quasar

A previously undocumented Linux implant codenamed Quasar Linux RAT (QLNX) is targeting developers' systems to establish a silent foothold as well as facilitate a broad range of post-compromise functionality, such as credential harvesting, keylogging, file manipulation, clipboard monitoring, and network tunneling. "QLNX targets developers and DevOps credentials across the software supply chain," Trend Micro researchers Aliakbar Zahravi and Ahmed Mohamed Ibrahim said in a technical analysis of the malware. "Its credential harvester extracts secrets from high-value files such as .npmrc (npm tokens), .pypirc (PyPI credentials), .git-credentials, .aws/credentials, .kube/config, .docker/config.json, .vault-token, Terraform credentials, GitHub CLI tokens, and .env files. The compromise of these assets could allow the operator to push malicious packages to NPM or PyPI registries, access cloud infrastructure, or pivot through CI/CD pipelines." The malware's ability to systematically harvest a wide range of credentials poses a severe risk to developer environments. A threat actor who successfully deploys QLNX against a package maintainer gains unauthorized access to their publishing pipeline, allowing the attacker to push poisoned versions that can lead to cascading downstream impacts. QLNX executes filelessly from memory, masquerades itself as a kernel thread (e.g., kworker or ksoftirqd), and is capable of profiling the host to detect containerized environments, wiping system logs to cover up the tracks, and setting up persistence using no less than seven different methods, including systemd, crontab, and .bashrc shell injection. Furthermore, it exfiltrates the collected data to an attacker-controlled infrastructure, and receives commands that make it possible to execute shell commands, manage files, inject code into processes, take screenshots, log keystrokes, establish SOCKS proxies and TCP tunnels, run Beacon Object Files (BOFs), and even manage a peer-to-peer (P2P) mesh network. Exactly how the malware is delivered is unclear. However, once a foothold is established, it enters a primary operational phase by running a persistent loop that continuously attempts to establish and maintain communication with the command-and-control (C2) server over raw TCP, HTTPS, and HTTP. In total, QLNX supports 58 distinct commands that give the operators complete control of the compromised host. QLNX also comes with a Pluggable Authentication Module (PAM) inline-hook backdoor that intercepts plaintext credentials during authentication events, logs outbound SSH session data, and transmits the data to the C2 server. The malware also supports a second PAM-based credentials logger that's automatically loaded into every dynamically linked process to extract the service name, username, and authentication token. It employs a two-tiered rootkit architecture: a userland rootkit deployed through the Linux dynamic linker's LD_PRELOAD mechanism to ensure that the implant's artifacts and processes stay hidden. There also exists a kernel-level eBPF component that uses BPF subsystem to conceal processes, files, and network ports from standard userland tools such as ps, ls, and netstat upon receiving instructions from the C2 server. "The QLNX implant was built for long-term stealth and credential theft," Trend Micro said. "What makes it particularly dangerous is not any single feature, but how its capabilities chain together into a coherent attack workflow: arrive, erase from disk, persist through six redundant mechanisms, hide at both userspace and kernel level, and then harvest the credentials that matter most."

A recently identified Linux backdoor was designed to steal developer credentials across the software supply chain, Trend Micro warns. Dubbed Quasar Linux (QLNX), the RAT has a modular architecture, uses multiple persistence and detection evasion mechanisms, packs a rootkit, and provides attackers with remote access to the infected machines. The main purpose of QLNX, Trend Micro says, is the theft of developer credentials, keys, and tokens that could provide its operators with access to development tools, cloud environments, and repositories. It targets AWS credentials and configurations, Kubernetes tokens, Docker Hub credentials, Git access tokens and configurations, NPM authentication tokens, and PyPI API keys, potentially allowing operators to publish malicious packages through established developer accounts. “An attacker who successfully deploys QLNX against a package maintainer gains access to that maintainer’s publishing pipeline. A single compromise can be silently leveraged to trojanize packages, inject backdoors into build artifacts, or pivot into cloud environments where production infrastructure lives,” Trend Micro says. The RAT is executed in memory, spoofs its process name, and can delete itself to evade detection. It also performs system reconnaissance to detect containers, hides specific processes, ports, and files, and clears system logs. It also deploys a Pluggable Authentication Module (PAM) backdoor to harvest credentials, and gathers extensive system information, including clipboard contents, SSH keys, and browser profiles. QLNX contains two PAM backdoor implementations: the first harvests plaintext credentials from authentication events, contains a master password bypass, and logs outbound SSH session data; the second loads into dynamically linked processes to extract the service name, username, and authentication token. The malware contains a two-tier rootkit architecture, deploying userspace hooks through the LD_PRELOAD shared library, which also enables persistence, along with an eBPF rootkit controller that manages kernel-level BPF maps. “This component does not contain the kernel-side eBPF program itself. Its role is limited to creating and managing BPF maps — kernel data structures designed to hold the list of items that should be hidden from the system. Upon receiving instructions from the C&C server, the implant leverages the Linux kernel’s BPF subsystem to conceal processes, files, and network ports from standard userland tools,” Trend Micro explains. QLNX can achieve persistence in six different ways, using crontab entries, desktop entries, init scripts, service files, and shell lines, based on commands received from the operator, and can deploy several methods on the same system. The malware supports 58 distinct commands, allowing attackers to interact with shells, enumerate and manipulate files and processes, create directories, download and upload files, reboot or shut down the system, open URLs, display notifications, open TCP sockets, harvest sensitive information, capture the screen, log keystrokes, and use SSH credentials to execute commands on remote hosts. “The QLNX implant was built for long-term stealth and credential theft. What makes it particularly dangerous is not any single feature, but how its capabilities chain together into a coherent attack workflow: arrive, erase from disk, persist through six redundant mechanisms, hide at both userspace and kernel level, and then harvest the credentials that matter most,” Trend Micro notes. Related: Exploitation of ‘Copy Fail’ Linux Vulnerability Begins Related: Dozens of Open VSX Extension Clones Linked to GlassWorm Malware Related: New ‘SSHStalker’ Linux Botnet Uses Old Techniques Related: Checkmarx Confirms Data Stolen in Supply Chain Attack

A previously undocumented Linux implant named Quasar Linux (QLNX) is targeting developers' systems with a mix of rootkit, backdoor, and credential-stealing capabilities. The malware kit is deployed in development and DevOps environments in npm, PyPI, GitHub, AWS, Docker, and Kubernetes. This could enable supply-chain attacks where the threat actor publishes malicious packages on code distribution platforms. Researchers at cybersecurity company Trend Micro analyzed the QLNX implant and found that "it dynamically compiles rootkit shared objects and PAM backdoor modules on the target host using gcc [GNU Compiler Collection]." A report from the company this week notes that QLNX was designed for stealth and long-term persistence, as it runs in-memory, deletes the original binary from disk, wipes logs, spoofs process names, and clears forensic environment variables. The malware uses seven distinct persistence mechanisms, including LD_PRELOAD, systemd, crontab, init.d scripts, XDG autostart, and ‘.bashrc’ injection, ensuring it loads into every dynamically linked process and respawns if killed. QLNX features multiple functional blocks dedicated to specific activities, making it a complete attack tool. Its core components can be summarized as follows: RAT core — Central control component built around a 58-command framework that provides interactive shell access, file and process management, system control, and network operations, while maintaining persistent communication with the C2 over custom TCP/TLS or HTTP/S channels. Rootkit — Dual-layer stealth mechanism combining a userland LD_PRELOAD rootkit and a kernel-level eBPF component. The userland layer hooks libc functions to hide files, processes, and malware artifacts, while the eBPF layer conceals PIDs, file paths, and network ports at the kernel level. Both are deployed dynamically, with the userland rootkit compiled on the target system. Credential access layer — Combines credential harvesting (SSH keys, browsers, cloud and developer configs, /etc/shadow, clipboard) with PAM-based backdoors that intercept and log plaintext authentication data. Surveillance module — Keylogging, screenshot capture, and clipboard monitoring. Networking and lateral movement — TCP tunneling, SOCKS proxy, port scanning, SSH-based lateral movement, and peer-to-peer mesh networking. Execution and injection engine — Process injection (ptrace, /proc/pid/mem) and in-memory execution of payloads (shared objects, BOF/COFF). Filesystem monitoring — Real-time tracking of file activity via inotify. After initial access, QLNX establishes a fileless foothold, deploys persistence and stealth mechanisms, and then harvests developer and cloud credentials. By targeting developer workstations, attackers can bypass enterprise security controls and access the credentials that underpin software delivery pipelines. This approach mirrors recent supply chain incidents in which stolen developer credentials were used to publish trojanized packages to public repositories. Trend Micro has not provided details about specific attacks or any attribution for QLNX, so the deployment volume and specific activity levels of this new malware are unclear. At the time of publication, the Quasar Linux implant is detected by only four security solutions, which flag its binary as malicious. Trend Micro has provided indicators of compromise (IoCs) to help defenders detect QLNX infections and protect against them. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

A fake website impersonating Avast antivirus is tricking people into infecting their own computers. The site looks legitimate, runs what appears to be a virus scan, and claims your system is full of threats. But the results are fake: when you’re prompted to “fix” the problem, the download you’re given is actually Venom Stealer—a type of malware designed to steal passwords, session cookies, and cryptocurrency wallet data. This is a classic scare-and-fix scam: create panic, then offer a solution. In this case, the “solution” abuses the trusted Avast brand to deliver the attack. A scan that finds exactly what the attacker wants you to see The phishing page is a recreation of the Avast brand, complete with navigation bar, logo, and reassuring certification badges. Visitors are invited to run what appears to be a comprehensive virus scan. Once they click, the page stages a brief animation before delivering its predetermined verdict: three threats found, three threats removed, system protected. A scrolling console log names a specific detection—Trojan:Win32/Zbot.AA!dll—to lend the performance an air of specificity. The victim is then prompted to download the cure: a file called Avast_system_cleaner.exe. This is the payload. And far from cleaning anything, it immediately begins stealing. A Chrome service that is not Chrome When the victim launches Avast_system_cleaner.exe, the binary—a 64-bit Windows PE executable roughly 2 MB in size—copies itself into a location designed to blend in with legitimate software: C:\Program Files\Google\Chrome\Application\v20svc.exe. The dropped file is byte-for-byte identical to the parent, sharing the same MD5 hash (0a32d6abea15f3bfe2a74763ba6c4ef5). It then launches the copy with the command-line flag --v20c, a meaningless argument whose sole purpose is to signal to the malware that it is running in its second-stage role. The disguise is deliberate. A process named v20svc.exe sitting inside Chrome’s application directory looks, at a glance, like a legitimate browser service component. Anyone scanning their task manager would likely scroll past it without a second thought. This is a textbook example of masquerading: naming a malicious binary to match the conventions of trusted software so it escapes casual inspection. A debug artifact baked into the binary confirms its lineage: the PDB path reads crypter_stub.pdb, indicating the executable was packed using a crypter, which is a tool designed to scramble a payload’s code so antivirus engines cannot recognise it from its signature alone. At the time of analysis, only 27% of engines on VirusTotal flagged the sample, meaning roughly three in four commercial antivirus products missed it entirely. YARA rules matched the sample to the Venom Stealer malware family, a known descendant of the Quasar RAT framework that has been sold on underground forums since at least 2020. Venom Stealer is purpose-built for data theft: browser credentials, session cookies, cryptocurrency wallets, and credit card details stored in browsers. Every cookie, every wallet, every saved password Once running, the malware works through a checklist of high-value targets on the victim’s machine. It starts with browsers. Behavioral analysis confirms the malware harvests saved credentials and session cookies. In the analysis environment, it was observed directly accessing Firefox’s cookie database at C:\Users\ \AppData\Roaming\Mozilla\Firefox\Profiles\ \cookies.sqlite-shm. Process memory also contained fully-formed JSON structures with stolen cookie data from Microsoft Edge and Google Chrome, including active sessions for Netflix, YouTube, Reddit, Facebook, LinkedIn, AliExpress, Outlook, Adobe, and Google. Stolen session cookies give the attacker the ability to hijack authenticated browser sessions without needing the victim’s password, including sessions protected by two-factor authentication. The malware also targets cryptocurrency wallets. Behavioral signatures confirm it searches for and attempts to steal locally-stored wallet data, and Venom Stealer is documented as targeting desktop wallet applications. For anyone holding crypto assets on a hot wallet, the implications are immediate. Beyond credentials, the stealer captures a screenshot of the victim’s desktop, saved temporarily as C:\Users\ \AppData\Local\Temp\screenshot_5sIczFxY95t2IQ5u.jpg, and writes a session tracking file to C:\Users\ \AppData\Roaming\Microsoft\fd1cd7a3\sess. A small marker file is also dropped at C:\Users\Public\NTUSER.dat—a path chosen to mimic a legitimate Windows registry hive file and avoid suspicion. Disguised as analytics, delivered over plain HTTP All stolen data is exfiltrated to a single command-and-control domain: app-metrics-cdn[.]com, which resolved to 104.21.14.89 (a Cloudflare address) during analysis. The domain name is crafted to look like a benign analytics or content delivery service, the kind of traffic that might not raise alarm bells in a corporate proxy log. The exfiltration follows a structured four-step sequence over unencrypted HTTP. First, a multipart form-data POST to /api/upload transmits the collected file—screenshots, wallet data, cookie databases—totalling around 140 KB. A second POST to /api/upload-json sends a structured JSON payload of approximately 29 KB containing parsed credentials and cookies. A confirmation POST to /api/upload-complete signals that the theft is finished. The malware then enters a heartbeat loop, periodically checking in at /api/listener/heartbeat to maintain contact with the operator’s infrastructure. All of this traffic uses a generic Mozilla/5.0 user-agent string, another attempt to blend in with ordinary web browsing. Syscalls, sleep loops, and debugger checks Venom Stealer does not simply steal and leave. It takes significant steps to avoid being caught. The most notable evasion technique is the use of direct and indirect system calls, a method where the malware invokes Windows kernel functions directly rather than routing through the standard ntdll.dll library. Because most endpoint detection tools work by intercepting calls to that library, this technique effectively blinds them. This behaviour was flagged in both the parent and the dropped child process. The malware also checks whether it is being debugged, queries CPU vendor and model information, reads the volume serial number of the system drive, creates guard pages in memory that can crash debuggers attempting to step through the code, and enumerates running processes. These are common techniques for detecting virtual machines and analysis environments. To frustrate automated analysis further, it incorporates sleep calls exceeding three minutes. This is not a new trick Impersonating security software to distribute malware is one of the oldest tricks in the book. A user who believes their system is infected is primed to act urgently, and a page that looks like a trusted antivirus vendor is exactly the kind of authority they will defer to. By staging a fake scan that “finds” threats and then offering a cure, the attacker exploits both fear and trust in a single interaction. This is not an isolated tactic. In May 2025, DomainTools documented a separate campaign in which attackers built a convincing clone of Bitdefender’s website and used it to distribute Venom RAT alongside the StormKitty stealer. The playbook is nearly identical: impersonate a security brand, manufacture urgency, and deliver a Trojan dressed as protection. It suggests this is a repeatable template, not a one-off experiment. What to do if you may have been affected Only download security software from official vendor websites. Avast’s legitimate site is avast.com. Do not trust search engine results, ads, or links in unsolicited emails. If you interacted with a site like this or downloaded the file, act quickly: Check if your system is infected. Look for the file v20svc.exe inC:\Program Files\Google\Chrome\Application\ . If it exists, your system was likely compromised by this malware. Run a full system scan immediately. Use a trusted, up-to-date anti-malware tool (such as Malwarebytes) to detect and remove the infection. If the scan finds threats, follow the tool’s recommendations to quarantine or delete them. Change your password right away. Start with email, banking, and any important accounts. Assume anything saved in your browser has been exposed. Sign out of all active sessions. Log out of services like Google, Microsoft, Facebook, and Netflix. Stolen session cookies allow an attacker to bypass two-factor authentication entirely. Protect cryptocurrency funds. If you use a desktop cryptocurrency wallet, transfer your funds to a new wallet generated on a clean device as soon as possible. Indicators of Compromise (IOCs) File hashes SHA-256: ecbeaa13921dbad8028d29534c3878503f45a82a09cf27857fa4335bd1c9286d Domains app-metrics-cdn[.]com Network indicators 104.21.14.89 C2 URLs http://app-metrics-cdn[.]com/api/upload http://app-metrics-cdn[.]com/api/upload-json http://app-metrics-cdn[.]com/api/upload-complete http://app-metrics-cdn[.]com/api/listener/heartbeat From reporting threats to removing them. Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Cybersecurity never stops—and neither do hackers. While you wrapped up last week, new attacks were already underway. From hidden software bugs to massive DDoS attacks and new ransomware tricks, this week’s roundup gives you the biggest security moves to know. Whether you’re protecting key systems or locking down cloud apps, these are the updates you need before making your next security decision. Take a quick look to start your week informed and one step ahead. ⚡ Threat of the Week Cisco 0-Day Flaws Under Attack — Cybersecurity agencies warned that threat actors have exploited two security flaws affecting Cisco firewalls as part of zero-day attacks to deliver previously undocumented malware families like RayInitiator and LINE VIPER. The RayInitiator and LINE VIPER malware represent a significant evolution on that used in the previous campaign, both in sophistication and its ability to evade detection. The activity involves the exploitation of CVE-2025-20362 (CVSS score: 6.5) and CVE-2025-20333 (CVSS score: 9.9) to bypass authentication and execute malicious code on susceptible appliances. The campaign is assessed to be linked to a threat cluster dubbed ArcaneDoor, which was attributed to a suspected China-linked hacking group known as UAT4356 (aka Storm-1849). Future-Ready Protection for Microsoft Rising attacks demand a plan. Get Veeam’s Cyber Resilience Playbook for Microsoft 365 & Entra ID and learn 10 steps to stay future-ready and secure your SaaS data. Download the playbook now! Read Now ➝ 🔔 Top News Nimbus Manticore Uses MiniJunk in Critical Infra Attacks — An Iran-aligned cyber espionage group has expanded its operations beyond its traditional Middle Eastern hunting grounds to target critical infrastructure organizations across Western Europe using constantly evolving malware variants and attack tactics. Nimbus Manticore, which overlaps with UNC1549 or Smoke Sandstorm, has been observed targeting defense manufacturing, telecommunications, and aviation companies in Denmark, Portugal, and Sweden. Central to the campaign are MiniJunk, an obfuscated backdoor that gives the attacker persistent access to infected systems, and MiniBrowse, a lightweight stealer with separate versions for stealing credentials from Chrome and Edge browsers. MiniJunk is an updated version of MINIBIKE (aka SlugResin), with the emails directing victims to fake job-related login pages that appear to be associated with companies like Airbus, Boeing, Flydubai, and Rheinmetall. In a further escalation of its tactics, Nimbus Manticore has been observed using the service SSL.com starting around May 2025 to sign their code and pass off malware as legitimate software programs, leading to a "drastic decrease in detections." ShadowV2 Targets Docker for DDoS Attacks — A novel ShadowV2 bot campaign is turning distributed denial-of-service (DDoS) attacks into a full-blown for-hire business by targeting misconfigured Docker containers on AWS. Instead of relying on prebuilt malicious images, the attackers build containers on the victim’s machine itself to launch a Go-based RAT that can launch DDoS attacks. The exact rationale of the approach is unclear, though Darktrace researchers suggest it may have been a way to reduce forensic traces from importing a malicious container. Once installed, the malware sends a heartbeat signal to the C2 server every second, while also polling for new attack commands every five seconds. Cloudflare Mitigates Largest DDoS Attack on Record — Web performance and security company Cloudflare said its systems blocked a record-breaking distributed denial-of-service (DDoS) attack that peaked at 22.2 terabits per second (Tbps) and 10.6 billion packets per second (Bpps), and lasted only 40 seconds. The attack was aimed at a single IP address of an unnamed European network infrastructure company. It's believed that the attack may be powered by the AISURU botnet. Vane Viper Linked to Malicious Campaigns Distributing Malware — A high-volume cybercrime operation known as Vane Viper that's been active for more than a decade is supported by a commercial digital advertising platform with a checkered past. Vane Viper takes advantage of hundreds of thousands of compromised websites and malicious ads that redirect unsuspecting Web users to destinations such as exploit kits, malware, and sketchy websites. The findings suggest that Vane Viper is not acting as an unwitting intermediary but is a complicit enabler and active participant in malicious operations. It also shares parallels with VexTrio Viper in that both emerged from Eastern Europe around 2015 and are controlled by the Russian diaspora in Europe and Cyprus. "URL Solutions, Webzilla, and AdTech Holding form a closely connected trio of firms: domains registered en masse via a registrar steeped in cybercrime, hosted on infrastructure operated by a company that's hosted everything from Methbot to state-sponsored disinformation, and payloads delivered via an ad network long implicated in malvertising," Infoblox said. "Not only has PropellerAds turned a 'blind eye' to criminal abuse of their platform, but indicators [...] suggest – with moderate-to-high confidence – that several ad-fraud campaigns originated from infrastructure attributed to PropellerAds." 2 New Supermicro BMC Bugs Allow Implanting Malicious Firmware — Servers running on motherboards sold by Supermicro contain medium-severity vulnerabilities that can allow hackers to remotely install malicious firmware that runs even before the operating system, providing unprecedented persistence. That said, the caveat is that the threat actor needs to have administrative access to the BMC control interface to perform the update, or distribute them as part of a supply chain attack by compromising the servers used to host firmware updates and replacing the original images with malicious ones, all while keeping the signature valid. Supermicro said it has updated the BMC firmware to mitigate the vulnerabilities, adding that it's currently testing and validating affected products. The current status of the update is unknown. ️🔥 Trending CVEs Hackers don't wait. They exploit newly disclosed vulnerabilities within hours, transforming a missed patch or a hidden bug into a critical point of failure. One unpatched CVE is all it takes to open the door to a full-scale compromise. Below are this week's most critical vulnerabilities, making waves across the industry. Review the list, prioritize patching, and close the window of opportunity before attackers do. This week's list includes — CVE-2025-20362, CVE-2025-20333, CVE-2025-20363 (Cisco), CVE-2025-59689 (Libraesva ESG), CVE-2025-20352 (Cisco IOS), CVE-2025-10643, CVE-2025-10644 (Wondershare RepairIt), CVE-2025-7937, CVE-2025-6198 (Supermicro BMC), CVE-2025-9844 (Salesforce CLI), CVE-2025-9125 (Lectora Desktop), CVE-2025-23298 (NVIDIA Merlin), CVE-2025-59545 (DotNetNuke), CVE-2025-34508 (ZendTo), CVE-2025-27888 (Apache Druid Proxy), CVE-2025-10858, CVE-2025-8014 (GitLab), and CVE-2025-54831 (Apache Airflow). 📰 Around the Cyber World Microsoft Offers ESU for Free in the E.U. — Microsoft has decided to offer free extended security updates for Windows 10 users in the European Economic Area (EEA), following pressure from the Euroconsumers group. "We are pleased to learn that Microsoft will provide a no-cost Extended Security Updates (ESU) option for Windows 10 consumer users in the European Economic Area (EEA)," Euroconsumers said. In other regions, users will need to either enable Windows Backup or pay $30 for the year or redeem 1,000 Microsoft Reward points. It's worth noting that Windows 10 reaches end of support (EoS) on October 14, 2025. Olymp Loader Spotted in the Wild — A new malware loader called Olymp Loader has been spotted in the wild, being propagated via GitHub repositories, or through tools disguised as popular software such as PuTTY, OpenSSL, Zoom, and even a Counter Strike mod called Classic Offensive. Written in assembly language, the malware-as-a-service (MaaS) solution provides built-in stealer modules, including a custom version of BrowserSnatch that's available on GitHub. Campaigns using Olymp have been found to deliver an array of information stealers and remote access trojans like Lumma, Raccoon, WebRAT (aka SalatStealer), and Quasar RAT. The tool was first advertised by a seller named OLYMPO in HackForums on June 5, 2025, as a botnet, before evolving into a loader and a crypter. "The malware seller has published a roadmap that treats Olymp as a bundle comprising Olymp Botnet, Olymp Loader, Olymp Crypter, an install service, and a file‑scanning tool for antivirus testing," Outpost24 said. "It remains to be seen whether OLYMPO can sustain and support a broader malware product suite over time." Regardless, the emergence of yet another bundled crimeware stack can further lower the entry barrier for less experienced threat actors, allowing them to mount widespread campaigns at scale within a short amount of time. Malicious Facebook Ads Lead to JSCEAL Malware — Cybersecurity researchers have disclosed an ongoing campaign that's using bogus ads on Facebook and Google to distribute premium versions of trading platforms like TradingView for free. According to Bitdefender, the activity has also expanded to YouTube, where sponsored ads on the platform are being used to direct users to malware-laced downloads that steal credentials and compromise accounts. These ads are posted via legitimate-but-compromised verified YouTube accounts to serve the ads. The attackers take pains to ensure that the hijacked channels mimic the official TradingView channel by reusing the latter's branding and playlists to build credibility. An unlisted video uploaded by the rebranded channel, titled "Free TradingView Premium – Secret Method They Don’t Want You to Know," is estimated to have racked up more than 182,000 views through aggressive advertising. "The unlisted status is deliberate, of course. By not being publicly searchable, these malicious videos avoid casual reporting and platform moderation," Bitdefender said. "Instead, they are shown exclusively through ad placements, ensuring they reach their targets while remaining hidden from public view." The attacks ultimately led to the deployment of malware known as JSCEAL (aka WEEVILPROXY) to steal sensitive data. LockBit 5.0 Analyzed — The threat actors behind the LockBit ransomware have released a "significantly more dangerous" version, LockBit 5.0, on its sixth anniversary, with advanced obfuscation and anti-analysis techniques, while being capable of targeting Windows, Linux, and ESXi systems. "The 5.0 version also shares code characteristics with LockBit 4.0, including identical hashing algorithms and API resolution methods, confirming this is an evolution of the original codebase rather than an imitation," Trend Micro said. "The preservation of core functionalities while adding new evasion techniques demonstrates the group's strategy of incremental improvement to their ransomware platform." LockBit may not be the most prolific ransomware group it once was ever since its infrastructure was disrupted in a law enforcement operation early last year, but the findings show that it continues to be as aggressive as ever when it comes to refining and retooling its tactics. "The Windows binary uses heavy obfuscation and packing: it loads its payload through DLL reflection while implementing anti-analysis techniques like ETW patching and terminating security services," the company said. "Meanwhile, the newly discovered Linux variant maintains similar functionality with command-line options for targeting specific directories and file types. The ESXi variant specifically targets VMware virtualization environments, designed to encrypt entire virtual machine infrastructures in a single attack." Microsoft Blocks Access to Services Used by Israeli Military Unit — Microsoft has revealed that it "ceased and disabled" a set of services to Unit 8200 within the Israel Ministry of Defense (IMOD) that were used to enable mass surveillance of civilians in Gaza and the West Bank. It said it found evidence "relating to IMOD consumption of Azure storage capacity in the Netherlands and the use of AI services." The secretive contract came to light last month following a report by The Guardian, along with +972 Magazine and Local Call, that revealed how Microsoft's Azure service was being used to store and process millions of Palestinian civilian phone calls made each day in Gaza and the West Bank. The newspaper reported that the trove of intercepted calls amounted to 8,000 terabytes of data and was held in a Microsoft data center in the Netherlands. The collected data has been moved out of the country and is being planned to be transferred to the Amazon Web Services cloud platform. Ransomware Groups Use Stolen AWS Keys to Breach Cloud — Ransomware gangs are using Amazon Web Services (AWS) keys stored in local environments, such as Veeam backup servers, to pivot to a victim's AWS account and steal data with the help of the Pacu AWS exploitation framework, turning what started as an on-premise event into a cloud compromise. "Threat actors are becoming increasingly adept at exploiting cloud environments — leveraging compromised AWS keys, targeting backup servers, and using advanced attack frameworks to evade detection," Varonis said. Meta Unveils Ad-Free Option in the U.K. — Meta has launched an ad-free experience for Facebook and Instagram in the U.K., allowing users to pay £2.99 a month to access the platforms without ads on the web, and £3.99 a month for Android and iOS. "We will notify UK users over the age of 18 that they have the choice to subscribe to Facebook and Instagram for a fee to use these services without seeing ads," the company said. "A reduced, additional fee of £2/month on the web or £3/month on iOS and Android will automatically apply for each additional account listed in a user's Account Center." Meta has significant hurdles in rolling out the scheme in the E.U., causing it to walk back its ad model, offering users the choice to receive "less personalized ads" that are full-screen and temporarily unskippable. Earlier this May, the European Commission said the model does not comply with the Digital Markets Act (DMA) and fined Meta €200 million. In response, the company said it would need to make modifications to the model that "could result in a materially worse user experience for European users and a significant impact." In a report published in July 2025, privacy non-profit noyb said: "'Pay or Okay' has spread throughout the E.U. in recent years and can now be found on hundreds of websites. However, data protection authorities still haven't adopted a consistent E.U.-wide approach to deal with these systems. They should have agreed on this long ago." Dutch Teen Duo Arrested Over Alleged 'Wi-Fi Sniffing' for Russia — Two teenagers have been arrested in the Netherlands on suspicion of espionage, reportedly on behalf of Russian intelligence agencies. The boys, both aged 17, were arrested on Monday. One has been remanded in custody while the other has been released on home bail. The arrests are related to laws regarding state-sponsored interference, but additional details have been withheld due to the age of the suspects and the ongoing investigation. The teens are alleged to have been tasked with carrying a "Wi-Fi sniffer" along a route past buildings in The Hague, including the headquarters of Europol and Eurojust, as well as several embassies. Akira Ransomware Breaching MFA-Protected SonicWall VPN Accounts — Cybersecurity researchers have warned about an "aggressive" Akira ransomware campaign targeting SonicWall VPNs to rapidly deploy the locker as part of an attack wave that began on July 21, 2025. "In almost all intrusions, ransomware encryption took place in under four hours from initial access, with a staging interval as short as 55 minutes in some instances," Arctic Wolf said in a new report. Other commonly observed post-exploitation activities include internal network scanning, Impacket SMB activity tied to discovery, Active Directory discovery, and VPN client logins originating from Virtual Private Server (VPS) hosting providers. Targeting firewall and LDAP-synchronized, several intrusions have involved the threat actors leveraging the dedicated account used for Active Directory synchronization to log in via SSL VPN, despite not being intentionally configured for such access. In more than 50% of the analyzed intrusions, login attempts were observed against accounts with the One Time Password (OTP) feature enabled. "Malicious logins were followed within minutes by port scanning, Impacket SMB activity, and rapid deployment of Akira ransomware," the company noted. "Victims spanned across multiple sectors and organization sizes, suggesting opportunistic mass exploitation." Four People to Face Trial Over Greece Spyware Scandal — Four individuals, two Israeli and two Greek employees of spyware vendor Intellect, are expected to face trial in Greece over the use of the Predator surveillance tool by the ruling government in 2022 to eavesdrop on judges, senior military officers, journalists, and the opposition. But to date, no government officials have been charged in connection with the scandal. Phishing Emails Lead to DarkCloud Stealer — The information stealer known as DarkCloud is being distributed via phishing emails masquerading as financial correspondence that trick recipients into opening malicious ZIP archives. The stealer, besides adding new layers of encryption and evasion, targets web browser data, keystrokes, FTP credentials, clipboard contents, email clients, files, and cryptocurrency wallets. Stolen credentials/data are sent to attacker-controlled Telegram, FTP, SMTP, or Web Panel (PHP) endpoints. It's marketed on Telegram by a user named @BluCoder and on the clearnet through the domain darkcloud.onlinewebshop[.]net. It's advertised as the "best surveillance software for parents, spouses, and employers." Cybersecurity company eSentire said: "DarkCloud is an information-stealing malware written in VB6 and is actively being updated to target a wide range of applications, including email clients, FTP clients, cryptocurrency wallets, web browsers and supports numerous other information-stealing capabilities like keystroke/clipboard harvesting, clipboard hijacking, and file collection." Nupay Plugs "Configuration Gap" — Indian fintech company Nupay said it addressed a configuration gap after UpGuard flagged an unprotected Amazon S3 storage bucket containing more than 270,000 documents related to bank transfers of Indian customers. The exposed information included bank account numbers, transaction amounts, names, phone numbers, and email addresses. The data was linked to at least 38 different banks and financial institutions. It's currently not known how long the data was left publicly accessible on the internet, although misconfigurations of this kind are not uncommon. Nupay told TechCrunch the bucket exposed a "limited set of test records with basic customer details," and that a majority of the details were "dummy or test files." Top AI Chatbots Provide Answers with False Claims — Some of the top AI chatbots' tendency to repeat false claims on topics in the news increased nearly twice as much as they did last year, according to an audit by NewsGuard. The disinformation rates of the chatbots have almost doubled, going from 18% in August 2024 to 35% a year later, with the tools providing false claims to news prompts more than one-third of the time. "Instead of citing data cutoffs or refusing to weigh in on sensitive topics, the LLMs now pull from a polluted online information ecosystem — sometimes deliberately seeded by vast networks of malign actors, including Russian disinformation operations — and treat unreliable sources as credible," it said. Israel's PM Says His U.N. Speech Streamed Directly to Gaza Cellphones — Israeli Prime Minister Benjamin Netanyahu said his speech at the United Nations last week was also pushed to mobile phones of Gaza residents in an unprecedented operation. "Ladies and gentlemen, thanks to special efforts by Israeli intelligence, my words are now also being carried," Netanyahu said. "They're streamed live through the cell phones of Gaza." There is no evidence for how it would've worked or if this actually took place. Fake Teams Installers Lead to Oyster Malware — Threat actors are abusing SEO poisoning and malvertising to lure users searching for Teams online into downloading a fake installer that leads to malware called Oyster (aka Broomstick or CleanUpLoader). "Oyster is a modular, multistage backdoor that provides persistent remote access, establishes Command and Control (C2) communications, collects host information, and enables the delivery of follow-on payloads," Blackpoint said. "By hiding behind a widely used collaboration platform, Oyster is well positioned to evade casual detection and blend into the noise of normal enterprise activity." The activity has been attributed by Conscia to Vanilla Tempest (aka Storm-0832 or Vice Society). Flaw in Streamlit Framework Patched — Cybersecurity researchers discovered a vulnerability in the Streamlit app deployment framework that can allow attackers to hijack underlying cloud servers. "To do that, threat actors bypass file type restrictions and take full control of a misconfigured cloud instance running Streamlit applications," Cato Networks said. In a hypothetical attack scenario, bad actors can exploit a file upload vulnerability in the framework to rewrite server files and deploy new SSH configurations. Streamlit released a security patch in March. 🎥 Cybersecurity Webinars Beyond the Hype: Practical AI Workflows for Cybersecurity Teams — AI is transforming cybersecurity workflows, but the best results come from blending human oversight with automation. In this webinar, Thomas Kinsella of Tines shows how to pinpoint where AI truly adds value, avoid over-engineering, and build secure, auditable processes that scale. Halloween Special: Real Breach Stories and the Fix to End Password Horrors — Passwords are still a prime target for attackers—and a constant pain for IT teams. Weak or reused credentials, frequent helpdesk resets, and outdated policies expose organizations to costly breaches and reputational damage. In this Halloween-themed webinar from The Hacker News and Specops Software, you’ll see real breach stories, discover why traditional password policies fail, and watch a live demo on blocking compromised credentials in real time—so you can end password nightmares without adding user friction. From Code to Cloud: Learn How to See Every Risk, Fix Every Weak Link — Modern AppSec needs end-to-end visibility from code to cloud. Without it, hidden flaws delay fixes and raise risk. This webinar shows how code-to-cloud mapping unites dev, DevOps, and security to prioritize and remediate faster, forming the backbone of effective ASPM. 🔧 Cybersecurity Tools Pangolin — It is a self-hosted reverse proxy that securely exposes private services to the internet without opening firewall ports. It creates encrypted WireGuard tunnels to connect isolated networks and includes built-in identity and access management, so you can control who reaches your internal apps, APIs, or IoT devices. Ideal for developers, DevOps teams, or organizations needing safe remote access, Pangolin simplifies sharing internal resources while keeping them protected behind strong authentication and role-based permissions. AI Red Teaming Playground — Microsoft’s AI Red Teaming Playground Labs offers hands-on challenges to practice probing AI systems for security gaps. Built on Chat Copilot and powered by the open-source PyRIT framework, it lets you simulate prompt injections and other adversarial attacks to identify hidden risks in generative AI before deployment. Disclaimer: The tools featured here are provided strictly for educational and research purposes. They have not undergone full security audits, and their behavior may introduce risks if misused. Before experimenting, carefully review the source code, test only in controlled environments, and apply appropriate safeguards. Always ensure your usage aligns with ethical guidelines, legal requirements, and organizational policies. 🔒 Tip of the Week Hardening Active Directory Against Modern Attacks — Active Directory is a prime target—compromise it and attackers can own your network. Strengthen its defenses starting with Kerberos FAST (Flexible Authentication Secure Tunneling), which encrypts pre-authentication traffic to block offline password cracking and relay attacks. Deploy it in “Supported” mode, monitor KDC events (IDs 34, 35), then enforce “Required” once all clients are ready. Run PingCastle for a rapid forest health check and use ADeleg/ADeleginator to uncover dangerous over-delegation in OUs or service accounts. Harden password security with Fine-Grained Password Policies (FGPP) and automate local admin password rotation using LAPS or Lithnet Password Protection to block breached credentials in real time. Tighten other control layers: use AppLocker Inspector/Gen to lock down application execution and GPOZaurr to detect orphaned or risky Group Policy Objects. Scan AD Certificate Services with Locksmith to close misconfigurations and use ScriptSentry to catch malicious logon scripts that enable stealthy persistence. Finally, apply CIS or Microsoft security baselines and generate custom Attack Surface Reduction rules with ASRGen to block exploit techniques that bypass standard policies. This layered, rarely implemented strategy raises the cost of compromise and forces even advanced adversaries to work far harder. Conclusion These headlines show how tightly connected our defenses must be in today’s threat landscape. No single team, tool, or technology can stand alone—strong security depends on shared awareness and action. Take a moment to pass these insights along, spark a conversation with your team, and turn this knowledge into concrete steps. Every patch applied, policy updated, or lesson shared strengthens not just your own organization, but the wider cybersecurity community we all rely on.

From fake CAPTCHAs to RATs: Inside 2025’s cyber deception threat trends Cybercriminals are getting better at lying. That’s the takeaway from a new LevelBlue report, which outlines how attackers are using social engineering and legitimate tools to quietly move through environments before they’re caught. Data showing at what stage an incident was detected (Source: LevelBlue) In that short window, the number of customers affected by security incidents nearly tripled. The rate jumped from 6 percent in late 2024 to 17 percent in early 2025. More than half of those incidents began at the initial access stage. Once attackers were in, they moved quickly. The average time between compromise and lateral movement fell below 60 minutes. In some cases, it took less than 15. That speed is possible because attackers continue to rely on familiar tools. Remote Desktop Protocol remains the most common method for moving from one system to another. Remote monitoring and management (RMM) software is widely used to keep access active. LevelBlue found many cases where multiple RMM tools were installed on the same host. Tunneling utilities help attackers avoid firewalls and keep their activity hidden. These tactics are not new, but they are being used with greater precision and automation. “A striking development in the first half of 2025 is how much more sophisticated threat actors have become at deception,” said Fernando Martinez Sidera, Lead Threat Researcher at LevelBlue. “They’re moving beyond traditional BEC schemes and using targeted social engineering to manipulate users into opening the door. Once inside, they’re deploying remote access trojans and quickly covering their tracks, allowing them to move laterally through networks with alarming speed. This isn’t a one-off trend – we fully expect this shift to continue throughout 2026.” Another trend is the drop in incidents tied to business email compromise. BEC still accounts for the largest share of initial access, at 57 percent, but this is down from 74 percent in the last reporting period. That shift is linked to the sharp rise in fake CAPTCHA scams and help desk impersonation. Social engineering now makes up 39 percent of initial access methods, nearly triple the rate from late 2024. ClickFix is the campaign most often cited. In these attacks, users are tricked into copying a line of code into the Windows Run box. This is made to look like a routine CAPTCHA or security prompt. But instead of verifying anything, the user is launching a PowerShell command that connects to an external server and downloads malware. The payload is often a Remote Access Trojan such as NetSupport, Quasar, or Lumma Stealer. ClickFix-related activity rose more than 1,400 percent in just six months. Once attackers get inside, they are relying on a combination of RMM tools and tunneling to maintain access. Tools like Plink and Ngrok are commonly used to create hidden connections. These blend in with normal IT operations, which makes them harder for defenders to spot. Some cases involved two or even three RMM tools installed at once. The malware trends reflect this approach as well. Lumma Stealer was the most frequently seen infostealer in early 2025. It targets Windows systems and collects browser data, credentials, and cryptocurrency wallets. It is often delivered through phishing emails or fake CAPTCHA pages. Remote Access Trojans were also active. These included AsyncRAT, Remcos, and StealC. Each provides the attacker with full remote access and the ability to launch new attacks. While data theft is on the rise, ransomware and encryption events have gone down. LevelBlue saw a 78 percent drop in ransomware cases and a 94 percent drop in unauthorized access incidents. That doesn’t mean the threat is gone. It likely signals that attackers are getting what they want without triggering alarms. Defenders should take note. The report urges organizations to focus on user training, especially around social engineering tactics like fake CAPTCHAs. It also recommends tighter control over PowerShell, script execution, and tunneling tools. Segmenting networks, limiting lateral movement, and reviewing endpoint security policies are also key steps.

AsyncRAT has cemented its place as a cornerstone of modern malware and as a pervasive threat that has evolved into a sprawling network of forks and variants. While its capabilities are not that impressive on their own, it is the open-source nature of AsyncRAT that has truly amplified its impact. This blogpost provides an overview and analysis of the most relevant forks of AsyncRAT, drawing connections between them and showing how they have evolved. Key points of this blogpost: We provide unique insights into the landscape of AsyncRAT and its numerous variants in order to navigate the labyrinth of forks easily. In the effort to map the vast hierarchy of AsyncRAT’s forks, we uncover their unique interconnections and document how these variants can be distinguished. We explore less common variants that feature unique plugins, ranging from a basic screamer plugin to a USB malware spreader. Origins of AsyncRAT You may have heard of AsyncRAT, short for asynchronous remote access trojan. This open-source RAT was released on GitHub in 2019 by a user going by the name of NYAN CAT. Developed in C#, it offers a wide range of typical RAT functionalities, including keylogging, screen capturing, credential theft, and more. Its simplicity and open-source nature has made it a popular choice among cybercriminals, leading to its widespread use in various cyberattacks. But where does it come from? We believe that the groundwork for AsyncRAT was laid earlier by the Quasar RAT, which has been available on GitHub since 2015 and features a similar approach. Both are written in C#; however, their codebases differ fundamentally, suggesting that AsyncRAT was not just a mere fork of Quasar, but a complete rewrite. A fork, in this context, is a personal copy of someone else’s repository that one can freely modify without affecting the original project. The main link that ties them together lies in the custom cryptography classes used to decrypt the malware configuration settings. Specifically, these are classes Aes256 and Sha256, which fall under the Client.Algorithm namespace for AsyncRAT and the Quasar.Common.Cryptography namespace for Quasar. Figure 1 shows identical code being used in both implementations of Aes256. The same code is mostly copied and pasted, including the same salt value and decryption settings. This class, together with Sha256, leads us to believe that AsyncRAT was to some degree influenced by the Quasar RAT. Apart from these similarities, AsyncRAT introduced significant improvements, particularly in its modular architecture and enhanced stealth features, which make it more adaptable and harder to detect in modern threat environments. Its plugin-based architecture and ease of modification have sparked the proliferation of many forks, pushing the boundaries even further. Fork labyrinth Ever since it was released to the public, AsyncRAT has spawned a multitude of new forks that have built upon its foundation. Some of these new versions have expanded on the original framework, incorporating additional features and enhancements, while others are essentially the same version in different clothes. Fork hierarchy Figure 2 illustrates how some of the more prevalent AsyncRAT forks have evolved from one another over time. In the middle of the tree are DcRat and VenomRAT. Our analysis has shown that they are the most widely deployed variants, together accounting for a significant number of campaigns. Other lesser-known forks occupy smaller but nonetheless notable portions of the pie. Figure 3 depicts the distribution of the most prevalent forks according to our telemetry. DcRat offers a notable improvement over AsyncRAT in terms of features and capabilities. One of the more obvious changes is the data structure used for transferring data back and forth. It utilizes MessagePack, a well-known open-source library for more efficient binary data serialization. DcRat also implements evasion techniques like AMSI and ETW patching, which work by disabling security features that detect and log malicious behavior – AMSI patching prevents script scanning, while ETW patching blocks event tracing. Additionally, it features an antiprocess system whereby processes whose names match those in a denylist are terminated. Blocklisted programs include Taskmgr.exe, ProcessHacker.exe, MsMpEng.exe, Taskkill.exe, etc. It’s also worth noting that DcRat’s plugin base builds upon AsyncRAT and further extends its functionality. Among the added plugins are capabilities such as webcam access, microphone recording, Discord token theft, and “fun stuff”, a collection of plugins used for joke purposes like opening and closing the CD tray, blocking keyboard and mouse input, moving the mouse, turning off the monitor, etc. Notably, DcRat also introduces a simple ransomware plugin that uses the AES-256 cipher to encrypt files, with the decryption key distributed only once the plugin has been requested. Apart from that, there appear to be many small changes like a different choice of salt (a string instead of a binary value), deliberately changed variable names to further evade detection, dynamic API resolution, and many more. VenomRAT, on the other hand, was likely inspired by DcRat, as evidenced in the Identifying versions section. The malware is packed with so many features that it could be considered a separate threat on its own. We have chosen to group it under AsyncRAT as their client parts are very similar to each other. VenomRAT’s features and plugins have been documented in more detail by other vendors, so we won’t dive deep into them in this blogpost. Not all RATs are serious in nature though, and this applies equally to AsyncRAT forks. Clones like SantaRAT or BoratRAT (see Figure 4) are meant to be jokes. In the case of the former, its authors have themselves acknowledged that the project was basically “shamelessly ripped off of DcRat”. Yet, despite this, we have found instances of real-world usage of them in the wild. While doing the analysis, we used various methods to identify and categorize each sample. It should be noted that the research was primarily on the client part of the malware, as this binary is what ends up on victims’ machines. It contains useful information such as malware configuration and where information about the C&C can be found. The quickest and most straightforward way to identify a fork is to peek directly into the malware’s configuration, which can usually be found in the InitializeSettings function. The configuration values are encrypted with AES-256 and stored as base64 strings in the Settings class. In most cases, the correct fork name is readily available and conveniently labeled as Version. In about 90% of our analyzed samples, the Version field contains some meaningful description of either the fork’s name or the malware author’s pseudonym. The remaining samples had this field intentionally left blank. Figure 5 illustrates the typical configuration initialization procedure found in DcRat and its derivatives (VenomRAT in this case). If the Version field is empty, sometimes it’s possible to get another clue by looking at the Salt value used for encrypting the configuration. Attackers often neglect this parameter when copy-pasting their own fork. The Salt value can be found in the Client.Algorithm.Aes256 class, as seen in Figure 6. Yet another way to get more insight is to look for the embedded certificate used to authenticate the C&C server. It’s also located in the configuration as a base64-encoded value. Unpacking this value often reveals further information about the server, such as common name, organization, and organizational unit. If a particular fork has its own name in the Version field, it is often possible to trace back the previous fork upon which it was likely based by looking at the CN field. Figure 7 shows a DER-encoded certificate that reveals the BoratRAT fork, after extraction and decoding. The techniques mentioned above primarily apply to trivial cases where malware authors either did not bother to remove traces or used a default certificate. A more sophisticated method for identifying AsyncRAT servers exists, which involves sending a specially crafted packet to the C&C server. This approach is explained in detail in this Axel Mahr blogpost. Should everything else fail, determining the sample origin can ultimately be done the old-fashioned way, by manually inspecting the code. This involves a detailed analysis of the code’s structure, syntax, and functionality, comparing them against the patterns of previously categorized samples. Extensive fork list We have highlighted here some of the more prominent AsyncRAT forks. Due to the sheer number of available forks, it is not feasible to cover every single one. For completeness, Figure 8 provides an extended list of AsyncRAT forks known to be used for malicious purposes, as seen in ESET telemetry to date. Exploring lesser-known variants So far, we’ve mentioned some of the major forks that dominate the landscape. In this section, we have cherry-picked some lesser-known forks that enhance AsyncRAT’s functionality beyond the features included in the default versions. These exotic forks are often the work of one person or group and they make up less than 1% of the volume of AsyncRAT samples. NonEuclid RAT This fork stands out primarily for its inclusion of new plugins, on top of the default ones. While some plugins might seem trivial or geared towards “fun stuff”, others, like WormUsb.dll, have distinctly malicious purposes. Table 1 lists a selection of NonEuclid RAT plugins that deviate from the standard plugin base seen in regular forks. Table 1. Selection of NonEuclid RAT plugins we deemed interesting Screamer.dll There are five jump scare images built into the plugin. An attacker sends a command that indicates which image they want to use, along with the WAV file to be played, and the delay after which the jump scare is triggered. Figure 9 shows the first three prebundled images an attacker may choose from. Piano.dll This plugin plays arbitrary WAV files. All sound files are stored in %appdata%\Piano. piano.dll supports three commands: SetSound – adds a new sound file to %appdata%\Piano, PlayMisc – plays a requested sound file from %appdata%\Piano, and ClientAdd – retrieves multiple sound files from the C&C server. Service.dll This plugin facilitates managing Windows services, such as starting, stopping, and pausing services. Maps.dll This is a simple plugin to collect geolocation information from the victim. It uses the .NET GeoCoordinateWatcher class to register a callback function to collect data each time the location is available. Among the collected information are latitude, longitude, username, and computer name. WormUsb.dll This plugin compromises PE files with an arbitrary payload specified by the attacker. Despite the term Usb in WormUsb.dll, this plugin targets several locations based on the command provided: InfectExe – compromises an individual PE file, InfectExeInWindows – targets PE files in personal folders (Desktop, Documents, Downloads, My Music), and InfectUsbExe – targets PE files in all drives excluding the C drive. Under the hood, it works by moving the original file to a temporary location. Then it drops a small stub in place of the original file. This stub’s resource section is then populated to contain both the original file and the specified payload, both of which are compressed and encrypted with a per-file key, generated at the time of construction. Following this, the malware then obfuscates the stub by introducing proxy methods, adding custom control flow obfuscation, and variable renaming. As a final touch, it embeds the original icon and metadata in the modified stub. Figure 10 shows the function, with the original method names, responsible for compromising a single file. When such a compromised file is executed, it first decrypts, unpacks and runs the payload program, then proceeds to do the same with the original program. Brute.dll This plugin supports brute forcing of both SSH and FTP protocols from the client side. The attacker feeds it three parameters: host, login, and password, and the plugin will try to connect using those credentials. If the connection succeeds, the credentials are sent back to the attacker with a flag indicating success. It’s not difficult to imagine a scenario whereby an attacker might use this sort of attack to distribute brute forcing across a large pool of compromised machines, thus circumventing restrictions based solely on the IP address. Signature Antivirus.dll The name of the plugin implies it might have something to do with antivirus functionality. While this is technically true, it is also a case of the most primitive, manual antivirus solution ever created. The plugin receives a list of MD5 hashes from the attacker and compares them to the hashes of all EXE files it finds on every disk. If a matching file is found, it triggers the oddly named DetectVirus function, which merely deletes the file without any further analysis. This makes the name of the plugin very dubious at best. In the hands of the malware author, it may have been used to delete competitor malware, or really just any arbitrary file. cliper.dll This is a standalone clipper that continuously monitors the victim’s clipboard, and if a cryptocurrency wallet address is detected, it is replaced with one provided by the attacker. Attacker-provided wallets are only sent when the plugin is first requested; they are not hardcoded in the plugin. Additionally, in Figure 11, we can also see some credit card entries. This plugin contains an extensive list of regexes that can detect both cryptocurrency wallets and credit cards, and in the case of the latter they just get sent back to the attacker. JasonRAT Identified in 2024, this variant shows continued signs of activity. It is interesting in that it employs obscure variable-naming conventions reminiscent of “satanic” terms from what the malware author refers to as the Book of Jason. In Figure 12, you can see typical AsyncRAT configuration values (in base64), but with renamed variables, while Figure 13 shows the logic of the main entry point of the malware. Besides the usual configuration values, this variant further extends the client by introducing country targeting. Another strange feature is the choice of string obfuscation. A subset of the strings employs an extra layer of obfuscation by utilizing an extended variant of Morse code. Both uppercase and lowercase letters are included, as well as some special characters. Figure 14 shows the encoded registry key string using an extended mapping. XieBroRAT This is a RAT with Chinese localization. It introduces a new plugin, BrowserGhost.dll, which is a browser-credential stealer. Another plugin, Abstain.dll, provides interaction with Cobalt Strike servers by making a reverse connection. To increase the coverage, the malware provides the delivery chain in several different languages. The standard .NET client binary can be wrapped and distributed via shellcode, VBS, or JavaScript. Finally, the author further extended the malware by borrowing heavily from open-source projects, integrating tools like mimikatz, SharpWifiGrabber, SharpUnhooker, etc. Conclusion AsyncRAT’s rise and its subsequent forks highlight the inherent risks of open-source malware frameworks. Our analysis revealed a diverse and evolving ecosystem of derivatives, ranging from persistent threats like DcRat and VenomRAT to lesser-known novelty forks like JasonRAT and BoratRAT, which seem to serve more as curiosities than credible threats. All of these forks not only extend AsyncRAT’s technical capabilities but also demonstrate how quickly and creatively threat actors can adapt and repurpose open-source code. The widespread availability of such frameworks significantly lowers the barrier to entry for aspiring cybercriminals, enabling even novices to deploy sophisticated malware with minimal effort. This democratization of malware development – especially considering the rising popularity of LLMs and potential to misuse their capabilities – further accelerates the creation and customization of malicious tools, contributing to a rapidly expanding and increasingly complex threat landscape. In light of these trends, it is reasonable to anticipate that future forks may incorporate more advanced obfuscation, modularity, and evasion capabilities. This potential evolution underscores the importance of proactive detection strategies and deeper behavioral analysis to effectively address emerging threats. IoCs A comprehensive list of indicators of compromise (IoCs) can be found in our GitHub repository. Files MITRE ATT&CK techniques This table was built using version 17 of the MITRE ATT&CK framework.

Attacks that leverage malicious open-source packages are becoming a major and growing threat. This type of attacks currently seems commonplace, with reports of infected packages in repositories like PyPI or npm appearing almost daily. It would seem that increased scrutiny from researchers on these repositories should have long ago minimized the profits for cybercriminals trying to make a fortune from malicious packages. However, our investigation into a recent cyberincident once again confirmed that open-source packages remain an attractive way for attackers to make easy money. Infected out of nowhere In June 2025, a blockchain developer from Russia reached out to us after falling victim to a cyberattack. He’d had around $500,000 in crypto assets stolen from him. Surprisingly, the victim’s operating system had been installed only a few days prior. Nothing but essential and popular apps had been downloaded to the machine. The developer was well aware of the cybersecurity risks associated with crypto transactions, so he was vigilant and carefully reviewed his every step while working online. Additionally, he used free online services for malware detection to protect his system, but no commercial antivirus software. The circumstances of the infection piqued our interest, and we decided to investigate the origins of the incident. After obtaining a disk image of the infected system, we began our analysis. Syntax highlighting with a catch As we examined the files on the disk, a file named extension.js caught our attention. We found it at %userprofile%\.cursor\extensions\solidityai.solidity-1.0.9-universal\src\extension.js. Below is a snippet of its content: This screenshot clearly shows the code requesting and executing a PowerShell script from the web server angelic[.]su: a sure sign of malware. It turned out that extension.js was a component of the Solidity Language extension for the Cursor AI IDE, which is based on Visual Studio Code and designed for AI-assisted development. The extension is available in the Open VSX registry, used by Cursor AI, and was published about two months ago. At the time this research, the extension had been downloaded 54,000 times. The figure was likely inflated. According to the description, the extension offers numerous features to optimize work with Solidity smart contract code, specifically syntax highlighting: We analyzed the code of every version of this extension and confirmed that it was a fake: neither syntax highlighting nor any of the other claimed features were implemented in any version. The extension has nothing to do with smart contracts. All it does is download and execute malicious code from the aforementioned web server. Furthermore, we discovered that the description of the malicious plugin was copied by the attackers from the page of a legitimate extension, which had 61,000 downloads. How the extension got on the computer So, we found that the malicious extension had 54,000 downloads, while the legitimate one had 61,000. But how did the attackers manage to lull the developer’s vigilance? Why would he download a malicious extension with fewer downloads than the original? We found out that while trying to install a Solidity code syntax highlighter, the developer searched the extension registry for solidity. This query returned the following: In the search results, the malicious extension appeared fourth, while the legitimate one was only in eighth place. Thus, while reviewing the search results, the developer clicked the first extension in the list with a significant number of downloads – which unfortunately proved to be the malicious one. The ranking algorithm trap How did the malicious extension appear higher in search results than the legitimate one, especially considering it had fewer downloads? It turns out the Open VSX registry ranks search results by relevance, which considers multiple factors, such as the extension rating, how recently it was published or updated, the total number of downloads, and whether the extension is verified. Consequently, the ranking is determined by a combination of factors: for example, an extension with a low number of downloads can still appear near the top of search results if that metric is offset by its recency. This is exactly what happened with the malicious plugin: the fake extension’s last update date was June 15, 2025, while the legitimate one was last updated on May 30, 2025. Thus, due to the overall mix of factors, the malicious extension’s relevance surpassed that of the original, which allowed the attackers to promote the fake extension in the search results. The developer, who fell into the ranking algorithm trap, didn’t get the functionality he wanted: the extension didn’t do any syntax highlighting in Solidity. The victim mistook this for a bug, which he decided to investigate later, and continued his work. Meanwhile, the extension quietly installed malware on his computer. From PowerShell scripts to remote control As mentioned above, when the malicious plugin was activated, it downloaded a PowerShell script from https://angelic[.]su/files/1.txt. The script checks if the ScreenConnect remote management software is installed on the computer. If not, it downloads a second malicious PowerShell script from: https://angelic[.]su/files/2.txt. This new script then downloads the ScreenConnect installer to the infected computer from https://lmfao[.]su/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest and runs it. From that point on, the attackers can control the infected computer via the newly installed software, which is configured to communicate with the C2 server relay.lmfao[.]su. Data theft Further analysis revealed that the attackers used ScreenConnect to upload three VBScripts to the compromised machine: a.vbs b.vbs m.vbs Each of these downloaded a PowerShell script from the text-sharing service paste.ee. The download URL was obfuscated, as shown in the image below: The downloaded PowerShell script then retrieved an image from archive[.]org. A loader known as VMDetector was then extracted from this image. VMDetector attacks were previously observed in phishing campaigns that targeted entities in Latin America. The loader downloaded and ran the final payload from paste.ee. Our analysis of the VBScripts determined that the following payloads were downloaded to the infected computer: Quasar open-source backdoor (via a.vbs andb.vbs ), Stealer that collected data from browsers, email clients, and crypto wallets (via m.vbs ). Kaspersky products detect this malware asHEUR:Trojan-PSW.MSIL.PureLogs.gen . Both implants communicated with the C2 server 144.172.112[.]84, which resolved to relay.lmfao[.]su at the time of our analysis. With these tools, the attackers successfully obtained passphrases for the developer’s wallets and then syphoned off cryptocurrency. New malicious package The malicious plugin didn’t last long in the extension store and was taken down on July 2, 2025. By that time, it had already been detected not only by us as we investigated the incident but also by other researchers. However, the attackers continued their campaign: just one day after the removal, they published another malicious package named “solidity”, this time exactly replicating the name of the original legitimate extension. The functionality of the fake remained unchanged: the plugin downloaded a malicious PowerShell script onto the victim’s device. However, the attackers sought to inflate the number of downloads dramatically. The new extension was supposedly downloaded around two million times. The following results appeared up until recently when users searched for solidity within the Cursor AI development environment (the plugin is currently removed thanks to our efforts). The updated search results showed the legitimate and malicious extensions appearing side-by-side in the search rankings, occupying the seventh and eighth positions respectively. The developer names look identical at first glance, but the legitimate package was uploaded by juanblanco, while the malicious one was uploaded by juanbIanco. The font used by Cursor AI makes the lowercase letter l and uppercase I appear identical. Therefore, the search results displayed two seemingly identical extensions: the legitimate one with 61,000 downloads and the malicious one with two million downloads. Which one would the user choose to install? Making the right choice becomes a real challenge. Similar cyberattacks It’s worth noting that the Solidity extensions we uncovered are not the only malicious packages published by the attackers behind this operation. We used our open-source package monitoring tool to find a malicious npm package called “solsafe”. It uses the URL https://staketree[.]net/1.txt to download ScreenConnect. In this campaign, it’s also configured to use relay.lmfao[.]su for communication with the attackers. We also discovered that April and May 2025 saw three malicious Visual Studio Code extensions published: solaibot, among-eth, and blankebesxstnion. The infection method used in these threats is strikingly similar to the one we described above. In fact, we found almost identical functionality in their malicious scripts. In addition, all of the listed extensions perform the same malicious actions during execution, namely: Download PowerShell scripts named 1.txt and2.txt . Use a VBScript with an obfuscated URL to download a payload from paste.ee . Download an image with a payload from archive.org . This leads us to conclude that these infection schemes are currently being widely used to attack blockchain developers. We believe the attackers won’t stop with the Solidity extensions or the solsafe package that we found. Takeaways Malicious packages continue to pose a significant threat to the crypto industry. Many projects today rely on open-source tools downloaded from package repositories. Unfortunately, packages from these repositories are often a source of malware infections. Therefore, we recommend extreme caution when downloading any tools. Always verify that the package you’re downloading isn’t a fake. If a package doesn’t work as advertised after you install it, be suspicious and check the downloaded source code. In many cases, malware installed via fake open-source packages is well-known, and modern cybersecurity solutions can effectively block it. Even experienced developers must not neglect security solutions, as these can help prevent an attack in case a malicious package is installed.