protonvpn

Il piano ProtonVPN Plus è proposto in offerta a 2,99 euro al mese per due anni e punta sulla sicurezza VPN attraverso la cifratura del traffico. ProtonVPN consente di instradare la connessione verso server in oltre 140 Paesi. garantendo la massima sicurezza per la rete virtuale privata. Inoltre, ProtonVPN è in grado di proteggere fino a 10 dispositivi contemporaneamente. La tecnologia di cifratura utilizza AES-256 o ChaCha20 e crea un tunnel sicuro tra il dispositivo e il server VPN. Questo meccanismo mette al sicuro i dati anche quando l’accesso avviene attraverso reti Wi-Fi pubbliche. Indice degli argomenti La rete offerta da ProtonVPN comprende più di 20.000 server distribuiti in oltre 140 Paesi. L’utente può scegliere la posizione della connessione oppure utilizzare la funzione di connessione rapida. La piattaforma offre inoltre larghezza di banda illimitata e supporta lo streaming ad alta velocità. Sono disponibili anche download P2P e BitTorrent. La sicurezza VPN offerta da ProtonVPN comprende una politica di non conservazione dei log. Il servizio dichiara di non raccogliere registri del traffico, indirizzi IP, dati sulla larghezza di banda o informazioni sulla navigazione. Tra le funzionalità incluse figurano anche split tunneling, DNS personalizzato, ad-blocker e anti-malware, VPN Accelerator e Double Hop. Quest’ultima architettura instrada la connessione attraverso due server VPN. La protezione può essere estesa a dieci dispositivi con un unico abbonamento. Il servizio è disponibile su Windows, iOS, Android, Fire TV, Apple TV, Android TV e browser. Il piano biennale di ProtonVPN applica uno sconto del 70% e richiede un esborso complessivo di 71,76 euro per i primi 24 mesi. Il prezzo equivale a 2,99 euro mensili. Il confronto con il piano mensile evidenzia il vantaggio economico più elevato. Due anni al prezzo mensile di 9,99 euro costerebbero 239,76 euro. Con l’offerta biennale il costo scende a 71,76 euro, con un risparmio di 168 euro. Dopo i primi 24 mesi, il piano biennale si rinnova a 83,88 euro ogni 12 mesi. L’abbonamento annuale prevede invece 47,88 euro per i primi 12 mesi e successivamente 83,88 euro annui. L’offerta comprende una garanzia soddisfatti o rimborsati di 30 giorni. Il rimborso integrale è previsto annullando l’abbonamento e richiedendolo entro questo periodo.

La diversificazione dei modelli di ricavo per le fondazioni tecnologiche no-profit rappresenta uno dei trend più interessanti dell’economia digitale recente. Per mantenere l’indipendenza finanziaria senza cedere alle logiche della monetizzazione dei dati utente, Mozilla ha progressivamente integrato nella propria offerta servizi premium a valore aggiunto, tra cui spicca Firefox VPN. Indice degli argomenti Sotto il profilo strettamente ingegneristico, è fondamentale non confondere le due soluzioni di protezione dei dati offerte dall’ecosistema Mozilla, poiché presentano architetture di rete e perimetri di sicurezza radicalmente differenti: la soluzione integrata Mozilla VPN Premium: è una Virtual Private Network che agisce a livello di rete (Layer 3 del modello OSI). Il software stabilisce un tunnel cifrato che intercetta e protegge l’intero stack di rete del sistema operativo. Ogni singolo pacchetto dati in uscita dal dispositivo viene instradato attraverso il tunnel sicuro, azzerando i rischi di data leakage. Il servizio garantisce la protezione dell’intero dispositivo su reti Wi-Fi pubbliche non fiduciarie, blocco di elementi traccianti/malware e funzionalità avanzate come l’indirizzamento multi-hop (double VPN). l’estensione per browser Firefox IP Protection / Multi-Account Containers: è un proxy crittografato che opera esclusivamente a livello applicativo (Layer 7 del modello OSI). La protezione è limitata al solo traffico dati generato all’interno del browser Firefox, lasciando esposti i flussi generati da altre applicazioni (client mail, SSH, applicativi aziendali). A differenza della VPN di sistema, agisce come un perimetro isolato che protegge la navigazione web senza alterare l’instradamento dei pacchetti dati dell’intero host. Mozilla non gestisce una rete di server proprietaria, ma si appoggia all’infrastruttura di Mullvad VPN, player svedese noto per i rigorosi standard di anonimato. La rete offre l’accesso a oltre 500 server dislocati in più di 30 Paesi, garantendo larghezza di banda illimitata e performance idonee per attività ad alto traffico, inclusi i giochi online. Il punto di forza risiede nella conformità alle normative europee (GDPR) e nella rigorosa politica di non-registrazione dei dati (No-Log Policy): Assenza di tracciamento: Non viene effettuata alcuna registrazione, tracciamento o condivisione dei dati di rete dell’utente. Separazione delle identità: La cooperazione tecnica prevede che Mullvad non conosca l’identità reale dell’utente (gestita tramite l’Account Mozilla), mentre Mozilla non ha visibilità sull’attività di rete. Infrastruttura RAM-only: I server operano su memoria volatile, azzerando la persistenza dei dati in caso di violazione hardware o sequestro fisico. Mozilla VPN implementa in via esclusiva WireGuard® (marchio registrato da Jason A. Donenfeld), un protocollo di nuova generazione che ridefinisce gli standard di efficienza rispetto ai competitor commerciali e corporate basati sui tradizionali OpenVPN o IPsec. L’algoritmo di cifratura simmetrica ChaCha20, combinato con l’autenticazione dei messaggi Poly1305, garantisce elevate velocità di trasmissione e una latenza minima, riducendo drasticamente il consumo energetico della batteria sui dispositivi mobili rispetto alle architetture legacy. L’essenzialità verticale (Mozilla/Mullvad): il modello Pure-Play In netta controtendenza, la partnership tra Mozilla e Mullvad adotta una filosofia incentrata sulla specializzazione verticale e sul principio del minimalismo del software. Questa strategia esclude deliberatamente i servizi aggiuntivi per concentrare il 100% delle risorse hardware e di sviluppo sulla sola ottimizzazione del tunnel di rete e sulla stabilità del protocollo WireGuard. Non vengono offerti antivirus, password manager o cloud storage, delegando la gestione di queste necessità ad altri strumenti scelti liberamente dall’utente. Questo modello si rivolge a un target che ricerca una configurazione lineare e priva di sovrastrutture, dove i ricavi generati (nel caso di Mozilla) contribuiscono direttamente al finanziamento della fondazione no-profit e al sostegno di un ecosistema web aperto. Le suite di sicurezza integrate: il modello All-in-One L’ecosistema integrato mette a disposizione, all’interno dello stesso canone e di un’unica interfaccia di controllo, strumenti essenziali per la produttività e la tutela dell’identità: password manager dedicati (NordPass, ExpressKeys), archiviazione cloud cifrata (NordLocker), sistemi per la rimozione dei dati personali dai database commerciali (Incogni), servizi di mascheramento email (ExpressMailGuard) e moduli assistiti da intelligenza artificiale (ExpressAI). Sotto il profilo economico, questo approccio si traduce in un’ottimizzazione della spesa per l’utente, che beneficia di un pacchetto completo ad alto valore d’uso rispetto all’acquisto dei singoli applicativi sul mercato. 🌍 Server: 8.000+ server in 129 paesi 📱 Massimo dispositivi: 10 📍 IP dedicato: ✔ 🆓 Versione Free: Garanzia rimborso di 30 giorni 💻 Compatibilità: Windows, macOS, Android, iOS 🔐 Sicurezza: IKEv2/IPsec, OpenVPN, NordLynx 👨💻 Assistenza 24/7: ✔ 🏢 Sede legale: Panama 🔥 Offerte attive: SCONTO fino al 74% NordVPN si posiziona come il punto di riferimento prestazionale nel mercato della cybersecurity consumer e professional. Grazie al protocollo proprietario NordLynx, il servizio garantisce la massima efficienza nella gestione dei flussi dati, riducendo al minimo la perdita di banda passante e assicurando velocità di picco stabili anche su tratte internazionali. L’infrastruttura poggia su una rete globale da 10 Gbps dotata di oltre 9.300 server dislocati in 211 località all’interno di oltre 130 Paesi. Sotto il profilo operativo, la proposta di valore del provider si articola su tre pilastri fondamentali: Flessibilità commerciale e assicurativa: con un unico abbonamento è possibile proteggere fino a 10 dispositivi simultaneamente. La gamma di servizi è modulare: i piani base si concentrano sul networking sicuro (completo di Kill Switch e IP dedicato opzionale), mentre i profili top di gamma (Ultimate) integrano il sistema di rimozione dati Incogni e una copertura assicurativa cyber fino a 5.000 € per il recupero delle perdite derivanti da truffe informatiche. Protezione endpoint continua: accanto alla crittografia standard dei pacchetti di rete (AES-256), il software integra il modulo Threat Protection Pro. Questo sistema di sicurezza opera a livello locale anche a VPN disattivata, bloccando malware, tracker e inserzioni pubblicitarie attraverso filtri URL assistiti da intelligenza artificiale. Monitoraggio dell’Identità: il piano include strumenti per il controllo dei dati sensibili, come il Dark Web Monitor, che traccia in tempo reale l’eventuale esposizione online di email, numeri di telefono e carte di credito, mitigando il rischio di furti d’identità. La proposta di NordVPN si articola su tre diversi livelli di protezione distribuiti su piani biennali, annuali o mensili, tutti coperti da una garanzia di rimborso a 30 giorni. Il piano NordVPN Base, incentrato sulla sola VPN ultra-veloce e sul protocollo NordLynx, parte da una tariffa promozionale di 2,99 € al mese per i primi 24 mesi (71,76 € totali, con rinnovo successivo a 139,08 €/anno), mentre la tariffa mensile senza vincoli si attesta a 11,59 €. Il piano intermedio NordVPN Plus, proposto a 3,49 € al mese sul biennio (83,76 € totali, con rinnovo a 179,88 €/anno o 13,69 € per il singolo mese), integra il modulo Threat Protection Pro™ contro malware e tracker, un password manager multipiattaforma (NordPass) e il Data Breach Scanner. Al vertice dell’offerta si colloca il piano NordVPN Ultimate, ottimizzato per la protezione dell’identità aziendale e personale al costo promozionale di 6,19 € al mese per 24 mesi (148,56 € totali, con rinnovo a 256,68 €/anno o 19,39 € mensili): questo pacchetto estende i servizi includendo 1 TB di spazio cloud crittografato (NordLocker), il sistema Dark Web Monitor Pro™ per il tracciamento di leak su dati sensibili e carte di credito, e una vera e propria Assicurazione Cyber che offre una copertura fino a 5.000 € per il recupero delle perdite derivanti da truffe informatiche o furto d’identità. Ecco la tabella comparativa dettagliata che analizza la struttura dei prezzi e i tre livelli di protezione della suite di cybersecurity di NordVPN, basata sui piani biennali, annuali e mensili. Ciascun account, indipendentemente dal livello scelto, garantisce la protezione simultanea di un massimo di 10 dispositivi e l’assistenza clienti attiva 24 ore su 24, 7 giorni su 7. 🇮🇹 Posizioni server in Italia: Roma e Milano 🌍 Server: 3200+ in 100 paesi 📱 Massimo dispositivi: illimitati 🆓 Versione Free: Garanzia rimborso di 30 giorni 💻 Compatibilità: Windows, macOS, Android, iOS 🔐 Sicurezza: OpenVPN, IKEv2, Shadowsocks, Wireguard e L2TP 👨💻 Assistenza 24/7: ✔ 🏢 Sede legale: Paesi Bassi 🔥 Offerte attive: SCONTO fino all’86% + 3 mesi gratis 🔥 La proposta di Surfshark (con sede legale nei Paesi Bassi) si posiziona sul mercato attraverso una strategia basata su piani illimitati e sulla progressiva integrazione di moduli per la tutela dell’identità digitale. Il principale driver competitivo di Surfshark risiede nella politica dei flussi di rete: a differenza della concorrenza, il servizio consente la protezione di un numero illimitato di dispositivi simultanei con un unico abbonamento. L’infrastruttura tecnica poggia su una rete globale di oltre 4.500 server operanti esclusivamente su memoria volatile (RAM-only) distribuiti in 100 Paesi, registrando velocità di connessione complessive pari a 1615 Mbps (secondo i benchmark Techradar). La struttura commerciale è suddivisa in tre pacchetti modulari: Starter, One e One+, configurati su scale temporali da 24 mesi, 12 mesi o singola mensilità flessibile, tutti garantiti da una clausola di rimborso a 30 giorni: Surfshark One+: collocato al vertice dell’offerta per la gestione avanzata dei dati sensibili, è distribuito al prezzo promozionale di 4,19 € al mese sul contratto biennale (113,13 € totali per 27 mesi, con opzione a 12 mesi a 6,99 €/mese e mensile flat a 20,85 €). Il valore aggiunto di questo pacchetto è l’integrazione nativa del servizio Incogni, uno strumento automatizzato deputato alla richiesta di rimozione sistematica dei dati personali dell’utente dai database dei broker commerciali e dalle piattaforme di ricerca di persone, attivo per i residenti in Unione Europea, Stati Uniti, Regno Unito, Svizzera e Canada. Surfshark Starter: costituisce l’offerta d’ingresso orientata alla crittografia pura e al mascheramento dell’identità. Il piano biennale prevede una tariffa promozionale di 1,99 € al mese con 3 mesi extra inclusi (pari a 53,73 € per i primi 27 mesi, con una versione annuale a 3,19 €/mese e una mensile senza vincoli a 15,45 €). Include le funzioni di core networking (VPN, ad blocker CleanWeb, offuscamento tramite Bypasser e Rotazione dell’IP) e il sistema Alternative ID per la generazione di email e dettagli personali proxy utili a mitigare i flussi di spam. Surfshark One: rappresenta la soluzione integrata di cybersecurity endpoint, proposta alla tariffa promozionale biennale di 2,29 € al mese (61,83 € complessivi per i primi 27 mesi, mentre la quota annuale si attesta a 3,39 €/mese e la mensile a 17,95 €). Questo livello estende il perimetro di protezione introducendo il modulo Surfshark Antivirus (con scansioni pianificate, rilevamento malware basato su intelligenza artificiale e protezione attiva della webcam), il motore di ricerca privato e privo di annunci Surfshark Search, e il sistema Alert per il monitoraggio h24 dei data leak relativi a documenti d’identità, carte di credito e account email. 🇮🇹 Posizioni server in Italia: Milano e Palermo 🌍 Server: 20.017 in 145 Paesi 📱 Massimo dispositivi: 10 🆓 Versione Free: ✔ 💻 Compatibilità: Phone, Android, Mac, Windows, Linux, Fire TV Stick, Chromebook, Android TV, Apple TV 🔐 Sicurezza: Crittografia AES-256 con supporto a WireGuard e OpenVPN 👨💻 Assistenza 24/7: e-mail e ticket (risposta entro 24 ore) 🏢 Sede legale: Svizzera 🔥 Offerte attive: SCONTO fino al 70% Sotto il profilo della compliance normativa e dell’architettura societaria, la proposta di Proton VPN (sviluppata da Proton AG, con sede a Ginevra) si posiziona come il punto di riferimento prosumer per la tutela dei diritti digitali, sfruttando la giurisdizione della Svizzera extra-UE/USA e le sue rigide leggi sulla privacy. A differenza dei principali competitor commerciali controllati da grandi conglomerati della cybersecurity, l’infrastruttura di Proton si distingue per una trasparenza radicale: il codice delle applicazioni è 100% open source e costantemente sottoposto ad audit indipendenti di terze parti, associato a una politica No-Log pubblicata apertamente. La rete si estende su oltre 20.000 server dislocati in più di 140 Paesi, supportando una larghezza di banda illimitata e algoritmi di cifratura avanzati (AES-256 e ChaCha20). L’offerta si focalizza sul piano premium Proton VPN Plus, che integra l’esclusiva tecnologia VPN Accelerator, capace di incrementare la velocità di connessione fino al 400%, e moduli avanzati di sicurezza come il sistema Double Hop (per l’instradamento accoppiato del traffico), lo Split Tunneling, un ad-blocker con protezione anti-malware integrata e il supporto al traffico P2P/BitTorrent veloce su un massimo di 10 dispositivi simultanei. Accanto al comparto a pagamento, l’azienda mantiene attivo il piano Proton VPN Free: l’unica soluzione gratuita sul mercato che non impone limiti di banda, non memorizza i log delle sessioni e non monetizza i dati degli utenti tramite advertising. La struttura dei prezzi del piano Proton VPN Plus si articola su tre opzioni di fatturazione, assistite da una garanzia di rimborso proporzionale a 30 giorni: Piano biennale: prevede un abbattimento del costo di listino pari al 70%, posizionandosi a 2,99 € al mese. Il modello economico richiede un addebito anticipato unico di 71,76 € per i primi 24 mesi; al termine del periodo promozionale, il contratto si rinnova automaticamente su base annuale alla tariffa standard di 83,88 € ogni 12 mesi. Piano annuale: configurato con uno sconto del 60%, si attesta a un costo di 3,99 € al mese, con una transazione iniziale di 47,88 € per i primi 12 mesi e successivi rinnovi automatici alla quota standard di 83,88 € all’anno. Piano mensile: risponde alle esigenze di flessibilità a breve termine senza vincoli di lock-in. Presenta una tariffa flat di 9,99 € al mese, fatturata su base ricorrente ogni 30 giorni. 🌍 Server: 5900 server in 105 paesi 📱 Massimo dispositivi: 8 🆓 Versione Free: Garanzia rimborso di 30 giorni 💻 Compatibilità: Windows, macOS, Android, iOS, Linux 🔐 Sicurezza: IKEv2, OpenVPN 👨💻 Assistenza 24/7: ✔ 🏢 Sede legale: Isole Vergini Britanniche 🔥 Offerte attive: SCONTO fino al 67% + 4 mesi GRATIS La proposta di ExpressVPN si posiziona nella fascia premium del mercato della cybersecurity, estendendo il concetto di cifratura di rete verso i nuovi standard di protezione dei dati. Il provider opera su una rete globale interamente offuscata distribuita in 105 Paesi, basata sulla tecnologia proprietaria TrustedServer: server blindati che eseguono il posizionamento dei dati esclusivamente su memoria volatile (RAM) azzerando i log a ogni riavvio del sistema hardware. Sotto il profilo computazionale, oltre a implementare la crittografia AES a 256 bit e il protocollo ultra-veloce Lightway scritto in codice Rust, ExpressVPN si distingue per l’integrazione nativa della protezione post-quantistica, progettata per neutralizzare le minacce di decifrazione asincrona derivanti dal futuro sviluppo dei computer quantistici. La suite espande il proprio perimetro operativo integrando il modulo Threat Manager (per il blocco preventivo di inserzioni, domini sospetti, tracker e siti per adulti) e tre verticali software inclusi nell’abbonamento: ExpressKeys (password manager illimitato con crittografia end-to-end) ExpressMailGuard (servizio di inoltro e mascheramento email tramite alias privati per il controllo dello spam) e, nei piani di fascia alta ExpressAI (un assistente chatbot privato focalizzato sull’elaborazione riservata dei file su cinque modelli distinti) L’ecosistema, compatibile con tutti i principali browser e sistemi operativi, supporta la configurazione di router dedicati (Aircove) e include la distribuzione di pacchetti di connettività internazionale in roaming grazie alle eSIM fornite dal partner Holiday. La strategia di pricing di ExpressVPN abbandona i tradizionali schemi della singola licenza di rete per adottare un modello di bundling strutturato su tre livelli: Base, Avanzato e Pro, distribuiti su contratti biennali, annuali o a rinnovo mensile flessibile. Tutti i piani erogano assistenza h24/7 in live chat e la garanzia di rimborso a 30 giorni per i nuovi utenti: Piani Biennali: configurati con una formula promozionale che aggiunge 4 mesi extra gratuiti (28 mesi di copertura totale). Il livello ExpressVPN Base si attesta a 2,39 € al mese (66,98 € iniziali, con rinnovo successivo a 79,95 €/anno) e include 10 connessioni simultanee; il livello ExpressVPN Avanzato sale a 3,19 € al mese (89,38 € iniziali, con rinnovo a 109,95 €/anno), estendendo gli endpoint a 12 dispositivi e sbloccando ExpressKeys, alias email avanzati e 3 giorni di eSIM gratis; il top di gamma ExpressVPN Pro si posiziona a 5,19 € al mese (145,38 € iniziali, con rinnovo a 179,95 €/anno), offrendo 14 dispositivi, IP dedicato incluso, alias illimitati, ExpressAI e 5 giorni di eSIM. Piani annuali: strutturati con l’inclusione di 3 mesi extra gratuiti (15 mesi di copertura totale). Presentano tariffe promozionali equivalenti a 4,49 € al mese per il piano Base (67,35 € totali), 5,49 € al mese per il piano Avanzato (82,35 € totali) e 7,99 € al mese per il piano Pro (119,85 € totali), allineandosi ai medesimi costi di rinnovo automatico annuale previsti per i contratti biennali. Piani mensili: ideati per eliminare i vincoli di permanenza sul lungo periodo, prevedono un addebito ricorrente ogni 30 giorni pari a 11,49 € per la configurazione Base, 12,49 € per la linea Avanzata e 17,49 € per la licenza Pro. Le estensioni VPN per Firefox sviluppate dai principali provider (NordVPN, Surfshark, Proton VPN ed ExpressVPN) non devono essere confuse con i client software installati a livello di sistema operativo. Sebbene vengano commercializzate sotto il nome di “VPN”, dal punto di vista ingegneristico si tratta di proxy crittografati HTTP/HTTPS che operano esclusivamente all’interno del browser. Di seguito viene analizzato in modo dettagliato il loro funzionamento tecnico, i vantaggi operativi e le differenze strutturali rispetto alle applicazioni desktop native. Le estensioni agiscono a un livello applicativo differente rispetto alle VPN tradizionali, modificando solo una porzione specifica dei flussi dati del dispositivo: Isolamento del Traffico (Layer 7 del modello OSI): l’estensione intercetta e crittografa esclusivamente i pacchetti dati generati all’interno del browser Firefox. Tutto il traffico esterno al browser — come client di posta elettronica (Thunderbird, Outlook), applicazioni di messaggistica, aggiornamenti di sistema o client di condivisione file P2P — continua a transitare sulla rete locale senza alcuna protezione, esponendo l’indirizzo IP reale del dispositivo. Protocollo di cifratura dedicato: mentre l’applicazione desktop utilizza protocolli di rete complessi (come WireGuard, OpenVPN, Lightway o NordLynx), l’estensione per Firefox stabilisce un tunnel proxy sicuro utilizzando la crittografia TLS (Transport Layer Security), lo stesso protocollo che protegge i siti web HTTPS. Questo garantisce che i dati scambiati tra Firefox e il server del provider non possano essere intercettati o letti da soggetti terzi (inclusi gli amministratori di reti Wi-Fi pubbliche o l’Internet Service Provider). Per compensare i limiti strutturali del modello proxy, i diversi provider hanno integrato all’interno delle loro estensioni per Firefox moduli specifici per l’ottimizzazione delle performance e della privacy: NordVPN: l’estensione integra una versione nativa del modulo Threat Protection (limitata al browser), che blocca l’esecuzione di script pubblicitari invasivi e tracciatori di terze parti, riducendo i tempi di caricamento delle pagine. Include inoltre un sistema di blocco automatico per i protocolli WebRTC, prevenendo potenziali leakage dell’IP reale causati dalle API del browser. Surfshark: include nell’estensione l’ad-blocker CleanWeb, deputato al blocco di annunci, pop-up per il consenso dei cookie e malware. Offre inoltre la funzione di bypass (Whitelisting) a livello applicativo per consentire a determinati siti web (es. portali bancari o aziendali) di ignorare il proxy senza dover disattivare l’estensione. Proton VPN: mantiene un approccio focalizzato sulla trasparenza, con un’estensione per Firefox completamente open-source. Consente un cambio rapido della geolocalizzazione tra i server della rete elvetica ed è ottimizzata per operare in sinergia con i sistemi anti-tracciamento nativi di Mozilla. ExpressVPN: l’estensione per Firefox di ExpressVPN funziona in modo radicalmente diverso rispetto ai concorrenti. Non agisce come un proxy isolato, ma come un telecomando/interfaccia di controllo per l’applicazione desktop. Quando si attiva l’estensione su Firefox, essa comanda direttamente il client principale, proteggendo l’intero sistema operativo (Layer 3) e garantendo al contempo funzioni integrate nel browser come la protezione dalle perdite WebRTC e il mascheramento della geolocalizzazione HTML5. Il posizionamento di Mozilla VPN si inserisce in un mercato altamente competitivo, dominato da player orientati a modelli di business differenti. Mozilla VPN è un prodotto che richiede un abbonamento a pagamento che offre una protezione illimitata e completa per un massimo di 5 dispositivi simultanei. La matrice di compatibilità ufficiale prevede i seguenti requisiti minimi: Windows: 10 (solo architetture a 64 bit) e 11. macOS: 13 (Ventura) e versioni superiori. Linux: Ubuntu 20.04 e versioni superiori. Android: Versione 9 e superiori. iOS: Versione 17 e superiori. 1.1. Registrazione del profilo e licenza: Sottoscrizione commerciale. Accedere al portale ufficiale Mozilla, selezionare il piano tariffario annuale a 4,99 €/mese con fatturazione unica di 59,88 €, o mensile a 9,99 €/mese. Entrambi i piani includono una garanzia di rimborso entro 30 giorni per i nuovi clienti. Completare la transazione tramite il proprio Account Mozilla. 2.2. Download e installazione del client: Verifica dei requisiti minimi. Scaricare il pacchetto software nativo per il sistema operativo in uso dal repository ufficiale o dagli store di riferimento (Google Play / App Store), verificando la conformità dell’architettura hardware (es. Windows 64-bit). 3.3. Autenticazione e generazione del token: scambio chiavi asincrono. Avviare l’applicazione e inserire le credenziali dell’Account Mozilla. Il client autentica la licenza d’uso e genera un token crittografato monouso verso i server partner di instradamento, mantenendo separata l’identità dell’utente dall’attività di rete. 4.4. Attivazione del tunnel WireGuard: routing totale (Layer 3). Azionare lo switch principale sull’interfaccia utente. Il sistema configura l’interfaccia di rete virtuale, applica la cifratura ai pacchetti in uscita e stabilisce la connessione sicura, confermata dal cambio di stato visivo dell’applicazione.

A surge in attempts to compromise internet-connected surveillance cameras across the Middle East has been identified during the ongoing regional conflict, with activity attributed to infrastructure linked to Iranian threat actors. The targeting, which began intensifying on February 28, has affected Israel, Qatar, Bahrain, Kuwait, the UAE and Cyprus, with additional focused activity observed in parts of Lebanon on March 1. The findings, released by Check Point Research (CPR), point to a coordinated campaign against devices manufactured by Hikvision and Dahua. The researchers said the pattern of activity aligns with Iran's established military doctrine of using compromised cameras to support operational planning and battle damage assessment following missile strikes. Activity Tied To Regional Escalation According to CPR, the spike in exploitation attempts coincided with key geopolitical developments. Earlier, more targeted scanning was recorded on January 14–15, around the time Iran temporarily closed its airspace amid expectations of a possible US strike. Subsequent waves of activity aligned with other high-profile events, including: January 24 – A visit to Israel by the US Central Command commander during heightened tensions Early February – Public warnings from Iranian leadership that a US strike could spark wider regional conflict The infrastructure used in the campaign combines commercial VPN exit nodes, including Mullvad, ProtonVPN, Surfshark and NordVPN, along with virtual private servers assessed to be operated by multiple Iran-linked threat actors. Specific Vulnerabilities Exploited The campaign observed by CPR focused exclusively on Hikvision and Dahua products. Researchers observed scanning for known vulnerabilities, including authentication bypass and remote code execution (RCE) flaws. Patches are available for all identified issues. Check Point examined exploitation attempts involving CVE-2021-33044 and CVE-2017-7921, traced to infrastructure attributed to Iran and active since the start of the year. The researchers noted similar tactics during the 12-day conflict between Israel and Iran in June 2025. In one widely reported incident, a street camera facing the Weizmann Institute of Science was allegedly compromised shortly before a ballistic missile struck the site. The report concluded that monitoring camera-targeting activity from known Iranian-linked infrastructure may offer early warning of potential follow-on kinetic operations. To help mitigate these risks, defenders should eliminate public exposure by removing WAN access and using a VPN, while enforcing strong credentials and keeping firmware up-to-date. Additionally, they should implement network segmentation for cameras on a dedicated VLAN and monitor for unusual login attempts and outbound connections.

Interplay between Iranian Targeting of IP Cameras and Physical Warfare in the Middle East March 4, 2026 Key Findings During the ongoing conflict, we identified intensified targeting of IP cameras from two manufacturers starting on February 28, originating from infrastructure we attribute to Iranian threat actors. The targeting extends across Israel, Qatar, Bahrain, Kuwait, the UAE, and Cyprus – countries that have also experienced significant missile activity linked to Iran. On March 1st, we additionally observed camera-targeting activity focused on specific areas in Lebanon. We also observed earlier, more targeted activity against cameras in Israel and Qatar on January 14–15. These dates surround with Iran’s temporary closure of its airspace, reportedly amid expectations of a potential U.S. strike. Taken together, these findings are consistent with the assessment that Iran, as part of its doctrine, leverages camera compromise for operational support and ongoing battle damage assessment (BDA) for missile operations, potentially in some cases prior to missile launches. As a result, tracking camera-targeting activity from specific, attributed infrastructures may serve as an early indicator of potential follow-on kinetic activity. Introduction As highlighted in the Cyber Security Report 2026, cyber operations have increasingly become an additional tool in interstate conflicts, used both to support military operations and to enable ongoing battle damage assessment (BDA). During the 12-day conflict between Israel and Iran in June 2025, the compromise of cameras was likely used to support BDA and/or target-correction efforts. In the current Middle East conflict, Check Point Research has observed intensified targeting of cameras beginning in the first hours of hostilities, including a sharp increase in exploitation attempts against IP cameras not only in Israel but also across Gulf countries: specifically the UAE, Qatar, Bahrain, and Kuwait, as well as similar activity in Lebanon and Cyprus. This activity originated from multiple attack infrastructures that we attribute to several Iran-nexus threat actors. Notably, we also identified earlier activity exhibiting similar patterns, dated January 14, coinciding with the peak of anti-regime protests in Iran, a period during which Iran anticipated potential action from the United States and Israel and temporarily closed its airspace. Findings Check Point Research (CPR) continuously tracks infrastructure used by Iran-nexus threat actors. Starting February 28, we observed a spike in targeting of IP cameras in several countries in the Middle East including Israel,UAE, Qatar, Bahrain, Kuwait and Lebanon, while also similar activity occurred against Cyprus. The attack infrastructure we track combines specific commercial VPN exit nodes (Mullvad, ProtonVPN, Surfshark, NordVPN) and virtual private servers (VPS), and is assessed to be employed by multiple Iran-nexus actors. Scanning activity we observed targets cameras such as Hikvision and Dahua and aligns with attempts to identify exposure to the vulnerabilities listed below. No attempts to interact with other camera vendors were observed from this infrastructure. The popular devices of Hikvision and Dahua are targeted with the following vulnerabilities: Patches are available for all of the vulnerabilities listed above. As a case study, we conducted a deep dive into two of the CVEs listed above – CVE-2021-33044 and CVE-2017-7921 – and examined exploitation attempts originating from operational infrastructure we attribute to Iran, observed since the beginning of the year. Waves of activity against Israel: The spikes in this activity are closely aligned with geopolitical events around the same time: January 14-15 – While internal anti-regime protests in Iran peaked, Iranian officials and state media portrayed the unrest as a foreign-backed plot by Iran’s adversaries, including the United States and Israel and also closed its airspace. At the same time we also observe a wave of scans of cameras in the Iraqi Kurdistan. January 24 – The U.S. Central Command (CENTCOM) commander visited Israel and met with the Israel Defense Forces’ chief of staff amid heightened tensions. Beginning of February – Iran’s leadership was increasingly worried about a possible U.S. strike; Iranian/IRGC-linked messaging warned a strike could trigger a wider regional war. Waves of activity against Qatar: Waves of activity against Bahrain: Waves of activity against Kuwait: Waves of activity against United Arab Emirates: Waves of activity against Cyprus: Waves of activity against Lebanon: We observed similar targeting patterns during the 12-day war between Israel and Iran in June 2025, likely to support battle damage assessment (BDA) and/or targeting correction. One of the best-known cases occurred when Iran struck Israel’s Weizmann Institute of Science with a ballistic missile and had reportedly taken control of a street camera facing the building just prior to the hit Recommendations for Defenders: Eliminate public exposure: remove direct WAN access to cameras/NVRs; place them behind VPN or a zero-trust access gateway; block inbound port-forwards. Patch management: keep cameras/NVR firmware and management software updated – updates from the manufacturers are available; remove/replace end-of-life devices that no longer get security fixes. Network segmentation: isolate cameras on a dedicated VLAN with no lateral access to corporate/OT networks; tightly control outbound traffic (only to required update/cloud endpoints). “The Turkish Rat” Evolved Adwind in a Massive Ongoing Phishing Campaign Check Point Research Publications August 11, 2017 “The Next WannaCry” Vulnerability is Here Check Point Research Publications March 12, 2026 “Handala Hack” – Unveiling Group’s Modus Operandi SUBSCRIBE TO CYBER INTELLIGENCE REPORTS We value your privacy! BFSI uses cookies on this site. We use cookies to enable faster and easier experience for you. By continuing to visit this website you agree to our use of cookies.

A new infostealer named ‘Arkanix Stealer’ operated as a malware-as-a-service (MaaS) enterprise in a one-shot campaign, Kaspersky says. Implemented in both C++ and Python, the malware emerged in October 2025, when its developer started advertising it in underground forum posts, but likely ceased operations in December, when its control panel and Discord channel disappeared. While short-lived, Arkanix Stealer did provide miscreants with broad information-stealing capabilities, collecting system and user information, application details, browser data, Telegram and Discord data, VPN information, and stealing files from specific directories. As part of the MaaS, users were provided with access to a control panel allowing them to configure payloads and access statistics. Users were provided with a browser post-exploitation tool named ChromElevator, delivered via a native C++ version of the malware that could also harvest cryptocurrency wallet data. The Python variant of the stealer, Kaspersky says, was deployed via a Python script, often bundled with PyInstaller or Nuitka, and could dynamically modify its configuration by making GET requests to a remote server. Arkanix Stealer could collect broad system information, including CPU, GPU, RAM, OS, screen, keyboard, and time zone data, along with details on the installed software, including antivirus and VPN applications. It could also target 22 browsers to harvest information such as history, autofill information, passwords, cookies, and 0Auth2 data, as well as Telegram messages and Discord credentials. The analyzed stealer sample also contained a self-spreading feature, acquiring a list of the victim’s Discord friends and channels via the Discord API, and sending a configured message to them. Kaspersky also observed the malware collecting credentials from known VPN clients, such as Mullvad VPN, NordVPN, ExpressVPN, and ProtonVPN. Using a pre-defined set of paths, the malware was seen exfiltrating files from multiple directories associated with the current user, packing them in a ZIP archive, and sending them to the command-and-control (C&C) server. The malware could also fetch additional modules from the C&C to expand its capabilities. These modules include a Chrome grabber, a wallet patcher, an extra collector, and a Python script placed in the startup folder to be executed at system boot. The native variant uses VMProtect, without code virtualization, implements anti-analysis features, collects RDP connection details, targets gaming files and clients for credential theft, captures screenshots, and exfiltrates browser data. Kaspersky identified two servers used to host the stealer panel and monitor victims, both secured via a sign-in page. The malware’s developer also maintained a Discord channel to interact with users and implemented a referral program to attract customers. “This campaign tends to be more of a one-shot campaign for quick financial gains rather than a long-running infection. The panel and the Discord chat were taken down around December 2025, leaving no message or traces of further development or a resurgence,” Kaspersky notes. Related: ‘SolyxImmortal’ Information Stealer Emerges Related: Infostealer Malware Delivered in EmEditor Supply Chain Attack Related: New ‘Sandworm_Mode’ Supply Chain Attack Hits NPM Related: New Keenadu Android Malware Found on Thousands of Devices

An information-stealing malware operation named Arkanix Stealer, promoted on multiple dark web forums towards the end of 2025, was likely developed as an AI-assisted experiment. The project included a control panel and a Discord server for communication with users, but the author took them down without notification, just two months after the operation began. Arkanix offered many of the standard data-stealing features that cybercriminals are used to, along with a modular architecture and anti-analysis features. Kaspersky researchers analyzed the Arkanix stealer and found clues indicating LLM-assisted development, which "might have drastically reduced development time and costs." The researchers believe that Arkanix was a short-lived project for quick financial gains, which makes detection and tracking much more difficult. Arkanix appears online Arkanix started being promoted on hacker forums in October 2025, offering two tiers to potential customers: a basic level with a Python-based implementation, and a “premium” one with a native C++ payload using VMProtect protection, integrating AV evasion and wallet injection features. The developer set up a Discord server that acted as a forum for the community around the project to receive updates, provide feedback for proposed features, and receive help. Also, a referral program was established to promote the project more aggressively, giving referrers an extra free hour of premium access, while potential new customers received one week of free access to the “premium” version. Data-stealing capabilities Arkanix malware can collect system information, steal data stored in the browser (history, autofill info, cookies, passwords), and cryptocurrency wallet data from 22 browsers. Kaspersky researchers say that it can also extract 0Auth2 tokens on Chromium-based browsers. Additionally, the malware can steal data from Telegram, steal Discord credentials, spread via the Discord API, and send messages to the victim’s friends/channels. Arkanix also targets credentials for Mullvad, NordVPN, ExpressVPN, and ProtonVPN, and can archive files from the local filesystem to exfiltrate them asynchronously. Additional modules that can be downloaded from the command-and-control include a Chrome grabber, a wallet patcher for Exodus or Atomic, a screenshots tool, HVNC, and stealers for FileZilla and Steam. The “premium” native C++ version adds RDP credential theft, anti-sandbox and anti-debugging checks, WinAPI-powered screen capturing, and also targets Epic Games, Battle.net, Riot, Unreal Engine, Ubisoft Connect, and GOG. The higher-tier variant also delivers the ChromElevator post-exploitation tool, which injects into suspended browser processes for data theft and is designed to bypass Google's App-Bound Encryption (ABE) protection for unauthorized access to user credentials. The purpose of the Arkanix stealer experiment remains unclear. The project may be an attempt to determine how LLM assistance can improve malware development and how quickly new features can be shipped to the community. Kaspersky's assessment is that Arkanix is "more of a public software product than a shady stealer." The researchers provide a comprehensive list of indicators of compromise (IoCs) that include hashes for detected files, along with domains and IP addresses. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Introduction In October 2025, we discovered a series of forum posts advertising a previously unknown stealer, dubbed “Arkanix Stealer” by its authors. It operated under a MaaS (malware-as-a-service) model, providing users not only with the implant but also with access to a control panel featuring configurable payloads and statistics. The set of implants included a publicly available browser post-exploitation tool known as ChromElevator, which was delivered by a native C++ version of the stealer. This version featured a wide range of capabilities, from collecting system information to stealing cryptocurrency wallet data. Alongside that, we have also discovered Python implementation of the stealer capable of dynamically modifying its configuration. The Python version was often packed, thus giving the adversary multiple methods for distributing their malware. It is also worth noting that Arkanix was rather a one-shot malicious campaign: at the time of writing this article, the affiliate program appears to be already taken down. Kaspersky products detect this threat as Trojan-PSW.Win64.Coins.*, HEUR:Trojan-PSW.Multi.Disco.gen, Trojan.Python.Agent.*. Technical details Background In October 2025, a series of posts was discovered on various dark web forums, advertising a stealer referred to by its author as “Arkanix Stealer”. These posts detail the features of the stealer and include a link to a Discord server, which serves as the primary communication channel between the author and the users of the stealer. Upon further research utilizing public resources, we identified a set of implants associated with this stealer. Initial infection or spreading The initial infection vector remains unknown. However, based on some of the file names (such as steam_account_checker_pro_v1.py, discord_nitro_checker.py, and TikTokAccountBotter.exe) of the loader scripts we obtained, it can be concluded with high confidence that the initial infection vector involved phishing. Python loader The Python loader is the script responsible for downloading and executing the Python-based version of the Arkanix infostealer. We have observed both plaintext Python scripts and those bundled using PyInstaller or Nuitka, all of which share a common execution vector and are slightly obfuscated. These scripts often serve as decoys, initially appearing to contain legitimate code. Some of them do have useful functionality, and others do nothing apart from loading the stealer. Additionally, we have encountered samples that employ no obfuscation at all, in which the infostealer is launched in a separate thread via Python’s built-in threading module. Upon execution, the loader first installs the required packages — namely, requests, pycryptodome, and psutil — via the pip package manager, utilizing the subprocess module. On Microsoft Windows systems, the loader also installs pywin32. In some of the analyzed samples, this process is carried out twice. Since the loader does not perform any output validation of the module installation command, it proceeds to make a POST request to hxxps://arkanix[.]pw/api/session/create to register the current compromised machine on the panel with a predefined set of parameters even if the installation failed. After that, the stealer makes a GET request to hxxps://arkanix[.]pw/stealer.py and executes the downloaded payload. Python stealer version During our research, we obtained a sample of the Python implementation of the Arkanix stealer, which was downloaded from the endpoint hxxps://arkanix[.]pw/stealer.py by the previous stage. The stealer’s capabilities — or features, as referred to by the author — in this version are configurable, with the default configuration predefined within the script file. To dynamically update the feature list, the stealer makes a GET request to hxxps://arkanix[.]pw/api/features/{payload_id}, indicating that these capabilities can be modified on the panel side. The feature list is identical to the one that was described in the GDATA report. Prior to executing the information retrieval-related functions, the stealer makes a request to hxxps://arkanix[.]pw/upload_dropper.py, saves the response to %TEMP%\upd_{random 8-byte name}.py, and executes it. We do not have access to the contents of this script, which is referred to as the “dropper” by the attackers. During its main information retrieval routine, at the end of each processing stage, the collected information is serialized into JSON format and saved to a predefined path, such as %LOCALAPPDATA\Arkanix_lol\%info_class%.json. In the following, we will provide a more detailed description of the Python version’s data collection features. System info collection Arkanix Stealer is capable of collecting a set of info about the compromised system. This info includes: OS version CPU and GPU info RAM size Screen resolution Keyboard layout Time zone Installed software Antivirus software VPN Information collection is performed using standard shell commands with the exception of the VPN check. The latter is implemented by querying the endpoint hxxps://ipapi[.]co/json/ and verifying whether the associated IP address belongs to a known set of VPNs, proxies, or Tor exit nodes. Browser features This stealer is capable of extracting various types of data from supported browsers (22 in total, ranging from the widely popular Google Chrome to the Tor Browser). The list of supported browsers is hardcoded, and unlike other parameters, it cannot be modified during execution. In addition to a separate Chrome grabber module (which we’ll discuss later), the stealer itself supports the extraction of diverse information, such as: Browser history (URLs, visit count and last visit) Autofill information (email, phone, addresses and payment cards details) Saved passwords Cookies In case of Chromium-based browsers, 0Auth2 data is also extracted All information is decrypted using either the Windows DPAPI or AES, where applicable, and searched for relevant keywords. In the case of browser information collection, the stealer searches exclusively for keywords related to banking (e.g., “revolut”, “stripe”, “bank”) and cryptocurrencies (e.g., “binance”, “metamask”, “wallet”). In addition to this, the stealer is capable of extracting extension data from a hardcoded list of extensions associated with cryptocurrencies. Telegram info collection Telegram data collection begins with terminating the Telegram.exe process using the taskkill command. Subsequently, if the telegram_optimized feature is set to False, the malware zips the entire tdata directory (typically located at %APPDATA%\Roaming\Telegram Desktop\tdata) and transmits it to the attacker. Otherwise, it selectively copies and zips only the subdirectories containing valuable info, such as message log. The generated archive is sent to the endpoint /delivery with the filename tdata_session.zip. Discord capabilities The stealer includes two features connected with Discord: credentials stealing and self-spreading. The first one can be utilized to acquire credentials both from the standard client and custom clients. If the client is Chromium-based, the stealer employs the same data exfiltration mechanism as during browser credentials stealing. The self-spreading feature is configurable (meaning it can be disabled in the config). The stealer acquires the list of user’s friends and channels via the Discord API and sends a message provided by the attacker. This stealer does not support attaching files to such messages. VPN data collection The VPN collector is searching for a set of known VPN software to extract account credentials from the credentials file with a known path that gets parsed with a regular expression. The extraction occurs from the following set of applications: Mullvad VPN NordVPN ExpressVPN ProtonVPN File retrieval File retrieval is performed regardless of the configuration. The script relies on a predefined set of paths associated with the current user (such as Desktop, Download, etc.) and file extensions mainly connected with documents and media. The script also has a predefined list of filenames to exfiltrate. The extracted files are packed into a ZIP archive which is later sent to the C2 asynchronously. An interesting aspect is that the filename list includes several French words, such as “motdepasse” (French for “password”), “banque” (French for “bank”), “secret” (French for “secret”), and “compte” (French for “account”). Other payloads We were able to identify additional modules that are downloaded from the C2 rather than embedded into the stealer script; however, we weren’t able to obtain them. These modules can be described by the following table, with the “Details” column referring to the information that could be extracted from the main stealer code. The Wallet patcher and Extra collector scripts are received in an encrypted form from the C2 server. To decrypt them, the attackers utilize the AES-GCM algorithm in conjunction with PBKDF2 (HMAC and SHA256). After decryption, the additional payload has its template placeholders replaced and is stored under a partially randomized name within a temporary folder. Once all operations are completed, the stealer removes itself from the drive, along with the artifacts folder (Arkanix_lol in this case). Native version of stealer During our analysis, we were able to obtain both the release and debug versions of the native implementation, as both were uploaded to publicly available resources. The following are the key differences between the two: The release version employs VMProtect, but does not utilize code virtualization. The debug version communicates with a Discord bot for command and control (C2), whereas the release version uses the previously mentioned C2 domain arkanix[.]pw . The debug version includes extensive logging, presumably for the authors’ debugging purposes. Notably, the native implementation explicitly references the name of the stealer in the VersionInfo resources. This naming convention is consistent across both the debug version and certain samples containing the release version of the implant. After launching, the stealer implements a series of analysis countermeasures to verify that the application is not being executed within a sandboxed environment or run under a debugger. Following these checks, the sample patches AmsiScanBuffer and EtwEventWrite to prevent the triggering of any unwanted events by the system. Once the preliminary checks are completed, the sample proceeds to gather information about the system. The list of capabilities is hardcoded and cannot be modified from the server side, in contrast to the Python version. What is more, the feature list is quite similar to the Python version except a few ones. RDP connections The stealer is capable of collecting information about known RDP connections that the compromised user has. To achieve this, it searches for .rdp files in %USERPROFILE%\Documents and extracts the full server address, password, username and server port. Gaming files The stealer also targets gamers and is capable to steal credentials from the popular gaming platform clients, including: Steam Epic Games Launcher net Riot Origin Unreal Engine Ubisoft Connect GOG Screenshots The native version, unlike its Python counterpart, is capable of capturing screenshots for each monitor via capCreateCaptureWindowA WinAPI. In conclusion, this sample communicates with the C2 server through the same endpoints as the Python version. However, in this instance, all data is encrypted using the same AES-GCM + PBKDF2 (HMAC and SHA256) scheme as partially employed in the Python variant. In some observed samples, the key used was arkanix_secret_key_v20_2024. Alongside that, the C++ sample explicitly sets the User-Agent to ArkanixStealer/1.0. Post-exploitation browser data extractor This is an implant embedded within the resources of the C++ implementation. The author incorporated it into the resource section without applying any obfuscation or encryption. Subsequently, the stealer extracts the payload to a temporary folder with a randomly generated name composed of hexadecimal digits (0-9 and A-F) and executes it using the CreateProcess WinAPI. The payload itself is the unaltered publicly available project known as “ChromElevator”. To summarize, this tool consists of two components: an injector and the main payload. The injector initializes a direct syscall engine, spawns a suspended target browser process, and injects the decrypted code into it via Nt syscalls. The injected payload then decrypts the browser master key and exfiltrates data such as cookies, login information, web data, and so on. Infrastructure During the Arkanix campaign, two domains used in the attacks were identified. Although these domains were routed through Cloudflare, a real IP address was successfully discovered for one of them, namely, arkanix[.]pw. For the second one we only obtained a Cloudflare IP address. Both servers were also utilized to host the stealer panel, which allows attackers to monitor their victims. The contents of the panel are secured behind a sign-in page. Closer to the end of our research, the panel was seemingly taken down with no message or notice. Stealer promotion During the research of this campaign, we noticed that the forum posts advertising the stealer contained a link leading to a Discord server dubbed “Arkanix” by the authors. The server posed as a forum where authors posted various content and clients could ask various questions regarding this malicious software. While users mainly thank and ask about when the feature promised by the authors will be released and added into the stealer, the content made by the authors is broader. The adversary builds up the communication with potential buyers using the same marketing and communication methods real companies employ. To begin with, they warm up the audience by posting surveys about whether they should implement specific features, such as Discord injection and binding with a legitimate application (sic!). Additionally, the author promised to release a crypter as a side project in four to six weeks, at the end of October. As of now, the stealer seems to have been taken down without any notice while the crypter was never released. Furthermore, the Arkanix Stealer authors decided to implement a referral program to attract new customers. Referrers were promised an additional free hour to their premium license, while invited customers received seven days of free “premium” trial use. As stated in forum posts, the premium plan included the following features: C++ native stealer Exodus and Atomic cryptocurrency wallets injection Increased payload generation, up to 10 payloads Priority support Speaking of technical details, based on the screenshot of the Visual Studio stealer project that was sent to the Discord server, we can conclude that the author is German-speaking. This same screenshot also serves as a probable indicator of AI-assisted development as it shares the common patterns of such assistants, e.g. the presence of the utils.cpp file. What provides even more confidence is the overall code structure, the presence of comments and extensive debugging log output. Conclusions Information stealers have always posed as a serious threat to users’ data. Arkanix is no exception as it targets a wide range of users, from those interested in cryptocurrencies and gaming to those using online banking. It collects a vast amount of information including highly sensitive personal data. While being quite functional, it contains probable traces of LLM-assisted development which suggests that such assistance might have drastically reduced development time and costs. Hence it follows that this campaign tends to be more of a one-shot campaign for quick financial gains rather than a long-running infection. The panel and the Discord chat were taken down around December 2025, leaving no message or traces of further development or a resurgence. In addition, the developers behind the Arkanix Stealer decided to address the public, implementing a forum where they posted development insights, conducted surveys and even ran a referral program where you could get bonuses for “bringing a friend”. This behavior makes Arkanix more of a public software product than a shady stealer. Indicators of Compromise Additional IoCs are available to customers of our Threat Intelligence Reporting service. For more details, contact us at [email protected]. Domains and IPs arkanix[.]pw arkanix[.]ru

A Spanish court has granted precautionary measures against NordVPN and ProtonVPN, ordering the two popular VPN providers to block 16 websites that facilitate piracy of football matches. The restrictions will apply to a dynamic list of IP addresses in Spain, and there will be no opportunity for appeals. The measures were taken 'inaudita parte', meaning that the defendants weren’t called to participate in a hearing. LaLiga - the country’s professional football organizer, and its broadcasting partner, Telefónica, are required to “preserve sufficient digital evidence of the unlawful transmission of the protected contents.” LaLiga showed a strong stance against the piracy ecosystem in recent years, previously targeting Cloudflare, accusing the internet giant of facilitating illegal sports streaming. The two organizations proved that the VPN providers fall under the EU Digital Services Regulation, and therefore have a duty to help prevent copyright infringement carried out through their infrastructure. “The orders identify how VPN systems prove to be a suitable means, 'highly effective and accessible to generate the possibility of access to content not accessible in certain geographic points,' distorting the real geographic location of online access, and facilitating 'access to websites that broadcast protected content illegally,'” reads LaLiga’s announcement. “What is more, the orders highlight how the defendant companies acknowledge and even advertise that their system is excellent at evading restrictions.” LaLiga characterized the ruling as unprecedented in Spain, aligning it with similar decisions in France, and celebrated that the liability of VPN providers for piracy is clearly recognized. In response, ProtonVPN took to Twitter to question the decision, declaring a total lack of awareness of the proceedings and stating that they have not been formally notified. “Any judicial order issued without proper notification to the affected parties, thereby denying them the opportunity to be heard, would be procedurally invalid under fundamental principles of due process, stated the VPN service provider. “Spanish courts, like all courts operating under the rule of law, are bound by procedural safeguards that ensure parties are given a fair opportunity to present their case before any binding judgment is rendered.” In a request for comments to BleepingComputer, NordVPN's spokesperson Laura Tyrylyte stated that the company was not involved in any legal proceedings in Spain. Tyrylyte stated that the process for blocking domains is ineffective in the fight against piracy as it does not address the root cause. Instead, hosting providers should be the target, since pirates can use subdomains to bypass the restrictions. "Effective piracy control should focus on eliminating the source of the content, targeting hosting providers, cutting off financing for illegal operations, and increasing the availability of legitimate content." Through its representative, NordVPN said that the measures affect mostly reputable, paid VPN providers, while free services continue to operate largely unhindered. "Free VPNs are often harder to regulate and, since users who seek to avoid paying for content are unlikely to pay for a VPN either, these services remain a loophole for pirates to bypass restrictions." Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

A Russian-linked campaign delivers the StealC V2 information stealer malware through malicious Blender files uploaded to 3D model marketplaces like CGTrader. Blender is a powerful open-source 3D creation suite that can execute Python scripts for automation, custom user interface panels, add-ons, rendering processes, rigging tools, and pipeline integration. If the Auto Run feature is enabled, when a user opens a character rig, a Python script can automatically load the facial controls and custom UI panels with the required buttons and sliders. Despite the potential for abuse, users often activate the Auto Run option for convenience. Researchers at cybersecurity company Morphisec observed attacks using malicious .blend files with embedded Python code that fetches a malware loader from a Cloudflare Workers domain. The loader then fetches a PowerShell script that retrieves two ZIP archives, ZalypaGyliveraV1 and BLENDERX, from attacker-controlled IPs. The archives unpack into the %TEMP% folder and drop LNK files in the Startup directory for persistence. Next, they deploy two payloads, the StealC infostealer and an auxiliary Python stealer, likely used for redundancy. Morphisec researchers report that the StealC malware used in this campaign was the latest variant of the second major version of the malware that was analyzed by Zscaler researchers earlier this year. The latest StealC has expanded its data-stealing capabilities and supports exfiltration from: 23+ browsers, with server-side credential decryption and compatibility with Chrome 132+ 100+ cryptocurrency wallet browser extensions and 15+ cryptocurrency wallet apps Telegram, Discord, Tox, Pidgin, VPN clients (ProtonVPN, OpenVPN), and mail clients (Thunderbird) Updated UAC bypass mechanism Despite the malware being documented since 2023, subsequent releases appear to remain elusive for anti-virus products. Morphisec comments that no security engine on VirusTotal detected the StealC variant they analyzed. Given that 3D model marketplaces cannot scrutinize the code in user-submitted files, Blender users are advised to exercise caution when using files sourced from such platforms and should consider disabling the auto-execution of code. You can do this from Blender > Edit > Preferences > uncheck the 'Auto Run Python Scripts' option. 3D assets should be treated like executable files, and users should only trust publishers with a proven record. For everything else, it is recommended to use sandboxed environments for testing. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Cybersecurity professionals recognize that enterprise networks are prime targets for dark web risks such as ransomware, unauthorized insider activity, and data exfiltration. What’s less obvious is that evidence of this activity often hides in plain sight, buried within everyday network traffic. For security leaders using Network Detection and Response (NDR), these hidden signals become opportunities for the defense. Wondering how to spot dark web threats on your network? Start with these four essential steps to leverage NDR for detection and investigation: Step 1: Know the gateways to the dark web Unlike the public web, the dark web relies on anonymizing tools like the Tor browser, Invisible Internet Project (I2P), and Freenet peer-to-peer (P2P) networks that obscure user origins, encrypt traffic, and evade detection. Despite their ability to obfuscate activity, signs of dark web movement are still captured in network data. Telltale signs include unusual port usage, encrypted traffic patterns, and communication with Tor entry or exit nodes (explored further in step 4). Step 2: Understand NDR NDR systems monitor network traffic in real time, leveraging AI, machine learning, and behavioral analytics to identify suspicious or malicious activity. NDR also maintains comprehensive records of network activity, providing essential history and context. With these insights, teams can integrate NDR into their SOC infrastructure and processes to improve mean time to detect (MTTD) and respond (MTTR) to cyber threats, including those posed by the dark web. Step 3: Deploy NDR for comprehensive dark web visibility Monitor traffic across your core network, edge environments, and internal segments. Key recommendations include: Position NDR sensors at strategic locations: Focus on network segments housing high-value assets to catch command-and-control (C2) activity and data exfiltration attempts. Analyze north-south traffic: Use NDR to inspect internal-to-external communications to detect possible dark web interactions. Track lateral movement: Monitor internal traffic between devices for signs that could indicate dark web-related threats. Step 4: Detect and hunt with NDR Begin with network baselining NDR deployments often start with a 30-day network baselining period that allows the platform to learn your organization’s normal traffic. Once complete, NDR can automatically flag indicators of dark web activity, including: New communications with previously unknown external IPs Excessive peer connections Suspicious file transfer protocols or traffic to unusual domains Unusual outbound traffic masquerading as normal, signaling possible data exfiltration to dark web marketplaces With the baseline established, you can now refine NDR settings to automate detection of targeted dark web indicators. Note that if your network is already compromised, you must be careful to not let the NDR perceive threat activity as being “normal.” This is why baselining the network requires active analysis and an understanding of your environment. Automate detection of Tor activity Set up dynamic alerts for devices communicating over default Tor ports (9001, 9030, 9050). Monitor tunnel logs for irregular patterns like compressed Transport Layer Security (TLS) headers, unique negotiation behaviors, unusually long sessions, and high bandwidth usage. Scan for Tor traffic signatures, including distinctive packet lengths and handshakes. Track connections to known Tor entry nodes, relays, bridges, and Obfourscator or “obfs4” nodes. Flag traffic frequently switching between multiple external IPs or interacting with anonymization services. Corelight’s Open NDR Platform with Investigator can provide visibility into Tor connections through network metadata (including connection, protocol, and TLS connections and certificates), Suricata signatures, and machine learning algorithm detections. Trusted to defend the world’s most sensitive networks, Corelight's Network Detection & Response (NDR) platform combines deep visibility with advanced behavioral and anomaly detections to help your SOC uncover new AI-powered threats and dark web activity. Take action against threats today Monitor for I2P and P2P Connections Set dynamic alerts for traffic on I2P ports (7650–7659) and BitTorrent/P2P ports (6881–6889). Monitor for high outbound UDP traffic to random or external IPs, signaling I2P tunnels. Watch for periodic spikes to unfamiliar or unresolved IPs and obscure UDP ports that are common with I2P peer discovery. Detect persistent, long-duration P2P sessions across distributed IPs, indicating Freenet activity. Look for self-signed certificates typical of Freenet and other anonymization tools. Flag workstations and devices (including IoT) that show persistent connections to high-entropy or random domain names, a common sign of anonymization services. The Corelight Encrypted Traffic Collection can help identify unusual certificates, unexpected encryption, and other TLS anomalies that could indicate use of encrypted I2P and P2P connections. Track suspicious DNS activity Monitor DNS logs for queries to .onion addresses, uncommon subdomains, and attempts to access domains associated with anonymization tools. Flag queries to low-reputation, rarely used, or malicious domains, especially those linked to VPNs or proxies. For example, DNS requests involving the .su domain, reserved for the former Soviet Union, are almost never legitimate. Detect devices that avoid internal DNS and instead use external DNS servers. This could indicate the use of anonymization tools, but it is also likely a violation of the organization’s network security policies and preferences. Monitor VPN connections Detect connections to well-known consumer VPN providers (e.g., NordVPN, ExpressVPN, ProtonVPN). Alert on non-standard VPN ports (OpenVPN: 1194, Layer Two Transport Protocol, or L2TP: 1701). Flag traffic routed via OpenVPN, IPSec, or WireGuard, including use of custom SSL/TLS certificates tied to these services, to determine if they are allowed by current policies and practices. Corelight’s VPN Insights package identifies over 400 unique VPN protocols, providers, and types and logs them along with critical metadata (like country of origin) for investigation. Monitor for “impossible travel,” geolocation and similar anomalies Identify instances of “impossible travel” using IP geolocation data from users or devices (e.g., logins from distant countries when users are located in your offices). Detect connections from suspicious regions or countries outside your organization's normal operational scope. Look for traffic with no identifiable legitimate business application Flag lateral movement that signals possible infiltration Flag internal traffic that hops between multiple systems before reaching external endpoints. Monitor for unusual activity between internal devices, especially using unexpected protocols like SOCKS proxies/tunnels. Corelight’s Encrypted Traffic Collection can also identify unusual remote management traffic, even in encrypted connections, helping to see potentially malicious use of SSH and RDP as attackers move laterally within a network. Detect malware and command-and-control (C2) beaconing Use Yara to analyze files extracted from network traffic. Look for malware or suspicious binaries. Check logs for patterns of “check-in” activity. These may occur at regular intervals, such as every 5 minutes, or every hour. Corelight’s C2 Collection identifies dozens of attack frameworks, RATs, and malware that are often used to stage attacks, establish C2, and download additional tools for attack expansion. Add threat intelligence Correlate known dark web activity by adding threat intelligence feeds. Integrate feeds to flag Indicators of Compromise (IOCs) like hashes, IPs, and C2 domains. Consider hiring a third party threat intelligence service to monitor the dark web for chatter about your organization or data leaks from your environment. Track login attempts from suspicious or compromised locations with external credential monitoring. Corelight’s Intel Framework matches millions of indicators at line rate, generating alerts and logs for pinpoint detection and investigation. A well-tuned NDR solution significantly enhances your organization’s ability to detect dark web activity and bolsters overall cybersecurity posture. Corelight’s Open NDR Platform features integrated multi-layer detection, file analysis, advanced protocol monitoring, and comprehensive long-term network metadata collection. To discover more about Corelight NDR or discuss how to activate these dark web detection capabilities within your own network, visit corelight.com. Sponsored and written by Corelight.