• Cisco Talos began an investigation after observing a DLL named "verification.google" executing from WebDAV at a Ukrainian government organization. We assess with moderate confidence that the attacks are not targeted at a particular organization, but are a part of a cryptocurrency and credentials-stealing operation using the Amatera stealer as the primary payload. 
• Pivoting around the similar WebDAV behavior led to a second loader named "pf.ch" and allowed us to reconstruct its earlier delivery stages. The chain uses a Cloudflare Worker to inject JavaScript code stored on BNB Smart Chain and a ClickFix prompt impersonating Google CAPTCHA, leading to download and execution of Amatera stealer. The chain is likely very similar to what has caused the WebDAV-based execution at the Ukraininan government organization.  
• The two Amatera builds were tasked with different secondary payloads by their respective command-and-control (C2) infrastructure: the "pf.ch" loader was instructed to deploy a NativeAOT loader running ZigCryptoStealer and a Go-based reverse proxy, while the "verification.google" loader was instructed to install an unauthorized instance of NetSupport Manager. 
• The NetSupport Manager installation contained configuration with the C2 server using an IP address based in Russia. With moderate confidence, we assess that "verification.google" branch attack was conducted by a Russian threat actor.  

 In April 2026, Cisco Talos identified an unusual WebDAV DLL execution in endpoint telemetry from a Ukrainian government organization. The remote file was named "verification.google" and was launched through the 32-bit version of "rundll32.exe". This initial finding led us to two similar delivery chains, two different DLL loaders and two ACR/Amatera stealer payloads. Talos tracks the actor behind the observed "verification.google" activity as UAT-10820. 

Following the initial investigation, we decided to hunt for similar WebDAV and ordinal-execution patterns in an attempt to recover the full infection chain. Using VirusTotal, we were able to identify a full chain from a second DLL loader named "pf.ch".  

These two examples are a part of a wider set of recent campaigns delivering Amatera through different infection chains. In July 2026, Malwarebytes documented fake game and software downloads that used RenPy Loader, MSBuild and EtherHiding before delivering Amatera. Blackpoint Cyber described another fake-verification chain that used a signed Microsoft App-V script, configuration stored in Google Calendar and a payload concealed in a PNG image. Apart from the main payload malware family, we found no common infrastructure or other evidence linking those activities to the chains described in this post. 

Initial finding in endpoint telemetry 

The initial event that started the investigation was recorded in April 2026 and it showed an execution of a DLL file through a WebDAV UNC path together with startup of the Windows WebClient service. Apart from the initial command line, we had details of the checksum of the executed DLL but it was not clear what started the execution chain. It was time for hunting in open source intelligence repositories and Talos analytical platform. We wanted to find a similar execution with the similar loader and the payload family and ideally recover the whole infection chain which would likely point to how "verification.google" execution was triggered. This lead us to the "pf.ch" loader and the chain we discovered.  

Hunting reveals a second WebDAV delivery chain 

The "pf.ch" sample uses the same combination of WebDAV, a disguised DLL filename and ordinal execution through "rundll32.exe". We were also able to recover the full ClickFake related sequence leading to this loader. Figure 1 shows both chains, with dashed elements marking stages that were not directly recovered. With low to medium confidence, we assess that the two delivery chains are identical. 

The discovered "pf.ch" loader chain was initiated by ClearFake Javascript injected into the content of a compromised site by a malicious Cloudflare worker.  

The C2 server returned configuration instructing the stealer to download a DLL side-loading package in which a signed Chrome component sideloads a malicious NativeAOT DLL, "secur32.dll". The DLL loads ZigCryptoStealer and uses a vulnerable driver to terminate EDR software. A separate x86 shellcode loader with a Go reverse TCP proxy is also downloaded as a secondary payload by the Amatera configuration sent by the C2 server.  

The secondary payload of the "verification.google" branch as instructed by its own C2, is a PowerShell script which attempts to install a sample of NetSupport Manager remote access tool. 

ClearFake retrieves browser code from BNB Smart Chain 

The "pf.ch" branch begins likely on a compromised website. A Cloudflare Worker injects a malicious JavaScript which queries BNB Smart Chain testnet contract 0x886d310Ac23e05EA705e24E513D19f53793832A9 through "bsc-testnet-rpc[.]publicnode[.]com".  

BNB Smart Chain is a public, Ethereum-compatible blockchain hosting transactions and smart contracts. The actor uses the contract as remotely changeable storage for encoded JavaScript, a technique known as EtherHiding. Based on the operating system of the victim’s machine, the JavaScript code retrieves the next stage from the blockchain, which acts as a bulletproof hosting provider for the malicious code. Potent Pages previously documented unauthorized Cloudflare Workers querying the same first stage contract. 

The initial Javascript code contains routines to check for local and headless browser environments, identifies the operating system, and queries a second contract based on the result of the operation. If the victim is running Windows, it retrieves code from 0x46790e2Ac7F3CA5a7D1bfCe312d11E91d23383Ff and if the victim is running macOS, it uses 0x68DcE15C1002a2689E19D33A3aE509DD1fEb11A5. The response is Base64 decoded and evaluated as JavaScript. 

The Windows browser stage creates a victim identifier, stores it in the cjs_id cookie and asks a tracking contract whether the goal for that identifier has already been reached. If the browser is not headless and the target is Windows, the script overlays a fake Google CAPTCHA-style checkbox onto the compromised page, instructing the victim to open the Windows Run dialog, paste the clipboard contents, and press Enter. 

​ The copied command opens a WebDAV path on a randomized subdomain of "leaguejazire[.]com", places the victim identifier in the path, and executes "pf.ch" through ordinal #1. 

Censys documented the same Windows and macOS contracts in a blockchain-backed ClickFix chain, although the downstream payloads in that reporting differ from those analyzed here. 

The macOS browser stage uses the same headless-browser checks, victim tracking, and fake verification design, but its execution chain is different. It instructs the victim to open Terminal and paste a command that uses curl with a macOS user-agent string. The request goes to a subdomain of "riyazinikokar[.]xyz". Since the subject of our initial research was a customer running Windows, we have not further pursued the macOS side of the "pf.ch" branch.  

WebDAV launches disguised DLLs 

Both observed variants retrieve a 32-bit DLL over WebDAV using a file extension name that does not indicate it is a standard DLL file. Both use the 32-bit "rundll32.exe" process and invoke a function by calling the function ordinal #1. The corresponding first exports are moor in "pf.ch" and CfgInspectModuleData in "verification.google". 

Different initial loaders 

Although the WebDAV execution pattern is the same the two initial loaders use different code and protection methods. 

"pf.ch" uses exception-driven control flow 

The "pf.ch" loader is a packed 32-bit DLL whose only named export is moor with import table containing only AddVectoredExceptionHandler and __mb_cur_max functions.  

The packed code uses vectored exception handling, XOR loops, API hashing, and control-flow patterns, which makes the static analysis of the code more difficult. After the initialization, one of its threads is waiting for an event named hit. Once the event is triggered, it copies an embedded blob into memory and transfers control to it using Windows fibers. The next stage decoder uses XOR and LZNT1 to decode the final Amatera payload. 

The unpacked PE file, an Amatera sample, is also 32-bit, has no import table, and resolves APIs by walking loaded module export tables. The sample uses 32-to-64-bit transitions to execute system calls, possibly in an attempt to evade EDR hooks.  

The sample contains the build label 4.1.5-alpha and string GETWELLV2. Amatera is known to use the Steam community profiles as C2 dead drop resolvers, and the GETWELL2 string was observed in some previous samples as a name of a Steam community profile used to retrieve the IP address of the C2 server. Once C2 server address is resolved, the main configuration is downloaded.  

The Amatera payload was recovered only as a memory-resident artifact and was not observed to be written to disk. Its hash is nonetheless included in the indicator of compromise (IOC) list below, as memory derived hashes remain applicable to memory scanning. 

"verification.google" uses DLL hollowing in "dbghelp.dll" 

The "verification.google" variant does not immediately unpack its payload. It first prepares the state and then passes execution through a callback. The callback is registered using the dynamically resolved function TpAllocWork, an undocumented native NT internal function in "ntdll.dll". The callback is later executed asynchronously by Windows. The callback function implements most of the malicious unpacking functionality in a large control flow flattening loop. 

The loader resolves functions by hash, derives execution state from the environment and implements direct WoW64 syscall stubs. The stubs decode syscall numbers at runtime and call the WoW64 transition pointer instead of the corresponding exported "ntdll.dll" functions. 

The loader reconstructs its next stage from data in the .rdata section. It first maps a clean image of the legitimate "dbghelp.dll" in memory and then overwrites the beginning of its code section with the unpacked next stage. Finally, it restores executable protection before transferring control to the overwritten code section of the "dbghelp.dll".  

This module overwriting (stomping) technique is also known as DLL hollowing or module overloading. VMRay’s technical overview of DLL hollowing describes the same core sequence: loading a legitimate DLL, overwriting its mapped code with malicious content, and executing from that overwritten region. G DATA documented module stomping in a HijackLoader chain that delivered ACRStealer, using different DLLs, "evr.dll", and "rasapi32.dll" rather than the "dbghelp.dll" observed in our case. 

Amatera C2 configurations 

"pf.ch" loaded Amatera resolves its C2 through a Telegraph page 

Before starting its Amatera C2 session, the Amatera sample used in "pf.ch" branch constructs the dead drop C2 URL "https[:]//telegra[.]ph/Functions-04-03". At the time of analysis, the page looked like a short Rust programming tutorial titled “Functions.” with an altered code example containing the string r.]MTQ1LjI0OS4xMDkuMTQ3)0(. 

​ The raw HTML places the same value inside a println statement.  

Decoding MTQ1LjI0OS4xMDkuMTQ3 produces “145.249.109[.]147” as its C2 address.  

After resolving the address, the payload generates WoW64 transition gates, opens an Auxiliary Function Driver (AFD) socket and connects directly to "145.249.109[.]147" on TCP port 443.  

After connecting to the C2 server, Amatera connects to the GetEndpoints URL on the server. The response supplies randomized URI paths for different C2 functions. The stealer then uses the configuration path, together with an embedded build identifier, to retrieve its information collection rules.  

In the "pf.ch" build, a TLS-decoded HTTP buffer we were able to analyse contained a nonzero session identifier and an opaque 73-byte body whose framing is consistent with the ECDH and ChaCha20-Poly1305 protocol documented for recent Amatera versions.  

After removal of the transport and application encryption layers, the configuration is first Base64 decoded and then XOR decoded with the key 852149723\x00, before parsing it as a JSON object.  

Apart from the rules for stealing data the received configuration also contained the instructions to load secondary payloads in a ld (load) json array.  

The ld field is an array of secondary loader tasks supplied by the Amatera controller. Within each entry, u is the download URL, tf selects the payload type and tr selects file-based (1) or fileless (2) execution. The loader supports executables, DLLs, command scripts, PowerShell, raw shellcode and MSI packages, which is described by the field tf. The p value determines task order, with lower positive values processed first. 

"verification.google" loaded Amatera configuration 

The "verification.google" Amatera build stores its bootstrap controller as an encrypted string. At runtime, it decrypts the fixed address "45.150.34[.]2" and connects to it directly on TCP port 443, while presenting "github[.]com" as the TLS server name and HTTP Host value. Unlike the "pf.ch" build, it does not use a public dead-drop resolver to obtain its initial C2 address. After connecting, it sends the GetEndpoints command to obtain working endpoints used for subsequent communication.  

As in the "pf.ch" Amatera payload the first accessed C2 URL is GetEndpoints. This branch’s configuration contains over 400 entries across its browser, extension, messaging, wallet, and other-application collection lists, plus four file collection rules.  

The application rules in the configuration blob extend the initial browser related information collection to Telegram, Signal, WhatsApp, and other messaging data. They also cover over 100 desktop wallet locations and credential data from password managers, authenticators, FTP clients, mail clients, VPN software, and remote-access tools. Representative targets include KeePass, Bitwarden, 1Password, RoboForm, NordPass, WinAuth, Authy, FileZilla, AnyDesk, NordVPN and AzireVPN. 

Four file grabber rules cover the Desktop, Downloads, Documents and Windows Recent-items directory. Across those rules, more than 100 unique filename and extension patterns look for private keys, wallet backups, API and OAuth material, two-factor authentication data, password databases and certificate files such as .kdbx, .p12, .pfx and .pem. Most of the collection rules are focused on stealing cryptocurrency related data and credentials.  

Amatera secondary payloads 

Further on, we focus on the secondary loader tasks, which may point to a more advanced threat actor, based on the installed secondary payload type. 

The "pf.ch" Amatera build received two secondary tasks. One deployed a NativeAOT loader and ZigCryptoStealer, while the other ran a Go reverse TCP proxy from memory. The "verification.google" build received a PowerShell task that installed NetSupport Manager.  

Amatera branch	Task type	Follow-on capability
pf.ch	File-based archive	Chrome DLL side-loading host, NativeAOT loader, process termination and ZigCryptoStealer
pf.ch	Fileless shellcode	Go reverse TCP proxy over WebSocket and Yamux
verification.google	Fileless PowerShell	Unauthorized NetSupport Manager remote access

NativeAOT chain runs ZigCryptoStealer 

The "jquery.min.js" entry has priority 1, so Amatera processes it first. Its tf: 1 and tr: 1 values select the file-based executable handler. The server response does not have to be a PE file but it can also be an archive file. When this handler receives an archive, the loader extracts it to a temporary directory, enumerates the resulting *.exe file and launches the selected executable. The most recently observed response was a ZIP archive, SHA-256 279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92.  

The archive included the file "platform_experience_helper.exe", a legitimate Google Chrome component. The executable imports GetUserNameExW from "Secur32.dll", which is a malicious DLL file in the archive which gets sideloaded by the Chrome component.  

The side-loaded "Secur32.dll" is a NET NativeAOT loader which decrypts and loads 2 PE files. The first file is a user mode payload and the second a vulnerable driver used to ter. The NativeAOT DLL starts “C:\Windows\"explorer.exe" in a suspended state, manually maps the PE’s headers and sections into the child, changes its initial thread context to the new entry point, and resumes it.  

The payload is a cryptocurrency stealer written in Zig language — ZigCryptoStealer. It polls the clipboard, recognizes several cryptocurrency address formats and can replace matching values with addresses embedded in the payload.  

The payload makes a separate JSON-RPC eth_call through "bsc[.]rpc[.]blxrbdn[.]com" to BNB Smart Chain contract 0x7CC3cFC1Ac007B8c6566fD2C7419b15a75473468. This is a second use of EtherHiding in the infection chain, this time by the final payload rather than the browser delivery framework. VMRay has previously documented ZigCryptoStealer variants using BNB Smart Chain contracts as a dead drop for C2 configuration.  

ZigCryptoStealer disguises the request as a routine query for an ERC-20 token balance. It supplies a randomly generated cryptocurrency address, but the smart contract ignores it and instead returns text stored by the operator. The operator can change this text using the contract's setData(string) function. During our analysis, the contract returned "lb[.]propertyfind[.]cc", which ZigCryptoStealer then used as its C2 domain. 

The contract was deployed on March 16, 2026. The same wallet that deployed it made 39 successful setData calls through July 26. These calls provide a public history of the C2 values supplied to the malware with six domains active during July: 

Effective period in UTC	Contract value
June 30 – July 5	fd[.]gstats-api-contact[.]cc
July 5 – 9	pkg[.]vogueatelier[.]cc
July 9 – 12	kffd3[.]vogueatelier[.]cc
July 12 – 18	kffd3[.]vexlatech[.]cc
July 18 – 26	static[.]quorashift[.]cc
July 26 – 30	lb[.]propertyfind[.]cc

Talos used Cisco Umbrella to observe DNS activity for all six domains while they were active. The two most recent values also had the broadest query distribution. Umbrella data includes DNS quaries from 38 countries for "static[.]quorashift[.]cc" and 98 for "lb[.]propertyfind[.]cc". Queries for the current value came most often from the United States, Indonesia, Brazil, India, and Egypt.  

Passive DNS shows that all six domains resolved through shared Cloudflare addresses.  

The second decrypted PE is a signed Windows driver whose version information contains the names MOCOMSYS & DCRC and DCRCV_U Driver (for SCM). Its original filename is "DCRCVDrv.sys", and it exposes the device \Device\DCRCVDRV_U.  

The NativeAOT loader enumerates running processes, hashes their names, and compares the hashes with an internal target list of EDR software and other security tools. For every matched process name, it sends the process identifier to the driver with IOCTL 0x2205c0. The driver’s handler accepts the four-byte PID, obtains a process handle and calls ZwTerminateProcess. We found no caller authorization check in that IOCTL branch. This gives the loader a kernel-mode process-termination primitive, a BYOVD driver. 

​

Go payload turns the host into a reverse TCP proxy 

The URL for the second secondary payload of the "pf.ch" branch yielded a binary shellcode blob with SHA-256 643ef35536ff9273fb84b8504467b1a5645cd3ffd5476d64b99244b02131b205. 

The 32-bit shellcode walks the process environment block (PEB) to find "ntdll.dll" and resolves LdrLoadDll, NtAllocateVirtualMemory, NtProtectVirtualMemory and NtFreeVirtualMemory . It then decrypts and decompresses the final payload stored in the shellcode using XOR to decrypt and LZNT1 to decompress the compressed proxy payload. 

The unpacked file has SHA-256 1819827e17f31e72d456158b6b9c90af25a65945f6f05d04a060da9f24179b25. 

The payload is a Golang 32-bit Windows executable with main package “github.com/acr/proxy-panel/cmd/bot”. It includes HashiCorp Yamux network multiplexing library with C2 hardcoded “wss://"update[.]dubbedmuch[.]cc"/”. 

The proxy reads the Windows MachineGuid and hostname, then sends them over WebSocket Secure (wss) protocol. After the C2 server accepts the client, the program creates a Yamux server session, multiplexing outgoing communications over the same connection. Each logical stream supplies a source and destination address. The client connects to the requested destination and relays bytes in both directions. 

​ PowerShell in the "verification.google" branch installs NetSupport Manager 

The secondary payload in this branch is "https://kr[.]cedar2glanz[.]ru/jewel[.]js". The tf value 4 of the single secondary payload loader instruction (ld) identifies the payload as PowerShell. The tr value 2 selects the execution path that retrieves the URL with PowerShell DownloadString and runs it through Invoke-Expression (IEX). Proofpoint’s Amatera analysis documents the same ld, tf and tr semantics in more details.  

The next PowerShell stage dynamically resolves native functions and runs an environment check before installing the payload containing the following steps: 

• It queries the C: volume serial and compares it with the hard-coded value 4E014A2F. The original expression returns true when this value matches, allowing execution to continue early and skipping the remaining checks.  
• It calculates system uptime from Win32_OperatingSystem.LastBootUpTime. An uptime below 10 minutes returns false, causing the script to exit. 
• It measures a native 500 ms NtDelayExecution call with GetTickCount64. If fewer than 400 ms appear to elapse, the gate returns false, which can identify an environment that accelerates or skips delays. 
• It checks the processor count. Fewer than three processors unexpectedly returns true and allows execution to continue early rather than rejecting the low-resource system. 
• It queries total physical memory. A reported value below 3.2GiB returns false. 
• It queries Win32_VideoController and selects the largest reported AdapterRAM value. A reported maximum below 384 MiB returns false. 
• It checks display-device friendly names and manufacturers against 36 strings associated with virtual graphics, remote displays, cloud platforms and generic virtual adapters. A match returns false. 

After the environment checks, the script derives an installation path by hashing MachineGuid|zdozwoqx3c. It also starts two background Powershell runspaces that request many legitimate URLs, including GitHub API, npm, Docker Hub, PyPI, NuGet, and PowerShell Gallery. The requests seem to generate decoy traffic to hide the malicious download within plausible developer activity. 

The script downloads "https://phys[.]stunned-amniotic[.]com/hub[.]log". Although the logs at the targeted system in Ukraine contained no evidence of accessing this URL we were able to download the file that was likely intended to be downloaded and executed by the Amatera stealer payload.  

The response at the time of analysis was a ZIP file with SHA256 bd36f4c15fe0acb6748da5ed12e45dcc37d412385812c078d1e4f04730e9f69b. Finally, the PowerShell validates ZIP entry paths, extracts the archive in the %APPDATA% directory, and starts "hypersnap.exe" executable without a visible window and creates a scheduled task triggered at user logon. 

The ZIP contains legitimate NetSupport Manager software 

The launched "hypersnap.exe" is a renamed, signed NetSupport Manager 12.44 "client32.exe". The "client32.exe" stub calls the export _NSMClient32@8 in signed "PCICL32.DLL", the main NetSupport client runtime containing the main functionality of the remote access platform.  

The actor-controlled "client32.ini" NetSupport Manager configuration enables silent operation, hides the system-tray interface, disables visible chat, message, disconnect, replay and help controls and configures "paternal-angrily[.]com:443" as the NetSupport HTTP Gateway. 

The client connects to the gateway, which acts as a proxy between the threat actor and the NetSupport Manager client installation at the victim system. The NetSupport client was configured to poll the gateway every 60 seconds. At the time of the analysis the domain resolved to the IP address "212.118.56[.]166", based in Russia.  

The NetSupport deployment used a license issued as KAKAN, with serial number NSM789508. The exact license file has appeared in numerous malicious NetSupport packages, including activity publicly tracked as EVALUSION and IClickFix. We therefore treat it as an indicator of shared deployment lineage rather than a unique threat actor identifier. 

NetSupport adds an operator driven capability after Amatera’s automated collection. Amatera steals configured credentials, session data, cryptocurrency material, and selected files. An unauthorized NetSupport client can then provide screen and input control, file transfer, inventory, process and service management and remote command or PowerShell execution. This could let an operator inspect data outside Amatera’s predefined rules, act on sessions from the original endpoint, or deploy additional tooling.  

Indicators of compromise (IOCs) 

The IOCs for this threat are also available at our GitHub repository here. 

Claude Mythos is the first model reported to complete a cyber kill chain without step-by-step human direction. The finding does not describe malware or a confirmed victim breach. It is a controlled test, but shows how quickly autonomous attack capability is advancing.

The concern is speed. The model found weaknesses, entered a defended enterprise network, collected credentials, raised privileges, moved between systems and reached domain administrator control.

Those are stages defenders try to interrupt during an intrusion. GitHub hosts projects and discussions using the Claude Mythos name, but did not identify a malware campaign.

The finding comes from Booz Allen’s assessment of autonomous models. It is a benchmark result, not evidence of a named program independently attacking organizations.

Booz Allen said in a report shared with Cyber Security News (CSN) that it tested 18 U.S. and Chinese models as autonomous attackers against a production-grade enterprise network. Researchers used network and host telemetry to measure actions, rather than accept model claims.

Claude Mythos AI Autonomously Executes Full Cyber Kill Chain

The Cyber Weapon Index gave Claude Mythos an 80 score, combining 74 for vulnerability research and 86 for kill-chain attainment.

It was the only model assessed as reaching the final objective. Researchers said it moved from a stolen employee credential to administrator-level control in every credentialed attempt.

The harder scenario began with no credentials. The report says Claude Mythos penetrated from outside and worked out how to raise its access, instead of following a fixed plan.

The reported autonomous AI agent breach illustrates why this development has drawn attention. The test examined whether models could spot weaknesses in compiled software without source code.

Only frontier Anthropic models identified the previously unseen flaw used in testing, and only Claude Mythos reportedly exploited it. The result is from a defined setting, not proof of universal performance.

Other models showed progress without matching the full outcome. Four reached domain access and control, four achieved lateral movement, and two reached credential access.

All but one penetrated the network autonomously. An attacker need not finish every stage alone to cause disruption or give a human operator a head start.

Defenders face a speed problem

The report argues that risk lies in the entire AI system, not only its model. An attack harness can link a model with tools, memory, feedback and an execution environment.

This helps an agent retain context, recover from errors and connect tasks, as seen in agents breaching company networks.

A model that stops short alone can become more effective with automation, tailored prompts and operational tools. The report found that a harness paired with Claude Sonnet could rival Claude Mythos. A public model score, therefore, can leave serious blind spots.

The likely entry routes are familiar: exposed services, unpatched flaws, stolen credentials and weak access controls.

AI reduces the time and expertise needed to test options, analyze results and adapt. AI agents rebuilding attack tools illustrate how persistence after failure can amplify this advantage. The recommended response is to assume an initial foothold and restrict what happens next.

Organizations should connect vulnerability management, detection, containment and response; enforce least privilege, strong identity checks, segmentation and isolation of high-value systems; and test containment while keeping services running.

Teams should test safeguards in deployed configurations, including tool permissions and autonomy levels. The report recommends continuous measurement of models and surrounding systems, plus controlled access for vetted defenders to reproduce threatening behavior.

This exceeds paper compliance when attack methods change quickly. The headline is not that an AI model has become a criminal actor. A controlled assessment found one system capable of completing a realistic sequence of offensive tasks.

The gap between early access and full compromise may be narrowing, making patching, identity protection and segmentation urgent. Related AI-driven government system breaches show why coordinated automation needs preparation.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Claude Mythos AI Autonomously Executes Full Cyber Kill Chain Without Human Guidance appeared first on Cyber Security News.

A new intrusion campaign shows how quickly a Windows domain can be turned into a launchpad for deeper compromise. The operators used a Sliver command-and-control beacon, account creation, credential theft and remote administration to establish control after gaining an initial foothold.

The activity was staged from an exposed server and aimed at one unnamed US organisation. Its scripts were built for a real Active Directory environment, including a planned rollout across 18 hosts, while the recovered material contained no proof that ransomware was deployed in this specific incident.

Analysts at The Hunter’s Ledger identified the operation as a high-risk post-exploitation toolkit and tracked it as UTA-2026-024.

The research ties the infrastructure to a confirmed ransomware incident, but does not name the people behind this intrusion or conclude that they deployed an encryptor.

The Hunter’s Ledger said in a report shared with Cyber Security News (CSN) that the operators combined ordinary public tools with unusually detailed knowledge of the victim’s network.

The result was a durable access package designed to disable safeguards, steal credentials and keep its control channels available.

Hackers Disable Endpoint Protection

After entering the domain, the operators scripted the creation of an Active Directory account with a non-expiring password and added it directly to Domain Admins.

They also created a local administrator, enabled Remote Desktop Protocol access, and turned off Network Level Authentication, expanding the paths available for later movement.

The scripts stopped and disabled eight services associated with the victim’s endpoint protection product, then checked each service state.

They also collected the SAM, SYSTEM and SECURITY registry hives for offline password cracking, while a separate LSASS memory dump and Mimikatz supplied additional routes to credentials.

A central concern is the campaign’s persistence. Scheduled tasks ran as SYSTEM, used forged author details and included backdated registration dates.

One weekly task downloaded the latest attack chain without saving a fixed payload, a tactic similar to remote scheduled task delivery in EtherRAT attacks.

The team also manipulated the victim’s DNS content filter through its administrative interface. It added the attackers’ domain to an allowlist and placed a matching record in internal DNS, making the domain resolve internally and pass the same security control intended to block it.

This approach mirrors a broader pattern in Windows intrusions, where trusted administrative features become the delivery system after access is obtained.

Recent reporting on fake installer campaigns disabling Defender also showed attackers using installer workflows and scheduled tasks to weaken controls before maintaining access. In both cases, the danger is not a single tool but the sequence of actions surrounding it.

Blockchain C2 Complicates Response

Alongside Sliver, the toolkit used a Node.js implant that obtained its command server from an Ethereum smart contract.

The first domain recorded in that contract was the same one inserted into the victim’s DNS configuration, directly connecting the two seemingly different parts of the operation.

The contract changed domains five times over five months, making simple domain blocks short-lived. Yet the contract itself stayed unchanged and publicly readable, giving defenders a better tracking point.

The related beacon also contacted its main server every 60 seconds with no measured timing variation, a useful signal for network hunting.

The recommended response is to reset credentials across the affected domain, not solely for known accounts; review privileged-group additions and SYSTEM tasks; restore the DNS allowlist; rotate the filter administrator password; and remove planted internal DNS entries.

Teams should also look for RDP enabled with Network Level Authentication disabled and monitor the contract for later C2 changes. Security teams should favor behavior over broad signatures for public tools.

Baseline scheduled tasks, alert on fileless download commands running as SYSTEM and review sudden endpoint-protection service changes.

Readers examining related Windows tradecraft can compare Sliver implant activity targeting Germany and ransomware SYSTEM task abuse, which show how familiar components can be chained into an enterprise-wide incident. The pattern deserves sustained, careful attention.

Indicators of compromise (IoCs):-

Type	Indicator	Description
IPv4 address	193.233.202.17	Primary Sliver command-and-control and staging-server address
IPv4 address	77.110.126.46	Hardcoded third-tier fallback address, designated hunt-only
IPv4 address	146.103.127.44	Historical operator-used address from April 2026, designated monitor-only
Domain	publisherresolution.com	First C2 domain written to the Ethereum resolver contract
Domain	resumeacceptable.com	Historical Ethereum resolver C2 domain
Domain	simultaneouslypower.com	Historical Ethereum resolver C2 domain
Domain	wiselystarting.com	Historical Ethereum resolver C2 domain
Domain	itemrange.com	Most recently recorded Ethereum resolver C2 domain
URL	https://publisherresolution.com	Ethereum resolver contract value
URL	https://resumeacceptable.com	Ethereum resolver contract value
URL	https://simultaneouslypower.com	Ethereum resolver contract value
URL	https://wiselystarting.com	Ethereum resolver contract value
URL	https://itemrange.com	Ethereum resolver contract value
URL	http://193.233.202.17:42718/task_39.ps1	Fileless PowerShell download location used by the persistence task
File name	svcload.exe	Modified PrintSpoofer derivative
File name	ws35.exe	Reverse-shell sample containing the fallback address
File name	ws36.exe	Reverse-shell sample containing the fallback address
File name	ws37.exe	Reverse-shell sample containing the fallback address
File name	ws_3srv.exe	Reverse-shell sample containing the fallback address
File name	task_39.ps1	PowerShell payload retrieved by the scheduled task
File name	slv_beacon_sc.bin	Sliver beacon shellcode payload
Smart contract	0xb3f2897f2bc797e5b9033faef8c81e92b01cb831	Ethereum contract used to resolve the Node.js implant’s C2 location
MSI UpgradeCode	{B3D67F25-0E3A-4B6B-965C-2C7610958983}	Stable installer identifier observed in the MSI package
User-Agent	Chrome/108.0.6602.492	Hardcoded malformed User-Agent associated with the campaign’s request profile

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Hackers Disable Endpoint Protection and Deploy Sliver Across Compromised Windows Domain appeared first on Cyber Security News.

Panzer ransomware has entered Italy amid a sharp rise in attacks. The ransomware-as-a-service, or RaaS, operation surfaced on August 5 and listed a kitchen manufacturer in Treviso and a telecommunications engineering firm in Catanzaro among its alleged victims.

The group advertises tools for Windows, Linux, FreeBSD, and VMware ESXi systems. An attack on a virtualization host can disrupt many business applications at once, turning one compromised server into a wider outage.

Panzer posted victims across 11 countries and the campaign arrived as claimed ransomware incidents in Italy reached 212 by September 6, above the 169 recorded during all of 2025.

Researcher Andrea Fortuna said in a report shared with Cyber Security News (CSN) that the Panzer’s victim posts should still be treated carefully.

Doimo Cucine and NTE Italia had not publicly confirmed the incidents when the report was published, but their listing may be a credibility-building tactic.

Panzer Ransomware Targets Italian Manufacturers

Panzer stands out less for a publicly examined encryptor than for the business system surrounding it. Prospective affiliates reportedly apply through Tox, face screening, and receive access to a dashboard for builds, negotiations, payment invoices, leak posts, and team accounts.

The stated split gives affiliates 80 percent of each payment and the platform 20 percent. Operators also claim to monitor new affiliates for signs of researcher or law-enforcement access, showing a controlled recruitment process.

Its ESXi option is particularly serious for manufacturers and telecom providers that run core workloads as virtual machines.

An intruder who reaches a hypervisor could encrypt multiple virtual disks and halt dependent services, rather than affecting a single employee device.

Reporting on VMware vCenter attack techniques illustrates how control of virtualization infrastructure can become a direct path to ransomware deployment.

Panzer also appears to pair encryption with data theft. The group claimed 30 GB of stolen data from Doimo Cucine and 16 GB of sensitive documents from NTE Italia.

Backups may restore systems, but they do not remove the pressure created by a threatened data leak or potential reporting duties. Researchers have not independently confirmed Panzer’s first access method or publicly analysed payload.

Available assessments instead associate the operation, with limited confidence, with password attacks, credential theft, remote-service movement, local data collection, security-tool tampering, and data transfers over alternative protocols.

Possible entry routes include vulnerable internet-facing VPN or gateway devices, exposed Remote Desktop Protocol services, phishing messages with malicious documents, and abused remote-management software.

The focus on exposed access points echoes reporting on RDP and VPN attack routes, where stolen credentials and unpatched perimeter systems open a route into internal networks.

Defending virtualized operations

Italian organizations should begin with remote access. Require phishing-resistant multi-factor authentication for VPN, remote administration, and privileged accounts; remove unnecessary privileges; and rotate credentials immediately when compromise is suspected.

Internet-facing appliances and remote-management tools also need prompt patching and regular exposure reviews.

Segmentation is equally important. Keep domain controllers, backup repositories, vCenter, and ESXi management interfaces away from everyday user networks.

Restrict administrative protocols to monitored management segments, so a compromised workstation cannot easily reach the systems that control an entire virtual estate.

Teams should watch for warning signs before encryption begins: unusual VPN logins, new administrator accounts, unexpected PsExec or WMI activity, unapproved remote-management tools, large archives in user or ProgramData folders, and unfamiliar cloud-transfer utilities.

A new ESXi ransomware campaign underscores why telemetry from hypervisors deserves the same attention as endpoint alerts.

Two commands deserve urgent attention when they appear unexpectedly on a server: vssadmin delete shadows and bcdedit recoveryenabled no.

They can remove recovery options, and responders should isolate the affected host, preserve evidence, and begin incident-response procedures rather than waiting for encryption.

Finally, maintain offline or immutable backups for every platform, including virtual machines, and test restorations routinely.

Monitor large outbound transfers, prepare legal and communications plans for double extortion, and ensure that recovery testing covers the applications and dependencies that keep production and telecom services operating.

Indicators of compromise (IoCs):-

Type	Indicator	Description
Leak site (.onion)	pnzruro7syvwvefx5mpo2fhzi4jftgquynsqf3vy5x3no57yp2iz4nyd.onion	Panzer leak-site address
Tox ID (affiliate recruitment)	8C3D96497A9438794F705C055FC2FD3059F6CF11FF51060EE55ED7F0679CFC7218825BD56CB1	Publicly listed affiliate-recruitment contact

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Panzer Ransomware Targets Italian Manufacturers and Telecom Firms With ESXi-Ready RaaS appeared first on Cyber Security News.

BigBear 2.0 is a phishing operation designed to steal proof that a user has already passed multi-factor authentication.

It targets Microsoft 365 accounts through convincing sign-in links, then takes over the logged-in browser session rather than attempting to break the authentication factor.

The operation is a rebranded Evilginx2 phishing framework that targets Microsoft 365 accounts. Victims are drawn in through email links that open a proxy page resembling a Microsoft sign-in page.

It relays their traffic to the genuine service while quietly collecting credentials and the session data returned after sign-in.

CloudSEK analysts identified BigBear 2.0 in June 2026 after gaining access to its administrative panel. The researchers linked the activity to an operator using the alias General Boss and found a network of 42 virtual private server nodes.

CloudSEK said in a report shared with Cyber Security News (CSN) that the panel held 5,137 stolen records tied to 461 organizations and 3,331 unique victim IP addresses across more than 40 countries.

Of those records, 474 represented complete authenticated sessions, alongside 1,032 passwords and 4,148 session cookies. The records illustrate an operation that collects both immediate account access and material that may support persistent access later.

BigBear 2.0 Evilginx2 Phishing Campaign Bypasses Microsoft 365 MFA

BigBear 2.0 uses an adversary-in-the-middle setup, meaning it sits between the victim and the real Microsoft login service.

It captures the email address and password, lets Microsoft validate the request, and waits for the victim to complete their normal approval or code challenge.

When sign-in succeeds, Microsoft sends an authenticated session cookie to the browser. Because the proxy handled the exchange, it can copy that cookie before forwarding the response.

The attacker can replay it in another browser and enter email, Teams, SharePoint, OneDrive, and connected single sign-on applications as the victim. Microsoft 365 session hijacking campaigns have reported the same account-takeover risk.

This is not a weakness in a one-time password, SMS code, or push notification by itself. These methods confirm the user during the live session, but the proxy steals the resulting proof. BigBear used country-matched residential proxies and scripts that pushed users away from security-key authentication.

The campaign particularly affected IT services and managed service providers, a concern because one compromised provider can offer attackers a route into customer environments.

At least five affiliates were linked to the panel. Phishing kits targeting organizations show this service-based model is spreading.

Containing identity compromise

Organizations should treat a suspected stolen cookie as an identity incident, not merely a password problem. Reset affected passwords, revoke active sessions and refresh tokens, and force a new sign-in for impacted accounts.

Teams should examine mailbox forwarding rules, OAuth consent grants, unfamiliar application access, and sign-in activity for evidence that a hijacked session was used after authentication. This review should begin as soon as suspicious activity is reported.

The most useful long-term control is phishing-resistant authentication, especially FIDO2 or WebAuthn security keys and passkeys where properly deployed.

These methods bind a login cryptographically to the genuine site, making a lookalike proxy far less useful. Passkey attack techniques nevertheless deserve ongoing attention.

Administrators should require compliant devices through Conditional Access, shorten session lifetimes where appropriate, and watch for unusual residential IP ranges or new browser sessions.

Email filtering should inspect links that imitate sign-in pages even when they use valid certificates. Teams can monitor for the distinctive headers and cookies listed below, because infrastructure can be reassigned.

For users, a familiar Microsoft page and successful MFA prompt do not always prove that a browser is connected directly to Microsoft.

Verify unexpected sign-in requests through a trusted bookmark or known application, not an email link. This concern is reinforced by Evilginx session-cookie attacks, which also depend on real-time relaying rather than stolen passwords alone.

The campaign combined cookie theft, geographic proxy matching, and affiliate access. MFA must be paired with phishing-resistant methods, session controls, and rapid token revocation.

Indicators of compromise (IoCs):-

Type	Indicator	Description
IP address	38[.]60[.]250[.]157	BigBear 2.0 VPS node
IP address	95[.]179[.]233[.]79	BigBear 2.0 VPS node
IP address	80[.]240[.]27[.]55	BigBear 2.0 VPS node
IP address	65[.]20[.]103[.]58	BigBear 2.0 VPS node
IP address	38[.]54[.]124[.]88	BigBear 2.0 VPS node
IP address	208[.]85[.]20[.]79	BigBear 2.0 VPS node
IP address	95[.]179[.]169[.]154	BigBear 2.0 VPS node
IP address	107[.]191[.]46[.]14	BigBear 2.0 VPS node
IP address	130[.]94[.]82[.]180	BigBear 2.0 VPS node
IP address	38[.]54[.]124[.]58	BigBear 2.0 VPS node
IP address	208[.]85[.]18[.]18	BigBear 2.0 VPS node
IP address	45[.]32[.]147[.]239	BigBear 2.0 VPS node
IP address	208[.]76[.]222[.]214	BigBear 2.0 VPS node
IP address	130[.]94[.]82[.]230	BigBear 2.0 VPS node
IP address	65[.]20[.]102[.]80	BigBear 2.0 VPS node
IP address	70[.]34[.]208[.]46	Historical BigBear 2.0 VPS node
IP address	130[.]94[.]113[.]184	Historical BigBear 2.0 VPS node
IP address	78[.]141[.]193[.]59	Historical BigBear 2.0 VPS node
IP address	64[.]176[.]72[.]180	Historical BigBear 2.0 VPS node
IP address	136[.]244[.]114[.]85	Historical BigBear 2.0 VPS node
IP address	70[.]34[.]244[.]122	Historical BigBear 2.0 VPS node
IP address	199[.]247[.]10[.]14	Historical BigBear 2.0 VPS node
IP address	152[.]39[.]137[.]60	Historical BigBear 2.0 VPS node
IP address	91[.]245[.]235[.]208	Historical BigBear 2.0 VPS node
IP address	45[.]32[.]64[.]165	Historical BigBear 2.0 VPS node
Domain	konceptenterprises[.]com	Phishing domain
Domain	ccpipharma[.]com	Phishing domain
Domain	annastudios-paros[.]com	Phishing domain
Domain	dnsforward[.]com	Phishing domain
Domain	hotelmidtownsurat[.]com	Phishing domain
Domain	dataclust[.]com	Phishing domain
Domain	cifutura[.]com	Phishing domain
Domain	hoaivt[.]com	Phishing domain
Domain	dronalms[.]com	Phishing domain
Domain	virextec[.]com	Phishing domain
Domain	offtic[.]com	Phishing domain
Domain	rootreseller[.]com	Phishing domain
Domain	management[.]michaelmarcotte[.]com	Phishing domain
Domain	kgsscans[.]com	Phishing domain
Domain	soil-management[.]com	Phishing domain
Domain	daengrentacar[.]com	Historical phishing domain
Domain	arrmmy[.]com	Historical phishing domain
Domain	captelind[.]com	Historical phishing domain
Domain	planisteradmin[.]com	Historical phishing domain
Domain	hnospascualfadon[.]com	Historical phishing domain
Domain	haliotisbar[.]com	Historical phishing domain
Domain	knowncontractor[.]com	Historical phishing domain
Domain	valtteri[.]net	Historical phishing domain
URL	management[.]daengrentacar[.]com/meetings	Observed live Microsoft 365 phishing page
Filename	cookie.js	File attachment used in the credential-processing workflow
Telegram bot	@comeandget_bot	Primary administrator command-and-control bot, revoked
Telegram bot token	8629902848[:]AAGEFRukqwu9QaMSDNNuVRYF3juTcg4ehO4	Defanged token for revoked primary administrator bot
Telegram bot	@botterxyz_bot	Affiliate credential-exfiltration bot
Telegram bot token	8625043408[:]AAH6G8X0aW0QhoLEB1uJiYQ5-2aLSJzg8VE	Defanged affiliate bot token
Telegram bot	@PackingitonG_bot	Affiliate credential-exfiltration bot
Telegram bot token	8783369414[:]AAGENRhb7By-0-cQFgrnOw1AW4NbOeUutVE	Defanged affiliate bot token
Telegram bot	@donplayer_bot	Affiliate credential-exfiltration bot
Telegram bot token	8807072847[:]AAEYbUaFcbeAgxTZ2Zl8pFbpjRPM9jXvvzE	Defanged affiliate bot token
Telegram bot	@bolywan_bot	Affiliate credential-exfiltration bot
Telegram bot token	8462028468[:]AAEQt7oq0c3nTHzApQtHk3RdZ7ifnkYd1XM	Defanged affiliate bot token
Telegram bot	@rdsxtdytguyg75d_bot	Affiliate credential-exfiltration bot
Telegram bot token	8794520788[:]AAERSVBlWMpzHc21CCP_-9tL_pjqH9-WuFI	Defanged affiliate bot token
HTTP header	x-evg-token	Evilginx-related application header
HTTP header	x-evg-server	Evilginx-related application header
HTTP header	x-evg-session	Evilginx-related application header
Cookie	evginx_session	Evilginx-related session cookie
Cookie	evginx_token	Evilginx-related token cookie
Cookie	evginx_admin	Evilginx-related administrator cookie
Cookie	bigbear_session	BigBear 2.0 session cookie
Cookie	bigbear_token	BigBear 2.0 token cookie

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post BigBear 2.0 Evilginx2 Phishing Campaign Bypasses Microsoft 365 MFA With Session Cookie Theft appeared first on Cyber Security News.

Kimsuky has been observed using an AI agent to produce convincing phishing decoys at scale, then hiding malware inside Windows shortcut files. The latest activity shows how ordinary-looking documents can become the first step in compromise.

The campaign begins with spear-phishing messages carrying ZIP archives. Inside is a malicious LNK shortcut disguised as a document, often with a browser-style icon and false details. When opened, it displays a decoy while silently launching PowerShell to fetch additional code.

The 13 samples examined were collected between August 11 and 19, 2026, and used financial and corporate lures. That wider range raises the risk for corporate staff who routinely receive paperwork and financial notices.

Genians researchers identified the activity as a continuation of the Kimsuky-linked Operation GitPower cluster. 

Genians said in a report shared with Cyber Security News (CSN) that the campaign retains GitHub-based command infrastructure while adding evasion and varied decoy formats.

Kimsuky Hackers Use OpenCode AI Agent

The most notable change is evidence of opencode in the Creator and Producer metadata of several PDF lures.

Four documents carried the same August 16 creation timestamp, while their Author field remained set to “anonymous,” supporting the assessment that they were produced automatically rather than assembled one at a time.

The documents were not uniformly polished. Some contained unreplaced placeholder text for payment dates, grace periods, and financial values, a sign that drafts were pushed into use without careful review.

Other PDFs showed HeadlessChrome and Skia/PDF metadata, suggesting a separate workflow that generated HTML content and rendered it into cleaner-looking PDFs.

That combination gives attackers speed without abandoning familiar social engineering. Analysts found 29 retrieved decoy files but only 11 unique documents by MD5, with duplicated content redistributed under randomized names.

Readers can see the earlier context in Kimsuky local LLM phishing lures, where AI-made files were already used to make shortcut-borne attacks appear routine.

Such artifacts can disappear as operators refine their process, so defenders should not use document quality or metadata alone as the test for whether an attachment is safe.

LNK Loaders Hide GitHub-Based Payloads

Every analyzed LNK file launched PowerShell, concealing an encrypted loader in arguments stretching roughly 5,800 to 9,500 characters.

About 300 leading spaces helped keep the command out of sight in the shortcut properties window, while excess padding inflated file sizes to frustrate simple inspection and some automated checks.

After decoding the hidden content, the loader downloads a decoy and a follow-on script from GitHub Raw Content using a hardcoded personal access token.

It then creates randomly named PowerShell files in AppData or Temp, starts PowerShell through conhost.exe --headless, and registers hidden scheduled tasks that impersonate BitLocker, MATLAB, or .NET components.

One Visa-themed variant also pulled code from Pastebin, giving the operators a second delivery route if GitHub access is blocked. The approach builds on North Korea GitHub C2 attacks, where trusted developer platforms were used to blend malicious traffic into ordinary web activity.

Newer variants check for virtual-machine and analysis tools, look for the username “Bruno,” and delete PowerShell command history when they detect a likely research environment.

They also use error documents in some incomplete builds, but the persistence and payload retrieval stages can still run. Comparable LNK PowerShell loader techniques show why opening a file that merely looks like a PDF is not a reliable safety check.

Organizations should quarantine unsolicited ZIP attachments containing LNK files, especially when their icons and descriptions do not match their real type.

Security teams should correlate LNK launches with long command lines, hidden PowerShell, newly created scripts, scheduled-task registration, GitHub Raw requests carrying unusual tokens, and Pastebin access.

This behavior-first approach is more durable than relying on a single domain blocklist or decoy document review, and aligns with lessons from malicious shortcut file campaigns.

Indicators of compromise (IoCs):-

Type	Indicator	Description
MD5	10780939962b54addc9d31f57d80edfc	Malicious sample hash
MD5	1523a2fcc901965ab4568d9fe829e4af	Malicious sample hash
MD5	500e0bc0d7579fb338912770964076fe	Malicious sample hash
MD5	685bfc6b2c29fbc16cfad908894add55	Malicious sample hash
MD5	7a53089053b1381742856a5cf2b95f8b	Malicious sample hash
MD5	8db2f20b719dcb7029d6296505622093	Malicious sample hash
MD5	900e832c10d851bbdef3fb191a15db0e	Malicious sample hash
MD5	a2015665a3e18bf0ef86e3931245c7e6	Malicious sample hash
MD5	bb88940e915b11f6330b7446f6037f5b	Malicious sample hash
MD5	ce5932b88f879f26006df81f2fa7667e	Malicious sample hash
MD5	d0894d4626aae0f96d6b84ca3bb71a36	Malicious sample hash
MD5	e50f2ae7fb03675a1ef58b1cf9cda6d1	Malicious sample hash
MD5	f648bdd3c2cd902e239149de86d43e8f	Malicious sample hash
GitHub account	github[.]com/sven5500	GitHub account linked to campaign infrastructure
GitHub account	github[.]com/montry111	GitHub account linked to campaign infrastructure
GitHub account	github[.]com/jamjack2026	GitHub account linked to campaign infrastructure
GitHub account	github[.]com/urusa4400	GitHub account linked to campaign infrastructure
GitHub account	github[.]com/jamestony88	GitHub account linked to campaign infrastructure
GitHub account	github[.]com/baras6600P	GitHub account linked to campaign infrastructure
GitHub account	github[.]com/choemiyang	GitHub account linked to campaign infrastructure
GitHub account	github[.]com/jeni534	GitHub account linked to campaign infrastructure
URL	pastebin[.]com/raw/gybpx38s	Pastebin-based second-stage payload delivery URL
Email	baras6600@proton[.]me	Campaign-associated email address
Email	choemiyang@hotmail[.]com	Campaign-associated email address
Email	dustinharrise91@outlook[.]com	Campaign-associated email address
Email	jackal3300@proton[.]me	Campaign-associated email address
Email	jametony8@outlook[.]com	Campaign-associated email address
Email	jamjack2026@proton[.]me	Campaign-associated email address
Email	montry111@proton[.]me	Campaign-associated email address
Email	sven5500@proton[.]me	Campaign-associated email address
Email	taini7700@outlook[.]com	Campaign-associated email address
Email	urusa4400@proton[.]m	Campaign-associated email address, recorded exactly as listed in the source

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Kimsuky Hackers Use OpenCode AI Agent to Mass-Produce Phishing Decoys in LNK Attacks appeared first on Cyber Security News.

South Korean automotive and media organizations have been hit by a quiet Linux intrusion toolkit built for long-term access.

The malware hides inside software that manages web traffic, allowing attackers to watch users, steal information, and change pages delivered through compromised servers.

The operation appears designed for patience rather than disruption. Attackers likely entered through a groupware portal or mail server, used the edge server as a bridge into internal systems.

That pattern echoes the risks described in stealthy Linux server intrusions, where hidden access can remain active without drawing attention.

Analysts at Rapid7 identified the toolkit and assessed its link to DPRK-aligned advanced persistent threats with medium confidence.

Rapid7 said in a report shared with Cyber Security News (CSN) that the activity likely dates to early 2025, although the precise initial entry point and any exploited vulnerability have not been confirmed.

The affected organizations had ports 80, 443 and 25 exposed, with a groupware login service on port 443 and mail services on port 25.

These systems sit at the network edge, making their compromise serious: an intruder can collect credentials, move deeper inside, and potentially target visitors passing through that server.

DPRK-Linked Hackers Deploy Ted Backdoor

The central component, called ted backdoor, is a modified build of HAProxy 2.8.12, software commonly used to direct website traffic.

Instead of acting like a separate malicious program, it is compiled into the legitimate load balancer and uses its built-in features to inspect decrypted web requests while normal traffic continues to flow.

That placement gives the operators unusual control. The implant can capture session cookies and selected request details, run commands, upload or download files, and inject a malicious script into pages served to chosen visitors.

Its hidden command channel uses a request for a picture-like path, while its code also reduces HAProxy connection counters to make activity harder to spot. Researchers found an SSH keylogger as well as altered versions of crond, agetty, atd, sshd and polkitd.

The stager checks the operating system and whether HAProxy or cron is present before replacing the cron service, copying timestamps from a legitimate SSH binary, and removing chosen words from logs.

This reflects the same concern raised by Linux backdoors stealing SSH credentials: trusted system components can become the attacker’s hiding place.

CurlRAT supplies the remote-control layer. It polls attacker infrastructure for tasks, can execute commands, send system details, install added payloads, and open reverse or interactive shells with elevated privileges. A watchdog monitors HAProxy and reports whether the service starts, stops, reloads, or restarts.

Long-Term Espionage Risks and Defenses

Rapid7 said the combination of credential theft, web-session collection, selective page changes, and traffic redirection points to long-term espionage.

The targeting of South Korean media and automotive firms also fits a regional intelligence-gathering pattern. Readers following Kimsuky espionage activity in Korea will recognize why exposed groupware and stolen credentials remain valuable footholds.

The operators used basic XOR encryption and a substitution method to protect configurations and communications. Their command-and-control domains imitate image delivery services, including one that resembles a popular Korean web platform’s static-content naming style.

Rapid7 also noted overlap in timing and delivery concepts with other DPRK activity, but said more evidence is needed for a firmer attribution. Defenders should review edge systems that handle web traffic, encryption, mail, or runtime modules.

They should compare deployed HAProxy and Linux service binaries against known versions, inspect unexpected shared libraries and cron changes, and rotate credentials that may have passed through affected servers. Independent network monitoring matters because logs on a compromised device may have been altered.

Teams should also investigate unusual requests to image-like paths, unexpected outbound connections from load balancers, and web responses that change only for particular visitors.

Regular patching of groupware and mail servers reduces likely entry opportunities. As shown by recent Asia-focused Linux espionage, post-compromise tools can turn a single exposed server into a durable route across an organization.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
SHA-256	5db1b6d52faf60b4f32d6fd0c7c938e4d05d29a14c32ded4a9668357c08b6a91	CurlRAT stager
SHA-256	09739441ed4599bac2f8159028f772f71e4b25c8badfff95574e56d7384f3dbe	CurlRAT stager variant
SHA-256	fea1bc36632c71e5a839803469ef60ac47595d36b2c50934ac109ade6df06e61	CurlRAT stager variant
SHA-256	83f7d565b0465546027052b597af46eae3a199e7a91fcc2ab936341147349130	CurlRAT
SHA-256	7007a78d50a993cb174c685eba96eb442c9507e38fd9d8e5dffc712f613ec110	CurlRAT
SHA-256	6cf1b5e92a9c0756f597a5ddefb38eba32961c52efac7ab2a0aa52c639a8fc53	CurlRAT
SHA-256	ed72f4cd8d467b5c5d95ae6aeca4aaeea14d79565d379c1ca5871a714727be16	CurlRAT
SHA-256	feeea9d0bf6ae7396d28271baa51ae50df5169ce5d32a516865856f91abc50b3	CurlRAT
SHA-256	d53c760c23b4405eb04ad0f20ead375440344b3bdf1fb7854ed12e40d155eabe	Trojanized cronie binary
SHA-256	2f02b09d61d432134e994ad671258f523bbf289ae6091fd4eae192c60bd51b6f	Trojanized agetty binary
SHA-256	8f30b57928934ae67478d0e690c91d046e35a638da098d02922a4a88a0fdb66c	Trojanized atd binary
SHA-256	a1d8af3a6acb731f07f72040eccb3450c1c83d40e29f736c2a63d35388660be4	Trojanized polkitd binary
SHA-256	12810854c8b2c391b23e2e18b013e873d0369b0637aa3cf993136c07188ba3b8	CurlRAT sample
SHA-256	009a1e2d7a582a24e50cf2ffc2a005482c8e38f22bf5ed416053855f8d054e1e	CurlRAT sample
SHA-256	4bb923eb040aa13ca8fd409c31ee4729c60ddff32e350efe1c5a4a9168a065f5	SSH keylogger
SHA-256	94630b96f628c96a6bff7904b40ffc9ad67c86f8a4ff6080c3b524831c93f402	Ted backdoor
SHA-256	72e70936f0dbe459142a1d867617c35f8d0cce5d18c6a49e1090a2a5adc8e558	Modified HAProxy build containing ted backdoor
SHA-256	a8bfab4de81a1acb04aacdf757346946b0f5e30f0c9f402004016d0e425119c7	Ted backdoor sample
Domain	img.monderhouse.space	CurlRAT command-and-control infrastructure
Domain	img.smartnords.site	Command-and-control infrastructure
Domain	img.darklights.store	Backup CurlRAT configuration host
Domain	img.responsive.pstatic.autos	Command-and-control infrastructure masquerading as static content
Domain	img.socialteams.store	Command-and-control infrastructure
Domain	img.worksongo.store	Command-and-control infrastructure

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post DPRK-Linked Hackers Deploy Ted Backdoor and CurlRAT Against South Korean Firms appeared first on Cyber Security News.

A counterfeit Minecraft optimisation mod is installing Myth Stealer, malware that can steal browser passwords, cookies and data. Its malicious file looks useful because features work as advertised, giving players little reason to suspect a hidden threat.

The campaign exploits users seeking performance improvements from unofficial add-ons. Once installed, the fake mod starts a multi-stage infection chain that leads to a remote tool that lets its operator collect data and broadly control a Windows device.

Analyst devmihaylov identified the malware while examining samples obtained from a buyer of the commodity stealer.

devmihaylov said in a report shared with Cyber Security News (CSN) that the files initially received zero detections from VirusTotal, showing how lightly distributed threats can evade reputation-based checks.

Minecraft players remain frequent targets for malware distributors. Coverage of fake Minecraft Fabric mods showed how a harmless-looking game download can become the first step in account theft and compromise. The threat pairs a decoy with a loader designed to blend into a gaming setup.

Fake Minecraft Mod

The Java archive presents itself as a companion to a legitimate optimisation project and includes 12 working modules that change game performance settings.

A hidden thirteenth component waits briefly, gathers system information, then retrieves and starts the next stage in the background. That approach matters because victims may see the expected optimisation behavior and conclude the download is safe.

The loader uses a large executable built around a standard runtime and brings a private Java environment, letting the payload run even where Java is not otherwise installed.

Before launching the final stage, the program displays a polished administrator-rights request resembling a normal Windows prompt.

Accepting it can give the malware greater access and helps its installation. It also contains retry logic intended to cope with security software interrupting the process.

The final component is heavily disguised to slow investigation. Its code uses reserved Windows-style names, encrypted text and obstacles that can break basic extraction tools.

This concealment, combined with an apparently genuine mod, makes a quick visual check of a download an unreliable safeguard.

Credential theft and remote control

Myth Stealer targets data stored by Chromium-based browsers and Firefox, including saved usernames, passwords, browsing records and active session cookies.

Stolen cookies can be especially damaging because they may let an attacker reuse an already authenticated web session. Readers can see why browser passwords and cookies remain valuable targets in similar data-theft operations.

The malware also collects system details, chat content, clipboard data and files, can capture screenshots or webcam material.

Its remote-control features include running commands, downloading or deleting files, managing processes and setting itself to start again after a reboot.

Researchers also found functions that could disrupt a victim. These include changing display settings, interfering with the mouse or keyboard, showing misleading full-screen messages and attempting to restrict access to security tools.

They can complicate recovery and pressure users to follow an attacker’s instructions. The operation used web-based reporting channels to receive stolen information, a technique documented in coverage of Discord webhook abuse across other malware campaigns.

Although the analysed command infrastructure was no longer responding when reported, inactive servers do not erase the risk to systems already infected.

Players should obtain mods only from trusted project pages, confirm the developer and file integrity, and avoid downloads promoted through chat links, videos or unofficial file-sharing pages.

This echoes guidance from reporting on trojanized Minecraft mod downloads, where social engineering is central to reaching players.

Anyone who installed a suspicious mod should remove it, run a full security scan and change passwords from a clean device.

They should also sign out of important accounts to invalidate sessions, review browser extensions and look for unfamiliar programs that start automatically. An unexpected administrator prompt during mod installation is a serious warning sign.

Indicators of compromise (IoCs):-

Type	Indicator	Description
SHA-256	2003869ed68eaa053f63bf6a5093050f52d520da877c017a4f62658000bba2a3	MythStealer.jar stage-one dropper
SHA-256	38789d9ac5f8cad13f510bc9d0e47809777bef913f329a9f526a11d33aeca09d	DiscordNitroGenerator.exe stage-two container
SHA-256	bd4eb81a12526daa040ceccc14135006dfd9792e7c21ec5fab9c2cb0400f6718	client.jar, Myth Stealer 3.2-FIX payload
File name	MythStealer.jar	Counterfeit Minecraft mod and stage-one dropper
File name	DiscordNitroGenerator.exe	Stage-two Node.js-based container
File path	%APPDATA%\Microsoft\Windows\javaw.exe	Dropped stage-two executable
File path	%TEMP%\webcam-<timestamp>.jpg	Webcam-capture output
File name	sqlitejdbc.dll	Native library loaded from the temporary directory
File name	jnidispatch.dll	Native library loaded from the temporary directory
URL	hxxp[://]ip-api[.]com/json/?fields=query,countryCode	Host geolocation lookup
URL	hxxps[://]www[.]dropbox[.]com/scl/fi/tvvsyk7x5kkbdfyuw7zh7/DiscordNitroGenerator	Second-stage download location
IP address	146[.]19[.]191[.]11	Command-and-control infrastructure
URL path	hxxp[://]146[.]19[.]191[.]11/s	Command server-list endpoint
URL path	hxxp[://]146[.]19[.]191[.]11/t	Telemetry endpoint
URL path	hxxp[://]146[.]19[.]191[.]11/l	Upload endpoint
URL	hxxp[://]146[.]19[.]191[.]11/api/injection	Discord injection-script endpoint
Domain	ays[.]gamepazarin[.]com	Backup command-and-control domain
URL	hxxps[://]canary[.]discord[.]com/api/webhooks/1545915606111625276/LwbwHWZBbQTP	Stage-one reporting webhook
URL	hxxps[://]discord[.]com/api/webhooks/1476291391826034944/xXOpsSG_GM0Hvf74rKbqw	Embedded exfiltration webhook
URL	hxxps[://]discord[.]com/api/webhooks/1476291402403942472/Let5i1nhtIG1cScI3vJmp	Embedded exfiltration webhook
URL	hxxps[://]discord[.]com/api/webhooks/1476291404757078189/NI-dMuvT_02i7Ee-HgX3v	Embedded exfiltration webhook
URL	hxxps[://]discord[.]com/api/webhooks/1476291406283935865/GIRbMQaDzYFV1qH95IxAo	Embedded exfiltration webhook
URL	hxxps[://]discord[.]com/api/webhooks/1476291406795509872/Qxjec0dl9zszu2giJYC3R	Embedded exfiltration webhook
Registry value	HKCU\...\Policies\System\DisableTaskMgr	Disables Windows Task Manager
Registry path	HKCU\Control Panel\Cursors	Used for cursor replacement
Registry path	HKCU\Software\Microsoft\ColorFiltering	Used for screen-colour inversion
Product identifier	mythkg-exe 2.21	Launcher product name and version
Build identifier	myth-gee9ute7hb	Build identifier embedded in payload
C2 keys	rawr, owo, uwu	Obfuscated server-list configuration keys

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Fake Minecraft Mod Deploys Myth Stealer RAT to Steal Browser Credentials and Cookies appeared first on Cyber Security News.

PEEP, a malicious Chrome extension posing as Smart Bookmarks, can steal active login sessions and turn an already compromised Windows computer into a remote backdoor.

The finding shows how a browser add-on can become far more dangerous than a simple data thief when it gains a path to the operating system.

The toolkit does not appear to provide its own way into a device. Instead, attackers need prior code execution or administrative access, then silently place it in Chrome or Edge profiles.

Its installers can alter browser settings so the extension launches without the usual store checks, approval prompts, or visible warnings.

Analysts at SOCRadar identified the operation as PEEP, a Chromium-based post-compromise toolkit derived from the open-source RedExt project.

SOCRadar said in a report shared with Cyber Security News (CSN) that the researchers found a primary build disguised as Smart Bookmarks, version 1.3.0, along with a related testing variant and an exposed development repository.

The scale of confirmed victim impact remains unclear. A server status snapshot recorded 34 agent entries, 10 active sessions, and 507 data records, but test identifiers mean those figures cannot prove the number of infected devices.

Still, the design creates a serious risk because stolen session cookies may let an intruder enter accounts without needing a password again.

Malicious Chrome Extension

Once active, PEEP runs inside the browser and asks for broad access to tabs, cookies, history, bookmarks, downloads, browser settings, scripting, and every website.

It gathers browsing history, open-tab details, session cookies, form data, clipboard contents, screenshots, and local or session storage, creating a broad view of a victim’s online activity.

The session-theft capability is especially concerning because a valid cookie proves that a user has already signed in.

As explained in this guide to stolen browser cookie risks, an attacker who obtains that token may be able to reuse an active session and sidestep a later password or MFA prompt until the session is revoked.

PEEP also accepts commands to open pages, inject JavaScript, change proxy settings, and capture page content. It contacts its command server at regular intervals using unencrypted HTTP, allowing the operator to send tasks and receive collected data.

That behavior resembles other malicious browser add-on campaigns that abuse extensions to monitor sensitive activity.

The native-messaging bridge is what changes the threat from browser monitoring into host control. The browser extension can call a companion Windows program, enabling shell commands, file operations, and discovery of running processes and services under the current user account.

Persistence Raises Cleanup Challenge

PEEP uses several methods to remain in place after installation. Its scripts can forge Chrome Secure Preferences integrity values, use enterprise force-install policies, or sideload the extension.

It can also exploit a ScriptCache fallback, leaving apparently harmless source files while Chrome reloads a previously compiled malicious service worker.

That layered approach means removing the visible extension alone may not be enough. Security teams should identify the listed extension IDs, remove the associated native-messaging host and local artifacts, and review browser policies and registry entries.

The finding follows earlier cases in which a native messaging host backdoor turned Chrome into a route for device-level control.

Organizations should block the identified infrastructure, restrict traffic to the exposed services, and investigate browser processes or PowerShell activity that modifies Secure Preferences files.

Strict extension allow-lists, disabled developer mode, restrictions on external sideloading, and approval of only trusted native-messaging hosts can reduce the chance of a similar installation succeeding.

Defenders should also treat a suspected PEEP infection as both an endpoint and identity incident. Remove the malware, end active sessions, rotate affected credentials, and examine account activity for misuse.

Phishing-resistant MFA and browser protections for stored credentials add useful friction, while the recent Chrome extension supply chain attacks show why every installed add-on deserves careful ongoing review.

Indicators of compromise (IoCs):-

Type	Indicator	Description
C2 host	206.237.30.232	Hardcoded command-and-control, payload distribution, and staging host
Domain	xfjcc.fun	Reported C2 domain
Domain	new.xfjcc.fun	Reported C2-related subdomain
Domain	newadmin.xfjcc.fun	Reported C2-related subdomain
Domain	newapi.xfjcc.fun	Reported C2-related subdomain
C2 service	tcp/5001	C2 control panel and agent API service
Staging service	tcp/5002	Exposed development and payload-staging repository
C2 endpoint	/api/register	Agent registration endpoint
C2 endpoint	/api/commands?agent_id=<id>	Command polling endpoint
C2 endpoint	/api/exfil	Data-exfiltration endpoint
C2 endpoint	/api/agents/<id>/heartbeat	Agent heartbeat endpoint
C2 endpoint	/api/agents/<id>/task_result	Task-result endpoint
C2 endpoint	/api/agents/<id>/data	Observed candidate alternate data channel
C2 endpoint	/api/extension_update/<id>	Extension update endpoint
C2 endpoint	/api/extension_crx/<id>	Extension delivery endpoint
C2 endpoint	/health	Unauthenticated server status endpoint
HTTP header	X-PEEP-Agent-Key	Agent identification header
HTTP header	X-PEEP-Agent-Id	Agent identification header
HTTP authentication realm	realm="PEEP"	Control-panel HTTP Basic authentication realm
Extension ID	ejkndncpkdcjcikfhiamcdehdoegilbj	Primary Smart Bookmarks payload
Extension ID	bibjjhidpdmfcbkodddndmoejcloobdh	Alternate smoke-agent variant
Extension ID	hpjgilbbdmfcnaapjbofmmmjjfijbdki	Reported related extension identifier
Extension ID	akhljhifabhkcoboncoiekfpdodjaack	Reported related extension identifier
Extension ID	eljagiodakpnjbaceijefgmidmpmfimg	Reported related extension identifier
Native-messaging host	com.peep.lab	Native host registered for browser-to-host communication
File	nm_host.exe	Windows native-messaging host binary
File	nm_host.js	Native-host script
File	install_silent.ps1	Silent installation script
File	patch_secure_prefs.ps1	Browser preference-forgery script
File	force_enable.ps1	Extension re-registration script
File	patch_secure_prefs_linux.py	Linux preference-forgery script
File	extension.pem	Extension signing private key included in recovered packages
File	CHROME150-LIVE-RESULT.md	Development and testing log
File	background.js	Extension service-worker script
File	content.js	Extension content script
Static key	peep_nm_host_aes256_key_32bytes!	Embedded native-host encryption key
Local path	%LOCALAPPDATA%\PEEP	Local staging and artifact directory
Registry path	HKCU/HKLM\...\NativeMessagingHosts\com.peep.lab	Native-messaging host registration location
File pattern	*.bak_peep_hmac_*	Backup artifact associated with preference modification
File pattern	*.bak_peep_enable_*	Backup artifact associated with extension enabling
Distinctive string	Smart Bookmarks	Malicious extension display name
Distinctive string	PEEP Client	Internal toolkit name
Distinctive string	AI · 法客-P	C2-panel string
Distinctive string	redext-compatible	Framework-related identifier
Agent key	a6dfab5a6e510ece	Reported embedded agent key
Agent key	348e99545a69b184	Reported embedded agent key
SHA-256	86a5fb2f14d175d1c13a7b49b55b968b2a5e96afc944d85a31b3	Reported PEEP-related hash value
SHA-256	6700e30a3224248085d30f2eb727cea28dec288355fca675344	Reported PEEP-related hash value
SHA-256	9402c0198ae5c8bed14cdeaabe7e8b25625debbc62a900cfcdb	Reported PEEP-related hash value
SHA-256	8edd653910f3217c96a603e8ce9e5e409d3b8674476f22e0a3a	Reported PEEP-related hash value
SHA-256	87db7138a80117ddf2989827c1dde09ee73c7a252d511c74ed66	Reported PEEP-related hash value
SHA-256	259d8eddb6caf509d7bffa2b4c0dd7d89668800c870f529729a	Reported PEEP-related hash value
SHA-256	e46aee4ca43ba66666f6572c62365cf57642f2cf1f6eca00fcf8e	Reported PEEP-related hash value
SHA-256	f031c00f592aa5e98893b4532f743362fed7fb0a485e8a3c0ad4	Reported PEEP-related hash value
SHA-256	a43bf7f81507c8f9d0942fed331e7590a43044a6d219ec100597	Reported PEEP-related hash value
SHA-256	b4e3ca8f44477b9ade1272f92516202f83a80219c8bd6176527a	Reported PEEP-related hash value
SHA-256	8e988b915b75dd749e3f4e1ca7ee21746885b4fe34e8a246e6f1	Reported PEEP-related hash value
SHA-256	9c6b269e5087a40b4552f72e9ff13d9b39e433af5075ad68f57e	Reported PEEP-related hash value
SHA-256	207e0d47c4e5493ef7313eb1faeb1c6195923c89f263e548609a	Reported PEEP-related hash value

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Malicious Chrome Extension Can Steal Login Sessions and Turn PCs Into Remote Backdoors appeared first on Cyber Security News.

A financially motivated threat group known as Toy Ghouls has begun using two custom Windows backdoors that communicate through popular messaging and broker services.

The tools give attackers a discreet way to run commands, collect system details, and maintain control over compromised devices.

The campaign marks a change for the group, which had previously relied heavily on public tools and leaked ransomware builders.

Its move to custom malware suggests a broader effort to stay inside victim networks longer while making activity harder for security teams to spot.

Analysts at Securelist identified the malware in early July 2026 and linked it to Toy Ghouls, also tracked as Bearlyfy, Laboo.boo, and Feral Wolf. The group has targeted Russian organizations since 2025 and has previously been associated with its own GenieLocker ransomware.

The new backdoors are called mqtt-bird-agent 0.1.0 and matrix-bird-agent 0.1.0. They are delivered after attackers gain access to an organization, showing how a small initial breach can develop into a persistent and serious compromise.

Kaspersky said in a report shared with Cyber Security News (CSN) that the tools provide full control over an infected Windows device.

Hackers Use Popular Messaging Services

Toy Ghouls uses Windows Remote Management, or WinRM, to place the backdoors and their configuration files on already compromised systems.

The attackers use Evil-WinRM and WinRM-fs, tools that can help move files and run remote commands across Windows environments.

WinRM is widely used for legitimate administration, which can make malicious use difficult to identify without close monitoring.

Organizations have faced similar risks from Windows Remote Management abuse, where attackers use valid access and remote sessions to move deeper into a network. The HiveMQ version uses the public broker.hivemq.com MQTT service as its command-and-control channel.

It reports whether a device is online, sends information such as processor usage and free memory, and retrieves instructions that are then run through a hidden PowerShell process.

Using a broker service allows attackers to blend malicious traffic with normal internet activity. The approach resembles an earlier MQTT command channel used by WailingCrab, demonstrating why familiar cloud and messaging infrastructure can complicate network investigations.

The second version uses an attacker-controlled Element server based on the Matrix protocol. It sends device status messages to a designated room, receives commands from an account called panel-bot, and executes those instructions through the Windows command line.

Both variants can run interactively or install themselves as Windows services, allowing them to start again after a reboot. This persistence method makes the infection more dangerous because an attacker may regain access even after the original remote session has ended.

Persistence and Defensive Response

The malware stores its settings in a config.toml file before protecting sensitive fields with encryption tied to the infected computer.

On the Element variant, the file is deleted after first use and the information is moved into the Windows registry, reducing the number of obvious artifacts left on disk.

Security teams should review WinRM access, limit it to approved management systems, and investigate unusual remote PowerShell activity.

They should also watch for unexpected services named cplsupport or wtas, suspicious configuration files in ProgramData folders, and outbound traffic involving the listed messaging infrastructure.

Administrators should treat remote-management credentials as high-value assets and enforce strong authentication for privileged accounts.

Recent incidents involving the Teams and Quick Assist campaign show how social engineering and trusted Windows tools can be combined to create a path toward wider network access.

The discovery also reinforces the value of checking for quiet backdoor behavior, rather than looking only for known ransomware activity.

A recent Windows backdoor investigation similarly highlighted how attackers can minimize visible network signals while waiting for instructions.

Toy Ghouls’ use of MQTT and Element does not mean the services themselves are malicious. Instead, the case shows how threat actors can misuse legitimate or common technology to hide command traffic, gather system data, and keep control of compromised Windows systems for longer periods.

Indicators of compromise (IoCs):-

Type	Indicator	Description
File name	cplsupport.exe	HiveMQ-based backdoor executable
MD5 hash	BFADBEEE63A4F0BF19EC9DEB8FA58F58	Hash associated with cplsupport.exe
File name	wtass.exe	Element-based backdoor executable
MD5 hash	7916C33688385525078BEE504C90F359	Hash associated with wtass.exe
File name	config.toml	Backdoor configuration file
Registry key	HKLM\Software\synapse\Config\SealedConfig	Stores sealed Element backdoor configuration
Registry key	HKLM\Software\SynapseAgent\metrics_interval	Stores Element variant metrics reporting interval
Service name	cplsupport (Problem Reports Control Panel)	Service used by the HiveMQ variant
Service name	wtas (Windows Telemetry Aggregator Service)	Service used by the Element variant
Domain	broker.hivemq.com	Legitimate MQTT broker abused for command-and-control communications
Domain	ip-api.com	Legitimate service queried to identify the victim system’s public IP address and country
Domain	meet.element[.]tw	Attacker-controlled Element server used for command-and-control

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Hackers Use Popular Messaging Services to Control New Windows Backdoors appeared first on Cyber Security News.

NodeStealer has returned with a more invasive toolkit. The Python-based information stealer can now record keystrokes, watch copied text, and capture victims’ screens, turning an account-stealing infection into continuous surveillance.

The change raises the stakes for people whose browsers hold work, banking, or social-media access. First tracked in 2023, NodeStealer initially focused on sensitive browser data and Facebook accounts.

It later widened its interest to Facebook Ads Manager accounts and payment-card information. The latest activity mainly affected victims in Asia and North America, with financial services the leading sector, but the campaign crossed several industries.

Netskope researchers identified the upgraded variant in August 2026 and said it adds spyware functions alongside the earlier theft features.

Netskope said in a report shared with Cyber Security News (CSN) that the researchers also found signs that some new code may have been produced with AI assistance.

The report does not identify a confirmed initial delivery method, so organizations should avoid assuming a single infection route.

What is clear is the malware’s objective after execution: collect enough credentials, session data, personal details, and screen content to support fraud, impersonation, or follow-on account takeover.

NodeStealer Can Now Record Everything Victims Type

The most worrying addition is a keylogger that uses Python’s pynput library to monitor keyboard input.

It saves captured text in a temporary file, sends it to the primary Telegram command-and-control channel every 120 seconds, and then clears the file’s contents. The logging is designed to continue indefinitely.

That can expose passwords, search terms, customer data, private messages, and other information that users enter manually. Clipboard monitoring fills a similar gap by collecting plain text copied and pasted into the device.

Readers following Snake Keylogger’s capture techniques will recognize how this combination gives criminals visibility beyond saved browser credentials.

NodeStealer also takes a screenshot when it runs and another before its screenshot function finishes, transmitting both images through Telegram.

A screen capture can reveal data that may never reach the clipboard or keyboard, including dashboards, recovery codes, open documents, and active conversations.

The separation of stolen material across two Telegram bots may also make disruption harder. One bot receives an archive of browser credentials, passwords, and cookie databases, while the other receives Facebook-specific data.

This approach resembles other Telegram bot driven malware operations that abuse legitimate messaging infrastructure for attacker communications.

Facebook Data Theft Expands

The newest samples query more than 20 Facebook Graph API endpoints, up from two in previous versions.

Rather than only checking an account, the malware seeks a detailed picture of the person managing it, covering identity details, contacts, interests, posts, pages, advertising assets, business records, integrations, and login-related data. For companies that run advertising campaigns, the impact can extend beyond one employee’s profile.

Access to business and Ads Manager information could help attackers run unauthorized ads, steal budgets, target colleagues, or make convincing social-engineering approaches. The risk mirrors Facebook advertising account theft reported in other malware campaigns.

Analysts noted an apparent AI-assisted element in the new functions: repeated, similarly structured calls marked with decorative emoji labels, a pattern absent from earlier NodeStealer code.

That observation is not proof of a particular tool or author, but it suggests attackers may be accelerating routine feature development.

The malware is also distributed as compiled Python bytecode with altered header fields, apparently intended to obscure its compilation timeline and possibly interfere with automated analysis.

Security teams should ensure that inspection workflows examine Python bytecode even when its metadata looks incomplete or misleading.

Defenders should treat unusual Python-based files, unexpected browser-data access, persistent keystroke collection, and Telegram-bound archives as high-priority signals.

Reduce exposure by limiting administrator access, keeping browsers and endpoint protections updated, reviewing active sessions, and warning staff not to run untrusted attachments or downloads. Recent phishing-delivered VIP Keylogger campaigns show why these basics still matter.

People responsible for Facebook business accounts should use strong multi-factor authentication, review connected apps, and watch for unfamiliar advertising changes.

Since cookies and session data can be valuable to attackers, prompt session revocation and credential resets are important after a suspected infection.

These steps cannot undo stolen screenshots, but they can limit further account abuse and reduce the chance of costly misuse.

Indicators of compromise (IoCs):-

Type	Indicator	Description
File name pattern	keylog({ip}).txt	Temporary keystroke-log filename pattern used by the NodeStealer keylogger, with the victim IP value inserted into the name.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post NodeStealer Can Now Record Everything Victims Type and Steal Their Screenshots appeared first on Cyber Security News.

Attackers are using invisible Unicode characters to make phishing emails appear harmless while disrupting the security systems built to spot suspicious language.

The campaign pushed finance-themed messages at massive scale, showing how a tiny change inside a word can weaken standard filtering. Recipients saw ordinary offers for funding, loans, or credit, but the underlying text was altered.

This is not malware delivered through an attachment. It is a phishing evasion method that changes how malicious text is encoded. The emails were sent in huge weekday bursts from disposable, finance-branded domains and passed through shared marketing infrastructure.

That combination gave criminals both reach and a more credible appearance, raising the risk of fraud, credential theft, and costly business mistakes.

Microsoft said in a report shared with Cyber Security News (CSN) that it identified a high-volume phishing operation abusing invisible Unicode tag characters, a tactic often called ASCII smuggling.

Researchers found the activity while examining protections for hidden prompt-injection content in email. The discovery shows that techniques first discussed around AI systems can quickly be repurposed for routine inbox attacks.

The scale was striking. Microsoft’s detection signature recorded roughly 21,000 hits on February 8, then more than 1.3 million the following day.

Activity later exceeded 2.3 million messages in a day and stayed elevated for about three months. The campaign largely followed a weekday schedule, dropping sharply during weekends before returning on Monday.

Hackers Use Invisible Unicode Characters

The attack works because the inserted characters do not normally appear on screen. A recipient sees a familiar financial term, while a filter looking for the exact text may see separate fragments instead.

This gap between visible content and machine-readable content helps attackers reduce the value of simple keyword rules, signatures, and text-based checks.

In the observed emails, criminals placed an invisible character inside high-interest financial wording rather than hiding a complete secret instruction.

The altered word still looked normal to the target, but its digital form changed enough to confuse some detection pipelines. A previously reported invisible character phishing technique illustrates how attackers have increasingly used hidden text to break up warning signs.

The method may also affect machine-learning filters. Many mail systems divide text into smaller pieces before deciding whether a message is spam or phishing.

When attackers split a familiar word with a hidden character, the system may no longer recognize the usual pattern. However, this unusual text can also become a strong signal for defenders because it is rare in legitimate email.

Microsoft linked this phase to a broader campaign using business-loan and funding lures. The campaign relied on hundreds of rotating domains assembled from a small set of finance-related words.

Its delivery method is a reminder that criminals often blend technical evasion with familiar social-engineering pressure, much like the tactics seen in a recent device code phishing campaign targeting business users.

Detection Must Look Beyond Keywords

The key defensive step is to normalize email text before applying keyword, signature, or regular-expression checks. Security teams should remove or standardize invisible and non-rendering characters in message subjects and bodies.

This ensures that a suspicious word is evaluated in the form a recipient actually sees, rather than in its deliberately fragmented version.

Defenders should also treat unexpected hidden characters as an anomaly worth investigating, while accounting for legitimate uses such as certain regional flag emojis.

A single signal should not decide whether an email is malicious. Sender reputation, authentication results, URL checks, message volume, domain behavior, and visual content analysis can provide a fuller picture.

Organizations should test their email gateways, security analytics, and AI systems to confirm that they process hidden characters consistently.

The same normalizing control can reduce exposure to both phishing evasion and prompt-injection attempts in AI tools that read email content. Recent coverage of a session hijacking phishing kit shows why layered defenses remain essential when email campaigns evolve.

Employees still play an important role. An unsolicited funding offer, loan notice, or credit-line message should be checked carefully before a link is opened or credentials are entered.

Security teams should review abrupt changes in mail volume and new finance-themed sender domains, especially when several signals appear together.

The broader rise in inbox threats was also reflected in Microsoft’s email phishing threats report, underscoring that phishing remains a high-volume and adaptable risk.

Indicators of compromise (IoCs):-

Type	Indicator	Description
Content pattern	U+E0000-U+E007F	Unicode Tags block used to insert invisible characters into phishing text
Content pattern	U+E0020	Unicode TAG SPACE observed spliced inside high-signal financial keywords
Sender domain	guardiangrowthfunding[.]com	Finance-themed sender domain observed on February 9, 2026
Sender domain	digitalcapitalboost[.]com	Finance-themed sender domain observed on February 9, 2026
Sender domain	thebusinessloanexpress[.]com	Finance-themed sender domain observed on February 9, 2026
Sender domain	yourlocfunding[.]com	Finance-themed sender domain observed on February 9, 2026
Sender domain	advancefundingboost[.]com	Finance-themed sender domain observed on February 9, 2026
Sender domain	guardiancapitalway[.]com	Finance-themed sender domain observed on February 9, 2026
Sender domain	harboradvancefunding[.]com	Finance-themed sender domain observed on February 9, 2026
Sender domain	unitedfundingwave[.]com	Finance-themed sender domain observed on February 9, 2026
Sender domain	directcapitalboost[.]com	Finance-themed sender domain observed on February 9, 2026
Sender domain	onlinedirectfinance[.]com	Finance-themed sender domain observed on February 9, 2026
Sender domain	catalystcapitalharbor[.]com	Finance-themed sender domain observed on February 9, 2026
Sender domain	rocketboostfunding[.]com	Finance-themed sender domain observed on February 9, 2026
Sender domain	digitalrushcapital[.]com	Finance-themed sender domain observed on February 9, 2026
Sender domain	guardianloccapital[.]com	Finance-themed sender domain observed on February 9, 2026
Sender domain	guardianlocchoice[.]com	Finance-themed sender domain observed on February 9, 2026
Sender domain	ourbusinessloans[.]com	Finance-themed sender domain observed on February 9, 2026
Sender domain	directcapitalpulse[.]com	Finance-themed sender domain observed on February 9, 2026
Sender domain	catalystboostfunding[.]com	Finance-themed sender domain observed on February 9, 2026
Sender domain	elevatecapitalrush[.]com	Finance-themed sender domain observed on February 9, 2026
Sender domain	fundingexpresscapital[.]com	Finance-themed sender domain observed on February 9, 2026
Sender pattern	em-<digits>.<brand-domain>	Envelope sender pattern associated with the campaign’s mail relay
Infrastructure pattern	acems<N>[.]com	Shared sending-pool domain pattern used in campaign delivery
Infrastructure pattern	emsd<N>[.]com	Shared sending-pool domain pattern used in campaign delivery
Infrastructure domain	activehosted[.]com	Shared click-tracking domain found in campaign messages
Infrastructure domain	acemlnd[.]com	Shared click-tracking domain found in campaign messages
URL pattern	hxxps://<account-id>.acemlnd[.]com/<tracking-token>	Observed click-tracking URL structure
URL pattern	hxxps://<brand-subdomain>.activehosted[.]com/<tracking-token>	Observed click-tracking URL structure
IPv4 range	173.236.20[.]0/24	Shared email-marketing infrastructure range used as a corroboration and scoping signal, not a standalone block indicator

Audit the Mirage2FA attack: a session-hijacking checklist for your M365 security team

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Hackers Use Invisible Unicode Characters to Evade Phishing Detection in Millions of Emails appeared first on Cyber Security News.

Hackers have turned commercial AI models into working parts of a cyberattack operation. The campaign paired AI-directed tasking with familiar methods such as vulnerable public-facing servers, stolen credentials, webshells, and custom remote-access malware.

The operation reached Taiwan’s Kuomintang Party History Archives, Indonesia’s Ministry of Foreign Affairs, and government and education networks in mainland China.

A confirmed breach hit a Fengtai District government environment, exposing administrative and health records, collecting Windows credentials, and deploying implants.

Analysts at Hunt.io identified the activity after examining exposed attacker directories and tracing a shared SOCKS proxy across five connected workspaces.

Hunt.io said in a report shared with Cyber Security News (CSN) that the operators linked infrastructure, reusable accounts, SecFlow files, and GLUTTON payload material.

The findings show a practical shift in how intrusions can be managed. AI did not create the underlying security flaws, but it helped divide work, retain context, and coordinate actions at speed.

It reinforces the need for rapid patching, exposure management, credential protection, and review of unusual web-server activity.

Hackers Turn Claude, Qwen and DeepSeek Into AI Agents

The operators used a framework called SecFlow to turn a broad objective into smaller jobs for specialist AI workers.

Claude, Qwen, and DeepSeek profiles could be selected without changing the task interface, allowing the system to assign reconnaissance, exploit testing, data collection, and reporting across a shared workspace.

SecFlow connected those workers to target details, storage, proxy routes, and tool permissions. The setup included private model relays under niestools.com alongside official provider routes.

It gave later workers earlier results, so one target could quickly develop into coordinated activity. The campaign nevertheless remained grounded in conventional intrusion tradecraft.

Workers used public proof-of-concept code, credential testing, vulnerable applications, webshells, and a custom implant named SecBox.

Readers can compare this operating model with earlier Claude DeepSeek intrusion reporting, which documented commercial models embedded in a separate China-linked campaign.

A claimed Apache Shiro success was not supported by the recovered evidence, yet it was carried into later instructions and triggered more than 27 unsuccessful GLUTTON follow-up tests.

AI coordination can therefore multiply an operator’s speed, but it can also spread an early mistake through the entire workflow.

From Exposed Servers to Data Theft

The Fengtai intrusion began through an Office Automation application that accepted uploaded ASPX files.

Attackers used server-side command pages to run Windows commands, map internal systems, attempt privilege escalation, pull LSASS memory and registry hives, query databases, and move data through ordinary HTTP requests.

They also inserted a privileged application account and staged SecBox, a Go-based remote-access and network-pivot tool. The implant could execute commands, transfer files, scan ports, proxy traffic, and use replacement command-and-control routes.

This blend of webshell access and endpoint tools illustrates why web server attacks need monitoring beyond initial exploit alerts.

Elsewhere, an exposed education AI management service disclosed agent settings, secrets, conversations, and student profile data.

The researchers confirmed use of leaked credentials against a production API and an unauthenticated request to create an agent configuration, but did not confirm a full server takeover. This distinction matters for impact assessment.

A separate fake MySQL service targeted unsafe Java object processing, using an outbound database connection to deliver a Linux second stage.

The group also tested Shellshock, Spring4Shell, Ghostcat, Log4Shell, Grafana, Nexus, Nacos, and Shiro paths. Similar risks are explored in AI agents breach government systems, where parallel agents accelerated reconnaissance and credential attacks.

Organizations should patch internet-facing software promptly, remove exposed directories, restrict administrative interfaces, rotate exposed credentials, and inspect web servers for unexpected ASPX, JSP, PHP, or image-based loaders.

Teams should also watch for outbound connections to the listed infrastructure, review authentication and application logs, and validate automated security findings before acting on them.

Guidance on agents rebuilding failed malware tools further underlines why defenders need behavior-based detection, not only static signatures.

Network segmentation and least-privilege access can further limit the damage if a public application is compromised. Exercises also shorten containment time.

Indicators of compromise (IoCs):-

Type	Indicator	Description
IP address	81.70.240[.]170	Exposed SecFlow workspace, AI execution host, SSH jump host, and egress point
IP address	43.99.61[.]170	Java/CAS exploitation workspace containing GLUTTON tooling and JNDI listener
IP address	152.42.200[.]25	Shellshock and credential-testing workspace with callback listener
IP address	129.211.184[.]149	Payload-distribution, command-and-control, and post-exploitation store
IP address	159.223.64[.]67	Fake MySQL deserialization server, scanner, and callback tooling host
Network endpoint	129.211.184[.]149:64288	Primary SecBox command-and-control endpoint embedded in Windows builds
Network endpoint	129.211.184[.]149:8443	SecBox controller backend and payload-distribution service
Network endpoint	158.247.234[.]124:18000	SecBox dead-drop-resolver TCP and WebSocket redirector
Network endpoint	207.148.109[.]245:18000	Earlier plaintext SecBox dead-drop-resolver redirector
Network endpoint	103.45.65[.]93:35888	Shared authenticated SOCKS5 route
Network endpoint	43.162.217[.]10:35888	Primary authenticated SOCKS5h route configured in SecFlow
IP address	211.159.155[.]240	SecFlow gateway
URL	hxxp://129.211.184[.]149:8443/999b4e8c/public/dnc/a6d28ebe?os=<os>&arch=<arch>	Linux second-stage payload download endpoint
URL	hxxp://158.247.234[.]124:18000/c22.exe	Windows payload download endpoint used to stage fw.exe
URL	tcp://imported-concerns-listening-typing[.]trycloudflare[.]com:443	Short-lived SecBox dead-drop-resolver TCP route
URL	tcp://marriage-step-wave-heavy[.]trycloudflare[.]com:443	Short-lived SecBox dead-drop-resolver TCP route
URL	wss://wins-say-charm-social[.]trycloudflare[.]com/c2	Short-lived SecBox secure WebSocket route
URL	ws://158.247.234[.]124:18000/	SecBox WebSocket redirector route
Domain	.niestools[.]com	Operator-controlled domain family used for model relays, AI gateways, proxy management, documentation, and GLUTTON authorization
Domain	claude.niestools[.]com	Private Claude API relay configured in SecFlow
Domain	deepseek.niestools[.]com	Private DeepSeek-compatible API relay configured in SecFlow
Domain	glutton.niestools[.]com	Hardcoded GLUTTON MCP authorization domain
Domain	proxy.niestools[.]com	Proxy-pool management console
Domain	chatgpt.niestools[.]com	Sub2API AI gateway host
Domain	wiki.niestools[.]com	Observed subdomain in the operator-controlled domain family
Filename	agent_new.out	Windows SecBox-compatible multiprotocol implant
SHA-256	20a8ed7d235cf6419e2d4b1e439595ef96961adaecf3c990c5cd507eb4a74ca4	Hash for agent_new.out
Filename	e6475722.exe / v11.exe	Windows SecBox payload staged as C:\Windows\Temp\v11.exe
SHA-256	0b3d76cf1ac6648d4cfbe39c8fea67c6b28a361ea6de86a92cc7d54a0181cc9e	Hash for e6475722.exe / v11.exe
Filename	av2_chk_cn-44.exe and aliases	Windows implant with deceptive syscfg.exe internal-name metadata
SHA-256	3c9b2ec423f91642d2d09031d47e50d7ebe77a8b12ec5e393405f85da11a0f6a	Hash for av2_chk_cn-44.exe
Filename	bf57c009.bin	Linux SecBox-compatible implant variant
SHA-256	4ecbdaedf9040dbbb33ce7a96ad961dce0f3ffb2c41285606a27a7c5ab3d2273	Hash for bf57c009.bin
Filename	c22.exe / fw.exe / fw_c049574c.exe	Windows implant associated with the c22.exe to fw.exe deployment chain
SHA-256	eef30bb6834bf349d1b1f4401aa0b8e73631ea632a884c6498a5b3a9e069d412	Hash for c22.exe / fw.exe / fw_c049574c.exe
Filename	cmd.aspx	Victim-side HTTP command shell that executes commands through cmd.exe /c
Filename	down.aspx	Arbitrary-file range reader supporting resumable binary exfiltration
SHA-256	dcd59349bd6cc29e59da5105f2f08f606ece8dfac4e369e052eca1786450f541	Hash for down.aspx
Filename	downx.aspx	Arbitrary-file reader applying XOR with key 0xAA
SHA-256	135b33b289d481d60fa2527aeae5882d33adcb6756df89ea7684f4af3567b141	Hash for downx.aspx
Filename	extract.aspx	LSASS-dump scanner for username and NT-hash material
SHA-256	9ef85857ed2b53a23eb41ce5769b4fb5b8b2225404b227a776520771df86706e	Hash for extract.aspx
Filename	sqldump.aspx	Office Automation database reconnaissance and extraction payload
SHA-256	797676d3becc124bb6705ebd76189e8decedae3abf978434d730459133351064	Hash for sqldump.aspx
Filename	sql6.aspx	Base64-encoded arbitrary SQL interface
SHA-256	af6404a125d1e4eb67425ec17f2abeec7242fb6f7377de739e47cb7f5d147eee	Hash for sql6.aspx
Filename	doc_helper.aspx / doc_view_666b2dde.aspx	Duplicate file-management webshells enabling arbitrary file operations
SHA-256	053c8dfb147262aaedf0d9cdce631ad73cfd5b1a808114c12bbe5adfe4796302	Hash for doc_helper.aspx and doc_view_666b2dde.aspx
Filename	dl_e6.aspx	Loader that copies e6475722.exe to C:\Windows\Temp\v11.exe and attempts execution
SHA-256	80d778c9d9e44896f08b1a196254527e39da4e8ce5edebf8d296b7dec6b7b3e0	Hash for dl_e6.aspx
Filename	dl_v11.aspx	Downloader that copies e6475722.exe to C:\Windows\Temp\v11.exe
SHA-256	f7c233df3423912296a4e78dd1fa7a1f6412606177336be0762961c93e8fae3c	Hash for dl_v11.aspx
Filename	dl_icn.aspx	Downloader that retrieves c22.exe and writes it as C:\Windows\Temp\fw.exe
SHA-256	548df87041ea2cbe99fc519fd89c5b7cdfe935d87a803a80a5f747aa9f076091	Hash for dl_icn.aspx
Filename	launchfw.aspx	Loader that downloads c22.exe as fw.exe and executes it through Process.Start and WMI
SHA-256	79cc5855375b5c840bae8263dc3dc5a9fd9cbd7920ab4ed65d407fd830d3eda1	Hash for launchfw.aspx
Filename	potato4.aspx	EFSRPC named-pipe token-impersonation and privilege-escalation payload
SHA-256	a407f540f4eb0c8fae5cd83fa6e210df6c4ed7fca6aedb6ebc5efbf031989ac4	Hash for potato4.aspx
Filename	cb1_glutton.bin	Primary Tomcat or Undertow GLUTTON injector
SHA-256	00759d29178baabcbe9682a953c64e179fd24d86dac0d6abdc8e5070216923f2	Hash for cb1_glutton.bin
Filename	cb1_glutton_wl.bin	WebLogic or CAS ticket-interception GLUTTON variant
SHA-256	f51ab15a89155ce4d3bcd0a65cf6a3ccf62115f502e0863c19baf93d11c57acc	Hash for cb1_glutton_wl.bin
Filename	cb1_redis_glutton.bin	Redis-assisted GLUTTON payload writer
SHA-256	853222ffdcc74dd606f6ff79ff353ce3626d50e54e9aa1a87fb03e2121e82aaf	Hash for cb1_redis_glutton.bin
Filename	MethodInvoker.class	Tomcat or Undertow in-memory filter component
SHA-256	218d8508c2035c78b49d33e087e33643f4f906af5694be68cf939f17fa4b5ffd	Hash for MethodInvoker.class
Filename	confusion_d0c41072a0dc784c.jsp	Obfuscated JSP loader for PNG-carried in-memory payloads
SHA-256	2deac4ab60f6cb1bb65fa4df5dbd9dcf7b7bc27e16bea55c3ddbe47154720277	Hash for confusion_d0c41072a0dc784c.jsp
Filename	confusion_d0c41072a0dc784c_nodejs.html	Obfuscated Node.js loader for PNG-carried in-memory payloads
SHA-256	e6ee24c6775867714d1e4b586d75c0168e61ba49b36e0a29b73cbc925df6ae47	Hash for confusion_d0c41072a0dc784c_nodejs.html
Filename	CommonsBeanutils1.bin	Java deserialization payload used to download a second-stage implant
SHA-256	1c00ce5354c91a9db878e2b4db750c2a74140e0d15aeac9b8cecf4599598b736	Hash for CommonsBeanutils1.bin
Filename	CommonsCollections6.bin	Java deserialization callback and second-stage downloader payload
SHA-256	27fae1b7be68b0c27c5dad33aaed9de5b38406fb20b971757b6be386e3ffc7a6	Hash for CommonsCollections6.bin
Filename	Spring1.bin	Spring gadget-chain downloader delivered through the fake MySQL workflow
SHA-256	77f5b5321e2f5c18b3c610e50084b98201fb6214e13665cc49da5afbf3f49611	Hash for Spring1.bin
Filename	fakeserver_new.py	Fake MySQL-compatible service used for deserialization-based initial access
Filename	xor_bd.py	XOR-encoded webshell client used against an Indonesian Foreign Ministry URI
Filename	deploy_all.sh	Script used to deploy PHP webshells masquerading as WordPress files
File path	wp-content/plugins/class-wp-settings.php	PHP webshell masquerading as a WordPress plugin file
File path	wp-content/cache/cache-main.php	PHP webshell masquerading as a WordPress cache file
File path	wp-content/uploads/maintenance-check.php	PHP webshell masquerading as a WordPress maintenance file
File path	wp-includes/class-wp-l10n.php	PHP webshell masquerading as a WordPress core file
XOR key	d0c41072a0dc784c	Recovered repeating key used by GLUTTON PNG-carried webshell loaders
Byte sequence	FF 88 00	Payload-end marker searched by GLUTTON PNG-carried loaders

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Hackers Turn Claude, Qwen and DeepSeek Into AI Agents for Real-World Cyberattacks appeared first on Cyber Security News.

Microsoft 365 users are facing a phishing technique built on a small change: attackers leave the SMTP envelope sender blank.

The omission can let an unauthenticated message pass a Direct Send safeguard while showing employees an address that appears to belong to their own organization.

The approach is not a Microsoft software flaw and does not need a stolen account. It exploits how Exchange Online’s RejectDirectSend control checks the domain in the envelope sender, rather than the address displayed in the visible From field.

That difference offers criminals a simple route to impersonation. It removes a barrier designed to stop an especially risky form of spoofed mail.

Researchers at ReliaQuest identified the pattern in active phishing cases and reproduced it in a controlled Microsoft 365 tenant.

Reliaquest said in a report shared with Cyber Security News (CSN), the company said the technique had appeared repeatedly across unrelated organizations during the past year. A convincing internal-looking email can carry a document notice, payment request, or voicemail lure.

Even if mail filters detect some attempts, any message that reaches a recipient creates an opening for credential theft, malware delivery, fraudulent transfers, and wider account compromise.

Microsoft 365 Phishing Technique Uses Empty Envelope Sender

Direct Send allows devices and applications to send mail within the same Microsoft 365 tenant without authentication. Earlier coverage of Microsoft 365 Direct Send documented attackers imitating internal users without compromising an account.

RejectDirectSend is meant to reject unauthenticated Direct Send mail claiming to come from an organization’s accepted domain. ReliaQuest sent two messages to a tenant’s mail host.

The message using the tenant domain in its envelope sender was rejected, but one using the SMTP command MAIL FROM:<> was accepted and queued.

The recipient still saw the same internal IT support address in the visible From field. Since the empty sender holds no domain, RejectDirectSend has nothing to compare with the tenant’s accepted domains.

The control therefore does not apply its rejection condition, although the message came from an unauthenticated external source.

Acceptance does not mean inbox delivery. Microsoft 365 marked the test message anonymous, gave it a Spam Confidence Level of 9, and sent it to Junk Email after SPF and DKIM returned no result and DMARC failed.

Yet filtering outcomes can differ based on content, infrastructure, configuration, and trusted-sender exceptions. In one case, a message that failed every sender-authentication check was classed as high-confidence phishing but reached an inbox because the spoofed executive was an allowed sender.

Organizations following email authentication configuration guidance should also review exceptions that can override checks.

Targeting and Defensive Steps

ReliaQuest examined examples from September 2025 to August 2026 targeting executives, managers, finance staff, procurement teams, and customer-facing roles. These people regularly handle invoices, bids, shared files, and payment instructions, making business language convincing.

File-sharing notices were most common, followed by payment and remittance requests, procurement invitations, loan or investment offers, and meeting invitations. Some messages used SVG attachments disguised as voicemail recordings.

That approach echoes coverage of weaponized SVG phishing files, which can trigger browser redirection rather than act as images. Security teams should retain RejectDirectSend but not view it as a complete defense.

An IP-restricted inbound connector permits unauthenticated Direct Send only from approved devices and applications. It blocked every Direct Send attempt, including those with a blank sender envelope.

Administrators should identify systems that truly need Direct Send and tightly restrict approved source IP addresses.

Remove unjustified filtering exceptions, including allowed senders, allowed domains, safe-sender entries, and rules that change spam scores. Previous internal email spoofing cases show why trusted routes and permissive rules need scrutiny.

Finally, defenders should search for an empty envelope sender paired with a visible From address in an accepted internal domain, which differs from bounce mail. Prioritize alerts where SPF, DKIM, or DMARC also failed but delivery occurred through an override.

Employees should verify unexpected payment, document, or access requests using a known channel before acting. This check should occur first before responding or opening attachments.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Microsoft 365 Phishing Technique Uses Empty Envelope Sender to Evade Direct Send Blocking appeared first on Cyber Security News.

Mac users are being targeted with 14 fake application installers that appear to offer familiar software but instead start a credential-stealing remote-access trojan.

The files were distributed as macOS disk images and installer packages, giving attackers another route into systems used by developers and job seekers.

The activity is tied to the long-running Contagious Interview campaign, in which attackers pose as recruiters and send coding tests, repositories or packages to prospective candidates.

This latest wave moves the lure outside the usual developer workflow and hides the infection inside software installers.

Jamf Threat Labs identified the installer cluster and linked its staging infrastructure to earlier Git-hook and Visual Studio Code task-file attacks.

The final payload is OtterCookie, a remote-access trojan that can take browser and cryptocurrency-wallet credentials, search for sensitive files and monitor clipboard data.

The risk is not limited to a single fake download. A victim who bypasses macOS warnings can unknowingly launch a decoy application while the hidden program retrieves later stages in the background.

Jamf said in a report shared with Cyber Security News (CSN) that it gives operators a path to valuable account data and a channel for commands on the affected Mac.

Security teams should treat reports of unsolicited interview software as possible security incidents, especially when applicants are asked to disable safeguards, run terminal commands, or install a package outside normal distribution channels.

14 Fake macOS Installers Linked to DPRK Campaign

The 14 samples impersonate applications including The Unarchiver, Presentify, PDFify, Magic Disk Cleaner, Sketch, SiteSucker Pro, RAR Extractor Max, Mp3tag, Mole, HextEdit, Folder Preview Pro, Disk Doctor Pro, ServerCat and Bartender.

Researchers found both DMG and PKG versions, all lacking a valid signature and notarization. In the disk-image route, attackers changed the app configuration so a hidden executable named .macos runs when the user double-clicks the bundle.

It removes the quarantine attribute from the real app, opens that app as a decoy, then contacts a staging server. This tactic echoes malicious Git hook attacks that used job-related coding work to trigger malware.

The package route uses a different wrapper but reaches the same destination. The unsigned installer places a preinstall script under Application Support, while a postinstall script launches it.

That script fetches the next stage and attempts to clear the protection flag from the installed application. The hidden executable is built for Intel processors, so Apple-silicon Macs need Rosetta 2 before it can launch.

The dependency is notable because researchers have previously documented x86-64 macOS malware delivery designed around Rosetta 2, but it does not remove the need for victim interaction in this case.

Job Lures Expand Attack Chain

The first downloaded script creates a concealed ~/.task folder and retrieves tokenlinux.sh. The next script downloads Node.js, a malicious parser.js file and supporting components, runs an installation command, and launches the final program.

Later retrieval requests carry short-lived signed tokens that appear designed to track the session and control access to each stage.

OtterCookie contains a Socket.IO-based remote-access component, a browser and wallet credential stealer, an in-memory file scanner and a clipboard collector.

Its use is consistent with OtterCookie hidden in SVGs, another campaign that targeted developers through a seemingly legitimate project.

The samples may reflect active testing or early development because they do not run by default. Still, the combined social engineering and staged delivery show why a security warning should not be treated as a routine obstacle.

Users should obtain Mac software only from trusted sources, verify a developer signature where possible, and avoid removing the quarantine attribute merely to make an unfamiliar app run.

Organizations should keep threat prevention, advanced detection and web controls enabled to block and report similar activity, particularly for staff handling interview assignments or external code.

The campaign also reinforces the need to review repositories, package scripts and unexpected installers before execution.

Earlier fake interview malware campaigns show that the same recruitment pretext can be adapted across platforms, while this variant demonstrates that familiar Mac app names remain effective bait.

Indicatprs of compromise (IoCs):-

Type	Indicator	Description
IP address	162.0.239[.]85	Staging C2 server, port 3000
IP address	147.124.202[.]205	OtterCookie operator C2 server using ports 7671, 7676 and 7679
Domain	w3pi[.]social	Domain resolving to the staging host
Domain	miniapp.w3pi[.]social	TLS certificate common name associated with the staging host
Domain	softcus[.]net	Domain resolving to the staging host
Domain	pobelstudio[.]com	Domain resolving to the staging host
Domain	pobel[.]studio	Domain resolving to the staging host
Domain	kikaiverse[.]com	Domain resolving to the staging host
Domain	lalitae[.]com	Domain resolving to the staging host
URL	hxxp://162.0.239[.]85:3000/task/mac?token=30621301	First-stage payload retrieval
URL	hxxp://162.0.239[.]85:3000/task/tokenlinux?token=30621301&st=<JWT>	Second-stage script retrieval
URL	hxxp://162.0.239[.]85:3000/task/parser?token=30621301&st=<JWT>	OtterCookie parser retrieval
URL	hxxp://162.0.239[.]85:3000/task/package.json	Malicious Node.js package configuration retrieval
URL	hxxp://147.124.202[.]205/api/service/makelog	OtterCookie operator endpoint
File path	~/.task/tokenlinux.sh	Downloaded second-stage shell script
File path	~/.task/node-v20.11.1-darwin-x64/	Downloaded Node.js runtime directory
File path	~/.task/node-v20.11.1-darwin-x64/bin/parser.js	OtterCookie JavaScript payload
File path	~/.task/node-v20.11.1-darwin-x64/bin/package.json	Malicious Node.js package file
File path	~/.task/node-v20.11.1-darwin-x64/bin/scdata	Remote-access trojan component
File path	~/.task/node-v20.11.1-darwin-x64/bin/ldata	Credential-stealing component
File name	Mole/Contents/MacOS/.macos	Hidden executable launched from the trojanized Mole application
SHA-256	ab5e0684869238c1a1cabadfa0b2e4351490a6343d210ad09c09455ed352b338	The Unarchiver 4.3.9.dmg
SHA-256	0e12f41c2d3d2e48b5a004bff4c126bf8e907bc6c20648f3844ed4ebad126a29	Presentify 8.1.2.dmg
SHA-256	01955691147a036e2104a16f9c3b34d11cb3304e184ed9d533325705599b876b	PDFify 5.2.dmg
SHA-256	9ff8a6e839ebfaa185fbd53c35f1e671fe9ce6851738df07d086cae67db3e06a	Magic Disk Cleaner 5.0.2.dmg
SHA-256	f5686109776f83123d30568e552708a7ad78964396d0f3bfd37d0332f44f8ad6	Sketch2026.2.dmg
SHA-256	d9f6c4e60ca24364751e9a3f1550f3600726cb5d185407bc82078aa95ef09e53	SiteSucker Pro 6.1.8.dmg
SHA-256	fab2e8e1ac22c5d14fd6531efe4e8e05ca9246786154b2d2f3b7f425777f4818	RAR Extractor Max 13.8.dmg
SHA-256	24a252e72d767d62f3076f4f59780511288ea9eedd0e30f234c9cdd5b7644cbf	Mp3tag 1.13.0.dmg
SHA-256	1abbdeee6d03894c0c53240f7ba873fadf9367e312ada1d280420bc88f986e91	Mole 1.8.0.dmg
SHA-256	ed3cfda8fcd1936777e3ebabb9a307325c4c2cd793416386c80bf906e4df279b	HextEdit 1.0.7.dmg
SHA-256	08425172a2dc19516ba9a3fcca8a0a789962d9b95d1792974f69c086ee64aec9	Folder Preview Pro 2.11.1.dmg
SHA-256	7030b07575e3c6558fecfd1cabc7463f10c7ca37262da7e57221a85464b7982d	Disk Doctor Pro 1.0.25.dmg
SHA-256	46d382b234dcd63e66b17799b2e6cefe24ae60e10bef758c6ccf8e72ba0aaa6c	ServerCat 26.8.0.dmg
SHA-256	d55d6419b20e7bf07025d3e464cd4bc05bc96216bf5f85dd7f9a4cbdba10d8ea	Bartender 6.6.2.dmg
SHA-256	3a7fedfeb42f13b2c368c195ec83b8e8c952df7fd506133210868f3eeb06b51d	The Unarchiver 4.3.9.pkg
SHA-256	5ab8c5808cc00825c608027d7da8611a5386de65a724fed999828310b3cb4ddb	RAR Extractor Max 13.8.pkg
SHA-256	3cda9d3522d471a0018bc58499a424f8084b29e21776d8d63d09fe2d7eca4b49	EzyCal 2.6.pkg
SHA-256	6b33812538be1983c94cedc82f480fd98b7ccdd3df7fa4fda863262818d07ba1	Mp3tag.pkg
SHA-256	791f2c56e945a2b6e99d93b10e6f42c383aa9a083ae98fc74f8720f92789c645	Disk Doctor Pro.pkg
SHA-256	e328e5ecf66ac5989aa5f8fb2a7c742d475647b53c929df544b6128db16750d6	Mole.pkg
SHA-256	0d306f347999e02cbbe41d6ff1c47aecbc994213b3cc65bbf4aa723469e6e5ab	SiteSucker Pro 6.1.8.pkg
SHA-256	89d36570b91f59f78eaaafba19e91032dce3e6b42d4b7905d38724399bb8c8c2	HextEdit.pkg
SHA-256	f9e29c72088f4a7f7789755cd08057f0125c42b352187951623d9290ed0ace1f	Hidden .macos executable
SHA-256	0882bb158878a1ca19320f5160dc93f4608c862f3ab652671bb92a82b2f1eb39	/task/tokenlinux.sh
SHA-256	815a41a0c0426ffec3c9ad08e1fb125a040cf0e41acce2a86b891aeb08648d61	/task/mac
SHA-256	42620128470e26d473a128f354b77ca2c5fe9e5782e7addc1e3f863dbd0cd9b0	node-v20.11.1-darwin-x64/bin/parser.js
SHA-256	4c025bda19d6b7b1f9cc209876099b20130a198c18ae22b7809470dde93c62db	node-v20.11.1-darwin-x64/bin/scdata
SHA-256	b07f46962c409cb854e34e06abcfc616edcc5a554a43cfac8f4f26cb818a340d	node-v20.11.1-darwin-x64/bin/ldata

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post 14 Fake macOS Installers Linked to DPRK Campaign Deliver Credential-Stealing RAT appeared first on Cyber Security News.

A large campaign has compromised more than 14,000 internet-connected Dahua cameras, exposing how vulnerable surveillance equipment can become a gateway to video feeds and device settings.

The operation ran for 35 days, and hit devices worldwide, with confirmed compromises centered in Ukraine and Russia. It shows how unattended devices can create durable, long-lasting hidden access for intruders.

The operator scanned for exposed camera management services, tried weak credentials, and used two known authentication-bypass flaws against unpatched devices.

It also used a cloud relay path that can reach cameras behind network address translation by serial number, so even non-public devices could be targeted.

Analysts at Hunt.io identified the activity after finding an openly exposed operator directory containing 2,616 files and campaign tooling.

Hunt.io said in a report shared with Cyber Security News (CSN) the recovered material revealed parallel attack paths, persistent access, and an unrelated Windows payload.

The impact goes beyond unauthorized viewing. The toolkit collected credentials, captured camera snapshots, and exported device records in a format designed for large-scale administration.

Researchers also found offline recovery-code generation, creating a route to administrative resets that can remain useful even after a device owner changes a password.

Dahua Camera Backdoor Survives Password Changes

The most serious finding is persistence. After gaining administrator access through CVE-2021-33044 or CVE-2021-33045, the tool adds a separate account through the camera’s remote management interface.

That account is stored independently from the main administrator password, so changing the password does not remove it. On most affected firmware, a factory reset also fails to erase the hidden access. Hunt.io counted 1,923 cameras carrying the account.

That changes the response from a routine password reset into a compromise investigation, especially for organizations using cameras at sensitive sites.

The two flaws used for initial entry have patches available, yet exposed and unpatched cameras remain attractive targets. Readers can see why direct exposure matters in this coverage of threat actors targeting IP cameras, which also tracks authentication weaknesses affecting surveillance devices.

One exploit path impersonates a trusted hardware controller, while the other claims the request came from the camera itself. Both can provide administrator access without a valid password.

Researchers cautioned that a label used in the toolkit for the persistent-account technique points to an unrelated vulnerability, so defenders should focus on the observed behavior rather than that incorrect identifier.

Recovery Codes Expand Risk

The campaign also abused a cloud relay capability to find and contact cameras using serial numbers. According to the recovered logs, 89.4 percent of live serials tested returned a channel that did not require authentication.

That route can bypass the protection normally offered by placing a camera behind a home or business router. Attackers then generated recovery codes offline for live devices.

These codes can support password recovery without knowing the current device credentials. This makes the threat more durable: removing the unauthorized account may not end access.

Organizations should audit every camera account, remove the unauthorized account when found, rotate camera and linked recorder credentials, and review whether footage or passwords were accessed.

Administrators should also disable P2P features when they are not needed, restrict the management service to trusted internal networks, and apply the vendor update that fixes the two bypasses.

Unpatched-camera abuse also appeared in Iranian operations targeting US networks, underlining that camera security is now an operational concern, not a minor maintenance task.

Firmware updates are essential because they prevent new recovery codes from being generated and cause earlier codes to be refreshed and eventually invalidated.

Network teams should alert on suspicious controller or loopback login patterns, while Windows teams should investigate broad security-tool exclusions.

For broader context on the risks posed by exposed video equipment, see the FBI warning on webcam and DVR attacks and the analysis of automated camera exploitation toolkit.

Indicators of compromise (IoCs):-

Type	Indicator	Description
IPv4	154.86[.]119.60	Operator server that exposed the open directory and staged payloads
IPv4	185.132[.]53.56	Second host where the identical Windows payload was identified
Domain:Port	easy4ipcloud[.]com:8800	Dahua P2P relay endpoint abused in the campaign; legitimate infrastructure, not inherently malicious
URL	vk[.]com/wall-163997495	VKontakte link hardcoded into the operator’s Telegram notification template
Domains	dahuaddns[.]com, quickddns[.]com	Dahua DDNS services used for serial-number enumeration; legitimate infrastructure abused by the operator
Port	37777/TCP	Dahua Easy4IP binary management protocol targeted by the campaign
TLS Subject	rbc[.]ru	Certificate subject presented by the primary host; identified as a widely reused proxy-tool certificate, not a bank-specific compromise indicator
Discord	discord[.]gg/cctv	Community handle included in the recovery-code tool’s console title
Credential	p2pwn / p2password	RPC-installed persistent camera account and primary victim-side artifact
Credentials	admin:admin, 666666:666666, 888888:888888, admin:admin123, default:tluafed	Default credential pairs used by the backdoor tool’s brute-force list
Serial prefixes	AH1058FPAG, 3E02C9DPAA, 7K01F36PCA, 5D03CF3PAJ, 3K04B95PAG, 4J00809PAJ, 3L05AF4PAG, 5E00106PAJ, 5F009F7PAJ, 5K09CA1PAJ, 6E0933FPAZ, 3J03016PAG, 5H01308PAJ	Camera serial prefixes targeted by the serial-number brute-force process
SHA-256	de03a0ae5c7aa0c237ae36a649875f986fd9701ac06857dd214054367ce5090c	Hash for 1.exe / xeno.exe, a UPX-packed Windows payload assessed as SalatStealer
SHA-256	694bfbe44bcd9b4844e15294be74dafe86ff8ae40b8b1067f4dae70a6ef75da8	Compiled Go ELF backdoor tool
SHA-256	be2738c8a2beb55ac484d71c329381f3caabac80664283ad9a24dbab82b5b590	Operator copy of the backdoor source archive
Filename	cidrs.txt	Renamed IPDeny Russia CIDR list used to drive scanning activity
Service	Port 8080 "Telemt Panel"	Vite/React service observed on the primary operator host
Windows path	C:\Users\SystemX\Downloads\seria	Development path exposed in a Windows-side test log
PTR	rogue-orbit-ryzhuuxu.expresshost.cloud	Reverse-DNS hostname for the primary host; provider naming convention
Domain	oxycod[.]one	Legitimate personal domain associated with the second host’s pre-existing history
SSH fingerprint SHA-256	570963ee5a1253832c80e95ebb34dca5fe0f6bf7437857dcae511fbb023ed109	SSH host-key fingerprint associated with the primary host
SHA-256	7a963211a052a78899a8881d36b42b55690c02e95c1485f5d78d3cfdb3d2842a	Original serial brute-force script at /CVE-2025-31702-main/dahua-sn-brute2.py
SHA-256	083c9ee06ed2ee1bc0051358b3eeb3242f474eacea4c88b3b10b06d15389b753	Mid-rewrite serial brute-force script at /cve-project/dahua-sn-brute2.py
SHA-256	5f60e5b45ecd67a987bdb1173d6a8063aa20a7946377da4698aaba3ebe72d088	Fully Russified serial brute-force script at /cve-2025-31702/dahua-sn-brute2.py
SHA-256	4a4a346df72c839272ea835e4717cd88f843333b3563e745e657895347ea3dbe	Active serial brute-force launcher at /cve-project/start_all.sh

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Dahua Camera Backdoor Survives Password Changes and Factory Resets on Compromised Devices appeared first on Cyber Security News.

You've had your iPhone stolen. A day later, you get a text from Apple saying they've found it, and a very helpful woman called Alice from Apple Support calls to walk you through recovering it. She's polite. She's professional. But she is not from Apple. She's not even human. And she's about to break into your iPhone. Meanwhile, OpenAI, Anthropic, and Meta have all announced - with varying degrees of drama - that their AI agents have "broken out of the sandbox" and gone hacking. James takes a step back and asks the awkward question: is this really an emergent AI apocalypse, or did they just leave the door open? All this and more in episode 483 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest James Ball.

Hackers are using QR codes without image files to slip past email defenses. The tactic turns email markup into a scannable code, routing recipients to a phishing page while depriving many security tools of the image object they expect to inspect.

QR phishing moves victims from a monitored work computer to a mobile device. A scan can conceal the destination until the phone opens it, and attackers may use the landing page to steal sign-in details, session data, payment information, or deliver a harmful download.

Analysts from PhishU Framework identified the technique after examining a form of quishing that builds a QR pattern directly in an email body. It reflects the shift in which attackers alter delivery formats as mail gateways improve at detecting known lures.

PhishU Framework said in a report shared with Cyber Security News (CSN) that the approach can display even when remote images are blocked.

The report describes a gap, not an unstoppable attack: defenses that render the entire message visually and inspect the result can still identify the code.

Hackers Use QR Codes With No Images

Traditional email QR scams include a bitmap in an attachment or message body. A secure email gateway can extract that image, decode the embedded link, and examine redirects before deciding whether the email poses a risk.

The new method removes that starting point. They can arrange black and white squares with HTML tables or text-like block characters, so the mail client draws a QR code as part of its layout.

A phone camera sees the same valid pattern, but an image-only scanner may see only text and styling instructions. That distinction explains why the technique can sidestep controls built for traditional attachment and image-based scams.

A imageless QR-code phishing campaign showed how dense HTML tables can create a working code that redirects victims to hostile websites.

The attack exploits a familiar human weakness. An email that appears to be an invoice, shared document, security alert, or account notice can pressure a recipient to scan rather than examine a clickable link.

Recent email phishing threat figures show QR lures remain a material part of phishing activity as criminals adapt attachments and delivery methods.

Defenders Need Visual Inspection

The central lesson for security teams is to stop treating the absence of an image as proof that no QR code is present.

Mail protection should render suspicious HTML as a recipient would see it, scan the visual result for QR patterns, and inspect any recovered destination before allowing the message through.

Detection rules can also look for unusually dense grids of tiny alternating cells, repeated color attributes, or blocks of characters arranged in a fixed-width pattern.

These signals are not automatically malicious, but they give analysts a reason to review an email whose design does not match normal business communication.

Administrators should retain remote-image blocking, but should not rely on it as a complete quishing defense. They should test their email path using authorized simulations, confirm whether markup-built codes are detected, and review link protection after delivery.

Guidance on QR-code attack response guidance also stresses previewing decoded links and avoiding sign-in or payment details on a site reached from an unexpected code.

For employees, the safest response is behavioral rather than technical: do not scan an unsolicited QR code just because an email says it is urgent.

Verify the request through a known channel, inspect the decoded address before opening it, and use phishing-resistant sign-in methods where possible.

The risk becomes sharper when attackers use a trusted mailbox, as credential theft through compromised mailboxes can make a lure appear legitimate.

This development is another reminder that email security must evaluate what a message does, not merely what files it contains.

QR codes assembled from markup are still visible to people, so layered filtering, careful inspection, and user awareness remain the most reliable way to reduce the chance that a scan becomes an account compromise.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Hackers Use QR Codes With No Images to Bypass Email Security appeared first on Cyber Security News.

StreamRAT is a new Android banking trojan that gives criminals broad control of an infected phone. It pairs streaming offers with screen viewing, remote actions and deceptive login windows, turning an app download into an account takeover.

The campaign targeted Spanish-speaking Android users through advertisements on Meta platforms and TikTok. One observed advertising push reached 570,000 Meta users between 11 June and 3 July 2026, mainly in Spain. It identified the malware while tracking the streaming-themed Steamtv Esp campaign.

The operators used a phishing site and a multi-stage installation process to steer visitors toward installing an Android package outside official channels.

Threat Fabric said in a report shared with Cyber Security News (CSN) that the download chain drew on a GitHub repository linked to Mirax distribution, showing how the operators reused delivery infrastructure while changing the final payload.

The operation matters because StreamRAT blends banking fraud functions with tools that let an operator watch and manipulate a device in real time.

Its control panel also appears designed for a malware-as-a-service model, which could allow customers to run campaigns using the same framework.

StreamRAT Uses VNC and Accessibility for Device Control

After installation, StreamRAT asks the victim to enable Android Accessibility Services, a legitimate feature intended to assist users.

In the wrong hands, that permission can read what is on screen and perform actions such as taps, swipes, returning home or opening notifications, as seen in other Android banking malware campaigns.

The trojan supports two viewing modes. Its VNC option uses Android’s screen-capture system, while hidden VNC takes repeated screenshots through Accessibility without a direct screen-sharing indicator. Both give attackers a view of the phone and support remote interaction.

StreamRAT can also rebuild the screen as structured interface text, capture typed data, list installed applications and show credential-stealing overlays.

A black screen or a fake update screen can block the victim’s touch input while the operator continues working in the background, a pattern related to abuse of Android accessibility.

The result is more than spying. An operator can monitor the app a victim opens, deliver a matching fake page, collect details entered there and use intercepted unlock information to access the device. That combination puts banking sessions, messages and other sensitive accounts at risk.

Delivery Chain and Evasion Risks

The infection begins with social-media advertisements posing as a free television-streaming service. The lure site checks whether a visitor uses Android, adjusts its instructions for the app used to open it and guides the person through enabling unknown-source installation and Accessibility permissions.

A first-stage dropper tries to become the default home application, keeping the victim inside its interface when they press the Home button. It then retrieves and installs the final payload.

Similar social engineering has featured in phone based banking fraud, where attackers rely on urgency and familiar-looking screens rather than a software flaw.

Before downloading the final malware, the dropper can create a deliberately broken VPN connection that disrupts internet access while excluding itself.

Researchers assess this may hinder online reputation checks or cloud-based analysis, although it does not fully defeat offline protection.

StreamRAT communicates with its command server through WebSocket connections and avoids wasting bandwidth by skipping duplicate screen and interface data.

That engineering focus mirrors the WebSocket mobile threat evolution seen in other Android threats and suggests an effort to make remote operations reliable at scale.

Users should avoid APK downloads offered through advertisements, messages or unofficial websites, especially services promising free streaming or urgent updates.

They should deny unexpected requests for Accessibility, unknown-app installation or VPN access, and remove unfamiliar apps promptly. An app that combines installation capability with VPN permissions deserves immediate scrutiny.

For organisations, mobile-device monitoring should flag unusual Accessibility activity, unexpected screen-capture requests, default-launcher changes and newly installed apps from outside managed stores.

Security teams can also watch for the indicators below, while treating the values as detection leads rather than proof that every matching device is compromised.

Indicators of compromise (IoCs):-

Type	Indicator	Description
SHA-256	e0714788b4e2518b0d9d4cbf18c7217bb97718e01689d77338f1cc4a230fcb6c	StreamRAT-related Android application sample
Package name	io.base.one887	Package associated with the StrεαmTV Pro application
Application name	StrεαmTV Pro	Application name used by the StreamRAT-related sample
SHA-256	ba83cc3c9535690191018edf73ca5c6001609df9919462796aa2e551f142e4d3	StreamRAT-related Android application sample
Package name	io.meat.hint	Package associated with the Sistema de vídeo application
Application name	Sistema de vídeo	Application name used by the StreamRAT-related sample
C2 IP address	45.147.28[.]59	StreamRAT command-and-control infrastructure
C2 IP address	193.32.2[.]245	StreamRAT command-and-control infrastructure

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post New StreamRAT Android Trojan Gives Hackers Full Remote Control Through VNC and Accessibility appeared first on Cyber Security News.

The Gentlemen ransomware operation is moving from access to full network encryption at striking speed. In some intrusions, attackers disabled defenses and recovery services before deploying ransomware in less than 24 hours across enterprises.

The group runs as a ransomware-as-a-service operation, meaning affiliates can strike organizations they can reach. Its double-extortion approach adds pressure: files are stolen first, then encrypted, leaving victims facing a data leak as well as operational disruption.

Analysts at Sophos examined 15 incidents linked to the group, tracked as GOLD SHERWOOD, and found a repeatable playbook.

The findings show how a small window after a suspicious login can quickly become a business-wide outage.

Sophos said in a report shared with Cyber Security News (CSN) that initial access appears to come from exposed firewall management interfaces, unpatched devices, or stolen VPN credentials.

A Fortinet SSL VPN account without multi-factor authentication gave the intruder a foothold, underlining why FortiOS authentication bypass vulnerability remains a serious concern for exposed infrastructure.

The Gentlemen Ransomware Hackers Disable EDR

Once inside, the affiliates moved across systems using legitimate domain credentials and Remote Desktop Protocol.

They placed their toolkit in a trusted Windows location that is often overlooked, then mapped systems, data stores, and backup infrastructure before the visible stage of the attack began.

They increased their control by changing administrator passwords, adding accounts to privileged groups, and enabling remote desktop access.

In several cases, they created firewall rules to allow outside RDP connections, providing a fallback route if the originally compromised VPN session was lost.

Next, they removed obstacles to encryption. Attackers used custom and publicly available utilities, including vulnerable drivers, to terminate antivirus and endpoint detection and response processes.

They also weakened Windows Defender by adding broad scan exclusions or changing policy settings. A recent report on ransomware operators disable EDR shows the broader pattern of crews stopping security and backup software before spreading across a network.

In this campaign, the effort was deliberate rather than incidental, with multiple approaches used when one method failed. Backup services were then disabled, often immediately before encryption.

They targeted recovery and backup-agent services, making it harder for teams to restore systems. In one intrusion, they also cleared Application, System, and Security event logs, obscuring the evidence responders need to trace the breach.

Rapid Encryption Playbook

Before locking systems, the group copied selected files with legitimate transfer tools. It commonly focused on newer data and used filters to reduce the volume transferred, which can make outbound activity less obvious while still collecting material valuable for extortion.

Affiliates adapted their process. Researchers saw them switch among transfer utilities and object-storage methods as conditions changed.

That flexibility resembles other attacks against remote infrastructure, including Gunra ransomware VPN attacks, where exposed access points can quickly lead to high-impact ransomware activity.

The median interval from first observed post-compromise activity to ransomware deployment was about two days. The shortest observed period was under 24 hours, leaving little room for manual investigation after an attacker gains entry.

The locker was deployed locally, through network shares, or across the domain using centralized logon shares and remote execution.

It encrypted files, assigned a six-character extension, and left a ransom note in affected directories. Although Windows was the only version deployed in the reviewed cases, related builds also support Linux and ESXi environments.

The pace makes prevention and early detection equally important. Organizations should patch internet-facing firewalls and VPN appliances, require MFA for every remote-access account, restrict RDP exposure, and closely review new privileged accounts. The Fortinet security update guidance provides useful context on fixing a flaw tied to the access methods investigated.

Teams should also alert on unusual activity from system staging folders, unfamiliar data-transfer utilities, Windows Defender exclusions, disabled backup services, cleared logs, and attempts to load vulnerable drivers.

Separating backups from ordinary administrator control and testing recovery plans can prevent attackers from turning a single compromised account into a prolonged outage.

Indicators of compromise (IoCs):-

Type	Indicator	Description
MD5	622b2ca08552535bc142cb815ff9ec16	Sophos-listed threat indicator
SHA-1	f0bc50d2d2838c5294e21cd9bce2f09bf581e508	Sophos-listed threat indicator
SHA-256	a348f5fa048a09188bd706fd3d4efca978990caf3355ecfee501c9f1e19c	Sophos-listed threat indicator
MD5	4741a4976c6abfb3c80c170104518b6e	Sophos-listed threat indicator
SHA-1	be8c52474ab79a52af31e3cb2f71638299a0de1d	Sophos-listed threat indicator
SHA-256	ddba5b4e7a7ada77d56477e9d41c008f93e81d9a33ed09e77cb2af624f	Sophos-listed threat indicator
MD5	738df7ae0097f6bef93d65be5d4a2a26	Sophos-listed threat indicator
SHA-1	c96baab9b7e7ef661921d44d7900f165c794ed25	Sophos-listed threat indicator
SHA-256	1a9291ec869155336bf185d221d655d11c77a55ea0c8ecc0274202f74a9	Sophos-listed threat indicator
MD5	d8691ef15eea27cfefafeeb485286080	Sophos-listed threat indicator
SHA-1	8bca55b3c9bfbdf68c9b6c72a7b1bf1dd6d5e3b2	Sophos-listed threat indicator
SHA-256	3c71537b64487bbf4d1793f72c75d332650d09a77b71e4d884ff15c266a	Sophos-listed threat indicator
MD5	b23b653541bd95bdc4da07a0b07b57bf	Sophos-listed threat indicator
SHA-1	f0537cbb773ae12100b36731e7c39f5a9d852b14	Sophos-listed threat indicator
SHA-256	50f2cdf16f05da9253fa2d6eb60d5a42da14c02c551c0874c9e953d4119	Sophos-listed threat indicator
SHA-256	bf7a2fb7f7256809dc690213b85f747cef8db7b909caf9783cac181912fb	Sophos-listed threat indicator
SHA-256	761ce72420edf5e5531cdbad0e93397d7520cdead825886ca7f75cef76	Sophos-listed threat indicator
MD5	002417da707b93bf5ce3cb26d28005f6	Sophos-listed threat indicator
SHA-1	8732c1ff565828a0bdef514b5dc0dfea40c1d1f2	Sophos-listed threat indicator
SHA-256	81053c2c3be8b7dbf7d5087dba05c940b3ee4fd95524272651c816b72c	Sophos-listed threat indicator
SHA-256	7a37acb031cddaa39ad20db0961baa5423ec53f318c49c9275c982507d	Sophos-listed threat indicator
MD5	bc4a8d7bbbeb941265dfc954539326c0	Sophos-listed threat indicator
SHA-1	b7cea81e6de895d01d01d20bd6dcfd347940b57f	Sophos-listed threat indicator
SHA-256	3a31ec3bf9b7eac6593a723145381f5d0f4ede076c4c8818d949a08f559	Sophos-listed threat indicator
SHA-256	68031d549de399a44bb00614b910106baccef5996623b2f1102352a52a	Sophos-listed threat indicator
SHA-1	058c3ff21e79770e4a60937c27b1ede227709248	Sophos-listed threat indicator
SHA-1	9c0b05eb75f971cc25ee979e49b227b86b19e833	Sophos-listed threat indicator
SHA-1	a438ba2122a814320f47a056f04122f81c2ae6c5	Sophos-listed threat indicator
SHA-1	a8ba89e67297642dcc1ae77433ab84e1f27d1792	Sophos-listed threat indicator
MD5	8ea97d01cbf459b94d134d05c54cd33e	Sophos-listed threat indicator
SHA-1	5c9bf6b7e4c7dc9b9227ce86e2d271d624c35147	Sophos-listed threat indicator
SHA-256	0be8f415a485b11747bcfd71c9cd9781e090354728f076791ed6845b69e	Sophos-listed threat indicator
MD5	07e9f0b8627a95960e79e930fb099e84	Sophos-listed threat indicator
SHA-1	56bee9df5833a637f5c54d5911df98b0812fe643	Sophos-listed threat indicator
SHA-256	2d91a78e739891c9854c254f5b2a6b84c0e167dfa253466cbccd2cdd1c	Sophos-listed threat indicator
SHA-256	ccdde8091d63eaafbe30d9f0482afd245abc10ab16e21ae9254e51e42cb	Sophos-listed threat indicator

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post The Gentlemen Ransomware Hackers Disable EDR and Backups Before Encrypting Networks in Under 24 Hours appeared first on Cyber Security News.