emeditor

A threat actor tracked as Storm-2561 has been targeting VPN users in a new credential theft campaign, Microsoft reports. Active since at least May 2025, Storm-2561 is known for using search engine optimization (SEO) poisoning for malware distribution and for impersonating popular software vendors to attract victims to malicious websites. The newly observed campaign started in mid-January, aimed at luring individuals looking for VPN software into downloading trojans that have been signed with a legitimate digital certificate to evade detection. Not only did the threat actor abuse users’ trust in search engine rankings, but they also hosted the malicious payloads on GitHub repositories, further increasing the chances of successful infections. In the repositories associated with the campaign, which have been removed, Storm-2561 hosted a ZIP file containing an MSI installer file posing as the legitimate VPN software Pulse Secure. Using SEO poisoning, the threat actor ensured that victims searching for ‘Pulse VPN download’ or ‘Pulse Secure client’ would receive malicious results at the top of the search page. Other brands were also impersonated as part of the campaign, Microsoft says. Users clicking on a poisoned result were taken to a malicious download website, but the payload was served as the ZIP archive fetched from GitHub. During installation, the MSI inside the ZIP file sideloaded a DLL to drop and launch a variant of the Hyrax information stealer that would collect URI and VPN credentials and exfiltrate them to an attacker-controlled command-and-control (C&C) server. Both the MSI and the DLL were signed with a valid certificate from Taiyuan Lihua Near Information Technology Co., Ltd., which has since been revoked. Other files signed with the same certificate were also identified, all posing as VPN applications. The fake VPN client installed in this attack mimicked the legitimate application, displaying a GUI that prompted the victim to introduce their credentials. The login information was immediately sent to the attacker’s C&C server. The MSI installed was also observed establishing persistence through the Windows RunOnce registry key by adding the fake VPN application to startup. After collecting the victims’ credentials, the fake software displayed an installation error message, providing instructions on how to download the legitimate Pulse VPN client, and, in certain instances, opening the browser to the legitimate VPN website. “If users successfully install and use legitimate VPN software afterward, and the VPN connection works as expected, there are no indications of compromise to the end user. Users are likely to attribute the initial installation failure to technical issues, not malware,” Microsoft notes. Related: Cloned AI Tool Sites Distribute Malware in ‘InstallFix’ Campaign Related: ‘SolyxImmortal’ Information Stealer Emerges Related: Infostealer Malware Delivered in EmEditor Supply Chain Attack

A new variant of the ClickFix attack relies on cloned webpages for popular development tools to distribute information-stealing malware, Push Security reports. As part of the campaign, dubbed InstallFix, threat actors rely on malvertising to lure victims to legitimate-looking malicious installation pages on which install commands have been replaced with rogue ones. One variant of the attack abuses users’ interest in Anthropic’s Claude Code CLI tool, using malicious advertisements distributed exclusively through Google Ads, increasing the visibility of the cloned page via sponsored search results. The cloned page is a near-pixel-perfect replica of the legitimate one. The install one-liner on it, however, points to an attacker-controlled server that distributes an infostealer, instead of fetching the install script for Claude Code. “Unless you’re carefully reading the URL embedded in the install one-liner (and let’s be honest, almost nobody does these days), the page is indistinguishable from the real one,” Push Security notes. Once the victim triggers the execution chain, cmd.exe spawns mshta.exe to retrieve and run code from a remote server, resulting in an Amatera Stealer infection. “We saw different sites executing identical binaries, further indicating that these are part of a single attacker campaign,” Push Security says. The cybersecurity firm also notes that threat actors are abusing legitimate domains such as Cloudflare Pages, Squarespace, and Tencent EdgeOne to host malicious content and blend with normal web traffic. Threat actors were also seen hosting malicious terminal commands on public pages on claude.ai, distributing the Cuckoo infostealer via clones of the Homebrew website, hosting rogue OpenClaw installers in GitHub repositories, and distributing malware through NPM packages mimicking Claude Code. “But this isn’t just a Claude problem — any tool or site that is likely to get clicks, and can be easily cloned, is a potential target for malvertising and impersonation,” Push Security notes. Related: Microsoft Warns of ClickFix Attack Abusing DNS Lookups Related: Malicious Chrome Extension Crashes Browser in ClickFix Variant ‘CrashFix’ Related: Hackers Weaponize Claude Code in Mexican Government Cyberattack Related: Infostealer Malware Delivered in EmEditor Supply Chain Attack

A new infostealer named ‘Arkanix Stealer’ operated as a malware-as-a-service (MaaS) enterprise in a one-shot campaign, Kaspersky says. Implemented in both C++ and Python, the malware emerged in October 2025, when its developer started advertising it in underground forum posts, but likely ceased operations in December, when its control panel and Discord channel disappeared. While short-lived, Arkanix Stealer did provide miscreants with broad information-stealing capabilities, collecting system and user information, application details, browser data, Telegram and Discord data, VPN information, and stealing files from specific directories. As part of the MaaS, users were provided with access to a control panel allowing them to configure payloads and access statistics. Users were provided with a browser post-exploitation tool named ChromElevator, delivered via a native C++ version of the malware that could also harvest cryptocurrency wallet data. The Python variant of the stealer, Kaspersky says, was deployed via a Python script, often bundled with PyInstaller or Nuitka, and could dynamically modify its configuration by making GET requests to a remote server. Arkanix Stealer could collect broad system information, including CPU, GPU, RAM, OS, screen, keyboard, and time zone data, along with details on the installed software, including antivirus and VPN applications. It could also target 22 browsers to harvest information such as history, autofill information, passwords, cookies, and 0Auth2 data, as well as Telegram messages and Discord credentials. The analyzed stealer sample also contained a self-spreading feature, acquiring a list of the victim’s Discord friends and channels via the Discord API, and sending a configured message to them. Kaspersky also observed the malware collecting credentials from known VPN clients, such as Mullvad VPN, NordVPN, ExpressVPN, and ProtonVPN. Using a pre-defined set of paths, the malware was seen exfiltrating files from multiple directories associated with the current user, packing them in a ZIP archive, and sending them to the command-and-control (C&C) server. The malware could also fetch additional modules from the C&C to expand its capabilities. These modules include a Chrome grabber, a wallet patcher, an extra collector, and a Python script placed in the startup folder to be executed at system boot. The native variant uses VMProtect, without code virtualization, implements anti-analysis features, collects RDP connection details, targets gaming files and clients for credential theft, captures screenshots, and exfiltrates browser data. Kaspersky identified two servers used to host the stealer panel and monitor victims, both secured via a sign-in page. The malware’s developer also maintained a Discord channel to interact with users and implemented a referral program to attract customers. “This campaign tends to be more of a one-shot campaign for quick financial gains rather than a long-running infection. The panel and the Discord chat were taken down around December 2025, leaving no message or traces of further development or a resurgence,” Kaspersky notes. Related: ‘SolyxImmortal’ Information Stealer Emerges Related: Infostealer Malware Delivered in EmEditor Supply Chain Attack Related: New ‘Sandworm_Mode’ Supply Chain Attack Hits NPM Related: New Keenadu Android Malware Found on Thousands of Devices

INFOSEC IN BRIEF The Trump administration has cleared a trio of individuals sanctioned by the Biden administration for involvement with the Intellexa spyware consortium behind the Predator surveillance tool, removing restrictions that had barred them from doing business with the US. It's the latest indicator that the Trump administration is a-okay with commercial spyware used by authoritarian countries to spy on dissidents, journalists, and political opponents, following a move in September that saw Team MAGA lift restrictions on Immigration and Customs Enforcement (ICE) purchasing software from commercial spyware maker Paragon Solutions. Predator has all the usual features of a commercial spyware product. It allows users to perform espionage-related activities on infected devices, including device tracking, surveillance, data theft, and the like. Predator has remained available through the Intellexa spyware consortium despite US sanctions imposed in 2024 on Intellexa-linked entities and executives. In its first round of sanctions in March 2024, the Biden-era Treasury Department described Intellexa as a "significant threat to … national security." Sara Hamou, who was sanctioned in March 2024 for providing managerial services to Intellexa-linked firms, has now been removed from the Treasury Department's Specially Designated Nationals list. The same applies to Andrea Gambazzi, the beneficial owner of Thalestris Limited, which held Predator distribution rights, and Merom Harpaz, described by US officials as a senior Intellexa executive. Both were sanctioned in September 2024. According to Reuters, the Treasury Department said the delistings were carried out as part of the normal administrative process in response to petitions for reconsideration, adding that each individual had demonstrated measures to separate themselves from the Intellexa consortium. Separately, ICE in September lifted a stop-work order on a Biden-era surveillance contract, allowing the agency to proceed with acquiring commercial spyware it had previously been blocked from deploying. According to the Atlantic Council, the United States recently earned the ignominious honor of becoming the largest investor in commercial spyware, with three times more investors than the next three highest countries. Korean Air employees' PII exposed in breach Korean Air posted an internal notice last week after its former in-flight catering and duty-free unit, KC&D, disclosed a security incident involving about 30,000 employees' records, including names and bank account numbers in some cases. As reported by Korean news outlet the JoongAng Daily, Korean Air said KC&D informed it of the leak and that no customer information appears to have been compromised - only the personally identifiable information (PII) of Korean Air staff. As other outlets reported, the culprit seems to be notorious cyber extortion group Clop, which took credit for the incident and leaked the data online. Korean Air's notice didn't include any mention of how the breach occurred, but as The Register and other publications have noted, Clop has made extensive use of a vulnerability in Oracle Enterprise Business Suite that was exploited as a zero-day beginning in August of last year, before patches were made available. Router maker ignoring researcher RCE report Security researchers who claim to be the first to use an AI agent to identify a remotely exploitable zero day have shared the exploit with the manufacturer, who appears to be ignoring them. Researchers at Pwn.ai say they used an AI agent to identify CVE-2025-54322, a CVSS 10.0 remote code execution vulnerability in Chinese networking hardware maker Xspeeder's SXZOS firmware more than seven months ago. The bug is a preauthorization vulnerability in the firmware, which, according to Pwn.ai, allows an attacker to gain total control of vulnerable devices. Pwn.ai said it found the vulnerability using emulated software that was able to hammer SXZOS from multiple angles. Pwn.ai said it's found other vulnerabilities in other systems, but is making the Xspeeder vuln its first disclosure "because, unlike other vendors, we have been unable to get any response from Xspeeder despite more than seven months of outreach." EmEditor installer download hijacked Bad news for anyone who downloaded Emurasoft's EmEditor from its official website between 19 and 22 December: You probably downloaded a maliciously modified version. Emurasoft said shortly before the Christmas holiday that the EmEditor download on its website was altered, it suspects, by an "unauthorized … third party." The company noted that the Download Now button was altered to point to an incorrect URL hosting a copy of the EmEditor MSI package that was signed by an unauthorized third party. It's believed that the only file affected by the hack was the emed64_25.4.3.msi, which, instead of being signed by Emurasoft, Inc., was signed by Walsham Investments Limited, suggesting tampering. The suspect file attempts to execute a PowerShell command that downloads and executes content from an outside domain when executed. Emurasoft didn't disclose what the malicious file may be doing, but said that the malicious redirect has been fixed and provided instructions to determine whether users were affected. Westminster City Council admits sensitive data stolen in November breach What began as a "cyber security incident" has since been confirmed as the unauthorized copying of council data likely to include sensitive and personal information, as Westminster City Council in the UK has disclosed more about the scope of a November breach. The BBC reported last week that the late-2025 incident, which affected IT systems shared by Westminster, Kensington and Chelsea, and Hammersmith and Fulham, is now being considered one in which "potentially sensitive and personal information" was likely snagged by attackers targeting the boroughs. That's in contrast to the initial claim from the trio in late November, and follow-up claims from Kensington and Chelsea that admitted some data was taken, but that it was just some old stuff. Now, Westminster appears to be saying it's a legitimate concern for locals in that borough, as well as Kensington and Chelsea. Hammersmith and Fulham, the BBC noted, maintains its systems were unaffected. It's still not clear what data was taken, but Westminster City Council, like Kensington and Chelsea, is warning citizens to be vigilant for scam calls, emails, and texts that may result from misuse of the stolen data. ®

The popular text and code editing software EmEditor was recently targeted in a supply chain attack that resulted in the distribution of infostealer malware. Developed by Redmond-based Emurasoft, Inc., EmEditor is a high-performance Windows tool designed for coding, text editing, and processing large files. In a security incident notice posted on the official website on December 22, the software’s developers warned that individuals who had downloaded EmEditor using the ‘download now’ button between December 19, 18:39 PT, and December 22, 12:50 PT, may have been served a malicious installer. “If you downloaded the installer from the [Download Now] button on the EmEditor homepage during this period, it is possible that a different file without our digital signature was downloaded. This is a conservative estimate, and in reality the affected period may have been narrower and limited to a specific timeframe,” the notice reads. Based on Emurasoft’s analysis, the URL behind the ‘Download Now’ button was changed to point to a malicious .msi file hosted in a different location on the EmEditor website. The fake installer had the same name and was similar in size to the genuine installer, but was signed with a certificate belonging to a different company. When run, the malicious installer executed a PowerShell command designed to download and execute a file from a fake EmEditor domain. The Chinese cybersecurity company Qianxin has investigated the attack and warned enterprises and government organizations about the potential threat. The security firm noted that the editor has a significant user base in China. Qianxin’s analysis showed that the malicious .msi file contained a script designed to collect system information, along with files from the Desktop, Documents, and Downloads folders. Data such as VPN configurations, browser information, and credentials for Windows and applications such as Zoho Mail, Discord, Slack, Teams, Zoom, WinSCP, PuTTY, Telegram, and Steam are also collected. The security firm pointed out that the malware checks the system’s language, and it terminates if it’s set to former Soviet countries or Iran. Qianxin researchers also found that once it collects information, the malicious script deploys a browser extension named ‘Google Drive Caching’, which has been described as a fully-featured information-stealing malware. This malicious extension is used for persistence and enables the attackers to collect system information, browser history and bookmarks, and cookies. In addition, the extension has clipboard hijacking functionality that enables it to replace cryptocurrency addresses with ones owned by the attacker. It’s also capable of logging keystrokes and stealing Facebook ad accounts. Qianxin has not shared any information on attribution, but its description suggests that the supply chain attack was conducted by profit-driven cybercriminals rather than a state-sponsored APT. However, the cybersecurity industry says the lines between the two threat actor categories are increasingly blurred. Indicators of compromise (IoCs) for the EmEditor attack are available from Qianxin and Emurasoft. Related: 640 NPM Packages Infected in New ‘Shai-Hulud’ Supply Chain Attack Related: Chinese Cyberspies Deploy ‘BadAudio’ Malware via Supply Chain Attacks Related: Supply Chain Attack Targets VS Code Extensions With ‘GlassWorm’ Malware