A ransomware group called Dark Project is recruiting criminal partners with an offer of 80% of proceeds from successful attacks, pairing generous commissions with a platform for managing extortion.

First observed in June 2026, the financially motivated operation combines data theft, file encryption, and public leak threats to pressure organizations into paying.

The group’s published victim records cover 38 organizations across eight countries, with the United States accounting for 30 listings.

Manufacturing, healthcare, and construction feature prominently. However, these figures describe organizations named in threat intelligence and leak-site records, not independently verified compromises or a complete measure of the group’s activity.

Researchers from Gurucul identified Dark Project’s ransomware operation in their threat actor profile, documenting its recruitment process, infrastructure, and reported attack methods.

Their findings describe an emerging operation that uses the language of legitimate security services to advertise tools and partner support for ransomware activity.

New Dark Project Ransomware Group

Dark Project advertises a partner program under which affiliates receive 80% of proceeds while its operators retain 20% for platform services and reporting.

The offer resembles established ransomware affiliate revenue models used by other criminal groups, although the advertised terms do not prove that partners receive payments as promised.

Recruitment follows four stages: application, vetting and onboarding, deployment, and commission settlement. Applicants contact the group through Tox.

Approved partners reportedly receive a unique identifier, platform access, and operational instructions before deploying payloads against organizations.

Dark Project claims to manage victim communication and ransom negotiations, promising commission payments within 24 hours of a completed engagement.

The advertised infrastructure includes a Tor-hosted operations dashboard, agents supplied in EXE and BIN formats, and a social-engineering simulation suite.

Agents reportedly contain partner identifiers that allow activity to be linked to individual affiliates. These are platform claims documented by Gurucul, rather than capabilities independently demonstrated through published malware analysis.

Separating payload deployment from negotiations gives affiliates fewer operational tasks to manage. Comparable affiliate management platform features have appeared in Lynx ransomware operations, where partners can manage victim profiles and leak schedules.

Dark Project also promotes Bitcoin payments, but the supplied report provides no wallet addresses or transaction evidence confirming settlements.

Victim disclosures peaked in August 2026, when 20 organizations were listed, following four in June and none in July. September and October each added five listings, while November contributed four at collection time. These dates track publication activity; they should not be treated as confirmed intrusion dates.

Reported Attack Methods, Defensive Priorities, and Evidence Gaps

Gurucul describes initial access through phishing, exposed Remote Desktop Protocol services, compromised credentials, and VPN access sourced from infostealer logs or initial access brokers.

The reported operation targets Windows environments and follows double-extortion, stealing sensitive information before encryption and threatening publication if negotiations fail. This creates separate risks involving business disruption and data exposure.

That distinction matters because restoring files does not remove the threat of stolen information becoming public. Related reporting on data theft extortion tactics explains why recovery alone cannot resolve every ransom demand.

Dark Project’s Tor leak site serves as its public pressure channel, publishing alleged victim details when the operators seek additional leverage.

The report maps activity to techniques including abuse of valid accounts, Windows Management Instrumentation, RDP, SMB, data exfiltration, encryption, and attempts to inhibit recovery.

It also lists associated vulnerabilities, but does not provide sufficient incident evidence to establish every listed flaw as a confirmed Dark Project entry point. Defenders should distinguish reported associations from demonstrated exploitation.

Manufacturing accounts for 12 reported victims, healthcare for seven, and construction for four. Those concentrations make access monitoring and recovery readiness important priorities for exposed organizations.

Gurucul recommends patching, stronger access controls, suspicious-activity monitoring, and secure backups. Security teams can use those measures without assuming that every affiliate follows an identical intrusion sequence.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post New Dark Project Ransomware Group Offers Hackers 80% Commission to Expand Cyberattacks appeared first on Cyber Security News.

Fake game downloads and cracked software installers are turning Windows PCs into money-making tools for campaign operators.

Microsoft has warned that deceptive installation packages quietly deliver software that shares internet bandwidth, runs distributed-computing workloads, or installs unwanted utilities, often without users understanding what they have agreed to install.

The campaign targets people searching for free games, software activators, audio plugins, and unofficial tools. Unlike the password theft seen in fake game download campaigns, this operation focuses on making money from installed software and device resources.

A single installer can attempt several installations, giving operators multiple opportunities to profit from one download.

Microsoft Threat Intelligence researchers identified the campaign and detailed its behavior in a November 3 technical report.

Their investigation confirmed three delivery branches involving WorldProxyPool, CharityEngine and BOINC, and Advanced Windows Manager.

These products can have legitimate uses; the security concern is their installation through deceptive bundles without informed consent.

Microsoft Warns Fake Game Downloads

The infection starts when someone runs an installer presented as a game, cracked application, or utility. Observed lures included PC games, Roblox executors, auto-clickers, and driver tools.

The package launches temporary processes built around Inno Setup, then starts additional executable stages that deliver the bundled software. Not every installation follows an identical sequence.

The delivery system calls its downstream packages “offers” and tracks their results separately. Session, affiliate, and offer values help coordinate delivery and record outcomes.

Importantly, one failed offer does not mean the entire bundle has stopped: another package can still install successfully. Some payloads also launched before or around their reporting callback, making those reports incomplete prevention checkpoints.

WorldProxyPool supplies the bandwidth-sharing branch, routing third-party internet traffic through affected devices. The underlying risk resembles proxyware disguised as Notepad++, where apparently useful downloads conceal unauthorized network sharing.

In Microsoft’s investigation, scheduled tasks launched the proxy agent at startup, ran a hidden PowerShell watchdog every five minutes, and checked for updates hourly, all with SYSTEM privileges.

The computing branch installs CharityEngine, BOINC, and supporting components, including VirtualBox. Microsoft observed computing workloads, hardware-capability checks, and communication with CharityEngine infrastructure.

This is resource hijacking, but the findings do not establish cryptocurrency mining. The distinction matters because distributed computing and cryptomining are different activities, even when either consumes resources without the owner’s informed permission.

A third branch installs Advanced Windows Manager or Windows Manager utilities and updater components. Across the campaign, unattended installation options reduce visible prompts.

The result is not necessarily one obvious malicious program, but a collection of unexpected applications and recurring background activity that can outlast the original download session.

Detection, Protection, and Campaign Indicators

Microsoft recommends avoiding cracked software, unofficial game installers, and activation tools, while enabling cloud-delivered protection, tamper protection, and reputation-based controls.

Its unwanted software protection guidance also explains why potentially unwanted applications deserve attention even when they are not classified as malware. For organizations, software inventory reviews can reveal installations that users never intended to authorize.

Investigators should connect suspicious installer execution with network callbacks, newly created scheduled tasks, and unexpected software. Earlier YouTube download proxyware campaigns demonstrate how ordinary download activity can conceal persistent bandwidth sharing.

However, that reporting concerns separate activity; Microsoft’s report does not establish a connection between those operators and this campaign.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Microsoft Warns Fake Game Downloads Are Secretly Monetizing Windows PCs appeared first on Cyber Security News.

An Android banking malware campaign is turning streaming-app advertisements into a route for stealing credentials and draining accounts.

Mirax, the remote access trojan lets criminals watch infected phones, intercept security codes, and operate banking apps directly from victims’ devices.

Thousands of Android phones belonging to retail banking customers across the Middle East, Turkey, and Africa were infected between March and September 2026.

Confirmed cases point to losses reaching millions of US dollars, although the available figures cover only infections and fraud visible to investigators and affected banks.

Group-IB researchers identified the campaign in a November 5 investigation, reporting activity spikes during Eid and late July. The operation remained active when the report was published, with streaming apps assessed as possible advertising vectors still available on Google Play.

Mirax Android RAT Hijacks Phones Through Streaming-App Ads

Evidence suggests the infection begins inside low-reputation streaming apps downloaded from Google Play. Advertisements and video links direct users toward a separate installer downloaded outside the store.

This differs from Perseus streaming app attacks, which use fake IPTV applications distributed through sideloading, but both exploit demand for entertainment.

One confirmed installer posed as “TikTok 18+,” an imitation unrelated to TikTok or ByteDance. It retrieves the Mirax payload, which impersonates Google Play Services using a Cyrillic letter that resembles the Latin “o.”

The disguise makes a dangerous permission request appear connected to a familiar system component. Accessibility access is the turning point. Mirax pushes victims toward enabling this permission, then uses it to read screen content and control the interface.

Similar Android banking overlay attacks combine permission abuse with counterfeit login screens, helping attackers capture credentials while users believe they are interacting with legitimate applications.

Mirax also intercepts SMS messages and notifications, records typed information, and captures lock-screen PINs, passwords, or patterns.

Operators can replay those secrets to unlock phones unattended, open banking sessions, add beneficiaries, and initiate transfers.

Since transactions originate from the customer’s genuine phone and banking app, familiar device signals provide less reassurance. Researchers found evidence of international transfers, internal account movements, and marketplace purchases.

Some proceeds may have passed through mule accounts in India, but investigators were still tracing destinations. The findings do not establish that every transfer followed the same laundering route.

Server-Controlled Features Complicate Detection and Response

Mirax separates its installed capabilities from its targeting instructions. Banking overlays and application mappings arrive from command-and-control infrastructure after installation rather than being packaged inside the Android application.

The observed operation targeted more than 20 banking and wallet packages, alongside global cryptocurrency exchanges. Two WebSocket channels separate commands from stolen data, while HTTP long-polling provides a fallback.

Operators can remotely change hosts, ports, TLS settings, and polling intervals. DNS-over-HTTPS is enabled by default, reducing visibility through local DNS monitoring. Static inspection therefore cannot reveal every target or configuration deployed against a particular victim.

A SOCKS5 module also turns compromised phones into residential proxies. Earlier reporting on Mirax residential proxy capabilities described how this routes malicious traffic through victims’ connections.

Combined with device takeover, it can weaken checks based on IP reputation and location, without requiring attackers to operate from their own infrastructure.

The malware hides its launcher icon, randomizes package names, and restores activity after reboots. It can obstruct uninstall screens, block security applications, and display black overlays or fake updating messages while fraudulent activity continues underneath.

These controls extend the time operators have to exploit an infection. Group-IB recommends checking Accessibility abuse, remote-control activity, and screen sharing alongside transaction attempts.

Banks should escalate suspicious combinations and hold payments for customer verification. Users should reject unexpected Accessibility requests from entertainment apps, avoid advertised APK downloads, and seek removal support when a suspicious app resists uninstallation. Indicators remain useful, but rotating identifiers make behavioral detection essential.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Mirax Android RAT Hijacks Phones Through Streaming-App Ads to Steal Banking Credentials and Drain Accounts appeared first on Cyber Security News.

Cybercriminals are now using ARTEX, an AI-powered penetration testing platform, to break into websites with almost no human input.

In the cases studied, the AI agents stole more than 190,000 gaming credentials and over 300 Apple code-signing certificates. Only three of those certificates still worked.

ARTEX was built as an open-source tool to help security teams test their own systems. Its developer made the project closed-source on October 8 after it appeared in a breach of South Korean banks, which we covered in a solo hacker AI case.

Forks and backups of the original code are still easy to find, so criminals keep using it. Researchers at Check Point noted the activity after finding 2,557 systems that host or once hosted ARTEX panels, and 1,608 of them were live and open to the internet.

Ten of those servers were set up wrongly and exposed their full databases. That gave Check Point a rare look at how operators prompted their agents and which AI models they picked.

ARTEX AI Agents Steal 190,000 Gaming Credentials

The Apple campaign targeted a gray market that sells .p12 signing certificates. These files let people sign and sideload iOS apps without the App Store.

One operator ran two ARTEX consoles from October 14 to October 29 and pointed them at 10 certificate signing shops. The agents used Deepseek v4.1 Flash and Kimi K3.1 Pro and processed about 36 billion tokens. Check Point estimates the cost at $700 to $1,500.

The agents got in through simple mistakes. They found hardcoded admin passwords in JavaScript files, web APIs with no login, weak admin passwords, and command injection flaws that allowed remote code execution.

They also used insecure direct object references and server-side template injection. In one case, the agent moved from a low-privilege user to root because of loose folder permissions.

After reaching each shop, the agents looked for the certificate library, a database of .p12 files and their plaintext passwords. They checked each key by decrypting it, matching the private key to the certificate, checking Apple’s revocation service, and checking the expiry date.

They also looked for a matching in-house provisioning profile. Of more than 300 certificates, three passed every check, so they could sign any iOS app.

The gaming campaign was simpler and larger. Chinese mobile gaming has a gray market for hacked “data accounts,” which buyers can use with only a QQ-Connect access token and a sideloaded login tool.

The operator aimed agents at 13 backend credential servers. Some of these servers kept a 21.5 MB plaintext credential file in the public web root. The agents recovered more than 190,000 credential sets for Honor of Kings alone.

Testing showed about 3.3 percent still worked, which Check Point puts at roughly 6,000 live accounts. The run lasted about five days on DeepSeek V4.1 Flash and cost an estimated $180 to $360. Operators barely touched the agents after setting the goal. Their messages were mostly short questions about progress.

What the ARTEX Campaigns Reveal About AI-Driven Cybercrime

Not every campaign worked. A third operator tried to drain cryptocurrency from 292 crypto payment domains. Across 230 findings and 400,791 agent messages, no money reached the attacker’s wallet.

Some agents claimed success based on API replies that only said “success,” which turned out to be false. Along the way, one agent found leaked AWS S3 credentials and gained write access to a bucket holding 714 enterprise-signed iOS app landing pages.

It could have swapped the app files for malicious ones. The bucket owners later restored the original manifest. The same pattern of cheap, fast, hands-off automation appeared in autonomous AI agents harvesting credentials in earlier reports.

Chinese models were the most common choice, with the Deepseek Flash family in the lead. Check Point saw guardrails trigger only with Anthropic’s Opus 5.5, and the operator then switched to a more permissive Chinese model.

Operators also used residential proxies to get around web firewalls and IP blocks. Of the live ARTEX servers, 882 (54 percent) sit in the US, 295 (18 percent) in Hong Kong, and 103 (6 percent) in China. Check Point also sees other frameworks, such as CyberStrike, Cairn and PentAGI, with similar abilities.

The risk comes from scale, not clever tricks. The agents tested every endpoint, script and site without stopping until they reached the goal. This matches the warnings in the CERT-In advisory on AI agents, which says exposed passwords and keys are the usual way in.

Companies should find and rotate exposed secrets, remove hardcoded credentials from front-end code, and require login on every API.

They should also test their internet-facing systems and watch for sudden bursts of requests. Readers who want more background can see how ARTEX automates Active Directory attacks.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post ARTEX AI Agents Steal 190,000 Gaming Credentials and Hundreds of Apple Code-Signing Certificates appeared first on Cyber Security News.

Hackers are using the ARTEX AI framework to find exposed credentials on GitHub and turn them into access to cloud systems.

In one observed case, an AI agent moved from searching public repositories for application secrets to stealing data from Azure Key Vault in just five minutes, showing how quickly a coding mistake can become a cloud security incident.

The operation combines credential hunting, automated analysis, and follow-on attacks with less hands-on work from human operators.

Instead of simply collecting leaked keys, the agents investigate what those keys can access and pursue valuable resources. The five-minute finding describes one documented case, not the time required for every attack involving the framework.

Microsoft Threat Intelligence and Microsoft Security Research identified the malicious activity in a November 5 report, tracing GitHub scanning to August 2026.

Researchers described ARTEX as an offensive AI framework, rather than a conventional malware family.

Earlier reporting on ARTEX enterprise attack automation explains how agents interpret results and select subsequent actions, helping attackers connect familiar weaknesses faster.

Hackers Use ARTEX AI to Find GitHub Secrets

The agents submitted large volumes of GitHub searches combining target organization names with terms associated with secrets, cloud platforms, and AI providers.

Exposed material included application credentials and API keys for AI inference services. These searches target authentication data accidentally committed in scripts, configuration files, or other source code.

Once useful credentials were found, agents obtained tokens for compromised OAuth applications and used their permissions to explore cloud resources.

Microsoft observed agents extracting Azure Key Vault secrets and searching Azure DevOps for additional credentials. The wider problem of active GitHub credential exposure helps explain why this approach remains effective: publicly disclosed secrets can remain usable until their owners revoke or rotate them.

In follow-on activity beginning as early as October 28, attackers used valid application credentials to access Microsoft Entra ID tenants and connected Azure and Microsoft 365 resources.

Service principals, the identities applications use to authenticate, enabled access to dozens of applications across multiple tenants. Some compromised credentials belonged to vendor-owned multitenant applications, extending the risk to downstream customers.

The attackers mapped subscriptions, permissions, resource groups, and AI deployments. They targeted storage keys, connection strings, App Service settings, publishing credentials, and Azure Kubernetes Service credentials.

Compromised applications also accessed SharePoint and OneDrive, with observed file downloads and mailbox-item access. Agents additionally used Azure VM Run Command, a legitimate feature that can execute scripts inside virtual machines.

The activity showed adaptive troubleshooting. After failed requests mixed Key Vault data-plane API versions with Azure Resource Manager control-plane endpoints, the agent retried approximately 28 seconds later using ARM version 2023-07-01 and received successful responses.

Similar corrections followed failed Azure SQL and Application Insights requests. Such behavior supports the broader concern around autonomous AI credential theft, where automation can reduce delays between discovery and misuse.

Detecting and Containing AI-Driven Cloud Credential Abuse

Microsoft recommends treating publicly exposed credentials as compromised, even after developers delete the original code.

Responders should revoke or rotate affected secrets, investigate historical use, and replace credentials stored in any Key Vault the compromised application could read. Disabling affected service principals may be necessary; already-issued tokens remain valid until expiry.

Detection should connect identity events with subsequent cloud operations. Security teams should review Entra service-principal sign-ins, Azure Activity records, Key Vault diagnostics, storage logs, and Microsoft 365 audit data.

One address accessing several service principals, or one application rapidly requesting tokens across ARM, Key Vault, Storage, and Graph, warrants investigation. IP matches alone should not determine attribution.

Longer-term protection means reducing reliance on long-lived secrets through managed identities, enforcing least privilege, and enabling GitHub secret scanning and push protection.

Microsoft also recommends monitoring secondary public repositories for leaked organizational credentials.

Behavioral detections remain essential because attackers can change source addresses and user-agent strings, while legitimate tools can produce traffic resembling individual attack steps.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Use ARTEX AI to Find GitHub Secrets and Steal Azure Key Vault Data in Just 5 Minutes appeared first on Cyber Security News.

A China-linked threat group tracked as Storm-2603 has used the SharePoint ToolShell flaws to plant a backdoor that never touches the disk.

The group then tried to run Warlock ransomware on the same network. The break-in hit an on-premises SharePoint server and ended with a ransomware launch that security software blocked.

ToolShell is the name for a set of Microsoft SharePoint bugs, including CVE-2025-53770 and CVE-2025-53771. They let an attacker run code on a server through specially crafted web requests.

Microsoft linked the ransomware side of this activity to Storm-2603, while other groups using the same flaws mostly stole data and spied. Defenders who thought July 2025 patching closed the story should note that unpatched servers were still being hit months later.

Researchers at Securelist, the threat research arm of Kaspersky, identified and documented this intrusion in a report published on November 5, 2026.

Their team found the activity in a December review of a customer’s logs. They noted that the attackers kept control inside the IIS worker process, w3wp.exe, and wrote nothing to disk for the backdoor itself. You can read the full Securelist analysis for the technical details.

Storm-2603 Hackers Exploit SharePoint ToolShell Flaws

The first sign was small. On December 20, a single request hit a SharePoint ToolPane endpoint to check whether the host was vulnerable to CVE-2025-53770. It came from infrastructure tied to ONYPHE, an internet scanning platform.

About 12 minutes later, a second connection arrived from a bulletproof hosting provider, Pfcloud UG. Nothing was exploited yet, and three quiet days followed.

Because of that gap, the team first rated the probe as low priority. The real intrusion came on December 24, Christmas Eve, when many security teams run with fewer staff.

The attacker sent a crafted request from 45.91.94[.]204, a Safing Privacy Network node that hides the true source behind several relays.

That request loaded a webshell straight into the IIS worker process. It ran in memory and vanished if the application pool was recycled or IIS restarted. This matches what earlier reports on the ToolShell zero-day and Warlock ransomware warned about.

The webshell was a modular C# framework. Its main part, G.cs, registered a custom VirtualPathProvider, which lets ASP.NET serve pages that do not exist as files.

It woke up only when a request carried a specific User-Agent, so normal traffic never triggered it. It talked to the attacker over a custom binary protocol with simple XOR scrambling.

It also used the suo5 proxy tool to tunnel traffic through the SharePoint host, which let the attackers reach other machines inside the network.

Other modules listed running processes, logged-on users and network connections. One installed MSI packages silently, and another created admin accounts through low-level Windows account calls instead of normal commands.

For SYSTEM rights, the code used a named-pipe trick copied from the EfsPotato tool, which works because IIS worker processes hold the needed impersonation privilege.

Velociraptor, Tunnels and a Blocked Warlock Launch

Soon after the webshell ran, the worker process started msiexec.exe to install a package from Supabase cloud storage. The package was Velociraptor version 0.73.4.0, a real forensics tool with a known flaw, CVE-2025-6264.

Cisco Talos had already described Velociraptor abused in ransomware cases tied to the same group. Here, the attackers used it for persistence, discovery, data collection and running payloads.

Through Velociraptor, they set up several backup routes: Zoho Assist, VS Code tunneling, Cloudflare Tunnel and a small reverse proxy. With so many paths, deleting one tool would not end their access.

They also stopped depending on the webshell or the ToolShell bug at this point. The group then dropped a vulnerable driver, rsndispot.sys, to shut down endpoint protection.

A sideloaded DLL, flagged as Warlock’s antivirus killer, was likely meant to use it. This fits earlier findings on custom malware that abuses BYOVD from the same actor.

The final step failed. Kaspersky’s Proactive Defense Module blocked the Warlock ransomware process before it could encrypt anything.

Securelist assigns the case to Storm-2603 with moderate confidence, based on the ToolShell use, the Warlock tools and the Velociraptor habits.

For defenders, patching is not enough. Install Microsoft’s emergency SharePoint security updates, then rotate exposed MachineKeys and hunt for persistence.

Watch for odd w3wp.exe behavior, new VirtualPathProvider registrations, unexpected outbound connections and new remote-management tools. Securelist also advises keeping memory and IIS logs, and treating a confirmed exploit as a full host compromise.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Storm-2603 Hackers Exploit SharePoint ToolShell Flaws to Hide Fileless Backdoor and Launch Ransomware Attack appeared first on Cyber Security News.

Security researchers have found ARTEX, an AI-powered penetration-testing framework, exposed on 1,465 internet-facing hosts.

Some servers also hosted command-and-control tools, phishing software, and exploit files, showing how automated security-testing platforms are appearing alongside established attack infrastructure.

The findings offer defenders a view of these environments, including files operators left publicly accessible. The count does not mean 1,465 separate hacking groups are operating the framework.

Around 650 hosts shared repeated configurations across two hosting providers, suggesting cloned systems or servers using multiple addresses.

Removing those clusters leaves roughly 815 distinct-looking deployments. Public exposure also does not establish malicious activity, because authorized security testers can use ARTEX.

Researchers from Censys identified the exposed consoles and associated attack tools in a November 5 report. They described ARTEX as a dual-use framework, not a malware family.

Their investigation found additional threat detections on 155 hosts, or 10.6% of the total, and 32 open directories exposing tools, implants, and operator files.

ARTEX AI Hacking Framework Found on 1,465 Public Servers

Released on July 26, 2026, ARTEX combines a Go backend, Next.js console, and PostgreSQL database. It connects with ScopeSentry, an asset-discovery platform, to import domains, addresses, ports, and endpoints.

Operators define a target, testing scope, and objective; AI agents then plan tasks, execute tools, and record results. Earlier coverage of ARTEX enterprise attack automation explains how this approach reduces manual work across attack stages.

A planner breaks objectives into smaller actions, while worker agents run tools such as nmap and return findings. ARTEX maintains an asset graph showing discovered systems and an exploration graph tracking what has been tested.

It supports Anthropic, OpenAI, and compatible model endpoints, allowing operators to change providers without rebuilding the workflow.

Censys found CyberStrikeAI alongside ARTEX on 70 hosts, with PentAGI, HexStrike AI, and RedAmon also appearing. Other servers carried Vshell, Cobalt Strike, Adaptix C2, FRP, and Gophish.

These combinations matter because reconnaissance, phishing, remote access, and AI-assisted testing can sit together, although shared hosting alone does not prove a coordinated attack.

The exposed directories provided stronger operational clues. Their contents included Windows lateral-movement tools, a public sudo exploit, Linux implants, reverse-shell scripts, and compiled stagers.

One directory exposed

One directory exposed an operator’s home folder, including SSH material and shell history. Separate reporting on ARTEX Active Directory attacks describes how agents have supported credential attacks and movement between Windows systems.

Censys also traced an ARTEX server cited by CrowdStrike to open directories visible from August 18, seven weeks before CrowdStrike’s report.

That investigation linked ARTEX to attacks against South Korean financial institutions. Separately, Microsoft attributed ARTEX-assisted activity against ConnectWise customer tenants to Storm-0940.

Coverage of ARTEX Microsoft 365 targeting details that campaign’s scanning, password spraying, and OAuth abuse. Defenders should correlate infrastructure matches with authentication logs, endpoint activity, and network connections rather than treat every ARTEX console as hostile.

Censys recommends checking nearby open directories, tunneling services, unfamiliar LLM gateways, and historical scan records. Short-lived directories are particularly useful: ten disappeared and fifteen appeared elsewhere between November 3 and November 5.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post ARTEX AI Hacking Framework Found on 1,465 Public Servers, Some Hosting Cyberattack Tools appeared first on Cyber Security News.

Hackers are hiding a free information stealer called Marsalek inside fake cheats and tools for games such as Roblox, Fortnite, and Counter-Strike 2.

The files look like helpful game add-ons. In the background they steal saved passwords, browser cookies, Discord tokens, and crypto wallet data from Windows PCs.

Marsalek ran from about December 2025 to May 2026 as malware-as-a-service, so anyone could sign up on a public site, build a malicious file, and watch victims on a dashboard.

The free tier did not even ask for a Discord or email account. Similar fake game cheat campaigns have pushed other stealers through GitHub and Reddit, which shows how popular this trick has become.

Analysts at McAfee Labs identified the malware and counted more than 1,560 registered accounts, over 400 malicious files, and more than 29 distribution URLs.

They also linked Marsalek to WeedHack, a Minecraft-focused service, because both point customers to the same Telegram support channel, @MetaMaskenMann.

Hackers Hide Marsalek Malware in Fake Roblox and Fortnite Cheats

Most of the lures copy tools that gamers already search for. McAfee saw fake versions of Roblox script executors such as Swift, Solara, MatrixHub External, and Matcha External.

Fake Minecraft clients such as Shadow Client and Boss Client also appeared, and a sample named Fortnite_tweaks.exe is in the indicator list.

The files spread through look-alike websites, Discord, and GitHub. Customers can start an infection with a PowerShell script, a ClickFix page, a Python file, or an EXE file. Bitdefender reported a related case with fake Roblox Xeno cheats that also targeted younger players.

After the first step, the chain is almost the same every time. The starter script downloads a portable Python package and a second file called python_setup.py.

That file tries to gain admin rights with a Windows tool called CMSTP, then hides the permission prompt and presses Enter for the user. It then adds 8 paths and 15 processes to Microsoft Defender’s exclusion list, so later files are not scanned.

The ClickFix page is a fake Cloudflare check, a trick also seen in the Warden Stealer malware campaign that tells victims to paste commands into Windows.

The third file, svc.py, does the main stealing in over 1,400 lines of code. It goes after 32 Chromium-based browsers and Firefox.

It also gets around Chrome’s App-Bound Encryption by injecting a DLL into a suspended Chrome, Edge, or Brave process, so the browser itself unlocks the key.

The malware checks 26 Discord paths, copies Telegram session data, and reads Mullvad VPN account details. It scans for 56 browser extensions and 12 wallet apps, and it looks for files with words like “seed,” “passphrase,” and “wallet.” In Exodus and Atomic Wallet it swaps in two .asar files to leave a backdoor.

Dual-Hook Design Turns Customers Into Victims

The last stage is PureLog, a low-cost stealer sold for as little as $59 a month. It is hidden with .NET Reactor, decrypted with Triple DES, and run only in memory.

It targets 35 browsers, 48 extensions, and 12 desktop apps, takes a screenshot, and sets a scheduled task that runs RunetimeBroker.exe every five minutes. It sends data to a separate server, telemetrydata.to.

This setup is called a dual hook. The customers think they own the stolen logs, but Marsalek’s author also gets a copy and may use a high-value victim’s accounts first.

The built-in FAQ even teaches buyers how to use stolen cookies and tokens and how to launder coins through Monero. McAfee saw the most activity in the United States, followed by Germany, the United Kingdom, India, and Brazil.

Gaming profiles are worth money, and it is easy to see attackers steal gaming accounts and then sell the items or reuse the same logins elsewhere.

The best defense is simple. Download games and tools only from official sources, never turn off antivirus because a site says it is a false alarm, and never paste commands from a web page.

Anyone who ran a suspicious cheat should change passwords from a clean device, sign out of all sessions, move crypto to a new wallet, and reinstall Windows. Readers can find the full technical details in the McAfee Labs Marsalek report.

Indicators of compromise (IoCs):-

SHA256 hashes

Domains and distribution URLs

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Hide Marsalek Malware in Fake Roblox and Fortnite Cheats to Steal Passwords and Crypto Wallet Data appeared first on Cyber Security News.

A single operator in Taiwan built a team of 12 AI agents and used it to attack hundreds of organizations in 11 countries. The campaign hit emergency services, banks, universities, and military systems. It led to confirmed theft of medical data and personal records.

The setup, named BOSSAI, shows how one person with rented GPUs and open-source tools can now run a campaign that once needed a full team.

Some of the agents wrote code, some scanned websites, and some carried out the attacks. The operator sat in the middle and passed results between them.

Analysts at Acronis Threat Research Unit identified the campaign after finding what looked like a misconfigured development server. It turned out to be a full attack platform with more than 90,000 files, about 9GB of logs, chat histories, exploit tools, and victim data.

Acronis calls this kind of actor an “AI-augmented threat,” because the activity looks like a state-backed group but comes from one person, as Acronis explains in its full report.

One Hacker Uses 12 AI Agents

The mesh had 12 agents, but only nine were active. Builder agents such as Grok, OpenClaw, Claude Code, and Codex set up servers, DNS, and proxies.

Attack agents such as Hermes, Cursor, Trae, and CyberStrike scanned targets and wrote exploits. Hermes did most of the work, with about 95 sessions and 18,311 messages.

The agents did not talk to each other. The operator copied output from one tool and pasted it into the next. In one case, a scanner called HalberdStrike checked a Taiwanese emergency-services site.

Hermes turned the findings into a report, and the operator pasted it into Cursor with the order to exploit the flaws. Cursor then carried out the attack.

The agents were linked to security tools through MCP servers, including HexStrike AI, a Kali Linux server, and a Ghidra bridge.

Earlier coverage of the HexStrike AI framework shows how this kind of tool lets AI models run scanners such as Nmap on their own. Attack traffic went out through proxies, and the main node ran on a server at 112[.]121[.]185[.]218.

The damage in Taiwan was serious. A Taipei fire-department patient-care platform exposed ECG readings, ambulance video, and vital signs from 2018, with no login needed.

Agents also pulled case records from a city 119 dispatch system, covering seven districts. Other victims included a lender with 16 SQL injection points and a fire-dispatch vendor whose database panel still used default root credentials.

Outside Taiwan, the agents collected about 206,800 residential phone records in Mexico. In Thailand they found 489 targets across 45 universities and pulled data from three of them.

Why the AI Agents Struggled and What It Means for Defenders

The campaign was far from smooth. Commercial models such as Grok 4.5 and MiniMax M3 refused to help with attacks and asked for proof of written authorization.

The operator then switched to local “abliterated” models, which have their safety rules stripped out. Those models were weaker and often made mistakes.

Hallucinations caused real problems. HalberdStrike flagged a failed connection as a “critical RCE,” and more than half of its high-severity findings were false positives.

Since the operator told the agents to work without asking questions, Hermes also walked away from a Honduran military system, judging it out of scope.

Still, the agents worked well where basic security was weak. Old open ports, unpatched Oracle databases, and default passwords were the easy wins.

Where login checks and filtering held, the agents failed. Acronis notes that hiding behind obscurity no longer helps when an agent can test hundreds of sites at once.

This fits a wider trend. Anthropic recently warned that AI agents can automate every stage of a cyberattack, though humans still pick targets.

The first large-scale AI-driven espionage case from 2025 showed Claude doing most of an intrusion with little human input.

Researchers have also seen agents try SQL injection and path traversal on their own when normal methods failed. Defenders should patch exposed databases, remove default credentials, and close old ports.

They should also put login checks in front of every API, including those that serve dispatch and medical data. The same agents that find flaws quickly will keep finding them until those basics are fixed.

Acronis also tied the activity to one person in Hualien City, Taiwan. The operator reused business branding, a GitHub account, and a home IP across both legitimate and attack servers. The researchers assess this with high confidence.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post One Hacker Uses 12 AI Agents to Breach Taiwan’s Emergency Services and Steal Sensitive Data appeared first on Cyber Security News.

A macOS malware family called Phexia is spreading through fake web pages that talk Mac users into pasting a command into Terminal.

Once the command runs, the malware quietly settles on the Mac, steals the login password, and copies browser data, keychain files, and password-manager extension data.

The trick is known as ClickFix. A page shows a fake verification or fix, and the user performs the dangerous step themselves. No software flaw is needed, so the usual protections have little to catch.

Phexia is sold to several criminal groups, which is why more infections keep appearing. Analysts at WithSecure identified and detailed the malware in a report published on November 4, 2026.

They say Phexia is a modular backdoor and information stealer that has been in use since at least late 2025. The firm has seen a growing number of infections since early 2026, which suggests more criminals are buying it.

Hackers Trick Mac Users Into Running Terminal Commands

In nearly every case WithSecure could examine, the infection started with a command typed into Terminal. The command used curl to download a shell script and sent it straight to bash.

The script was usually named update.sh, though script.sh, clear-cache.sh, and Terminal.sh also appeared. It was hosted on random-looking subdomains that changed between waves.

The team tied one July 6 infection to a typosquatted domain, which points to look-alike web addresses as a likely delivery route. The same trick has appeared in a fake CAPTCHA Mac campaign that also ended in password theft and cryptomining.

The script then runs an AppleScript dropper. The dropper writes a LaunchAgent into the user’s Library folder and sets it to restart whenever it stops.

The loader is stored as Base64 text inside that file, so no readable script sits on the disk. Builds from June to mid-September used a label of “com.” plus 16 lowercase letters. October builds switched to “com.Apple.” plus 16 letters, to look like a real Apple item.

The capital “A” gives it away, because genuine Apple labels use lowercase. After setup, the backdoor checks in with its server and asks for more modules.

A tool called dscl tests whether the entered login password is correct, and a fake “System Preferences” prompt can keep asking until the right one is typed.

The password is saved in a hidden file named .passphrase. WithSecure saw this happen anywhere from under a minute to about eight minutes after infection. Some checks began 22 hours later and repeated on following days.

With the password in hand, the stealer copies the data it wants. It reads browser “Safe Storage” keys for Chrome, Edge, Brave, Opera, and Vivaldi, and copies cookies, history, and saved login files.

It also takes LastPass and NordPass extension stores, the login keychain, and Safari cookies. Everything is zipped and uploaded to the command server and to a second server at 62.60.226[.]50 over plain HTTP.

The operators also install the XMRig Monero miner. They keep reinstalling it and changing mining pools and wallets. Similar password-grabbing tricks showed up in the MacSync macOS infostealer, so the method is clearly popular among Mac malware sellers.

Polygon Blockchain Hides the Command Server

The biggest recent change came in May 2026. Phexia began reading its server address from a smart contract on the Polygon blockchain, a method called EtherHiding.

The loader holds no fixed server name. It asks public Polygon endpoints for the current address and then requests its next module from that host.

The operator can swap in a new server by sending one blockchain transaction. Blocking a domain therefore does not remove the pointer, and the malware just looks up the next address.

WithSecure saw one contract used from June 14 to October 22. A different contract appeared on October 27 and resolved to dhsbdgs[.]icu.

Old infections did not move to new servers right away. Machines kept contacting an older domain for about a month after the contract changed.

When a Mac was infected again, two builds ran side by side, and the earlier one kept receiving tasks for more than 20 minutes. Defenders should therefore keep old indicators in their searches and check for several LaunchAgents on one Mac.

File hashes help little here, because the malware uses built-in Apple tools and every build is obfuscated differently. WithSecure recommends watching behavior instead.

Look for Terminal sessions that download scripts and then launch osascript, LaunchAgents that decode Base64 into osascript, Polygon lookups from script processes, and dscl password checks.

Affected users should isolate the Mac, remove every malicious LaunchAgent, reset passwords from a clean device, revoke sessions, and review password-manager and wallet exposure.

The newer ClickFix abuse of Script Editor shows how fast attackers change the entry point, and the Atomic Stealer ClickFix campaign shows the same social trick. Users should never paste commands from a website into Terminal.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Trick Mac Users Into Running Terminal Commands That Install Phexia Password-Stealing Malware appeared first on Cyber Security News.

Hackers are impersonating the Israel Tax Authority through phishing emails, fake government websites, and CAPTCHA-style checks to trick employees into running SimpleHelp remote access software.

The campaign targets Israeli organizations and turns an ordinary tax-document request into a possible entry point for unauthorized access.

Observed since September 2026, the activity targets a business task familiar to finance, accounting, and administrative staff.

Instead of receiving a tax document, recipients download an archive containing an executable. The attack reflects broader phishing campaigns abusing RMM tools, where legitimate software becomes a route into company systems.

Researchers from Cato Networks identified the campaign’s delivery infrastructure and examined its use of SimpleHelp.

In their November 3 research report, Cato CTRL researchers said they suspect a connection to MuddyWater, although the evidence does not establish definitive attribution. CyberIL had previously reported the activity.

Hackers Use Fake Government Websites and CAPTCHA Checks

The attack starts with an email claiming to come from the Israel Tax Authority. Recipients who try to enter the supposed personal account area reach a lookalike website.

Its government-themed name creates a misleading connection to Israel’s official government web namespace. The page then presents a checkbox, a Continue button, and an archive password.

These details make the download resemble a protected document service. Unlike fake CAPTCHA command attacks that instruct victims to paste commands into Terminal, this chain uses verification to lead users toward a ZIP download and subsequent executable launch.

Inside the archive, the supposed tax document is actually a program. One sample carries a Hebrew filename meaning “Israel Tax Authority,” extending the impersonation beyond the browser.

Opening it can deploy SimpleHelp configured to connect to infrastructure controlled by the attackers. SimpleHelp is legitimate remote support software, not inherently malware.

Its normal features include desktop control, terminal access, file transfers, and system diagnostics. When deployed without authorization, those same functions could let an operator inspect business systems, run commands, retrieve files, or deliver additional tools.

The distinction between capability and observation matters. Cato described these functions as potential attacker uses, not confirmed actions in this campaign.

Its telemetry showed a blocked request to campaign infrastructure, rather than proof that an attacker completed a remote-access session or stole information.

Suspected MuddyWater Links and the Limits of the Evidence

Cato’s attribution assessment rests on Israeli targeting, locally tailored impersonation, and phishing that delivers legitimate remote-access software.

Earlier MuddyWater remote access operations also involved SimpleHelp, providing relevant context. However, similarities in tools and targeting support suspicion rather than conclusive identification of the operator.

The infrastructure investigation also used FOFA searches for two HTTP ETag values. Researchers found eight service records associated with one IP address, including two campaign domains displaying nginx “Coming Soon” pages.

Those eight records should not be mistaken for eight separate servers or confirmed victims. Cato notified SimpleHelp on October 20, 2026, and shared server information the following day.

SimpleHelp identified both samples as Remote Access Client version 5.4.5 and assessed the findings as apparent malicious use of an older release. Neither party identified evidence of a software vulnerability being exploited.

That separates this campaign from earlier SimpleHelp vulnerability exploitation incidents involving compromised remote-management deployments.

Here, the documented entry point was social engineering intended to persuade users to install an attacker-configured client. Cato also found no evidence that SimpleHelp’s own infrastructure had been compromised in connection with this activity.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Use Fake Government Websites and CAPTCHA Checks to Deliver SimpleHelp Remote Access Software appeared first on Cyber Security News.

Citrix has disclosed a critical XenServer vulnerability that could let an unauthenticated attacker compromise virtualization hosts and supporting appliances.

Tracked as CVE-2026-98432, the flaw requires access to the management network, an important limit when assessing which systems are exposed.

The November 3 security bulletin covers XenServer 8.4 and XenServer 9, alongside affected Workload Balancing and Conversion Manager appliances.

Unlike previously reported Citrix XenServer guest vulnerabilities, the headline issue does not require a privileged account inside a virtual machine.

Citrix researchers noted that the issue could compromise the host, running Workload Balancing appliances, or Conversion Manager appliances.

Critical Citrix XenServer Vulnerability

The disclosure concerns software vulnerabilities, not an identified malware campaign; the bulletin does not name malware or confirm active exploitation.

Management-network access remains the central requirement for CVE-2026-98432. The advisory does not describe an unrestricted internet attack, publish an exploit chain, or explain the underlying coding error.

Administrators should therefore avoid treating every deployment as equally exposed without checking network reachability. A separate flaw, CVE-2026-102703, could allow a privileged guest user to compromise the host.

Earlier Citrix hypervisor security issues involved host crashes, highlighting why availability failures and host compromise must remain distinct when explaining virtualization risks.

Six additional vulnerabilities affect network booting or Secure Boot. An unauthenticated attacker on the same network could compromise a PXE-booting virtual machine during startup, while a guest administrator could bypass the guest’s Secure Boot policy.

The bulletin groups these outcomes without assigning each one to individual identifiers. Citrix has released fixes through the Normal and Early Access channels for both XenServer releases.

Administrators should follow the official security bulletin, update Workload Balancing to 2026.1.1 or later, and install Conversion Manager 2026.2.0.

Reviewing hypervisor security best practices can also support management-network isolation while teams coordinate patch deployment.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Critical Citrix XenServer Vulnerability Could Let Hackers Take Over Virtualization Hosts Without Authentication appeared first on Cyber Security News.

Executive summary

In 2025, several threat actors exploited CVE-2025-53770 and CVE-2025-53771 (ToolShell vulnerabilities) in on-premises Microsoft SharePoint to achieve remote code execution through crafted HTTP requests. One of the threat actors deployed ransomware on the target’s systems after successful exploitation. Microsoft attributed this ransomware-related ToolShell activity to Storm-2603, distinguishing it from other actors whose observed activity was primarily focused on credential theft, espionage, and data exfiltration.

In December, our retrospective analysis identified activity consistent with Storm-2603’s TTPs. This activity involved the attacker using the IIS worker process as an in-memory bridge to the customer’s infrastructure, keeping the access and control layer entirely within w3wp.exe without writing anything to disk. Although subsequent post-exploitation activity generated disk artifacts, the bridge used to maintain access remained memory-resident.

Let’s look in more detail at this attack.

The attack chain, from reconnaissance to infrastructure compromise

Intrusion timeline: Strategic latency and exploitation

The intrusion analyzed in this report occurred in two stages, with a temporal gap between initial access and subsequent exploitation activity. The attack timeline was as follows:

• Dec 20 – Vulnerability fingerprinting: A single HTTP request targeted a SharePoint administrative endpoint associated with the ToolPane component to determine whether the host was vulnerable to CVE-2025-53770.
• Dec 21-23 – Tactical latency: A three-day period of silence followed the initial probe, separating the vulnerability fingerprinting from subsequent malicious activity and potentially reducing the likelihood of immediate detection.
• Dec 24 – High-intensity re-engagement: On Christmas Eve, when security staffing at many companies is reduced, the full RCE chain was executed through the IIS worker process (w3wp.exe) on the same endpoint as the initial probe.
• Dec 26 – Incident discovery: The three-day gap initially prevented the December 20 probe from being correlated with subsequent malicious activity, marking the event as low priority. Retrospective analysis established that the probe was the initial phase of the subsequent intrusion.

Intrusion timeline

Initial access validation phase

Vulnerability fingerprinting

A vulnerability fingerprinting request on December 20 marked the first observed interaction with the target. The request originated from infrastructure associated with ONYPHE, an internet-scale attack surface discovery and management platform for identifying exposed assets, vulnerabilities, and cyberthreats. Unlike widely used tools such as Shodan and Censys, which merely provide a list of internet-facing assets correlated with the open-source data about known vulnerabilities, ONYPHE actually checks if the target system is vulnerable.

Fingerprinting with ONYPHE

The request characteristics were consistent with ONYPHE’s vulnerability checks, which use active, non-intrusive probes to identify internet-exposed systems vulnerable to specific CVEs. For ToolShell, ONYPHE adopted the approach used by Niels Hofmans (hazcod). Namely, it attempts to inject a harmless marker into the target server to find out if it is vulnerable.

OFFICIAL ONYPHE CVE CHECKER (TOOLSHELL)

This phase served as a validation step against the SharePoint execution surface exposed over HTTP:

• The target processed structured requests through the ASP.NET pipeline without rejection.
• The request path reached application logic capable of handling serialized input.
• No defensive controls interrupted or altered the execution flow at the application boundary.

Approximately 12 minutes later, a second inbound connection originated from infrastructure associated with Pfcloud UG, a provider operating under a bulletproof hosting (BPH) model. Given the timing and the IP’s documented history of scanning and abusive activity, the connection may represent follow-on reconnaissance against the newly identified target. No exploitation was attempted at this stage.

A connection from an IP address belonging to Pfcloud UG BPH

Active exploitation: Santa took your data and left a backdoor

The main malicious activity occurred on December 24. The actor targeted the same SharePoint host with a crafted request from 45.91.94.204 (45.91.92.0/22, ASN 63473, HostHatch, LLC). This resulted in a webshell execution within the IIS worker process (w3wp.exe). The payload was not written to disk; rather, it was loaded directly into the ASP.NET runtime and used during subsequent request processing. The implant remained resident for the lifetime of the affected application domain. This runtime state was lost when the application pool was recycled or IIS was restarted.

Attack originated from an SPN node

The IP address 45.91.94.204 is a Safing Privacy Network (SPN) node. SPN routes each connection through a multilayer VPN path with multiple relay nodes that can obscure the originating IP.

SPN promotes itself as a network that offers strong privacy protection for internet traffic. Its infrastructure resembles Tor’s in many ways, but with some differences. It features the following capabilities:

• Speed: Near-VPN performance for high-speed data transfer.
• Layer 3 support: Supports multiple protocols like TCP, UDP, ICMP (unlike Tor, which only supports TCP).
• App-routing: Direct tunneling without a browser.
• Multi-identity: Simultaneous exit nodes to bypass IP rate limits.
• Fixed-size packets and padding make it harder to analyze its traffic.

It is less common than Tor, and frequently bypasses standard Tor blocklists.

Webshell architecture

The webshell the attackers injected into the w3wp.exe runtime is a multi-module in-memory framework, where execution is orchestrated through the main component (G.cs) and extended via multiple functional units across namespaces.

The implementation follows a modular C# project structure in which each capability is isolated into its own compilation unit and invoked dynamically at runtime.

Webshell components

“G.cs” pipeline control and C2

Pipeline control

The main webshell component is G.cs. It orchestrates the implant’s execution context, lifecycle, C2 and session management.

To ensure persistence within the runtime, G.cs performs the following actions:

• Registers a custom VirtualPathProvider using the non-public RegisterVirtualPassProviderInternal method from the ASP.NET HostingEnvironment class so that ASP.NET uses it for virtual-path processing. The provider is automatically added to the chain of registered virtual path providers.
  
• Delegates the provider’s .NET Remoting lifetime policy to the previous provider in the chain, preserving the existing lifetime behavior.
  

Additionally, to evade defenses and enable the VirtualPathProvider to be registered even if the application in whose AppDomain the webshell is running is precompiled, the module implements the trust control subversion (T1553) technique:

• Uses reflection to check if the application is precompiled.
• Extracts pointers for internal state fields for the BuildManager class, which manages application compilation, and modifies them at runtime.
  
• Uses reflection once again to force runtime injection.

G.cs uses the GetCacheKey() function as the interception point for the virtual path processing flow. It processes incoming requests to the SharePoint server and checks their headers to filter out requests from the attacker.

The specific User-Agent in the request headers triggers the webshell execution. If the request doesn’t match this condition, the implant remains dormant, making its traffic harder to recognize.

Command and control layer (in-memory transport)

The same core module (G.cs) implements the communication layer.

Instead of relying on external frameworks or standard beacons, it uses a custom binary protocol with XOR-based obfuscation to exchange data with the C2. These communications blend into normal application traffic. The module uses the GetCacheKey() hook to intercept standard HTTP requests. When a specific User-Agent is detected in the request headers, the module parses it, extracts the payload, and establishes a TCP connection to a target host inside the target’s network if needed.

Bidirectional TCP tunnel initialization

G.cs establishes a full-duplex proxy tunnel to support interactive control. It stores active target sockets in memory to pair concurrent HTTP read and write channels.

TCP connections from the C2 server to arbitrary hosts inside the target network are supported for pivoting and lateral movement. The traffic is proxied through the SharePoint host.

Target-to-attacker data channel

Attacker-to-target data channel

As can be seen in the screenshots, the attackers used the suo5 tool to implement traffic proxying. Its authors promote it as a stable forward-proxying tool for scenarios where outbound internet connections are prohibited.

To increase its performance, G.cs manipulates ThreadPool by raising its limits for concurrent operations and maximum timeout.

ThreadPool manipulation

“Prog.cs”: Execution entry point and task dispatcher

Prog.cs is the entry point that receives command-line arguments and passes them to uk/London.cs. The latter acts as the orchestrator, handling command parsing and privilege escalation (via named pipe impersonation). We’ll review it in more detail later. If the “suo5” command is provided, London.cs triggers G.cs to hook into the ASP.NET runtime as a memory shell. Once active, G.cs independently processes incoming web traffic inside the web server memory.

Host interaction modules

The following modules provide direct system interaction capabilities, each implemented as a separate unit. London.cs triggers these modules when it receives a corresponding command from Prog.cs.

“FileDownloader.cs”

The FileDownloader.cs module downloads arbitrary files from external URLs provided by the C2. It stores the downloaded files in the Program Data directory without any user interaction.

“LoggedOnUsers.cs”

This module enumerates logged-on users and identifies their session types (interactive, service, remote). The results are stored in memory. The attackers can retrieve them using the proxy and tunneling capabilities provided by G.cs.

“ProcessList.cs”

This module lists running processes with full paths to the corresponding executables on the disk. The results are stored in memory and the attackers can retrieve them via G.cs.

“NetworkInfo.cs”

This module extracts information about existing network connections, including protocols, local and remote IPs and ports, and connection state. It also enumerates network interfaces and headers. The results are stored in memory and can be retrieved by the attackers via G.cs.

“MSI.cs”

This module silently installs and executes MSI packages previously downloaded by FileDownloader.cs.

“User.cs”

This module creates administrative accounts using the native SAM RPC subsystem (SAMRPCNative namespace) rather than standard command-line tooling. This may indicate an attempt to evade detection and provide the attackers with privileged stealthy access to target systems that persists after the webshell has finished its work.

SAMRPCNative

The SAMRPCNative namespace implements a low-level C# P/Invoke wrapper for the native Windows samlib.dll library, comprising three types: SAMStructs.cs, SAMMethods.cs, and SAMEnums.cs.

“SAMEnums.cs”

Implements structured bitwise lists and constant flags mapping numeric codes to their security meaning in SAM, and translates system status return codes.

“SAMStructs.cs”

Defines native data structures required for P/Invoke memory alignment and for marshalling. It securely formats and aligns data structures.

“SAMMethods.cs”

Contains external API declarations (P/Invoke) imported from samlib.dll to perform actions such as connecting to the SAM server, creating users and opening domains.

This layer is crucial for the attackers because it enables account operations.

Privilege escalation

The uk namespace contains offensive primitives for privilege escalation. To elevate privileges to SYSTEM, it uses a local token impersonation technique via the Encrypting File System Remote Protocol (EFSRPC) interface adopted from the EfsPotato tool.

This functionality is implemented in the uk/London class. It creates a malicious named pipe while the EfsrTiny class (a tiny version of the EfsPotato tool) connects to the LSASS.exe RPC server. Then it’s London.RpcThread function calls the EfsRpcEncryptFileSrv function from EfsrTiny with a crafted \\localhost path. This tricks LSASS.exe into connecting back to the attacker’s named pipe. Finally, the London.Exp function uses ImpersonateNamedPipeClient to coerce and impersonate the LSASS.exe token and spawn a new process via CreateProcessAsUser with SYSTEM privileges. As the webshell resides in the IIS worker process, it has the necessary SeImpersonatePrivilege to perform this technique.

The uk namespace also implements a minimal MSRPC client layer by explicitly defining structures such as RPC_CLIENT_INTERFACE and MIDL_STUB_DESC, thereby spoofing an interface stub. This enables direct interaction with the Windows RPC runtime (Rpcrt4.dll) without relying on MIDL-generated stubs or higher-level RPC abstractions. This provides direct control over binding and marshaling that goes beyond the constraints of standard client APIs.

Post-exploitation activity

Shortly after the webshell injection, the infected worker process spawned msiexec.exe to install a remote MSI payload hosted in Supabase cloud storage. The payload was Velociraptor, an open-source digital forensics and incident response tool – namely version 0.73.4.0 vulnerable to CVE-2025-6264 – that the attackers abused for command execution on the target network.

In October 2025, Cisco Talos reported Velociraptor being leveraged by threat actors as a post-compromise execution framework and attributed this activity to Storm-2603. This tool enables arbitrary command execution, and can be used for various purposes. In our case, it was used for persistence, discovery, data collection and payload execution.

The threat actor used Velociraptor to deploy multiple independent tunneling mechanisms, including Zoho Assist-Unattended Support for unauthorized remote access, VS Code CLI tunneling, Cloudflare Tunnel, and a lightweight reverse proxy utility. By doing so, they attempted to maintain access even if some of their tools were detected and deleted. At this stage, they also no longer depended on the IIS worker process lifecycle and ToolShell vulnerability.

EDR-killing attempts

Once the threat actor had access to the target system, they were able to upload a vulnerable driver that is used by many attackers to terminate EDR solutions. We were able to detect the main driver at C:\programdata\rsndispot.sys (054a32d6033b1744dca7f49b2e466ea2). In addition, the adversary used a malicious DLL (2d9ebf9c042f596f435865b40edad928) in a sideloading attack. This DLL was identified as Warlock ransomware’s AV killer. It was possibly intended to kill security solutions using the vulnerable rsndispot.sys driver.

Ransomware deployment attempt

The attackers made attempts to launch ransomware on the compromised system. However, the Proactive Defense Module in Kaspersky Endpoint Security blocked the ransomware process, effectively preventing this activity. The malware DLL we obtained was identified as Warlock ransomware.

What defenders really need to look for

ToolPane deserialization and CLR artifacts

When the attackers tried to access ToolPane, both the dynamically compiled App_Web_toolpane.aspx assembly and the Microsoft.GeneratedCode helper assembly were present within the same application domain.

Both assemblies are used in legitimate scenarios. App_Web_* assemblies are generated during normal ASP.NET page compilation, while Microsoft.GeneratedCode is typically produced by the XmlSerializer during legitimate serialization workflows. However, a request to the ToolPane endpoint that results in immediate loading of Microsoft.GeneratedCode within the same execution window indicates that the runtime is processing serialized data supplied through the request.

Detecting deserialization exploitation

First, it is highly recommended to read this article (in Russian) on how deserialization exploit attempts in the CLR should be detected, with examples of YARA rules and monitoring recommendations. A summary of the main idea of the detection logic is provided below.

Deserialization vulnerabilities should be treated as a distinct class of exploitation events. In the CLR, deserialization is not merely the conversion of bytes into values – it is the reconstruction of an object graph from an incoming stream. Serialization and deserialization are performed by formatters. One of the most widely used formatters is BinaryFormatter. It uses the NRBF format, which defines the stream as a sequence of records describing classes, arrays, primitives, and references between objects. The shape of the resulting graph is determined by the data supplied to the deserializer. This means that the input stream defines not only the values but also the specific types, relationships, and lifecycle points that the runtime must materialize.

Microsoft states explicitly that BinaryFormatter is unsafe and cannot be made safe; beginning with .NET 9, the in-box implementation is effectively removed from ordinary use. However, Microsoft continues to use it in its products, including SharePoint, because it is powerful and easy to use. To fix BinaryFormatter-related issues, architectural changes are needed. Similar warnings also apply to related unsafe mechanisms, including LosFormatter (used in the vulnerable page).

The primary risk of unsafe deserialization is that the CLR may resolve unexpected types, instantiate objects outside normal constructor invariants, and invoke special lifecycle mechanisms such as ISerializable, IObjectReference, IDeserializationCallback, and methods marked [OnDeserialized]. In other words, the attacker-controlled data can force the runtime to construct a graph containing types with executable side effects.

A practical detection strategy should therefore focus on graph-construction artifacts. CLR loader events identify the relevant assemblies and application domains. Memory and metadata inspection then reveal the type names and generated serializer structures associated with the suspected gadget chain. In ToolShell-like scenarios, unsafe deserialization usually produces helper assemblies (evidence in loader events) with metadata containing fully qualified type names, gadget class names, and string representations of the constructed generic types (just scan via YARA for it). In our case, the artifacts to look for include Microsoft.GeneratedCode, App_Web_toolpane.aspx* (evidence of deserialization in loader events) as well as strings identifying ObjectDataProvider, ExpandedWrapper, and LosFormatter (evidence that the input stream was deserialized into dangerous objects). Note that these indicators are not significant in isolation; their value lies in the fact that they show the runtime has already received data requiring helper code generation to reconstruct a dangerous object graph.

Gadget objects that exploit vulnerabilities like those associated with ToolShell are conveniently represented in corpus-style tooling such as ysoserial.net/YSoNet, which aggregate known gadget chains for unsafe .NET deserialization. For defensive purposes, the value of these projects lies not in their offensive capability but in the catalog of types and structures that can be searched for in streams, memory, and helper assemblies. The presence of any of them in memory or in a helper assembly should be treated as a strong indicator of exploitation.

To simplify deserialization exploit detection, we created a tool named CLRDeserializationExploitFinder. It can detect ToolShell exploitation attempts, as well as other gadget chains covered by ysoserial.net.

Detecting a VPP-based webshell/runtime implant

A mechanism based on VirtualPathProvider should be treated as a separate class of runtime implant (no files involved). In ASP.NET, HostingEnvironment.RegisterVirtualPathProvider registers a new virtual-path provider (VPP) in the application’s compilation system. Once registered, the application can serve virtual paths during dynamic compilation as though they were ordinary on-disk pages. Dynamic compilation does not require the payload to exist as a file in the filesystem. It operates entirely within the trust boundary of the application itself. During the compilation process, temporary files may be generated, but they cannot be treated as reliable forensic artifacts. Because VPPs can also be used for legitimate purposes, the defensive model should begin with an inventory of the legitimate VirtualPathProvider implementations. In all other cases, the registration or use of a new VPP should be considered anomalous.

To see how the dynamic generation of virtual pages using ASP.NET, IIS, and the CLR works, and to learn how to detect such activity, use our project VirtualPathProvider Lab.

The most useful telemetry source for this technique is the Microsoft-Windows-IIS-Configuration ETW provider. To detect virtual paths, events 25 and 47 are of primary value. Event 25 records the mapping of ConfigPath to PhysicalPath, and event 47 records the mapping of the configuration path to a directory. In the case of a VPP-backed path, these events create an inconsistency: IIS and ASP.NET behave as if the path has a physical representation, while the corresponding file does not exist on disk. In the example provided by VirtualPathProvider Lab, this appears as a mapping of the virtual resource googlecheck.aspx to a physical path where no real file is present. This discrepancy between configuration resolution and filesystem reality is the primary indicator of virtual content.

The second indicator is more negative than positive. For disk-backed files, IIS normally creates a FileChangeNotificationMonitor chain, as reflected in events 17, 18, 19, and 21. For virtual paths served by a custom VirtualPathProvider, this chain is absent or does not match the normal profile of an ordinary file because there is no physical object or corresponding on-disk change lifecycle. Consequently, the presence of positive events 25 and 47 combined with the absence of the expected events 17, 18, 19, and 21 for the same path forms a reliable detection pattern: the path exists for IIS as a configuration-resolved resource, yet it is not backed by the filesystem and is not accompanied by normal file-change monitoring.

To sum up, the hunting target here is the discrepancy between how IIS/ASP.NET resolves a resource and what is actually present on the disk and in the change-monitoring chain. For known applications, such cases can be filtered through an allowlist of legitimate VirtualPathProvider implementations. Anything else should be treated as a potential runtime implant and examined using ETW, filesystem verification, and memory inspection of the w3wp.exe process.

Attribution

Microsoft tracks Storm-2603 as a standalone threat actor with no known links to other groups. While they are careful about assessing the actor’s motivation, they mention that it has previously deployed Warlock and LockBit ransomware following active exploitation of on-premises SharePoint vulnerabilities. In the analyzed incident, we observed similar SharePoint exploitation activities, as well as an EDR killer associated with Warlock ransomware and unsuccessful Warlock launch attempts.

Other documented intrusions have identified Storm-2603 as leveraging known flaws within perimeter mail gateways to achieve initial access, subsequently staging the Velociraptor framework with elevated privileges and establishing persistent encrypted tunnels via commercial remote management software to orchestrate secondary lateral movement. This aligns with the post-exploitation behavior we observed in our case. Together with the ToolShell exploitation scenario, this allows us to attribute this case to Storm-2603 with moderate confidence.

Conclusion

From the incident analyzed in this article, the main defensive lesson is that exploiting an internet-facing SharePoint server can enable fileless code execution directly inside the application trust boundary. Storm-2603 did not require a conventional dropper, persistent service, or exposed C2 endpoint; instead, it deployed a webshell inside w3wp.exe, from which tunneling, privilege escalation, credential access, and lateral movement could be orchestrated. Detection therefore needs to move beyond file-based webshell hunting toward runtime behavior, such as anomalous w3wp.exe activity, unexpected outbound connections, RPC coercion, token impersonation, and the introduction of remote-management or DFIR tooling after application compromise.

To correctly attribute malicious activity and develop appropriate response measures, defenders should reconstruct execution chains and temporal relationships across application, host, and identity layers. They should also preserve memory and IIS telemetry, and correlate low-signal reconnaissance with subsequent privileged activity rather than evaluating events in isolation. A confirmed SharePoint exploit with code execution should trigger host-level containment, persistence hunting, credential and exposed MachineKey rotation, and TTP-driven investigation rather than remediation limited to the initial exploit or known IOCs.

Kaspersky products detect the threats mentioned in this article as:

• Trojan.MSIL.Agent.gen
• Trojan.Win64.DLLhijack.cdp

Indicator of compromise

Barracuda has disclosed two security vulnerabilities that could allow attackers to bypass authorization controls and gain root access to affected appliances when exploited together.

The flaws affect several Barracuda security products, but exploitation requires access to a device’s administrative interface, making exposed management systems a key concern for defenders.

The vulnerabilities, tracked as CVE-2026-116606 and CVE-2026-111560, were disclosed on November 2, 2026. Barracuda has released patches and urged customers to install the latest firmware and verify that security updates have reached their devices.

Its advisory does not report active exploitation or identify an associated attack campaign. Barracuda researchers identified the vulnerabilities, not a malware strain.

The distinction matters because the disclosure describes weaknesses in appliance access controls and command handling rather than a documented malware infection.

According to the official Barracuda security advisory, combining these weaknesses could give an attacker root access to an affected device.

Critical Barracuda Security Flaws

CVE-2026-116606 is a pre-authentication authorization bypass affecting Barracuda Email Security Gateway, commonly called ESG.

It carries a CVSS score of 9.3. CVE-2026-111560 is a command injection vulnerability with a score of 8.6 and affects six product families. Barracuda labels both vulnerabilities “High” in its advisory, despite the first flaw’s 9.3 score.

The first weakness concerns authorization controls, while the second involves command injection. Barracuda says the combined attack could bypass those controls and obtain root access.

However, the advisory does not publish vulnerable endpoints, example requests, payloads, or a detailed exploit sequence. Administrators should therefore avoid treating an assumed attack chain as confirmed technical evidence.

Earlier coverage of Barracuda gateway command injection explains how a separate flaw, CVE-2023-2868, enabled system command execution through malicious archive processing.

That historical vulnerability is not one of the newly disclosed issues, and its exploitation method should not be applied to this advisory.

An important limitation remains unresolved in the published details. Barracuda calls CVE-2026-116606 a pre-authentication authorization bypass, yet its advisory also lists “Authentication Required: Yes, administrative access.”

Its overview states that attackers need access to the administrative interface. These statements do not clearly establish whether valid administrator credentials are required for every exploitation scenario.

Only ESG is listed as affected by both vulnerabilities. The command injection flaw also affects Load Balancer Application Delivery Controller, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway.

The published matrix does not list those five additional products as vulnerable to the authorization bypass. The broader concern is familiar: security appliances can become valuable entry points when exploitable weaknesses remain exposed.

Reporting on most exploited security vulnerabilities previously included Barracuda ESG among products targeted through known flaws. That history provides context for patching urgency, but it does not establish exploitation of these newly disclosed CVEs.

Patches, Administrative Exposure, and Defensive Priorities

Barracuda recommends restricting administrative interfaces to trusted internal networks and applying appropriate network access controls. Organizations whose management interfaces are not publicly accessible face less exposure to this attack path.

Reducing internet exposure is therefore an immediate containment measure, but the vendor still directs customers to update firmware and apply all security patches.

The supplied advisory lists ESG patches BNSF-40425 for versions 9.4.017 and later, and BNSF-40430 for earlier versions.

It identifies BNADC-16586 for ADC and WAF, BNMA-32468 for Message Archiver, BNWF-60060 for WAF Control Center, and BNYF-24789 for Web Security Gateway. These identifiers help administrators verify remediation against the affected product.

Customers should check the latest firmware offered by each appliance and confirm that patches actually installed. Systems several firmware versions behind may require multiple updates.

If automatic patching did not apply an update, Barracuda advises installing it manually as soon as possible and enabling automatic patch delivery where it has been disabled.

Previous reporting on network device root access illustrates why management interfaces deserve close attention during vulnerability response.

For this disclosure, however, administrators should follow Barracuda’s product-specific guidance rather than assume another vendor’s exploit methods or recovery requirements apply. Barracuda Support can help verify firmware and patch status.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Critical Barracuda Security Flaws Could Let Hackers Bypass Authentication and Gain Root Access appeared first on Cyber Security News.

Microsoft Edge now automatically disables notifications from websites that send users to detected scam pages, cutting off a route used to deliver fake virus warnings.

The protection connects Microsoft Defender SmartScreen and Scareware blocker detections with notification permissions, helping prevent malicious sites from repeatedly drawing people back into the same scam.

The change arrived with Edge 156, according to Microsoft’s November 2 disclosure. Rather than simply warning about a dangerous destination, Edge can now stop further notifications from the website responsible for sending the user there.

That distinction matters because closing a deceptive page does not necessarily stop notifications the visitor previously allowed.

Researchers writing on Windows Blogs, Rob Franco and Lu Huang, noted the malicious notification abuse while reviewing user reports submitted through Scareware blocker.

Their findings describe a recurring scam delivery method, not a newly named malware family: website notifications repeatedly brought users back to pages that Edge’s security tools identified as scams.

Microsoft Edge Now Automatically Blocks Malicious Websites

The attack starts with a permission request. A misleading website persuades someone to select “Allow,” sometimes claiming this is necessary to prove they are not a robot.

That click grants notification access, giving the site repeated opportunities to display false security messages even after the original page has closed.

These alerts borrow the language of antivirus products to create urgency. Related reporting on fake Microsoft security scans shows how convincing branding and fabricated findings can pressure users into unsafe decisions.

A notification claiming that a computer is infected should therefore not be confused with a verified diagnosis from installed security software.

Edge’s new response follows a specific detection chain. When Microsoft Defender SmartScreen or Scareware blocker identifies a scam reached through a notification, the browser automatically disables notifications from the originating site.

This closes the route used to bring the user back, rather than addressing only the page currently open. The scope is important: Microsoft describes notification blocking tied to detected scams, not a guarantee that every deceptive website will be stopped before interaction.

On the next browser launch, an information bar explains the action. Users can review blocked sites in Edge Settings and restore notifications if they believe the browser made an incorrect decision.

The wider scam ecosystem explains why stopping repeat contact matters. Campaigns using the browser locking CypherLoc kit have combined full-screen warnings, hidden controls and alarming sounds to push fake Microsoft support calls.

Those techniques are separate from notification permissions, but both depend on making a browser message look like a serious system emergency.

Microsoft says Scareware blocker directly protects tens of thousands of users daily against new scams. Reports also support wider SmartScreen protection; during the preview, each report helped protect another 50 users.

The new notification control extends that feedback process by acting on the delivery source as well as the destination.

Reporting Suspicious Prompts and Stopping Repeat Scams

Edge also offers a “Block and report” option within notification permission requests. Users can open the menu beside “Block” and report the requesting site before granting access.

Reports can include the URL and a screenshot of the page that tried to persuade the visitor to enable notifications. This gives SmartScreen evidence earlier in the process, potentially before an abusive notification reaches anyone.

The distinction between delivery and deception is also visible in malicious Google Ads campaigns that lead visitors to fake security warnings. Different entry points can feed similar support scams, making the original source worth investigating alongside the warning itself.

Users retain a manual way to stop unwanted messages when automatic detection does not intervene. Microsoft advises opening the “…” menu on a website notification and disabling future notifications from that site.

Other buttons inside a fake alert may simply open more pop-up windows, so interacting with its supposed repair controls can prolong the scam.

For security teams, the practical value is a shorter repeat-exposure window. Blocking a detected destination helps with one encounter; withdrawing the sender’s notification access also interrupts future attempts from that source.

Microsoft describes the broader approach as connecting browser-side detection, user reports and cloud reputation to turn individual observations into protection for more users.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Microsoft Edge Now Automatically Blocks Malicious Websites Sending Fake Virus Alert Notifications appeared first on Cyber Security News.

A Russian state-linked hacking group is using trusted websites to quietly break into phones. Researchers say APT29, also known as Midnight Blizzard or Cozy Bear, planted hidden code on real and cloned sites in the US, Ukraine, the Czech Republic and Bulgaria.

Visitors with out-of-date iPhones or Android phones can lose cookies, Wi-Fi passwords and, in some cases, almost all of their phone data. They only need to open the page.

The campaign was found in mid-October 2026. It uses three entry routes: code added directly to hacked sites, lookalike sites that copy real ones, and a one-week break-in at a Ukrainian web analytics service.

All three load the same script, which checks the visitor’s device and sends a matching exploit. The exploits use old, already-patched flaws, so fully updated phones are safe.

Analysts at Sekoia identified the campaign and the malicious scripts behind it. They say with moderate to high confidence that APT29 is responsible. They are working with the CERTs of affected countries to find victims and try to shut down the infrastructure.

Russian APT29 Hackers Turn Trusted Websites Into Traps

The first route was simple. The attackers added a few lines of JavaScript to the main page template of a Ukrainian gas production company. Once the page loaded, the code quietly pulled a script from a server the attackers controlled.

Sekoia also found the same trick on the site of a US chemical industry trade group, a far-right European political party and a Bulgarian military-related site.

When the attackers could not break into a site, they copied it. They registered two lookalike domains, america250[.]holiday and theowo[.]club.

These acted as middlemen for the real America250 site and the website of Raffles London at The OWO, a hotel near the UK Ministry of Defence and 10 Downing Street.

Visitors saw the real content, but the attackers slipped malicious code into each page. Sekoia thinks the goal was to reach diplomats and high-profile guests.

The widest net came from Plerdy, a Ukrainian SEO tracker used by thousands of sites. Between 27 August and 3 September 2026, the attackers altered its tracker file, so every site that loaded it also loaded the attackers’ script.

Many of the affected sites were linked to the military and defense sector. The loaded script is called UltimateFingerprinter. It is hidden inside a large copy of the AngularJS library, which makes up about 98 percent of the 2.3 MB file.

Sekoia believes this was meant to confuse automated analysis tools or to make the file look harmless. The script collects 394 data fields from 61 checks, but it mostly blocks only odd devices, such as those with huge screen sizes or no touch support.

This is not APT29’s first watering hole campaign. Google’s Threat Analysis Group tied a similar Mongolian government website campaign to the group in 2024.

Amazon also reported an APT29 watering hole campaign in 2025 that sent visitors to fake Cloudflare checks.

Exploit Chains, Stolen Data and Ways to Stay Safe

Sekoia recovered three exploit chains, which it named A, B and C. Class A targets iOS 16.7 and steals cookies. It uses CVE-2025-43529 and CVE-2024-27834, and it sets a marker cookie so the exploit does not run twice on the same phone.

Class B is the most invasive. It targets iOS 18.5 and is the DarkSword exploit kit leaked online earlier this year. It chains CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520.

After that, it takes messages, WhatsApp and Telegram databases, Keychain passwords, contacts, call history, location caches, photos and iCloud Drive files.

Class C goes after Android phones running Chrome versions 139 to 145, except 143. It uses CVE-2026-3910 and CVE-2025-27038, a flaw in the Adreno graphics driver.

The final payload, named AndroSnitch, copies Chrome cookies, saved logins, history and Wi-Fi settings. It stops if it finds a Samsung Galaxy S25 Ultra.

All stolen data goes to ad.starx-net[.]com. None of the payloads set up lasting access, which fits quick intelligence gathering. Stolen cookies could let the attackers reuse logged-in sessions, including webmail.

Sekoia sees signs that the exploits came from a third party. For example, the server checks for iOS 16.7, but the exploit works on iOS 16.0 to 17.4.

The researchers say reuse of commercial surveillance exploits by state groups will likely grow. Other researchers have also warned about Coruna and DarkSword kits that hit outdated iPhones from a single web visit.

The defense is simple. Update iOS and Chrome now, and replace phones that no longer get updates. Teams should also check logs for the domains below and review who has loaded third-party scripts.

Indicators of compromise (IoCs):-

Domains and IP Addresses

File Hashes (SHA-256)

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Russian APT29 Hackers Turn Trusted Websites Into Traps to Compromise iPhone and Android Users appeared first on Cyber Security News.

Cloudflare has launched Zero Wire, a public vulnerability intelligence feed designed to help security teams track critical CVEs, understand exploitation activity, and find security fixes.

Announced on November 3, 2026, the service sits within Cloudflare Radar’s security section and brings technical evidence, vendor guidance, and recommended actions into readable briefings.

The platform addresses a familiar problem: when a serious vulnerability emerges, defenders must piece together scattered advisories while checking their own systems.

Cloudflare’s launch announcement describes a service built to shorten that process, giving security leaders and engineers a shared starting point without requiring them to be Cloudflare customers.

Cloudflare Launches Zero Wire

Cloudflare researchers noted that network observations can reveal exploitation attempts, but the announcement does not identify a new malware family. Instead, Zero Wire connects vulnerability research with practical response guidance.

Earlier reporting on Cloudflare’s early PHP warnings illustrates the distinction: detecting suspicious requests can justify urgent investigation without proving attackers successfully compromised a server.

Zero Wire is not intended to catalog every CVE. Its focus is significant vulnerabilities in internet-facing software, including web applications, underlying runtimes, libraries, and exposed services.

Briefings explain potential impact, identify deployments that need investigation, summarize exploitation evidence, and point readers toward patches or mitigations. Inclusion does not depend on Cloudflare having a dedicated protection available.

The homepage divides entries into “Needs attention” and “Reference.” The first category covers issues requiring active assessment, including known exploitation or developing guidance.

The second retains briefings once guidance stabilizes. Moving an entry into Reference does not mean every affected organization has patched; readers must still assess their own exposure and check the entry’s last-reviewed date.

Cloudflare uses PHP2Shell to show why clear ownership matters. The issue concerns the PHP runtime, meaning an application or plugin update alone cannot repair the underlying weakness.

Reporting on critical PHP runtime vulnerabilities provides related context for teams checking which server components need updates, rather than assuming a refreshed website means the entire software stack is secure.

Users can search published briefings by CVE or issue name and follow technology tags. A single briefing may combine related vulnerabilities when that makes the response clearer.

Each entry also records important developments, allowing returning readers to identify changes in advisories, exploitation evidence, or recommended actions without reconstructing the full disclosure timeline.

Turning Vulnerability Intelligence Into Security Fixes

Each briefing’s action guidance connects the issue to concrete checks: identify affected deployments, confirm software versions, contact hosting providers where necessary, and apply vendor updates.

Cloudflare also supplies a prepared AI-agent prompt for a read-only assessment covering deployed software, exposure, fixes, and existing safeguards. Copying that prompt does not automatically scan infrastructure or change systems.

Evidence remains central to the workflow. Vendor advisories establish affected versions and remediation instructions, while exploitation reports describe attacker activity.

Zero Wire links relevant external material, including CISA’s Known Exploited Vulnerabilities Catalog. Related coverage of CISA’s PHP2Shell exploitation warning shows why confirmed exploitation should influence response priority alongside the technical severity of a vulnerability.

Where available, Cloudflare adds charts showing HTTP requests matching managed web application firewall rules. These figures indicate observed activity, not successful exploits or compromised systems.

Likewise, an absence of matching traffic on Cloudflare’s network cannot establish that exploitation is absent elsewhere. Those limits matter when security teams explain risk to management or decide whether deeper investigation is needed.

Protection details include available WAF rules and configuration requirements. Dashboard links help customers review settings, but opening a link does not enable protection or verify coverage.

Cloudflare stresses that filtering malicious requests is a temporary safeguard, not a software fix, and cannot reverse actions already taken on an origin server. Teams must still follow vendor remediation guidance.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Cloudflare Launches Zero Wire to Track Critical CVEs, Active Exploits, and Security Fixes appeared first on Cyber Security News.

A new XLoader malware campaign is landing in inboxes as ordinary business orders and price quote requests. The emails look routine, but the attached archive holds a script that starts a chain of hidden steps.

The chain ends with the XLoader password stealer running inside a trusted Windows program. XLoader is an information stealer from the FormBook family.

It takes saved passwords, browser cookies and other login data, then sends them to servers run by the attackers. Criminals favor it because it is sold as a service, so almost anyone can buy and use it.

Researchers at Morphisec noted that they have seen more XLoader activity in recent months, built around many business-themed email lures.

One chain they studied begins with a Greek-language email that asks the reader to confirm order 001828. The subject starts with “RE:”, which makes it look like part of an ongoing conversation. The same campaign also delivered Agent Tesla, Remcos and XWorm.

Hackers Hide XLoader Malware in Fake Business Orders

The message is short and asks the reader to review the attached order and reply quickly. It was sent to “undisclosed-recipients,” so no single target is known.

The attached RAR archive repeats the order number, but it holds one obfuscated JScript file instead of a document. Morphisec also saw Slovenian and quotation-themed emails with the same type of attachment.

When the victim opens the script, Windows Script Host runs it. The script tries to wipe its own Zone.Identifier stream, which is the mark Windows uses to flag files that came from the internet.

It then unpacks two files from its own body into the Documents folder: a LuaJIT interpreter and a Lua program with no file extension. Nothing is downloaded at this stage, so network filters have little to catch. The script launches the interpreter in a hidden window.

The Lua program hides its console window and tries to blind security tools. It searches memory for the AMSI scanning functions and tries to erase their names. It also tries to overwrite 12 functions in ntdll, including several that Windows uses for event tracing, so that logging fails.

Morphisec says this shows the loader’s intent, and it did not observe the patches working on a real host. Many other campaigns have used fake orders as bait, as in the Cascading Shadows attack chain that also delivered XLoader.

Memory-Only Tricks That Help XLoader Evade Detection

Next, the Lua loader decodes a large hidden blob and loads it straight into memory as a packed program. This packed program has no import table, so it looks bare to scanners.

It finds the Windows functions it needs by itself and decrypts the XLoader core with RC4 encryption. Only the script, the interpreter and the Lua file ever touch the disk. Everything after that lives in memory.

XLoader then picks a 32-bit Windows program to hide in. The 12 candidates include cleanmgr.exe, clip.exe, getmac.exe, mshta.exe, ftp.exe and find.exe.

It creates a shared memory section that both programs can see, copies itself in and changes the target thread so it runs the new code.

Morphisec says this is not process hollowing, because the host program’s original image stays in place. The method also avoids the common WriteProcessMemory call that many tools watch for. The core code is encrypted too, and it decrypts a key routine only while that routine runs.

Once active, XLoader can read Windows Vault entries and prepare cookie records for theft. Its settings list 64 possible hosts plus one more, and it starts with 16 of them.

Many are decoys, so the list alone does not reveal the real server. Earlier reporting showed that XLoader has upgraded its obfuscation tactics in the same way. Zscaler ThreatLabz has also documented XLoader’s network protocol, and Morphisec says this sample matches that design.

Treat archives with script files inside as suspicious, even when the email mentions a real-looking order number. Block JS files in RAR and ZIP attachments at the mail gateway.

Watch for LuaJIT programs with random names starting from the Documents folder. Also look for scheduled tasks named EHFTUOMQDRXVTJSF, which the loader can create to run every ten minutes if a marker file exists.

Defenders should also correlate the order-themed script with the dropped files, changes to ntdll functions, and a shared memory mapping followed by a thread context change.

The same lure style has long worked for criminals. One older campaign sent fake SharePoint notification emails to spread XLoader. Staff training and attachment filtering therefore remain the cheapest defenses.

Since XLoader steals saved logins, any infected machine needs a full password reset for browser and email accounts. Another campaign used an Equation Editor vulnerability campaign to reach the same goal, so patching old Office flaws still matters.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Hide XLoader Malware in Fake Business Orders to Steal Passwords and Evade Detection appeared first on Cyber Security News.

The number of organizations named on ransomware leak sites rose 30% in the third quarter of 2026. Researchers say that does not mean attacks rose by the same amount. Most of the growth came from new, unproven groups, and some of their claims may be false.

Leak sites are where ransomware gangs post the names of victims to pressure them into paying. Defenders have long used these posts to count attacks.

Fake or recycled claims are not new, and a past case of fake extortion demands showed that old data can be passed off as a fresh breach. This quarter the problem looks larger.

Analysts at ReliaQuest noted that 43 groups that had never posted before Q3 drove 93% of the increase. Groups active in both Q2 and Q3 added only 1% more named organizations.

The team said it is realistic that some claimed attacks are false allegations. It also said the listings likely mix new attacks, rebrands, recycled data and claims with no proof behind them.

Ransomware Gangs Claim 30% More Victims

The posting patterns of the new groups differ a lot. Some post steadily every week. Others dump dozens of names at once.

A group called “Global Secret Group” listed 48 victims, 28 of them on one day. Another, “crpx0,” listed 47 victims, 41 on a single day, and has not posted since August.

Researchers say bulk releases do not prove the claims are fake. They fit better with data collected in advance than with many separate break-ins.

Other new groups look more like real operations. “Storm” listed 71 victims over 20 days, more than established names like DragonForce (69) and LockBit (62).

But Storm first posted about five weeks after a similarly named group, “Stormous,” made its last post. That timing makes a rebrand possible, though it is unconfirmed.

The clearest example of a doubtful claim is “ExfilSquad,” first seen in July 2026. It released data samples with employee names, email addresses, phone numbers and work locations, plus empty fields and basic customer relationship details.

ReliaQuest says this is low-risk personal data. It does not prove a network breach. The group likely scans GitHub for exposed credentials and takes only what those accounts can reach.

It then uses a ransomware-style leak site to make that limited access look like a major breach. It also posted payment deadlines it did not follow through on, and it listed some targets with no data samples.

The likely real harm is targeted phishing against the named employees, plus the cost of investigating the claim. That is why researchers advise treating each post as an unverified claim.

Recent cases show the same caution, such as the Emperador ransomware group claim against AB InBev, which stayed unverified with no company confirmation.

What Defenders Should Do When Named

When a new group lists your organization, check three things. Was the organization really compromised? Does the evidence match how the group says it got the data? Is the name a distinct group, a rebrand, an affiliate or an opportunistic poster? Paying on a false claim wastes money and funds crime.

Ignoring a real claim can leave exposed data open to phishing and account takeover. ReliaQuest advises teams to review internal logs, access records and any posted samples. If the evidence shows an intrusion, start incident response.

If it does not, keep the claim marked unverified while looking for other sources of exposure. Teams should also record overlaps in tools and infrastructure with known groups, which can point to a rebrand.

Because new names have no history or public indicators, detection should focus on shared behavior. That means abuse of remote services, stolen identities, lateral movement and data theft.

Established groups like Qilin and The Gentlemen show why. Both exploited internet-facing systems, used vulnerable drivers to disable endpoint security tools, and changed Group Policy settings to spread ransomware.

Together they drove about a quarter of listed manufacturing victims. Our earlier look at The Gentlemen ransomware group covers how this affiliate-driven crew grew so fast.

Defenders can block much of this activity. They should patch and monitor edge devices, enforce Microsoft’s vulnerable driver block list, and alert on unexpected Group Policy changes.

The GentleKiller vulnerable driver tool shows how attackers use signed but flawed drivers to shut down security software.

Teams should also audit GitHub and other code repositories for exposed keys and passwords, rotate any they find, and review customer system logs for unusual bulk downloads.

The data also shows ransomware spreading beyond the US. US listings grew 9%, and about 85% of the added victims were elsewhere.

The US share of all listed victims fell from 55% in Q1 to 49% in Q2 and 41% in Q3. Manufacturing victims rose 70%, but professional, scientific and technical services stayed the top sector for the sixth quarter in a row. A lower ranking does not mean lower risk.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Ransomware Gangs Claim 30% More Victims, but Researchers Warn Some Breaches May Be Fake appeared first on Cyber Security News.

Microsoft’s new research shows that attackers pick flaws that give them control of a system. About 78% of vulnerabilities exploited in real attacks let an attacker take over a system or raise their privileges.

The finding comes from a data study published on November 2, 2026, by Microsoft Security Research. Software flaws keep piling up. From 1999 through September 2026, about 383,000 vulnerabilities were disclosed.

Only about 2,000 of them, roughly 0.5%, were linked to real-world exploitation. Fewer than 1 in 200 flaws ever reach a real attack, so defenders gain a lot by knowing which ones matter.

Microsoft researchers Yair Tsarfaty and Or Begam noted that attackers go after remote code execution, privilege escalation and authentication bypass bugs far more than other types.

The analysts also warned that AI-assisted bug hunting and exploit writing could shrink the time defenders have to react. That follows a trend already seen when attackers exploit flaws within hours of disclosure.

Microsoft Reveals 78% of Exploited Vulnerabilities

The team studied each CVE in two ways: by impact and by affected platform. Impact means the best result an attacker could get. For example, if a bug bypasses login and then allows remote code execution, Microsoft counts it as remote code execution.

Platforms included Windows, Linux and Unix, mobile, network appliances, IoT and OT, virtualization hosts, and developer packages.

The full CVE pool looks very different from the exploited pool. Across all published CVEs, about 77% sit in application code and 23% in operating system code.

Among exploited bugs, operating system flaws jump to 41%. Server-side remote code execution rises from 20% of all CVEs to 37% of exploited ones. Local privilege escalation climbs from 11% to 18%, and client-side remote code execution from 4% to 13%.

Low-value bug types fall sharply. Cross-site scripting drops from 15% to 4%, and denial of service from 16% to 7%.

Microsoft explained that a crash or a small script run gives an attacker little to build on, while code execution and higher privileges give a foothold for later steps.

A good example is the Windows privilege escalation flaw in the CLFS driver, which let local users reach SYSTEM access.

Microsoft also cautioned that a bug’s label does not always match real results. Some flaws described as remote code execution may only cause a crash in real conditions. So teams should check what an attacker can actually do before they rank a fix.

Why Slow Patching Helps Attackers

The second finding is about speed. Microsoft’s 2026 exposure data shows the median fix takes about two weeks on Windows workstations.

On Windows Servers it takes more than a month. Linux servers and macOS applications take over 10 weeks, and network appliances take more than a year. That gap is the window attackers use, and it is widest on the systems that matter most.

Exploitation moves much faster. VulnCheck reported that 29% of exploits in 2025 were launched within one day of CVE publication. CISA data shows the mean time from CVE publication to the KEV catalog fell from 89 days in 2024 to 57 days in 2025.

In 2026, through September, the mean is 20 days and the median is only 3 days. Microsoft says two things decide a flaw’s value to an attacker: impact and exposure. Servers often run service accounts or cloud identities with more permissions than they need.

Taking over one gives access to data, admin rights and trusted network paths. Microsoft calls this the blast radius. Public exploit code makes this worse, as seen when the MiniPlasma Windows zero-day gave SYSTEM access on patched machines.

Microsoft said defenders should fix takeover flaws first. Stopping them breaks an intrusion early, before it spreads. The second tier includes denial of service on systems where uptime is critical, and leaked credentials that feed privileged identity paths.

The same pattern shows in the Cloud Files driver zero-day, where attackers used a local flaw to gain SYSTEM rights. Patching is still key, but some old or unsupported systems cannot be patched.

Microsoft suggests finding all internet-facing assets, including shadow IT and third-party dependencies, with Defender External Attack Surface Management.

Defender Vulnerability Management then ranks weaknesses beyond CVSS scores, using exploit signals, internet exposure and asset value.

Attack Path Analysis shows how an exposed server could lead through a privileged identity to sensitive data, so teams can cut that route. Microsoft also shares more detail in its original research post.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Microsoft Reveals 78% of Exploited Vulnerabilities Enable System Takeover and Privilege Escalation appeared first on Cyber Security News.