Morphisec exposes a LuaJIT XLoader infostealer campaign. Learn how the XLoader infostealer abuses JScript and shared-section injection.
Related Posts:
The post LuaJIT XLoader Infostealer Spreads via Fake Orders appeared first on Daily CyberSecurity.
Cisco Talos has analyzed a new Windows infostealer called VOLTA, which calls itself VOLTA-AUTODOXER. It steals the usual data, then hands the loot to a large language model that ranks what the victim is worth. Ryan Fetterman laid it out in a Talos report, after the malware turned up through the CAIRN research effort.
“There is a new idea in the cybercrime world — cast a wide net, steal everything, and let AI sort out the specifics. A new malware self-named “VOLTA-AUTODOXER,” surfaced through the CAIRN research effort, is a self-deleting Windows infostealer that augments its post-theft workflow with an LLM-powered victim-profiling stage.” reads the report published by Talos.
The malware deletes itself after running and does not use servers controlled by the attacker. Instead, it uses third-party systems to carry out its activities.
The malicious code supports data-stealing features are advanced. It collects browser passwords, cookies and saved payment card details from Chromium browsers, as well as data from Firefox, Thunderbird and Outlook. It also steals Slack workspace information and login sessions from Discord, Telegram, Steam, Battle.net and Roblox.
The malware also collects Microsoft OAuth tokens, SSH keys, cloud service credentials, screenshots and all saved Wi-Fi passwords. For crypto wallets, it tries to crack the wallet password directly on the infected device and saves the results in its report. To steal some browser tokens, it must bypass Chrome’s App-Bound Encryption.
But VOLTA goes further. It also builds a detailed profile of the victim. This includes their location and home address, employer and company domain, estimated year of birth, the last four digits of payment cards, Slack workspaces and information about who created documents. It also looks for signs of iPhone backups and checks the current value of the victim’s Roblox account.
“After harvesting the standard stealer haul, including browser passwords; cookies; payment cards; cryptocurrency wallet seed phrases; Discord, Telegram, Steam, and Roblox sessions; Microsoft OAuth tokens; SSH and cloud-provider keys; Wi-Fi profiles; and screenshots, VOLTA builds a structured evidence bundle about the person behind the machine.” states the report.
It uses the victim’s own logged-in sessions to fill the gaps. It searches Gmail for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to confirm a home address, pulls order histories from Uber Eats and DoorDash, and adds detail to the victim’s Discord profile. Even a takeout history can now count as evidence.
The bundle goes to OpenRouter, a routing service for AI models, with a system prompt that tells the model to act as a forensic intelligence analyst drafting a target assessment.
“The required output includes a section titled “WHAT THEY’RE WORTH” with valuables ranked by monetization with a low/medium/high tier, and a section on “THEIR OPSEC” containing an assessment of the victim’s security posture and password hygiene.” states the report. “The model is the operator’s triage analyst; it turns a raw credential log into a prioritized and citation-backed dossier of the victim and their monetizable assets.”
It also needs a section called “THEIR OPSEC”, rating the victim’s security habits and password hygiene. In short, it’s a performance review for the person it just robbed.
The prompt asks for something agents do well: connecting scattered facts. It pushes the model to link names, addresses or universities to patterns in the victim’s passwords. The model isn’t hunting for new data, only stretching what the malware already took. The operator wants a short, blunt assessment with a trail of citations.
By default VOLTA calls Anthropic’s Claude Opus 4.6. If the model refuses, which VOLTA spots by scanning replies for phrases like “I can’t” or “I’m not able”, it moves on to Moonshot AI’s Kimi K2 and then Google’s Gemini 2.5 Flash. A low temperature setting of 0.2 keeps the output consistent.
The requests are hand-built JSON with no software kit, and the malware still runs without the AI stage if no API key is present.
Talos sees the fallback system as evidence that the malware’s author expected security protections and designed ways to bypass them.
The AI analysis runs directly on the victim’s computer, using their own internet connection, before any data is sent out. The malware creates a file called Identity_Report.txt, receives the AI’s response in AI_Analysis.txt, and sends both files together in a ZIP archive called volta_dox.zip.
The stolen data can be sent to the attacker in up to three stages. The first archive, volta_log.zip, contains the information collected by the malware. The second, volta_dox.zip, contains the AI analysis. A third archive, volta_doxnet.zip, is created if the malware finds additional network information. The attacker receives everything through a Telegram channel.
The malware also has six configurable fields that can be changed when it is built. This suggests that its author may offer a builder service, allowing customers to create their own customised versions.
The credentials stored in these fields are encrypted, but the encryption is weak because the key is stored inside the malware itself. Anyone who analyses the file can recover them.
If VOLTA is sold as a commercial product, its AI feature could allow even inexperienced criminals to identify valuable victims and receive detailed, ranked profiles directly through Telegram.
For defense, Talos suggests an application control policy that restricts which processes can launch Chrome with the –headless flag, which would block the App-Bound Encryption bypass. At minimum, alert when Chrome starts with –headless from any process outside a known developer set. Storing credentials in hardware-backed stores also helps.
If you’re compromised, the main program may have deleted itself, but try to keep %APPDATA%\volta_debug.txt. It’s a timestamped log of what was collected and whether the AI call worked. Revoke any exposed tokens and change passwords. If a wallet’s seed phrase sat in plaintext on disk, treat the wallet as fully compromised and move the funds to a new wallet whose seed was generated on an air-gapped device.
“VOLTA is a mature stealer with a late-stage AI layer added for one purpose: relieving the operator of analytical work. The axis of AI improvement here is not speed or scale but effort displacement; the same logic visible in CLOSEDQUORUM, though applied to a different phase.” concludes the post. “These implants reflect the same underlying logic: Identify the step that requires the most sustained human attention and replace it with a model call. The question for defenders is not whether this pattern will appear elsewhere, but which phase it touches next.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, malware)
Cisco Talos uncovers the NIK C2 framework. This Windows NIK C2 framework abuses OpenAI APIs to analyze stolen victim data and deploy screen lockers.
Related Posts:
The post NIK C2 Framework Integrates OpenAI API to Analyze Stolen Data in Live Attacks appeared first on Daily CyberSecurity.
Socket uncovers malicious Firefox extensions spoofing Phantom, Jupiter, and Bitget. These malicious Firefox wallet extensions steal seed phrases.
Related Posts:
The post Fake Phantom, Jupiter, and Bitget Firefox Extensions Steal Crypto Recovery Phrases appeared first on Daily CyberSecurity.
Gen Digital exposes a Claude malware campaign on claude.ai. This fake Download Claude malware campaign uses Google Ads and ClickFix to drop AMOS.
Related Posts:
The post Attackers Abuse Claude Sharing Features and Google Ads to Deliver AMOS and Windows RAT appeared first on Daily CyberSecurity.
Zscaler uncovers an SEO poisoning campaign using fake Chocolatey and Massgrave sites to drop Armorsteal malware and Python Armorsteal malware modules.
Related Posts:
The post Fake Chocolatey and Massgrave Sites Deliver Python Armorsteal Malware via SEO Poisoning appeared first on Daily CyberSecurity.
An Amazon ClickFix campaign uses a fake CAPTCHA and the old Windows finger command to drop Lumma Stealer and NetSupport. Stay protected.
Related Posts:
The post Amazon ClickFix Campaign Abuses Windows Finger Command to Drop Lumma Stealer and NetSupport appeared first on Daily CyberSecurity.
Symantec reveals the Aoki infostealer. The Aokigahara Aoki infostealer steals API keys and session files from Claude, Codex, Cursor, and Gemini.
Related Posts:
The post Aoki Infostealer Harvests API Keys and Tokens From AI Coding Assistants appeared first on Daily CyberSecurity.
A fake Web3 accelerator used malicious npm packages to drop stealers on macOS and Windows and reroute AI coding agent traffic to its servers.
Related Posts:
The post Malicious npm Packages From Fake Web3 Accelerator Apex Deliver Stealers and Hijack AI Coding Agents appeared first on Daily CyberSecurity.
Warden Stealer, a fast-growing Rust infostealer, steals AI agent tokens, browser data, and crypto while bundling its own loader and clipper.
Related Posts:
The post Warden Stealer Rust Infostealer Targets AI Coding Agent Tokens and Browser Data appeared first on Daily CyberSecurity.
The lure is the now-familiar ClickFix technique, dressed up as Cloudflare’s standard bot check. The fake page asks you to run a command, supposedly to confirm you’re not a bot, and that command quietly downloads and installs an MSI package from an attacker-controlled server. There’s no bot to fool here, you’re the one being fooled.
“In September 2026, CERT-UA specialists discovered over 100 compromised websites to which malicious JavaScript code had been added by attackers. When visiting such a site, the user was shown a fake Cloudflare verification page, which, under the pretext of confirming that the visitor was a human, offered to execute a command.” reads the report published by the Ukraine CERT-UA. “Executing the command resulted in downloading and installing an MSI package from a remote server (ClickFix technique).”
What makes this campaign interesting is how the attackers control it. The domain used for the fake page and the script’s settings are stored in a smart contract on the Polygon or Ethereum blockchain. The script checks the contract each time it runs, so the attackers can change the domain or turn the attack on and off without changing the compromised websites. In effect, they are using the blockchain as a remote control that is difficult to take down.
The script has three modes: off, silent visitor tracking, and the full fake verification page. The attack mode only targets Windows users who arrive through search engines, and it will show the fake page no more than twice within 12 hours for the same visitor. This is clearly designed to keep the campaign quiet and make it harder to spot through unusual traffic patterns.
CERT-UA pulled apart three separate MSI variants used in the campaign. The first just installs the stealer directly. The second is more elaborate, trying to slip past Windows User Account Control, carving out Microsoft Defender exceptions, and deploying a vulnerable AMD driver to exploit CVE-2023-20598, a bring-your-own-vulnerable-driver (BYOVD) move that blinds security tools before the real payload drops.
The third variant skips the driver abuse entirely and uses DLL side-loading instead, tricking a legitimate executable into loading a malicious library that decrypts and launches the stealer. Three different paths, the same room goal. CERT-UA names that payload LunexStealer.
LunexStealer isn’t just a credential grabber, it doubles as a remote execution tool, able to download and run executables, MSI packages, PowerShell scripts, and raw commands on demand. Depending on what configuration it pulls from its command server, it can also install a browser extension called LUNARAXE, disguised under the name “Microsoft Office Word Editor” so it blends into a list of legitimate-looking add-ons.
That extension steals cookies, browsing history, and anything typed into a web form, and gives the attacker live remote control over the browser itself.
“Depending on the configuration received from the control server, LUNEXSTEALER can install a malicious browser extension called LUNARAXE, which appears in the browser under the name “Microsoft Office Word Editor”.” continues the report. “The extension steals cookies, browsing history, and credentials entered into web forms, and also allows attackers to remotely control the browser: execute JavaScript code on web pages, manage tabs and take snapshots of them, and change proxy server settings. If the NAIVEMESS auxiliary component is present, the extension also gains access to the computer’s file system.”
There’s a file system access layer too, a PowerShell component called NAIVEMESS that CERT-UA says registers itself as a legitimate browser-to-system messaging host, letting the extension read, write, and launch files on the victim’s machine.
CERT-UA’s advice is simple: a real security check will never ask you to open the Run window, Command Prompt, or PowerShell and paste a command. If a website asks you to do that, close it, even if the site looks familiar.
For system administrators, CERT-UA recommends additional controls, such as restricting Win+R with Group Policy, limiting who can install MSI files, and blocking known vulnerable drivers.
Full CERT-UA advisory with indicators of compromise and the complete malware breakdown is available here.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, LunexStealer)
Trump Mobile data breach: BYOD leaks Trump Mobile customer data for 3,615 people, including Trump allies, via an infostealer and no MFA.
Related Posts:
The post Trump Mobile Data Breach Exposes 3,615 Customers in BYOD Leak appeared first on Daily CyberSecurity.
2CLoader malware dodges sandboxes and security tools to deliver Vidar and Remus infostealers. See how it works and how to detect it.
Related Posts:
The post New 2CLoader Malware Delivers Vidar and Remus Infostealers While Dodging Sandboxes appeared first on Daily CyberSecurity.
A new MacSync macOS infostealer spreads via fake apps. Learn how the MacSync macOS infostealer abuses iCloud to compromise Apple systems.
Related Posts:
The post New MacSync macOS Infostealer Targets Crypto Wallets appeared first on Daily CyberSecurity.
A new PamStealer macOS infostealer spreads via fake Wavel apps. Learn how the PamStealer macOS infostealer steals system passwords and browser data.
Related Posts:
The post PamStealer macOS Malware Spreads via Fake Wavel Crypto App appeared first on Daily CyberSecurity.
Discover the latest Vidar information stealer obfuscation tactics. ThreatLabz reveals how the malware uses a virtual machine and custom stream ciphers.
Related Posts:
The post Vidar Information Stealer Upgrades Evasion Tactics appeared first on Daily CyberSecurity.
Someone impersonated LastPass on GitHub, got users to download a fake authenticator, and ended up killing 145 different antivirus and EDR products using a driver that Microsoft itself had signed. That last part is the one worth sitting with.
LastPass’s Threat Intelligence, Mitigation, and Escalation team spotted the fake GitHub organization on August 13, 2026. It appeared high in search results for “LastPass Authenticator download” and used real LastPass logos and branding to look legitimate. The download page also displayed fake trust badges, including “VirusTotal Approved.” The badges were meaningless and were simply there to make users feel safe enough to download the file.
Once LastPass brought in Delphos Labs for payload analysis, the picture got a lot bigger than one fake page. They found a shared kit actively impersonating more than 40 different companies, all running through the same infrastructure. This wasn’t a one-off phishing attempt, it was a malware-as-a-service operation with LastPass as just one of many skins on the same underlying product.
“LastPass Threat Intelligence, Mitigation, and Escalation (TIME) Team, in partnership with Delphos, identified and disrupted a multi-stage malware delivery campaign impersonating at least 40 companies on GitHub.” reads the report published by LastPass. “The payload it delivered survived controls that were built to stop exactly this, with a Microsoft Windows Hardware Compatibility Publisher chain signature and a clean VirusTotal score. LastPass is internally tracking the infostealer as Rapuncel.”
Worth stating plainly, since brand impersonation attacks like this tend to get misattributed to the company being spoofed. LastPass wasn’t breached here. Its name was borrowed, which is a different and honestly more common problem: attackers don’t need to break into a company, they just need a logo people trust.
“This was opportunistic brand impersonation. No LastPass system, service, or customer vault was involved or compromised. The lure was distributed entirely outside LastPass channels. Official LastPass Authenticator is available through lastpass.com and the official app stores.” continues the report. “GitHub is not a LastPass distribution channel. This was opportunistic use of a recognizable name.”
The download process was more sophisticated than it first appeared. When victims clicked the download button, they were sent through two other GitHub Pages accounts that looked like broken 404 pages but secretly used JavaScript to redirect them to the next step.
A separate server behind Cloudflare then chose where to send the final malware. This meant the attackers could switch to a new malware server without changing the GitHub pages. The endpoint also changed between August 27 and September 10, showing that the attackers were still actively maintaining the campaign.
The ZIP file itself uses an old trick that still works: padding. Two large junk DLLs inflate the archive past the size limit most automated scanners bother checking, so the real malware slips through hidden among plausible looking files. Delphos has seen this exact size-padding move before in an unrelated 55MB stealer sample, so it’s not new, it’s just still effective because scanners haven’t closed that gap.
Once opened, the fake installer was actually a Microsoft debugging tool that had been renamed. It automatically loaded a malicious DLL placed in the same folder. The malware then gained SYSTEM privileges and installed a kernel driver disguised as an NVIDIA component.
The driver had a valid Microsoft Windows Hardware Compatibility Publisher signature. That trusted signature helped it bypass security checks and then disable the antivirus and EDR products installed on the victim’s system.
“The signature was ineffective at halting this campaign because a signature merely asks whether a file matches something already discovered to be malicious. This driver was signed, timestamped, and clean on VirusTotal, and its dangerous twin was hiding behind a different filename. Every signal a signature-based control reads came back green.” continues the report. “The Microsoft signature proves the driver passed through a trust pipeline. It does not prove the driver is safe.”
That’s the whole failure mode in one sentence. The driver was clean on VirusTotal, properly signed, and not on Microsoft’s blocklist, because it wasn’t the same file as the one everyone was already watching for. Delphos traced it back to CcProtect.sys, a known Chinese disk-encryption driver already catalogued on LOLDrivers with public proof-of-concept killer code freely available on GitHub. The attackers just renamed the file to Alinubx.sys, and that single change was enough to dodge every hash-based detection built around the original name.
“A user-mode stealer steals credentials. A trusted kernel driver clears the runway.” continues the report. “This is an abuse-by-design driver rather than a memory-corruption exploit. The process-kill interface appears to be product functionality exposed by a host-defense driver. The control is policy enforcement: block the driver, deny the signer or lineage, or prevent the drop. If the driver is trusted and not blocklisted, administrator rights are enough to install and use it.”
Once the driver killed security software from kernel level, the actual credential theft was almost mundane by comparison. Passwords from more than 25 browsers, wallet files from over 30 crypto apps, Discord tokens, Steam sessions, Telegram data, anything in Windows Credential Manager, screenshots of every connected monitor. For Chrome and Edge specifically, the malware injected code directly into the browser process to call the browser’s own decryption service from the inside, defeating Google’s 2024 app-bound encryption by simply asking nicely from a trusted position.
Delphos flagged the sample to Microsoft on August 19. MSRC responded that the driver behavior doesn’t meet its definition of a security vulnerability, since it’s not a Microsoft-owned component, and redirected the report to the separate blocklist submission channel instead. As of publication, Alinubx.sys still wasn’t on that blocklist. Bureaucracy moves at bureaucracy speed, malware doesn’t wait for it.
The bigger lesson is not just about this campaign. It is about the assumptions that no longer hold. A well-known brand on GitHub does not mean the repository is official. A Microsoft signature does not automatically mean a driver is safe. A clean VirusTotal result does not prove a file is harmless. And a blocklist can only stop threats that have already been identified.
In this case, attackers managed to exploit all four trust assumptions at the same time, using a toolkit that is currently targeting around 40 other companies.
If you or someone on your team downloaded an authenticator or security tool from a GitHub link in the past few weeks, it is worth spending 15 minutes checking the system now. It could save you from a much bigger problem later.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, LastPass)
Learn how the LLM-generated PhantomRaven information stealer targets developers. The PhantomRaven information stealer uses npm to hijack CI/CD secrets.
Related Posts:
The post LLM-Generated PhantomRaven Information Stealer Discovered appeared first on Daily CyberSecurity.
AmnesiaStealer malware targets macOS with data theft and remote browser-session control, potentially exposing accounts already open on compromised Macs.
The post Apple Mac Malware Lets Attackers Control Browser Sessions After Infection appeared first on TechRepublic.
Entrar