webrtc

Chaos ransomware msaRAT hides its C2 channel inside a legitimate browser process Cisco Talos has identified a Rust-based remote access trojan it attributes to the Chaos ransomware group, named msaRAT after four of the binding names left in the binary. The tool starts its own instance of Chrome or Edge on the victim machine and controls it through Chrome DevTools Protocol, a debugging interface built into both browsers. The browser then carries the command-and-control traffic over a WebRTC channel. Once installed, the RAT process keeps all of its own traffic on 127.0.0[.]1. External traffic leaves from a legitimate browser process: HTTPS to a Cloudflare developer domain, a STUN request to a Google server, then WebRTC to a Twilio relay. Shell commands execute on the victim host and the output returns along the same path. The design needs a browser it can locate on the machine. Chaos operates as ransomware-as-a-service, confirmed active since February 2025, using vishing and spam email for initial access and double extortion afterward. Michael Szeliga, a Cisco Talos researcher and one of the authors of the analysis, was asked what this changes for defenders and whether other groups will follow. “This continues the shift defenders have already been dealing with, where attackers use legitimate cloud and collaboration services to hide C2 traffic. I expect browser-mediated C2 and similar approaches to become more prevalent, much like what was demonstrated with Praetorian’s TURNt research using Microsoft Teams TURN infrastructure. Threat actors will continue looking for ways to hide inside trusted applications and services, making behavior-based detection increasingly important, especially in ransomware attacks,” Szeliga told Help Net Security. Delivery arrives dressed as a Windows update The operator already has access to the machine when this starts. A curl.exe command pulls an MSI impersonating a Windows update into ProgramData. The attacker then executes it. The URL specifies port 443, the traffic is plain HTTP, and firewall rules that read port numbers with no protocol inspection pass it through. Installation ends with a custom action loading a DLL from inside the installer straight into memory. That DLL is msaRAT. msaRAT hunts for a browser on disk msaRAT checks six fixed locations drawn from environment variables, split between Chrome and Edge, then falls back to a registry lookup that covers Chrome alone. Finding a browser, it launches a fresh process headless, with the remote debugging port enabled and a user-data directory the malware specifies. Finding none, the whole C2 mechanism sits idle. The RAT connects to that debugging port over the loopback address, opens a tab in the instance it started, and turns off Content Security Policy for the page. It registers callbacks the browser’s JavaScript uses to report back, then injects JavaScript stored in plaintext inside the binary. What the network sees is a browser doing WebRTC The injected JavaScript pulls connection configuration from a Cloudflare Workers endpoint, with Origin and Referer headers set to Microsoft’s website. A Google STUN server handles the NAT lookup that finds the host’s external address. Signaling runs through the Workers endpoint, and the operator’s reply is built to prevent a direct connection, which forces every byte through a Twilio TURN relay. The attacker’s real server address stays out of the packet capture. Cloudflare Workers exits the picture once the channel opens. Blocking *.workers.dev to cut off that signaling broadly affects legitimate Cloudflare Workers deployments at the same time. Commands come back as cmd.exe Traffic inside the channel carries two layers of encryption. DTLS covers the transport by specification, handled by the browser. msaRAT encrypts the payload separately, using a key negotiated the moment the C2 connection opens. Two of the frame types carry a command string, which the RAT hands to cmd.exe for execution. The output goes back out the same channel. The remaining frames open and close channels, perform the key exchange, and kill the browser process. Catch it at the host Szeliga was asked which vantage point gives the best odds of catching it. “The most reliable place to catch this is at the host, specifically where the browser is launched with set parameters. From a network perspective, the initial negotiation is conducted using HTTPS. From there, not only is the WebRTC traffic encrypted with DTLS and can blend in with ordinary traffic, the RAT adds its own encryption layer to the data. In this case, the earlier the activity can be detected and interrupted on the endpoint, the better,” he explained. A Chrome or Edge process started with a remote debugging port and a user-data directory the malware specifies is the observable event, and it follows an MSI landing in ProgramData. Talos published a ClamAV signature, Win.Downloader.ChaosRaas-10060321-0. The indicators cover the delivery server, the signaling domain, and a file hash, and they also sit in the Talos GitHub repository. The signaling requests carry a HeadlessChrome user agent, one artifact the network still gets to see. The endpoint holds the rest.

Apple announced security updates this week for iOS, iPadOS, macOS Tahoe, and Safari that resolve dozens of vulnerabilities, including 26 security defects in WebKit. iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2 were rolled out with 37 security fixes across IOGPUFamily, kernel, libxslt, Web Extensions, WebKit, and WebRTC. The 26 WebKit bugs (including two in WebKit Canvas and WebKit Storage) could be exploited via malicious websites to exfiltrate data, leak sensitive information, crash Safari, corrupt memory, disclose process memory, hijack clipboard data, and process restricted web content outside the sandbox. The 11 flaws affecting other operating system components could lead to system crashes, kernel memory writes, kernel state disclosure, kernel memory corruption, process crashes, and Safari crashes. Per Apple’s advisories, at least four of these security defects appear to have been identified using AI. They were reported to Apple by Anthropic and OpenAI Codex Security researchers. On Monday, Apple also announced the release of Safari 26.5.2 with patches for 31 vulnerabilities in Web Extensions, WebKit, WebKit Canvas, WebKit Storage, and WebRTC. The Safari update brings these security fixes to macOS Sonoma and macOS Sequoia users, after they were first made available to the users of macOS Tahoe 26.6 beta. The company makes no mention of any of these security defects being exploited in the wild, but threat actors are known to have weaponized bugs in Apple products shortly after disclosure. Users are advised to update their devices as soon as possible, especially since most of the resolved issues affect WebKit and could be triggered when visiting a malicious website. Additional information can be found on Apple’s security updates page. Related: New Exploit Bypasses Apple’s Boot Defenses, Affects Millions of iPhones Related: Apple Patches Dozens of Vulnerabilities in macOS, iOS

Apple released updates for iOS/iPadOS, macOS, and Safari on Monday. There have been no updates for other Apple operating systems (visionOS, watchOS, tvOS). Usually, Apple updates all products at the same time. Most of the vulnerabilities affect the web browser (WebKit, libxslt, WebRTC, and Web Extension). Only four of the vulnerabilities are not directly related to web content: Three Kernel issues and one vulnerability in the IOGPUFamily. None of the vulnerabilities is labeled as "exploited". -- Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu Twitter|

Proton has announced a new video conferencing service named Meet and positioned it as a privacy-focused alternative to mainstream services like Google Meet, Zoom, and Microsoft Teams. Meet provides end-to-end encrypted (E2EE) calls to protect the confidentiality of the conversations and does not require a paid plan or even a Proton account to use. It is free for one-hour meetings of up to 50 participants. For longer calls, Proton offers a “pro” plan that starts at $7.99/month. Proton says Meet was created in response to the increasing need for privacy-first, EU-based alternatives that make it easier to comply with GDPR, or even CCPA (California Consumer Privacy Act), addressing the complexities of laws such as the US Cloud Act, and overcoming challenges posed by an increasingly unstable geopolitical environment. Apart from the legal aspect, Proton highlights the rampant practice of using people’s conversations to train AI models, which creates the risk of private data exposure from large language models (LLMs). “Proton Meet gives you back your privacy and peace of mind by protecting your calls with end-to-end encryption, so nobody can listen in or use your conversations to sell ads, conduct surveillance, or train AI,” Proton says. Meet works as simply as creating a conference call link and sharing it with other participants. The new service is fully integrated with Proton Calendar and also supports adding scheduled meetings to Google and Microsoft calendars. Strong privacy and security Proton Meet calls are secured with Messaging Layer Security (MLS), an independently reviewed open source end-to-end encryption protocol designed for real-time group messaging. Proton has published a separate post to provide more details about MLS, highlighting that all media and chat are encrypted client-side, leaving the company unable to access or process any cleartext data. Proton Meet’s architecture is built on WebRTC with Selective Forwarding Units (SFU) for relaying media and chat to all participants. Each meeting link contains an ID and a password that is kept locally on the client side, and authenticates participants via the Secure Remote Password (SRP) protocol, used on other Proton services for a decade. Concerning MLS, the system forms a cryptographic group that shares an epoch key used for encryption, which is rotated on every join/leave event. New members cannot read past messages (forward secrecy), old members can’t read future messages, and everyone has full visibility on the call participants, but their names remain end-to-end encrypted. Email and IP address information is kept private between participants, and Proton does not retain records of who met with whom. The firm says that even in the case of a server compromise, traffic cannot be read or modified, and that databases contain only meeting IDs, exposing nothing sensitive to hackers. The only realistic risk is having the meeting link compromised, which can be mitigated by locking entries once all expected participants have joined, removing rogue participants, or rotating the link. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Cybersecurity researchers have discovered a new payment skimmer that uses WebRTC data channels as a means to receive payloads and exfiltrate data, effectively bypassing security controls. "Instead of the usual HTTP requests or image beacons, this malware uses WebRTC data channels to load its payload and exfiltrate stolen payment data," Sansec said in a report published this week. The attack, which targeted a car maker's e-commerce website, is said to have been facilitated by PolyShell, a new vulnerability impacting Magento Open Source and Adobe Commerce that allows unauthenticated attackers to upload arbitrary executables via the REST API and achieve code execution. Notably, the vulnerability has since come under mass exploitation since March 19, 2026, with more than 50 IP addresses participating in the scanning activity. The Dutch security company said it has found PolyShell attacks on 56.7% of all vulnerable stores. The skimmer is designed as a self-executing script that establishes a WebRTC peer connection to a hard-coded IP address ("202.181.177[.]177") over UDP port 3479 and retrieves JavaScript code that's subsequently injected into the web page for stealing payment information. The use of WebRTC marks a significant evolution in skimmer attacks, as it bypasses Content Security Policy (CSP) directives. "A store with a strict CSP that blocks all unauthorized HTTP connections is still wide open to WebRTC-based exfiltration," Sansec noted. "The traffic itself is also harder to detect. WebRTC DataChannels run over DTLS-encrypted UDP, not HTTP. Network security tools that inspect HTTP traffic will never see the stolen data leave." Adobe released a fix for PolyShell in version 2.4.9-beta1 released on March 10, 2026. But the patch has yet to reach the production versions. As mitigations, site owners are recommended to block access to the "pub/media/custom_options/" directory and scan the stores for web shells, backdoors, and other malware. More Details About PolyShell Emerge The development comes as Searchlight Cyber's Assetnote team shared additional details of the PolyShell vulnerability, stating it's rooted in a function named ImageProcessor::processImageContent(), which accepts any "valid" image as input and move the file to destination folder (i.e., "pub/media/custom_options/quote/ / / "). As for what constitutes a valid image, the code checks that it's not empty, has a size, has a valid MIME type, and does not have blocked characters in its file name. In other words, there is no validation to ensure that the file extension actually matches the MIME type. This allows an attacker to upload a polyglot shell via an HTTP POST request to the "/rest/default/V1/guest-carts/{cart_id}/items" endpoint and invoke that file to achieve code execution. An important caveat here is that the uploaded file is only accessible if the web server is misconfigured; any attempt to access it will result in a 404 error message. "If you're using Adobe’s suggested Nginx/Apache configurations, then the files are inaccessible and not executable," security researcher Tomais Williamson said. "However, any deviations from this configuration (or missing .htaccess files) may lead to instances being impacted." "For Nginx instances, Magento ships with an example configuration file that should block access to the folders and any uploaded PHP files. Deviations from this configuration that remove the deny all clauses locations affecting the pub/media/custom_options path can lead to XSS, and removing .php execution restrictions will lead to those files being executable." (The story was updated after publication to include insights from Searchlight Cyber about PolyShell.)

Attacks leveraging the ‘PolyShell’ vulnerability in version 2 of Magento Open Source and Adobe Commerce installations are underway, targeting more than half of all vulnerable stores. According to eCommerce security company Sansec, hackers started exploiting the critical PolyShell issue en masse last week, just two days after public disclosure. “Mass exploitation of PolyShell started on March 19th, and Sansec has now found PolyShell attacks on 56.7% of all vulnerable stores,” Sansec says. The researchers previously reported that the problem lies in Magento’s REST API, which accepts file uploads as part of the custom options for the cart item, allowing polyglot files to achieve remote code execution or account takeover via stored cross-site scripting (XSS), if the web server configuration allows it. Adobe released a fix in version 2.4.9-beta1 on March 10, 2026, but it has not yet reached the stable branch. BleepingComputer previously contacted Adobe to ask about when a security update addressing PolyShell will become available for production versions, but we have not received a response. Meanwhile, Sansec has published a list of IP addresses that target scanning for web stores vulnerable to PolyShell. WebRTC skimmer Sansec reports that in some of the attacks suspected to exploit PolyShell, the threat actor delivers a novel payment card skimmer that uses Web Real-Time Communication (WebRTC) to exfiltrates data. WebRTC uses DTLS-encrypted UDP rather than HTTP, so it is more likely to evade security controls even on sites with strict Content Security Policy (CSP) controls like "connect-src." The skimmer is a lightweight JavaScript loader that connects to a hardcoded command-and-control (C2) server via WebRTC, bypassing normal signaling by embedding a forged SDP exchange. It receives a second-stage payload over the encrypted channel, then executes it while bypassing CSP, primarily by reusing an existing script nonce, or falling back to unsafe-eval or direct script injection. Execution is delayed using ‘requestIdleCallback’ to reduce detection. Sansec noted that this skimmer was detected on the e-commerce website of a car maker valued at over $100 billion, which did not respond to their notifications. The researchers provide a set of indicators of compromise that can help defenders protect against these attacks. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Cybersecurity researchers have flagged a new evolution of the GlassWorm campaign that delivers a multi-stage framework capable of comprehensive data theft and installing a remote access trojan (RAT), which deploys an information-stealing Google Chrome extension masquerading as an offline version of Google Docs. "It logs keystrokes, dumps cookies and session tokens, captures screenshots, and takes commands from a C2 server hidden in a Solana blockchain memo," Aikido security researcher Ilyas Makari said in a report published last week. GlassWorm is the moniker assigned to a persistent campaign that obtains an initial foothold through rogue packages published across npm, PyPI, GitHub, and the Open VSX marketplace. In addition, the operators are known to compromise the accounts of project maintainers to push poisoned updates. The attacks are careful enough to avoid infecting systems with a Russian locale and use Solana transactions as a dead drop resolver to fetch the command-and-control (C2) server ("45.32.150[.]251") and download operating system-specific payloads. The stage two payload is a data-theft framework with credential harvesting, cryptocurrency wallet exfiltration, and system profiling capabilities. The collected data is compressed into a ZIP archive and exfiltrated to an external server ("217.69.3[.]152/wall"). It also incorporates functionality to retrieve and launch the final payload. Once the data is transmitted, the attack chain involves fetching two additional components: a .NET binary that is designed to carry out hardware wallet phishing and a Websocket-based JavaScript RAT to siphon web browser data and run arbitrary code. The RAT payload is fetched from "45.32.150[.]251" by using a public Google Calendar event URL as a dead drop resolver. The .NET binary leverages the Windows Management Instrumentation (WMI) infrastructure to detect USB device connections and displays a phishing window when a Ledger or Trezor hardware wallet is plugged in. "The Ledger UI displays a fake configuration error and presents 24 numbered recovery phrase input fields," Makari noted. "The Trezor UI displays a fake "Firmware validation failed, initiating emergency reboot" message with the same 24-word input layout. Both windows include a 'RESTORE WALLET' button." The malware not only kills any real Ledger Live processes running on the Windows host, but also re-displays the phishing window if the victim closes it. The end goal of the attack is to capture the wallet recovery phrase and transmit it to the IP address "45.150.34[.]158." The RAT, on the other hand, uses a Distributed Hash Table (DHT) to retrieve the C2 details. In the event the mechanism returns no value, the malware switches to the Solana-based dead drop. The RAT then establishes communication with the server to run various commands on the compromised system - start_hvnc / stop_hvnc, to deploy a Hidden Virtual Network Computing (HVNC) module for remote desktop access. start_socks / stop_socks, to launch a WebRTC module and run it as a SOCKS proxy. reget_log, to steal data from web browsers, such as Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Vivaldi, and Mozilla Firefox. The component is equipped to bypass Chrome's app-bound encryption (ABE) protections. get_system_info, to send system information. command, to execute attacker-supplied JavaScript via eval(). The RAT also force-installs a Google Chrome extension named Google Docs Offline on Windows and macOS systems, which then connects to a C2 server and receives commands issued by the operator, allowing to gather cookies, localStorage, the full Document Object Model (DOM) tree of the active tab, bookmarks, screenshots, keystrokes, clipboard content, up to 5,000 browser history entries, and the installed extensions list. "The extension also performs targeted session surveillance. It pulls monitored site rules from /api/get-url-for-watch and ships with Bybit (.bybit.com) pre-configured as a target, watching for the secure-token and deviceid cookies," Aikido said. "On detection, it fires an auth-detected webhook to /api/webhook/auth-detected containing the cookie material and page metadata. The C2 can also supply redirect rules that force active tabs to attacker-controlled URLs." The discovery coincides with yet another shift in GlassWorm tactics, with the attackers publishing npm packages impersonating the WaterCrawl Model Context Protocol (MCP) server ("@iflow-mcp/watercrawl-watercrawl-mcp) to distribute malicious payloads. "This is GlassWorm's first confirmed move into the MCP ecosystem," Koi security researcher Lotan Sery said. "And given how fast AI-assisted development is growing – and how much trust MCP servers are given by design – this won't be the last." Developers are advised to exercise caution when it comes to installing Open VSX extensions, npm packages, and MCP servers. It's also recommended to verify publisher names, package histories, and avoid blindly trusting download counts. Polish cybersecurity company AFINE has published an open-source Python tool called glassworm-hunter to scan developer systems for payloads associated with the campaign. "Glassworm-hunter makes zero network requests during scanning," researchers Paweł Woyke and Sławomir Zakrzewski said. "No telemetry. No phone-home. No automatic update checks. It reads local files only. Glassworm-hunter update is the only command that touches the network. It fetches the latest IoC database from our GitHub and saves it locally."

Researchers uncover AI-powered vishing platform A vishing-as-a-service platform that helps scammers carry out so-called “press 1” scams is misusing text-to-speech (TTS) capabilities provided by AI voice technology company ElevenLabs, Mirage Security researchers claim. How “press 1” vishing scams work For “press 1” scams, fraudsters spoof phone numbers of trusted institutions (e.g., bank), call up potential victims and try to scare them with pre-recorded messages into sharing sensitive information. When impersonating banks, for example, the fraudsters first play a message that claims the users’ account has been compromised or that the bank has spotted fraudulent transactions tied to it, and instruct potential victims to press “1” on their phone keyboard if they want to resolve the issue. Those who do are connected to a scammer posing as an employee of the institution, who then carries the scam through to completion or until the victim catches on. With the P1 (p1bot.io) platform, the scammers don’t have to talk to the potential victims during a live call – they move the scam along by playing messages that have been pre-recorded with natural AI-generated voices. “We’ve seen open-source OTP bot kits on GitHub that wire together ElevenLabs and Twilio, and academic researchers demonstrated a fully automated AI vishing system (ViKing) using the same stack in a controlled study,” says Mirage Security CEO Ross Lazerowitz. “But p1bot represents something different: a commercial, subscription-based platform where ElevenLabs is embedded as a first-class feature, not bolted on by individual operators. The integration is polished, the voice catalog is curated, and the workflow is designed to lower the barrier for anyone willing to pay.” How p1bot streamlines vishing attacks Would-be scammers register to use p1bot via a Telegram bot, pay $399 per month via a OxaPay crypto payment gateway, and get access to the web-based dashboard. At its core, p1bot is a browser-based softphone, Mirage Security found. Via its interface, the operators can spoof phone numbers, generate AI voice prompts, place calls via WebRTC, capture DTMF tones (i.e., the sounds produced when the victim is pressing keys on a phone), record calls, and play pre-generated audio clips mid-call to simulate automated interactive voice response (IVR) systems. Operators create fake IVR clips via the “Generate TTS” page, and save them in the Audio Library so they can use them during live calls. The Generate TTS page (Source: Mirage Security) “[The platform] ships with a hardcoded catalog of ElevenLabs voice IDs: 15 English, 4 French, and 4 Spanish voices, each mapped to a real ElevenLabs voice profile,” Lazerowitz says. The platform-provided APIs are backed by p1bot’s accounts, he told Help Net Security, but operators with their own ElevenLabs account can extend the platform’s voice capabilities (e.g., paste custom voice IDs). Exposed JavaScript helped researchers dissect p1bot Lazerowitz told us that they managed to discover all of this because the platform’s client-side JavaScript was not obfuscated or access-restricted, which allowed them to analyze the application logic, API integrations, and embedded credentials without creating accounts or placing any calls. They’ve also looked at the diagnostic log messages left enabled in the production version of the app, and found many indicators that point to the platform having been built with the help of coding AI assistants. The integration of ElevenLabs’ voices into the platform means that criminals are not developing new AI capabilities, Lazerowitz noted, but subscribing to the same commercial services as everyone else. “When we reported our findings to ElevenLabs, their security team responded quickly, investigated the abusive accounts, and took action. That kind of responsiveness, combined with the traceability features ElevenLabs has built into their platform, demonstrates that disruption is possible when researchers and vendors work together,” he concluded. ElevenLabs monitors user-generated content to detect harmful activities and accepts reports of concerning content. When abuse is detected, they ban accounts and – when required by law – they report them to government authorities. Help Net Security has reached out to ElevenLabs for a comment on Mirage Security’s report, but they declined to comment on this specific case. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

Cybersecurity researchers have disclosed that artificial intelligence (AI) assistants that support web browsing or URL fetching capabilities can be turned into stealthy command-and-control (C2) relays, a technique that could allow attackers to blend into legitimate enterprise communications and evade detection. The attack method, which has been demonstrated against Microsoft Copilot and xAI Grok, has been codenamed AI as a C2 proxy by Check Point. It leverages "anonymous web access combined with browsing and summarization prompts," the cybersecurity company said. "The same mechanism can also enable AI-assisted malware operations, including generating reconnaissance workflows, scripting attacker actions, and dynamically deciding 'what to do next' during an intrusion." The development signals yet another consequential evolution in how threat actors could abuse AI systems, not just to scale or accelerate different phases of the cyber attack cycle, but also leverage APIs to dynamically generate code at runtime that can adapt its behavior based on information gathered from the compromised host and evade detection. AI tools already act as a force multiplier for adversaries, allowing them to delegate key steps in their campaigns, whether it be for conducting reconnaissance, vulnerability scanning, crafting convincing phishing emails, creating synthetic identities, debugging code, or developing malware. But AI as a C2 proxy goes a step further. It essentially leverages Grok and Microsoft Copilot's web-browsing and URL-fetch capabilities to retrieve attacker-controlled URLs and return responses through their web interfaces, essentially transforming it into a bidirectional communication channel to accept operator-issued commands and tunnel victim data out. Notably, all of this works without requiring an API key or a registered account, thereby rendering traditional approaches like key revocation or account suspension useless. Viewed differently, this approach is no different from attack campaigns that have weaponized trusted services for malware distribution and C2. It's also referred to as living-off-trusted-sites (LOTS). However, for all this to happen, there is a key prerequisite: the threat actor must have already compromised a machine by some other means and installed malware, which then uses Copilot or Grok as a C2 channel using specially crafted prompts that cause the AI agent to contact the attacker-controlled infrastructure and pass the response containing the command to be executed on the host back to the malware. Check Point also noted that an attacker could go beyond command generation to make use of the AI agent to devise an evasion strategy and determine the next course of action by passing details about the system and validating if it's even worth exploiting. "Once AI services can be used as a stealthy transport layer, the same interface can also carry prompts and model outputs that act as an external decision engine, a stepping stone toward AI-Driven implants and AIOps-style C2 that automate triage, targeting, and operational choices in real time," Check Point said. The disclosure comes weeks after Palo Alto Networks Unit 42 demonstrated a novel attack technique where a seemingly innocuous web page can be turned into a phishing site by using client-side API calls to trusted large language model (LLM) services for generating malicious JavaScript dynamically in real time. The method is similar to Last Mile Reassembly (LMR) attacks, which involves smuggling malware through the network via unmonitored channels like WebRTC and WebSocket, and piecing them directly in the victim's browser, effectively bypassing security controls in the process. "Attackers could use carefully engineered prompts to bypass AI safety guardrails, tricking the LLM into returning malicious code snippets," Unit 42 researchers Shehroze Farooqi, Alex Starov, Diva-Oriane Marty, and Billy Melicher said. "These snippets are returned via the LLM service API, then assembled and executed in the victim's browser at runtime, resulting in a fully functional phishing page."

In April 2025, we reported on a then-new iteration of the Triada backdoor that had compromised the firmware of counterfeit Android devices sold across major marketplaces. The malware was deployed to the system partitions and hooked into Zygote – the parent process for all Android apps – to infect any app on the device. This allowed the Trojan to exfiltrate credentials from messaging apps and social media platforms, among other things. This discovery prompted us to dive deeper, looking for other Android firmware-level threats. Our investigation uncovered a new backdoor, dubbed Keenadu, which mirrored Triada’s behavior by embedding itself into the firmware to compromise every app launched on the device. Keenadu proved to have a significant footprint; following its initial detection, we saw a surge in support requests from our users seeking further information about the threat. This report aims to address most of the questions and provide details on this new threat. Our findings can be summarized as follows: We discovered a new backdoor, which we dubbed Keenadu, in the firmware of devices belonging to several brands. The infection occurred during the firmware build phase, where a malicious static library was linked with libandroid_runtime.so . Once active on the device, the malware injected itself into theZygote process, similarly to Triada. In several instances, the compromised firmware was delivered with an OTA update. A copy of the backdoor is loaded into the address space of every app upon launch. The malware is a multi-stage loader granting its operators the unrestricted ability to control the victim’s device remotely. We successfully intercepted the payloads retrieved by Keenadu. Depending on the targeted app, these modules hijack the search engine in the browser, monetize new app installs, and stealthily interact with ad elements. One specific payload identified during our research was also found embedded in numerous standalone apps distributed via third-party repositories, as well as official storefronts like Google Play and Xiaomi GetApps. In certain firmware builds, Keenadu was integrated directly into critical system utilities, including the facial recognition service, the launcher app, and others. Our investigation established a link between some of the most prolific Android botnets: Triada, BADBOX, Vo1d, and Keenadu. The complete Keenadu infection chain looks like this: Kaspersky solutions detect the threats described below with the following verdicts: HEUR:Backdoor.AndroidOS.Keenadu.* HEUR:Trojan-Downloader.AndroidOS.Keenadu.* HEUR:Trojan-Clicker.AndroidOS.Keenadu.* HEUR:Trojan-Spy.AndroidOS.Keenadu.* HEUR:Trojan.AndroidOS.Keenadu.* HEUR:Trojan-Dropper.AndroidOS.Gegu.* Malicious dropper in libandroid_runtime.so At the very beginning of the investigation, our attention was drawn to suspicious libraries located at /system/lib/libandroid_runtime.so and /system/lib64/libandroid_runtime.so – we will use the shorthand /system/lib[64]/ to denote these two directories. The library exists in the original Android source. Specifically, it defines the println_native native method for the android.util.Log class. Apps utilize this method to write to the logcat system log. In the suspicious libraries, the implementation of println_native differed from the legitimate version by the call of a single function: The suspicious function decrypted data from the library body using RC4 and wrote it to /data/dalvik-cache/arm[64]/system@framework@[email protected]. The data represents a payload that is loaded via DexClassLoader. The entry point within it is the main method of the com.ak.test.Main class, where “ak” likely refers to the author’s internal name for the malware; this letter combination is also used in other locations throughout the code. In particular, the developers left behind a significant amount of code that writes error messages to the logcat log during the malware’s execution. These messages have the AK_CPP tag. The payload checks whether it is running within system apps belonging either to Google services or to Sprint or T-Mobile carriers. The latter apps are typically found in specialized device versions that carriers sell at a discount, provided the buyer signs a service contract. The malware aborts its execution if it finds that it’s running within these processes. It also implements a kill switch that terminates its execution if it finds files with specific names in system directories. Next, the Trojan checks if it is running within the system_server process. This process controls the entire system and possesses maximum privileges; it is launched by the Zygote process when it starts. If the check returns positive, the Trojan creates an instance of the AKServer class; if the code is running in any other process, it creates an instance of the AKClient class instead. It then calls the new object’s virtual method, passing the app process name to it. The class names suggest that the Trojan is built upon a client-server architecture. The system_server process creates and launches various system services with the help of the SystemServiceManager class. These services are based on a client-server architecture, and clients for them are requested within app code by calling the Context.getSystemService method. Communication with the server-side component uses the Android inter-process communication (IPC) primitive, binder. This approach offers numerous security and other benefits. These include, among other things, the ability to restrict certain apps from accessing various system services and their functionality, as well as the presence of abstractions that simplify the use of this access for developers while simultaneously protecting the system from potential vulnerabilities in apps. The authors of Keenadu designed it in a similar fashion. The core logic is located in the AKServer class, which operates within the system_server process. AKServer essentially represents a malicious system service, while AKClient acts as the interface for accessing AKServer via binder. For convenience, we provide a diagram of the backdoor’s architecture below: It is important to highlight Keenadu as yet another case where we find key Android security principles being compromised. First, because the malware is embedded in libandroid_runtime.so, it operates within the context of every app on the device, thereby gaining access to all their data and rendering the system’s intended app sandboxing meaningless. Second, it provides interfaces for bypassing permissions (discussed below) that are used to control app privileges within the system. Consequently, it represents a full-fledged backdoor that allows attackers to gain virtually unrestricted control over the victim’s device. AKClient architecture AKClient is relatively straightforward in its design. It is injected into every app launched on the device and retrieves an interface instance for server communication via a protected broadcast (com.action.SystemOptimizeService). Using binder, this interface sends an attach transaction to the malicious AKServer, passing an IPC wrapper that facilitates the loading of arbitrary DEX files within the context of the compromised app. This allows AKServer to execute custom malicious payloads tailored to the specific app it has targeted. AKServer architecture At the start of its execution, AKServer sends two protected broadcasts: com.action.SystemOptimizeService and com.action.SystemProtectService. As previously described, the first broadcast delivers an interface instance to other AKClient-infected processes for interacting with AKServer. Along with the com.action.SystemProtectService message, an instance of another interface for interacting with AKServer is transmitted. Malicious modules downloaded within the contexts of other apps can use this interface to: Grant any permission to an arbitrary app on the device. Revoke any permission from an arbitrary app on the device. Retrieve the device’s geolocation. Exfiltrate device information. Once interaction between the server and client components is established, AKServer launches its primary malicious task, titled MainWorker. Upon its initial launch, MainWorker logs the current system time. Following this, the malware checks the device’s language settings and time zone. If the interface language is a Chinese dialect and the device is located within a Chinese time zone, the malware terminates. It also remains inactive if either the Google Play Store or Google Play Services are absent from the device. If the device passes these checks, the Trojan initiates the PluginTask task. At the start of its routine, PluginTask decrypts the command-and-control server addresses from the code as follows: The encrypted address string is decoded using Base64. The resulting data, a gzip-compressed buffer, is then decompressed. The decompressed data is decrypted using AES-128 in CFB mode. The decryption key is the MD5 hash of the string "ota.host.ba60d29da7fd4794b5c5f732916f7d5c" , and the initialization vector is the string"0102030405060708" . After decrypting the C2 server addresses, the Trojan collects victim device metadata, such as the model, IMEI, MAC address, and OS version, and encrypts it using the same method as the server addresses, but this time it utilizes the MD5 hash of the string "ota.api.bbf6e0a947a5f41d7f5226affcfd858c" as the AES key. The encrypted data is sent to the C2 server via a POST request to the path /ak/api/pts/v4. The request parameters include two values: m: the MD5 hash of the device IMEI n: the network connection type (“w” for Wi-Fi, and “m” for mobile data) The response from the C2 server contains a code field, which may hold an error code returned by the server. If this field has a zero value, no error has occurred. In this case, the response will include a data field: a JSON object encrypted in the same manner as the request data and containing information about the payloads. How Keenadu compromised libandroid_runtime.so After analyzing the initial infection stages, we set out to determine exactly how the backdoor was being integrated into Android device firmware. Almost immediately, we discovered public reports from Alldocube tablet users regarding suspicious DNS queries originating from their devices. This vendor had previously acknowledged the presence of malware in one of its tablet models. However, the company’s statement contained no specifics regarding which malware had compromised the devices or how the breach occurred. We will attempt to answer these questions. The DNS queries described by the original complainant also appeared suspicious to us. According to our telemetry, the Keenadu C2 domains obtained at that time resolved to the IP addresses listed below: 67.198.232[.]4 67.198.232[.]187 The domains keepgo123[.]com and gsonx[.]com mentioned in the complaint resolved to these same addresses, which may indicate that the complainant’s tablet was also infected with Keenadu. However, matching IP addresses alone is insufficient for a definitive attribution. To test this hypothesis, it was necessary to examine the device itself. We considered purchasing the same tablet model, but this proved unnecessary: as it turns out, Alldocube publishes firmware archives for its devices publicly, allowing anyone to audit them for malware. To analyze the firmware, one must first determine the storage format of its contents. Alldocube firmware packages are RAR archives containing various image files, other types of files, and a Windows-based flashing utility. From an analytical standpoint, the Android file system holds the most value. Its primary partitions, including the system partition, are contained within the image file super.img. This is an Android Sparse Image. For the sake of brevity, we will omit a technical breakdown of this format (which can be reconstructed from the libsparse code); it is sufficient to note that there are open-source utilities to extract partitions from these files in the form of standard file system images. We extracted libandroid_runtime.so from the Alldocube iPlay 50 mini Pro (T811M) firmware dated August 18, 2023. Upon examining the library, we discovered the Keenadu backdoor. Furthermore, we decrypted the payload and extracted C2 server addresses hosted on the keepgo123[.]com and gsonx[.]com domains, confirming the user’s suspicions: their devices were indeed infected with this backdoor. Notably, all subsequent firmware versions for this model also proved to be infected, including those released after the vendor’s public statement. Special attention should be paid to the firmware for the Alldocube iPlay 50 mini Pro NFE model. The “NFE” (Netflix Enabled) part of the name indicates that these devices include an additional DRM module to support high-quality streaming. To achieve this, they must meet the Widevine L1 standard under the Google Widevine DRM premium media protection system. Consequently, they process media within a TEE (Trusted Execution Environment), which mitigates the risk of untrusted code accessing content and thus prevents unauthorized media copying. While Widevine certification failed to protect these devices from infection, the initial Alldocube iPlay 50 mini Pro NFE firmware (released November 7, 2023) was clean – unlike other models’ initial firmware. However, every subsequent version, including the latest release from May 20, 2024, contained Keenadu. Recently, Alldocube issued several new firmware versions and asked Kaspersky to check them for Keenadu. Kaspersky can confirm that the firmware versions that Alldocube has shared are not infected. During our analysis of the Alldocube device firmware, we discovered that all images carried valid digital signatures. This implies that simply compromising an OTA update server would have been insufficient for an attacker to inject the backdoor into libandroid_runtime.so. They would also need to gain possession of the private signing keys, which normally should not be accessible from an OTA server. Consequently, it is highly probable that the Trojan was integrated into the firmware during the build phase. Furthermore, we have found a static library, libVndxUtils.a (MD5: ca98ae7ab25ce144927a46b7fee6bd21), containing the Keenadu code, which further supports our hypothesis. This malicious library is written in C++ and was compiled using the CMake build system. Interestingly, the library retained absolute file paths to the source code on the developer’s machine: D:\work\git\zh\os\ak-client\ak-client\loader\src\main\cpp\__log_native_load.cpp: this file contains the dropper code. D:\work\git\zh\os\ak-client\ak-client\loader\src\main\cpp\__log_native_data.cpp: this file contains the RC4-encrypted payload along with its size metadata. The dropper’s entry point is the function __log_check_tag_count. The attacker inserted a call to this function directly into the implementation of the println_native method. According to our data, the malicious dependency was located within the firmware source code repository at the following paths: vendor/mediatek/proprietary/external/libutils/arm/libVndxUtils.a vendor/mediatek/proprietary/external/libutils/arm64/libVndxUtils.a Interestingly, the Trojan within libandroid_runtime.so decrypts and writes the payload to disk at /data/dalvik-cache/arm[64]/system@framework@[email protected]. The attacker most likely attempted to disguise the malicious libandroid_runtime.so dependency as a supposedly legitimate “vndx” component containing proprietary code from MediaTek. In reality, no such component exists in MediaTek products. Finally, according to our telemetry, the Trojan is found not only in Alldocube devices but also in hardware from other manufacturers. In all instances, the backdoor is embedded within tablet firmware. We have notified these vendors about the compromise. Based on the evidence presented above, we believe that Keenadu was integrated into Android device firmware as the result of a supply chain attack. One stage of the firmware supply chain was compromised, leading to the inclusion of a malicious dependency within the source code. Consequently, the vendors may have been unaware that their devices were infected prior to reaching the market. Keenadu backdoor modules As previously noted, the inherent architecture of Keenadu allows attackers to gain virtually unrestricted control over the victim’s device. To understand exactly how they leveraged this capability, we analyzed the payloads downloaded by the backdoor. To achieve this, we crafted a request to the C2 server, masquerading as an infected device. Initially, the C2 server did not deliver any files; instead, it returned a timestamp for the next check-in, scheduled 2.5 months after the initial request. Through black-box analysis of the C2 server, we determined that the request includes the backdoor’s activation time; if 2.5 months have not elapsed since that moment, the C2 will not serve any payloads. This is likely a technique designed to complicate analysis and minimize the probability of these payloads being detected. Once we modified the activation time in our request to a sufficiently distant date in the past, the C2 server returned the list of payloads for analysis. The attacker’s server delivers information about the payloads as an object array. Each object contains a download link for the payload, its MD5 hash, target app package names, target process names, and other metadata. An example of such an object is provided below. Notably, the attackers chose Alibaba Cloud as their CDN provider. Files downloaded by Keenadu utilize a proprietary format to store the encrypted payload and its configuration. A pseudocode description of this format is presented below (struct KeenaduPayload): After downloading, Keenadu verifies the file integrity using MD5. The Trojan’s creators also implemented a code-signing mechanism using the DSA algorithm. The signature is verified before the payload is decrypted and executed. This ensures that only an attacker in possession of the private key can generate malicious payloads. Upon successful verification, the configuration and the malicious module are decrypted using AES-128 in CFB mode. The decryption key is the MD5 hash of the string that is a concatenation of "37d9a33df833c0d6f11f1b8079aaa2dc" and a salt, while the initialization vector is the string "0102030405060708". The configuration contains information regarding the module’s entry and exit points, its name, and its version. An example configuration for one of the modules is provided below. Having outlined the backdoor’s algorithm for loading malicious modules, we will now proceed to their analysis. Keenadu loader This module (MD5: 4c4ca7a2a25dbe15a4a39c11cfef2fb2) targets popular online storefronts with the following package names: com.amazon.mShop.android.shopping (Amazon) com.zzkko (SHEIN) com.einnovation.temu (Temu) The entry point is the start method of the com.ak.p.d.MainApi class. This class initiates a malicious task named HsTask, which serves as a loader conceptually similar to AKServer. Upon execution, the loader collects victim device metadata (model, IMEI, MAC address, OS version, and so on) as well as information regarding the specific app within which it is running. The collected data is encoded using the same method as the AKServer requests sent to /ak/api/pts/v4. Once encoded, the loader exfiltrates the data via a POST request to the C2 server at /ota/api/tasks/v3. In response, the attackers’ server returns a list of modules for download and execution, as well as a list of APK files to install on the victim’s device. Interestingly, in newer Android versions, the delivery of these APKs is implemented via installation sessions. This is likely an attempt by the malware to bypass restrictions introduced in recent OS versions, which prevent sideloaded apps from accessing sensitive permissions – specifically accessibility services. Unfortunately, during our research, we were unable to obtain samples of the specific modules and APK files downloaded by this loader. However, users online have reported that infected tablets were adding items to marketplace shopping carts without the user’s knowledge. Clicker loader These modules (such as ad60f46e724d88af6bcacb8c269ac3c1) are injected into the following apps: Wallpaper (com.android.wallpaper) YouTube (com.google.android.youtube) Facebook (com.facebook.katana) Digital Wellbeing (com.google.android.apps.wellbeing) System launcher (com.android.launcher3) Upon execution, the malicious module retrieves the device’s location and IP address using a GeoIP service deployed on the attackers’ C2 server. This data, along with the network connection type and OS version, is exfiltrated to the C2. In response, the server returns a specially formatted file containing an encrypted JSON object with payload information, as well as a XOR key for decryption. The structure of this file is described below using pseudocode: The decrypted JSON consists of an array of objects containing download links for the payloads and their respective entry points. An example of such an object is provided below. The payloads themselves are encrypted using the same logic as the JSON. In the course of our research, we obtained several payloads whose primary objective was to interact with advertising elements on various themed websites: gaming, recipes, and news. Each specific module interacts with one particular website whose address is hardcoded into its source. Google Chrome module This module (MD5: 912bc4f756f18049b241934f62bfb06c) targets the Google Chrome browser (com.android.chrome). At the start of its execution, it registers an Activity Lifecycle Callback handler. Whenever an activity is launched within the target app, this handler checks its name. If the name matches the string "ChromeTabbedActivity", the Trojan searches for a text input field (used for search queries and URLs) named url_bar. If the element is found, the malware monitors text changes within it. All search queries entered by the user into the url_bar field are exfiltrated to the attackers’ server. Furthermore, once the user finishes typing a query, the Trojan can hijack the search request and redirect it to a different search engine, depending on the configuration received from the C2 server. It is worth noting that the hijacking attempt may fail if the user selects a query from the autocomplete suggestions; in this scenario, the user does not hit Enter or tap the search button in the url_bar, which would signal the malware to trigger the redirect. However, the attackers anticipated this too. The Trojan attempts to locate the omnibox_suggestions_dropdown element within the current activity, a ViewGroup containing the search suggestions. The malware monitors taps on these suggestions and proceeds to redirect the search engine regardless. The Nova (Phantom) clicker The initial version of this module (MD5: f0184f6955479d631ea4b1ea0f38a35d) was a clicker embedded within the system wallpaper picker (com.android.wallpaper). Researchers at Dr. Web discovered it concurrently with our investigation; however, their report did not mention the clicker’s distribution vector via the Keenadu backdoor. The module utilizes machine learning and WebRTC to interact with advertising elements. While our colleagues at Dr. Web named it Phantom, the C2 server refers to it as Nova. Furthermore, the task executed within the code is named NovaTask. Based on this, we believe the original name of the clicker is Nova. It is also worth noting that shortly after the publication of the report on this clicker, the Keenadu C2 server began deleting it from infected devices. This is likely a strategic move by the attackers to evade further detection. Interestingly, in the unload request, the Nova module appeared under a slightly different name. We believe this new name disguises the latest version of the module, which functions as a loader capable of downloading the following components: The Nova clicker. A Spyware module which exfiltrates various types of victim device information to the attackers’ server. The Gegu SDK dropper. According to our data, this is a multi-stage dropper that launches two additional clickers. Install monetization A module with the MD5 hash 3dae1f297098fa9d9d4ee0335f0aeed3 is embedded into the system launcher (com.android.launcher3). Upon initialization, it runs an environment check for virtual machine artifacts. If none are detected, the malware registers an event handler for session-based app installations. Simultaneously, the module requests a configuration file from the C2 server. An example of this configuration is provided below. When an app installation is initiated on the device, the Trojan transmits data on this app to the C2 server. In response, the server provides information regarding the specific ad used to promote it. For every successfully completed installation session, the Trojan executes GET requests to the URL provided in the tracking_link field in the response, as well as the first link within the click array. Based on the source code, the links in the click array serve as templates into which various advertising identifiers are injected. The attackers most likely use this method to monetize app installations. By simulating traffic from the victim’s device, the Trojan deceives advertising platforms into believing that the app was installed from a legitimate ad tap. Google Play module Even though AKClient shuts down if it is injected into Google Play process, the C2 server have provided us with a payload for it. This module (MD5: 529632abf8246dfe555153de6ae2a9df) retrieves the Google Ads advertising ID and stores it via a global instance of the Settings class under the key S_GA_ID3. Subsequently, other modules may utilize this value as a victim identifier. Other Keenadu distribution vectors During our investigation, we decided to look for alternative sources of Keenadu infections. We discovered that several of the modules described above appeared in attacks that were not linked to the compromise of libandroid_runtime.so. Below are the details of these alternative vectors. System apps According to our telemetry, the Keenadu loader was found within various system apps in the firmware of several devices. One such app (MD5: d840a70f2610b78493c41b1a344b6893) was a face recognition service with the package name com.aiworks.faceidservice. It contains a set of trained machine-learning models used for facial recognition – specifically for authorizing users via Face ID. To facilitate this, the app defines a service named com.aiworks.lock.face.service.FaceLockService, which the system UI (com.android.systemui) utilizes to unlock the device. Within the onCreate method of the com.aiworks.lock.face.service.FaceLockService, triggered upon that service’s creation, three receivers are registered. These receivers monitor screen on/off events, the start of charging, and the availability of network access. Each of these receivers calls the startMars method whose primary purpose is to initialize the malicious loader by calling the init method of the com.hs.client.TEUtils class. The loader is a slightly modified version of the Keenadu loader. This specific variant utilizes a native library libhshelper.so to load modules and facilitate APK installs. To accomplish this, the library defines corresponding native methods within the com.hs.helper.NativeMain class. This specific attack vector – embedding a loader within system apps – is not inherently new. We have previously documented similar cases, such as the Dwphon loader, which was integrated into system apps responsible for OTA updates. However, this marks the first time we have encountered a Trojan embedded within a facial recognition service. In addition to the face recognition service, we identified other system apps infected with the Keenadu loader. These included the launcher app on certain devices (MD5: 382764921919868d810a5cf0391ea193). A malicious service, com.pri.appcenter.service.RemoteService, was embedded into these apps to trigger the Trojan’s execution. We also discovered the Keenadu loader within the app with package name com.tct.contentcenter (MD5: d07eb2db2621c425bda0f046b736e372). This app contains the advertising SDK fwtec, which retrieved its configuration via an HTTP GET request to hxxps://trends.search-hub[.]cn/vuGs8 with default redirection disabled. In response, the Trojan expected a 302 redirect code where the Location header provided an URL containing the SDK configuration within its parameters. One specific parameter, hsby_search_switch, controlled the activation of the Keenadu loader: if its value was set to 1, the loader would initialize within the app. Loading via other backdoors While analyzing our telemetry, we discovered an unusual version of the Keenadu loader (MD5: f53c6ee141df2083e0200a514ba19e32) located in the directories of various apps within external storage, specifically at paths following the pattern: /storage/emulated/0/Android/data/%PACKAGE%/files/.dx/. Based on the code analysis, this loader was designed to operate within a system where the system_server process had already been compromised. Notably, the binder interface names used in this version differed from those used by AKServer. The loader utilized the following interfaces: com.androidextlib.sloth.api.IPServiceM com.androidextlib.sloth.api.IPermissionsM These same binder interfaces are defined by another backdoor that is structured similarly and was also discovered within libandroid_runtime.so. The execution of this other backdoor on infected devices proceeds as follows: libandroid_runtime.so imports a malicious function __android_log_check_loggable from the liblog.so library (MD5: 3d185f30b00270e7e30fc4e29a68237f). This function is called within the implementation of the println_native native method of the android.util.Log class. It decrypts a payload embedded in the library’s body using a single-byte XOR and executes it within the context of all apps on the device. The payload shares many similarities with BADBOX, a comprehensive malware platform first described by researchers at HUMAN Security. Specifically, the C2 server paths used for the Trojan’s HTTP requests are a match. This leads us to believe that this is a specific variant of BADBOX. Within this backdoor, we also discovered the binder interfaces utilized by the aforementioned Keenadu loader. This suggests that those specific instances of Keenadu were deployed directly by BADBOX. Modifications of popular apps Unfortunately, even if your firmware does not contain Keenadu or another pre-installed backdoor, the Trojan still poses a threat to you. The Nova (Phantom) clicker was discovered by researchers at Dr. Web around the same time as we held our investigation. Their findings highlight a different distribution vector: modified versions of popular software distributed primarily through unofficial sources, as well as various apps found in the GetApps store. Google Play Infected apps have managed to infiltrate Google Play too. During our research, we identified trojanized software for smart cameras published on the official Android app store. Collectively, these apps had been downloaded more than 300,000 times. Each of these apps contained an embedded service named com.arcsoft.closeli.service.KucopdInitService, which launched the aforementioned Nova clicker. We alerted Google to the presence of the infected apps in its store, and they removed the malware. Curiously, while the malicious service was present in all identified apps, it was configured to execute only in one specific package: com.taismart.global. The Fantastic Four: how Triada, BADBOX, Vo1d, and Keenadu are connected After discovering that BADBOX downloads one of the Keenadu modules, we decided to conduct further research to determine if there were any other signs of a connection between these Trojans. As a result, we found that BADBOX and Keenadu shared similarities in the payload code that was decrypted and executed by the malicious code in libandroid_runtime.so. We also identified similarities between the Keenadu loader and the BB2DOOR module of the BADBOX Trojan. Given that there are also distinct differences in the code, and considering that BADBOX was downloading the Keenadu loader, we believe these are separate botnets, and the developers of Keenadu likely found inspiration in the BADBOX source code. Furthermore, the authors of Keenadu appear to target Android tablets primarily. In our recent report on the Triada backdoor, we mentioned that the C2 server for one of its downloaded modules was hosted on the same domain as one of the Vo1d botnet’s servers, which could suggest a link between those two Trojans. However, during the current investigation, we managed to uncover a connection between Triada and the BADBOX botnet as well. As it turns out, the directories where BADBOX downloaded the Keenadu loader also contained other payloads for various apps. Their description warrants a separate report; for the sake of brevity, we will not delve into the details here, limiting ourselves to the analysis of a payload for the Telegram and Instagram clients (MD5: 8900f5737e92a69712481d7a809fcfaa). The entry point for this payload is the com.extlib.apps.InsTGEnter class. The payload is designed to steal victims’ account credentials in the infected services. Interestingly, it also contains code for stealing credentials from the WhatsApp client, though it is currently not utilized. The C2 server addresses used by the Trojan to exfiltrate device data are stored in the code in an encrypted format. They are first decoded using Base64 and then decrypted via a XOR operation with the string "xiwljfowkgs". After decrypting the C2 addresses, we discovered the domain zcnewy[.]com, which we had previously identified in 2022 during our investigation of malicious WhatsApp mods containing Triada. At that time, we assumed that the code segment responsible for stealing WhatsApp credentials and the malicious dropper both belonged to Triada. However, since we have now established that zcnewy[.]com is linked to BADBOX, we believe that the infected WhatsApp modifications we described in 2022 actually contained two distinct Trojans: Triada and BADBOX. To verify this hypothesis, we re-examined one of those modifications (MD5: caa640824b0e216fab86402b14447953) and confirmed that it contained the code for both the Triada dropper and a BADBOX module functionally similar to the one described above. Although the Trojans were launched from the same entry point, they did not interact with each other and were structured in entirely different ways. Based on this, we conclude that what we observed in 2022 was a joint attack by the BADBOX and Triada operators. These findings show that several of the largest Android botnets are interacting with one another. Currently, we have confirmed links between Triada, Vo1d, and BADBOX, as well as the connection between Keenadu and BADBOX. Researchers at HUMAN Security have also previously reported a connection between Vo1d and BADBOX. It is important to emphasize that these connections are not necessarily transitive. For example, the fact that both Triada and Keenadu are linked to BADBOX does not automatically imply that Triada and Keenadu are directly connected; such a claim would require separate evidence. However, given the current landscape, we would not be surprised if future reports provide the evidence needed to prove the transitivity of these relationships. Victims According to our telemetry, 13,715 users worldwide have encountered Keenadu or its modules. Our security solutions recorded the highest number of users attacked by the malware in Russia, Japan, Germany, Brazil and the Netherlands. Recommendations Our technical support team is often asked what steps should be taken if a security solution detects Keenadu on a device. In this section, we examine all possible scenarios for combating this Trojan. If the libandroid_runtime.so library is infected Modern versions of Android mount the system partition, which contains libandroid_runtime.so, as read-only. Even if one were to theoretically assume the possibility of editing this partition, the infected libandroid_runtime.so library cannot be removed without damaging the firmware: the device would simply cease to boot. Therefore, it is impossible to eliminate the threat using standard Android OS tools. Operating a device infected with the Keenadu backdoor can involve significant inconveniences. Reviews of infected devices complain about intrusive ads and various mysterious sounds whose source cannot be identified. If you encounter the Keenadu backdoor, we recommend the following: Check for software updates. It is possible that a clean firmware version has already been released for your device. After updating, use a reliable security solution to verify that the issue has been resolved. If a clean firmware update from the manufacturer does not exist for your device, you can attempt to install a clean firmware yourself. However, it is important to remember that manually flashing a device can brick it. Until the firmware is replaced or updated, we recommend that you stop using the infected device. If one of the system apps is infected Unfortunately, as in the previous case, it is not possible to remove such an app from the device because it is located in the system partition. If you encounter the Keenadu loader in a system app, our recommendations are: Find a replacement for the app, if applicable. For example, if the launcher app is infected, you can download any alternative that does not contain malware. If no alternatives exist for the app – for example, if the face recognition service is infected – we recommend avoiding the use of that specific functionality whenever possible. Disable the infected app using ADB if an alternative has been found or you don’t really need it. This can be done with the command adb shell pm disable --user 0 %PACKAGE% . If an infected app has been installed on the device This is one of the simplest cases of infection. If a security solution has detected an app infected with Keenadu on your device, simply uninstall it following the instructions the solution provides. Conclusion Developers of pre-installed backdoors in Android device firmware have always stood out for their high level of expertise. This is still true for Keenadu: the creators of the malware have a deep understanding of the Android architecture, the app startup process, and the core security principles of the operating system. During the investigation, we were surprised by the scope of the Keenadu campaigns: beyond the primary backdoor in firmware, its modules were found in system apps and even in apps from Google Play. This places the Trojan on the same scale as threats like Triada or BADBOX. The emergence of a new pre-installed backdoor of this magnitude indicates that this category of malware is a distinct market with significant competition. Keenadu is a large-scale, complex malware platform that provides attackers with unrestricted control over the victim’s device. Although we have currently shown that the backdoor is used primarily for various types of ad fraud, we do not rule out that in the future, the malware may follow in Triada’s footsteps and begin stealing credentials. Indicators of compromise Additional IoCs, technical details and a YARA rule for detecting Keenadu activity are available to customers of our Threat Intelligence Reporting service. For more details, contact us at [email protected].

Cybersecurity researchers have disclosed details of a new mobile spyware platform dubbed ZeroDayRAT that's being advertised on Telegram as a way to grab sensitive data and facilitate real-time surveillance on Android and iOS devices. "The developer runs dedicated channels for sales, customer support, and regular updates, giving buyers a single point of access to a fully operational spyware panel," Daniel Kelley, security researcher at iVerify, said. "The platform goes beyond typical data collection into real-time surveillance and direct financial theft." ZeroDayRAT is designed to support Android versions 5 through 16 and iOS versions up to 26. It's assessed that the malware is distributed via social engineering or fake app marketplaces. The malicious binaries are generated through a builder that's provided to buyers along with an online panel that they can set up on their own server. Once the malware infects a device, the operator gets to see all the details, including model, location, operating system, battery status, SIM, carrier details, app usage, notifications, and a preview of recent SMS messages, through a self-hosted panel. This information allows the threat actor to profile the victim and glean more about who they talk to and the apps they use the most. The panel also extracts their current GPS coordinates and plots them on Google Maps, along with the history of all locations they have been to over time, effectively turning it into spyware. "One of the more problematic panels is the accounts tab," Kelley added. "Every account registered on the device is enumerated: Google, WhatsApp, Instagram, Facebook, Telegram, Amazon, Flipkart, PhonePe, Paytm, Spotify, and more, each with its associated username or email." Some of the other capabilities of ZeroDayRAT include logging keystrokes, gathering SMS messages -- including one-time passwords (OTPs) to defeat two-factor authentication, as well as allowing hands-on operations, such as activating real-time surveillance via live camera streaming and a microphone feed that allows the adversary to remotely monitor a victim. To enable financial theft, the malware incorporates a stealer component that scans for wallet apps like MetaMask, Trust Wallet, Binance, and Coinbase, and substitutes wallet addresses copied to the clipboard to reroute transactions to a wallet under the attacker's control. There also exists a bank stealer module to target online mobile wallet platforms like Apple Pay, Google Pay, PayPal, along with PhonePe, an Indian digital payments application that allows instant money transfers with the Unified Payments Interface (UPI), a protocol to facilitate inter-bank peer-to-peer and person-to-merchant transactions. "Taken together, this is a complete mobile compromise toolkit, the kind that used to require nation-state investment or bespoke exploit development, now sold on Telegram," Kelley said. "A single buyer gets full access to a target's location, messages, finances, camera, microphone, and keystrokes from a browser tab. Cross-platform support and active development make it a growing threat to both individuals and organizations." The ZeroDayRAT malware is similar to numerous others that have targeted mobile device users, either via phishing or by infiltrating official app marketplaces. Over the past few years, bad actors have repeatedly managed to find various ways to bypass security protections put in place by Apple and Google to trick users into installing malicious apps. Attacks targeting Apple's iOS have typically leveraged an enterprise provisioning capability that allows organizations to install apps without the need for publishing them to the App Store. By marketing tools that combine spyware, surveillance, and information-stealing capabilities, they further lower the barrier of entry for less skilled hackers. They also highlight the evolving sophistication and persistence of mobile-focused cyber threats. News of the commercial spyware platform coincides with the emergence of various mobile malware and scam campaigns that have come to light in recent weeks - An Android remote access trojan (RAT) campaign has used Hugging Face to host and distribute malicious APK files. The infection chain begins when users download a seemingly harmless dropper app (e.g., TrustBastion) that, when opened, prompts users to install an update, which causes the app to download the APK file hosted on Hugging Face. The malware then requests accessibility permissions and access to other sensitive controls to enable surveillance and credential theft. An Android RAT called Arsink has been found to use Google Apps Script for media and file exfiltration to Google Drive, in addition to relying on Firebase and Telegram for C2. The malware, which allows data theft and complete remote control, is distributed via Telegram, Discord, and MediaFire links, while impersonating various popular brands. Arsink infections have been concentrated in Egypt, Indonesia, Iraq, Yemen, and Türkiye. A document reader app named All Document Reader (package name: com.recursivestd.highlogic.stellargrid) uploaded to the Google Play Store has been flagged for acting as an installer for the Anatsa (aka TeaBot and Toddler) banking trojan. The app attracted over 50,000 downloads before it was taken down. An Android banking trojan called deVixor has been actively targeting Iranian users through phishing websites that impersonate legitimate automotive businesses since October 2025. Besides harvesting sensitive information, the malware includes a remotely triggered ransomware module capable of locking devices and demanding cryptocurrency payments. It uses Google Firebase for command delivery and Telegram-based bot infrastructure for administration. A malicious campaign codenamed ShadowRemit has exploited fake Android apps and pages mimicking Google Play app listings to enable unlicensed cross-border money transfers. These bogus pages have been found to promote unauthorized APKs as trusted remittance services with zero fees and improved exchange rates. "Victims are instructed to send payments to beneficiary accounts/eWallet endpoints and provide transaction screenshots as proof for verification," CTM360 said. "This approach can bypass regulated remittance corridors and aligns with mule-account collection patterns." An Android malware campaign targeting users in India has abused the trust associated with government services and official digital platforms to distribute malicious APK files through WhatsApp, leading to the deployment of malware that can steal data, establish persistent control, and run a cryptocurrency miner. The operators of an Android trojan and cybercrime tool called Triada have been observed using phishing landing pages disguised as Chrome browser updates to trick users into downloading malicious APK files hosted on GitHub. According to an analysis by Alex, attackers are "actively taking over long-standing, fully verified advertiser accounts to distribute malicious redirects." A WhatApp-oriented scam campaign has leveraged video calls, in which the threat actor poses as a bank representative or a Meta support and instructs them to share their phone's screen to address a purported unauthorized charge on their credit card, and install a legitimate remote access app, such as AnyDesk or TeamViewer, to steal sensitive data. An Android spyware campaign has leveraged romance scam tactics to target individuals in Pakistan to distribute a malicious dating chat app dubbed GhostChat to exfiltrate victims' data. It's currently not known how the malware is distributed. The threat actors behind the operation are also suspected to be running a ClickFix attack that infects victims' computers with a DLL payload that can gather system metadata and run commands issued by an external server, as well as a WhatsApp device-linking attack called GhostPairing to gain access to their WhatsApp accounts. A new family of Android click fraud trojans called Phantom has been found to leverage TensorFlow.js, a JavaScript machine learning library, to automatically detect and interact with specific advertisement elements on a site loaded in a hidden WebView. An alternative "signaling" mode uses WebRTC to stream a live video feed of the virtual browser screen to the attackers' server and allow them to click, scroll, or enter text. The malware is distributed via mobile games published to Xiaomi's GetApps store and other unofficial, third-party app stores. An Android malware family called NFCShare has been distributed via a Deutsche Bank phishing campaign to deceive users into installing a malicious APK file ("deutsche.apk") under the pretext of an update, which reads NFC card data and exfiltrates it to a remote WebSocket endpoint. The malware shares similarities with NFC relay malware families like NGate, ZNFC, SuperCard X, PhantomCard, and RelayNFC, with its command-and-control (C2) server previously flagged as associated with SuperCard X activity in November 2025. In a report published last month, Group-IB said it has witnessed a surge in NFC-enabled Android tap-to-pay malware, most of which is advertised within Chinese cybercrime communities on Telegram. The NFC-based relay technique is also referred to as Ghost Tap. "At least $355,000 in illegitimate transactions have been recorded from one POS vendor alone throughout November 2024 – August 2025," the Singapore-headquartered cybersecurity company said. "In another observed scenario, mobile wallets preloaded with compromised cards are used by mules across the globe to make purchases." Group-IB also said it identified three major vendors of Android NFC relay apps, including TX-NFC, X-NFC, and NFU Pay, with TX-NFC amassing over 25,000 subscribers on Telegram since commencing operations in early January 2025. X-NFC and NFU Pay have more than 5,000 and 600 subscribers on the messaging platform, respectively. The end goal of these attacks is to trick victims into installing NFC-enabled malware and tapping their physical payment cards on their smartphone, causing the transaction data to be captured and relayed to the cybercriminal's device through an attacker-controlled server. Once the card details are exfiltrated, a dedicated app installed on the money mule's device is used to complete payments or cash-out as though the victims' cards were physically present. Calling tap-to-pay scams a growing concern, Group-IB said it observed a steady increase in the detection of malware artifacts between May 2024 and December 2025. "At the same time, different families and variants are also appearing, while the old ones remain active," it added. "This indicates the spread of this technology among fraudsters."

Cybersecurity researchers have discovered a self-propagating worm that spreads via Visual Studio Code (VS Code) extensions on the Open VSX Registry and the Microsoft Extension Marketplace, underscoring how developers have become a prime target for attacks. The sophisticated threat, codenamed GlassWorm by Koi Security, is the second such supply chain attack to hit the DevOps space within a span of a month after the Shai-Hulud worm that targeted the npm ecosystem in mid-September 2025. What makes the attack stand out is the use of the Solana blockchain for command-and-control (C2), making the infrastructure resilient to takedown efforts. It also uses Google Calendar as a C2 fallback mechanism. Another novel aspect is that the GlassWorm campaign relies on "invisible Unicode characters that make malicious code literally disappear from code editors," Idan Dardikman said in a technical report. "The attacker used Unicode variation selectors – special characters that are part of the Unicode specification but don't produce any visual output." The end goal of the attack is to harvest npm, Open VSX, GitHub, and Git credentials, drain funds from 49 different cryptocurrency wallet extensions, deploy SOCKS proxy servers to turn developer machines into conduits for criminal activities, install hidden VNC (HVNC) servers for remote access, and weaponize the stolen credentials to compromise additional packages and extensions for further propagation. The names of the infected extensions, 13 of them on Open VSX and one on the Microsoft Extension Marketplace, are listed below. These extensions have been downloaded about 35,800 times. The first wave of infections took place on October 17, 2025. It's currently not known how these extensions were hijacked. codejoy.codejoy-vscode-extension 1.8.3 and 1.8.4 l-igh-t.vscode-theme-seti-folder 1.2.3 kleinesfilmroellchen.serenity-dsl-syntaxhighlight 0.3.2 JScearcy.rust-doc-viewer 4.2.1 SIRILMP.dark-theme-sm 3.11.4 CodeInKlingon.git-worktree-menu 1.0.9 and 1.0.91 ginfuru.better-nunjucks 0.3.2 ellacrity.recoil 0.7.4 grrrck.positron-plus-1-e 0.0.71 jeronimoekerdt.color-picker-universal 2.8.91 srcery-colors.srcery-colors 0.3.9 sissel.shopify-liquid 4.0.1 TretinV3.forts-api-extention 0.3.1 cline-ai-main.cline-ai-agent 3.1.3 (Microsoft Extension Marketplace) The malicious code concealed within the extensions is designed to search for transactions associated with an attacker-controlled wallet on the Solana blockchain, and if found, it proceeds to extract a Base64-encoded string from the memo field that decodes to the C2 server ("217.69.3[.]218" or "199.247.10[.]166") used for retrieving the next-stage payload. The payload is an information stealer that captures credentials, authentication tokens, and cryptocurrency wallet data, and reaches out to a Google Calendar event to parse another Base64-encoded string and contact the same server to obtain a payload codenamed Zombi. The data is exfiltrated to a remote endpoint ("140.82.52[.]31:80") managed by the threat actor. Written in JavaScript, the Zombi module essentially turns a GlassWorm infection into a full-fledged compromise by dropping a SOCKS proxy, WebRTC modules for peer-to-peer communication, BitTorrent's Distributed Hash Table (DHT) for decentralized command distribution, and HVNC for remote control. The problem is compounded by the fact that VS Code extensions are configured to auto-update, allowing the threat actors to push the malicious code automatically without requiring any user interaction. "This isn't a one-off supply chain attack," Dardikman said. "It's a worm designed to spread through the developer ecosystem like wildfire." "Attackers have figured out how to make supply chain malware self-sustaining. They're not just compromising individual packages anymore – they're building worms that can spread autonomously through the entire software development ecosystem." The development comes as the use of blockchain for staging malicious payloads has witnessed a surge due to its pseudonymity and flexibility, with even threat actors from North Korea leveraging the technique to orchestrate their espionage and financially motivated campaigns.

Visual Studio developers are targeted with a self-propagating worm in a sophisticated supply chain attack through the OpenVSX marketplace, Koi Security reports. Dubbed GlassWorm, the malware was designed to steal sensitive information from the victims’ machines, including NPM, GitHub, and Git credentials, and to drain funds from 49 cryptocurrency extensions. Additionally, it deploys SOCKS proxy servers on the infected machines, installs hidden VNC servers to provide attackers with remote access to systems, and spreads itself by compromising packages and extensions using the stolen credentials. What makes the worm stand out, Koi Security notes, is its use of Unicode variation selectors, which do not produce visual output, hiding the code in code editors to make it invisible to the human eye. “To a developer doing code review, it looks like blank lines or whitespace. To static analysis tools scanning for suspicious code, it looks like nothing at all. But to the JavaScript interpreter? It’s executable code,” Koi explains. GlassWorm uses the Solana blockchain for command-and-control (C&C) infrastructure: it searches the blockchain for specific transactions that contain in their memo field instructions regarding the location of the next-stage payload. This ensures that the infrastructure is not disrupted, as these transactions cannot be modified or deleted from the blockchain, and provides the attackers with anonymity. Furthermore, the attackers can easily change the payload or its location by simply publishing a new transaction for the malware to read. “You’re playing whack-a-mole with an opponent who has infinite moles. This isn’t some theoretical attack vector. This is a real-world, production-ready C&C infrastructure that’s actively serving malware right now. And there’s literally no way to take it down,” Koi notes. Additionally, the malware uses Google Calendar as a backup C&C, from which it fetches another payload to turn the infected systems into nodes in the attacker’s infrastructure, by deploying a SOCKS proxy server, WebRTC modules for peer-to-peer communication, and hidden VNC for remote control. According to Koi, the attack started on October 17, when seven VS Code extensions on OpenVSX were compromised. Given the malware’s self-propagating capabilities, additional extensions were compromised after the infected packages were installed by users. On October 18, after two of the initially compromised developers published clean versions of their packages, Koi was seeing 10 extensions still delivering the malware. Another one was identified the next day, in Microsoft’s VS Code marketplace. “The attacker’s C&C infrastructure is fully operational – payload servers are responding, and stolen credentials are being used to compromise additional packages,” Koi warned over the weekend. According to Koi, the infected extensions have been installed over 35,800 times. Given that VS Code extensions auto-update, the compromised packages infected all developers that had them installed, without user interaction. Related: GitHub Boosting Security in Response to NPM Supply Chain Attacks Related: Shai-Hulud Supply Chain Attack: Worm Used to Steal Secrets, 180+ NPM Packages Hit Related: Highly Popular NPM Packages Poisoned in New Supply Chain Attack Related: Over 6,700 Private Repositories Made Public in Nx Supply Chain Attack

The Cybernews research team found that video call app Huddle01 exposed email addresses, real names, and other identifiers through an unprotected Kafka broker. Think of an unprotected Kafka broker like a post office that stores and delivers confidential mail. Now, imagine the manager leaves the front doors wide open, with no locks, guards, or ID checks. Anyone can walk in, look through private letters and photos, and grab whatever catches their eye. Huddle01 is a video call app that focuses on decentralized Web Real-Time Communication (WebRTC). WebRTC is appealing because it lets people talk and share data directly between devices without using a central server. Done right, this can reduce latency, cut costs, and improve privacy. But leaving your Kafka broker open to anyone who happens to stumble upon it does not qualify as “doing privacy right.” The Kafka broker operated without authentication or encryption, meaning anyone could listen in, collect logs, or potentially alter data if write access existed. This demonstrates a fundamental misconfiguration that puts both users and the platform at risk. The Kafka instance contained over 621,000 log entries from the last 13 days, belonging to Huddle01, including: Usernames (sometimes real names) Email addresses Crypto wallet addresses (Huddle01 supports many wallets across blockchains like Bitcoin and Ethereum) Detailed activity data, such as which users joined specific calls, participants in each call, country, time, date, and duration Other identifiers The app is popular among cryptocurrency users, but in this case the open Kafka instance could have deanonymized their wallets by tying their crypto wallets to usernames and email addresses. Which also paints a target on their back as potentially high-value targets. It also makes users more vulnerable to social engineering since attackers can craft credible emails or messages using real names and meeting data. And hold on for the worst part. Cybernews states it responsibly disclosed the data leak to the company behind Huddle01… “However, it did not respond to the initial disclosure and subsequent attempts. After one month, the exposed server remained accessible. It’s unclear how many other third parties might have accessed the data.” Security tips for affected users Knowing that the exposed information goes back about two weeks doesn’t help much, since anyone with access could have set up a data collector, listening in on the real-time data streaming and processing going on. So, any Huddle01 users should: Change passwords on accounts linked to the exposed email or username, and use strong, unique passwords for each site. Set up two-factor authentication (2FA) wherever possible to prevent unauthorized access. Monitor inboxes for suspicious messages. Be extra cautious of emails or texts asking for crypto transactions or sensitive information, as targeted phishing is a possibility. Be especially wary of social engineering attempts that reference details from meeting logs, such as who you spoke to or when meetings occurred. Stay updated on official statements from Huddle01 or news coverage, as they may release more guidance later. Pro tip: Did you know that you can submit suspicious messages like these to Malwarebytes Scam Guard, which instantly flags known scams? Something feel off? Check it before you click. Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly. Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.

Rhadamanthys is a popular, multi-modular stealer, released in 2022. Since then, it has been used in multiple campaigns by various actors. Most recently, it is being observed in the ClickFix campaigns. The latest version, 0.9.2, comes with significant updates that may impact detection and enforce updates to tools used by researchers. Check Point Research (CPR) provides multiple scripts that can help defenders keep up with these changes: a converter for the new version of the custom executable format, a deobfuscator for strings, and an unpacker for the package that carries the modules. In this report we provide details of the latest changes and describe them in the context of the malware as a whole. Introduction Rhadamanthys is a complex, multi-modular malware sold on the underground market since September 2022. It was first advertised by the actor “kingcrete2022.” From the outset, its design showed the hallmarks of experienced developers, and analysis soon revealed that it drew heavily from an earlier project by the same authors, Hidden Bee [1]. This strong foundation helped Rhadamanthys quickly gain traction: from a niche product, it grew into one of the dominant stealers in cybercrime campaigns and has even attracted interest from more advanced threat actors. Since its appearance, Check Point Research (CPR) has been closely tracking its development, noting constant updates and customization options. In previous publications, we explored the breadth of its features, internal design, and the execution flow of its components using v0.5 as an example. Much of that work remains relevant today, as the core architecture has stayed intact. However, with the release of v0.9.x, Rhadamanthys introduced changes that broke some of our previously published tools, including the custom format converter and string deobfuscator. This was a clear sign that the family had reached another milestone update, one significant enough to warrant a fresh analysis. In this blog, we present our findings on the latest release, v0.9.2. It is worth noting that the initial loader of Rhadamanthys comes in multiple variants: it can be a .NET executable or a native Windows executable (32- or 64-bit). The main target of our analysis is the execution chain started by the native version. Although the first stage varies, the later stages are identical for all loader types. Website makeover Rhadamanthys was initially promoted through posts on cybercrime forums, but soon it became clear that the author had a more ambitious plan to connect with potential customers and build visibility. In parallel, they launched a Telegram support channel, a Tor website with detailed product descriptions, and offered communication via Tox. Most recently, the website underwent a complete makeover, presenting a polished and professional image. The operators now brand themselves as “RHAD security” and “Mythical Origin Labs.” The new site showcases all of their products, including teasers for those still in development. Alongside Rhadamanthys – their flagship stealer – they also advertise Elysium Proxy Bot and a Crypt Service. Version updates are also listed, though this section is not always up to date with actual releases. As before, Rhadamanthys is offered in tiered packages: from $299 per month for a self-hosted version, to $499 per month with a rented server and additional benefits. A special Enterprise tier, with individually negotiated pricing, is also available. The combination of the branding, product portfolio, and pricing structure suggest that the authors treat Rhadamanthys as a long-term business venture rather than a side project. For defenders, this professionalization signals that Rhadamanthys with its growing customer base and an expanding ecosystem is likely here to stay, making it important to track not only its malware updates but also the business infrastructure that sustains it. Announcements: 0.9.x The release of version 0.9 was announced in February 2025, followed by subsequent updates 0.9.1 and 0.9.2. The official website, however, still lists only 0.9.1 (released in May). Its changelog includes a long list of updates, reproduced below: v0.9.1 (2025-05-18) Redesigned database operation process, separated read and write operations. Ensures data write integrity User management permission levels, introduced new worker, traffic merchant, removed observer mode Optimized file packaging and CPU usage when exporting to directory. Significantly reduced log packaging export speed TOR removed random address generation, fixed address permanently effective Management login added 2FA OTP login verification Client and task plugins, introduced memory mutex throughout the process, suppressing multiple executions on the same machine sending duplicate data Client loading introduced tracking system, can interface with user's loading program. Program startup and data collection work will trigger WEBHOOK callback When generating client files, directly select tags from list, generated files named by build tags Support using multiple server lists for client building Support relay jump page, real server URL encrypted stored in jump page Build stub completely removed registry write operations, X64 version, added process injection switch, can choose self-process injection and new process injection Task execution conditions added HWID condition LOG display pagination list added log total count display LOG list page added download count flag block FILE download added, one-click package all exported logs into a compressed package, convenient for download Telegram message template, added new filter categories Added shim server work detection, 5 minutes offline, sends Telegram message notification Fixed delete duplicate LOG function, keeps latest record Fixed search function, fixed time search function Agrent_X wallet, changed to Argent a Kepler wallet changed to Keplr API interface changes, added new API interfaces Get device fingerprint information, added browser fingerprint information collection Build stub redesigned, higher stability and reliability Added nonascii: true configuration, supporting non-ASCII character password filtering Several entries stand out, including the introduction of a global mutex to suppress duplicate executions, expanded process injection options, and a redesigned build stub. These indicate modifications to the core modules. Version 0.9.2, released a few months later and already gaining traction, is not yet listed on the website. As always, such changelogs are written for customers and do not fully capture the points of greatest interest to researchers. However, they still provide useful hints about which areas of the stealer have changed. In the following sections, we present the results of our analysis and highlight the modifications we confirmed, together with several changes that were not documented in the public notes. Lumma-like message box The first thing that stands out in the updated release (0.9.2) is the introduction of a new message box that appears at the start of the malware. We encounter it as soon as we unpack the initial executable. It’s a well-known fact is that most malware is distributed in a protective layer, meant to thwart static detection. The usual first step of analysis is to remove it and reach the core executable (it can be done automatically, i.e. with the help of tools like PE-sieve/HollowsHunter). Interestingly, after unpacking the latest Rhadamanthys (0.9.2), as we try to run the obtained executable, the warning message shows up, saying: “Do you want to run a malware? (Crypt build to disable this message)”. This message box is familiar to anyone who has ever analyzed the famous Lumma stealer (more info: here [5]). In the past, the Lumma stealer introduced a check aimed at preventing malware distributors from spreading the initial executable in its plain, unprotected form, which can be easily detected. It was also preventing unskilled distributors from getting their own machine infected. The malware checks the file from which it is deployed, and if it found familiar patterns at the defined offsets, it recognizes that it is running from the raw, unpacked sample. In such cases, instead of running malicious actions immediately, a pop-up is displayed, asking the user for permission to continue. An identical check is now performed by Rhadamanthys. At first glance, it may appear that both malware families share the same code, responsible for displaying the message. But upon closer inspection, we can see that completely different APIs are called along the way. In Lumma, opening and reading the file is implemented via raw syscalls, and the message box is executed via NtRaiseHardError. In Rhadamanthys, raw syscalls aren’t used, and the same message box is displayed by MessageBoxW. Both loaders are obfuscated, but the obfuscation patterns are different. In the case of the Rhadamanthys loader, the APIs used are static, but the code blocks that call them are disconnected – this obfuscation pattern reminds of some LLVM-based obfuscators. In contrast, Lumma code is much more coherent and can be decompiled. The important functions are called via syscalls, using a single proxy function: Therefore, despite the surface-level similarity, it seems to be just a behavioral mimicry. We don’t have any proof of links between the Lumma development group and Rhadamanthys; however, it is possible that after Europol’s operation earlier this year, some members of the original Lumma team joined the promising competitor. This message box occurs in the Stage 1 executable. Typically for Rhadamanthys, this executable runs a shellcode in memory, which loads Stage 2, that consist of multiple modules. Its core modules are implemented in a format proprietary to this malware that we denote as XS. Updates in the custom XS format Since its inception, Rhadamanthys has shipped its executable modules in custom formats rather than the standard PEs. Only the first stage (the initial component), is a typical Windows executable. Its role is to prepare and deploy the set of components, that are unpacked from the internal package. Custom formats preserve all the essential components of an executable, such as relocations, import tables, and sections with access rights – but this information is stored in headers fully reinvented by the authors. Unlike PE or ELF files, which are natively supported by the operating systems, custom executables require proprietary loaders. This acts as a form of obfuscation, as standard tools can’t parse them. In addition, the absence of expected headers makes it more difficult to dump those components from memory, and reconstruct them. The evolution of the custom formats used by Rhadamanthys was described in detail in our earlier work From Hidden Bee to Rhadamanthys, along with a tool to convert them into PE for easier study (available here). Since version 0.5, Rhadamanthys modules used formats starting with the magic value XS. Two subtypes exist, used at different stages of execution (details outlined here): XS1: modules from the Stage 2 package, embedded in the initial executable. XS2: modules from the Stage 3 package, downloaded from C2 after environment checks. In v0.9.x, both formats received updates, which we label XS1_B and XS2_B. The first subtype (XS1) contains an extended header, with a field denoting the version number. The current variant is version 4, a direct increment over the previously described one. The header of the XS1_B can be described by the following structure: #pragma pack(push, 1) // Adjust to one byte typedef struct { WORD magic; WORD nt_magic; WORD sections_count; **//WORD imp_key; 0; round--) { BYTE val = dll_name[indx]; if (pos) { flag = (val >> (7 - pos)) & 1; if (pos == 7) { pos = 0; ++indx; } else { ++pos; } } else { flag = val >> 7; pos = 1; } outC |= (flag != 0) 0 then break end end end if file_count > 0 then for k, v in pairs(files) do framework.add_file(k, v) end framework.set_commit("!CP:LedgerLive") Other modules In the latest releases, the package at Stage 3 was enriched with few more modules. They are: chrome_extension.dat fingerprint.js index.html The most interesting one is fingerprint.js . It is a JavaScript, which starts with the following comment: Browser Fingerprint Export Tool ; Used to collect browser fingerprint information and export as JSON. It is meant to be opened by a browser and collect a variety of information about its configuration. The main function of the script is called asynchronously and it collects all the information into a JSON report: The function that does the data collection comes with extensive comments, showing what type of data we can expect to be gathered. // Collect all fingerprint information async function collectAllFingerprints() { const fingerprint = { // Timestamp timestamp: new Date().toISOString(), // Basic system info system: await collectSystemInfo(), // Browser info browser: collectBrowserInfo(), // WebGL info webgl: await collectWebGLInfo(), // Canvas info canvas: await collectCanvasInfo(), // Network info network: await collectNetworkInfo(), // Screen info screen: collectScreenInfo(), // Hardware info hardware: collectHardwareInfo(), // Language info language: collectLanguageInfo(), // Fonts info fonts: await detectAvailableFonts(), // WebRTC info webrtc: await getWebRTCInfo(), // Web Audio info audio: await getWebAudioInfo(), // Miscellaneous features misc: collectMiscFeatures() }; return fingerprint; } Once this script is deployed, it allows the attackers to grab additional information about the browsers installed on the victim system, and their settings. For example, it allows to list all the plugins installed, and checks if the following features are enabled: doNotTrack Java cookies WebDriver WebGL It also pinpoints the precise product version and build. The index.html is very simple, and seems to be used just as a carrier where the fingerprint.js will be embedded: Rhadamanthys looked mature from the start, given that its codebase draws heavily from the authors’ earlier project, Hidden Bee. Its initial development was fast-paced, as the authors invested heavily in rapid feature growth to gain momentum and attract customers. They kept reworking the codebase, introduced extensions and add-ons that increased flexibility, allowing customization for diverse use cases. Currently, the development is slower and steadier: the core design remains intact, with changes focused on refinements – such as new stealer components, changes in obfuscation, and more advanced customization options. The latest variant represents an evolution rather than a revolution. Analysts should update their config parsers, monitor PNG-based payload delivery, track changes in mutex and bot ID formats, and expect further churn in obfuscation as tooling catches up. If this trajectory continues, a future 1.0 release may emphasize stability and professionalization, further cementing Rhadamanthys as a long-term player in the stealer ecosystem. Protections Check Point Threat Emulation and Harmony Endpoint provide comprehensive coverage of attack tactics, file types, and operating systems and protect against the attacks and threats described in this report. “The Turkish Rat” Evolved Adwind in a Massive Ongoing Phishing Campaign Check Point Research Publications August 11, 2017 “The Next WannaCry” Vulnerability is Here Check Point Research Publications March 12, 2026 “Handala Hack” – Unveiling Group’s Modus Operandi SUBSCRIBE TO CYBER INTELLIGENCE REPORTS We value your privacy! BFSI uses cookies on this site. We use cookies to enable faster and easier experience for you. By continuing to visit this website you agree to our use of cookies.

Google on Wednesday rushed out a Chrome update that resolves a vulnerability exploited in attacks, the sixth zero-day addressed in the browser this year. Tracked as CVE-2025-10585 and reported by Google’s Threat Analysis Group (TAG) on September 16, the flaw is described as a type confusion in the V8 JavaScript and WebAssembly engine. Type confusion bugs are memory safety issues that can trigger unexpected software behavior, which could lead to crashes, remote code execution, and other types of attacks. Using crafted HTML pages, threat actors could exploit type confusion defects in V8 to perform arbitrary read/write operations remotely. “Google is aware that an exploit for CVE-2025-10585 exists in the wild,” the internet giant notes in its advisory. No details were released on the vulnerability or its exploitation. The fact that it was reported by Google TAG implies that a spyware vendor might have exploited it. TAG researchers have uncovered numerous security holes exploited by commercial spyware, including bugs in Chrome. The latest browser update also resolves two use-after-free flaws in Dawn (CVE-2025-10500) and WebRTC (CVE-2025-10501), for which Google handed out rewards of $15,000 and $10,000, respectively. Additionally, the update contains fixes for a heap buffer overflow in the ANGLE graphics engine (CVE-2025-10502) discovered by the Big Sleep AI agent, which Google says can find security defects that attackers already know about and plan on exploiting. The internet giant has yet to disclose the bug bounty amount to be paid for the ANGLE flaw. No reward will be handed out for the exploited vulnerability because it was discovered internally. The latest Chrome iteration is now rolling out as versions 140.0.7339.185/.186 for Windows and macOS, and as version 140.0.7339.185 for Linux. Related: Chrome Update Patches Fifth Zero-Day of 2025 Related: Critical Chrome Vulnerability Earns Researcher $43,000 Related: ChatGPT’s Calendar Integration Can Be Exploited to Steal Emails Related: DELMIA Factory Software Vulnerability Exploited in Attacks

A new post-exploitation command-and-control (C2) evasion method called 'Ghost Calls' abuses TURN servers used by conferencing apps like Zoom and Microsoft Teams to tunnel traffic through trusted infrastructure. Ghost Calls uses legitimate credentials, WebRTC, and custom tooling to bypass most existing defenses and anti-abuse measures, without relying on an exploit. This new tactic was presented by Praetorian's security researcher Adam Crosser at BlackHat USA, where it was highlighted that the new technique can be used by Red Teams when performing penetration emulation exercises. "We leverage web conferencing protocols, which are designed for real-time, low-latency communication and operate through globally distributed media servers that function as natural traffic relays," reads the presentation's briefing. "This approach allows operators to blend interactive C2 sessions into normal enterprise traffic patterns, appearing as nothing more than a temporarily joined online meeting." How Ghost Calls works TURN (Traversal Using Relays around NAT) is a networking protocol commonly used by video call, VoIP, and WebRTC services that helps devices behind NAT firewalls communicate with each other when a direct connection is not possible. When a Zoom or Teams client joins a meeting, it receives temporary TURN credentials that the Ghost Calls can hijack to set up a TURN-based WebRTC tunnel between the attacker and the victim. This tunnel can then be used to proxy arbitrary data or disguise C2 traffic as regular video conferencing traffic through trusted infrastructure used by Zoom or Teams. As the traffic is routed through legitimate domains and IPs that are widely used in the enterprise, malicious traffic can bypass firewalls, proxies, and TLS inspection. Additionally, WebRTC traffic is encrypted, so it's well hidden. By abusing these tools, attackers also avoid exposing their own domains and infrastructure while enjoying high-performance, reliable connectivity, and the adaptability of using both UDP and TCP over port 443. In comparison, traditional C2 mechanisms are slow, conspicuous, and often lack the real-time exchange capabilities required to facilitate VNC operations. TURNt-ing it Crosser's research culminated with the development of a custom open-source (available on GitHub) utility called 'TURNt' that can be used for tunneling C2 traffic via WebRTC TURN servers provided by Zoom and Teams. TURNt consists of two components, namely a Controller running on the attacker's side, and a Relay deployed on a compromised host. The Controller runs a SOCKS proxy server to accept connections tunneled through TURN. Relay connects back to the Controller using TURN credentials, and sets up a WebRTC data channel through the provider's TURN server. TURNt can perform SOCKS proxying, local or remote port forwarding, data exfiltration, and facilitate hidden VNC (Virtual Network Computing) traffic tunneling. Although Ghost Calls does not exploit any vulnerabilities in Zoom or Microsoft Teams, BleepingComputer has contacted both vendors to ask if they plan to introduce additional safeguards to reduce its feasibility. We will update this post once we receive a response from either. Update 8/9 - A Zoom spokesperson has told BleepingComputer that Zoom pushed a mitigation for this particular technique which only allows TURN infrastructure to pair a client with a media-server and disabled support for peer-to-peer connections through the infrastructure. This wouldn’t be possible in scenarios where providers leverage this infrastructure for peer-to-peer communication, but may be possible in certain instances where this infrastructure is only used for communication with a centralized server. At the moment, Zoom hasn't tested if any workarounds would be possible in this scenario. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Una VPN per Torrent è una Rete Privata Virtuale (VPN) ottimizzata e utilizzata specificamente per le attività di “torrenting”, ovvero la condivisione e il download di file attraverso reti P2P (peer-to-peer) come BitTorrent. Indice degli argomenti Usare una VPN per i Torrent protegge la privacy nascondendo l’IP e impedisce che le attività online siano tracciate da provider o terze parti. Inoltre, aiuta ad evitare blocchi, limitazioni di banda e rischi legali legati al download di contenuti. Una VPN per il download di Torrent crea un tunnel criptato tra il dispositivo dell’utente e il server remoto, mascherando l’indirizzo IP reale e sostituendolo con quello del server VPN. In questo modo, chiunque monitori l’attività online, come provider internet, agenzie governative o malintenzionati, non può risalire all’identità dell’utente né intercettare i dati trasferiti. Il traffico viene inoltre crittografato impedendo a terze parti di vedere quali file vengono scaricati o condivisi. Questo meccanismo consente di aggirare blocchi geografici, limitazioni imposte dagli ISP (come il throttling) e garantisce maggiore anonimato durante le sessioni di file sharing su reti peer-to-peer. Scaricare file tramite torrent senza l’uso di una VPN espone l’utente a diversi rischi, in particolare sul piano legale. I sistemi P2P mostrano pubblicamente l’indirizzo IP dei partecipanti alla rete rendendo facile per le autorità o enti anti-pirateria identificare chi condivide contenuti protetti da copyright. Anche il semplice download, se riguarda materiale coperto da diritti, può portare a sanzioni amministrative o a conseguenze più gravi a seconda del Paese. Inoltre, i provider possono tracciare l’attività dell’utente e collaborare con le autorità fornendo log delle connessioni. Senza una VPN il livello di anonimato è nullo e ogni azione compiuta online resta potenzialmente rintracciabile. Per chi utilizza i Torrent scegliere una VPN adeguata non è solo una questione di anonimato ma anche di prestazioni e sicurezza. La VPN ideale deve garantire una connessione stabile e veloce, proteggere i dati personali da occhi indiscreti e offrire funzionalità pensate specificamente per il file sharing su reti P2P. Ogni aspetto, dalla politica sulla privacy al numero di server disponibili, contribuisce a rendere l’esperienza di download più sicura, efficiente e priva di rischi legali. Di seguito tre soluzioni di VPN adatte per Torrent con specifiche su caratteristiche, vantaggi, costi ed eventuali promozioni. 🌍 Server: 7.000+ server in 118 paesi 📱 Massimo dispositivi: 10 📍 IP dedicato: ✔ 🆓 Versione Free: Garanzia rimborso di 30 giorni 💻 Compatibilità: Windows, macOS, Android, iOS 🔐 Sicurezza: IKEv2/IPsec, OpenVPN, NordLynx 👨💻 Assistenza 24/7: ✔ 🏢 Sede legale: Panama 🔥 Offerte attive: SCONTO fino al 63% NordVPN dispone di una vasta infrastruttura globale con oltre 7.000 server in più di 118 Paesi, inclusi centinaia ottimizzati specificamente per il traffico P2P, garantendo larghezza di banda illimitata e connessioni stabili ideale per il file sharing ad alta velocità. Il protocollo proprietario NordLynx, sviluppato su WireGuard, consente download rapidi con latenze minime, mentre la crittografia AES‑256, la rigorosa politica no-log verificata da audit esterni e la funzione kill switch assicurano massima protezione della privacy durante l’attività torrent. Tra le funzionalità aggiuntive più apprezzate si contano Threat Protection Pro per bloccare malware, tracker e pubblicità indesiderate sui siti di torrenting, l’opzione Double VPN per cifrare due volte la connessione e il supporto per split tunneling per una configurazione flessibile in dispositivi multiuso. NordVPN supporta il torrenting su un massimo di 10 dispositivi contemporaneamente e mette a disposizione anche proxy SOCKS5, utili per accelerare i download dove non è richiesta la crittografia, perfetti per utenti avanzati che vogliono il massimo controllo sulla velocità. NordVPN offre diverse opzioni per durata e risparmio: il piano biennale ha un costo medio di circa 3,39 €/mese con sconti fino al 70 %, mentre il piano triennale risulta ancora più vantaggioso. Viene fornita una garanzia soddisfatti o rimborsati di 30 giorni e, per chi utilizza Android, una prova gratuita di 7 giorni. In alcune occasioni si aggiungono promozioni come gift card Amazon o sconti per referral. Certo, analizziamo questa offerta per un pacchetto di sicurezza online. NordVPN propone tre diversi piani di sicurezza online: Base, Plus e Ultimate, ciascuno disponibile con tre opzioni di durata: 2 anni, 1 anno o 1 mese. L’obiettivo è proteggere le attività online con varie funzionalità, a seconda del piano che si sceglie. Tutti i piani includono una garanzia di rimborso di 30 giorni, che permette di provare il servizio e, se non si è soddisfatti, chiedere un rimborso entro un mese. Questi piani offrono il risparmio maggiore perché ti impegni per un periodo più lungo. I prezzi indicati sono l’equivalente mensile, ma si paga l’intero importo per i primi 24 mesi in un’unica soluzione. NordVPN 2 anni Base - Costo: 3,39 €/mese (totale 81,36 € per i primi 24 mesi, anziché 278,16 €). - Risparmio: 70%. - Funzionalità principali: Solo una VPN sicura e veloce. Una VPN (Virtual Private Network) ti permette di navigare in modo più privato e sicuro, mascherando l’indirizzo IP e criptando il traffico internet. NordVPN piano Plus 2 anni: - Costo: 4,39 €/mese (totale 105,36 € per i primi 24 mesi, anziché 359,76 €). - Risparmio: 70%. - Funzionalità principali: Tutto ciò che è incluso nel piano Base (VPN) più: - Protezione anti-malware e di navigazione: Difende da virus, spyware e altri software dannosi, e avvisa se si stanno per visitare siti web pericolosi. - Blocco di pubblicità e tracker: Rende la navigazione più fluida e privata, impedendo ai siti web di tracciare le attività online e riducendo le pubblicità intrusive. - Password manager con mascheramento dell’email: Aiuta a gestire e creare password complesse in modo sicuro e permette di utilizzare un’email “mascherata” per proteggere la vera email da spam o violazioni di dati. NordVPN piano Ultimate per 2 anni: - Costo: 6,89 €/mese (totale 165,36 € per i primi 24 mesi, anziché 597,36 €). - Risparmio: 72%. - Funzionalità principali: Tutto ciò che è incluso nel piano Plus, più: - Spazio di archiviazione cloud da 1 TB: Un terabyte di spazio online per salvare i file in modo sicuro. - Assicurazione Cyber con copertura massima di 5000 €: Questa è una funzionalità molto interessante. Offre una copertura economica per il recupero di perdite dovute a truffe informatiche e il rimborso dei costi in caso di furto d’identità. Questi piani offrono ancora un buon risparmio rispetto ai pagamenti mensili, ma con un impegno di durata inferiore rispetto ai piani biennali. Anche qui, il costo viene pagato in un’unica soluzione per i primi 12 mesi. NordVPN Piano Base 1 anno: - Costo: 4,99 €/mese (totale 59,88 € per i primi 12 mesi, anziché 139,08 €). - Risparmio: 56%. - Funzionalità: VPN. NordVPN Piano Plus 1 anno: - Costo: 5,99 €/mese (totale 71,88 € per i primi 12 mesi, anziché 179,88 €). - Risparmio: 60%. - Funzionalità: VPN, protezione anti-malware e di navigazione, blocco pubblicità e tracker, password manager con mascheramento dell’email. NordVPN Piano Ultimate 1 anno: - Costo: 8,49 €/mese (totale 101,88 € per i primi 12 mesi, anziché 298,68 €). - Risparmio: 65%. - Funzionalità: VPN, protezione anti-malware e di navigazione, blocco pubblicità e tracker, password manager con mascheramento dell’email, 1 TB di cloud storage, Assicurazione Cyber. Questi piani sono i più cari su base mensile, ma offrono la massima flessibilità poiché non ci si vincola a lungo termine e si paga mensilmente. Non c’è alcun risparmio rispetto al prezzo pieno. NordVPN piano Base 1 mese: - Costo: 12,99 €/mese. - Funzionalità: VPN. NordVPN piano Plus 1 mese: - Costo: 13,99 €/mese. - Funzionalità: VPN, protezione anti-malware e di navigazione, blocco pubblicità e tracker, password manager con mascheramento dell’email. NordVPN piano Ultimate 1 mese: - Costo: 16,49 €/mese. - Funzionalità: VPN, protezione anti-malware e di navigazione, blocco pubblicità e tracker, password manager con mascheramento dell’email, 1 TB di cloud storage, Assicurazione Cyber. Risparmio: I piani biennali offrono il risparmio percentuale maggiore. Se si è sicuri di voler utilizzare il servizio a lungo termine, questa è l’opzione più conveniente. Funzionalità: Se ci serve solo una VPN, il piano Base è sufficiente. Se si desidera una protezione più completa contro malware, pubblicità e per la gestione delle password, il piano Plus è un’ottima scelta. Il piano Ultimate è per chi cerca la massima sicurezza e protezione finanziaria in caso di problemi online. Pagamento: I piani da 1 e 2 anni richiedono un pagamento anticipato per l’intero periodo, mentre il piano mensile viene fatturato ogni mese. 🌍 Server: 3200+ in 100 paesi 📱 Massimo dispositivi: illimitati 🆓 Versione Free: Garanzia rimborso di 30 giorni 💻 Compatibilità: Windows, macOS, Android, iOS 🔐 Sicurezza: OpenVPN, IKEv2, Shadowsocks, Wireguard e L2TP 👨💻 Assistenza 24/7: ✔ 🏢 Sede legale: Paesi Bassi 🔥 Offerte attive: SCONTO fino all’83% + 3 mesi gratis 🔥 Surfshark si basa su una rete di oltre 3.200 server in più di 100 Paesi ed è ottimizzata per P2P, garantendo larghezza di banda illimitata e connessioni fluide e veloci anche con file di grandi dimensioni. Le funzionalità di sicurezza includono crittografia AES‑256‑GCM, politica no-log verificata da audit esterni come Deloitte e Cure53, kill switch automatico, protezione da fughe DNS/WebRTC e l’esclusivo strumento Bypasser per il tunneling selettivo (split tunneling) Surfshark consente connessioni su un numero illimitato di dispositivi contemporaneamente, risultando ideale per chi usa più client torrent su differenti sistemi, e offre bonus come MultiHop e CleanWeb per bloccare pubblicità, malware e tracker durante le attività P2P. Il piano biennale “Starter” costa 1,99 euro al mese. Surfshark offre anche piani “One” e “One+” con funzionalità aggiuntive, a partire da 2,49 euro e 3,99 euro al mese spesso sono disponibili promozioni come sconti superiori all’80 % o referral bonus. Indipendentemente dal pacchetto scelto, si avrà accesso a queste funzionalità e vantaggi: Connessione Internet Sicura (VPN): La funzione principale di Surfshark. Cripta il traffico internet, rendendolo illeggibile a chiunque tenti di intercettarlo e mascherando il nostro indirizzo IP reale. 3200+ server VPN in 100 Paesi: Un’ampia rete di server permette di connettersi da diverse località in tutto il mondo, garantendo velocità e stabilità. Politica No-Log verificata: Surfshark si impegna a non registrare né monitorare le attività online, garantendo la privacy. Dispositivi illimitati: Si può installare e usare Surfshark su tutti i dispositivi con un singolo abbonamento. Politica di rimborso di 30 giorni: Se non si è soddisfatti del servizio, si può richiedere un rimborso completo entro 30 giorni dall’acquisto. Blocco annunci e tracker: Aiuta a migliorare l’esperienza di navigazione eliminando pubblicità e impedendo ai siti web di tracciare la nostra attività online. Bypasser (Split Tunneling): Permette di scegliere quali app o siti web devono usare la VPN e quali no. Rotazione dell’IP: Cambia periodicamente il nostro indirizzo IP per una maggiore anonimità. MultiHop (Doppia VPN): Fa passare il nostro traffico attraverso due server VPN invece di uno, aumentando ulteriormente sicurezza e anonimato. Questo è il pacchetto essenziale per la sicurezza online. Connessione a Internet Sicura (VPN): La funzione base per criptare il traffico e nascondere l’IP. Blocco Annunci: Blocca le pubblicità invasive. Blocco del Consenso ai Cookie: Un’utile funzione per gestire i fastidiosi pop-up sui cookie. Piano da 24 mesi (+3 mesi extra): Prezzo medio: circa €1,99 al mese. Costo totale iniziale: circa €53,73 per i primi 27 mesi (24 mesi + 3 mesi extra gratuiti). Questo è l’abbonamento che offre il maggior risparmio, l’87% di sconto rispetto al prezzo mensile. Il pagamento avviene in un’unica soluzione per l’intero periodo. Piano da 12 mesi (+3 mesi EXTRA): Prezzo medio: circa €3,19 al mese. Costo totale iniziale: circa €47,85 per i primi 15 mesi (12 mesi + 3 mesi extra gratuiti). Il risparmio è comunque significativo rispetto al piano mensile. Piano Mensile: Prezzo medio: circa €15,45 al mese. Questo piano offre la massima flessibilità, ma è di gran lunga l’opzione più costosa su base mensile. Il pacchetto One include tutte le funzionalità di Starter e aggiunge un livello significativo di protezione e privacy. Questo è il pacchetto che viene promosso con le offerte speciali. Tutte le funzionalità di Starter. Mascheramento Email e documenti personali: - Mascheramento Email: crea un alias email per proteggere la nostra vera email da spam e fughe di dati. - Generatore di dettagli personali: Ci aiuta a creare dati fittizi per iscriversi a servizi senza usare le nostre informazioni reali. Protezione del dispositivo (Antivirus): - Antivirus: Protegge i nostri dispositivi da malware e virus. - Protezione della webcam: Avvisa e blocca tentativi non autorizzati di accesso alla nostra webcam. - Protezione in tempo reale: Monitora costantemente i nostri dispositivi per prevenire minacce informatiche. - Protezione da ransomware: Difende dagli attacchi ransomware. - Scansioni di memorie esterne: Analizza chiavette USB e altri dispositivi di archiviazione esterni. Monitoraggio del Dark Web: Ci avvisa se le nostre informazioni personali (email, carte di credito, documenti d’identità) vengono trovate sul dark web. - Avvisi di fuga degli indirizzi Email, carte di credito, documenti di identità e codice fiscale. Ricerche sicure online: - Motore di ricerca privato: Un motore di ricerca che non traccia le nostre attività e non ci mostra pubblicità. 24 mesi (+3 extra): - Prezzo: €2,49 al mese. - Risparmio: 86% sul prezzo mensile. - Costo Totale Iniziale: €67,23 per i primi 27 mesi (24 mesi + 3 mesi extra gratuiti). - Modalità di pagamento: Fatturato in un’unica soluzione per l’intero periodo. - Vantaggio: Si ottengono 3 mesi gratuiti aggiuntivi, portando il periodo di abbonamento a 27 mesi complessivi. 12 mesi (+3 extra): - Prezzo: €3,39 al mese. - Risparmio: 81% sul prezzo mensile. - Costo Totale Iniziale: €50,85 per i primi 15 mesi (12 mesi + 3 mesi extra gratuiti). - Modalità di Pagamento: Fatturato in un’unica soluzione per l’intero periodo. - Vantaggio: Anche qui, 3 mesi gratuiti aggiuntivi, per un totale di 15 mesi. 1 mese: - Prezzo: €17,95 al mese. - Modalità di Pagamento: Fatturato mensilmente. - Vantaggio: Massima flessibilità, ma il costo mensile è significativamente più alto. Surfshark VPN piano One+ Il piano Surfshark One+ è l’offerta più completa e premium di Surfshark, progettata per chi desidera la massima protezione digitale. Include tutte le funzionalità dei piani Starter e One, con l’aggiunta di un servizio cruciale per la rimozione dei dati personali. Ecco una spiegazione dettagliata dell’offerta Surfshark One+: Piano da 24 mesi (+3 mesi EXTRA gratuiti): - Prezzo mensile equivalente: €3,99 al mese. - Risparmio: Un notevole -81% sul prezzo mensile standard. - Costo totale iniziale: €107,73 per i primi 27 mesi (24 mesi di abbonamento + 3 mesi extra gratuiti). - Modalità di pagamento: L’intero importo viene fatturato in un’unica soluzione al momento dell’acquisto. - Vantaggio: Questa è l’opzione più conveniente in termini di costo mensile per un pacchetto di sicurezza così completo. Piano da 12 mesi (+3 mesi EXTRA gratuiti): - Prezzo mensile equivalente: €6,09 al mese. - Risparmio: Un -71% sul prezzo mensile standard. - Costo totale iniziale: €91,35 per i primi 15 mesi (12 mesi di abbonamento + 3 mesi extra gratuiti). - Modalità di pagamento: L’intero importo viene fatturato in un’unica soluzione. - Vantaggio: Un’ottima scelta se preferisci un impegno a medio termine, mantenendo comunque un buon risparmio. Piano Mensile: - Prezzo mensile: €20,65 al mese. - Modalità di pagamento: Fatturato mensilmente. - Vantaggio: Massima flessibilità, puoi disdire in qualsiasi momento. - Svantaggio: È l’opzione più costosa e non include i mesi extra gratuiti. Il piano One+ include tutte le funzionalità dei piani Starter e One, più un servizio esclusivo e molto importante: rimozione dei dati personali tramite Incogni. Incogni è un servizio che automatizza la rimozione dei nostri dati personali (indirizzi email, indirizzi fisici, numeri di telefono) dai database dei broker di dati e dai siti di ricerca di persone: Include richieste di rimozione ripetute per assicurarsi che i dati non vengano ripubblicati. Copertura automatica di oltre 250 siti. Disponibilità limitata: Questo servizio è disponibile solo per i residenti nei seguenti paesi: Stati Uniti, Regno Unito, Unione Europea, Svizzera e Canada. Piano da 24 mesi (+3 mesi extra gratuiti): - Prezzo mensile equivalente: €3,99 al mese. - Risparmio: Un notevole meno 81% sul prezzo mensile standard. - Costo totale iniziale: €107,73 per i primi 27 mesi (24 mesi di abbonamento + 3 mesi extra gratuiti). - Modalità di pagamento: L’intero importo viene fatturato in un’unica soluzione al momento dell’acquisto. - Vantaggio: Questa è l’opzione più conveniente in termini di costo mensile per un pacchetto di sicurezza così completo. Piano da 12 mesi (+3 mesi EXTRA gratuiti): - Prezzo mensile equivalente: €6,09 al mese. - Risparmio: Un -71% sul prezzo mensile standard. - Costo totale iniziale: €91,35 per i primi 15 mesi (12 mesi di abbonamento + 3 mesi extra gratuiti). - Modalità di pagamento: L’intero importo viene fatturato in un’unica soluzione. - Vantaggio: Un’ottima scelta se preferisci un impegno a medio termine, mantenendo comunque un buon risparmio. Piano Mensile: - Prezzo mensile: €20,65 al mese. - Modalità di pagamento: Fatturato mensilmente. - Vantaggio: Massima flessibilità, puoi disdire in qualsiasi momento. - Svantaggio: È l’opzione più costosa e non include i mesi extra gratuiti. Per migliorare ulteriormente la protezione della VPN è possibile integrare questi add-on, selezionabili dalla pagina del proprio account Surfshark: Dedicated IP (IP dedicato): Fornisce un indirizzo IP personale, disponibile in 20 località. Questo può aiutare a evitare captcha frequenti, ridurre i blocchi IP e minimizzare verifiche aggiuntive. Alternative Number (numero alternativo): Un numero di telefono virtuale che protegge il nostro numero di telefono reale da spam e truffatori. Utile per registrarsi a servizi di cui non ci si fida completamente e ricevere chiamate e messaggi senza esporre il nostro numero personale. 🌍 Server: 3000 server in 105 paesi 📱 Massimo dispositivi: 8 🆓 Versione Free: Garanzia rimborso di 30 giorni 💻 Compatibilità: Windows, macOS, Android, iOS, Linux 🔐 Sicurezza: IKEv2, OpenVPN 👨💻 Assistenza 24/7: ✔ 🏢 Sede legale: Isole Vergini Britanniche 🔥 Offerte attive: SCONTO fino al 49% + 3 mesi GRATIS ExpressVPN rappresenta una scelta di prim’ordine per chi scarica torrent grazie a una combinazione di sicurezza avanzata, performance elevate e supporto ottimizzato per il P2P. Il servizio permette il torrenting su intera rete di server offrendo larghezza di banda illimitata e connessioni stabili e veloci, ideali per scaricare file di grandi dimensioni senza ritardi o rallentamenti. L’infrastruttura di ExpressVPN è basata su server RAM-only (TrustedServer), che eliminano automaticamente ogni dato al riavvio, garantendo una protezione totale. La crittografia AES‑256, la politica no-log auditata (da enti come KPMG e Cure53), il kill switch “Network Lock” per bloccare il traffico in caso di disconnessione, e la protezione anti-perdite DNS/IP assicurano la massima privacy durante il torrenting. ExpressVPN propone diverse opzioni: Piano mensile costa 11,30 euro. L’annuale 7,26€ al mese con un costo totale di 87,25 euro. Piano di 6 mesi: 9,99€ al mese, con un costo totale di 59,94 euro ogni 6 mesi. Piano di 12 mesi: Circa 8,32€ al mese con un costo totale di 99,84 euro. In genere è disponibile una garanzia di rimborso di 30 giorni e in alcuni casi una prova gratuita di 7 giorni via app mobile. Inoltre, promozioni periodiche e programmi di referral consentono di ottenere sconti aggiuntivi o mesi gratuiti per ogni amico invitato. Assolutamente! Cerchiamo di capire bene i diversi piani di ExpressVPN e i relativi costi e funzionalità, distinguendo tra le diverse durate di abbonamento. ExpressVPN offre diverse opzioni di abbonamento, ciascuna con i propri vantaggi in termini di prezzo e durata. In generale, più lunga è la durata dell’abbonamento, maggiore è il risparmio. Vediamo i tre periodi principali: Questa è l’offerta più conveniente e offre il massimo risparmio percentuale. Si paga un’unica quota per 2 anni e si ricevono 4 mesi aggiuntivi gratuitamente. Il rinnovo avviene annualmente dopo i 28 mesi iniziali. Questa è un’ottima via di mezzo se non ci si vuole impegnare per due anni: 12 mesi di servizio e 3 mesi extra in regalo, con un buon risparmio rispetto al piano mensile. Anche qui, il rinnovo è annuale dopo i 15 mesi. Questa è l’opzione più flessibile ma anche la più costosa su base mensile. È ideale se vuoi provare il servizio per un breve periodo senza un impegno a lungo termine. Il pagamento è mensile. Ecco una tabella che confronta i tre tipi di piano (Base, Avanzato, Pro) attraverso le diverse durate di abbonamento (2 anni + 4 mesi gratis, 12 mesi + 3 mesi gratis, 1 mese). Tutti i prezzi sono in USD e, per le offerte con mesi gratuiti, il costo “al mese” è una media calcolata includendo i mesi bonus. Una VPN davvero adatta al torrenting deve adottare una rigida politica no-log, ovvero non registrare alcuna informazione sulle attività dell’utente. Questo significa che anche in caso di richieste da parte di autorità o di tentativi di accesso ai dati, non ci sarebbe nulla da fornire, perché nulla viene conservato. È una garanzia essenziale per chi cerca il massimo anonimato durante il download di file. Scaricare Torrent richiede una connessione veloce e costante. Una buona VPN deve offrire server ottimizzati per garantire bande larghe e latenze ridotte, evitando rallentamenti, buffering o disconnessioni. Il supporto a protocolli moderni come WireGuard, unito a una rete di server ben distribuita, fa la differenza per chi scarica file di grandi dimensioni in poco tempo. Il kill switch è una funzionalità indispensabile per chi scarica Torrent perché blocca automaticamente la connessione a internet se la VPN dovesse disconnettersi inaspettatamente. In questo modo, si evita che l’indirizzo IP reale venga esposto, anche per pochi secondi. È una barriera di sicurezza fondamentale che protegge la privacy in ogni momento. Una rete VPN con molti server distribuiti in diversi Paesi consente non solo di accedere più facilmente a contenuti non disponibili localmente ma anche di scegliere il server più veloce e meno affollato. Più ampia è la scelta, maggiore sarà la possibilità di ottenere prestazioni elevate e mantenere l’anonimato anche in Paesi con normative restrittive sul torrenting. Non tutte le VPN sono ottimizzate per il traffico peer-to-peer. Quelle migliori offrono server dedicati o ottimizzati per il P2P che assicurano una gestione più efficiente del traffico torrent, con priorità nella banda e protezioni rafforzate. Il supporto P2P nativo consente anche una configurazione più semplice e una maggiore compatibilità con i principali client Torrent.