epic games

Google to Allow One-Tap Android App Installs From Approved Third-Party Stores Outside U.S.

Third-party Android app stores can now apply to Google for permission to install apps with one tap, without Android's usual confirmation screens, and to update them in the background. To qualify, a store must pass identity checks and send Google its full catalog, along with every new app and update, for ongoing malware scanning. Approved stores get the features from December 1, but only on

thehackernews.comOct 28, 2026extracted

Resident Evil maker Capcom warns of phishing after 11.7 million records exposed

malwarebytes.comOct 23, 2026extracted

Infostealer riding the AI Train

research.checkpoint.comOct 23, 2026extracted

DarkMe RAT trades zero-days for plain phishing emails

DarkMe, a remote access trojan and info-stealer that has previously been associated with a threat group that targeted financial market traders and cryptocurrency users, has been spotted again. This time around, its distribution has been simplified: instead of leveraging zero-day exploits, attackers are betting on a simple email to convince targets to run it on their machine: The malicious email pointing to the first stage downloader for DarkMe (Source: Huntress) The link supposedly points to … More → The post DarkMe RAT trades zero-days for plain phishing emails appeared first on Help Net Security .

helpnetsecurity.comSep 23, 2026extracted

Fake GTA 6 Extended Look and demo sites deliver an infostealer

GTA 6 footage really has leaked online, and Rockstar has an official Extended Look coming to Netflix on August 27. But cybercriminals are exploiting the hype with fake Rockstar sites that lead visitors to password-stealing malware. We identified a network of sites appearing in searches for a GTA 6 demo and impersonating Rockstar Games. One Google result advertises an “Official Download,” but visitors who follow the sites’ “Play Now” links can instead end up downloading gta6_installer.exe . The sites are particularly convincing because they copy Rockstar’s genuine promotion for its August 27 extended look at GTA 6. But the executable they deliver isn’t a demo, game, or video. It’s an information stealer designed to take passwords stored in browsers, cookies, and authenticated sessions. And because stolen browser sessions can sometimes be reused without going through the normal login process, even two-factor authentication (2FA) may not be enough to stop them. One of the fake GTA 6 demo websites impersonating Rockstar Games There is no GTA 6 demo Rockstar has not announced or released a demo of Grand Theft Auto VI. The game is scheduled for release on November 19, 2026, for PlayStation 5 and Xbox Series X|S. Rockstar has not announced a PC version. Rockstar has announced an extended look at GTA 6 for August 27, premiering on Netflix before appearing on its YouTube channel later that day. That’s something to watch, not a playable demo or game download. The scam sites copy this genuine announcement while using “Play Now” buttons that can lead visitors to the malicious executable. The site copies Rockstar’s genuine Extended Look promo, but adds a fake “Play Now” button In other words, there is no legitimate GTA 6 demo or PC build to download. This isn’t the first fake GTA 6 offer we’ve seen. Earlier this year, scammers were charging people hundreds of dollars for fake GTA 6 early access . The file size should also immediately raise suspicion. The executable delivered by these sites is just 1.1 MB. That is nowhere near enough to contain a modern AAA game. In fact, the screenshot we took of one of the websites is larger than the file it was offering. The supposed GTA 6 installer is just 1.1 MB The leak created the opening On August 18, new GTA 6 gameplay footage and what appears to be a complete map of Leonida, the game’s setting, began circulating online. A person or group calling itself Cyberleek claimed responsibility. Rockstar and Take-Two responded with takedowns, with Take-Two filing DMCA subpoenas seeking records from Microsoft and Discord that could help identify whoever is behind the leaks. The malicious gta6_installer.exe sample was first spotted on August 19, just one day after the first Cyberleek material began circulating. Apparently genuine unauthorized GTA 6 material was already circulating, giving people searching for leaked footage, maps, or unofficial builds reason to believe there might be more out there. But genuine leaks weren’t the only thing competing for that attention. Leaked clips carried promotional material for a cryptocurrency token associated with Cyberleek, while Cyberleek’s website solicited cryptocurrency donations and offered paid advertising placements in future GTA 6 videos. AI-generated and recycled footage was also being presented on social media as fresh leaks. One of the fake GTA 6 sites appearing in Google search results alongside legitimate GTA 6 coverage This isn’t the first time GTA 6 has been caught up in a major leak. In 2022 , Rockstar confirmed that an attacker had stolen and published development footage of the game. Leaks create exactly the kind of environment malware operators can exploit: huge demand for unofficial material, mixed with fakes, promotions, scams, and genuine leaks that can all be made to look remarkably similar. The fake GTA 6 demo is another part of that ecosystem, but one designed to steal passwords and logged-in browser sessions. What the file actually does The installer belongs to the Vidar family, a well-established infostealer we’ve seen in other recent malware campaigns that is sold as a service to cybercriminals. Malwarebytes detects this sample, and blocks the websites and network infrastructure associated with the campaign. Vidar is designed to steal the information browsers remember for you. That could give attackers access to accounts including your email, social media, gaming, and shopping accounts. In this sample, it went looking for: Saved passwords and login details Session cookies Browsing and download history Autofill and other saved browser profile data Credentials stored by FTP clients Our analysis showed 19 browser targets, including Chrome, Edge, Firefox, Brave, Opera, and Vivaldi. It also searched Thunderbird profile directories and targeted Perplexity’s Comet browser and the WebView2 browser embedded inside Roblox Studio. The behavior report showed no persistence mechanism designed to make the malware survive a reboot. We observed no startup entry, scheduled task, or installed service that would relaunch it automatically. But an infostealer doesn’t need to remain on your computer to cause lasting damage. Once passwords or session tokens have been stolen, attackers can continue trying to use them after the malware itself is gone. That is one reason an infection can be easy to miss. In our analysis, it produced no visible user-facing window and installed nothing that a user would normally notice. From the victim’s perspective, the supposed GTA 6 installer may simply appear to do nothing. Why changing your password might not be enough If you use a password manager and unique passwords, you might assume there is little useful information for a stealer to take directly from your browser. Session cookies change that. When you sign in to a website, the site gives your browser a session token that tells it you have already authenticated. That is why you do not have to enter your password every time you open another page. If an attacker steals a usable session token, they may be able to reuse that authenticated session without going through the normal login process again. That matters for 2FA too. 2FA protects the login process, but a stolen session was created after that login had already succeeded. Depending on the service and its security controls, an attacker may therefore be able to reuse the session without being asked for your password or 2FA again. This is why changing your password after a stealer infection may not be enough by itself. A password change does not necessarily invalidate every existing session. You should also use the service’s option to sign out everywhere, revoke active sessions, or remove unfamiliar devices. How to protect yourself Check it’s official. Do not assume an unofficial “demo,” beta, early build, or leaked version is legitimate just because a game has not launched yet. Check the publisher’s official website and store pages first. Use official download sources. Download games and demos only from official sources such as Steam, the Epic Games Store, PlayStation Store, Xbox, or the publisher’s own website. Check the file size. A one-megabyte executable cannot contain a modern AAA game. Don’t trust search results. Attackers can buy advertisements and optimize malicious pages for exactly the terms people search during major news events. Don’t trust appearances. Official artwork, logos, screenshots, and page layouts are easy to copy. Be careful with leaked material. By definition, there is no official distribution channel to tell you which download is genuine. If what you want is GTA 6 footage, Rockstar’s official Extended Look arrives on August 27. Block malicious sites. Malwarebytes Browser Guard blocks malicious pages like these before they load, helping stop the attack before a download ever reaches your computer. What to do if you ran it If you downloaded and ran a supposed GTA 6 demo installer, assume credentials and active browser sessions on that computer may have been compromised. Work through the following steps: Scan the affected computer with Malwarebytes or another trusted security product and remove anything it detects. Use a clean device to change important passwords , starting with your primary email account, followed by banking, payment services, and accounts tied to your identity. Sign out of active sessions everywhere you can. Look for options such as “sign out everywhere,” “log out of all devices,” or “active sessions.” This is what deals with stolen session cookies and tokens. Check your accounts for changes you did not make , including new email forwarding rules, recovery addresses, phone numbers, authorised applications, and unfamiliar devices. Enable two-factor authentication on accounts that don’t already have it. Monitor important accounts closely for unusual activity over the following weeks. Check gaming accounts as well. Steam, Epic, and similar accounts can contain saved payment methods, valuable inventories, and access to other services. Technical details It uses your own browser to unlock your data Browsers increasingly use stronger encryption and application-level protections for saved passwords and cookies. In particular, Chromium-based browsers have made it harder for unrelated software to simply copy a database and decrypt everything directly. This sample uses a different approach. During our analysis, it launched the actual Chrome, Edge, and Firefox executables installed on the system. It started them in headless mode, disabled logging, and pointed each one at a temporary user-data directory. In other words, it was not launching a fake browser. It was using legitimate browser binaries already trusted by the system. The point is to work through a browser process that can access its own protected data rather than trying to defeat those protections from the outside. Afterward, the malware issued commands to delete the temporary browser directories it had created. The protection has not necessarily been broken. It has been approached through software that is already allowed to use it. That is an important distinction, because browser-level encryption makes credential theft harder, but it cannot make running an unknown executable safe. The delivery address can come from a social media profile Vidar has a well-documented habit of using what researchers call dead-drop resolvers . Instead of relying only on a command-and-control address permanently embedded in the malware, Vidar variants can retrieve the current destination from attacker-controlled profiles hosted on legitimate services such as Telegram and Steam. This makes the infrastructure easier to rotate: operators can update a profile instead of rebuilding and redistributing the malware. The activity we observed is consistent with that pattern. The sample contained profile URLs for Telegram, Pinterest, and Steam Community, and network connections to all three services were observed during analysis. It also communicated with attacker infrastructure. Most notably, it sent multipart POST requests to ses.1001gacor.org . The sample also established a TLS connection to ket.sm188daftar.mom . The important point is that traffic to a legitimate service such as Telegram, Pinterest, or Steam can blend in with ordinary network activity. Blocking one malicious server is also less useful when the malware has another place it can check for updated infrastructure. The Telegram profile used by the malware Indicators of compromise (IOCs) Distribution sites gta6demo[.]asia gta6demo[.]eu gta6demo[.]us rockstar-gta-6[.]com File hash (SHA-256) a8f19d598e6a49d8510d73d41fc445246755ed321c2f76985a463a9fef537eb0 ( gta6_installer.exe ) Dead-drop resolver URLs telegram[.]me/m1duus t[.]me/m1duus pinterest[.]com/m1duus steamcommunity[.]com/profiles/76561198657426610 Network infrastructure observed in this sample ses.1001gacor[.]org ket.sm188daftar[.]mom Additional Vidar infrastructure ket.1001gacor[.]org ljr.1001gacor[.]org nhg.1001gacor[.]org bob.1001gacor[.]org kra.1001gacor[.]org brr.1001gacor[.]org sto.1001gacor[.]org rex.1001gacor[.]org bib.1001gacor[.]org ges.1001gacor[.]org tax.11gokil[.]org sii.11gokil[.]org zaf.11gokil[.]org dez.11gokil[.]org tax.sm188dnsx[.]top sii.sm188dnsx[.]top zaf.sm188dnsx[.]top “One of the best cybersecurity suites on the planet.”   According to CNET.  Read their review →

malwarebytes.comAug 24, 2026extracted

153GB of stolen credentials surface after LiteLLM supply chain attack

153GB of stolen credentials surface after LiteLLM supply chain attack A massive 153GB archive stolen during the LiteLLM supply chain attack exposes credentials and other sensitive data linked to thousands of corporate domains, including AWS, Samsung, Cisco, and Salesforce. Hudson Rock says it obtained and analyzed the archive, which contains 433,909 files, and attributed 118,829 CI runner dumps to 2,488 corporate domains. “We are leveraging this data for a global ethical disclosure effort,” Alon Gal, Hudson Rock’s co-founder and CTO, told Help Net Security. “We see this as an opportunity to help organizations respond proactively before threat actors weaponize the data publicly.” LiteLLM is an open-source proxy gateway that developers use to route requests to different AI models. The LiteLLM breach had its roots in an earlier compromise of Trivy, a popular open-source vulnerability scanner. On March 19, 2026, TeamPCP, a cybercriminal group that emerged in late 2025, used stolen credentials to publish a compromised version of Trivy. LiteLLM’s build pipeline installed Trivy automatically, giving the poisoned scanner read access to the runner environment and allowing the attackers to steal the project’s PyPI publishing tokens. Using those tokens, TeamPCP published two malicious LiteLLM releases, versions 1.82.7 and 1.82.8, to the Python Package Index on March 24. “The key takeaway is how supply chains have evolved to make a single upstream breach affect thousands of companies simultaneously. A window of roughly 40 minutes in which the LiteLLM dependency was hacked led to over 430,000 instances in which millions of secrets were harvested,” Gal said. Tracing exposed secrets back to their owners The dataset contains information linked to organizations including NVIDIA, Volkswagen, Microsoft, FedEx, S&P Global, John Deere, Epic Games, Orange, TomTom, BT Group, ServiceNow, Deloitte, and Siemens. Screenshots published with the research show AWS secret access keys, Salesforce client secrets, Slack signing secrets, Azure environment variables, and AI provider API keys captured during pipeline execution. A trove of internal corporate secrets (Source: Hudson Rock) CloudSEK, working from a separate dataset built from about 434,000 stolen files, put the number of exposed organizations at close to 2,500. The company stressed that its figures reflect exposure rather than confirmed breaches. “I’ve confirmed the data is legit by the way, multiple victim orgs,” security researcher Kevin Beaumont said. “It contains a significant volume of sensitive content at orgs. It’s a massive supply chain breach due to poor AI security—not because AI is the threat, but teens can run circles around orgs obsessed with rushing out AI and poor DevOps security.” “Identifying the victims within this 153GB database presents a unique threat intelligence challenge. Accurate attribution requires looking past the surface level to analyze the actual infrastructure boundaries,” Hudson Rock noted. In one case, a leaked pipeline was tied to a committer email at SiriusXM, but infrastructure markers in the same dump, including a self-hosted GitLab instance at gitlab.adswizz.com, pointed to AdsWizz, a SiriusXM subsidiary. Hudson Rock said correct identification depends on “hard infrastructure markers rather than simple committer emails.” A large share of the dumped files have no obvious owner. According to Hudson Rock, some contain database passwords, third-party API keys, and cloud credentials without a company email address, custom domain, or internal server name that could identify the organization they came from. This means organizations may have exposed credentials in the dataset without knowing they are affected. Organizations urged to act before stolen data leaks Hudson Rock is urging organizations using AI proxy infrastructure, third-party CI/CD vulnerability scanners, or downstream AI packages to audit their environments for LiteLLM versions 1.82.7 and 1.82.8 and treat any secrets accessible to the LiteLLM environment as compromised. Organizations should also rotate cloud IAM keys and access tokens, review audit logs for anomalous activity dating back to March 24, and check for unauthorized .pth files and suspicious systemd services. “While we cannot disclose how we obtained this data, it is not leaked anywhere at the moment and is not circulating widely. This makes it a critical window of opportunity for companies to rotate keys and secrets before it eventually leaks, as is the natural cycle of a breach,” Gal added. Despite the scale of the breach, some organizations appear to be treating the exposure with less urgency than the findings warrant. “These creds date from about March. One of the orgs impacted told me they’d rotated them all and it’s a nothingburger, so I looked at their responsible disclosure policy, it allows trying creds, so I tried them all. Almost every one worked. Submitted report. One of the biggest US techcos,” Beaumont wrote. “This magnitude pushes us into a completely new world regarding the type of response required from the cybersecurity industry,” Gal concluded.

helpnetsecurity.comAug 13, 2026extracted

Fake Adobe and Zoom Updates Install ScreenConnect for Persistent Remote Access

Cybersecurity researchers have disclosed details of an active, multi-wave campaign that employs social engineering lures themed around Adobe and Zoom software updates, business document reviews, and system maintenance utilities to stealthily deploy Remote Monitoring and Management (RMM) programs like ConnectWise ScreenConnect. The campaign has been codenamed SMOKE#SCREEN by Securonix Threat Research. "The campaign relies on a toolkit of VBScript droppers, batch file loaders, compiled .NET executables and an HTML phishing page, all ultimately pointing to a live WsgiDAV-based staging server at 207.174.0[.]143:8080," researchers Shikha Sangwan, Akshay Gaikwad, and Aaron Beardslee said in a report shared with The Hacker News. Successful attacks culminate with a ScreenConnect agent installed and beaconing to one of three attacker-controlled relay servers, providing the attackers with persistent remote access to compromised systems. The activity has not been attributed to any known threat actor or group. The findings add to the growing abuse of legitimate RMM tools by threat actors, as it allows them to bypass security controls and take advantage of their prevalence in enterprise environments to blend in with authorized IT tooling without the need for deploying a purpose-built remote access trojan. Securonix said its investigation commenced following the discovery of a live WsgiDAV server that served two purposes: stage malicious payloads and maintain command-and-control (C2) over existing infected machines through a ScreenConnect relay on port 8041. An analysis of the ScreenConnect relay configuration strings embedded in the MSI and EXE payloads has uncovered three distinct C2 clusters, each associated with software update, document review, and document viewer decoy binaries. The initial access vector is assessed to be spear-phishing, with the emails serving as a conduit for an obfuscated Visual Basic Script (aka VBScript) dropper that first performs a series of environment and anti-analysis checks to ensure safe execution. It also enumerates running processes, and aborts if any of the following executables are running - Wireshark (wireshark.exe) Process Monitor (procmon.exe) Oracle VM VirtualBox (vboxservice.exe) Broadcom VMware Tools (vmtoolsd.exe) Citrix XenServer (xenservice.exe) Fiddler Classic (fiddler.exe) If the environment checks pass, the script proceeds to decrypt a PowerShell command that fetches a C# payload from "207.189.11[.]170" and executes it. Alternatively, attacks have been observed using business-themed lures to trick recipients into running a VBScript that ultimately leads to ScreenConnect installation. A third sample linked to the activity is delivered as a compressed archive, from which a batch script is run to disable Windows Antimalware Scan Interface (AMSI), escalate privileges by means of a User Account Control (UAC) prompt, turn off SmartScreen protections via Registry modifications, and then remove the Zone.Identifier alternate data stream (ADS) from the downloaded MSI file before running it. "The actor's delivery strategy has also rotated across multiple trusted hosting services," Securonix said. "An early phishing page ('zoom-update.html') delivers its payload via a Dropbox shared link, bypassing domain reputation filters since Dropbox is an allow-listed platform in most corporate environments." "A compiled .NET loader ('MemoryLoader.cs') references a Cloudflare Quick Tunnel (subscription-magnetic-recommended-meat.trycloudflare.com), a service designed for temporary local server exposure that is rarely monitored. The staging server itself runs cloudflared.exe, confirming that the actor uses the Cloudflare binary directly on their infrastructure to generate these ephemeral tunnels." Irrespective of the phishing lure used, all attack paths lead to the same destination: the installation of ScreenConnect client, which connects to a configured relay server and allows the operator to open a remote desktop session with the victim's machine. "What makes this campaign particularly notable for defenders is the observable arc of the actor's tradecraft," Securonix said. "From cautious XOR-encrypted VBScript droppers to aggressive nine-step Defender destruction sequences and then, most recently, a pivot back to stealth with anti-EDR timing and self-contained encrypted bundles, the campaign reads like a real-time arms race between attacker and defender." To counter the threat, organizations are recommended to restrict execution of untrusted MSI files, monitor when processes attempt to tamper with security products, audit legitimate use of RMM tools, check for suspicious PowerShell and "cmd.exe" processes, and enforce strict UAC settings to prevent standard users from bypassing UAC prompts for administrative tasks. Fake Xeno Roblox Cheats Deliver Java Stealer Malware The disclosure comes as Bitdefender warned of a separate campaign in which fake Xeno Executor installers promoted via gaming forums and Discord communities are used to initiate a multi-stage Java infection chain that drops an information stealer capable of credential theft, as well as stealing browser cookies, Discord, Roblox and Minecraft accounts, cryptocurrency-wallet data and payment information. The stealer, named Powercat, can also record keystrokes, access the webcam, stream the victim's desktop, manipulate files, run PowerShell commands, and grant attackers interactive control of the infected computer. "The final payload combines information theft, surveillance, persistence, remote access, file manipulation and command execution," Bitdefender researchers Janos Gergo Szeles and Silviu Stahie said. The activity is believed to have been ongoing since the start of 2026, with a surge recorded in the second half of March. Some aspects of the campaign were previously documented by ThreatLocker in late March 2026, highlighting the threat actor's use of bogus cheats for popular PC games to distribute Powercat. The so-called cheats come in the form of archives that mimic a legitimate Xeno installation using plausible file names. Victims are instructed to run a "xeno.exe," which, instead of launching the cheat, runs the first stage of the malware. The payload checks for a Java Runtime Environment, extracts one if missing, and then reads a local file ("XenoIcon.jpg") containing the keys necessary to validate its execution with the C2 server ("solthere[.]net"). Subsequently, it launches an obfuscated JAR file disguised as "decompiler.exe," which performs environment checks, registers the victim, and downloads the final malware payload. The third stage is a Java-based stealer and surveillance malware that can harvest sensitive data, collect screenshots and webcam footage, stream the victim's desktop, and monitor keyboard and mouse activity. It can also download and upload files, execute commands through PowerShell, and open an interactive shell for hands-on-keyboard access, giving the attacker full control over the host. "Personal information theft begins with the malware gathering information about potentially interesting software installed on the victim's system," Bitdefender said. "This allows the operators to adapt their strategy and prioritize which data to steal." Targeted applications include - Web browsers (Brave Browser, Chrome, Edge, Opera, Opera GX, and Vivaldi) Cryptocurrency wallets (Atomic, Cake Wallet, Exodus, Monero Wallet, SafePal, and Tron Wallet) Software development tools (Git, JetBrains tools, Microsoft Visual Studio, and Python IDLE) Game launchers (Battle.net, Epic Games Launcher, Riot Client, Rockstar Games Launcher, and Steam) VPN (ExpressVPN, Mullvad VPN, NordVPN, and Surfshark) Messengers (Discord, Snapchat, Telegram, and WhatsApp) Roblox and Minecraft installations (Feather, Lunar, Meteor, Modrinth, Prism, and the official Minecraft launcher) To target Exodus cryptocurrency wallets, the stealer checks if Exodus version 26.1.5 is installed on the system, and, if so, unpacks the "app.asar" archive and injects JavaScript code to capture valid tokens and exfiltrate them to the C2 server. "Gaming-related lures remain effective because they exploit users' interest in gaining an advantage, accessing restricted functionality, or avoiding anti-cheat detection," Bitdefender said. "The delivered malware is considerably more capable than a typical credential stealer. Its remote-access and command-execution capabilities also mean that the compromise can continue beyond the initial theft of information, which can lead to data destruction or allow operators to use the infected system in other cyber-criminal activities."

thehackernews.comAug 4, 2026extracted

Fake Fortnite rewards are stealing players’ accounts

Fortnite scam pages like the ones below appear by the dozen every day, recycled endlessly under different names and designs. One version promises $50 from a fake superhero collaboration. Another claims it can calculate what your locker is worth. Both lead to the same destination: a fake Epic Games login page designed to steal your account. It’s an old trick, but it still catches people out. The short version If a website promises free V-Bucks, cash, or a tool to calculate your locker’s value, then asks you to log in with your Epic account to get it, it’s not run by Epic. Epic doesn’t offer an official tool that values accounts, and no legitimate giveaway requires you to sign in through a third-party site. You’re just handing your Epic username and password to scammers. If you or your child entered your Epic login details on one of these sites, assume the account has been compromised. Change the password immediately, turn on two-factor authentication, and don’t reuse that password on any other accounts. Why do they want your login? A stolen Fortnite account can be worth real money. Criminals can take over accounts with rare skins, spend any saved payment methods, sell the account on underground marketplaces, or use it to scam the owner’s friends. They may also try the same username and password on other online accounts, hoping the password has been reused. Why Fortnite? Fortnite still attracts around 110 million monthly players and has more than 650 million registered accounts. That alone makes it an attractive target for cybercriminals. The audience’s age matters too. In December 2022, the US Federal Trade Commission (FTC) fined Epic Games a record $520 million, after alleging that the company knew children made up a substantial share of its player base and left voice and text chat turned on by default, exposing them to strangers. The Consumer Financial Protection Bureau (CFPB) also cites industry experts who say young gamers are especially vulnerable to phishing because they spend more time on social media and are less familiar with social engineering. The game is also built around visible status. Skins, emotes, and pickaxes cost real money, making the idea that “your locker has a price” feel plausible. Rare or discontinued skins really do sell for hundreds of dollars on unofficial marketplaces, even though Epic offers no official way to cash out V-Bucks and selling accounts violates its terms of service. That kernel of truth is exactly what these locker-value scams exploit. That’s also what makes them more convincing than a simple V-Bucks giveaway. Instead of promising something for nothing, they play on curiosity about something the player already owns. That’s probably why this version keeps coming back. How the scam works Some pages promise rewards: Others skip the free-reward pitch and frame the locker itself as hidden value the player is owed: Others frame it as competition instead of currency: The hook changes, but the fake login page doesn’t. These sites all do the same thing. They ask you to sign in with your Epic account so they can steal your username and password. Another variant: Fake settlement claims This one borrows a real story. Epic did settle with the FTC for $520 million, and real payments are still going out in 2026. But the real settlement pays actual dollars through the FTC’s own process, not in-game V-Bucks through an “Epic Games Locker,” and the claim window closed in July 2025. References to an “EU Regulatory Mandate” and the case number shown on these pages don’t match any genuine legal action. How to stay safe Fortnite scams change constantly, but the advice doesn’t. Use Malwarebytes Browser Guard to block known phishing sites before they have a chance to steal your login details. Only sign in to your Epic account at epicgames.com. If another website asks for your Epic login, leave. Be sceptical of offers that sound too good to be true. Free V-Bucks, locker valuations, and surprise rewards are all common phishing lures. Verify refunds and settlements on the official source. If a page claims you’re owed money, check the regulator’s website yourself instead of following its links. Turn on two-factor authentication (2FA). It can stop attackers from accessing your account even if they steal your password. Use Malwarebytes Scam Guard. It can help you identify suspicious links and messages before you click. What to do if you clicked Change the Epic password immediately, going directly to epicgames.com, not through the suspicious link. Turn on two-factor authentication if you haven’t already. Check your linked email for password reset requests or login alerts you didn’t make. Review connected devices/services on the account and remove anything unfamiliar. If you entered payment details anywhere, contact your card issuer and monitor your statements. Report the page to Epic’s support and flag it as phishing in your browser. If the page claims to be part of a settlement or refund, verify it on the regulator’s official website. For the Epic settlement, that’s ftc.gov. Stop threats before they can do any harm. Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

malwarebytes.comJul 31, 2026extracted

Week in review: Weaponized OAuth redirection logic delivers malware, Patch Tuesday forecast

Week in review: Weaponized OAuth redirection logic delivers malware, Patch Tuesday forecast Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: BlacksmithAI: Open-source AI-powered penetration testing framework BlacksmithAI is an open-source penetration testing framework that uses multiple AI agents to execute different stages of a security assessment lifecycle. BlacksmithAI runs as a hierarchical system in which an orchestrator coordinates task execution across specialized agents. Security debt is becoming a governance issue for CISOs Application security backlogs keep expanding across large development portfolios. Veracode’s 2026 State of Software Security Report puts numbers behind a familiar operational pattern, fixes lag discovery, and older weaknesses stay open across release cycles. Your dependencies are 278 days out of date and your pipelines aren’t protected Applications continue to ship with known weaknesses even as development workflows speed up. A new Datadog State of DevSecOps 2026 report examines how dependency management and pipeline practices are influencing exposure across cloud native environments. AI went from assistant to autonomous actor and security never caught up Enterprise AI deployments have shifted from pilot programs to production systems handling customer data, executing business transactions, and integrating with core infrastructure. That has exposed a significant gap between what AI agents can do and what security teams can observe or control. Cybersecurity is now the price of admission for industrial AI Industrial organizations are accelerating AI deployment across manufacturing, utilities, and transportation and running straight into a security problem. Cisco’s 2026 State of Industrial AI Report, based on responses from more than 1,000 decision-makers across 19 countries, finds that cybersecurity has become the single largest obstacle to AI adoption, outranking skills gaps, integration challenges, and budget constraints. Cybersecurity professionals are burning out on extra hours every week Cybersecurity professionals in the U.S. are working an average of 10.8 extra hours per week beyond their contracted schedules, according to survey data collected from 300 cybersecurity and IT leaders by Sapio Research. That figure effectively adds a sixth working day to the standard week for a large portion of the field. Nearly half of respondents reported working 11 or more overtime hours weekly, and one in five logged more than 16 additional hours. The vulnerability that turns your AI agent against you Zenity Labs disclosed PleaseFix, a family of critical vulnerabilities affecting agentic browsers, including Perplexity Comet, that allow attackers to hijack AI agents, access local files, and steal credentials within authenticated user sessions. The vulnerabilities can be triggered through malicious content embedded in routine workflows, enabling unauthorized actions without user awareness. Threat actors weaponize OAuth redirection logic to deliver malware An ongoing phishing campaign is abusing the OAuth authentication redirection mechanism to avoid triggering conventional email and browser defenses, Microsoft researchers have revealed. The attackers are targeting government and public-sector organizations, and redirecting unsuspecting users from trusted login pages to their own infrastructure, to serve malware or capture login credentials. Coruna: Spy-grade iOS exploit kit powering financial crime A powerful iOS exploit kit has circulated among multiple threat actors over the past year, moving from a commercial surveillance operation to state-linked espionage campaigns and, ultimately, ended into the hands of financially motivated hackers, according to new research from Google’s Threat Intelligence Group (GTIG). Over 1,200 IceWarp servers still vulnerable to unauthenticated RCE flaw (CVE-2025-14500) A critical RCE vulnerability (CVE-2025-14500) in IceWarp, an EU-made business communication and collaboration platform, may be exploited by attackers to gain unauthorized access to exposed unpatched servers. According to the Shadowserver Foundation, there are currently over 1,200 internet-facing instances that have yet to receive a fix, and the organization is sending out alerts to the owners, urging them to update. As AI agents start making purchases, security teams must rethink risk In this Help Net Security interview, Donald Kossmann, CTO at fintech company Chargebacks911, talks about the emerging security, fraud, and governance risks of “agentic commerce,” where AI agents can autonomously make purchasing decisions on behalf of users or organizations. FreeScout vulnerability enables unauthenticated, zero-click RCE via email (CVE-2026-28289) A newly discovered vulnerability (CVE-2026-28289) in the open-source help desk platform FreeScout could allow attackers to take over vulnerable servers by sending a specially crafted email to a FreeScout mailbox. FreeScout is a free, open-source help desk and shared inbox system used by businesses or teams to manage customer support conversations in one place. Cisco warns of SD-WAN Manager exploitation, fixes 48 firewall vulnerabilities Cisco has confirmed that two Catalyst SD-WAN Manager vulnerabilities (CVE-2026-20128 and CVE-2026-20122) patched in late February 2025 are being exploited by attackers. CVE-2026-20128 is a bug in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager, which could allow an authenticated, local attacker to gain DCA user privileges on an affected system. Iran-linked APT targets US critical sectors with new backdoors An Iran-linked hacking group has been active inside the networks of several US organizations since early February, raising concerns that the activity could precede broader cyber operations connected to escalating geopolitical tensions in the Middle East. Why workforce identity is still a vulnerability, and what to do about it Most organizations believe they have workforce identity under control. New hires are verified. Accounts are provisioned. Multi-factor authentication is enforced. Audits are passed. Then a breach happens, often through an account that was “properly secured.” But the problem can be traced back to the fact that identity verification, provisioning, authentication, and recovery operate as separate events, not a continuous system of trust. Engineering trust: A security blueprint for autonomous AI agents AI agents have evolved from just chatbots, answering questions to executing actions using various integrated tools, often autonomously, and as such the traditional security models have become less efficient. A single malicious instruction hidden in a webpage (that the agent processes), can manipulate that agent into performing unintended actions or leaking sensitive data. March 2026 Patch Tuesday forecast: Is AI security an oxymoron? Developers and analysts are using more AI tools to produce code and to test both the performance and security of the finished products. They are also embedding AI functionality in their products directly. But just how secure are these AI tools and routines themselves? Recent reports show they suffer from vulnerabilities just like any other code. When cyber threats start thinking for themselves In this Help Net Security video, Jason Rivera, Field CISO & Head of Solution Engineering at SimSpace, discusses how autonomous AI agents are changing cyber threats. Drawing on experience in the US Army, NSA, Deloitte, and CrowdStrike, he describes how security teams have traditionally measured risk through volume, speed, and sophistication. Why phishing still works today In this Help Net Security video, Gal Livschitz, Senior Penetration Tester at Terra Security, explains how phishing has evolved and why employees still fall for it. He outlines how phishing now uses HTTPS, branded pages, and lookalike domains, making attacks harder to spot. He highlights communication overload as a key weakness that attackers exploit. Motorola turns to GrapheneOS for smartphone security upgrade Motorola is strengthening smartphone security through a long-term partnership with the GrapheneOS Foundation, a mobile security nonprofit that develops a hardened operating system based on the Android Open Source Project. Anthropic’s Claude hit by widespread service outage (updated) Anthropic suffered widespread service disruptions Monday morning, leaving thousands of users unable to access its Claude AI platform. Most users reporting problems said they encountered errors when attempting to log in. Meta AI in WhatsApp organizes chats and reopens privacy issues The trend of integrating AI into digital platforms continues. In the latest Android beta release (2.26.9.4), the company has introduced a feature that allows users to organize their chat history with the help of Meta AI. Anthropic poaches users from rival chatbots with easier migration The controversy over Anthropic’s negotiations with the Pentagon has driven increased interest in Claude. Negotiations between the Department of Defense and Anthropic collapsed after a deadline for an agreement expired without a deal. The Pentagon had pressed the company to loosen certain restrictions on how its AI systems could be used. Anthropic declined and kept its existing policy limits in place. $100 radio equipment can track cars through their tire sensors When people consider what might track their movements, they think of smartphone apps, GPS services, or roadside cameras. The tires of a new car rarely enter that equation. Researchers at IMDEA Networks Institute, together with European partners, found that Tire Pressure Monitoring System (TPMS) sensors inside each wheel broadcast unencrypted wireless signals containing persistent identifiers. Google speeds up Chrome updates with new security-focused release cycle The Chrome browser is moving to a two-week release cycle, a change intended to give developers and users faster access to new features, performance improvements and bug fixes. The new schedule begins with the stable release of Chrome 153 on September 8, 2026, followed by new beta and stable releases every two weeks. The change applies to desktop, Android and iOS platforms, while the Dev and Canary channels remain unchanged. Workers reviewing Meta Ray-Ban footage encounter users’ intimate moments Bank details and intimate moments captured without people realizing they are being recorded are the new privacy nightmare behind the latest tech fashion hit, Meta Ray-Ban smart glasses. A joint investigation by Svenska Dagbladet and Göteborgs-Posten found that footage and audio recorded by Meta’s Ray-Ban smart glasses are reviewed by human contractors in Kenya, including recordings containing sensitive personal material. Authorities pull plug on Tycoon 2FA phishing-as-a-service platform Tycoon 2FA, a phishing-as-a-service platform that allowed cybercriminals to bypass MFA and break into online accounts, has been disrupted by law enforcement agencies and cybersecurity partners. Western governments lay the groundwork for secure 6G networks Governments are preparing for 6G, the next generation of mobile networks, placing security and resilience among their top priorities. In response, seven countries participating in the Global Coalition on Telecoms (GCOT) have introduced a set of 6G Security and Resilience Principles, developed with support from industry partners. Backup strategies are working, and ransomware gangs are responding with data theft Business email compromise (BEC) and funds transfer fraud combined for 58% of all cyber insurance claims filed in 2025, according to data from Coalition covering more than 100,000 policyholders across the United States, Canada, the United Kingdom, Australia, and Germany. OpenAI’s GPT-5.4 doubles down on safety as competition heats up In the midst of recent developments and controversies surrounding a contract with the U.S. Department of Defense, OpenAI released the GPT-5.4 model. The release comes at a time when users are reportedly leaving ChatGPT for rival chatbots, particularly Anthropic’s Claude. Microsoft working on Teams feature to keep unauthorized bots at bay Microsoft plans to add a new Teams feature that lets meeting admins identify and control third-party bots before they join. According to the Microsoft 365 Roadmap, the feature is scheduled to begin rolling out in May 2026 on Desktop, Mac, Linux, iOS, and Android versions of Microsoft Teams. AI risk moves into the security budget spotlight Enterprises are pushing AI deeper into workflows that touch sensitive data across cloud platforms and SaaS apps. The 2026 Thales Data Threat Report, based on a survey of 3,120 respondents in 20 countries, places that shift alongside growing pressure on data protection, identity controls, and cloud security. UK reduces cyberattack fix times from two months to eight days The UK government has launched a new vulnerability monitoring service (VMS) that promises to reduce the time needed to fix critical cyber weaknesses across the public sector. The service, launched as part of the Blueprint for Modern Digital Government, published in January 2025, continuously scans internet-facing systems at around 6,000 public sector organizations. Using commercial and proprietary tools, it detects about 1,000 types of cyber vulnerabilities. IPFire ships its 200th core update with a new domain blocklist and kernel upgrade Network firewall distribution IPFire released Core Update 200, marking the 200th incremental update to the 2.29 branch. The release bundles a kernel upgrade, a beta domain blocklist service, security patches for OpenSSL and glibc, and a range of component updates. 5 years of shifting cybersecurity behavior Online security is built through routine decisions made across devices and accounts. People choose how to create passwords, how often to reuse them, and how much effort to invest in protecting personal data. The National Cybersecurity Alliance and CybSafe’s Oh, Behave! The Cybersecurity Attitudes and Behaviors Report: 2021–2025 follows those patterns over five years, drawing on responses from more than 24,000 adults and documenting how attitudes and behaviors shift over time. Healthcare organizations are accepting cyber risk to cut costs Healthcare organizations are cutting cybersecurity budgets under financial pressure even as the threats targeting their systems intensify. A PwC survey of 381 global healthcare executives, conducted between May and July 2025, puts numbers to the gap between the risks the sector faces and the controls it has in place. Android’s March 2026 security patch fixes over 100 flaws, one under targeted exploitation The Android March 2026 security patch addresses vulnerabilities across dozens of components and includes one CVE confirmed under active exploitation. Devices running a patch level of 2026-03-05 or later receive fixes for all disclosed issues. New Defender deployment tool streamlines Windows device onboarding with single executable Microsoft’s Defender deployment tool for Windows helps administrators manage device onboarding at scale with updated progress visibility and additional controls. Cloudflare tracked 230 billion daily threats and here is what it found Cloudflare’s network blocks over 230 billion threats per day. The volume indicates how routine and automated the attack cycle has become, and the patterns behind that volume point to a shift in how breaches begin and progress. Cloudflare’s threat research unit, Cloudforce One, published its inaugural cyber threat report 2026, covering activity observed through 2025 and projecting into the year ahead. The report draws on telemetry from Cloudflare’s network, which handles roughly 20% of global web traffic. Immutable Linux distribution Nitrux 6.0.0 adds GPU passthrough, boot-level recovery, C++ update system Nitrux 6.0.0, released March 3, 2026, packages several components that security practitioners running Linux workstations will find worth examining: a new hypervisor orchestrator with IOMMU-enforced isolation, a rewritten update system with cryptographic verification, and a recovery mechanism that operates from within the boot process itself. LeakBase cybercrime forum with 142,000 users taken down in global operation LeakBase, an open-web cybercrime forum facilitating the trade of leaked databases and “stealer logs” containing stolen credentials, has been taken down in an international law enforcement operation coordinated by Europol and involving authorities from 14 countries. Google changes Play Store policies after settling Epic Games dispute Google is making changes to the Play Store after settling its legal fight with Epic Games, focusing on three areas: more billing options, lower fees with new programs for developers, and a program for registered app stores. That attractive online ad might be a malware trap Malware increasingly travels through the infrastructure that delivers online advertising. The Media Trust’s Global Report on Digital Trust, Ad Integrity, and the Protection of People describes a digital ad ecosystem where scam campaigns, malicious redirects, and malware delivery appear alongside marketing traffic. What happens when AI teams compete against human hackers A cybersecurity competition produced what may be the largest controlled dataset comparing AI-augmented teams to human-only teams on professional-grade offensive security tasks. The event, called NeuroGrid, ran for 72 hours on the Hack The Box platform and drew 1,337 registered human-only teams and 156 registered AI-agent teams competing across 36 challenges in nine security domains at four difficulty levels. Cursor Automations turns code review and ops into background tasks Cursor Automations, the always-on agent platform from Cursor, is expanding with a new generation of autonomous systems that streamline code review, incident response, and other engineering workflows. The platform runs AI agents on schedules or in response to development events. New cyber module strengthens risk planning for health organizations The Administration for Strategic Preparedness and Response’s (ASPR) new cybersecurity module in the Risk Identification and Site Criticality (RISC) 2.0 Toolkit helps organizations identify critical gaps, prioritize investments, and make informed decisions about risk mitigation to reduce disruptions to patient care and strengthen resilience. Secure by Design: Building security in at the beginning Secure by Design is not a single tool, product, or one‑time activity. It is a holistic approach that requires security to be deliberately embedded from the very beginning, at the point where systems, software, and services are conceived and designed. Rather than reacting to vulnerabilities after deployment, Secure by Design emphasizes anticipating risk early and addressing it through intentional design decisions, clearly defined security requirements, and accountability across the entire lifecycle. Webinar: The True State of Security 2026 In the webinar The True State of Security 2026, you’ll gain insight into why AI is distracting teams from more persistent risks and how human access and permissions remain the weakest link. You’ll also learn why current security workflows are slowing organizational growth and what a balanced security strategy should look like heading into 2026. Cybersecurity jobs available right now: March 3, 2026 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now. New infosec products of the week: March 6, 2026 Here’s a look at the most interesting products from the past week, featuring releases from Beazley Security, Push Security, Samsung, and Tufin.

helpnetsecurity.comMar 8, 2026extracted

Google changes Play Store policies after settling Epic Games dispute

Google changes Play Store policies after settling Epic Games dispute Google is making changes to the Play Store after settling its legal fight with Epic Games, focusing on three areas: more billing options, lower fees with new programs for developers, and a program for registered app stores. The rollout begins in the European Economic Area, the United Kingdom and the United States by June 30, 2026. Australia follows in September, while Japan and South Korea receive the changes by the end of 2026. The rest of the world follows in September 2027. “We believe these changes will make for a stronger Android ecosystem with even more successful developers and higher-quality apps and games available across more form factors for everyone,” the company stated. Expanded billing options Developers publishing apps on Google Play will be able to use their own billing systems alongside Google Play’s payment system. They can also direct users outside the app to complete purchases on their own websites. Google said the goal is to provide developers and users with more flexibility in how transactions are handled while maintaining security for payments. Lower Play Store fees The service fee for in-app purchases tied to new installs will be 20%. Developers participating in the Apps Experience Program or the updated Google Play Games Level Up program will pay 15% on transactions from new installs and 20% for transactions from existing installs. Developers who choose to use Google Play’s billing system will pay a separate billing fee, set at 5% in the European Economic Area, the United Kingdom and the United States. Subscription transactions will carry a 10% service fee. Easier access to alternative app stores Google is also launching a Registered App Stores program aimed at simplifying the installation of third party Android stores. App stores that meet certain safety and quality requirements will be able to register with Google and receive a more streamlined installation process when users sideload them. “This gives app stores more ways to reach users and gives users more ways to easily and safely access the apps and games they love,” Sameer Samat, president of the Android ecosystem, said in a blog post. The Registered App Stores program begins outside the US first and may expand to the US pending court approval, with rollout planned alongside a major Android release by the end of the year.

helpnetsecurity.comMar 5, 2026extracted

Arkanix Stealer pops up as short-lived AI info-stealer experiment

An information-stealing malware operation named Arkanix Stealer, promoted on multiple dark web forums towards the end of 2025, was likely developed as an AI-assisted experiment. The project included a control panel and a Discord server for communication with users, but the author took them down without notification, just two months after the operation began. Arkanix offered many of the standard data-stealing features that cybercriminals are used to, along with a modular architecture and anti-analysis features. Kaspersky researchers analyzed the Arkanix stealer and found clues indicating LLM-assisted development, which "might have drastically reduced development time and costs." The researchers believe that Arkanix was a short-lived project for quick financial gains, which makes detection and tracking much more difficult. Arkanix appears online Arkanix started being promoted on hacker forums in October 2025, offering two tiers to potential customers: a basic level with a Python-based implementation, and a “premium” one with a native C++ payload using VMProtect protection, integrating AV evasion and wallet injection features. The developer set up a Discord server that acted as a forum for the community around the project to receive updates, provide feedback for proposed features, and receive help. Also, a referral program was established to promote the project more aggressively, giving referrers an extra free hour of premium access, while potential new customers received one week of free access to the “premium” version. Data-stealing capabilities Arkanix malware can collect system information, steal data stored in the browser (history, autofill info, cookies, passwords), and cryptocurrency wallet data from 22 browsers. Kaspersky researchers say that it can also extract 0Auth2 tokens on Chromium-based browsers. Additionally, the malware can steal data from Telegram, steal Discord credentials, spread via the Discord API, and send messages to the victim’s friends/channels. Arkanix also targets credentials for Mullvad, NordVPN, ExpressVPN, and ProtonVPN, and can archive files from the local filesystem to exfiltrate them asynchronously. Additional modules that can be downloaded from the command-and-control include a Chrome grabber, a wallet patcher for Exodus or Atomic, a screenshots tool, HVNC, and stealers for FileZilla and Steam. The “premium” native C++ version adds RDP credential theft, anti-sandbox and anti-debugging checks, WinAPI-powered screen capturing, and also targets Epic Games, Battle.net, Riot, Unreal Engine, Ubisoft Connect, and GOG. The higher-tier variant also delivers the ChromElevator post-exploitation tool, which injects into suspended browser processes for data theft and is designed to bypass Google's App-Bound Encryption (ABE) protection for unauthorized access to user credentials. The purpose of the Arkanix stealer experiment remains unclear. The project may be an attempt to determine how LLM assistance can improve malware development and how quickly new features can be shipped to the community. Kaspersky's assessment is that Arkanix is "more of a public software product than a shady stealer." The researchers provide a comprehensive list of indicators of compromise (IoCs) that include hashes for detected files, along with domains and IP addresses. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

bleepingcomputer.comFeb 22, 2026extracted

Arkanix Stealer: a C++ & Python infostealer

Introduction In October 2025, we discovered a series of forum posts advertising a previously unknown stealer, dubbed “Arkanix Stealer” by its authors. It operated under a MaaS (malware-as-a-service) model, providing users not only with the implant but also with access to a control panel featuring configurable payloads and statistics. The set of implants included a publicly available browser post-exploitation tool known as ChromElevator, which was delivered by a native C++ version of the stealer. This version featured a wide range of capabilities, from collecting system information to stealing cryptocurrency wallet data. Alongside that, we have also discovered Python implementation of the stealer capable of dynamically modifying its configuration. The Python version was often packed, thus giving the adversary multiple methods for distributing their malware. It is also worth noting that Arkanix was rather a one-shot malicious campaign: at the time of writing this article, the affiliate program appears to be already taken down. Kaspersky products detect this threat as Trojan-PSW.Win64.Coins.*, HEUR:Trojan-PSW.Multi.Disco.gen, Trojan.Python.Agent.*. Technical details Background In October 2025, a series of posts was discovered on various dark web forums, advertising a stealer referred to by its author as “Arkanix Stealer”. These posts detail the features of the stealer and include a link to a Discord server, which serves as the primary communication channel between the author and the users of the stealer. Upon further research utilizing public resources, we identified a set of implants associated with this stealer. Initial infection or spreading The initial infection vector remains unknown. However, based on some of the file names (such as steam_account_checker_pro_v1.py, discord_nitro_checker.py, and TikTokAccountBotter.exe) of the loader scripts we obtained, it can be concluded with high confidence that the initial infection vector involved phishing. Python loader The Python loader is the script responsible for downloading and executing the Python-based version of the Arkanix infostealer. We have observed both plaintext Python scripts and those bundled using PyInstaller or Nuitka, all of which share a common execution vector and are slightly obfuscated. These scripts often serve as decoys, initially appearing to contain legitimate code. Some of them do have useful functionality, and others do nothing apart from loading the stealer. Additionally, we have encountered samples that employ no obfuscation at all, in which the infostealer is launched in a separate thread via Python’s built-in threading module. Upon execution, the loader first installs the required packages — namely, requests, pycryptodome, and psutil — via the pip package manager, utilizing the subprocess module. On Microsoft Windows systems, the loader also installs pywin32. In some of the analyzed samples, this process is carried out twice. Since the loader does not perform any output validation of the module installation command, it proceeds to make a POST request to hxxps://arkanix[.]pw/api/session/create to register the current compromised machine on the panel with a predefined set of parameters even if the installation failed. After that, the stealer makes a GET request to hxxps://arkanix[.]pw/stealer.py and executes the downloaded payload. Python stealer version During our research, we obtained a sample of the Python implementation of the Arkanix stealer, which was downloaded from the endpoint hxxps://arkanix[.]pw/stealer.py by the previous stage. The stealer’s capabilities — or features, as referred to by the author — in this version are configurable, with the default configuration predefined within the script file. To dynamically update the feature list, the stealer makes a GET request to hxxps://arkanix[.]pw/api/features/{payload_id}, indicating that these capabilities can be modified on the panel side. The feature list is identical to the one that was described in the GDATA report. Prior to executing the information retrieval-related functions, the stealer makes a request to hxxps://arkanix[.]pw/upload_dropper.py, saves the response to %TEMP%\upd_{random 8-byte name}.py, and executes it. We do not have access to the contents of this script, which is referred to as the “dropper” by the attackers. During its main information retrieval routine, at the end of each processing stage, the collected information is serialized into JSON format and saved to a predefined path, such as %LOCALAPPDATA\Arkanix_lol\%info_class%.json. In the following, we will provide a more detailed description of the Python version’s data collection features. System info collection Arkanix Stealer is capable of collecting a set of info about the compromised system. This info includes: OS version CPU and GPU info RAM size Screen resolution Keyboard layout Time zone Installed software Antivirus software VPN Information collection is performed using standard shell commands with the exception of the VPN check. The latter is implemented by querying the endpoint hxxps://ipapi[.]co/json/ and verifying whether the associated IP address belongs to a known set of VPNs, proxies, or Tor exit nodes. Browser features This stealer is capable of extracting various types of data from supported browsers (22 in total, ranging from the widely popular Google Chrome to the Tor Browser). The list of supported browsers is hardcoded, and unlike other parameters, it cannot be modified during execution. In addition to a separate Chrome grabber module (which we’ll discuss later), the stealer itself supports the extraction of diverse information, such as: Browser history (URLs, visit count and last visit) Autofill information (email, phone, addresses and payment cards details) Saved passwords Cookies In case of Chromium-based browsers, 0Auth2 data is also extracted All information is decrypted using either the Windows DPAPI or AES, where applicable, and searched for relevant keywords. In the case of browser information collection, the stealer searches exclusively for keywords related to banking (e.g., “revolut”, “stripe”, “bank”) and cryptocurrencies (e.g., “binance”, “metamask”, “wallet”). In addition to this, the stealer is capable of extracting extension data from a hardcoded list of extensions associated with cryptocurrencies. Telegram info collection Telegram data collection begins with terminating the Telegram.exe process using the taskkill command. Subsequently, if the telegram_optimized feature is set to False, the malware zips the entire tdata directory (typically located at %APPDATA%\Roaming\Telegram Desktop\tdata) and transmits it to the attacker. Otherwise, it selectively copies and zips only the subdirectories containing valuable info, such as message log. The generated archive is sent to the endpoint /delivery with the filename tdata_session.zip. Discord capabilities The stealer includes two features connected with Discord: credentials stealing and self-spreading. The first one can be utilized to acquire credentials both from the standard client and custom clients. If the client is Chromium-based, the stealer employs the same data exfiltration mechanism as during browser credentials stealing. The self-spreading feature is configurable (meaning it can be disabled in the config). The stealer acquires the list of user’s friends and channels via the Discord API and sends a message provided by the attacker. This stealer does not support attaching files to such messages. VPN data collection The VPN collector is searching for a set of known VPN software to extract account credentials from the credentials file with a known path that gets parsed with a regular expression. The extraction occurs from the following set of applications: Mullvad VPN NordVPN ExpressVPN ProtonVPN File retrieval File retrieval is performed regardless of the configuration. The script relies on a predefined set of paths associated with the current user (such as Desktop, Download, etc.) and file extensions mainly connected with documents and media. The script also has a predefined list of filenames to exfiltrate. The extracted files are packed into a ZIP archive which is later sent to the C2 asynchronously. An interesting aspect is that the filename list includes several French words, such as “motdepasse” (French for “password”), “banque” (French for “bank”), “secret” (French for “secret”), and “compte” (French for “account”). Other payloads We were able to identify additional modules that are downloaded from the C2 rather than embedded into the stealer script; however, we weren’t able to obtain them. These modules can be described by the following table, with the “Details” column referring to the information that could be extracted from the main stealer code. The Wallet patcher and Extra collector scripts are received in an encrypted form from the C2 server. To decrypt them, the attackers utilize the AES-GCM algorithm in conjunction with PBKDF2 (HMAC and SHA256). After decryption, the additional payload has its template placeholders replaced and is stored under a partially randomized name within a temporary folder. Once all operations are completed, the stealer removes itself from the drive, along with the artifacts folder (Arkanix_lol in this case). Native version of stealer During our analysis, we were able to obtain both the release and debug versions of the native implementation, as both were uploaded to publicly available resources. The following are the key differences between the two: The release version employs VMProtect, but does not utilize code virtualization. The debug version communicates with a Discord bot for command and control (C2), whereas the release version uses the previously mentioned C2 domain arkanix[.]pw . The debug version includes extensive logging, presumably for the authors’ debugging purposes. Notably, the native implementation explicitly references the name of the stealer in the VersionInfo resources. This naming convention is consistent across both the debug version and certain samples containing the release version of the implant. After launching, the stealer implements a series of analysis countermeasures to verify that the application is not being executed within a sandboxed environment or run under a debugger. Following these checks, the sample patches AmsiScanBuffer and EtwEventWrite to prevent the triggering of any unwanted events by the system. Once the preliminary checks are completed, the sample proceeds to gather information about the system. The list of capabilities is hardcoded and cannot be modified from the server side, in contrast to the Python version. What is more, the feature list is quite similar to the Python version except a few ones. RDP connections The stealer is capable of collecting information about known RDP connections that the compromised user has. To achieve this, it searches for .rdp files in %USERPROFILE%\Documents and extracts the full server address, password, username and server port. Gaming files The stealer also targets gamers and is capable to steal credentials from the popular gaming platform clients, including: Steam Epic Games Launcher net Riot Origin Unreal Engine Ubisoft Connect GOG Screenshots The native version, unlike its Python counterpart, is capable of capturing screenshots for each monitor via capCreateCaptureWindowA WinAPI. In conclusion, this sample communicates with the C2 server through the same endpoints as the Python version. However, in this instance, all data is encrypted using the same AES-GCM + PBKDF2 (HMAC and SHA256) scheme as partially employed in the Python variant. In some observed samples, the key used was arkanix_secret_key_v20_2024. Alongside that, the C++ sample explicitly sets the User-Agent to ArkanixStealer/1.0. Post-exploitation browser data extractor This is an implant embedded within the resources of the C++ implementation. The author incorporated it into the resource section without applying any obfuscation or encryption. Subsequently, the stealer extracts the payload to a temporary folder with a randomly generated name composed of hexadecimal digits (0-9 and A-F) and executes it using the CreateProcess WinAPI. The payload itself is the unaltered publicly available project known as “ChromElevator”. To summarize, this tool consists of two components: an injector and the main payload. The injector initializes a direct syscall engine, spawns a suspended target browser process, and injects the decrypted code into it via Nt syscalls. The injected payload then decrypts the browser master key and exfiltrates data such as cookies, login information, web data, and so on. Infrastructure During the Arkanix campaign, two domains used in the attacks were identified. Although these domains were routed through Cloudflare, a real IP address was successfully discovered for one of them, namely, arkanix[.]pw. For the second one we only obtained a Cloudflare IP address. Both servers were also utilized to host the stealer panel, which allows attackers to monitor their victims. The contents of the panel are secured behind a sign-in page. Closer to the end of our research, the panel was seemingly taken down with no message or notice. Stealer promotion During the research of this campaign, we noticed that the forum posts advertising the stealer contained a link leading to a Discord server dubbed “Arkanix” by the authors. The server posed as a forum where authors posted various content and clients could ask various questions regarding this malicious software. While users mainly thank and ask about when the feature promised by the authors will be released and added into the stealer, the content made by the authors is broader. The adversary builds up the communication with potential buyers using the same marketing and communication methods real companies employ. To begin with, they warm up the audience by posting surveys about whether they should implement specific features, such as Discord injection and binding with a legitimate application (sic!). Additionally, the author promised to release a crypter as a side project in four to six weeks, at the end of October. As of now, the stealer seems to have been taken down without any notice while the crypter was never released. Furthermore, the Arkanix Stealer authors decided to implement a referral program to attract new customers. Referrers were promised an additional free hour to their premium license, while invited customers received seven days of free “premium” trial use. As stated in forum posts, the premium plan included the following features: C++ native stealer Exodus and Atomic cryptocurrency wallets injection Increased payload generation, up to 10 payloads Priority support Speaking of technical details, based on the screenshot of the Visual Studio stealer project that was sent to the Discord server, we can conclude that the author is German-speaking. This same screenshot also serves as a probable indicator of AI-assisted development as it shares the common patterns of such assistants, e.g. the presence of the utils.cpp file. What provides even more confidence is the overall code structure, the presence of comments and extensive debugging log output. Conclusions Information stealers have always posed as a serious threat to users’ data. Arkanix is no exception as it targets a wide range of users, from those interested in cryptocurrencies and gaming to those using online banking. It collects a vast amount of information including highly sensitive personal data. While being quite functional, it contains probable traces of LLM-assisted development which suggests that such assistance might have drastically reduced development time and costs. Hence it follows that this campaign tends to be more of a one-shot campaign for quick financial gains rather than a long-running infection. The panel and the Discord chat were taken down around December 2025, leaving no message or traces of further development or a resurgence. In addition, the developers behind the Arkanix Stealer decided to address the public, implementing a forum where they posted development insights, conducted surveys and even ran a referral program where you could get bonuses for “bringing a friend”. This behavior makes Arkanix more of a public software product than a shady stealer. Indicators of Compromise Additional IoCs are available to customers of our Threat Intelligence Reporting service. For more details, contact us at [email protected]. Domains and IPs arkanix[.]pw arkanix[.]ru

securelist.comFeb 19, 2026extracted

ShinyHunters-Branded Extortion Activity Expands, Escalates

ShinyHunters-branded extortion attacks are expanding and escalating, relying on effective social engineering tactics to compromise cloud environments, Mandiant cautions. The warning comes only days after reports that the ShinyHunters group has set up infrastructure to target more than 100 organizations across multiple sectors, including Atlassian, Adyen, Canva, Epic Games, HubSpot, Moderna, ZoomInfo, GameStop, WeWork, Halliburton, Sonos, and Telstra. A known extortion group, ShinyHunters was seen registering fake domains to target these companies, using specialized phishing kits for credential harvesting. ShinyHunters-linked actors were seen using vishing to target single sign-on (SSO) authentication and compromise enterprises’ cloud-based software-as-a-service (SaaS) environments, and Mandiant’s alert reinforces the observation. “These campaigns leverage evolved voice phishing (vishing) and victim-branded credential harvesting to successfully compromise single sign-on (SSO) credentials and enroll unauthorized devices into victim multi-factor authentication (MFA) solutions,” the Google-owned cybersecurity firm notes. Okta recently warned of such attacks, in which the hackers intercepted credentials and tricked their victims into aiding them bypass MFA, deploying scripts to control authentication flows in the victims’ browsers in real time. Once an intrusion is detected, organizations should prioritize rapid containment to block the attackers’ access and prevent further data exfiltration, Mandiant says. “Because these campaigns rely on valid credentials rather than malware, containment must prioritize the revocation of session tokens and the restriction of identity and access management operations,” the company notes. Advice for organizations Organizations are advised to identify and disable compromised accounts, revoke active session tokens and OAuth authorizations, disable or heavily restrict public self-service password reset portals, and temporarily disable MFA registration. Additionally, they should restrict or temporarily disable VPNs, virtual desktop infrastructure (VDI) and similar remote access points, restrict access to identity provider and SaaS applications, and adopt manual, high-assurance verification protocols for account-related requests. “When appropriate, organizations should also communicate with end-users, HR partners, and other business units to stay on high-alert during the initial containment phase. Always report suspicious activity to internal IT and Security for further investigation,” Mandiant notes. A hardened verification process should include high-assurance paths such as live video calls, out-of-band approvals from users’ managers, and calls to users’ known good numbers. Helpdesk employees should not provide access or information during inbound calls and should independently contact the company’s designated account manager for explicit verification of access requests. Organizations should also educate their users on identifying vishing and phishing attempts, on being cautious of requests to change their passwords, especially during off-business hours, and on not sharing passwords. “Organizations should implement a layered series of controls to protect all types of identities. Access to cloud identity providers (IdPs), cloud consoles, SaaS applications, document and code repositories should be restricted since these platforms often become the control plane for privilege escalation, data access, and long-term persistence,” Mandiant notes. Related: Researchers Trap Scattered Lapsus$ Hunters in Honeypot Related: Security Industry Skeptical of Scattered Spider-ShinyHunters Retirement Claims

securityweek.comFeb 2, 2026extracted

Over 100 Organizations Targeted in ShinyHunters Phishing Campaign

Many major organizations appear to have been targeted in a recent cybercrime campaign linked to the ShinyHunters group, according to security firm Silent Push. Over the past 30 days, Silent Push has identified domains suggesting that the threat actors have been preparing or conducting attacks against at least 100 organizations in sectors such as software and technology, financial, biotech and pharma, financial services, real estate, energy and utilities, healthcare, logistics and transportation, manufacturing, retail, and insurance. Silent Push has named major companies such as Atlassian, Adyen, Canva, Epic Games, HubSpot, Moderna, ZoomInfo, GameStop, WeWork, Halliburton, Sonos, and Telstra. The hackers have set up fake domains targeting these companies, but it’s unclear whether any attacks were conducted or whether their attempts to gain access to systems were successful. In the campaign, the cybercriminals used voice phishing (vishing) to target single sign-on (SSO) accounts associated with Okta and other identity platforms. In attacks observed by Okta and others, threat actors used specialized phishing kits that enable them to intercept credentials and trick victims into helping them bypass multi-factor authentication. “The most critical of these features are client-side scripts that allow threat actors to control the authentication flow in the browser of a targeted user in real-time while they deliver verbal instructions or respond to verbal feedback from the targeted user,” Okta explained. It added, “It’s this real-time session orchestration that delivers the plausibility required to convince the threat actor’s target to approve push notifications, submit one time passcodes (OTP) or take other actions the threat actor needs to bypass MFA controls.” ShinyHunters is the public-facing entity that has taken credit for the attacks, but Silent Push has attributed the campaign — based on TTPs — to Scattered LAPSUS$ Hunters, the group formed last year by Lapsus$, Scattered Spider, and ShinyHunters members. On the ShinyHunters leak website, the cybercriminals recently listed companies such as Betterment, Crunchbase, and SoundCloud, all of which have confirmed suffering a data breach. Alon Gal, CTO of threat intelligence firm Hudson Rock, learned from ShinyHunters that these are victims of the Okta SSO vishing campaign. The hackers have released millions of records allegedly stolen from these companies. Google’s Mandiant has also been tracking this campaign, which it has described as active and ongoing. “After gaining initial access, these actors pivot into SaaS environments to exfiltrate sensitive data. An actor that identifies as ShinyHunters has approached some of the victim organizations with an extortion demand,” said Charles Carmakal, CTO of Mandiant Consulting. “While this is not the result of a security vulnerability in vendors’ products or infrastructure, we strongly recommend moving toward phishing-resistant MFA, such as FIDO2 security keys or passkeys where possible, as these protections are resistant to social engineering attacks in ways that push-based or SMS authentication are not. Administrators should also implement strict app authorization policies and monitor logs for anomalous API activity or unauthorized device enrollments,” Carmakal added. *updated with statement from Charles Carmakal Related: Google Warns of Vishing, Extortion Campaign Targeting Salesforce Customers Related: Organizations Warned of Rise in Okta Support Phishing Attacks Related: Security Industry Skeptical of Scattered Spider-ShinyHunters Retirement Claims

securityweek.comJan 27, 2026extracted

Vulnerabilità scoperte in Foxit PDF Editor, Epic Games Store e MedDream PACS

Betti RHC, la prima graphic novel al mondo dedicata alla cybersecurity awareness, ha finalmente il suo sito ufficiale. Uno spazio tutto suo dove scoprire il progetto, sfogliare le copertine degli episodi e immergersi nel mondo di Betti: la giovane laureanda in informatica che, dopo la morte misteriosa del padre, si trasforma nell'hacker più potente del mondo. Una storia avvincente che, episodio dopo episodio, affronta una minaccia digitale diversa — dal phishing al ransomware, fino al cyberbullismo — e insegna a riconoscerla e a difendersi, senza che sembri mai una lezione. Sul sito trovate tutto ciò che rende Betti un progetto diverso dal solito: la sua filosofia, le anteprime delle tavole e il racconto di come nasce ogni volume. Perché dietro Betti RHC c'è solo lavoro umano: ogni tavola è disegnata interamente a mano dagli artisti del Gruppo Arte di Red Hot Cyber, senza alcun uso di intelligenza artificiale. E a garantire che ogni storia sia realistica e tecnicamente corretta c'è la supervisione degli hacker etici del gruppo HackerHood, che mantengono il racconto fedele al mondo reale della sicurezza informatica. C'è spazio anche per le aziende, che possono usare Betti come strumento di awareness diverso dai soliti corsi: acquistare i volumi, personalizzarli con il proprio brand o sponsorizzare nuovi episodi. E come primo regalo, l'episodio "Byte the Silence", dedicato al cyberbullismo, è scaricabile gratuitamente per uso personale. Perché la miglior difesa, in fondo, è una bella storia. 👉 Scopri tutto su https://betti.redhotcyber.com/

redhotcyber.comJan 22, 2026extracted

New Stealit Malware Campaign Spreads via VPN and Game Installer Apps

Threat actors are conducting a new malicious campaign deploying the Stealit malware via disguised applications, according to Fortinet. The cybersecurity provider’s threat research lab, FortiGuard Labs, uncovered this new information stealer (infostealer) campaign following a spike in detections of a particular Visual Basic script, a new report explained. The campaign’s initial access is gained via fake game and VPN installers bundled in PyInstaller and common compressed archives and uploaded to file-sharing sites such as Mediafire and Discord. The threat actor then employs heavy obfuscation and numerous anti-analysis techniques to evade detection and complicate analysis. Once installed, the Stealit infostealer allows the threat actor to extract information from various browsers, including Google Chrome and Microsoft Edge. I can also steal data from a variety of applications, including game-related software and marketplaces (Steam, Minecraft, GrowTopic and Epic Games Launcher), instant messaging apps (WhatsApp and Telegram) and cryptocurrency wallets (Atomic, Exodus and wallets installed as browser extensions). Novel Stealit Delivery Techniques Leveraging Node.js Single Executable Apps While earlier Stealit malware used Electron to package scripts into installers, the new campaign initially leveraged Node.js Single Executable Apps (SEA) feature to distribute malicious scripts to systems without Node.js installed. Node.js SEA is an experimental feature designed to package Node.js applications, their dependencies and assets into a standalone executable, allowing them to run on systems without Node.js installed. This approach results in significantly larger file sizes. The threat actor behind this campaign has exploited this capability by embedding harmful scripts within the executable’s NODE_SEA_BLOB resource, stored as RCDATA. This resource contains not only the script but also its original file path, which often reveals telling details. In the observed samples, the path includes references to ‘StealIt’ and ‘angablue,’ indicating the use of AngaBlue, an open-source tool that automates the creation of Node.js SEA executables, alongside the Stealit infostealer. “Threat actors behind this may be exploiting the feature’s novelty, relying on the element of surprise, and hoping to catch security applications and malware analysts off guard,” the FortiGuard Labs researchers suggested. However, the researchers observed that, weeks into the new campaign, the threat actor reverted to the Electron framework, this time encrypting bundled Node.js scripts with AES-256-GCM. Stealit C2 Panel Relocation Alongside the shift in malware delivery technique, the threat actor behind this new Stealit campaign has also moved its command-and-control (C2) panel to new domains. Initially hosted at stealituptaded[.]lol, the panel was quickly moved to iloveanimals[.]shop after the original domain became inaccessible. The site operates as a commercial platform, marketing Stealit as a "professional data extraction solution" with subscription-based access, the FortiGuard Labs researchers observed. The panel advertises remote access Trojan- (RAT) like capabilities, including file theft, webcam control, live screen monitoring and ransomware deployment, targeting both Windows and Android systems. Instructional videos demonstrate its functionality, while pricing plans offer lifetime subscriptions at around $500 for Windows and $2000 for Android. The threat actor also maintains a Telegram channel (StealitPublic) for updates and promotions, with @deceptacle serving as the primary point of contact for potential clients.

infosecurity-magazine.comOct 13, 2025extracted

Stealit Malware Abuses Node.js Single Executable Feature via Game and VPN Installers

Cybersecurity researchers have disclosed details of an active malware campaign called Stealit that has leveraged Node.js' Single Executable Application (SEA) feature as a way to distribute its payloads. According to Fortinet FortiGuard Labs, select iterations have also employed the open-source Electron framework to deliver the malware. It's assessed that the malware is being propagated through counterfeit installers for games and VPN applications that are uploaded to file-sharing sites such as Mediafire and Discord. SEA is a feature that allows Node.js applications to be packaged and distributed as a standalone executable, even on systems without Node.js installed. "Both approaches are effective for distributing Node.js-based malware, as they allow execution without requiring a pre-installed Node.js runtime or additional dependencies," security researchers Eduardo Altares and Joie Salvio said in a report shared with The Hacker News. On a dedicated website, the threat actors behind Stealit claim to offer "professional data extraction solutions" via several subscription plans. This includes a remote access trojan (RAT) that supports file extraction, webcam control, live screen monitoring, and ransomware deployment targeting both Android and Windows operating systems. Prices for the Windows Stealer range from $29.99 for a weekly subscription to $499.99 for a lifetime license. The Android RAT pricing, on the other hand, goes from $99.99 all the way to $1,999.99. The fake executables contain an installer that's designed to retrieve the main components of the malware retrieved from a command-and-control (C2) and install them, but note that before performing a number of anti-analysis checks to ensure it's running inside a virtual or sandboxed environment. A crucial aspect of this step involves writing a Base64-encoded authentication key, a 12-character alphanumeric key, to the %temp%\cache.json file. This key is used to authenticate with the C2 server, as well as by subscribers to log in to the dashboard in order to likely monitor and control their victims. The malware is also engineered to configure Microsoft Defender Antivirus exclusions so that the folder that contains the downloaded components is not flagged. The functions of the three executables are as follows - save_data.exe, which is only downloaded and executed if the malware is running with elevated privileges. It's designed to drop a tool named "cache.exe" – which is part of open-source project ChromElevator – to extract information from Chromium-based browsers. stats_db.exe, which is designed to extract information from messengers (Telegram, WhatsApp), cryptocurrency wallets and wallet browser extensions (Atomic and Exodus), and game-related apps (Steam, Minecraft, GrowTopia, and Epic Games Launcher). game_cache.exe, which is designed to set up persistence on the host by launching its upon system reboot by creating a Visual Basic script and communicating with the C2 server to stream a victim's screen in real-time, execute arbitrary commands, download/upload files, and change desktop wallpaper. "This new Stealit campaign leverages the experimental Node.js Single Executable Application (SEA) feature, which is still under active development, to conveniently distribute malicious scripts to systems without Node.js installed," Fortinet said. "Threat actors behind this may be exploiting the feature's novelty, relying on the element of surprise, and hoping to catch security applications and malware analysts off guard."

thehackernews.comOct 10, 2025extracted

Sendit tricked kids, harvested their data, and faked messages, FTC claims

The Federal Trade Commission (FTC) has sued Sendit’s parent company, saying it signed up children under 13, collected their personal data, and misled them with fake messages and recurring bills. The lawsuit, filed against the app’s owner Iconic Hearts Holdings Inc and CEO Hunter Rice, alleges the company let users under the age of 13 sign up for Sendit and collected personal information about these users without parental consent—violating the Children’s Online Privacy Protection Rule (COPPA). Sendit is an add-on for Snapchat and Instagram, rather than a standalone app. Its primary feature is to allow users to post prompts or questions (called a Sendit) on their social media stories and receive anonymous replies from other users. In 2022, the app registered 116,000 people who self-declared that they were under 13 years old, according to the suit. Even after parents complained, the company continued to collect children’s phone numbers, birthdates, photos, and usernames for Snapchat, Instagram, TikTok and other accounts. The FTC also alleges that Sendit misled users about its paid “Diamond Membership.” The feature promised to allow users to see who had sent certain messages. In practice, it didn’t reveal the senders, according to the suit. Worse still, the company and its CEO faked some of these messages, the FTC alleges. According to the complaint: “Defendants trick users into believing that they have received provocative and sometimes sexual or romantic messages from their social media contacts, when in reality it is often Defendants themselves who have sent those messages.” Iconic Hearts also failed to disclose recurring charges clearly, according to the FTC—charging up to $9.99 every week after making it look like users were paying a single fee to disclose a user’s identity. Normally, cases like this end in a settlement. This time, the FTC referred the case to the Department of Justice (DoJ). It does this when it believes that the defendants are violating or about to violate the law, and that referring the case would be in the public interest. So now, the Central District of California will decide the case. Iconic Hearts also publishes the apps Noteit, Starmatch, and Locksmith. Launched in 2018, Sendit has been downloaded more than five million times on Google Play, and the company claims a total user base of around 25 million. The company has claimed Sendit is “the top Gen Alpha social networking app.” This isn’t the only case where anonymous messaging apps have run afoul of COPPA violations. In July 2024, the FTC settled with NGL Labs and its founders for $5 million. That app was accused of marketing to kids and teens, sending fake messages to drive up usage, tricking users into paid upgrades, and sneaking in recurring charges. “Company executives told employees to reach out to high school kids directly,” said the FTC at the time. NGL Labs also falsely claimed that AI content moderation filtered harmful messages like cyber bullying, the Commission added. The settlement banned NGL from marketing its app to anyone under 18. What could this mean for Iconic Hearts? The current maximum penalty enforceable by courts for failing to comply with COPPA is $53,088 per violation, according to the FTC. DoJ COPPA-related suits on the FTC’s behalf are not unheard of. Epic Games got a record $275 million penalty for COPPA violations in December 2022 after the DOJ sued it on behalf of the FTC (alongside another $245 million penalty for using ‘dark patterns’ to mislead users). Epic Games was aware that many children were playing its Fortnite game, yet it collected personal data from children without first obtaining parents’ verifiable consent, the suit said. The company also made it difficult for parents to delete their children’s personal information, and sometimes didn’t do as asked. The takeaway from this story? Try to keep kids under 13 off social media apps as long as possible, and when the time does come, stay involved. Talk to them about online safety, monitor their usage, and keep the conversation open. Scammers don’t need to hack you. They just need you to click once. Malwarebytes Identity Theft Protection catches suspicious activity before it becomes a problem.

malwarebytes.comOct 2, 2025extracted

Google to Verify All Android Developers in 4 Countries to Block Malicious Apps

Google has announced plans to begin verifying the identity of all developers who distribute apps on Android, even for those who distribute their software outside the Play Store. "Android will require all apps to be registered by verified developers in order to be installed by users on certified Android devices," the company said. "This creates crucial accountability, making it much harder for malicious actors to quickly distribute another harmful app after we take the first one down." To that end, the tech giant said it intends to start sending out invitations gradually starting October 2025, before opening it up to all developers in March 2026. The new requirements are expected to go into effect starting a year from now, in September 2026, in Brazil, Indonesia, Singapore, and Thailand. "At this point, any app installed on a certified Android device in these regions must be registered by a verified developer," Suzanne Frey, vice president of Product, Trust and Growth for Android, added. It's worth noting that nothing much will change for developers who distribute apps through the Google Play Store, as they are likely to have already met these verification requirements through the existing Play Console process. A separate type of Android Developer Console account is in the works for student and hobbyist developers. Google said the changes are designed to prevent malicious actors from impersonating developers and using their branding and reputation to create convincing fake apps. Compounding the problem is the presence of such malicious apps on third-party app marketplaces from where users can sideload them. The developer verification mandate adds to already existing security measures that block the sideloading of potentially dangerous apps in markets like Singapore, Thailand, Brazil, and India. In July 2023, the company also began requiring all new developer accounts registering as an organization to provide a valid D-U-N-S number assigned by Dun & Bradstreet before submitting apps in an effort to build user trust. The "new layer of security," Google pointed out, aims to protect users from repeat bad actors spreading malware and scams, as well as provide a "consistent, common sense baseline of developer accountability" across Android. It also said the system preserves user choice while enhancing security for everyone. While the Android app distribution rules are aimed at tightening the security of the ecosystem, they also come at a time when Google is potentially staring at major reforms to the Play Store, including distributing competing app stores through Google Play and providing rivals with access to its full app catalog, after having a lost an antitrust lawsuit brought by Epic Games in 2020.

thehackernews.comAug 26, 2025extracted