end. At each position, the sample XORs the encrypted byte with the corresponding byte of the key, overwriting the original. Ultimately, the modified byte array contains the original text, which is then converted to UTF-8 and returned as a string. Malware-as-a-Service BTMOB is an Android remote administration tool that evolved from the CraxsRAT, CypherRAT, and SpySolr families. It provides full remote control of the victim’s device and is sold in a Malware-as-a-Service (MaaS) model. On July 26, 2025, a threat actor posted a screenshot of the BTMOB RAT in action on GitHub under the username “brmobrats”, along with a link to the website btmob[.]xyz. The website contains information about the BTMOB RAT, including its version history, features, and other relevant details. It also redirects to a Telegram contact. Cyfirma has already linked this account to CraxsRAT and CypherRAT. Recently, a YouTube channel was created by a different threat actor that features videos demonstrating how to use the malware and facilitate its sale via Telegram. We also saw the distribution and sale of leaked BTMOB source code on some dark web forums. This may suggest that the creator of BeatBanker acquired BTMOB from its original author or the source of the leak and is utilizing it as the final payload, replacing the banking module observed in the INSS Reebolso incident. In terms of functionality, BTMOB maintains a set of intrusive capabilities, including: automatic granting of permissions, especially on Android 13–15 devices; use of a black FrameLayout overlay to hide system notifications similar to the one observed in the banking module; silent installation; persistent background execution; and mechanisms designed to capture screen lock credentials, including PINs, patterns, and passwords. The malware also provides access to front and rear cameras, captures keystrokes in real time, monitors GPS location, and constantly collects sensitive data. Together, these functionalities provide the operator with comprehensive remote control, persistent access, and extensive surveillance capabilities over compromised devices. Victims All variants of BeatBanker – those with the banking module and those with the BTMOB RAT – were detected on victims in Brazil. Some of the samples that deliver BTMOB appear to use WhatsApp to spread, as well as phishing pages. Conclusion BeatBanker is an excellent example of how mobile threats are becoming more sophisticated and multi-layered. Initially focused in Brazil, this Trojan operates a dual campaign, acting as a Monero cryptocurrency miner, discreetly draining your device’s battery life while also stealing banking credentials and tampering with cryptocurrency transactions. Moreover, the most recent version goes even further, substituting the banking module with a full-fledged BTMOB RAT. The attackers have devised inventive tricks to maintain persistence. They keep the process alive by looping an almost inaudible audio track, which prevents the operating system from terminating it and allows BeatBanker to remain active for extended periods. Furthermore, the threat demonstrates an obsession with staying hidden. It monitors device usage, battery level and temperature. It even uses Google’s legitimate system (FCM) to receive commands. The threat’s banking module is capable of overlaying Binance and Trust Wallet screens and diverting USDT funds to the criminals’ wallets before the victim even notices. The lesson here is clear: distrust is your best defense. BeatBanker spreads through fake websites that mimic Google Play, disguising itself as trustworthy government applications. To protect yourself against threats like this, it is essential to: Download apps only from official sources. Always use the Google Play Store or the device vendor’s official app store. Make sure you use the correct app store app, and verify the developer. Check permissions. Pay attention to the permissions that applications request, especially those related to accessibility and installation of third-party packages. Keep the system updated. Security updates for Android and your mobile antivirus are essential. Our solutions detect this threat as HEUR:Trojan-Dropper.AndroidOS.BeatBanker and HEUR:Trojan-Dropper.AndroidOS.Banker.* Indicators of compromise Additional IoCs, TTPs and detection rules are available to customers of our Threat Intelligence Reporting service. For more details, contact us at [email protected]. Host-based (MD5 hashes) F6C979198809E13859196B135D21E79B – INSS Reebolso D3005BF1D52B40B0B72B3C3B1773336B – StarLink

Cybersecurity researchers have discovered a malicious npm package that masquerades as an OpenClaw installer to deploy a remote access trojan (RAT) and steal sensitive data from compromised hosts. The package, named "@openclaw-ai/openclawai," was uploaded to the registry by a user named "openclaw-ai" on March 3, 2026. It has been downloaded 178 times to date. The library is still available for download as of writing. JFrog, which discovered the package, said it's designed to steal system credentials, browser data, crypto wallets, SSH keys, Apple Keychain databases, and iMessage history, as well as install a persistent RAT with remote access capabilities, SOCKS5 proxy, and live browser session cloning. It's tracking the activity under the name GhostClaw. "The attack is notable for its broad data collection, its use of social engineering to harvest the victim's system password, and the sophistication of its persistence and C2 [command-and-control] infrastructure," security researcher Meitar Palas said. "Internally, the malware identifies itself as GhostLoader." The malicious logic is triggered by means of a postinstall hook, which re-installs the package globally using the command: "npm i -g @openclaw-ai/openclawai." Once the installation is complete, the OpenClaw binary points to "scripts/setup.js" by means of the "bin" property in the "package.json" file. It's worth noting that the "bin" field is used to define executable files that should be added to the user's PATH during package installation. This, in turn, turns the package into a globally accessible command-line tool. The file "setup.js" serves as the first-stage dropper that, upon running, displays a convincing fake command-line interface with animated progress bars to give the impression that OpenClaw is being installed on the host. After the purported installation step is complete, the script shows a bogus iCloud Keychain authorization prompt, asking users to enter their system password. Simultaneously, the script retrieves an encrypted second-stage JavaScript payload from the C2 server ("trackpipe[.]dev"), which is then decoded, written to a temporary file, and spawned as a detached child process to continue running in the background. The temp file is deleted after 60 seconds to cover up traces of the activity. "If the Safari directory is inaccessible (no Full Disk Access), the script displays an AppleScript dialog urging the user to grant FDA to Terminal, complete with step-by-step instructions and a button that opens System Preferences directly," JFrog explained. "This enables the second-stage payload to steal Apple Notes, iMessage, Safari history, and Mail data." The JavaScript second-stage, featuring about 11,700 lines, is a full-fledged information stealer and RAT framework that's capable of persistence, data collection, browser decryption, C2 communication, a SOCKS5 proxy, and live browser cloning. It's also equipped to steal a wide range of data - macOS Keychain, including both the local login.keychain-db and all iCloud Keychain databases Credentials, cookies, credit cards, and autofill data from all Chromium-based browsers, such as Google Chrome, Microsoft Edge, Brave, Vivaldi, Opera, Yandex, and Comet Data from desktop wallet applications and browser extensions Cryptocurrency wallet seed phrases SSH keys Developer and cloud credentials for AWS, Microsoft Azure, Google Cloud, Kubernetes, Docker, and GitHub Artificial intelligence (AI) agent configurations, and Data protected by the FDA, including Apple Notes, iMessage history, Safari browsing history, Mail account configurations, and Apple account information In the final stage, the collected data is compressed into a tar.gz archive and exfiltrated through multiple channels, including directly to the C2 server, Telegram Bot API, and GoFile.io. What's more, the malware enters a persistent daemon mode that allows it to monitor clipboard content every three seconds and transmit any data that matches one of the nine pre-defined patterns corresponding to private keys, WIF key, SOL private key, RSA private key, BTC address, Ethereum address, AWS key, OpenAI key, and Strike key. Other features include keeping tabs on running processes, scanning incoming iMessage chats in real-time, and executing commands sent from the C2 server to run arbitrary shell command, open a URL on the victim's default browser, download additional payloads, upload files, start/stop a SOCKS5 proxy, list available browsers, clone a browser profile and launch it in headless mode, stop the browser clone, self-destruct, and update itself. The browser cloning function is particularly dangerous as it launches a headless Chromium instance with the existing browser profile that contains cookies, login, and history data. This gives the attacker a fully authenticated browser session without the need for accessing credentials. "The @openclaw-ai/openclawai package combines social engineering, encrypted payload delivery, broad data collection, and a persistent RAT into a single npm package," JFrog said. "The polished fake CLI installer and Keychain prompt are convincing enough to extract system passwords from cautious developers, and once captured, those credentials unlock macOS Keychain decryption and browser credential extraction that would otherwise be blocked by OS-level protections." Update The package has been removed from the npm registry as of March 10, 2026.

A convincing fake version of the popular Mac utility CleanMyMac is tricking users into installing malware. The site instructs visitors to paste a command into Terminal. If they do, it installs SHub Stealer, macOS malware designed to steal sensitive data including saved passwords, browser data, Apple Keychain contents, cryptocurrency wallets, and Telegram sessions. It can even modify wallet apps such as Exodus, Atomic Wallet, Ledger Wallet, and Ledger Live so attackers can later steal the wallet’s recovery phrase. The site impersonates the CleanMyMac website, but is unconnected to the legitimate software or the developers, MacPaw. Remember: Legitimate apps almost never require you to paste commands into Terminal to install them. If a website tells you to do this, treat it as a major red flag and do not proceed. When in doubt, download software only from the developer’s official website or the App Store. Read the deep-dive to see what we discovered. “Open Terminal and paste the following command” The attack begins at cleanmymacos[.]org, a website designed to look like the real CleanMyMac product page. Visitors are shown what appears to be an advanced installation option of the kind a power user might expect. The page instructs them to open Terminal, paste a command, and press Return. There’s no download prompt, disk image, or security dialog. That command performs three actions in quick succession: First, it prints a reassuring line: macOS-CleanMyMac-App: https://macpaw.com/cleanmymac/us/app to make the Terminal output look legitimate. Next, it decodes a base64-encoded link that hides the real destination. Finally, it downloads a shell script from the attacker’s server and pipes it directly into zsh for immediate execution. From the user’s perspective, nothing unusual happens. This technique, known as ClickFix, has become a common delivery method for Mac infostealers. Instead of exploiting a vulnerability, it tricks the user into running the malware themselves. Because the command is executed voluntarily, protections such as Gatekeeper, notarization checks, and XProtect offer little protection once the user pastes the command and presses Return. Geofencing: Not everyone gets the payload The first script that arrives on the victim’s Mac is a loader, which is a small program that checks the system before continuing the attack. One of its first checks looks at the macOS keyboard settings to see whether a Russian-language keyboard is installed. If it finds one, the malware sends a cis_blocked event to the attacker’s server and exits without doing anything else. This is a form of geofencing. Malware linked to Russian-speaking cybercriminal groups often avoids infecting machines that appear to belong to users in CIS countries (the Commonwealth of Independent States, which includes Russia and several neighboring nations). By avoiding systems that appear to belong to Russian users, the attackers reduce the risk of attracting attention from local law enforcement. The behavior does not prove where SHub was developed, but it follows a pattern long observed in that ecosystem, where malware is configured not to infect systems in the operators’ own region. If the system passes this check, the loader sends a profile of the machine to the command-and-control server at res2erch-sl0ut[.]com. The report includes the device’s external IP address, hostname, macOS version, and keyboard locale. Each report is tagged with a unique build hash, a 32-character identifier that acts as a tracking ID. The same identifier appears in later communications with the server, allowing the operators to link activity to a specific victim or campaign. “System Preferences needs your password to continue” Comparing payloads served with and without a build hash reveals another campaign-level field in the malware builder: BUILD_NAME. In the sample tied to a build hash, the value is set to PAds; in the version without a hash, the field is empty. The value is embedded in the malware’s heartbeat script and sent to the command-and-control (C2) server during every beacon check-in alongside the bot ID and build ID. What PAds stands for cannot be confirmed from the payload alone, but its structure matches the kind of traffic-source tag commonly used in pay-per-install or advertising campaigns to track where infections originate. If that interpretation is correct, it suggests victims may be reaching the fake CleanMyMac site through paid placements rather than organic search or direct links. Once the loader confirms a viable target, it downloads and executes the main payload: an AppleScript hosted at res2erch-sl0ut[.]com/debug/payload.applescript. AppleScript is Apple’s built-in automation language, which allows the malware to interact with macOS using legitimate system features. Its first action is to close the Terminal window that launched it, removing the most obvious sign that anything happened. Next comes the password harvest. The script displays a dialog box that closely mimics a legitimate macOS system prompt. The title reads “System Preferences”, the window shows Apple’s padlock icon, and the message says: The awkward wording—“for continue” instead of “to continue”—is one clue the prompt is fake, though many users under pressure might not notice it. “Required Application Helper. Please enter password for continue.” If the user enters their password, the malware immediately checks whether it is correct using the macOS command-line tool dscl. If the password is wrong, it is logged and the prompt appears again. The script will repeat the prompt up to ten times until a valid password is entered or the attempts run out. That password is valuable because it unlocks the macOS Keychain, Apple’s encrypted storage system for saved passwords, Wi-Fi credentials, app tokens, and private keys. Without the login password, the Keychain database is just encrypted data. With it, the contents can be decrypted and read. A systematic sweep of everything worth stealing With the password in hand, SHub begins a systematic sweep of the machine. All collected data is staged in a randomly named temporary folder—something like /tmp/shub_4823917/—before being packaged and sent to the attackers. The browser targeting is extensive. SHub searches 14 Chromium-based browsers (Chrome, Brave, Edge, Opera, OperaGX, Vivaldi, Arc, Sidekick, Orion, Coccoc, Chrome Canary, Chrome Dev, Chrome Beta, and Chromium), stealing saved passwords, cookies, and autofill data from every profile it finds. Firefox receives the same treatment for stored credentials. The malware also scans installed browser extensions, looking for 102 known cryptocurrency wallet extensions by their internal identifiers. These include MetaMask, Phantom, Coinbase Wallet, Exodus Web3, Trust Wallet, Keplr, and many others. Desktop wallet applications are also targeted. SHub collects local storage data from 23 wallet apps, including Exodus, Electrum, Atomic Wallet, Guarda, Coinomi, Sparrow, Wasabi, Bitcoin Core, Monero, Litecoin Core, Dogecoin Core, BlueWallet, Ledger Live, Ledger Wallet, Trezor Suite, Binance, and TON Keeper. Each wallet folder is capped at 100 MB to keep the archive manageable. Beyond wallets and browsers, SHub also captures the macOS Keychain directory, iCloud account data, Safari cookies and browsing data, Apple Notes databases, and Telegram session files—information that could allow attackers to hijack accounts without knowing the passwords. It also copies shell history files (.zsh_history and .bash_history) and .gitconfig, which often contain API keys or authentication tokens used by developers. All of this data is compressed into a ZIP archive and uploaded to res2erch-sl0ut[.]com/gate along with a hardcoded API key identifying the malware build. The archive and temporary files are then deleted, leaving minimal traces on the system. The part that keeps stealing after you’ve cleaned up Most infostealers are smash-and-grab operations: they run once, take everything, and leave. SHub does that, but it also goes a step further. If it finds certain wallet applications installed, it downloads a replacement for the application’s core logic file from the attacker’s server and swaps it in silently. We retrieved and analyzed five such replacements. All five were backdoored, each tailored to the architecture of the target application. The targets are Electron-based apps. These are desktop applications built on web technologies whose core logic lives in a file called app.asar. SHub kills the running application, downloads a replacement app.asar from the C2 server, overwrites the original inside the application bundle, strips the code signature, and re-signs the app so macOS will accept it. The process runs silently in the background. The five confirmed crypto wallet apps are Exodus, Atomic Wallet, Ledger Wallet, Ledger Live, and Trezor Suite. Exodus: silent credential theft on every unlock On every wallet unlock, the modified app silently sends the user’s password and seed phrase to wallets-gate[.]io/api/injection. A one-line bypass is added to the network filter to allow the request through Exodus’s own domain allowlist. Atomic Wallet: the same exfiltration, no bypass required On every unlock, the modified app sends the user’s password and mnemonic to wallets-gate[.]io/api/injection. No network filter bypass is required—Atomic Wallet’s Content Security Policy already allows outbound HTTPS connections to any domain. Ledger Wallet: TLS bypass and a fake recovery wizard The modified app disables TLS certificate validation at startup. Five seconds after launch, it replaces the interface with a fake three-page recovery wizard that asks the user for their seed phrase and sends it to wallets-gate[.]io/api/injection. Ledger Live: identical modifications Ledger Live receives the same modifications as Ledger Wallet: TLS validation is disabled and the user is presented with the same fake recovery wizard. Trezor Suite: fake security update overlay After the application loads, a full-screen overlay styled to match Trezor Suite’s interface appears, presenting a fake critical security update that asks for the user’s seed phrase. The phrase is validated using the app’s own bundled BIP39 library before being sent to wallets-gate[.]io/api/injection. At the same time, the app’s update mechanism is disabled through Redux store interception so the modified version remains in place. Five wallets, one endpoint, one operator Across all five modified applications, the exfiltration infrastructure is identical: the same wallets-gate[.]io/api/injection endpoint, the same API key, and the same build ID. Each request includes a field identifying the source wallet—exodus, atomic, ledger, ledger_live, or trezor_suite—allowing the backend to route incoming credentials by product. This consistency across five independently modified applications strongly suggests that a single operator built all of the backdoors against the same backend infrastructure. A persistent backdoor disguised as Google’s own update service To maintain long-term access, SHub installs a LaunchAgent, which is a background task that macOS automatically runs every time the user logs in. The file is placed at: ~/Library/LaunchAgents/com.google.keystone.agent.plist The location and name are chosen to mimic Google’s legitimate Keystone updater. The task runs every sixty seconds. Each time it runs, it launches a hidden bash script located at: ~/Library/Application Support/Google/GoogleUpdate.app/Contents/MacOS/GoogleUpdate The script collects a unique hardware identifier from the Mac (the IOPlatformUUID) and sends it to the attacker’s server as a bot ID. The server can respond with base64-encoded commands, which the script decodes, executes, and then deletes. In practice, this gives the attackers the ability to run commands on the infected Mac at any time until the persistence mechanism is discovered and removed. The final step is a decoy error message shown to the user: “Your Mac does not support this application. Try reinstalling or downloading the version for your system.” This explains why CleanMyMac appeared not to install and sends the victim off to troubleshoot a problem that doesn’t actually exist. SHub’s place in a growing family of Mac stealers SHub is not an isolated creation. It belongs to a rapidly evolving family of AppleScript-based macOS infostealers including campaigns such as MacSync Stealer (an expanded version of malware known as Mac.c, first seen in April 2025) and Odyssey Stealer, and shares traits with other credential-stealing malware such as Atomic Stealer. These families share a similar architecture: a ClickFix delivery chain, an AppleScript payload, a fake System Preferences password prompt, recursive data harvesting functions, and exfiltration through a ZIP archive uploaded to a command-and-control server. What distinguishes SHub is the sophistication of its infrastructure. Features such as per-victim build hashes for campaign tracking, detailed wallet targeting, wallet application backdooring, and a heartbeat system capable of running remote commands all suggest an author who studied earlier variants and invested heavily in expanding them. The result resembles a malware-as-a-service platform rather than a simple infostealer. The presence of a DEBUG tag in the malware’s internal identifier, along with the detailed telemetry it sends during execution, suggests the builder was still under active development at the time of analysis. The campaign also fits a broader pattern of brand impersonation attacks. Researchers have documented similar ClickFix campaigns impersonating GitHub repositories, Google Meet, messaging platforms, and other software tools, with each designed to convince users that they are following legitimate installation instructions. The cleanmymacos.org site appears to follow the same playbook, using a well-known Mac utility as the lure. What to do if you may have been affected The most effective part of this attack is also its simplest: it convinces the victim to run the malicious command themselves. By presenting a Terminal command as a legitimate installation step, the campaign sidesteps many of macOS’s built-in protections. No app download is required, no disk image is opened, and no obvious security warning appears. The user simply pastes the command and presses Return. This reflects a broader trend: macOS is becoming a more attractive target, and the tools attackers use are becoming more capable and more professional. SHub Stealer, even in its current state, represents a step beyond many earlier macOS infostealers. For most users, the safest rule is also the simplest: install software only from the App Store or from a developer’s official website. The App Store handles installation automatically, so there is no Terminal command, no guesswork, and no moment where you have to decide whether to trust a random website. Do not run the command. If you have not yet executed the Terminal command shown on cleanmymacos[.]org or a similar site, close the page and do not return. Check for the persistence agent. Open Finder, press Cmd + Shift + G, and navigate to ~/Library/LaunchAgents/ . If you see a file named com.google.keystone.agent.plist that you did not install, delete it. Also check:~/Library/Application Support/Google/ . If a folder named GoogleUpdate.app is present and you did not install it, remove it. Treat your wallet seed phrase as compromised. If you have Exodus, Atomic Wallet, Ledger Live, Ledger Wallet, or Trezor Suite installed and you ran this command, assume your seed phrase and wallet password have been exposed. Move your funds to a new wallet created on a clean device immediately. Seed phrases cannot be changed, and anyone with a copy can access the wallet. Change your passwords. Your macOS login password and any passwords stored in your browser or Keychain should be considered exposed. Change them from a device you trust. Revoke sensitive tokens. If your shell history contained API keys, SSH keys, or developer tokens, revoke and regenerate them. Run Malwarebytes for Mac. It can detect and remove remaining components of the infection, including the LaunchAgent and modified files. Indicators of compromise (IOCs) Domains cleanmymacos[.]org — phishing site impersonating CleanMyMac res2erch-sl0ut[.]com — primary command-and-control server (loader delivery, telemetry, data exfiltration) wallets-gate[.]io — secondary C2 used by wallet backdoors to exfiltrate seed phrases and passwords From reporting threats to removing them. Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

A oltre un anno dall’entrata in vigore dei primi divieti (2 febbraio 2025), il quadro regolatorio dell’AI Act sta entrando nella sua fase più complessa. L’Unione Europea, pur mantenendo il primato normativo globale, si trova oggi a gestire una fase di transizione critica: se da un lato le restrizioni sulle pratiche a rischio “inaccettabile” sono ormai consolidate, dall’altro il mercato attende la piena operatività dei modelli di IA di portata generale, i cui obblighi sono scattati nell’agosto 2025. Nonostante l’ambizione di Bruxelles, l’effetto trascinamento globale (Bruxelles effect) appare meno marcato rispetto al GDPR. Diversi ordinamenti extra-UE continuano a prediligere approcci di soft-law o regolamentazioni settoriali, osservando con scetticismo la rigidità burocratica europea che, secondo alcuni analisti finanziari, potrebbe influenzare l’attrattività del mercato unico per le big tech. Indice degli argomenti Il sistema dei rischi e i divieti operativi dell’Ai Act L’impianto normativo resta incardinato su un approccio basato sul rischio, volto a tutelare i diritti fondamentali sanciti dalla Carta dell’UE. Ad oggi, risultano pienamente operative le interdizioni per i sistemi che presentano rischi inaccettabili, ovvero quelli che: Manipolano il comportamento umano con tecniche subliminali o sfruttando vulnerabilità specifiche. Attuano il cosiddetto social scoring (classificazione sociale basata su comportamenti o personalità). Utilizzano l’identificazione biometrica remota “in tempo reale” in spazi pubblici per fini di contrasto (salvo deroghe autorizzate per minacce terroristiche imminenti o ricerca di persone scomparse). Estraggono immagini facciali da internet o CCTV per creare database di riconoscimento non mirati. Deducono emozioni nei luoghi di lavoro o nelle istituzioni educative. Sanzioni e conformità: i costi della non-compliance dell’Ai Act Il regime sanzionatorio rappresenta uno dei principali driver di spesa per il risk management aziendale. Le sanzioni sono parametrate per esercitare un effetto deterrente proporzionale alla capacità finanziaria: Violazioni di pratiche vietate: fino a 35 milioni di euro o al 7% del fatturato mondiale annuo. Inosservanza di altri requisiti: fino a 15 milioni di euro o al 3% del fatturato. Fornitura di informazioni inesatte: fino a 7,5 milioni di euro o all’1,5% del fatturato. Per le PMI e le startup è previsto un trattamento di favore, con l’applicazione dell’importo più basso tra i due parametri, nel tentativo di non soffocare l’ecosistema dell’innovazione europea. Resta fondamentale l’integrazione con il GDPR e la direttiva NIS2 per una gestione olistica della cybersecurity. Tabella di marcia dell’Ai Act: verso il 2027 Siamo attualmente in una fase intermedia della roadmap attuativa: Agosto 2025 (traguardo superato): piena applicazione per i modelli di IA di portata generale (GPAI). Le aziende hanno dovuto adeguare la documentazione tecnica e i controlli sulla trasparenza. Agosto 2027 (prossima scadenza): sarà il termine ultimo per la conformità dei sistemi di IA ad alto rischio integrati in prodotti regolamentati (dispositivi medici, veicoli, infrastrutture critiche). In questa fase, la pressione sui produttori aumenterà sensibilmente a causa degli obblighi di certificazione e sorveglianza post-market. Governance e sfide future dell’Ai Act L’Ufficio Europeo per l’IA coordina ora la vigilanza insieme alle autorità nazionali. In Italia, la definizione dell’autorità competente ha richiesto un lungo iter normativo, essenziale per fornire alle imprese un interlocutore certo per le valutazioni d’impatto sui diritti fondamentali. Il dibattito economico resta però acceso: il rischio è che un eccesso di oneri amministrativi possa innescare una perdita di competitività rispetto a mercati più deregolamentati. L’equilibrio tra protezione etica e dinamismo economico sarà il parametro su cui si misurerà il successo dell’AI Act nei prossimi anni. AI e protezione dei dati: un consiglio operativo In un contesto dove l’IA elabora volumi massivi di informazioni sensibili, la difesa del perimetro informativo non è più solo un obbligo legale, ma un asset strategico. Le aziende, le istituzioni, le agenzie o gli organismi dell’UE che non rispetteranno le disposizioni previste dall’AI Act rischiano sanzioni pesanti: fino a 35 milioni di euro o al 7% del fatturato mondiale totale annuo dell’esercizio precedente (se superiore) per violazioni relative a pratiche vietate o per l’inosservanza di requisiti in materia di dati; fino a 15 milioni di euro o al 3% del fatturato mondiale totale annuo dell’esercizio precedente per l’inosservanza di qualsiasi altro requisito o obbligo del regolamento; fino a 7,5 milioni di euro o all’1,5% del fatturato mondiale totale annuo dell’esercizio precedente per la fornitura di informazioni inesatte, incomplete o fuorvianti agli organismi notificati e alle autorità nazionali competenti in risposta a una richiesta. Per ciascuna categoria di violazione, la soglia per le PMI sarebbe l’importo più basso tra i due previsti, mentre per le altre imprese sarebbe l’importo più elevato. Le multe possono arrivare fino a 35 milioni di euro o al 7% del fatturato globale annuo, a seconda di quale valore sia maggiore. Questo include anche le aziende internazionali che operano all’interno dell’Unione Europea, applicando l’AI Act con un effetto extraterritoriale. In questo contesto, è fondamentale per le aziende operanti nell’UE comprendere l’interazione tra l’AI Act e altri regolamenti europei, come il Gdpr e la direttiva NIS2, per evitare sovrapposizioni di obblighi e per garantire una gestione corretta degli incidenti e dei rischi. L’AI Act classifica i sistemi di IA in quattro categorie di rischio: inaccettabile alto limitato minimo o nullo: include applicazioni come videogiochi abilitati all’IA o filtri antispam, che sono esenti da normative stringenti e la stragrande maggioranza dei sistemi di IA attualmente utilizzati nell’UE rientra in questa categoria. Le implicazioni di questa classificazione sono fondamentali per capire come la legge influenzerà i vari settori. Ecco le pratiche con rischio inaccettabile riguardano i sistemi di IA che: manipolano le decisioni degli individui in modo subliminale o ingannevole; sfruttano le vulnerabilità come l’età, la disabilità o lo status socio-economico per influenzare il comportamento; valutano o classificano gli individui in base al loro comportamento sociale o alle caratteristiche della personalità; valutano o prevedono il rischio di un individuo di commettere un reato basandosi sui loro tratti di personalità e caratteristiche; creano o espandono database di riconoscimento facciale attraverso la raccolta non mirata di immagini del viso da internet o da riprese di telecamere a circuito chiuso; deducono le emozioni nei luoghi di lavoro o nei centri educativi; classificano gli individui in base ai dati biometrici per dedurre la loro razza, opinioni politiche, appartenenza sindacale, credo religioso o filosofico, vita sessuale o orientamento sessuale; raccolgono informazioni biometriche “in tempo reale” in spazi pubblici accessibili per l’applicazione della legge, salvo eccezioni ben definite e regolamentate. Tali eccezioni includono la ricerca di un bambino scomparso o la prevenzione di una specifica e imminente minaccia terroristica, ma richiedono l’autorizzazione di un’autorità giudiziaria o indipendente e sono soggette a limiti temporali, geografici e di database di ricerca. I sistemi di IA che operano con tecniche manipolatorie, come il riconoscimento delle emozioni sul posto di lavoro o la creazione di profili biometrici per classificare individui in base alla razza, l’orientamento sessuale o la religione, sono considerati troppo pericolosi per essere utilizzati. Il divieto riguarda anche pratiche come il social scoring e l’uso di IA per prevedere crimini sulla base dell’aspetto fisico di una persona. Questi divieti sono il risultato di un’approfondita riflessione sulla natura dei rischi che l’IA può comportare. La legge si pone l’obiettivo di ridurre i danni derivanti dall’uso irresponsabile delle tecnologie, proteggendo i diritti fondamentali degli individui da violazioni gravi. L’AI Act proibisce espressamente queste applicazioni, considerando che i danni potenziali sarebbero troppo grandi e difficili da mitigare. Alto: comprende applicazioni in infrastrutture critiche (come i trasporti), nell’istruzione, nella sicurezza dei prodotti, e nella giustizia, nell’ applicazione dell’IA nella chirurgia assistita da robot o software medici basati sull’IA, servizi pubblici e privati essenziali (per esempio il credit scoring che nega ai cittadini la possibilità di ottenere un prestito). Questi sistemi devono rispettare rigorosi obblighi di valutazione prima di essere immesse sul mercato. Rischio limitato: si riferisce alla trasparenza e include obblighi per informare gli utenti quando interagiscono con sistemi di IA, come chatbot o contenuti generati da IA; Il cuore dell’AI Act è l’identificazione di un “rischio inaccettabile”, un concetto che implica che alcune applicazioni di IA possano nuocere gravemente alla sicurezza, ai diritti e alla dignità delle persone. L’intelligenza artificiale è uno strumento formidabile ma alcuni sistemi la utilizzano per usare ed elaborare informazioni che contengono dati personali e sensibili. Dunque, ogni utente deve proteggersi e creare intorno a se e ai propri dispositivi una barriera. Inoltre, occorre sempre più mettersi al riparo dalle minacce esterne con sistemi all’avanguardia. L’implementazione dell’AI Act, unitamente ai rigidi dettami del GDPR e della direttiva NIS2, impone alle organizzazioni un innalzamento dei protocolli di sicurezza. In un panorama dove l’intelligenza artificiale viene spesso utilizzata come vettore per attacchi di ingegneria sociale e data exfiltration, l’adozione di soluzioni tecnologiche di difesa diventa un pilastro della business continuity. Per mitigare i rischi legati alla gestione delle identità e degli accessi, l’utilizzo di gestori di password aziendali come NordPass e 1Password rappresenta oggi uno standard necessario per prevenire il credential stuffing e garantire la segregazione dei privilegi. Parallelamente, la protezione del dato a riposo richiede sistemi di cifratura avanzata; in questo ambito, soluzioni di archiviazione crittografata come NordLocker permettono di mantenere la riservatezza delle informazioni sensibili, riducendo l’impatto finanziario di potenziali data breach. Sul fronte della prevenzione attiva e della difesa dell’endpoint, suite come Kaspersky Plus offrono monitoraggio in tempo reale contro malware e minacce ibride, integrando strumenti di rilevamento che si allineano alle richieste di vigilanza del regolatore europeo. Infine, la gestione della presenza digitale e la riduzione della superficie di attacco passano per la rimozione dei dati personali dai database dei broker di dati, un processo automatizzabile attraverso servizi come Incogni, essenziali per limitare il rischio di profilazione non autorizzata. Compatibilità: Windows, Mac, Android, iOS, Linux Estensioni web: Chrome, Firefox, Edge, Safari, Opera, Brave Crittografia: XChaCha20 2FA: ✓ Compilazione automatica: ✓ Versione Gratuita: ✓ Prezzo: da 1,29 €/mese NordPass è un password manager sicuro e intuitivo che consente di salvare e compilare automaticamente le credenziali, archiviare dati in modo protetto, accedere da più dispositivi, monitorare la salute delle password e rilevare eventuali violazioni di dati. Tra le funzionalità extra troviamo anche l’allegato di file e il mascheramento delle e-mail. Per le aziende, NordPass propone soluzioni dedicate con controlli centralizzati e impostazioni a livello organizzativo, integrazione con SSO (Google Workspace, Entra ID, MS ADFS, Okta) e dashboard di sicurezza e gestione di cartelle condivise. Premium: Sconto del 50% sul piano biennale; Family: Fino a 6 utenti, con tutte le funzionalità Premium e sincronizzazione multi-dispositivo; 30 giorni di garanzia soddisfatti o rimborsati su tutti i piani. Teams: ideale per piccoli gruppi, con gestione centralizzata; Business: Pensato per medie imprese, include SSO e dashboard avanzata; Enterprise: Per grandi organizzazioni, con supporto dedicato e provisioning personalizzato. Oltre alla componente economica, la scelta del piano incide direttamente sulle capacità di governance e integrazione IT dell’azienda: Focus: sicurezza essenziale per micro-imprese. Incluso: condivisione sicura, MFA, accesso offline e login tramite Google Workspace. Vincolo: fatturazione fissa per 10 licenze, indipendentemente dall’utilizzo effettivo inferiore. Focus: gestione del rischio e conformità per PMI. Incluso (oltre a Teams): condivisione per cartelle e gruppi, Data Breach Scanner (monitoraggio violazioni dominio) e integrazione con la piattaforma di compliance Vanta. Vantaggio: offre il miglior rapporto tra costo e strumenti di prevenzione proattiva. Focus: automazione e integrazione in infrastrutture complesse. Incluso (oltre a Business): SSO avanzato (Entra ID, Okta, ADFS), Provisioning automatico degli utenti e integrazione con sistemi SIEM come Splunk o Microsoft Sentinel. Vantaggio: massima scalabilità e controllo centralizzato dei log di accesso per audit di sicurezza. ⚡ Velocità upload: Veloce 🔄️ Accesso ai file offline: ✔️ 💰 Costo: da 2,99 €/mese 📱 Mobile: Android, iOS 💻 Desktop: Windows, macOS 🔐 Sicurezza: AES-256 🧑💻 Facilità di utilizzo: Molto facile 🔥 Offerte attive: SCONTO fino al 53% NordLocker è una soluzione avanzata di cloud storage sicuro che offre crittografia end-to-end per proteggere i file sia in locale che online. Grazie alla sincronizzazione su più dispositivi, consente di accedere ai dati in modo protetto da qualsiasi piattaforma, inclusi Windows, macOS, Android, iOS e browser. Funzionalità principali di NordLocker: Crittografia completa: i file sono protetti durante la memorizzazione e la trasmissione; Architettura zero-knowledge: solo l’utente può accedere ai contenuti; NordLocker non conserva né conosce le chiavi di crittografia; Condivisione sicura: possibilità di condividere file o cartelle protette, mantenendo sempre il controllo degli accessi; Accesso protetto da autenticazione a due fattori (2FA); Supporto clienti attivo 24/7 e priorità per gli utenti Premium. NordLocker, prodotto gemello di NordPass e NordVPN, si posiziona nel mercato del Cloud Storage sicuro con una proposta focalizzata sulla crittografia end-to-end. A differenza dei servizi cloud tradizionali, NordLocker adotta un approccio Zero-Knowledge, garantendo che solo l’utente proprietario delle chiavi di cifratura possa accedere al contenuto dei file. La strategia di penetrazione del mercato di NordLocker si basa su una forte scontistica per il primo anno di sottoscrizione, mirata a incentivare la migrazione da servizi meno sicuri. I prezzi sono espressi in USD come da offerta originale; l’IVA può essere applicata al momento del checkout. L’offerta di NordPass si distingue per l’integrazione di strumenti di cyber-resilienza avanzati: Crittografia “Ironclad”: utilizzo di algoritmi di cifratura avanzati per proteggere i file sia localmente (sul computer) che nel cloud. Sincronizzazione e backup: protezione automatica contro la perdita di dati. In caso di smarrimento o danneggiamento del dispositivo hardware, i dati rimangono recuperabili tramite il vault remoto. Condivisione sicura (Locker Sharing): a differenza dell’invio di file singoli, l’utente condivide l’intero “locker” (archivio cifrato), mantenendo il controllo granulare su chi può accedere e quando. Autenticazione a più fattori (MFA): un ulteriore livello di sicurezza per prevenire accessi non autorizzati all’account. Il risparmio maggiore si ottiene scalando verso il piano da 2 TB, dove il costo per gigabyte diventa estremamente competitivo rispetto al piano intermedio. L’adozione di NordLocker risulta particolarmente indicata per: Professionisti e Business: gestione di documenti legali, fiscali o sanitari che richiedono la conformità a standard di privacy rigorosi. Protezione contro ransomware: poiché i file sono cifrati e backuppati nel cloud, un eventuale attacco hacker locale non compromette la disponibilità dei dati remoti. Collaborazione protetta: possibilità di inviare grandi quantità di dati sensibili senza affidarsi a protocolli email non sicuri. Garanzia di recesso: come per la linea NordPass, anche NordLocker include una garanzia di rimborso di 30 giorni, permettendo una valutazione tecnica dell’interfaccia “drag and drop” e dei tempi di caricamento prima del consolidamento dell’investimento. Compatibilità: Windows, Mac, Android, iOS, Linux Estensioni web: Chrome, Firefox, Edge, Safari, Opera, Brave Crittografia: AES-256 2FA: ✓ Compilazione automatica: ✓ Versione Gratuita: ❌ Prezzo: da 2,65 €/mese L’attuale offerta di 1Password si delinea come una soluzione di gestione delle identità digitali cross-platform, caratterizzata da un modello di pricing a due velocità che incentiva la fidelizzazione annuale attraverso una riduzione del canone mensile superiore al 30% per i nuovi clienti. La tabella seguente evidenzia il risparmio ottenibile optando per la fatturazione annuale rispetto a quella mensile: Questi piani sono orientati alla sicurezza domestica e individuale. Il piano Families risulta particolarmente efficiente sotto il profilo dei costi, consentendo la condivisione di caveau illimitati e il controllo amministrativo sugli accessi dei membri. Una funzionalità distintiva è la Travel Mode, che permette di nascondere temporaneamente i caveau sensibili durante l’attraversamento delle frontiere. Le soluzioni aziendali di 1Password si concentrano sulla governance e sull’integrazione dei sistemi: Teams Starter Pack: un pacchetto a costo fisso per 10 utenti, ideale per startup. Business: include l’integrazione con fornitori di identità (Identity Providers) come Okta, Entra ID e OneLogin. inoltre, offre la funzionalità Watchtower per il monitoraggio proattivo della “salute” delle password aziendali e report sull’utilizzo del team. Integrazione AWS: è prevista la possibilità di acquisto tramite il marketplace AWS per semplificare la fatturazione consolidata all’interno di infrastrutture cloud esistenti. Il valore aggiunto di 1Password risiede nell’architettura di sicurezza basata sulla Secret Key (chiave segreta), che integra la password principale per generare una cifratura AES a 256 bit end-to-end. Sotto il profilo operativo, l’adozione di un piano Business permette di mitigare i rischi di data breach attraverso: Autenticazione a due fattori (2FA) e supporto alle Passkeys. Recovery dei conti: possibilità per gli amministratori di recuperare l’accesso degli utenti bloccati. Provisioning automatico: integrazione con strumenti SIEM (Splunk, Elastic) per il monitoraggio in tempo reale degli eventi di sicurezza. L’offerta promozionale indicata (es. € 2,74 per il piano Individual) è riservata ai nuovi clienti e limitata al primo anno di sottoscrizione con fatturazione annuale. Al termine del periodo promozionale, è prevista l’applicazione delle tariffe standard di listino. Tutti i piani includono una prova gratuita di 14 giorni senza obbligo di acquisto immediato. Incogni, servizio specializzato nella protezione dell’identità digitale, ha lanciato una campagna promozionale in occasione del Safer Internet Day. L’offerta mira a ridurre l’esposizione degli utenti a stalking, doxing e furti d’identità attraverso la rimozione automatizzata dei dati personali dai database dei data broker. L’iniziativa prevede uno sconto fino al 55% sui piani annuali utilizzando il codice coupon PROTECT26, con una finestra temporale di attivazione limitata . La strategia di pricing di Incogni incentiva la sottoscrizione annuale, dimezzando di fatto il canone mensile rispetto alla fatturazione ricorrente standard. L’algoritmo di Incogni interviene su tre livelli critici della filiera dei dati: Automazione su larga scala: il sistema invia e gestisce richieste di rimozione a oltre 420 broker di dati noti, ripetendo il processo periodicamente per evitare che i dati vengano reinseriti (recupero dei dati). Rimozioni personalizzate (piano Unlimited): gli utenti possono segnalare siti specifici dove hanno individuato i propri dati. Il team di Incogni gestisce la pratica senza richiedere la compilazione di moduli aggiuntivi. Monitoraggio e reporting: il servizio fornisce report mensili sull’andamento delle pratiche, offrendo una metrica tangibile sulla riduzione della propria “impronta digitale”. L’adozione di Incogni risponde alla necessità di mitigare i rischi derivanti dai data breach: rimuovendo i propri dati dai broker, si riduce la probabilità di essere bersaglio di campagne di phishing mirate, chiamate di spam e tentativi di frode creditizia. Procedura d’Ingresso: l’attivazione richiede la firma di un modulo di autorizzazione digitale, necessario affinché Incogni possa legalmente agire per conto dell’utente presso i soggetti terzi. Codice sconto: l’applicazione del codice PROTECT26 è necessaria per sbloccare la tariffa agevolata del 55%. Garanzia di rimborso: è prevista una clausola di salvaguardia di 30 giorni (money-back guarantee). Qualora il servizio non soddisfi i requisiti tecnici dell’utente, è possibile richiedere il rimborso integrale entro il primo mese. Massimo dispositivi: 5 Versione Free: Prova gratuita di 30 giorni Sistemi Operativi: Windows, macOS, Android, iOS Dark Web Monitoring: ✔ Protezione minori: ✔ VPN: inclusa Offerte attive: SCONTO fino al 45% 🔥 L’attuale offerta di Kaspersky si articola su una struttura modulare progettata per rispondere alle diverse esigenze di protezione del mercato consumer. La strategia commerciale punta sull’ottimizzazione delle performance e sulla riduzione del rischio d’identità, offrendo sconti significativi fino al 58% per il primo anno di sottoscrizione. L’ecosistema Kaspersky 2026 si basa su tre pilastri fondamentali per la continuità operativa e la protezione del dato: Tutti i piani Kaspersky, Standard, Plus e Premium includono un motore antivirus premiato (vincitore del premio “Product of the Year” di AV-Comparatives). Le statistiche operative riportano oltre 437 milioni di attacchi bloccati nell’ultimo anno, evidenziando l’efficacia delle tecnologie di intelligenza artificiale applicate alla scansione degli URL e degli oggetti dannosi. A partire dal piano Plus, viene integrata una VPN illimitata e superveloce (supporto WireGuard®), essenziale per la cifratura del traffico su reti non protette. Il “Controllo fughe di dati” monitora costantemente se le password o le email associate all’account sono state esposte in violazioni note. Il piano Premium di Kaspersky si configura come la soluzione di fascia alta, includendo: Wallet Identità: Archivio criptato per documenti sensibili. Supporto IT Prioritario: Accesso remoto di esperti per la risoluzione di problemi tecnici. Family Protection: Inclusione gratuita per un anno di Kaspersky Safe Kids per il monitoraggio GPS e il filtraggio dei contenuti per i minori. È fondamentale per l’utente considerare la struttura del modello di abbonamento: Fatturazione anticipata: l’addebito per il rinnovo avviene automaticamente circa 15 giorni prima della scadenza del periodo in corso. Variazione tariffe: il prezzo promozionale è limitato al primo periodo. Al rinnovo, verrà applicato il prezzo standard (es. € 84,99 per il Premium). Diritto di Recesso: Kaspersky offre una garanzia di rimborso entro 30 giorni sia per l’acquisto iniziale che per i rinnovi già addebitati. Incentivo Amazon: il Buono Regalo da 20 € legato al piano Premium rappresenta un ritorno economico immediato, abbattendo il costo effettivo del primo anno a soli € 14,99. Il software Kaspersky garantisce la piena operatività cross-platform: Mobile: Android 11 – 16 e iOS 26.nno rispetto al prezzo di rinnovo; 30 giorni di prova gratuita e garanzia di rimborso entro 30 giorni. Windows: 7 SP1 fino a Windows 11. macOS: Versioni 14 – 26. Massimo dispositivi: 10 Versione Free: prova gratuita di 30 giorni Sistemi Operativi: Windows, macOS, Android, iOS Dark Web Monitoring: ✔ Protezione minori: ✔ VPN: ✔ Offerte attive: SCONTO fino al 66% (per il primo anno) 🔥 Norton offre diverse soluzioni per computer e altri dispositivi tra cui anche smartphone e tablet. Norton aiuta a mantenere protetti i dati che, durante la navigazione, sono particolarmente esposti. Norton AntiVirus Plus con backup nel cloud da 2GB L’analisi dell’offerta commerciale di Norton, aggiornata al primo trimestre del 2026, evidenzia una strategia di posizionamento aggressiva volta a consolidare la quota di mercato nel settore della cybersecurity consumer e Small Business. La struttura dei prezzi riflette una marcata differenziazione tra il costo di acquisizione del cliente e le tariffe di rinnovo a regime, con sconti che raggiungono il 68% sulle soluzioni multidevice. Dal punto di vista funzionale, l’offerta Nordon integra la protezione antivirus tradizionale con tecnologie emergenti di intelligenza artificiale. Il modulo “Protezione anti-truffa”, incluso nei piani 360, è progettato per il rilevamento proattivo di tentativi di phishing, messaggistica fraudolenta e, dato di rilievo tecnico, l’identificazione di contenuti manipolati tramite deepfake. Il piano Deluxe, proposto a 34,99 € per il primo anno (circa 2,92 €/mese), rappresenta il punto di equilibrio economico per i nuclei familiari o i professionisti con più endpoint. Il vantaggio competitivo di questa configurazione risiede nel Dark Web Monitoring, una funzionalità che scansiona i mercati illegali alla ricerca di credenziali compromesse, operando in sinergia con il Password Manager integrato. Oltre alla protezione malware, l’abbonamento include garanzie e strumenti ausiliari di rilievo: Promessa protezione Virus al 100%: un impegno contrattuale che prevede il rimborso qualora gli esperti Norton non riescano a rimuovere un’infezione. Assistente Genie (IA): tool basato su intelligenza artificiale conversazionale specializzato nel triage di messaggi e offerte sospette. Supporto identità (Piano Advanced): assistenza dedicata per il ripristino dei documenti e in caso di furto del portafoglio fisico, estendendo la protezione oltre il perimetro digitale. In linea con le direttive europee sulla protezione dei dati, è opportuno ricordare che l’efficacia di questi sistemi dipende dall’integrazione fluida con i protocolli di sicurezza aziendali. Per le piccole imprese, la soluzione Norton Small Business offre una scalabilità specifica per la protezione dei dati dei clienti, un requisito fondamentale per la compliance normativa. Norton 360 Standard con SafeCam per PC Protezione per 1 dispositivo: PC, Mac, dispositivo Android o iOS. Funzionalità aggiuntive rispetto ad AntiVirus Plus: Secure VPN per una navigazione sicura e privata; SafeCam per PC, che blocca gli accessi non autorizzati alla webcam; Backup nel cloud da 10 GB per PC. Protezione per fino a 5 dispositivi: PC, Mac, dispositivi Android o iOS. Funzionalità aggiuntive rispetto a Standard: Protezione minori per monitorare e proteggere l’attività online dei bambini; Dark Web Monitoring: avvisa se le informazioni personali vengono trovate nel Dark Web; Backup nel cloud da 50 GB per PC. Protezione per fino a 10 dispositivi: PC, Mac, dispositivi Android o iOS. Funzionalità aggiuntive rispetto a Deluxe: Assistenza per il ripristino dell’identità in caso di furto di identità; Assistenza in caso di furto del portafoglio; Monitoraggio dei social media per rilevare attività sospette. Backup nel cloud da 200 GB per PC. Tutti i piani includono la Promessa Protezione Virus 100% che garantisce un rimborso nel caso in cui Norton non riesca a rimuovere un virus Disclaimer: Questo articolo contiene link di affiliazione: acquisti o ordini effettuati tramite tali link permetteranno al nostro sito di ricevere una commissione. I servizi potrebbero subire variazioni di prezzo dopo la pubblicazione. FAQ: ai act categorie di rischio L’AI Act classifica i sistemi di IA in quattro categorie di rischio: 1. Rischio inaccettabile: sistemi vietati che minacciano diritti e libertà fondamentali, come il social scoring, il riconoscimento facciale indiscriminato e la manipolazione emotiva. 2. Alto rischio: comprende applicazioni in infrastrutture critiche (trasporti), istruzione, sicurezza dei prodotti, giustizia, chirurgia assistita da robot e servizi essenziali come il credit scoring. Questi sistemi devono rispettare rigorosi obblighi di valutazione prima di essere immessi sul mercato. 3. Rischio limitato: si riferisce alla trasparenza e include obblighi per informare gli utenti quando interagiscono con sistemi di IA, come chatbot o contenuti generati da IA. 4. Rischio minimo: tutti gli altri sistemi di IA che non presentano rischi significativi e sono soggetti a requisiti minimi. I sistemi di IA considerati a rischio inaccettabile e quindi vietati dall’AI Act includono: – Sistemi di social scoring che classificano le persone in base al loro comportamento sociale – Tecnologie di riconoscimento facciale indiscriminato in spazi pubblici – Sistemi che utilizzano tecniche manipolatorie o subliminali per influenzare il comportamento – Sistemi che sfruttano le vulnerabilità di gruppi specifici basate su età o disabilità – Sistemi per il riconoscimento delle emozioni sul posto di lavoro o in ambito educativo – Creazione di profili biometrici per classificare individui in base a caratteristiche come razza, orientamento sessuale o religione – Sistemi per prevedere crimini sulla base dell’aspetto fisico di una persona Questi divieti sono entrati in vigore dal 2 febbraio 2025 e rappresentano il risultato di un’approfondita riflessione sui rischi che l’IA può comportare per i diritti fondamentali. I sistemi di IA ad alto rischio secondo l’AI Act comprendono applicazioni che operano in settori critici come: – Infrastrutture critiche (come i trasporti) – Istruzione e formazione professionale – Sicurezza dei prodotti – Giustizia e processi democratici – Applicazioni dell’IA nella chirurgia assistita da robot o software medici – Servizi pubblici e privati essenziali (come il credit scoring che può negare ai cittadini la possibilità di ottenere un prestito) Questi sistemi AI ad alto rischio, pur essendo consentiti, sono fortemente regolati e devono rispettare rigorosi obblighi prima di essere immessi sul mercato, tra cui: – Valutazioni di impatto sui diritti fondamentali – Sistemi di gestione della qualità e del rischio – Sorveglianza continua anche dopo il rilascio – Documentazione tecnica dettagliata – Qualità e rappresentatività dei dati di addestramento L’AI Act prevede sanzioni pesanti per le aziende, istituzioni, agenzie o organismi dell’UE che non rispettano le disposizioni. Le multe possono arrivare fino a 35 milioni di euro o al 7% del fatturato globale annuo, a seconda di quale valore sia maggiore. Questo include anche le aziende internazionali che operano all’interno dell’Unione Europea, applicando l’AI Act con un effetto extraterritoriale. Per le PMI, la soglia sanzionatoria è l’importo più basso tra i due previsti, mentre per le altre imprese si applica l’importo più elevato. È fondamentale per le aziende operanti nell’UE comprendere l’interazione tra l’AI Act e altri regolamenti europei, come il GDPR e la direttiva NIS2, per evitare sovrapposizioni di obblighi e garantire una gestione corretta degli incidenti e dei rischi. L’AI Act non pone nessun tipo di limite dimensionale o settoriale, quindi anche le PMI e le microimprese dovranno affrontare un percorso di compliance proporzionato all’impatto dell’AI nel loro business. Il regolamento distingue tra due principali categorie di soggetti: i provider (chi sviluppa e/o modifica modelli di GPAI per trarne profitto) e gli utilizzatori (chi usa strumenti di AI per scopi aziendali). Per le piccole imprese, è consigliabile: 1. Iniziare con un’analisi delle reali esigenze di strumenti AI, individuando reparti, funzioni e utenti coinvolti 2. Mappare i modelli di AI utilizzati secondo le categorie di rischio previste dal regolamento 3. Stabilire un piano d’azione che includa test, audit, documentazione e procedure da tenere costantemente aggiornati 4. Investire nella formazione di dipendenti e dirigenti, senza sottovalutare nessuna mansione Per facilitare l’adeguamento delle PMI, la Commissione europea ha pubblicato un Codice di buone pratiche sull’IA che fornisce indicazioni per un approccio responsabile e semplificato. L’AI Act introduce obblighi stringenti in materia di cyber security per le aziende che sviluppano e adottano sistemi di intelligenza artificiale. Questi includono: – Conservazione dei file di log per garantire la tracciabilità delle operazioni – Implementazione di solide pratiche di data governance – Predisposizione di documentazione tecnica dettagliata – Creazione di meccanismi di controllo umano (human oversight) – Sicurezza e qualità dei dataset utilizzati per l’addestramento, che devono essere equamente rappresentativi e non discriminatori – Etichettatura chiara di chatbot, sistemi generativi e contenuti sintetici per evitare manipolazioni La dimensione della cyber security diventa particolarmente rilevante per i sistemi classificati come ad alto rischio, come quelli utilizzati da banche e assicurazioni. Per garantire la conformità, le aziende devono costruire “un sistema interno che parte dalla definizione di un modello di governance” in cui la cyber security assume un ruolo trasversale, diventando parte integrante dei processi di controllo e monitoraggio. Secondo l’AI Act, un sistema di IA è definito come: “Un sistema basato su macchina progettato per operare con diversi livelli di autonomia e che può mostrare adattabilità dopo il suo impiego, e che, per obiettivi espliciti o impliciti, deduce, in base agli input che riceve, come generare output come previsioni, contenuti, raccomandazioni o decisioni che possono influenzare ambienti fisici o virtuali”. Questa definizione si articola in sette elementi chiave: 1. È un sistema basato su macchina 2. È progettato per operare con diversi livelli di autonomia 3. Può mostrare adattabilità dopo l’impiego 4. Opera per obiettivi espliciti o impliciti 5. Deduce, sulla base degli input ricevuti 6. Genera output come previsioni, contenuti, raccomandazioni o decisioni 7. Può influenzare ambienti fisici o virtuali Due caratteristiche emergono come distintive: l’autonomia e l’inferenza. L’autonomia permette al sistema di agire indipendentemente, mentre l’inferenza consente di prendere decisioni e fare previsioni basate sui dati analizzati. L’AI Act si applicherà in diverse fasi, con scadenze e requisiti graduali per facilitare l’adozione e la conformità: – 1-2 febbraio 2025: entrata in vigore dei divieti per i sistemi di IA a rischio inaccettabile – Agosto 2025: entrata in vigore degli obblighi per i sistemi di intelligenza artificiale a finalità generali – Agosto 2026: applicazione completa di tutti i requisiti di sicurezza e governance Tuttavia, recenti sviluppi indicano che la Commissione UE starebbe valutando una moratoria/pausa su alcune disposizioni dell’AI Act, con lo scopo di concedere alle imprese più tempo per adeguarsi. Si starebbe considerando un “grace period” di un anno per le aziende che utilizzano sistemi AI ad alto rischio o che li hanno già immessi sul mercato prima della data di entrata in vigore delle nuove norme. Parallelamente, per le obbligazioni legate alla trasparenza si valuterebbe un possibile rinvio delle sanzioni fino ad agosto 2027. L’utilizzo dell’AI Generativa in azienda comporta diversi rischi di conformità normativa. Con questi strumenti è molto facile violare la normativa privacy quando vengono utilizzati per trattare dati personali, o la normativa sul diritto d’autore quando si utilizzano come fonti opere protette. Per quanto riguarda la privacy, si verificano due specifiche fattispecie di possibili violazioni: 1. I dati inseriti potrebbero essere utilizzati per migliorare il modello stesso, comportando una comunicazione di dati personali di cui l’interessato non è a conoscenza 2. Se si trattano dati personali con un sistema di AI per profilare soggetti, si entra nell’ambito dell’articolo 22 del GDPR, che disciplina in modo rigoroso tale aspetto Inoltre, alcuni usi di questi strumenti potrebbero configurare una condizione classificata ad alto rischio dall’AI Act. Ad esempio, se si chiede a un sistema di AI generativa di valutare le anomalie di comportamento dei dipendenti basate sui dati delle timbrature, si entra nell’ambito dell’analisi comportamentale, classificata come ad alto rischio. È quindi fondamentale che le aziende definiscano una policy specifica sull’uso degli strumenti di AI generativa, che indichi il possibile uso, i divieti, le attenzioni necessarie, e preveda una formazione adeguata del personale. Lo standard ISO/IEC 42001:2023 rappresenta una risorsa preziosa per le organizzazioni che desiderano allinearsi ai requisiti dell’AI Act, in quanto fornisce linee guida dettagliate per la creazione, gestione e miglioramento continuo di un sistema di gestione dell’IA. Lo standard si inquadra nel contesto della cosiddetta soft law, ossia delle pratiche volontarie di adozione dei sistemi di gestione e di qualità certificabili da enti terzi accreditati che mirano a consolidare la conformità normativa. L’adozione di questi modelli attuativi extra legislativi è incoraggiata dalle politiche e norme comunitarie. Lo standard ISO/IEC 42001:2023 offre un quadro per la gestione del rischio legato all’intelligenza artificiale, fornendo una serie di controlli e obiettivi, intesi come presidi dell’equità, della sicurezza, della trasparenza, della privacy e della robustezza. Rispecchia molte delle disposizioni dell’AI Act, richiedendo valutazioni regolari dei rischi associati ai sistemi di IA, audit frequenti, una gestione continua della qualità e dei rischi. L’ISO/IEC 42001 pone un’enfasi particolare sulla gestione e la qualità dei dati lungo l’intero ciclo di vita del sistema di IA, fornendo linee guida dettagliate per garantire che i dati utilizzati siano adeguati, affidabili e sicuri. Questo aspetto è fondamentale anche per l’AI Act, che richiede sistemi di IA equi e non discriminatori.

Cybersecurity researchers have disclosed a new iteration of the ongoing Contagious Interview campaign, where the North Korean threat actors have published a set of 26 malicious packages to the npm registry. The packages masquerade as developer tools, but contain functionality to extract the actual command-and-control (C2) by using seemingly harmless Pastebin content as a dead drop resolver and ultimately drop a developer-targeted credential stealer and remote access trojan. The C2 infrastructure is hosted on Vercel across 31 deployments. The campaign, discovered by Socket and kmsec.uk's Kieran Miyamoto, is being tracked under the moniker StegaBin. It's attributed to a North Korean threat activity cluster known as Famous Chollima. "The loader extracts C2 URLs steganographically encoded within three Pastebin pastes, innocuous computer science essays in which characters at evenly-spaced positions have been replaced to spell out hidden infrastructure addresses," Socket researchers Philipp Burckhardt and Peter van der Zee said. The list of the malicious npm packages is as follows - [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] All identified packages come with an install script ("install.js") that's automatically executed during package installation, which, in turn, runs the malicious payload located in "vendor/scrypt-js/version.js." Another common aspect that unites the 26 packages is that they explicitly declare the legitimate package they are typosquatting as a dependency, likely in an attempt to make them appear credible. The payload serves as a text steganography decoder by contacting a Pastebin URL and extracting its contents to retrieve the actual C2 Vercel URLs. While the pastes seemingly contain a benign essay about computer science, the decoder is designed to look at specific characters in certain positions in the text and string them together to create a list of C2 domains. "The decoder strips zero-width Unicode characters, reads a 5-digit length marker from the beginning, calculates evenly-spaced character positions throughout the text, and extracts the characters at those positions," Socket said. "The extracted characters are then split on a ||| separator (with an ===END=== termination marker) to produce an array of C2 domain names." The malware then reaches out to the decoded domain to fetch platform-specific payloads for Windows, macOS, and Linux, a tactic widely observed in the Contagious Interview campaign. One such domain, "ext-checkdin.vercel[.]app" has been found to serve a shell script, which then contacts the same URL to retrieve a RAT component. The Trojan connects to 103.106.67[.]63:1244 to await further instructions that allow it to change the current directory and execute shell commands, through which a comprehensive intelligence collection suite is deployed. It contains nine modules to facilitate Microsoft Visual Studio Code (VS Code) persistence, keylogging and clipboard theft, browser credential harvesting, TruffleHog secret scanning, and Git repository and SSH key exfiltration - vs, which uses a malicious tasks.json file to contact a Vercel domain every time a project is opened in VS Code by taking advantage of the runOn: "folderOpen" trigger. The module specifically scans the victim's VS Code config directory across all three platforms and writes the malicious tasks.json directly into it. clip, which acts as a keylogger, mouse tracker, and clipboard stealer with support for active window tracking and conducts periodic exfiltration every 10 minutes. bro, which is a Python payload to steal browser credential stores. j, which is a Node.js module used for browser and cryptocurrency theft by targeting Google Chrome, Brave, Firefox, Opera, and Microsoft Edge, and extensions like MetaMask, Phantom, Coinbase Wallet, Binance, Trust, Exodus, and Keplr, among others. On macOS, it also targets the iCloud Keychain. z, which enumerates the file system and steals files matching certain predefined patterns. n, which acts as a RAT to grant the attacker the ability to remotely control the infected host in real-time via a persistent WebSocket connection to 103.106.67[.]63:1247 and exfiltrate data of interest over FTP. truffle, which downloads the legitimate TruffleHog secrets scanner from the official GitHub page to discover and exfiltrate developer secrets. git, which collects files from .ssh directories, extracts Git credentials, and scans repositories. sched, which is the same as "vendor/scrypt-js/version.js" and is redeployed as a persistence mechanism. "While previous waves of the Contagious Interview campaign relied on relatively straightforward malicious scripts and Bitbucket-hosted payloads, this latest iteration demonstrates a concerted effort to bypass both automated detection and human review," Socket concluded. "The use of character-level steganography on Pastebin and multi-stage Vercel routing points to an adversary that is refining its evasion techniques and attempting to make its operations more resilient." The disclosure comes as the North Korean actors have also been observed publishing malicious npm packages (e.g., express-core-validator) to fetch a next-stage JavaScript payload hosted on Google Drive. "Only a single package has been published with this new technique," Miyamoto said. "It is likely Famous Chollima will continue to leverage multiple techniques and infrastructure to deliver follow-on payloads. It is unlikely this signals a complete overhaul of their stager behaviour on npm."

A Chrome extension named "QuickLens - Search Screen with Google Lens" has been removed from the Chrome Web Store after it was compromised to push malware and attempt to steal crypto from thousands of users. QuickLens was initially published as a Chrome extension that lets users run Google Lens searches directly in their browser. The extension grew to roughly 7,000 users and, at one point, received a featured badge from Google. However, on February 17, 2026, a new version 5.8 was released that contained malicious scripts that introduced ClickFix attacks and info-stealing functionality for those using the extension. The malicious QuickLens extension Security researchers at Annex first reported that the extension had recently changed ownership after being listed for sale on ExtensionHub, a marketplace where developers sell browser extensions. Annex says that on February 1, 2026, the owner changed to [email protected] under "LLC Quick Lens," with a new privacy policy hosted on a barely functional domain. Just over two weeks later, the malicious update was pushed to users. Annex's analysis shows that version 5.8 requested new browser permissions, including declarativeNetRequestWithHostAccess and webRequest. It also included a rules.json file that stripped browser security headers, such as Content-Security-Policy (CSP), X-Frame-Options, and X-XSS-Protection, from all pages and frames. These headers would have made it more difficult to run malicious scripts on websites. The update also introduced communication with a command-and-control (C2) server at api.extensionanalyticspro[.]top. According to Annex, the extension generated a persistent UUID, fingerprinted the victim's country using Cloudflare's trace endpoint, identified the browser and OS, and then polled the C2 server every five minutes for instructions. BleepingComputer learned about the extension this week after seeing numerous users [1, 2] reporting fake Google Update alerts on every web page they visited. "That is appearing in every site i go, i through it could be because Chrome wasn't updated, but even after uptading it continues to appear," a user seeking help said on Reddit. "Of course i will not run the code that it copy on my clipboard on the run box but it keeps appearing in every site, making it impossible to interact with anything." BleepingComputer's analysis of the extension showed it connected to a C2 server at https://api.extensionanalyticspro[.]top/extensions/callback?uuid=[uuid]&extension=kdenlnncndfnhkognokgfpabgkgehoddto, where it received an array of malicious JavaScript scripts. These payloads were then executed on every page load using a technique that Annex described as a "1x1 GIF pixel onload trick." Because the extension stripped CSP headers on all visited sites, this inline JavaScript execution worked even on sites that would normally block it. The first payload contacts google-update[.]icu, where it receives an additional payload that displays a fake Google Update prompt. Clicking the update button would display a ClickFix attack, prompting users to perform a verification by running code on their computers. For Windows users, this led to the download of a malicious executable named "googleupdate.exe" [VirusTotal] that was signed with a certificate from "Hubei Da'e Zhidao Food Technology Co., Ltd." Upon execution, the malware launched a hidden PowerShell command that spawned a second PowerShell instance to connect to drivers[.]solutions/META-INF/xuoa.sys using a custom "Katzilla" user agent. The response was piped into Invoke-Expression for execution. However, by the time BleepingComputer analyzed the payloads, the second-stage URL was no longer serving any malicious content. Another malicious JavaScript "agent" delivered by the https://api.extensionanalyticspro[.]top C2 was used to steal cryptocurrency wallets and credentials. The extension would detect if MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Solflare, Backpack, Brave Wallet, Exodus, Binance Chain Wallet, WalletConnect, and the Argon crypto wallets were installed. If so, it would attempt to steal activity and seed phrases, which would be used to hijack wallets and steal their assets. Another script captured login credentials, payment information, and other sensitive form data. Additional payloads were used to scrape Gmail inbox contents, extract Facebook Business Manager advertising account data, and collect YouTube channel information. A review of the now-removed Chrome extension page claims that macOS users were targeted with the AMOS (Atomic Stealer) infostealer. BleepingComputer has not been able to independently verify if these claims are true. Google has since removed QuickLens from the Chrome Web Store, and Chrome now automatically disables it for affected users. Users who installed QuickLens - Search Screen with Google Lens should ensure the extension is fully removed, scan their device for malware, and reset passwords for any credentials stored in the browser. If you use any of the mentioned cryptocurrency wallets, you should transfer your funds to a new wallet. This extension is not the first to be used in ClickFix attacks. Last month, Huntress discovered a browser extension that intentionally crashed browsers and then displayed fake fixes that installed the ModeloRAT malware. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Google on Friday released security updates for its Chrome browser to address a security flaw that it said has been exploited in the wild. The high-severity vulnerability, tracked as CVE-2026-2441 (CVSS score: 8.8), has been described as a use-after-free bug in CSS. Security researcher Shaheen Fazim has been credited with discovering and reporting the shortcoming on February 11, 2026. "Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page," according to a description of the flaw in the NIST's National Vulnerability Database (NVD). Google did not disclose any details about how the vulnerability is being exploited in the wild, by whom, or who may have been targeted, but it acknowledged that "an exploit for CVE-2026-2441 exists in the wild." While Google Chrome is no stranger to actively exploited vulnerabilities, the development once again highlights how browser-based flaws are an attractive target for malicious actors, given that they are installed everywhere and expose a broad attack surface. The disclosure of CVE-2026-2441 makes it the first actively exploited zero-day in Chrome that Google has patched in 2026. Last year, the tech giant addressed eight zero-day flaws in Chrome that were either actively exploited or demonstrated as a proof-of-concept (PoC). Last week, Apple also shipped iOS, iPadOS, macOS Tahoe, tvOS, watchOS, and visionOS updates to address a zero-day flaw (CVE-2026-20700, CVSS score: 7.8) that had been weaponized as a zero-day to execute arbitrary code on susceptible devices as part of an "extremely sophisticated attack" targeting specific individuals who were running iOS versions before iOS 26. For optimal protection, users are advised to update their Chrome browser to versions 145.0.7632.75/76 for Windows and Apple macOS, and 144.0.7559.75 for Linux. To make sure the latest updates are installed, users can navigate to More > Help > About Google Chrome and select Relaunch. Users of other Chromium-based browsers, such as Microsoft Edge, Brave, Opera, and Vivaldi, are also advised to apply the fixes as and when they become available.

SYSTEMS What Nvidia's first Groq 3 LPU benchmarks tell us about its $20B gambleGemma 4 31B performance tests offer a best-case scenario for next-gen dataflow accelerators ON-PREM US datacenters tripled their water footprint in 10 years... and those are figures from the start of the AI boom. It can only be worse now. Silo-ed reporting isn't helping ai and ML AI slop is good for business if you know what you're doingYour irresponsibility is someone else's opportunity SAAS Salesforce partners not seeing meaningful revenue from Agentforce AI platform, report saysShow us the money ai and ml AI companies are burning books, advocates complain to FTCFahrenheit 203, the temperature GPUs stop gorging on literature Security Russians are posing as Signal support to launch phishing attacksPLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more! Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attackPLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructureVoting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included Security EQT buys majority share in Swiss cybersecurity biz AcronisWent at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sightOn the plus side, infosec's a good bet for a long, stable career Emperor Penguin Linus Torvalds banishes a bug – with a botThe lad himself finds and fixes a tricky one… or does he? FOSS smashed one Microsoft monopoly. After 20 years of failure, it's time to smash anotherWord up GNOME can look like Windows – and Flashback can do it without extensionsNew 'Simple-taskbar' is an option, but there's a simpler, stabler way A moment of silence, please, for the final release of Debian on x86-32New Debian versions hit FOSSland in the form of 13.6 and 12.15 Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websitesFlaws in iCagenda, Balbooa Forms extensions can impact open source CMS that powers a million sites worldwide Frame: A new X11 server – implemented directly in assemblyJoins yserver, Phoenix, and of course XLibre – and outlier Arcan

ON-PREM US datacenters tripled their water footprint in 10 years... and those are figures from the start of the AI boom. It can only be worse now. Silo-ed reporting isn't helping ai and ML AI slop is good for business if you know what you're doingYour irresponsibility is someone else's opportunity SAAS Salesforce partners not seeing meaningful revenue from Agentforce AI platform, report saysShow us the money ai and ml AI companies are burning books, advocates complain to FTCFahrenheit 203, the temperature GPUs stop gorging on literature DEVOPS Go updates may delight diehard gophers but displease AI overlordsv 1.27 expands generics to support methods Security Russians are posing as Signal support to launch phishing attacksPLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more! Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attackPLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructureVoting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included Security EQT buys majority share in Swiss cybersecurity biz AcronisWent at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sightOn the plus side, infosec's a good bet for a long, stable career FOSS smashed one Microsoft monopoly. After 20 years of failure, it's time to smash anotherWord up GNOME can look like Windows – and Flashback can do it without extensionsNew 'Simple-taskbar' is an option, but there's a simpler, stabler way A moment of silence, please, for the final release of Debian on x86-32New Debian versions hit FOSSland in the form of 13.6 and 12.15 Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websitesFlaws in iCagenda, Balbooa Forms extensions can impact open source CMS that powers a million sites worldwide Frame: A new X11 server – implemented directly in assemblyJoins yserver, Phoenix, and of course XLibre – and outlier Arcan Cinnamon 6.8 will support Wayland – if you want itNext version of Linux Mint’s desktop has both kinds of display server

Brave has introduced a new AI browsing feature that leverages Leo, its privacy-respecting AI assistant, to perform automated tasks for the user. Intended to assist with tasks such as autonomous web research, product comparison, promo-code discovery, and news summarization, the feature is currently in its testing phase and accessible through the Brave Nightly version. The new agentic AI browsing mode is disabled by default and represents the first step towards tighter AI-user integration for the privacy-focused browser. AI risk and how Brave deals with it Brave stresses that agentic AI browsing is "inherently dangerous" and shouldn’t be used for critical operations, mainly due to prompt injection attacks and the potential for misinterpreting users' intent. To mitigate this risk, the new mode runs on a separate, isolated profile that does not have access to the user’s cookies, login information, and other sensitive data. The mode will also be restricted from accessing the browser’s settings page, non-HTTPS sites, the Chrome Web Store, where it could download extensions, and any sites flagged by Brave’s Safe Browsing system. All its actions will be visible in tabs, and anything risky will trigger warnings to the user, requesting their explicit approval. Additionally, the mode will be monitored by an ‘alignment checker’ mechanism, similar to what Google announced recently for Gemini’s agentic mode on Chrome, where an isolated second model evaluates whether the agent’s actions match user intent. Being isolated, this second model cannot be affected by prompt-injection attacks that target the primary agent. Additionally, Brave will encode specific policy-based rules and use models trained to mitigate prompt injection, such as Claude Sonnet, to provide effective protection. Regarding data privacy, which is Brave’s core value, the vendor says there will be no compromise. The system will keep the same ad/tracker blocking and no-logs policy, while no user data will be used for AI model training. Testing the new mode Those interested in testing Brave’s new agentic AI mode can do so only through Brave Nightly, after enabling the “Brave’s AI browsing” flag in ‘brave://flags.’ This will enable a button on Leo’s chat box that activates the new browsing mode. Tester feedback to help address any issues may be submitted here, while Brave also announced it’s doubling its HackerOne bug bounty payments for in-scope submissions concerning AI browsing. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Google has released an update for its Chrome browser that includes 13 security fixes, four of which are classified as high severity. One of these was found in Chrome’s Digital Credentials feature–a tool that lets you share verified information from your digital wallet with websites so you can prove who you are across devices. Chrome is by far the world’s most popular browser, with an estimated 3.4 billion users. That scale means when Chrome has a security flaw, billions of users are potentially exposed until they update. That’s why it’s important to install these patches promptly. Staying unpatched means you could be at risk just by browsing the web, and attackers often exploit these kinds of flaws before most users have a chance to update. Always let your browser update itself, and don’t delay restarting the browser as updates usually fix exactly this kind of risk. How to update Chrome The latest version number is 143.0.7499.40/.41 for Windows and macOS, and 143.0.7499.40 for Linux. So, if your Chrome is on version 143.0.7499.40 or later, it’s protected from these vulnerabilities. The easiest way to update is to allow Chrome to update automatically, but you can end up lagging behind if you never close your browser or if something goes wrong—such as an extension stopping you from updating the browser. To update manually, click the More menu (three dots), then go to Settings > About Chrome. If an update is available, Chrome will start downloading it. Restart Chrome to complete the update, and you’ll be protected against these vulnerabilities. You can also find step-by-step instructions in our guide to how to update Chrome on every operating system. Technical details One of the vulnerabilities was found in the Digital Credentials feature and is tracked as CVE-2025-13633. As usual Google is keeping the details sparse until most users have updated. The description says: Use after free in Digital Credentials in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. That sounds complicated so let’s break it down. Use after free (UAF) is a specific type of software vulnerability where a program attempts to access a memory location after it has been freed. That can lead to crashes or, in some cases, let an attackers run their own code. The renderer process is the part of modern browsers like Chrome that turns HTML, CSS, and JavaScript into the visible webpage you see in a tab. It’s sandboxed for safety, separate from the browser’s main “browser process” that manages tabs, URLs, and network requests. So, for HTML pages, this is essentially the browser’s webpage display engine. The heap is an area of memory made available for use by the program. The program can request blocks of memory for its use within the heap. In order to allocate a block of some size, the program makes an explicit request by calling the heap allocation operation. A “remote attacker who had compromised the renderer” means the attacker would already need a foothold (for example, via a malicious browser extension) and then lure you to a site containing specially crafted HTML code. So, my guess is that this vulnerability could be abused by a malicious extension to steal the information handled through Digital Credentials. The attacker could access information normally requiring a passkey, making it a tempting target for anyone trying to steal sensitive information. Some of the fixes also apply to other Chromium browsers, so if you use Brave, Edge, or Opera, for example, you should keep an eye out for updates there too. Let’s face it, an incognito window can only do so much. Breaches, dark web trading, credit fraud. Malwarebytes Identity Theft Protection monitors for all of it, alerts you fast, and comes with identity theft insurance.

Google patches yet another exploited Chrome zero-day (CVE-2025-13223) Google has shipped an emergency fix for a Chrome vulnerability (CVE-2025-13223) reported as actively exploited in the wild by its Threat Analysis Group (TAG). About CVE-2025-13223 CVE-2025-13223 is a type confusion vulnerability in V8, the JavaScript and WebAssembly engine used by Chrome and Chromium-based browsers. The flaw allows remote attackers to exploit heap corruption via a specially crafted HTML page, and can lead to unauthorized actions such as accessing sensitive data. For the exploit to have a chance to work, targets must be tricked into visiting such a page. CVE-2025-13223 and a second V8 type-confusion flaw, CVE-2025-13224, have been fixed in Chrome: v142.0.7444.175/.176 (for Windows) v142.0.7444.176 (for macOS) v142.0.7444.175 (for Linux) CVE-2025-13223 was reported by Clément Lecigne of Google TAG, and CVE-2025-13224 was discovered by Big Sleep, Google’s autonomous AI-powered system for automated vulnerability research. Zero-days affecting V8 are often exploited by attackers: in 2025 alone, Google fixed several of them after TAG researchers flagged related abuse. Updates are available/incoming Google says that the fixed Chrome versions will roll out over the coming days/weeks. The browser is updated automatically once updates become available, but you can also manually trigger the update to a fixed version (go to Settings -> About Chrome) and then relaunch the application to finalize the upgrade. Chromium-based browsers like Microsoft Edge, Brave, and Opera are expected to get these fixes soon, and Vivaldi maintainers have already delivered a fix for CVE-2025-13223. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

Cybersecurity researchers have revealed a new attack method targeting AI browsers, which they refer to as AI sidebar spoofing. This attack exploits users’ growing habit of blindly trusting instructions they get from artificial intelligence. The researchers successfully implemented AI sidebar spoofing against two popular AI browsers: Comet by Perplexity and Atlas by OpenAI. Initially, the researchers used Comet for their experiments, but later confirmed that the attack was viable in the Atlas browser as well. This post uses Comet as an example when explaining the mechanics of AI sidebar spoofing, but we urge the reader to remember that everything stated below also applies to Atlas. How do AI browsers work? To begin, let’s wrap our heads around AI browsers. The idea of artificial intelligence replacing, or at least transforming the familiar process of searching the internet began to generate buzz between 2023 and 2024. The same period saw the first-ever attempts to integrate AI into online searches. Initially, these were supplementary features within conventional browsers — such as Microsoft Edge Copilot and Brave Leo — implemented as AI sidebars. They added built-in assistants to the browser interface for summarizing pages, answering questions, and navigating sites. By 2025, the evolution of this concept ushered in Comet from Perplexity AI — the first browser designed for user-AI interaction from the ground up. This made artificial intelligence the centerpiece of Comet’s user interface, rather than just an add-on. It unified search, analysis, and work automation into a seamless experience. Shortly thereafter, in October 2025, OpenAI introduced its own AI browser, Atlas, which was built around the same concept. Comet’s primary interface element is the input bar in the center of the screen, through which the user interacts with the AI. It’s the same with Atlas. Besides, AI browsers allow users to engage with the artificial intelligence right on the web page. They do this through a built-in sidebar that analyzes content and handles queries — all without having the user leave the page. The user can ask the AI to summarize an article, explain a term, compare data, or generate a command while remaining on the current page. This level of integration conditions users to take the answers and instructions provided by the built-in AI for granted. When an assistant is seamlessly built into the user interface and feels like a natural part of the system, most people rarely stop to double-check the actions it suggests. This trust is precisely what the attack demonstrated by the researchers exploits. A fake AI sidebar can issue false instructions — directing the user to execute malicious commands or visit phishing websites. How did the researchers manage to execute the AI sidebar spoofing attack? The attack starts with the user installing a malicious extension. To do its evil deeds, it needs permissions to view and modify data on all visited sites, as well as access to the client-side data storage API. All of these are quite standard permissions; without the first one — no browser extension will work at all. Therefore, the chances that the user will get suspicious when a new extension requests these permissions are almost zero. You can read more about browser extensions and the permissions they request in our post Browser extensions: more dangerous than you think. Once installed, the extension injects JavaScript into the web page and creates a counterfeit sidebar that looks strikingly similar to the real thing. This shouldn’t raise any red flags with the user: when the extension receives a query, it talks to the legitimate LLM and faithfully displays its response. The researchers used Google Gemini in their experiments, though OpenAI’s ChatGPT likely would have worked just as well. The fake sidebar can selectively manipulate responses to specific topics or key queries set in advance by the potential attacker. This means that in most cases, the extension will simply display legitimate AI responses, but in certain situations it will display malicious instructions, links, or commands instead. How realistic is the scenario where an unsuspecting user installs a malicious extension capable of the actions described above? Experience shows it is highly probable. On our blog, we’ve repeatedly reported on dozens of malicious and suspicious extensions that successfully make it into the official Chrome Web Store. This continues to occur despite all the security checks conducted by the store and the vast resources at Google’s disposal. Read more about how malicious extensions end up in official stores in our post 57 shady Chrome extensions clock up six million installs. Consequences of AI sidebar spoofing Now let’s discuss what attackers can use a fake sidebar for. As noted by the researchers, the AI sidebar spoofing attack offers potential malicious actors ample opportunities to cause harm. To demonstrate this, the researchers described three possible attack scenarios and their consequences: crypto-wallet phishing, Google account theft, and device takeover. Let’s examine each of them in detail. Using a fake AI sidebar to steal Binance credentials In the first scenario, the user asks the AI in the sidebar how to sell their cryptocurrency on the Binance crypto exchange. The AI assistant provides a detailed answer that includes a link to the crypto exchange. But this link doesn’t lead to the real Binance site — it takes you to a remarkably convincing fake. The link points to the attacker’s phishing site, which uses the fake domain name binacee. Next, the unsuspecting user enters their Binance credentials and the code for two-factor authentication, if needed. After this, the attackers gain full access to the victim’s account and can siphon off all funds from their crypto wallets. Using a fake AI sidebar to take over a Google account The next attack variation also begins with a phishing link — in this case, to a fake file-sharing service. If the user clicks the link, they’re taken to a website where the landing page prompts them to sign in with their Google account right away. After the user clicks this option, they’re redirected to the legitimate Google login page to enter their credentials there, but then the fake platform requests full access to the user’s Google Drive and Gmail. If the user fails to scrutinize the page, and automatically clicks Allow, they grant attackers permissions for highly dangerous actions: Viewing their emails and settings. Reading, creating, and sending emails from their Gmail account. Viewing and downloading all the files they store in Google Drive. This level of access gives the cybercriminals the ability to steal the victim’s files, use services and accounts linked to that email address, and impersonate the account owner to disseminate phishing messages. Reverse shell initiated through a fake AI-generated utility installation guide Finally, in the last scenario, the user asks the AI how to install a certain application; the Homebrew utility was used in the example, but it could be anything. The sidebar shows the user a perfectly reasonable, AI-generated guide. All steps in it look plausible and correct up until the final stage, where the utility installation command is replaced with a reverse shell. If the user follows the AI’s instructions by copying and pasting the malicious code into the terminal and then running it, their system will be compromised. The attackers will be able to download data from the device, monitor activity, or install malware and continue the attack. This scenario clearly demonstrates that a single replaced line of code in a trusted AI interface is capable of fully compromising a device. How to avoid becoming a victim of fake AI-sidebars The AI sidebar spoofing attack scheme is currently only theoretical. However, in recent years attackers have been very quick to turn hypothetical threats into practical attacks. Thus, it’s quite possible that some malware creator is already hard at work on a malicious extension using a fake AI-sidebar, or uploading one to an official extension store. Therefore, it’s important to remember that even a familiar browser interface can be compromised. And even if instructions look convincing and come from the in-browser AI assistant, you shouldn’t blindly trust them. Here’s some final tips to help you avoid falling victim to an attack involving fake AI: When using AI assistants, carefully check all commands and links before following the AI’s recommendations. If the AI recommends executing any programming code, copy it and find out what it does by pasting it into a search engine in a different, non-AI browser. Don’t install browser extensions — AI or otherwise — unless absolutely necessary. Regularly clean up and delete any extensions you no longer use. Before installing an extension, read the user reviews. Most malicious extensions rack up heaps of scathing reviews from duped users long before store moderators get around to removing them. Before entering credentials or other confidential information, always check that the website address doesn’t look suspicious or contain typos. Pay attention to the top-level domain, too: it should be the official one. Use Kaspersky Password Manager to store passwords. If it doesn’t recognize the site and doesn’t automatically offer to fill in the login and password fields, this is a strong reason to ask yourself if you might be on a phishing page. Install a reliable security solution that will alert you to suspicious activity on your device and prevent you from visiting a phishing site. What other threats await you in browsers — AI-powered or regular:

SYSTEMS AMD inches closer to its goal of making AI suck less ... energyHouse of Zen claims latest systems already 4x more efficient than two years ago Google pits Marvell against Broadcom as it chases AI crownAnd Marvell just offered the Chocolate Factory a $12.2B stake to sweeten the deal SYSTEMS Cerebras CS-4 rack systems juice chips for every last drop of AI performanceNext-gen systems double per-chip performance while cramming 3x as many into a rack Security Copilot tricked into telling reseachers how to hack itselfHow to social engineer an AI's reasoning engine AI and ml Payments giant Stripe is about to drop over $7 billion to become a gateway to AI token salesAI gateways look promising as companies struggle with model orchestration Security Russians are posing as Signal support to launch phishing attacksPLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more! Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attackPLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructureVoting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included Security EQT buys majority share in Swiss cybersecurity biz AcronisWent at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sightOn the plus side, infosec's a good bet for a long, stable career FOSS smashed one Microsoft monopoly. After 20 years of failure, it's time to smash anotherWord up GNOME can look like Windows – and Flashback can do it without extensionsNew 'Simple-taskbar' is an option, but there's a simpler, stabler way A moment of silence, please, for the final release of Debian on x86-32New Debian versions hit FOSSland in the form of 13.6 and 12.15 Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websitesFlaws in iCagenda, Balbooa Forms extensions can impact open source CMS that powers a million sites worldwide Frame: A new X11 server – implemented directly in assemblyJoins yserver, Phoenix, and of course XLibre – and outlier Arcan Cinnamon 6.8 will support Wayland – if you want itNext version of Linux Mint’s desktop has both kinds of display server

The North Korean threat actor linked to the Contagious Interview campaign has been observed merging some of the functionality of two of its malware programs, indicating that the hacking group is actively refining its toolset. That's according to new findings from Cisco Talos, which said recent campaigns undertaken by the hacking group have seen the functions of BeaverTail and OtterCookie coming closer to each other more than ever, even as the latter has been fitted with a new module for keylogging and taking screenshots. The activity is attributed to a threat cluster that's tracked by the cybersecurity community under the monikers CL-STA-0240, DeceptiveDevelopment, DEV#POPPER, Famous Chollima, Gwisin Gang, PurpleBravo, Tenacious Pungsan, UNC5342, Void Dokkaebi, and WaterPlum. The development comes as Google Threat Intelligence Group (GTIG) and Mandiant revealed the threat actor's use of a stealthy technique known as EtherHiding to fetch next-stage payloads from the BNB Smart Chain (BSC) or Ethereum blockchains, essentially turning decentralized infrastructure into a resilient command-and-control (C2) server. It represents the first documented case of a nation-state actor utilizing the method that has been otherwise adopted by cybercrime groups. Contagious Interview refers to an elaborate recruitment scam that began sometime around late 2022, with the North Korean threat actors impersonating hiring organizations to target job seekers and deceiving them into installing information-stealing malware as part of a supposed technical assessment or coding task, resulting in the theft of sensitive data and cryptocurrency. In recent months, the campaign has undergone several shifts, including leveraging ClickFix social engineering techniques for delivering malware strains such as GolangGhost, PylangGhost, TsunamiKit, Tropidoor, and AkdoorTea. Central to the attacks, however, are malware families known as BeaverTail, OtterCookie, and InvisibleFerret. BeaverTail and OtterCookie are separate but complementary malware tools, with the latter first spotted in real-world attacks in September 2024. Unlike BeaverTail, which functions as an information stealer and downloader, initial interactions of OtterCookie were designed to contact a remote server and fetch commands to be executed on the compromised host. The activity detected by Cisco Talos concerns an organization headquartered in Sri Lanka. It's assessed that the company was not intentionally targeted by the threat actors, but rather they had one of their systems infected, likely after a user fell victim to a fake job offer that instructed them to install a trojanized Node.js application called Chessfi hosted on Bitbucket as part of the interview process. Interestingly, the malicious software includes a dependency via a package called "node-nvm-ssh" published to the official npm repository on August 20, 2025, by a user named "trailer." The package attracted a total of 306 downloads, before it was taken down by the npm maintainers six days later. It's also worth noting that the npm package in question is one of the 338 malicious Node.js libraries flagged earlier this week by software supply chain security company Socket as connected to the Contagious Interview campaign. The package, once installed, triggers the malicious behavior by means of a postinstall hook in its package.json file that's configured to run a custom script called "skip" so as to launch a JavaScript payload ("index.js"), which, in turn, loads another JavaScript ("file15.js") responsible for executing the final-stage malware. Further analysis of the tool used in the attack has found that "it had characteristics of BeaverTail and of OtterCookie, blurring the distinction between the two," security researchers Vanja Svajcer and Michael Kelley said, adding it incorporated a new keylogging and screenshotting module that uses legitimate npm packages like "node-global-key-listener" and "screenshot-desktop" to capture keystrokes and take screenshots, respectively, and exfiltrate the information to the C2 server. At least one version of this new module comes equipped with an auxiliary clipboard monitoring feature to siphon clipboard content. The emergence of the new version of OtterCookie paints a picture of a tool that has evolved from basic data-gathering to a modular program for data theft and remote command execution. Also present in the malware, codenamed OtterCookie v5, are functions akin to BeaverTail to enumerate browser profiles and extensions, steal data from web browsers and cryptocurrency wallets, install AnyDesk for persistent remote access, as well as download a Python backdoor referred to as InvisibleFerret. Some of the other modules present in OtterCookie are listed below - Remote shell module, which sends system information and clipboard content to the C2 server and installs the "socket.io-client" npm package to connect to a specific port on the OtterCookie C2 server and receive further commands for execution File uploading module, which systematically enumerates all drives and traverses the file system in order to find files matching certain extensions and naming patterns (e.g., metamask, bitcoin, backup, and phrase) to be uploaded to the C2 server Cryptocurrency extensions stealer module, which extracts data from cryptocurrency wallet extensions installed on Google Chrome and Brave browsers (the list of extensions targeted partially overlaps with that of BeaverTail) Furthermore, Talos said it detected a Qt-based BeaverTail artifact and a malicious Visual Studio Code extension containing BeaverTail and OtterCookie code, raising the possibility that the group may be experimenting with new methods of malware delivery. "The extension could also be a result of experimentation from another actor, possibly even a researcher, who is not associated with Famous Chollima, as this stands out from their usual TTPs," the researchers noted. Contagious Interview Evolves with New OtterCandy Malware The disclosure comes as NTT Security Holdings shared details of a new malware called OtterCandy, deployed in connection with the Contagious Interview campaign since July 2025, targeting Windows, macOS, and Linux systems. An early sample of OtterCandy was uploaded to the VirusTotal platform in February 2025. OtterCandy, per the Japanese cybersecurity company, combines the features of OtterCookie and RATatouille, a remote access trojan (RAT) distributed via the supply chain compromise of the npm package "rand-user-agent" back in May 2025. This is the first time the attack has been attributed to North Korean threat actors. The obfuscated payload embedded within the npm package is designed to set up a stealthy communication channel with a remote server and exfiltrate files within a particular directory and execute shell commands, the latter of which is specific only to Windows, according to Aikido. The full list of supported commands is below - env, to search for secret filenames across the entire file system imp, to search for secret filenames within the home directory pat, to search for filenames matching a preset pattern within the current directory upload, to transmit system information, browser passwords, wallet files, and extension data (MetaMask, Phantom, and TronLink) from Google Chrome and Edge to the C2 server exec, to cancel in-progress scans or uploads (ss_stop), upload a single file (ss_upf), recursively upload the contents of a directory (ss_upd), change current directory (cd), or terminate the malware process (ss_del) OtterCandy is said to be distributed via a sub-cluster of activity tracked as ClickFake Interview (aka Cluster B), which involves deceiving users with ClickFix-style lures to run malicious commands so as to fix supposed camera or microphone issues when job seekers attempt to provide a video assessment on a fake website under their control. "OtterCandy is a RAT and Info Stealer implemented by Node.js," NTT Security said. "It is malware that combines elements of RATatouille and OtterCookie. OtterCandy accepts commands when connected to the C2 server via Socket.IO." The first-stage malware used to deliver OtterCandy is named DiggingBeaver, a JavaScript payload that's executed once the victim copies and runs the command via the Windows Run dialog. DiggingBeaver has also been found to distribute other known ClickFake Interview malware, such as GolangGhost and FROSTYFERRET. NTT Security said it also observed a new variant of OtterCandy (OtterCandy v2) in August 2025 that comes with expanded functionality to harvest data from three additional cryptocurrency wallet extensions (Suiet, Trust Wallet, and Rabby Wallet), as well as enhance the "ss_del" command to delete Windows Registry keys and erase files and directories. (The story was updated after publication on October 19, 2025, to include details of OtterCandy malware from NTT Security Holdings.)

A malware campaign was recently detected in Brazil, distributing a malicious LNK file using WhatsApp. It targets mainly Brazilians and uses Portuguese-named URLs. To evade detection, the command-and-control (C2) server verifies each download to ensure it originates from the malware itself. The whole infection chain is complex and fully fileless, and by the end, it will deliver a new banking Trojan named Maverick, which contains many code overlaps with Coyote. In this blog post, we detail the entire infection chain, encryption algorithm, and its targets, as well as discuss the similarities with known threats. Key findings: A massive campaign disseminated through WhatsApp distributed the new Brazilian banking Trojan named “Maverick” through ZIP files containing a malicious LNK file, which is not blocked on the messaging platform. Once installed, the Trojan uses the open-source project WPPConnect to automate the sending of messages in hijacked accounts via WhatsApp Web, taking advantage of the access to send the malicious message to contacts. The new Trojan features code similarities with another Brazilian banking Trojan called Coyote; however, we consider Maverick to be a new threat. The Maverick Trojan checks the time zone, language, region, and date and time format on infected machines to ensure the victim is in Brazil; otherwise, the malware will not be installed. The banking Trojan can fully control the infected computer, taking screenshots, monitoring open browsers and websites, installing a keylogger, controlling the mouse, blocking the screen when accessing a banking website, terminating processes, and opening phishing pages in an overlay. It aims to capture banking credentials. Once active, the new Trojan will monitor the victims’ access to 26 Brazilian bank websites, 6 cryptocurrency exchange websites, and 1 payment platform. All infections are modular and performed in memory, with minimal disk activity, using PowerShell, .NET, and shellcode encrypted using Donut. The new Trojan uses AI in the code-writing process, especially in certificate decryption and general code development. Our solutions have blocked 62 thousand infection attempts using the malicious LNK file in the first 10 days of October, only in Brazil. Initial infection vector The infection chain works according to the diagram below: The infection begins when the victim receives a malicious .LNK file inside a ZIP archive via a WhatsApp message. The filename can be generic, or it can pretend to be from a bank: The message said, “Visualization allowed only in computers. In case you’re using the Chrome browser, choose “keep file” because it’s a zipped file”. The LNK is encoded to execute cmd.exe with the following arguments: The decoded commands point to the execution of a PowerShell script: The command will contact the C2 to download another PowerShell script. It is important to note that the C2 also validates the “User-Agent” of the HTTP request to ensure that it is coming from the PowerShell command. This is why, without the correct “User-Agent”, the C2 returns an HTTP 401 code. The entry script is used to decode an embedded .NET file, and all of this occurs only in memory. The .NET file is decoded by dividing each byte by a specific value; in the script above, the value is “174”. The PE file is decoded and is then loaded as a .NET assembly within the PowerShell process, making the entire infection fileless, that is, without files on disk. Initial .NET loader The initial .NET loader is heavily obfuscated using Control Flow Flattening and indirect function calls, storing them in a large vector of functions and calling them from there. In addition to obfuscation, it also uses random method and variable names to hinder analysis. Nevertheless, after our analysis, we were able to reconstruct (to a certain extent) its main flow, which consists of downloading and decrypting two payloads. The obfuscation does not hide the method’s variable names, which means it is possible to reconstruct the function easily if the same function is reused elsewhere. Most of the functions used in this initial stage are the same ones used in the final stage of the banking Trojan, which is not obfuscated. The sole purpose of this stage is to download two encrypted shellcodes from the C2. To request them, an API exposed by the C2 on the “/api/v1/” routes will be used. The requested URL is as follows: hxxps://sorvetenopote.com/api/v1/3d045ada0df942c983635e To communicate with its API, it sends the API key in the “X-Request-Headers” field of the HTTP request header. The API key used is calculated locally using the following algorithm: “Base64(HMAC256(Key))” The HMAC is used to sign messages with a specific key; in this case, the threat actor uses it to generate the “API Key” using the HMAC key “MaverickZapBot2025SecretKey12345”. The signed data sent to the C2 is “3d045ada0df942c983635e|1759847631|MaverickBot”, where each segment is separated by “|”. The first segment refers to the specific resource requested (the first encrypted shellcode), the second is the infection’s timestamp, and the last, “MaverickBot”, indicates that this C2 protocol may be used in future campaigns with different variants of this threat. This ensures that tools like “wget” or HTTP downloaders cannot download this stage, only the malware. Upon response, the encrypted shellcode is a loader using Donut. At this point, the initial loader will start and follow two different execution paths: another loader for its WhatsApp infector and the final payload, which we call “MaverickBanker”. Each Donut shellcode embeds a .NET executable. The shellcode is encrypted using a XOR implementation, where the key is stored in the last bytes of the binary returned by the C2. The algorithm to decrypt the shellcode is as follows: Extract the last 4 bytes (int32) from the binary file; this indicates the size of the encryption key. Walk backwards until you reach the beginning of the encryption key (file size – 4 – key_size). Get the XOR key. Apply the XOR to the entire file using the obtained key. WhatsApp infector downloader After the second Donut shellcode is decrypted and started, it will load another downloader using the same obfuscation method as the previous one. It behaves similarly, but this time it will download a PE file instead of a Donut shellcode. This PE file is another .NET assembly that will be loaded into the process as a module. One of the namespaces used by this .NET executable is named “Maverick.StageOne,” which is considered by the attacker to be the first one to be loaded. This download stage is used exclusively to download the WhatsApp infector in the same way as the previous stage. The main difference is that this time, it is not an encrypted Donut shellcode, but another .NET executable—the WhatsApp infector—which will be used to hijack the victim’s account and use it to spam their contacts in order to spread itself. This module, which is also obfuscated, is the WhatsApp infector and represents the final payload in the infection chain. It includes a script from WPPConnect, an open-source WhatsApp automation project, as well as the Selenium browser executable, used for web automation. The executable’s namespace name is “ZAP”, a very common word in Brazil to refer to WhatsApp. These files use almost the same obfuscation techniques as the previous examples, but the method’s variable names remain in the source code. The main behavior of this stage is to locate the WhatsApp window in the browser and use WPPConnect to instrument it, causing the infected victim to send messages to their contacts and thus spread again. The file sent depends on the “MaverickBot” executable, which will be discussed in the next section. Maverick, the banking Trojan The Maverick Banker comes from a different execution branch than the WhatsApp infector; it is the result of the second Donut shellcode. There are no additional download steps to execute it. This is the main payload of this campaign and is embedded within another encrypted executable named “Maverick Agent,” which performs extended activities on the machine, such as contacting the C2 and keylogging. It is described in the next section. Upon the initial loading of Maverick Banker, it will attempt to register persistence using the startup folder. At this point, if persistence does not exist, by checking for the existence of a .bat file in the “Startup” directory, it will not only check for the file’s existence but also perform a pattern match to see if the string “for %%” is present, which is part of the initial loading process. If such a file does not exist, it will generate a new “GUID” and remove the first 6 characters. The persistence batch script will then be stored as: “C:\Users\ \AppData\Roaming\Microsoft\Windows\Start Menu\Programs\” + “HealthApp-” + GUID + “.bat”. Next, it will generate the bat command using the hardcoded URL, which in this case is: “hxxps://sorvetenopote.com” + “/api/itbi/startup/” + NEW_GUID. In the command generation function, it is possible to see the creation of an entirely new obfuscated PowerShell script. First, it will create a variable named “$URL” and assign it the content passed as a parameter, create a “Net.WebClient” object, and call the “DownloadString.Invoke($URL)” function. Immediately after creating these small commands, it will encode them in base64. In general, the script will create a full obfuscation using functions to automatically and randomly generate blocks in PowerShell. The persistence script reassembles the initial LNK file used to start the infection. This persistence mechanism seems a bit strange at first glance, as it always depends on the C2 being online. However, it is in fact clever, since the malware would not work without the C2. Thus, saving only the bootstrap .bat file ensures that the entire infection remains in memory. If persistence is achieved, it will start its true function, which is mainly to monitor browsers to check if they open banking pages. The browsers running on the machine are checked for possible domains accessed on the victim’s machine to verify the web page visited by the victim. The program will use the current foreground window (window in focus) and its PID; with the PID, it will extract the process name. Monitoring will only continue if the victim is using one of the following browsers: Chrome Firefox MS Edge Brave Internet Explorer Specific bank web browser If any browser from the list above is running, the malware will use UI Automation to extract the title of the currently open tab and use this information with a predefined list of target online banking sites to determine whether to perform any action on them. The list of target banks is compressed with gzip, encrypted using AES-256, and stored as a base64 string. The AES initialization vector (IV) is stored in the first 16 bytes of the decoded base64 data, and the key is stored in the next 32 bytes. The actual encrypted data begins at offset 48. This encryption mechanism is the same one used by Coyote, a banking Trojan also written in .NET and documented by us in early 2024. If any of these banks are found, the program will decrypt another PE file using the same algorithm described in the .NET Loader section of this report and will load it as an assembly, calling its entry point with the name of the open bank as an argument. This new PE is called “Maverick.Agent” and contains most of the banking logic for contacting the C2 and extracting data with it. Maverick Agent The agent is the binary that will do most of the banker’s work; it will first check if it is running on a machine located in Brazil. To do this, it will check the following constraints: What each of them does is: IsValidBrazilianTimezone() Checks if the current time zone is within the Brazilian time zone range. Brazil has time zones between UTC-5 (-300 min) and UTC-2 (-120 min). If the current time zone is within this range, it returns “true”. IsBrazilianLocale() Checks if the current thread’s language or locale is set to Brazilian Portuguese. For example, “pt-BR”, “pt_br”, or any string containing “portuguese” and “brazil”. Returns “true” if the condition is met. IsBrazilianRegion() Checks if the system’s configured region is Brazil. It compares region codes like “BR”, “BRA”, or checks if the region name contains “brazil”. Returns “true” if the region is set to Brazil. IsBrazilianDateFormat() Checks if the short date format follows the Brazilian standard. The Brazilian format is dd/MM/yyyy. The function checks if the pattern starts with “dd/” and contains “/MM/” or “dd/MM”. Right after the check, it will enable appropriate DPI support for the operating system and monitor type, ensuring that images are sharp, fit the correct scale (screen zoom), and work well on multiple monitors with different resolutions. Then, it will check for any running persistence, previously created in “C:\Users\ \AppData\Roaming\Microsoft\Windows\Start Menu\Programs\”. If more than one file is found, it will delete the others based on “GetCreationTime” and keep only the most recently created one. C2 communication Communication uses the WatsonTCP library with SSL tunnels. It utilizes a local encrypted X509 certificate to protect the communication, which is another similarity to the Coyote malware. The connection is made to the host “casadecampoamazonas.com” on port 443. The certificate is exported as encrypted, and the password used to decrypt it is Maverick2025!. After the certificate is decrypted, the client will connect to the server. For the C2 to work, a specific password must be sent during the first contact. The password used by the agent is “101593a51d9c40fc8ec162d67504e221”. Using this password during the first connection will successfully authenticate the agent with the C2, and it will be ready to receive commands from the operator. The important commands are: Agent profile info In the “INFOCLIENT” command, the information sent to the C2 is as follows: Agent ID: A SHA256 hash of all primary MAC addresses used by all interfaces Username Hostname Operating system version Client version (no value) Number of monitors Home page (home): “home” indicates which bank’s home screen should be used, sent before the Agent is decrypted by the banking application monitoring routine. Screen resolution Conclusion According to our telemetry, all victims were in Brazil, but the Trojan has the potential to spread to other countries, as an infected victim can send it to another location. Even so, the malware is designed to target only Brazilians at the moment. It is evident that this threat is very sophisticated and complex; the entire execution chain is relatively new, but the final payload has many code overlaps and similarities with the Coyote banking Trojan, which we documented in 2024. However, some of the techniques are not exclusive to Coyote and have been observed in other low-profile banking Trojans written in .NET. The agent’s structure is also different from how Coyote operated; it did not use this architecture before. It is very likely that Maverick is a new banking Trojan using shared code from Coyote, which may indicate that the developers of Coyote have completely refactored and rewritten a large part of their components. This is one of the most complex infection chains we have ever detected, designed to load a banking Trojan. It has infected many people in Brazil, and its worm-like nature allows it to spread exponentially by exploiting a very popular instant messenger. The impact is enormous. Furthermore, it demonstrates the use of AI in the code-writing process, specifically in certificate decryption, which may also indicate the involvement of AI in the overall code development. Maverick works like any other banking Trojan, but the worrying aspects are its delivery method and its significant impact. We have detected the entire infection chain since day one, preventing victim infection from the initial LNK file. Kaspersky products detect this threat with the verdict HEUR:Trojan.Multi.Powenot.a and HEUR:Trojan-Banker.MSIL.Maverick.gen.

You get a message from a Discord friend. Or maybe an unknown indie developer reaches out to you. “Can you test my game?” they ask. The webpage they send over a link to looks legit: screenshots, dev blurb, itch.io-style layout, and the download button is right there, waiting to be clicked. The problem is these lookalike pages don’t give you the real game. Instead they drop a stealthy loader that quietly prepares your PC for follow-up malware. One lure we’ve seen impersonates the popular 2D platformer Archimoulin (the real game can be found here: nicolasduboc.itch.io/archimoulin). How they spread it – social engineering 101 This scam nails two things gamers trust: friends and downloads. A trusted delivery channel. The lure often arrives in a DM from someone in your friends list—usually because the attacker used a compromised account. People are far more likely to click links from friends. Familiar hosting and UI. The impersonators use Blogspot subdomains or cloud links and fake itch-style pages so the site looks legitimate. Sometimes downloads are served via Dropbox or similar service people trust. A convincing sign-in page. Some variants present a fake Discord sign-in page first to harvest credentials. This hands the attacker control of your account, which they can use to spread the link to your contacts. Reddit threads from victims show this pattern again and again: an innocuous “test my game” DM, a convincing page, then account takeover and mass-messaging to the victim’s friends. What actually happens when you click? Here’s what the user sees, and what the stealth loader is really doing: Double-click the downloaded Setup Game.exe and… nothing obvious happens. No installer UI, no progress bar. (That’s deliberate – the attacker wants the install to happen without alarming you.) The executable spawns PowerShell with a long, encoded command. (Attackers hide commands in encoded strings so the malicious script isn’t obvious at first glance.) The command decodes another script and runs it directly in memory. (Running in memory means the malware doesn’t leave a neat file on disk for antivirus to find, so it’s harder to detect.) That inner script hides the PowerShell window using a tiny .NET trick, so there’s no black console popping up to make you suspicious. (With no visible window there’s nothing to make you stop and ask what’s running.) The code tries to relaunch itself with admin rights (runAs ) and compiles a small helper on the fly usingcsc.exe . (You’ll see temp folders andRES*.tmp files while it runs.) It unpacks a Node.js runtime and native modules into your user cache (C:\Users\ \.cache\pkg\... ). (The malware is giving itself a toolkit, making it more flexible in what it can do next.) The installer even runs taskkill to force-close major browsers (Chrome, Brave, Firefox, Edge, and Opera). (That stops you from immediately googling what’s happening and then stopping the install.) In our sandbox run it didn’t phone home right away; instead it performed checks (net session, registry queries, BIOS/network checks) to confirm it’s on a “real” machine, then waits for the right moment to download the main payload. (Malware often avoids sandboxes, looking for signs it’s on a real user’s computer before unleashing the main payload.) Bottom line: The Setup Game.exe is a stager/loader – quiet on purpose, ready to pull down follow-up malware (backdoors, keyloggers, coinminers, or worse) when conditions match what the attacker wants. What to watch out for Unexpected DM with a download link: If you get a message offering an indie game you didn’t expect, verify it with the sender on another channel first. No installer UI but strange behavior after running: If there’s no installer window or progress bar, but your browsers crash or you see temporary compile folders appear, that’s a red flag. Unexpected folders appear: Look for new folders you didn’t create, like C:\Users\ \.cache\pkg\… or%TEMP%\xlfvhkx3\… especially if you haven’t installed developer tools. PowerShell showing -EncodedCommand : Check running processes logs for signs a hidden script is running. What to do if you already ran it Act quickly and use a different, clean device for the first steps. From another device, change your passwords (Discord, email, Steam) and enable 2FA. Log out all sessions and revoke authorised apps/tokens. Disconnect the infected PC and run a full Malwarebytes scan. Remove obvious new files/folders (e.g., C:\Users\ \.cache\pkg\… ,%TEMP%\xlfvhkx3\… ). Tell your friends not to click links from your account and report the pages to the host (Blogger/Dropbox) and your platform (Discord/Steam). If you see signs of deeper compromise, back up essentials and do a clean reinstall or get professional help. Final note—indie communities are built on trust Archimoulin is an indie game; the fake pages are not. Scammers are exploiting the goodwill between players and creators. That’s the worst bit of all: it weaponizes the community itself. A quick sanity check—to pause, verify the URL, and ask the sender via another app—is all it takes to avoid the hassle of cleaning up a compromised PC (or losing your account and friends). Share this with your clan: one click is all it takes for an attacker to turn a fun, indie moment into a mess. Indicators of compromise (IOCs) cakewind[.]blogspot.com carnagev1[.]blogspot.com kelarigame[.]blogspot.com klorigame[.]blogspot.com meraliagame[.]blogspot.com ravielchy[.]blogspot.com ravielchygame[.]blogspot.com tamunagame[.]blogspot.com veriliagame[.]blogspot.com Something feel off? Check it before you click. Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly. Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.

Brave browser reached 101 million monthly active users and 42 million daily active users this September, marking a new record in the project’s history. At the same time, Brave Search, the project’s privacy-focused search engine that launched in 2021 and relies on its own web index, has grown to 1.6 billion monthly search queries and 20 billion per year. The announcement notes that not all queries came from Brave Browser, where it is the default search engine, roughly 8% coming from Chrome users. Brave is a privacy-focused web browser created by Brendan Eich, first released in 2016. It blocks ads and trackers by default, which increases performance, and integrates crypto features. In 2021, the project announced that it reached the 50 million active users milestone, a significant growth from 24 million in 2020. In recent years, Brave has experienced a meteoric rise in adoption, partly because of the Digital Markets Act (DMA), an EU regulation that took effect in 2023, which requires “gatekeeper” tech companies to offer users a choice. DMA forced Apple, starting with iOS 17.4 released in March 2024, to introduce alternatives to Safari browser. This reportedly boosted Brave installs on iOS by 50% in Europe. Over the past two years, Brave has been growing consistently by approximately 2.5 million new users per month, a rate that surpasses the adoption rate of other browsers. "100 million users represent more than a growth milestone—they constitute a movement for a better Web that puts users first," said Brendan Eich, Brave CEO. "Across the globe, users are choosing privacy and control over their online experience, instead of Big Tech’s tracking and abuse," the CEO added. Apart from the browser itself and the search engine, Brave also launched privacy-conscious AI tools that recorded a significant adoption rate. According to Brave, its AI summarizer, now called "AI Answers," generates 15 million answers every day. The recent launch of Ask Brave, a system that consolidates traditional search with LLM chat, is expected to take this number even higher. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Brave Software, the creator of the privacy-focused web browser and search engine, has introduced a new subsystem called Ask Brave that unifies search and AI chat into a single interface. Ask Brave is free to use, accessible from any browser at search.brave.com/ask, and designed with privacy at its core. In essence, this new system combines traditional search results with AI-generated responses, enabling users to interact with the system and follow up on search queries in a chat-style format. Ask Brave is not a replacement for “AI Answers,” Brave Search’s AI-powered summarizer launched in 2023, which will continue to be available in the same form. Brave claims that the feature generates over 15 million answers daily, but it’s not enough to bridge the gap between traditional search results and LLM-generated responses. This is precisely where Ask Brave fits into the picture. “With Ask Brave, users no longer have to choose between different tools depending on the action they want to perform, juggling between traditional search engines with their ten blue links, and chat-like interfaces with their walls of text,” reads Brave’s announcement. “Brave solves this problem by offering a system that combines the best of both approaches, eliminating the unnecessary back-and-forth between different platforms and cumbersome copy-pasting.” Users can invoke Ask Brave by ending their search query with a double question mark “??” on Brave Search, clicking the “Ask” button on Brave Search (search.brave.com), or clicking the “Ask” tab on the search results page. The system operates in two modes, namely standard and deep research. The latter runs multiple search rounds across Brave’s index to cover any blind spots around the topic, providing more exhaustive and detailed answers. Ask Brave draws information from the web and is less likely to hallucinate or include irrelevant information in its answers, according to the Brave team. Being part of Brave’s ecosystem, privacy is uncompromising on Ask Brave. The team assures that all chats are encrypted, conversations aren’t used for AI training, and they are deleted after 24 hours of inactivity. Also, Brave Search does not log IP addresses, so conversations linked to search queries aren’t traceable to specific users. This contrasts with how most AI search and chat tools typically handle user data, logging everything for model training, fine-tuning, and personalization, unless users opt out. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Google fixes actively exploited Chrome zero-day vulnerability (CVE-2025-10585) Google has released a security update for the Chrome stable channel to fix a zero‑day vulnerability (CVE-2025-10585) reported by its Threat Analysis Group (TAG) on Tuesday. “Google is aware that an exploit for CVE-2025-10585 exists in the wild,” the company announced. About CVE-2025-10585 Like CVE-2025-6554, which was fixed earlier this year, CVE-2025-10585 is a type confusion vulnerability in V8, Chrome’s JavaScript and WebAssembly engine. Unfortunately, that’s the only information Google has shared about it. As per the company’s usual practice, they have refrained from sharing details about the attacks in which the flaw is being exploited. Google TAG’s involvement in the discovery, though, points to the vulnerability being used by state-sponsored threat actors in targeted attacks. Google has fixed CVE-2025-10585 in Chrome v140.0.7339.185/.186 for Windows/Mac and v140.0.7339.185 for Linux, along with three other high-severity vulnerabilities, one of which has been reported by Google Big Sleep, its AI-based bug hunter agent. Users who haven’t switched on automatic updates for the browser are advised to manually upgrade to a fixed version and relaunch the application. Developers of other popular Chromium-based browsers – Edge, Brave, Opera and Vivaldi – will likely fix CVE-2025-10585 very soon, so those users should update their browsers when they do. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

Google has released an update for its Chrome browser to patch four security vulnerabilities, including one zero-day. A zero-day vulnerability refers to a bug that has been found and exploited by cybercriminals before the vendor even knew about it (they have “zero days” to fix it). This update is crucial since it addresses one vulnerability which is already being actively exploited and, reportedly, can be abused when the user visits a malicious website. It probably doesn’t require any further user interaction, which means the user doesn’t need to click on anything in order for their system to be compromised. The Chrome update brings the version number to 140.0.7339.185/.186 for Windows, Mac and 140.0.7339.185 for Linux. So, if your Chrome is on the version number 140.0.7339.185 or later, it’s protected against exploitation of these vulnerabilities. The easiest way to update Chrome is to allow it to update automatically, but you can end up lagging behind if you never close your browser or if something goes wrong—such as an extension stopping you from updating the browser. To manually get the update, click the more menu (three stacked dots), then choose Settings > About Chrome. If there is an update available, Chrome will notify you and start downloading it. Then all you have to do is reload Chrome in order for the update to complete, and for you to be safe from the vulnerabilities. You can find more elaborate update instructions and how to read the version number in our article on how to update Chrome on every operating system. Technical details on the zero-day vulnerability Google describes the zero-day vulnerability tracked as CVE-2025-10585 as a type confusion in V8. Reported by Google Threat Analysis Group on 2025-09-16. Despite the short statement—Google never reveals a lot of details until everyone has had a chance to update—there are a few conclusions we can draw. It helps to know that V8 is Google’s open-source Javascript engine. A “type confusion” vulnerability happens when code doesn’t verify the object type passed to it and then uses the object without type-checking. So, a program mistakenly treats one type of data as if it were another, like confusing a list for a single value or interpreting a number as text. This mix-up can cause the software to behave unpredictably, creating opportunities for attackers to break in, steal data, crash programs, or even run malicious code. Google’s Threat Analysis Group (TAG) focuses on spyware and nation-state attackers who abuse zero days for espionage purposes. So, it stands to reason that an attacker used Javascript to create a malicious site that exploited this vulnerability and lured targeted victims to that website. TAG reported the bug on September 16, and Google issued the patch one day later. That implies that the bug was urgent, or very easy to fix, and probably that both of those statements are true to some extent. Usually, as more details become known or a patch gets reverse engineered, cybercriminals will start using the vulnerability in less targeted attacks. Users of other Chromium-based browsers, such as Microsoft Edge, Brave, Opera, and Vivaldi, are also advised to keep an eye out for updates and install them when they become available. From reporting threats to removing them. Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Google on Wednesday released security updates for the Chrome web browser to address four vulnerabilities, including one that it said has been exploited in the wild. The zero-day vulnerability in question is CVE-2025-10585, which has been described as a type confusion issue in the V8 JavaScript and WebAssembly engine. Type confusion vulnerabilities can have severe consequences as they can be weaponized by bad actors to trigger unexpected software behavior, resulting in the execution of arbitrary code and program crashes. Google's Threat Analysis Group (TAG) has been credited with discovering and reporting the flaw on September 16, 2025. As is typically the case, the company did not share any additional specifics about how the vulnerability is being abused in real-world attacks, by whom, or the scale of such efforts. This is done to prevent other threat actors from exploiting the issue before users can apply a fix. "Google is aware that an exploit for CVE-2025-10585 exists in the wild," it acknowledged in a terse advisory. CVE-2025-10585 is the sixth zero-day vulnerability in Chrome that has been either actively exploited or demonstrated as a proof-of-concept (PoC) since the start of the year. This includes: CVE-2025-2783, CVE-2025-4664, CVE-2025-5419, CVE-2025-6554, and CVE-2025-6558. To safeguard against potential threats, it's advised to update their Chrome browser to versions 140.0.7339.185/.186 for Windows and Apple macOS, and 140.0.7339.185 for Linux. To make sure the latest updates are installed, users can navigate to More > Help > About Google Chrome and select Relaunch. Users of other Chromium-based browsers, such as Microsoft Edge, Brave, Opera, and Vivaldi, are also advised to apply the fixes as and when they become available.

Analysis of the malware and tools used in an intrusion links a threat actor to three different ransomware-as-a-service (RaaS) operations, threat intelligence firm The DFIR Report says. The attack occurred in September 2024 and began with the victim executing a malicious file posing as DeskSoft’s world clock application EarthTime, which deployed the .NET-based SectopRAT malware on the system. The malicious application was signed with a revoked certificate from Brave Pragmatic Network Technology, a compromised or fraudulent CA known for signing multiple malware samples. After establishing persistence, the threat actor created a new local account with administrator privileges, deployed the SystemBC proxy tunnelling tool, compromised the domain controller via RDP, and started enumerating hosts using Windows utilities such as IPconfig and NLtest. Using RDP to connect to various servers, the attacker then deployed SystemBC across the environment, and executed PowerShell scripts on a backup server to retrieve credentials for Veeam. The threat actor was also seen accessing the victim’s file server via RDP and exfiltrating data from it. “They carried out further discovery activity with the use of AdFind for AD queries, PowerShell Cmdlets to collect host data, SharpHound for directory mapping, and SoftPerfect NetScan to scan remote hosts,” The DFIR Report says. Six days after initial access, the threat actor used SectopRAT to deploy a second backdoor, named Betruger, and performed additional reconnaissance by executing various commands on the domain controller. Betruger consolidates capabilities observed in multiple pre-ransomware tools in a single executable, allowing attackers to take screenshots, log keystrokes, escalate privileges, perform network discovery, and steal credentials. “This extensive functionality suggests that Betruger was explicitly developed to streamline ransomware operations by reducing the number of distinct tools that need to be deployed on a compromised network during the preparation phase of an attack,” The DFIR Report notes. During the attack, the threat actor also used the legitimate PsExec utility for privilege escalation, the Grixba data-gathering tool for further discovery, modified registry keys to disable Windows Defender security features, and performed potentially time-stomping activities. They were also seen using information stealers, dumping Veeam databases, and performing DCSync attacks to harvest credentials from the compromised systems. “Throughout the intrusion, the threat actor used multiple defense evasion techniques, including process injection, timestomping, disabling Microsoft Defender’s protections, and deploying binaries with spoofed metadata to disguise themselves as legitimate cybersecurity tools such as SentinelOne and Avast Antivirus,” The DFIR Report says. The final purpose of the attack, the cybersecurity firm notes, was ransomware deployment. While no file-encrypting malware was executed, however, the threat actor systematically archived data from the compromised systems and exfiltrated it via FTP. According to The DFIR Report, the threat actor can be linked to three RaaS operations, based on the tools employed during the attack: Grixba is a custom tool used by the Play ransomware group, Betruger is commonly deployed by RansomHub affiliates, and an output file associated with NetScan points to a DragonForce compromise. Related: Pennsylvania Attorney General Confirms Ransomware Behind Weeks-Long Outage Related: Jaguar Land Rover Operations ‘Severely Disrupted’ by Cyberattack Related: China-Linked Hackers Hijack Web Traffic to Deliver Backdoor

The threat actor known as EncryptHub is continuing to exploit a now-patched security flaw impacting Microsoft Windows to deliver malicious payloads. Trustwave SpiderLabs said it recently observed an EncryptHub campaign that brings together social engineering and the exploitation of a vulnerability in the Microsoft Management Console (MMC) framework (CVE-2025-26633, aka MSC EvilTwin) to trigger the infection routine via a rogue Microsoft Console (MSC) file. "These activities are part of a broad, ongoing wave of malicious activity that blends social engineering with technical exploitation to bypass security defenses and gain control over internal environments," Trustwave researchers Nathaniel Morales and Nikita Kazymirskyi said. EncryptHub, also tracked as LARVA-208 and Water Gamayun, is a Russian hacking group that first gained prominence in mid-2024. Operating at a high tempo, the financially motivated crew is known for leveraging several methods, including fake job offers, portfolio review, and even compromising Steam games, to infect targets with stealer malware. The threat actor's abuse of CVE-2025-26633 was previously documented by Trend Micro in March 2025, uncovering attacks that deliver two backdoors called SilentPrism and DarkWisp. The latest attack sequence involves the threat actor claiming to be from the IT department and sending a Microsoft Teams request to the target with the goal of initiating a remote connection and deploying secondary payloads by means of PowerShell commands. Among the files dropped are two MSC files with the same name, one benign and the other malicious, that's used to trigger CVE-2025-26633, ultimately resulting in the execution of the rogue MSC file when its innocuous counterpart is launched. The MSC file, for its part, fetches and executes from an external server another PowerShell script that collects system information, establishes persistence on the host, and communicates with an EncryptHub command-and-control (C2) server to receive and run malicious payloads, including a stealer called Fickle Stealer. "The script receives AES-encrypted commands from the attacker, decrypts them, and runs the payloads directly on the infected machine," the researchers said. Also deployed by the threat actor over the course of the attack is a Go-based loader codenamed SilentCrystal, which abuses Brave Support, a legitimate platform associated with the Brave web browser, to host next-stage malware – a ZIP archive containing the two MSC files to weaponize CVE-2025-26633. What makes this significant is that uploading file attachments on the Brave Support platform is restricted for new users, indicating that the attackers somehow managed to obtain unauthorized access to an account with upload permissions to pull off the scheme. Some of the other tools deployed include a Golang backdoor that operates in both client and server mode to send system metadata to the C2 server, as well as set up C2 infrastructure by making use of the SOCKS5 proxy tunneling protocol. There is also evidence that the threat actors are continuing to rely on videoconferencing lures, this time setting up phony platforms like RivaTalk to deceive victims into downloading an MSI installer. Running the installer leads to the delivery of several files: the legitimate Early Launch Anti-Malware (ELAM) installer binary from Symantec that's used to sideload a malicious DLL that, in turn, launches a PowerShell command to download and run another PowerShell script. It's engineered to gather system information and exfiltrate it to the C2 server, and await encrypted PowerShell instructions that are decoded and executed to give attackers full control of the system. The malware also displays a fake "System Configuration" pop-up message as a ruse, while launching a background job to generate fake browser traffic by making HTTP requests to popular websites so as to blend C2 communications with normal network activity. "The EncryptHub threat actor represents a well-resourced and adaptive adversary, combining social engineering, abuse of trusted platforms, and the exploitation of system vulnerabilities to maintain persistence and control," Trustwave said. "Their use of fake video conferencing platforms, encrypted command structures, and evolving malware toolsets underscores the importance of layered defense strategies, ongoing threat intelligence, and user awareness training."

Introduction In June, we encountered a mass mailing campaign impersonating lawyers from a major company. These emails falsely claimed the recipient’s domain name infringed on the sender’s rights. The messages contained the Efimer malicious script, designed to steal cryptocurrency. This script also includes additional functionality that helps attackers spread it further by compromising WordPress sites and hosting malicious files there, among other techniques. Report summary: Efimer is spreading through compromised WordPress sites, malicious torrents, and email. It communicates with its command-and-control server via the Tor network. Efimer expands its capabilities through additional scripts. These scripts enable attackers to brute-force passwords for WordPress sites and harvest email addresses for future malicious email campaigns. Kaspersky products classify this threat with the following detection verdicts: HEUR:Trojan-Dropper.Script.Efimer HEUR:Trojan-Banker.Script.Efimer HEUR:Trojan.Script.Efimer HEUR:Trojan-Spy.Script.Efimer.gen Technical details Background In June, we detected a mass mailing campaign that was distributing identical messages with a malicious archive attached. The archive contained the Efimer stealer, designed to pilfer cryptocurrency. This malware was dubbed “Efimer” because the word appeared in a comment at the beginning of its decrypted script. Early versions of this Trojan likely emerged around October 2024, initially spreading via compromised WordPress websites. While attackers continue to use this method, they expanded their distribution in June to include email campaigns. Email distribution The emails that users received claimed that lawyers from a large company had reviewed the recipient’s domain and found words or phrases in its name that infringed upon their registered trademarks. The emails threatened legal action but offered to drop the lawsuit if the domain owner changed the domain name. Furthermore, they even expressed willingness to purchase the domain. The specific domain was never mentioned in the email. Instead, the attachment supposedly contained “details” about the alleged infringement and the proposed buyout amount. In a recent phishing attempt, targets received an email with a ZIP attachment named “Demand_984175” (MD5: e337c507a4866169a7394d718bc19df9). Inside, recipients found a nested, password-protected archive and an empty file named “PASSWORD – 47692”. It’s worth noting the clever obfuscation used for the password file: instead of a standard uppercase “S”, the attackers used the Unicode character U+1D5E6. This subtle change was likely implemented to prevent automated tools from easily extracting the password from the filename. If the user unzips the password-protected archive, they’ll find a malicious file named “Requirement.wsf”. Running this file infects their computer with the Efimer Trojan, and they’ll likely see an error message. Here’s how this infection chain typically plays out. When the Requirement.wsf script first runs, it checks for administrator privileges. It does this by attempting to create and write data to a temporary file at C:\\Windows\\System32\\wsf_admin_test.tmp. If the write is successful, the file is then deleted. What happens next depends on the user’s access level: If the script is executed on behalf of a privileged user, it adds the C:\\Users\\Public\\controller folder to the Windows Defender antivirus exclusions. This folder will then be used to store various files. It also adds to exclusions the full path to the currently running WSF script and the system processesC:\\Windows\\System32\\exe andC:\\Windows\\System32\\cmd.exe . Following this, the script saves two files to the aforementioned path: “controller.js” (containing the Efimer Trojan) and “controller.xml”. Finally, it creates a scheduler task in Windows, using the configuration from controller.xml. If the script is run with limited user privileges, it saves only the controller.js file to the same path. It adds a parameter for automatic controller startup to the HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\controller registry key. The controller is then launched via the WScript utility. Afterward, the script uses WScript methods to display an error message dialog box and then exits. This is designed to mislead the user, who might be expecting an application or document to open, when in reality, nothing useful occurs. Efimer Trojan The controller.js script is a ClipBanker-type Trojan. It’s designed to replace cryptocurrency wallet addresses the user copies to their clipboard with the attacker’s own. On top of that, it can also run external code received directly from its command-and-control server. The Trojan starts by using WMI to check if Task Manager is running. If it is, the script exits immediately to avoid detection. However, if Task Manager isn’t running, the script proceeds to install a Tor proxy client on the victim’s computer. The client is used for communication with the C2 server. The script has several hardcoded URLs to download Tor from. This ensures that even if one URL is blocked, the malware can still retrieve the Tor software from the others. The sample we analyzed contained the following URLs: The file it downloads from one of the URLs (A46913AB31875CF8152C96BD25027B4D) is the Tor proxy service. The Trojan saves it to C:\\Users\\Public\\controller\\ntdlg.exe. If the download fails, the script terminates. Assuming a successful download, the script launches the file with the help of WScript and then goes dormant for 10 seconds. This pause likely allows the Tor service to establish a connection with the Onion network and initialize itself. Next, the script attempts to read a GUID from C:\\Users\\Public\\controller\\GUID. If the file cannot be found, it generates a new GUID via createGUID() and saves it to the specified path. The GUID format is always vs1a- , for example, vs1a-1a2b. The script then tries to load a file named “SEED” from C:\\Users\\Public\\controller\\SEED. This file contains mnemonic phrases for cryptocurrency wallets that the script has collected. We’ll delve into how it finds and saves these phrases later in this post. If the SEED file is found, the script sends it to the server and then deletes it. These actions assume that the script might have previously terminated improperly, which would have prevented the mnemonic phrases from being sent to the server. To avoid losing collected data in case of an error, the malware saves them to a file before attempting to transmit them. At this point, the controller concludes its initialization process and enters its main operation cycle. The main loop In each cycle of operation, the controller checks every 500 milliseconds whether Task Manager is running. As before, if it is, the process exits. If the script doesn’t terminate, it begins to ping the C2 server over the Tor network. To do this, the script sends a request containing a GUID (Globally Unique Identifier) to the server. The server’s response will be a command. To avoid raising suspicion with overly frequent requests while maintaining constant communication, the script uses a timer (the p_timer variable). As we can see, every 500 milliseconds (half a second), immediately after checking if Task Manager is running, p_timer decrements by 1. When the variable reaches 0 (it’s also zero on the initial run), the timer is reset using the following formula: the PING_INT variable, which is set to 1800, is multiplied by two, and the result is stored in p_timer. This leaves 1800 seconds, or 30 minutes, until the next update. After the timer updates, the PingToOnion function is called, which we discuss next. Many similar malware strains constantly spam the network, hitting their C2 server for commands. The behavior quickly gives them away. A timer allows the script to stay under the radar while maintaining its connection to the server. Making requests only once every half an hour makes them much harder to spot in the overall traffic flow. The PingToOnion function works hand-in-hand with CheckOnionCMD. In the first one, the script sends a POST request to the C2 using the curl utility, routing the request through a Tor proxy located at localhost:9050 at the address: The server’s response is saved to the user’s %TEMP% directory at %TEMP%\cfile. After a request is sent to the server, CheckOnionCMD immediately kicks in. Its job is to look for a server response in a file named “cfile” located in the %TEMP% directory. If the response contains a GUID command, the malware does nothing. This is likely a PONG response from the server, confirming that the connection to the C2 server is still alive and well. However, if the first line of the response contains an EVAL command, it means all subsequent lines are JavaScript code. This code will then be executed using the eval function. Regardless of the server’s response, the Trojan then targets the victim’s clipboard data. Its primary goal is to sniff out mnemonic phrases and swap copied cryptocurrency wallet addresses with the attacker’s own wallet addresses. First, it scans the clipboard for strings that look like mnemonic (seed) phrases. If it finds any, these phrases are saved to a file named “SEED” (similar to the one the Trojan reads at startup). This file is then exfiltrated to the server using the PingToOnion function described above with the action SEED parameter. Once sent, the SEED file is deleted. The script then takes five screenshots (likely to capture the use of mnemonic phrases) and sends them to the server as well. They are captured with the help of the following PowerShell command: The FileToOnion function handles sending files to the server. It takes two arguments: the file itself (in this case, a screenshot) and the path where it needs to be uploaded. Screenshots are sent to the following path on the server: Files are also sent via a curl command: After sending the file, the script goes idle for 50 seconds. Then, it starts replacing cryptocurrency wallet addresses. If the clipboard content is only numbers, uppercase and lowercase English letters, and includes at least one letter and one number, the script performs additional checks to determine if it’s a Bitcoin, Ethereum, or Monero wallet. If a matching wallet is found in the clipboard, the script replaces it according to the following logic: Short Bitcoin wallet addresses (starting with “1” or “3” and 32–36 characters long) are replaced with a wallet whose first two characters match those in the original address. For long wallet addresses that start with “bc1q” or “bc1p” and are between 40 and 64 characters long, the malware finds a substitute address where the last character matches the original. If a wallet address begins with “0x” and is between 40 and 44 characters long, the script replaces it with one of several Ethereum wallets hardcoded into the malware. The goal here is to ensure the first three characters match the original address. For Monero addresses that start with “4” or “8” and are 95 characters long, attackers use a single, predefined address. Similar to other wallet types, the script checks for matching characters between the original and the swapped address. In the case of Monero, only the first character needs to match. This means the malware will only replace Monero wallets that start with “4”. This clipboard swap is typically executed with the help of the following command: After each swap, the script sends data to the server about both the original wallet and the replacement. Distribution via compromised WordPress sites As mentioned above, in addition to email, the Trojan spreads through compromised WordPress sites. Attackers search for poorly secured websites, brute-force their passwords, and then post messages offering to download recently released movies. These posts include a link to a password-protected archive containing a torrent file. The torrent file downloads a folder to the device. This folder contains something that looks like a movie in XMPEG format, a “readme !!!.txt” text file, and an executable that masquerades as a media player. To watch a movie in the XMPEG format, the user would seemingly need to launch xmpeg_player.exe. However, this executable is actually another version of the Efimer Trojan installer. Similar to the WSF variant, this EXE installer extracts the Trojan’s main component into the C:\\Users\\Public\\Controller folder, but it’s named “ntdlg.js”. Along with the Trojan, the installer also extracts the Tor proxy client, named “ntdlg.exe”. The installer then uses PowerShell to add the script to startup programs and the “Controller” folder to Windows Defender exclusions. The extracted Trojan is almost identical to the one spread via email. However, this version’s code includes spoofed wallets for Tron and Solana, in addition to the Bitcoin, Ethereum, and Monero wallets. Also, the GUID for this version starts with “vt05”. Additional scripts On some compromised machines, we uncovered several other intriguing scripts communicating with the same .onion domain as the previously mentioned ones. We believe the attackers installed these via an eval command to execute payloads from their C2 server. WordPress site compromise Among these additional scripts, we found a file named “btdlg.js” (MD5: 0f5404aa252f28c61b08390d52b7a054). This script is designed to brute-force passwords for WordPress sites. Once executed, it generates a unique user ID, such as fb01- , and saves it to C:\\Users\\Public\\Controller\\. The script then initiates multiple processes to launch brute-force attacks against web pages. The code responsible for these attacks is embedded within the same script, prior to the main loop. To trigger this functionality, the script must be executed with the “B” parameter. Within its main loop, the script initiates itself by calling the _runBruteProc function with the parameter “B”. After a brute-force attack is completed, the script returns to the main loop. Here, it will continue to spawn new processes until it reaches a hardcoded maximum of 20. Thus, the script supports two modes – brute-force and the main one, responsible for the initial launch. If the script is launched without any parameters, it immediately enters the main loop. From there, it launches a new instance of itself with the “B” parameter, kicking off a brute-force attack. The brute-force process starts via the GetWikiWords function: the script retrieves a list of words from Wikipedia. This list is then used to identify new target websites for the brute-force attack. If the script fails to obtain the word list, it waits 30 minutes before retrying. The script then enters its main operation loop. Every 30 minutes, it initiates a request to the C2 server. This is done with the help of the PingToOnion method, which is consistent with the similarly named methods found in other scripts. It sends a BUID command, transmitting a unique user ID along with brute-force statistics. This includes the total number of domains attacked, and the count of successful and failed attacks. After this, the script utilizes the GetRandWords function to generate a list of random words sourced from Wikipedia. Finally, using these Wikipedia-derived random words as search parameters, the script employs the getSeDomains function to search Google and Bing for domains to target with brute-force attacks. The ObjID function calculates an eight-digit hexadecimal hash, which acts as a unique identifier for a special object (obj_id). In this case, the special object is a file containing brute-force information. This includes a list of users for password guessing, success/failure flags for brute-force attempts, and other script-relevant data. For each distinct domain, this data is saved to a separate file. The script then checks if this identifier has been encountered before. All unique identifiers are stored in a file named “UDBXX.dat”. The script searches the file for a new identifier, and if one isn’t found, it’s added. This identifier tracking helps save time by avoiding reprocessing of already known domains. For every new domain, the script makes a request using the WPTryPost function. This is an XML-RPC function that attempts to create a test post using a potential username and password. The command to create the post looks like this: When the XML-RPC request is answered, whether successfully or not, the WPGetUsers function kicks in to grab users from the domain. This function hits the domain at /wp-json/wp/v2/users, expecting a list of WordPress site users in return. This list of users, along with the domain and counters tracking the number of users and passwords brute-forced, gets written to the special object file described above. The ID for this file is calculated with the help of ObjID. After processing a page, the script lies dormant for five seconds before moving on to the next one. Meanwhile, multiple processes are running concurrently on the victim’s computer, all performing brute-force operations. As mentioned before, when the script is launched with the “B” argument, it enters an infinite brute-forcing loop, with each process independently handling its targets. At the start of each iteration, there’s a randomly chosen 1–2 second pause. This delay helps stagger the start times of requests, making the activity harder to detect. Following this, the process retrieves a random object file ID for processing from C:\\Users\\Public\\Controller\\objects by calling ObjGetW. The ObjGetW function snags a random domain object that’s not currently tied up by a brute-force process. Locked files are marked with the LOCK extension. Once a free, random domain is picked for brute-forcing, the lockObj function is called. This changes the file’s extension to LOCK so other processes don’t try to work on it. If all objects are locked, or if the chosen object can’t be locked, the script moves to the next loop iteration and tries again until it finds an available file. If a file is successfully acquired for processing, the script extracts data from it, including the domain, password brute-force counters, and a list of users. Based on these counter values, the script checks if all combinations have been exhausted or if the maximum number of failed attempts has been exceeded. If the attempts are exhausted, the object is deleted, and the process moves on to a new iteration. If attempts remain, the script tries to authenticate with the help of hardcoded passwords. When attempting to guess a password for each user, a web page post request is sent via the WPTryPost function. Depending on the outcome of the brute-force attempt, ObjUpd is called to update the status for the current domain and the specific username-password combination. After the status is updated, the object is unlocked, and the process pauses randomly before continuing the cycle with a new target. This ensures continuous, multi-threaded credential brute-forcing, which is also regulated by the script and logged in a special file. This logging prevents the script from starting over from scratch if it crashes. Successfully guessed passwords are sent to the C2 with the GOOD command. Alternative Efimer version We also discovered another script named “assembly.js” (MD5: 100620a913f0e0a538b115dbace78589). While similar in functionality to controller.js and ntdlg.js, it has several significant differences. Similarly to the first script, this one belongs to the ClipBanker type. Just like its predecessors, this malware variant reads a unique user ID. This time it looks for the ID at C:\\Users\\Public\\assembly\\GUID. If it can’t find or read that ID, it generates a new one. This new ID follows the format M11-XXXX-YYYY, where XXXX and YYYY are random four-digit hexadecimal numbers. Next up, the script checks if it’s running inside a virtual machine environment. If it detects a VM, it prefixes the GUID string with a “V”; otherwise, it uses an “R”. Following this, the directory where the GUID is stored (which appears to be the script’s main working directory) is hidden. After that, a file named “lptime” is saved to the same directory. This file stores the current time, minus 21,000 seconds. Once these initial setup steps are complete, the malware enters its main operation loop. The first thing it does is check the time stored in the “lptime” file. If the difference between the current time and the time in the file is greater than 21,600 seconds, it starts preparing data to send to the server. After that, the script attempts to read data from a file named “geip”, which it expects to find at C:\\Users\\Public\\assembly\\geip. This file contains information about the infected device’s country and IP address. If it’s missing, the script retrieves information from https://ipinfo.io/json and saves it. Next, it activates the Tor service, located at C:\\Users\\Public\\assembly\\upsvc.exe. Afterwards, the script uses the function GetWalletsList to locate cryptocurrency wallets and compile a list of its findings. It prioritizes scanning of browser extension directories for Google Chrome and Brave, as well as folders for specific cryptocurrency wallet applications whose paths are hardcoded within the script. The script then reads a file named “data” from C:\\Users\\Public\\assembly. This file typically contains the results of previous searches for mnemonic phrases in the clipboard. Finally, the script sends the data from this file, along with the cryptocurrency wallets it discovered from application folders, to a C2 server at: After the script sends the data, it verifies the server’s response with the help of the CheckOnionCMD function, which is similar to the functions found in the other scripts. The server’s response can contain one of the following commands: RPLY returns “OK”. This response is only received after cryptocurrency wallets are sent, and indicates that the server has successfully received the data. If the server returns “OK”, the old data file is deleted. However, if the transmission fails (no response is received), the file isn’t deleted. This ensures that if the C2 server is temporarily unavailable, the accumulated wallets can still be sent once communication is re-established. EVAL executes a JavaScript script provided in the response. KILL completely removes all of the malware’s components and terminates its operation. Next, the script scans the clipboard for strings that resemble mnemonic phrases and cryptocurrency wallet addresses. Any discovered data is then XOR-encrypted using the key $@#LcWQX3$ and saved to a file named “data”. After these steps, the entire cycle repeats. “Liame” email address harvesting script This script operates as another spy, much like the others we’ve discussed, and shares many similarities. However, its purpose is entirely different. Its primary goal is to collect email addresses from specified websites and send them to the C2 server. The script receives the list of target websites as a command from the C2. Let’s break down its functionality in more detail. At startup, the script first checks for the presence of the LUID (unique identifier for the current system) in the main working directory, located at C:\\Users\\Public\\Controller\\LUID. If the LUID cannot be found, it creates one via a function similar to those seen in other scripts. In this case, the unique identifier takes the format fl01- . Next, the checkUpdate() function runs. This function checks for a file at C:\\Users\\Public\\Controller\\update_l.flag. If the file exists, the script waits for 30 seconds, then deletes update_l.flag, and terminates its operation. Afterwards, the script periodically (every 10 minutes) sends a request to the server to receive commands. It uses a function named PingToOnion, which is similar to the identically named functions in other scripts. The request includes the following parameters: LIAM: unique identifier action: request type data: data corresponding to the request type In this section of the code, LIAM string is used as the action, and the data parameter contains the number of collected email addresses along with the script operation statistics. If the script unexpectedly terminates due to an error, it can send a log in addition to the statistics, where the action parameter will contain LOGS string, and the data parameter will contain the error message. The request is sent to the following C2 address: The server returns a JSON-like structure, which the next function later parses. The structure dictates the commands the script should execute. This script supports two primary functions: Get a list of email addresses from domains provided by the server The script receives domains and iterates through each one to find hyperlinks and email addresses on the website pages. The GetPageLinks function parses the HTML content of a webpage and extracts all links that reside on the same domain as the original page. This function then filters these links, retaining only those that point to HTML/PHP files or files without extensions. The PageGetLiame function extracts email addresses from the page’s HTML content. It can process both openly displayed addresses and those encapsulated withinmailto links .Following this initial collection, the script revisits all previously gathered links on the C2-provided domains, continuing its hunt for additional email addresses. Finally, the script de-duplicates the entire list of harvested email addresses and saves them for future use. Exfiltrate collected data to the server In this scenario, the script anticipates two parameters from the C2 server’s response:pstack andbuffer , where: - pstack is an array of domains to which subsequent POST requests will be sent; - buffer is an array of strings, each containing data in the format of address,subject,message. The script randomly selects a domain from pstack and then uploads one of the strings from thebuffer parameter to it. This part of the script likely functions as a spam module, designed to fill out forms on target websites. For each successful data submission via a POST request to a specific domain, the script updates its statistics (which we mentioned earlier) with the number of successful transmissions for that domain.If an error occurs within this loop, the script catches it and reports it back to the C2 server with the LOGS command. Throughout the code, you’ll frequently encounter the term “Liame”, which is simply “Email” spelled backwards. Similarly, variations like “Liama”, “Liam”, and “Liams” are also present, likely derived from “Liame”. This kind of “wordplay” in the code is almost certainly an attempt to obscure the malicious intent of its functions. For example, instead of a clearly named “PageGetEmail” function, you’d find “PageGetLiame”. Victims From October 2024 through July 2025, Kaspersky solutions detected the Efimer Trojan impacting 5015 Kaspersky users. The malware exhibited its highest level of activity in Brazil, where attacks affected 1476 users. Other significantly impacted countries include India, Spain, Russia, Italy, and Germany. TOP 10 countries by the number of users who encountered Efimer (download) Takeaways The Efimer Trojan combines a number of serious threats. While its primary goal is to steal and swap cryptocurrency wallets, it can also leverage additional scripts to compromise WordPress sites and distribute spam. This allows it to establish a complete malicious infrastructure and spread to new devices. Another interesting characteristic of this Trojan is its attempt to propagate among both individual users and corporate environments. In the first case, attackers use torrent files as bait, allegedly to download popular movies; in the other, they send claims about the alleged unauthorized use of words or phrases registered by another company. It’s important to note that in both scenarios, infection is only possible if the user downloads and launches the malicious file themselves. To protect against these types of threats, we urge users to avoid downloading torrent files from unknown or questionable sources, always verify email senders, and consistently update their antivirus databases. For website developers and administrators, it’s crucial to implement measures to secure their resources against compromise and malware distribution. This includes regularly updating software, using strong (non-default) passwords and two-factor authentication, and continuously monitoring their sites for signs of a breach. Indicators of compromise Hashes of malicious files 39fa36b9bfcf6fd4388eb586e2798d1a — Requirement.wsf 5ba59f9e6431017277db39ed5994d363 — controller.js 442ab067bf78067f5db5d515897db15c — xmpeg_player.exe 16057e720be5f29e5b02061520068101 — xmpeg_player.exe 627dc31da795b9ab4b8de8ee58fbf952 — ntdlg.js 0f5404aa252f28c61b08390d52b7a054 — btdlg.js eb54c2ff2f62da5d2295ab96eb8d8843 — liame.js 100620a913f0e0a538b115dbace78589 — assembly.js b405a61195aa82a37dc1cca0b0e7d6c1 — btdlg.js Hashes of clean files involved in the attack 5d132fb6ec6fac12f01687f2c0375353 — ntdlg.exe (Tor) Websites hxxps://lovetahq[.]com/sinners-2025-torent-file/ hxxps://lovetahq[.]com/wp-content/uploads/2025/04/movie_39055_xmpg.zip C2 URLs hxxp://cgky6bn6ux5wvlybtmm3z255igt52ljml2ngnc5qp3cnw5jlglamisad[.]onion hxxp://he5vnov645txpcv57el2theky2elesn24ebvgwfoewlpftksxp4fnxad[.]onion