twilio

Chaos ransomware msaRAT hides its C2 channel inside a legitimate browser process Cisco Talos has identified a Rust-based remote access trojan it attributes to the Chaos ransomware group, named msaRAT after four of the binding names left in the binary. The tool starts its own instance of Chrome or Edge on the victim machine and controls it through Chrome DevTools Protocol, a debugging interface built into both browsers. The browser then carries the command-and-control traffic over a WebRTC channel. Once installed, the RAT process keeps all of its own traffic on 127.0.0[.]1. External traffic leaves from a legitimate browser process: HTTPS to a Cloudflare developer domain, a STUN request to a Google server, then WebRTC to a Twilio relay. Shell commands execute on the victim host and the output returns along the same path. The design needs a browser it can locate on the machine. Chaos operates as ransomware-as-a-service, confirmed active since February 2025, using vishing and spam email for initial access and double extortion afterward. Michael Szeliga, a Cisco Talos researcher and one of the authors of the analysis, was asked what this changes for defenders and whether other groups will follow. “This continues the shift defenders have already been dealing with, where attackers use legitimate cloud and collaboration services to hide C2 traffic. I expect browser-mediated C2 and similar approaches to become more prevalent, much like what was demonstrated with Praetorian’s TURNt research using Microsoft Teams TURN infrastructure. Threat actors will continue looking for ways to hide inside trusted applications and services, making behavior-based detection increasingly important, especially in ransomware attacks,” Szeliga told Help Net Security. Delivery arrives dressed as a Windows update The operator already has access to the machine when this starts. A curl.exe command pulls an MSI impersonating a Windows update into ProgramData. The attacker then executes it. The URL specifies port 443, the traffic is plain HTTP, and firewall rules that read port numbers with no protocol inspection pass it through. Installation ends with a custom action loading a DLL from inside the installer straight into memory. That DLL is msaRAT. msaRAT hunts for a browser on disk msaRAT checks six fixed locations drawn from environment variables, split between Chrome and Edge, then falls back to a registry lookup that covers Chrome alone. Finding a browser, it launches a fresh process headless, with the remote debugging port enabled and a user-data directory the malware specifies. Finding none, the whole C2 mechanism sits idle. The RAT connects to that debugging port over the loopback address, opens a tab in the instance it started, and turns off Content Security Policy for the page. It registers callbacks the browser’s JavaScript uses to report back, then injects JavaScript stored in plaintext inside the binary. What the network sees is a browser doing WebRTC The injected JavaScript pulls connection configuration from a Cloudflare Workers endpoint, with Origin and Referer headers set to Microsoft’s website. A Google STUN server handles the NAT lookup that finds the host’s external address. Signaling runs through the Workers endpoint, and the operator’s reply is built to prevent a direct connection, which forces every byte through a Twilio TURN relay. The attacker’s real server address stays out of the packet capture. Cloudflare Workers exits the picture once the channel opens. Blocking *.workers.dev to cut off that signaling broadly affects legitimate Cloudflare Workers deployments at the same time. Commands come back as cmd.exe Traffic inside the channel carries two layers of encryption. DTLS covers the transport by specification, handled by the browser. msaRAT encrypts the payload separately, using a key negotiated the moment the C2 connection opens. Two of the frame types carry a command string, which the RAT hands to cmd.exe for execution. The output goes back out the same channel. The remaining frames open and close channels, perform the key exchange, and kill the browser process. Catch it at the host Szeliga was asked which vantage point gives the best odds of catching it. “The most reliable place to catch this is at the host, specifically where the browser is launched with set parameters. From a network perspective, the initial negotiation is conducted using HTTPS. From there, not only is the WebRTC traffic encrypted with DTLS and can blend in with ordinary traffic, the RAT adds its own encryption layer to the data. In this case, the earlier the activity can be detected and interrupted on the endpoint, the better,” he explained. A Chrome or Edge process started with a remote debugging port and a user-data directory the malware specifies is the observable event, and it follows an MSI landing in ProgramData. Talos published a ClamAV signature, Win.Downloader.ChaosRaas-10060321-0. The indicators cover the delivery server, the signaling domain, and a file hash, and they also sit in the Talos GitHub repository. The signaling requests carry a HeadlessChrome user agent, one artifact the network still gets to see. The endpoint holds the rest.

Drata brings visibility, control and auditability to enterprise AI agents Drata has introduced AI Agent Governance, a new security category focused on managing the risks and oversight requirements of AI agents, while extending its trust platform to support enterprise adoption of autonomous AI systems. While McKinsey finds 57% of business leaders cite governance friction as the top blocker to deploying more AI, this move is a strategic shift grounded in platform trends Drata is uniquely positioned to observe. Over the last nine months, the company has processed more than 2.1 million security questions through the Drata Trust Graph and seen the frequency of AI-specific questions surge by over 30%. These insights, derived from aggregate platform activity, reveal that questions cluster across five core themes: 1. Which AI agents are running? 2. What are they allowed to do? 3. Who do they run as? 4. Are they behaving as expected? 5. Can you prove all of the above? As AI adoption surges, the diligence required of companies to govern them does as well. Unfortunately, security leaders are unprepared to answer the first four questions, making it nearly impossible to answer the fifth. In fact, a staggering 89% of companies leave questions in that category unanswered. Empowering security leaders to see the agents in their environment, authorize their access, monitor them continuously, and prove their posture is what the new product from Drata is designed to do. “When enterprise customers conducted security reviews in the past, the conversation centered on which frameworks we were certified against, how we managed our security posture, and what our third-party risk profile looked like,” says Nils Puhlmann, co-founder of Cloud Security Alliance and former chief security officer of Twilio, Navan and Zynga. “However, over the past few months, an entirely new category of questions has emerged, focused on which AI agents are running and how they are governed. Answering those questions confidently is impossible with today’s technology; anyone who solves that problem is solving for the future of enterprise trust.” AI Agent Governance from Drata provides enterprise security teams with capabilities for the AI era, all built on the same platform that produces compliance evidence for thousands of audits and enables teams to prove trust externally. Upon integration, Drata’s inline sensors find every agent created by every employee in the environment, including the shadow AI agents no one knew existed, and provide a full inventory in minutes, mapping each one to its owner, identity, permissions, and scope. From there, every action is evaluated against its individual policy in real time, with violations blocked inline before execution and any drift caught and flagged immediately. Every decision is logged in a tamper-evident record, providing a single, verified evidence trail for the board, auditors, customers, and regulators. “Every major technology wave creates a security wave, and the security wave never starts with the platform vendor. Where endpoint created CrowdStrike and cloud created Wiz, we are now in a world where AI agents are creating a technology wave that requires a security layer to support its growth,” said Adam Markowitz, CEO of Drata. “We have spent five years building the trust layer between great companies and helping our customers prove trust faster through agentic workflows. Extending the platform to govern agents themselves is the next required step and Drata is uniquely positioned with the platform data and the policies, controls, risk, monitoring, and remediation actions to do it credibly,” Markowitz concluded.

Researchers uncover AI-powered vishing platform A vishing-as-a-service platform that helps scammers carry out so-called “press 1” scams is misusing text-to-speech (TTS) capabilities provided by AI voice technology company ElevenLabs, Mirage Security researchers claim. How “press 1” vishing scams work For “press 1” scams, fraudsters spoof phone numbers of trusted institutions (e.g., bank), call up potential victims and try to scare them with pre-recorded messages into sharing sensitive information. When impersonating banks, for example, the fraudsters first play a message that claims the users’ account has been compromised or that the bank has spotted fraudulent transactions tied to it, and instruct potential victims to press “1” on their phone keyboard if they want to resolve the issue. Those who do are connected to a scammer posing as an employee of the institution, who then carries the scam through to completion or until the victim catches on. With the P1 (p1bot.io) platform, the scammers don’t have to talk to the potential victims during a live call – they move the scam along by playing messages that have been pre-recorded with natural AI-generated voices. “We’ve seen open-source OTP bot kits on GitHub that wire together ElevenLabs and Twilio, and academic researchers demonstrated a fully automated AI vishing system (ViKing) using the same stack in a controlled study,” says Mirage Security CEO Ross Lazerowitz. “But p1bot represents something different: a commercial, subscription-based platform where ElevenLabs is embedded as a first-class feature, not bolted on by individual operators. The integration is polished, the voice catalog is curated, and the workflow is designed to lower the barrier for anyone willing to pay.” How p1bot streamlines vishing attacks Would-be scammers register to use p1bot via a Telegram bot, pay $399 per month via a OxaPay crypto payment gateway, and get access to the web-based dashboard. At its core, p1bot is a browser-based softphone, Mirage Security found. Via its interface, the operators can spoof phone numbers, generate AI voice prompts, place calls via WebRTC, capture DTMF tones (i.e., the sounds produced when the victim is pressing keys on a phone), record calls, and play pre-generated audio clips mid-call to simulate automated interactive voice response (IVR) systems. Operators create fake IVR clips via the “Generate TTS” page, and save them in the Audio Library so they can use them during live calls. The Generate TTS page (Source: Mirage Security) “[The platform] ships with a hardcoded catalog of ElevenLabs voice IDs: 15 English, 4 French, and 4 Spanish voices, each mapped to a real ElevenLabs voice profile,” Lazerowitz says. The platform-provided APIs are backed by p1bot’s accounts, he told Help Net Security, but operators with their own ElevenLabs account can extend the platform’s voice capabilities (e.g., paste custom voice IDs). Exposed JavaScript helped researchers dissect p1bot Lazerowitz told us that they managed to discover all of this because the platform’s client-side JavaScript was not obfuscated or access-restricted, which allowed them to analyze the application logic, API integrations, and embedded credentials without creating accounts or placing any calls. They’ve also looked at the diagnostic log messages left enabled in the production version of the app, and found many indicators that point to the platform having been built with the help of coding AI assistants. The integration of ElevenLabs’ voices into the platform means that criminals are not developing new AI capabilities, Lazerowitz noted, but subscribing to the same commercial services as everyone else. “When we reported our findings to ElevenLabs, their security team responded quickly, investigated the abusive accounts, and took action. That kind of responsiveness, combined with the traceability features ElevenLabs has built into their platform, demonstrates that disruption is possible when researchers and vendors work together,” he concluded. ElevenLabs monitors user-generated content to detect harmful activities and accepts reports of concerning content. When abuse is detected, they ban accounts and – when required by law – they report them to government authorities. Help Net Security has reached out to ElevenLabs for a comment on Mirage Security’s report, but they declined to comment on this specific case. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

Update: Added HungerRush statement below. Customers of restaurants using the HungerRush point-of-sale (POS) platform say they received emails from a threat actor attempting to extort the company, warning that restaurant and customer data could be exposed if HungerRush fails to respond. HungerRush is a restaurant technology provider that offers point-of-sale (POS), online ordering, delivery management, and payment processing software to help restaurants manage orders, customer information, and business operations. The company claims to work with over 16,000 restaurants, including Sbarro, Jet's Pizza, Fajita Pete's, Hungry Howie's, and many more. Extortion emails sent to restaurant patrons The attacker started sending the emails early Wednesday morning, with multiple recipients sharing samples with BleepingComputer. The first email was sent from [email protected], prompting HungerRush to stop ignoring their extortion emails or it would put customer data at risk. "You cannot ignore all my requests and expect me not to take malicious actions. You still have time," reads the email. "Every restaurant and customer of said restaurants' data which is in the millions is in jeopardy here and I can't even get a response back. Not to worry, there's still time left." A second email, sent three hours later from "[email protected]," escalates the threat, claiming that the attacker has access to data records for millions of customers that contain names, emails, passwords, addresses, phone numbers, dates of birth, and credit card information. BleepingComputer's analysis of the email headers shows they were delivered using Twilio SendGrid, which customers have told BleepingComputer was previously used to send HungerRush restaurant receipts. The emails were sent from o10.e.hungerrush.com (159.183.129.119), which resolves to infrastructure operated by Twilio SendGrid, a platform commonly used by companies to send transactional and marketing emails. The email headers also confirm that the messages passed SPF, DKIM, and DMARC authentication checks for the hungerrush.com domain, as the company's SPF record, shown below, authorizes SendGrid to send emails on their behalf. v=spf1 include:spf.protection.outlook.com include:_spf.salesforce.com include:mail.zendesk.com include:_spf.psm.knowbe4.com include:sendgrid.net include:4750273.spf01.hubspotemail.net -all Numerous people on Reddit have reported receiving the emails, stating that past digital receipts from restaurants showed they used HungerRush's ordering or POS systems. Alon Gal, co-founder and CTO of Hudson Rock, posted on LinkedIn that infostealer logs indicate a HungerRush employee's device was allegedly infected with an infostealer in October 2025, leading to the compromise of credentials. According to Gal, the malware stole numerous corporate credentials, including those for the company's NetSuite, QuickBooks-related services, Stripe dashboards, Bill.com vendor payment systems, Visa Online commercial services, and Salesforce environments. After publishing this story, HungerRush said that this previous infostealer infection is not linked to the breach. For the time being, customers of restaurants using the HungerRush POS system should be on alert for potential phishing emails and SMS texts that abuse the potentially stolen information. HungerRush confirms breach HungerRush confirmed to BleepingComputer that they are aware of the incident and have notified law enforcement. "We are aware of the situation and are actively investigating in coordination with the appropriate authorities," HungerRush told BleepingComputer. "Our teams are working quickly to understand the scope, address the issue, and implement any necessary remediation. Protecting our clients and their customers' data is a top priority, and we are treating this matter with the utmost urgency." In a later update, the company says that the incident is not linked to the infostealer infection seen by Alon Gal. Instead, HungerRush says the threat actor used a third-party vendor's compromised credentials to breach its email marketing service account. This allowed the threat actor to gain access to customer contact information, which was used to send the unauthorized emails. "As a result, certain customer contact information (including names, email addresses, mailing addresses, and phone numbers) was accessed and used to send unauthorized email messages to certain merchants and consumers," HungerRush told BleepingComputer in an updated statement. However, HungerRush disputes the threat actor's claims, stating that no sensitive personal or financial information, such as passwords, dates of birth, Social Security numbers, or payment card information, was exposed in the breach. HungerRush also noted that credit card data is not stored within its systems. Furthermore, the company says there is no evidence that any other systems were compromised, with the breach limited to the email marketing service. "As a precautionary measure, HungerRush disabled access to the affected email service to prevent additional unauthorized messages from being sent while the investigation continues," the company said. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Immaginate un attaccante che non usa vulnerabilità zero-day, non forza nessun sistema di autenticazione e non acquista tool sofisticati sul dark web. Immaginate, invece, qualcuno che scrive un’e-mail, fa una telefonata e poi, con la sola forza della manipolazione psicologica, apre le porte di uno dei più grandi operatori telefonici d’Europa. È esattamente quello che è successo a Odido, la principale telco dei Paesi Bassi con oltre 6 milioni di clienti: una violazione che non solo espone dati sensibili di massa, ma riaccende in modo prepotente il dibattito su quanto il fattore umano rimanga il tallone d’Achille irrisolto della cyber security aziendale. Come sottolinea Sandro Sana, Ethical Hacker e membro del Comitato Scientifico Cyber 4.0, “il caso Odido dimostra, ancora una volta, che la MFA (autenticazione a più fattori) non viene “bucata”: viene gentilmente consegnata. Quando il social engineering entra in gioco, firewall e controlli tecnici diventano comparse”. Indice degli argomenti Il 14 febbraio 2026 Odido – nato dalla fusione tra T-Mobile Netherlands e Tele2 Netherlands nel 2022 – ha comunicato ufficialmente alla propria base clienti un grave incidente di sicurezza informatica. L’azienda ha notificato l’Autorità olandese per la protezione dei dati (AP) e avviato un processo di notifica che, secondo fonti interne, richiederebbe fino a due giorni per raggiungere tutti i destinatari. Il vettore iniziale dell’attacco, ricostruito da fonti vicine all’indagine e riportato dalla testata olandese NOS, segue uno schema di multi-stage social engineering ormai consolidato ma ancora drammaticamente efficace: Fase 1, phishing: nella prima fase, gli attaccanti hanno inviato email di phishing mirate a dipendenti del call center — in particolare a operatori di call center esternalizzati — riuscendo a sottrarre le relative credenziali di accesso. Fase 2, vishing ed MFA Bypass: con le credenziali in mano, ma bloccati dall’autenticazione multi-fattore (MFA), gli attaccanti hanno chiamato telefonicamente le stesse vittime spacciandosi per tecnici del reparto IT interno di Odido, convincendole ad approvare il tentativo di accesso. Fase 3, esfiltrazione dati: una volta dentro, gli attaccanti hanno avuto accesso al sistema CRM Salesforce, da cui hanno iniziato un’estrazione sistematica dei dati dei clienti tramite scraping programmatico. La tecnica descritta corrisponde perfettamente a quello che in gergo tecnico si chiama MFA fatigue attack o real-time phishing proxy: l’attaccante non rompe la MFA, la scavalca semplicemente convincendo l’utente legittimo ad approvare la richiesta di autenticazione. Una distinzione sottile ma fondamentale. Odido ha ufficialmente comunicato che il data breach ha interessato un “sistema di contatto clienti” che, secondo alcune fonti, potrebbe essere identificato con la piattaforma CRM Salesforce utilizzata dai call center. La buona notizia, se di buona notizia si può parlare, è che password, dettagli delle chiamate e dati di fatturazione non sono stati compromessi. La cattiva notizia è che per una parte significativa degli utenti notificati (stimati in circa 6,2 milioni tra clienti attuali ed ex-clienti) i dati potenzialmente esposti includono elementi ad alto rischio di sfruttamento secondario: nomi e cognomi; indirizzi di residenza e indirizzi e-mail; IBAN bancari; date di nascita; numeri di documento di identità: passaporto e/o patente di guida. Nel data breach di Odido sarebbero interessati anche i clienti del brand sussidiario Ben, operatore low-cost che eroga servizi su base contrattuale senza piani a lungo termine. La combinazione di questi dati (identità anagrafica, coordinate bancarie, documento d’identità) rappresenta un kit pressoché completo per attività di identity fraud e spear phishing. Le incognite sul furto dell’intero database clienti Secondo fonti vicine all’indagine sul data breach di Odido, non è ancora possibile escludere che gli attaccanti abbiano scaricato l’intero database clienti. Un dump completo dei dati avrebbe richiesto diversi giorni di attività non rilevata, uno scenario tecnicamente plausibile ma non ancora confermato. L’esperto di cyber security Seymen Rouvhof ha confermato: “Con questo tipo di attacco, raccogliere tutti i record richiede, in genere, giorni. Le azioni devono rimanere inosservate durante quel periodo”. È inoltre importante sottolineare che La combinazione IBAN + nome + indirizzo + numero del documento d’identità è sufficiente per: aprire conti bancari o linee di credito fraudolente; effettuare SIM swap per aggirare l’autenticazione bancaria; costruire spear phishing altamente personalizzati verso i 6,2M di vittime; impersonare Odido in fatture false o comunicazioni urgenti. Per chi lavora ogni giorno nel campo della cyber security difensiva, il data breach di Odido non è una sorpresa: è la conferma di un pattern osservabile che si ripete con cadenza sempre più frequente. Il social engineering di nuova generazione non è il classico principe nigeriano delle e-mail spam degli anni 90. È un’operazione chirurgica, scalabile e spesso automatizzata, costruita su tre pilastri psicologici fondamentali: Autorità (Authority). L’attaccante si è presentato come membro dell’IT interno, sfruttando il principio di compliance all’autorità descritto dallo psicologo statunitense Robert Cialdini nel suo libro “Le armi della persuasione”, insieme alle altre sei tendenze umane (autorevolezza, reciprocità, scarsità, coerenza, riprova sociale e simpatia). I dipendenti dei call center – spesso terzisti, poco integrati nella cultura di sicurezza dell’azienda madre – tendono a obbedire alle richieste percepite come “tecniche” provenienti dall’IT, anche se non le comprendono pienamente. Urgenza (Scarcity/Urgency). La narrativa usata durante la chiamata vishing era quasi certamente costruita intorno all’urgenza: “C’è un problema di sicurezza sul tuo account, devi approvare immediatamente questa verifica”. L’urgenza inibisce il pensiero critico e accelera la decisione impulsiva. Scarcity of Information. I dipendenti target non avevano modo rapido di verificare l’identità del chiamante. I sistemi di autenticazione interna per le telefonate aziendali sono ancora oggi raramente implementati, creando un gap di verifica che gli attaccanti sfruttano sistematicamente. È utile sottolineare, inoltre, che il vettore d’attacco descritto è riconducibile alla famiglia degli attacchi di tipo MFA bypass via social engineering. In particolare, la tecnica del “vishing post-phishing” è documentata nel framework MITRE ATT&CK alla voce T1566.004 (Spearphishing Voice) combinata con T1621 (Multi-Factor Authentication Request Generation). La particolarità di questo attacco è la fase di handoff: il phishing cattura le credenziali, mentre il vishing completa il bypass MFA in real-time. Il tutto senza alcun exploit tecnico. Una tecnica, questa, che è stata osservata anche negli attacchi contro MGM Resorts (2023), Uber (2022) e Twilio (2022): tre casi in cui il social engineering ha preceduto o sostituito l’hacking tecnico. Uno degli elementi più rilevanti per i professionisti IT emerge dal vettore di esfiltrazione nel data breach di Odido: il sistema compromesso pare sia stato Salesforce, la piattaforma CRM dominante nel mercato Enterprise. Questo dettaglio merita un’analisi specifica. I sistemi CRM come Salesforce aggregano per definizione i dati più sensibili di un’organizzazione lato customer. Ironia della sorte, più il CRM è ben implementato, con profili cliente completi, storico interazioni, dati anagrafici completi, più diventa appetibile come target di esfiltrazione massiva. Nel data breach di Odido, una volta ottenute le credenziali di un account operatore legittimo, gli attaccanti hanno potuto sfruttare le API native del CRM o semplicemente la navigazione programmatica del portale per estrarre dati in modo automatizzato: una tecnica che gli analisti definiscono una “programmatic scraping session”. “Abbiamo implementato la MFA, siamo al sicuro”. Questa frase, ripetuta in quasi ogni assessment aziendale, è diventata pericolosamente fuorviante: il caso Odido è l’ennesima dimostrazione che la MFA è necessaria, ma non sufficiente. La MFA basata su notifiche push (come quelle di Microsoft Authenticator o Google Authenticator) presuppone che l’utente sappia distinguere una notifica legittima da una fraudolenta. Presuppone, cioè, un livello di consapevolezza che, soprattutto in ambienti di call center ad alto turnover e bassa formazione specifica, non può essere dato per scontato. Gli attaccanti, nel caso Odido, hanno semplicemente chiamato il dipendente mentre la notifica push era attiva, creando un contesto narrativo convincente (“Sono dell’IT, sto configurando il tuo account, approva la notifica che ti è arrivata”) che ha portato la vittima ad approvare consapevolmente, pur non sapendo cosa stesse approvando, l’accesso non autorizzato. Per configurare un sistema di autenticazione multifattoriale resistente ai tentativi di attacchi di tipo social engineering è utile adottare le seguenti raccomandazioni: Utilizzare passkey e sistemi FIDO2: eliminano il problema alla radice. L’autenticazione è device-bound ed è crittograficamente legata al sito o all’app di destinazione, per cui non c’è alcuna notifica push da approvare. Number matching: se si usa la push MFA, è consigliabile abilitare il “number matching” per mostrare all’utente un codice da inserire nel telefono. Ciò riduce drasticamente il rischio di false approvazioni di accesso. Security awareness contestuale: è molto utile anche addestrare i dipendenti specificamente sullo scenario “qualcuno vi chiama e vi chiede di approvare una notifica”, spiegando loro come comportarsi in situazioni del genere. MFA resistente al phishing: dovrebbe essere obbligatoria per i sistemi in cui vengono trattati dati sensibili. Zero-trust per i call center terzisti: violazioni di sicurezza come quella di Odido dimostrano che il modello “trust but verify” non funziona più. I call center esternalizzati devono operare in ambienti containerizzati con visibilità ridotta e monitoraggio continuo delle sessioni. Come evidenzia ancora Sandro Sana, “il vero problema non è Salesforce né la tecnologia utilizzata, ma l’illusione che l’autenticazione multi-fattore sia una misura risolutiva senza formazione, processi e controlli sull’operato dei terzisti”. “Questo data breach”, continua l’analista, “è l’ennesima prova che il perimetro più fragile resta quello umano e che la supply chain, soprattutto nei call center esternalizzati, continua a essere il punto cieco di molte organizzazioni. La sicurezza non si compra a licenza: si governa”. Il data breach di Odido apre scenari interessanti e preoccupanti sul piano regolatorio europeo. La violazione coinvolge dati di cittadini olandesi ed europei, gestiti attraverso una piattaforma (Salesforce) e operatori di call center esternalizzati. Una catena di responsabilità complessa che il GDPR e la direttiva NIS2 devono intercettare. Odido ha già notificato l’Autorità olandese per la protezione dei dati (AP) nei tempi previsti dall’art. 33 del GDPR, entro 72 ore dall’individuazione della violazione, e la notifica ai soggetti interessati è in corso. Sul fronte NIS2, Odido come operatore di telecomunicazioni rientra tra i soggetti essenziali, con obblighi rafforzati in materia di gestione del rischio e notifica agli enti competenti. Il nodo più critico, però, riguarda i call center terzisti. Se la violazione è originata da account di dipendenti di fornitori esterni, si pone con forza la questione dell’adeguatezza dei controlli di sicurezza imposti contrattualmente ai responsabili del trattamento ai sensi dell’art. 28 GDPR. La domanda è semplice: i contratti con i call center prevedevano obblighi specifici di formazione anti-phishing e di gestione sicura dell’MFA? In caso contrario, Odido ne risponde in solido. Odido ha comunicato ai clienti di aspettarsi possibili abusi derivati dall’esposizione dei loro dati, con una specifica attenzione alle fatture false che potrebbero sembrare provenire dall’operatore stesso. Ecco i consigliamo da seguire concretamente per proteggersi da questi tentativi di truffa, sottolineando che questi stessi consigli sono validi sempre indipendentemente dal caso specifico: Verificare ogni comunicazione finanziaria ricevuta da Odido accedendo direttamente al portale Odido, senza cliccare su link nelle email o SMS. Attivare alert sulle movimentazioni bancarie collegate all’IBAN potenzialmente esposto. Monitorare eventuali richieste di credito o aperture di conti effettuate a proprio nome, richiedendo una verifica alla propria banca. Non condividere ulteriori dati sensibili a seguito di comunicazioni non verificate che si presentano come Odido. In caso di sospetto utilizzo fraudolento dei documenti esposti (passaporto, patente), contattare le autorità competenti per richiedere un alert sul proprio codice documento. Da questo incidente emergono almeno cinque lezioni strutturali che ogni responsabile della sicurezza dovrebbe portare al prossimo board meeting: Il perimetro umano è il perimetro più vulnerabile.Nessun firewall, nessun EDR, nessun SIEM protegge dall’ingegneria sociale se i dipendenti non sono adeguatamente formati. La security awareness non è un costo overhead: è un controllo di sicurezza critico con ROI misurabile (riduzione del tasso di click su phishing simulati). I terzisti sono estensioni del perimetro aziendale. Un call center esterno che gestisce dati dei clienti è, a tutti gli effetti, parte del perimetro di sicurezza aziendale. I loro dipendenti devono ricevere la stessa formazione che ricevono i vostri. I loro sistemi devono rispettare i vostri standard. Questo va negoziato contrattualmente, non dato per scontato. Il CRM è infrastruttura critica. Salesforce, HubSpot, Microsoft Dynamics: questi sistemi contengono i gioielli della corona dei dati cliente. Trattarli come applicazioni ordinarie, senza monitoraggio comportamentale dedicato e controlli di accesso granulari, è un rischio sistemico inaccettabile. La MFA si bypassa: usare MFA resistente al phishing. Come evidenziato, la push MFA tradizionale non è più sufficiente contro attaccanti motivati. La transizione verso Passkeys e FIDO2 non è più un nice-to-have: è una necessità operativa, specialmente per i sistemi che contengono dati personali di milioni di utenti. Detection veloce, prevention perfetta. Nella realtà operativa, la prevenzione assoluta è un’utopia. Il vero differenziatore è la velocità di rilevamento. Nel caso Odido, l’esfiltrazione ha richiesto potenzialmente giorni. Un sistema di rilevamento comportamentale sulle sessioni Salesforce – anomalie nel volume di record consultati, orari di accesso insoliti, geoIP anomali – avrebbe potuto bloccare l’operazione molto prima. Il data breach di Odido non sarà l’ultimo del suo genere. Anzi: con la crescente sofisticazione degli strumenti di AI generativa – che permettono di creare e-mail di phishing grammaticalmente perfette, deepfake vocali convincenti per il vishing e profili social costruiti ad hoc per aumentare la credibilità degli attaccanti – il social engineering di nuova generazione diventerà il vettore dominante degli anni a venire. La risposta non può essere solo tecnologica, ma richiede un cambio di paradigma culturale nelle organizzazioni: la sicurezza non è responsabilità esclusiva del team IT, è responsabilità di ogni singola persona che ha accesso a sistemi aziendali, dai manager ai call center, dai developer agli stagisti. Dunque, il messaggio da portare sempre ai propri clienti è questo: “Il vostro attaccante più pericoloso non è nel dark web. Probabilmente ha già il vostro numero di telefono interno“. E Odido lo ha scoperto nel modo più costoso possibile.

Forty-five cybersecurity merger and acquisition (M&A) deals were announced in October 2025. Out of the 45 deals, roughly a quarter had publicly reported financial terms. A majority of deals were smaller, highly strategic acquisitions focusing on acquiring high-value tech or talent. Private equity firms were active in both large-scale buyouts and consolidation plays, showing confidence in GRC and other mature platforms. In fact, GRC companies were involved in over a dozen deals. The data shows an effort to consolidate GRC platforms, particularly through the integration of niche expertise such as third-party risk management and AI governance. Half a dozen deals involved identity and authentication firms, with several major companies looking to add next-generation features such as passwordless authentication and identity threat detection and response into their core identity platforms. While a majority of the target companies are based in the United States, a significant number of deals involve Australian companies, with several transactions pointing to consolidation within the local market. Here are some of the most important cybersecurity M&A deals announced in October 2025: Real-time event and risk detection solutions provider Dataminr is acquiring threat intelligence firm ThreatConnect for $290 million in cash and equity. The goal is to combine Dataminr’s data signals platform with ThreatConnect’s deep internal data capabilities to create agentic AI-powered intelligence that is tailored to each customer’s needs. Identity solutions provider Imprivata has bought identity threat detection and response company Verosint. Imprivata said the acquisition will enable it to add AI-powered risk intelligence to its platform. By integrating Verosint’s risk engine, Imprivata can continuously detect and respond to identity-based threats. Private equity firm Francisco Partners has entered into a definitive agreement to acquire Apple device management and security firm Jamf in a $2.2 billion deal. The transaction is expected to close in the first quarter of 2026, when Jamf will become a privately held company. Identity, access and device management company JumpCloud has acquired Breez, an identity threat detection, investigation, and response (ITDR) platform. The acquisition accelerates JumpCloud’s security roadmap, bringing ITDR tools and expertise directly into its platform. With Breez’s technology, JumpCloud expands its ability to detect, investigate, and respond to identity threats. LevelBlue, one of the world’s largest managed security service providers, announced a definitive agreement to acquire extended detection and response (XDR) provider Cybereason. Following the acquisition, Cybereason’s XDR technology and digital forensics and incident response (DFIR) capabilities will be integrated into LevelBlue’s portfolio of managed security services. The controversial spyware maker NSO Group has been acquired by a group of American investors led by Hollywood producer Robert Simonds, transferring controlling ownership of the firm out of Israel. The deal has been reportedly valued at several tens of millions of dollars. Automated security validation and penetration testing firm Pentera has acquired DevOvean, which specializes in remediation management, for $30 million. The integration of DevOcean capabilities will enable Pentera to reduce remediation overload, enrich findings with organizational context, speed up remediation, and enforce SLA-driven remediation. Ping Identity has signed an agreement to acquire Keyless, a London-based firm specializing in privacy-preserving biometric authentication. The deal will bring Keyless’ Zero-Knowledge Biometrics technology to the Ping Identity Platform. The deal enables Ping to help enterprises verify users securely, without ever storing or sharing sensitive biometric data. RecordPoint, a data management and AI governance firm, has bolstered its capabilities through the acquisition of Redactive, a Melbourne-based startup that helps companies make AI adoption secure, compliant, and scalable. The goal of the deal is to accelerate the development of RecordPoint’s AI governance platform with new threat management capabilities. Redactive’s technology enhances RecordPoint’s capacity to address emerging AI cyber threats targeting highly sensitive data. Business advisory firm Riveron announced its acquisition of Eden Data, an Austin-based advisory firm known for its deep cybersecurity and GRC expertise. The deal expands Riveron’s Risk Advisory offerings, combining financial controls, operational risk, and emerging technology expertise under one roof. Attack surface management and threat intelligence firm Searchlight Cyber has acquired risk management company Intangic. The move enhances Searchlight’s ability to help organizations measure, monitor and mitigate cyber risk across their external environments. Twilio has entered into an agreement to acquire Stytch, an identity platform for AI agents. Stytch’s experts and technology will help Twilio build an intelligent identity layer across its platform. This is driven by the need to authenticate both human users and the emerging AI Agents that act on their behalf. Cloud network security firm Vectra AI announced the acquisition of network observability company Netography. As part of the deal, Netography Fusion will join the Vectra AI portfolio as Vectra Fusion, delivering agentless, cloud-native observability to enable proactive, preemptive cyberattack defense for hybrid and multi-cloud environments. This marks the second company led by Netography CEO Martin Roesch to be acquired. Data portability and resilience solutions provider Veeam Software has announced plans to acquire data security posture management (DSPM) company Securiti AI for $1.725 billion in cash and stock. The acquisition will unite their capabilities and enable Veeam to eliminate the challenge of managing fragmented data. Related: Cybersecurity M&A Roundup: 40 Deals Announced in September 2025 Related: Cybersecurity M&A Roundup: 27 Deals Announced in August 2025

Threat actors tied to North Korea have been observed targeting the Web3 and blockchain sectors as part of twin campaigns tracked as GhostCall and GhostHire. According to Kaspersky, the campaigns are part of a broader operation called SnatchCrypto that has been underway since at least 2017. The activity is attributed to a Lazarus Group sub-cluster called BlueNoroff, which is also known as APT38, CageyChameleon, CryptoCore, Genie Spider, Nickel Gladstone, Sapphire Sleet (formerly Copernicium), and Stardust Chollima. Victims of the GhostCall campaign span several infected macOS hosts located in Japan, Italy, France, Singapore, Turkey, Spain, Sweden, India, and Hong Kong, whereas Japan and Australia have been identified as the major hunting grounds for the GhostHire campaign. "GhostCall heavily targets the macOS devices of executives at tech companies and in the venture capital sector by directly approaching targets via platforms like Telegram, and inviting potential victims to investment-related meetings linked to Zoom-like phishing websites," Kaspersky researchers Sojun Ryu and Omar Amin said. "The victim would join a fake call with genuine recordings of this threat's other actual victims rather than deepfakes. The call proceeds smoothly to then encourages the user to update the Zoom client with a script. Eventually, the script downloads ZIP files that result in infection chains deployed on an infected host." On the other hand, GhostHire involves approaching prospective targets, such as Web3 developers, on Telegram and luring them into downloading and executing a booby-trapped GitHub repository under the pretext of completing a skill assessment within 30 minutes of sharing the link, so as to ensure a higher success rate of infection. Once installed, the project is designed to download a malicious payload onto the developer's system based on the operating system used. The Russian cybersecurity company said it has been keeping tabs on the two campaigns since April 2025, although it's assessed that GhostCall has been active since mid-2023, likely following the RustBucket campaign. RustBucket marked the adversarial collective's major pivot to targeting macOS systems, following which other campaigns have leveraged malware families like KANDYKORN, ObjCShellz, and TodoSwift. It's worth noting that various aspects of the activity have been documented extensively over the past year by multiple security vendors, including Microsoft, Huntress, Field Effect, Huntabil.IT, Validin, and SentinelOne. The GhostCall Campaign Targets who land on the fake Zoom pages as part of the GhostCall campaign are initially served a bogus page that gives the illusion of a live call, only to display an error message three to five seconds later, urging them to download a Zoom software development kit (SDK) to address a purported issue with continuing the call. Should the victims fall for the trap and attempt to update the SDK by clicking on the "Update Now" option, it leads to the download of a malicious AppleScript file onto their system. In the event the victim is using a Windows machine, the attack leverages the ClickFix technique to copy and run a PowerShell command. At each stage, every interaction with the fake site is recorded and beaconed to the attackers to track the victim's actions. As recently as last month, the threat actor has been observed transitioning from Zoom to Microsoft Teams, using the same tactic of tricking users into downloading a TeamsFx SDK this time to trigger the infection chain. Regardless of the lure used, the AppleScript is designed to install a phony application disguised as Zoom or Microsoft Teams. It also downloads another AppleScript dubbed DownTroy that checks stored passwords associated with password management applications and installs additional malware with root privileges. DownTroy, for its part, is engineered to drop several payloads as part of eight distinct attack chains, while also bypassing Apple's Transparency, Consent, and Control (TCC) framework - ZoomClutch or TeamsClutch, which uses a Swift-based implant that masquerades as Zoom or Teams while harboring functionality to prompt the user to enter their system password in order to complete the app update and exfiltrate the details to an external server DownTroy v1, which uses a Go-based dropper to launch the AppleScript-based DownTroy malware that's then responsible for downloading additional scripts from the server until the machine is rebooted. CosmicDoor, which uses a C++ binary loader called GillyInjector (aka InjectWithDyld) to run a benign Mach-O app and inject a malicious payload into it at runtime. When it's run with the --d flag, GillyInjector activates its destructive capabilities and irrevocably wipes all files in the current directory. The injected payload is a backdoor written in Nim named CosmicDoor that can communicate with an external server to receive and execute commands. It's believed that the attackers first developed a Go version of CosmicDoor for Windows, before moving to Rust, Python, and Nim variants. It also downloads a bash script stealer suite named SilentSiphon. RooTroy, which uses Nimcore loader to launch GillyInjector, which then injects a Go backdoor called RooTroy (aka Root Troy V4) to collect device information, enumerate running processes, read payload from a specific file, and download additional malware (counting RealTimeTroy) and execute them. RealTimeTroy, which uses Nimcore loader to launch GillyInjector, which then injects a Go backdoor called RealTimeTroy that communicates with an external server using the WSS protocol to read/write files, get directory and process information, upload/download files, terminate a specified process, and get device information. SneakMain, which uses Nimcore loader to launch a Nim payload called SneakMain to receive and execute additional AppleScript commands received from an external server. DownTroy v2, which uses a dropper named CoreKitAgent to launch Nimcore loader, which then launches AppleScript-based DownTroy (aka NimDoor) to download an additional malicious script from an external server. SysPhon, which uses a lightweight version of RustBucket named SysPhon and SUGARLOADER, a known loader previously utilized to deliver the KANDYKORN malware. SysPhon, also employed in the Hidden Risk campaign, is a downloader written in C++ that can conduct reconnaissance and fetch a binary payload from an external server. SilentSiphon is equipped to harvest data from Apple Notes, Telegram, web browser extensions, as well as credentials from browsers and password managers, and secrets stored in configuration files related to a long list of services: GitHub, GitLab, Bitbucket, npm, Yarn, Python pip, RubyGems, Rust cargo, NET Nuget, AWS, Google Cloud, Microsoft Azure, Oracle Cloud, Akamai Linode, DigitalOcean API, Vercel, Cloudflare, Netlify, Stripe, Firebase, Twilio, CircleCI, Pulumi, HashiCorp, SSH, FTP, Sui Blockchain, Solana, NEAR Blockchain, Aptos Blockchain, Algorand, Docker, Kubernetes, and OpenAI. "While the video feeds for fake calls were recorded via the fabricated Zoom phishing pages the actor created, the profile images of meeting participants appear to have been sourced from job platforms or social media platforms such as LinkedIn, Crunchbase, or X," Kaspersky said. "Interestingly, some of these images were enhanced with [OpenAI] GPT-4o." The GhostHire Campaign The GhostHire campaign, the Russian cybersecurity company added, also dates back to mid-2023, with the attackers initiating contact with the targets directly on Telegram, sharing details of a job offer along with a link to a LinkedIn profile impersonating recruiters at financial companies based in the U.S. in an attempt to lend the conversations a veneer of legitimacy. "Following up on initial communication, the actor adds the target to a user list for a Telegram bot, which displays the impersonated company’s logo and falsely claims to streamline technical assessments for candidates," Kaspersky explained. "The bot then sends the victim an archive file (ZIP) containing a coding assessment project, along with a strict deadline (often around 30 minutes) to pressure the target into quickly completing the task. This urgency increases the likelihood of the target executing the malicious content, leading to initial system compromise." The project in itself is innocuous, but incorporates a malicious dependency in the form of a malicious Go module hosted on GitHub (e.g., uniroute), causing the infection sequence to be triggered once the project is executed. This includes first determining the operating system of the victim's computer and delivering an appropriate next-stage payload (i.e., DownTroy) programmed in PowerShell (Windows), bash script (Linux), or AppleScript (macOS). Also deployed via DownTroy in the attacks targeting Windows are RooTroy, RealTimeTroy, a Go version of CosmicDoor, and Rust-based loader named Bof that's used to decode and launch an encrypted shellcode payload stored in the "C:\Windows\system32\" folder. "Our research indicates a sustained effort by the actor to develop malware targeting both Windows and macOS systems, orchestrated through a unified command-and-control infrastructure," Kaspersky said. "The use of generative AI has significantly accelerated this process, enabling more efficient malware development with reduced operational overhead." "The actor's targeting strategy has evolved beyond simple cryptocurrency and browser credential theft. Upon gaining access, they conduct comprehensive data acquisition across a range of assets, including infrastructure, collaboration tools, note-taking applications, development environments, and communication platforms (messengers)."

Cybersecurity researchers have detailed a new cluster of activity where threat actors are impersonating enterprises with fake Microsoft OAuth applications to facilitate credential harvesting as part of account takeover attacks. "The fake Microsoft 365 applications impersonate various companies, including RingCentral, SharePoint, Adobe, and Docusign," Proofpoint said in a Thursday report. The ongoing campaign, first detected in early 2025, is designed to use the OAuth applications as a gateway to obtain unauthorized access to users' Microsoft 365 accounts by means of phishing kits like Tycoon and ODx that are capable of conducting multi-factor authentication (MFA) phishing. The enterprise security company said it observed the approach being used in email campaigns with more than 50 impersonated applications. The attacks begin with phishing emails sent from compromised accounts and aim to trick recipients into clicking on URLs under the pretext of sharing requests for quotes (RFQ) or business contract agreements. Clicking on these links directs the victim to a Microsoft OAuth page for an application named "iLSMART" that asks them to grant it permissions to view their basic profile and maintain continued access to the data that they have been granted access to. What makes this attack notable is the impersonation of ILSMart, a legitimate online marketplace for aviation, marine, and defense industries to buy and sell parts and repair services. "The applications' permissions would provide limited use to an attacker, but it is used for setting up the next stage of the attack," Proofpoint said. Regardless of whether the target accepted or denied the permissions requested, they are first redirected to a CAPTCHA page and then to a phony Microsoft account authentication page once the verification is complete. This fake Microsoft page makes use of adversary-in-the-middle (AitM) phishing techniques powered by the Tycoon Phishing-as-a-Service (PhaaS) platform to harvest the victim's credentials and MFA codes. As recently as last month, Proofpoint said it detected another campaign impersonating Adobe in which the emails are sent via Twilio SendGrid, an email marketing platform, and are engineered with the same goal in mind: To gain user authorization or trigger a cancellation flow that redirects the victim to a phishing page. The campaign represents just a drop in the bucket when compared to overall Tycoon-related activity, with the multiple clusters leveraging the toolkit to perform account takeover attacks. In 2025 alone, attempted account compromises affecting nearly 3,000 user accounts spanning more than 900 Microsoft 365 environments have been observed. "Threat actors are creating increasingly innovative attack chains in an attempt to bypass detections and obtain access to organizations globally," the company said, adding it "anticipates threat actors will increasingly target users’ identity, with AiTM credential phishing becoming the criminal industry standard." As of last month, Microsoft has announced plans to update default settings to improve security by blocking legacy authentication protocols and requiring admin consent for third-party app access. The updates are expected to be completed by August 2025. "This update will have a positive impact on the landscape overall and will hamstring threat actors that use this technique," Proofpoint pointed out. The disclosure follows Microsoft's decision to disable external workbook links to blocked file types by default between October 2025 and July 2026 in an attempt to enhance workbook security. The findings also come as spear-phishing emails bearing purported payment receipts are used to deploy by means of an AutoIt-based injector a piece of .NET malware called VIP Keylogger that can steal sensitive data from compromised hosts, Seqrite said. Over the course of several months, spam campaigns have been spotted concealing installation links to remote desktop software inside PDF files so as to bypass email and malware defenses. The campaign is believed to have been ongoing since November 2024, primarily targeting entities in France, Luxembourg, Belgium, and Germany. "These PDFs are often disguised to look like invoices, contracts, or property listings to enhance credibility and lure victims into clicking the embedded link," WithSecure said. "This design was intended to create the illusion of legitimate content that has been obscured, prompting the victim to install a program. In this case, the program was FleetDeck RMM." Other Remote Monitoring and Management (RMM) tools deployed as part of the activity cluster include Action1, OptiTune, Bluetrait, Syncro, SuperOps, Atera, and ScreenConnect. "Although no post-infection payloads have been observed, the use of RMM tools strongly suggests their role as an initial access vector, potentially enabling further malicious activity," the Finnish company added. "Ransomware operators in particular have favoured this approach."