Microsoft 365 users are facing a phishing technique built on a small change: attackers leave the SMTP envelope sender blank.

The omission can let an unauthenticated message pass a Direct Send safeguard while showing employees an address that appears to belong to their own organization.

The approach is not a Microsoft software flaw and does not need a stolen account. It exploits how Exchange Online’s RejectDirectSend control checks the domain in the envelope sender, rather than the address displayed in the visible From field.

That difference offers criminals a simple route to impersonation. It removes a barrier designed to stop an especially risky form of spoofed mail.

Researchers at ReliaQuest identified the pattern in active phishing cases and reproduced it in a controlled Microsoft 365 tenant.

Reliaquest said in a report shared with Cyber Security News (CSN), the company said the technique had appeared repeatedly across unrelated organizations during the past year. A convincing internal-looking email can carry a document notice, payment request, or voicemail lure.

Even if mail filters detect some attempts, any message that reaches a recipient creates an opening for credential theft, malware delivery, fraudulent transfers, and wider account compromise.

Microsoft 365 Phishing Technique Uses Empty Envelope Sender

Direct Send allows devices and applications to send mail within the same Microsoft 365 tenant without authentication. Earlier coverage of Microsoft 365 Direct Send documented attackers imitating internal users without compromising an account.

RejectDirectSend is meant to reject unauthenticated Direct Send mail claiming to come from an organization’s accepted domain. ReliaQuest sent two messages to a tenant’s mail host.

The message using the tenant domain in its envelope sender was rejected, but one using the SMTP command MAIL FROM:<> was accepted and queued.

The recipient still saw the same internal IT support address in the visible From field. Since the empty sender holds no domain, RejectDirectSend has nothing to compare with the tenant’s accepted domains.

The control therefore does not apply its rejection condition, although the message came from an unauthenticated external source.

Acceptance does not mean inbox delivery. Microsoft 365 marked the test message anonymous, gave it a Spam Confidence Level of 9, and sent it to Junk Email after SPF and DKIM returned no result and DMARC failed.

Yet filtering outcomes can differ based on content, infrastructure, configuration, and trusted-sender exceptions. In one case, a message that failed every sender-authentication check was classed as high-confidence phishing but reached an inbox because the spoofed executive was an allowed sender.

Organizations following email authentication configuration guidance should also review exceptions that can override checks.

Targeting and Defensive Steps

ReliaQuest examined examples from September 2025 to August 2026 targeting executives, managers, finance staff, procurement teams, and customer-facing roles. These people regularly handle invoices, bids, shared files, and payment instructions, making business language convincing.

File-sharing notices were most common, followed by payment and remittance requests, procurement invitations, loan or investment offers, and meeting invitations. Some messages used SVG attachments disguised as voicemail recordings.

That approach echoes coverage of weaponized SVG phishing files, which can trigger browser redirection rather than act as images. Security teams should retain RejectDirectSend but not view it as a complete defense.

An IP-restricted inbound connector permits unauthenticated Direct Send only from approved devices and applications. It blocked every Direct Send attempt, including those with a blank sender envelope.

Administrators should identify systems that truly need Direct Send and tightly restrict approved source IP addresses.

Remove unjustified filtering exceptions, including allowed senders, allowed domains, safe-sender entries, and rules that change spam scores. Previous internal email spoofing cases show why trusted routes and permissive rules need scrutiny.

Finally, defenders should search for an empty envelope sender paired with a visible From address in an accepted internal domain, which differs from bounce mail. Prioritize alerts where SPF, DKIM, or DMARC also failed but delivery occurred through an override.

Employees should verify unexpected payment, document, or access requests using a known channel before acting. This check should occur first before responding or opening attachments.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Microsoft 365 Phishing Technique Uses Empty Envelope Sender to Evade Direct Send Blocking appeared first on Cyber Security News.

SLEEPWALKER is a newly identified Windows backdoor built to wait rather than call home. Once placed on a compromised device, it can sit inactive for an extended period, only responding when an operator sends a carefully formed network packet.

That restraint makes the threat difficult to spot with tools that look for repeated connections to a command server.

It is designed to be loaded beside a legitimate security-management component, giving malicious code a trusted-looking place to run. Analysts at PolySwarm identified the malware and named it SLEEPWALKER.

PolySwarm said in a report shared with Cyber Security News (CSN) that their analysis says the sample has no identified threat actor, victim, campaign, delivery chain, or proven record of features used in a live intrusion.

The finding nonetheless matters to enterprise defenders. A backdoor that avoids routine beaconing can reduce the clues available to network monitoring teams, then give an intruder flexible access after the secret trigger arrives.

New Windows Backdoor Stays Completely Silent

The implant begins by checking that it is running within the expected management-agent process. It is an unsigned 64-bit Windows library that imitates a legitimate supporting component and is intended to launch through DLL side-loading, a technique also used in the C2Looper sideloading evasion case to hide hostile code behind familiar software.

Its stored configuration is deliberately sparse. Instead of a hard-coded command server, it instructs the malware to place available interfaces into promiscuous mode and watch indefinitely for traffic matching a defined encrypted packet format.

A valid packet clears framing checks and CRC-32 validation before its tasking is decrypted with AES-256-CCM. The malware then passes the result to its own command interpreter, allowing an attacker to issue work without creating the regular outbound beacon expected from many remote-access tools.

This passive design can leave legitimate management-agent traffic appearing normal while the implant waits. The trigger must still reach a monitored interface, suggesting the operator needs a position on, through, or near the victim network.

That requirement may limit use against isolated endpoints, yet it does not make the malware harmless: tasking received after activation can instruct the compromised host to create new routes for operator control.

The researchers recovered an encryption key from the analyzed library, but the decrypted content is not plain-language instruction text. It uses a proprietary bytecode structure, creating another obstacle for analysts trying to determine exactly what an operator asked an infected device to do.

Flexible Access Raises Detection Stakes

SLEEPWALKER supports 23 bytecode instructions for scheduling, repeated tasks, additional listeners, compressed payloads, local task files, and direct in-memory shellcode execution.

It also supports TCP, UDP, ICMP, Windows named pipes, DNS-based tasking, and VMware VMCI communications. Those options should be treated as possible capabilities, not confirmed activity.

The analyzed configuration enables only the raw-packet listener; DNS triggering, lateral movement, virtual-machine communications, and staged delivery were implemented in the code but were not shown to have been used. The malware can also adjust Windows settings to allow anonymous access to its named-pipe channel.

That behavior offers defenders a useful hunting lead, alongside unexpected library loading from management-agent folders and suspicious pipes, much like the PipeMagic named pipe investigation highlighted the value of watching uncommon local communication paths.

Security teams should validate library signatures and hashes, compare anonymous SMB and named-pipe settings with approved baselines, and investigate trusted processes loading unverified neighboring files.

Those checks are especially important because file reputation and blocklists alone may reveal little when there is no fixed command infrastructure.

Behavior-focused monitoring is therefore central. Teams should correlate process starts, unusual library loads, security-configuration changes, packet-capture evidence, and memory activity rather than treat any single signal as conclusive, an approach reinforced by the Mistic memory execution report.

For incident responders, the practical lesson is to preserve volatile evidence early and examine how a suspect process was launched.

SLEEPWALKER shows how an attacker can separate initial compromise from later control, remain quiet between actions, and make a familiar program part of the concealment strategy.

Indicators of compromise (IoCs):-

Type	Indicator	Description
SHA-256	d347170752a28e2b8c4b8b9f3cab2e3a6541ba11682c94498d26eb9002779d60	SLEEPWALKER sample hash
File name	dpapi.dll	Unsigned malicious DLL masquerading as a legitimate Microsoft component
Process name	ERAAgent.exe	Management-agent process targeted for DLL side-loading

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post New Windows Backdoor Stays Completely Silent Until Hackers Send a Secret Trigger appeared first on Cyber Security News.

Hackers are using a fake Cloudflare CAPTCHA to turn a routine web check into a doorway into corporate networks.

The campaign, called TerminalFix, begins on compromised websites and persuades visitors to paste a supposed verification command into Windows Terminal or PowerShell.

It relies on a victim completing the attacker’s instructions. It has been seen against multiple industry sectors. The copied command fetches a ZIP archive, unpacks it under ProgramData, and starts a batch file in the background.

It launches a longer chain that hides code, maps the organisation, and creates a route back to attackers. Microsoft analysts identified TerminalFix as a more capable ClickFix variant, targeting organisations in several industries. 

Microsoft said in a report shared with Cyber Security News (CSN) the campaign combines social engineering, DLL sideloading, image-hidden data, and a custom reverse tunnel.

An infection can turn that computer into a pivot point for systems it can access internally, including critical internal systems. Researchers did not observe final hands-on actions, but the access could enable theft, security-control tampering, or ransomware.

Hackers Use Fake Cloudflare CAPTCHA

The lure looks familiar. A compromised page briefly loads normally before a counterfeit Cloudflare Turnstile screen appears, with a checkbox and loading animation.

Clicking it silently puts a harmful PowerShell command on the clipboard, then tells the visitor to open a command window and paste it.

TerminalFix directs users to Terminal or PowerShell instead of the Windows Run box, making longer multi-line scripts easier to execute.

Readers following recent fake CAPTCHA malware attacks will recognise the pattern: trust in a familiar verification prompt replaces the need for a browser exploit.

The archive contains a legitimate signed program and a malicious DLL. When the trusted application starts from the attacker-controlled folder, Windows loads the nearby library first. This lets malicious code run in a less suspicious process.

The DLL downloads PNG images from attacker-controlled sites and extracts hidden program components from their pixel data.

It also sets a Registry Run entry and a scheduled task that restarts the payload hourly. Similar misuse appears in PowerShell DLL sideloading attacks, showing why file location and process activity matter.

Stealthy Access Requires Faster Response

After persistence is established, TerminalFix maps the infected environment. Its scripts query domain trusts, domain administrator membership, user and computer records, and server names, then run targeted ping checks.

This reconnaissance helps attackers identify valuable systems and identify domain-connected devices. The final payload brings its own Python runtime and starts a windowless interpreter, keeping the process out of sight.

The implant opens an encrypted WebSocket connection over port 443 and works like a SOCKS-style proxy, allowing operators to relay traffic to internal hosts through the victim.

Reverse tunnelling has also featured in recent enterprise backdoor campaigns, creating a concealed network path. Defenders should treat a confirmed infection as potential network-level access, not simply a malware cleanup event.

Investigate lateral movement and exposed credentials, prioritise password rotation for accounts available on the affected system, especially privileged domain accounts.

Teams should alert when the sideloading host runs outside its normal Windows location and review outbound connections to listed infrastructure.

Prevention starts with teaching staff that a real CAPTCHA will not ask them to open Terminal, PowerShell, or Run and paste commands.

Organisations can restrict PowerShell for standard users, enable script-block logging, apply signed-script or constrained-language controls where practical, and configure Terminal warnings for multi-line pasted text.

The wider ClickFix phishing delivery trend makes layered controls important because victims initiate the first command.

Network and endpoint teams should monitor unexpected DLL loads, newly created scheduled tasks, hidden ProgramData folders, and Python processes launched with tunnel-related arguments.

Blocking the listed domains, maintaining web protection, and isolating suspected devices quickly can curb an attacker’s movement.

They should also check web logs for visits to compromised sites and inspect clipboard-triggered PowerShell activity, because prompt user action can otherwise resemble a legitimate administrative task.

Investigators should preserve logs and assess the machine’s network reach before returning it to normal service.

Indicators of compromise (IoCs):-

Type	Indicator	Description
SHA-256	18c2090e8a0ae0568af9b87e59eaf8270f23d2909600ed9db91a9444fd8b278f	Initial ZIP archive, verify_pkg.zip
SHA-256	b8d107800403b9197e5b7609ceacd8e4cac1b0f9a1d156e6dacd6c3f7794b36a	Custom reverse-tunnel implant, client.py
SHA-256	ba77feed86bcda49308746421bdc684a432dd5d68c363975b2a3c6831bda3f07	Malicious DLL, dui70.dll
SHA-256	026478003fe354134c03acf6890e7d3b153ba08a836eca42350db48f213872ab	Malicious DLL, dui70.dll
SHA-256	032b529fac61e550f5dc9489686f519b82d64625fa05a8d9ecf8ba8be9b2ad22	Malicious DLL, dui70.dll
SHA-256	df8221a933b38284ebdcb8bffc2df62123c9f5b5f421dd0b070e13e668b3eabf	Malicious DLL, dui70.dll
SHA-256	eb1b4be34d05b394fb74efdeb95faecd1d1963be6ecc1b9db2b4757b491f01f0	Malicious DLL, dui70.dll
SHA-256	5d43abf5c36ea203176d3300ff14af27b4be81810ad2679b3a62b255e3d6e1c8	Malicious DLL, dui70.dll
SHA-256	9a7b4dcd51d9251c177d323d6aaecdfc86674f69bc1af048dc872926d22aaa24	Malicious DLL, dui70.dll
SHA-256	342df92235c9dec81203b837addaa38bb85b64b4a48fe71b5303ca86d991991e	Malicious DLL, dui70.dll
SHA-256	ededeacf30e493dd632d477fe770ba419aa2848f685ea049381a0a8d2cc3e84d	Malicious DLL, dui70.dll
Domain	gitnow[.]dev	Command-and-control server for the custom reverse tunnel on port 443
Domain	bestsocialmedianewspapper[.]com	Steganographic image hosting and payload delivery
Domain	offlineupdater[.]com	Steganographic image hosting failover
URL	hxxps://linked-log[.]com/	Compromised website used in the campaign

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post Hackers Use Fake Cloudflare CAPTCHA to Deploy Reverse Tunnel Into Corporate Networks appeared first on Cyber Security News.

PaperCut servers are under active attack, while 47% of tracked installations still run unpatched versions vulnerable to remote code execution.

PaperCut, the print management software running in schools, hospitals, and offices worldwide, confirmed on August 27 that a pre-authentication remote code execution flaw is being actively exploited against real customers. Researchers at Huntress found evidence of exploitation in two customer environments, and the security firm went further, reproducing the entire attack chain from scratch against a clean, unpatched install.

“Observed activity focused on system discovery. We have not observed secondary malware, further command-and-control traffic, or additional persistence or post-exploitation from the recovered payload.” reads the report published by Hutress.

“Huntress reproduced a full pre-authentication RCE chain against a vanilla PaperCut NG 25.0.11.75758 server. We have reached out to PaperCut to coordinate with them on continued vulnerability analysis.”

The vulnerability starts with a simple authorization mistake in PaperCut. An attacker can send a specially crafted request that makes the server display one page while actually running an action from another page.

PaperCut checks the permissions for the page it displays instead of the action it actually performs. This flaw, tracked as CVE-2026-81578, can let an attacker change the server’s configuration without logging in.

That access can then be combined with a second flaw, CVE-2026-82078. The issue in PaperCut’s database utilities can load unsafe Java classes, allowing the attacker to run arbitrary Java code on the server.

The real-world attacks Huntress observed were almost quaint compared to the severity of the bug itself. One incident lasted under two minutes total, with the attacker running nothing more aggressive than whoami and ver, basic commands to identify the compromised account and Windows version. A second incident added tasklist to the mix, checking what processes were running, but neither case showed evidence of deeper persistence, secondary malware, or follow-up command-and-control traffic.

The activities observed by Huntress read like reconnaissance rather than a finished operation, the kind of activity that usually precedes something worse.

The forensic trail attackers left behind is genuinely useful for defenders, and it’s worth understanding exactly what it looks like. Investigators found a malicious Java class file dropped directly into PaperCut’s own installation directory, capable of running commands, writing results to a temporary file, and then deleting both the output and the server’s own log file to cover its tracks. One artifact survived that cleanup regardless: a Derby database log entry reading memory:...\pwn, an oddly named database directory that PaperCut’s own investigation guidance now flags as a high-confidence indicator of compromise.

“After exploitation, the .class file deletes its own Udydn.out file, as well as the server’s server.log file. The server.log file recorded the execution of this code in a log line that contains the string DB URL: jdbc:derby:memory:pwn that immediately followed the large encoded data blob’s appearance in the log.” continues the report. “We observed /data/internal/derby.log was not deleted, and it contains one insightful breadcrumb”

PaperCut’s patching process is more complicated than simply installing an update. The company released an emergency patch first, then issued another update less than 24 hours later after additional testing. Fixes for version 24 were still being developed when the report was published.

The timing is important because the second confirmed attack targeted a server running version 24, before the fix for that version was available.

Huntress successfully recreated the exploit chain in a test environment. From a remote system, the researchers were able to trigger code execution without authentication. The attack caused PaperCut’s pc-app.exe Application Server to launch charmap.exe with SYSTEM privileges, confirming that the vulnerability can lead to code execution at the highest Windows privilege level.

The bigger concern involves older versions. Huntress found that about 47% of the roughly 2,500 PaperCut installations it tracks still run version 23 or earlier, and there is currently no patch for those versions.

Huntress is working with PaperCut to analyze the vulnerability and coordinate the response.

If your organization runs one of these older versions, the safest option for now is to remove the PaperCut Application Server from the public internet. Restrict access through a VPN or a trusted internal network until a proper fix becomes available.

If your PaperCut server has been publicly accessible recently, installing the patch should not be the end of your response. It should be the start of an investigation.

Before restarting the server, save its logs and configuration files so you don’t lose important evidence. Check whether pc-app.exe has launched a command shell or tools such as tasklist, and look for unexpected .class files in the server’s lib directory.

Even a short two-minute reconnaissance attempt could be an early sign of a more serious attack.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Philippine nuclear and naval targets)

PaperCut warns that a zero-day in NG and MF is being exploited. The company already release emergency patches to address it.

PaperCut Software warns that attackers are actively exploiting a zero-day in its NG and MF print management products. The flaw has no CVE yet, and the company has not released technical details.

PaperCut issued emergency patches on Friday and urged customers to install them immediately. It also recommends disconnecting application servers from the internet and limiting access to trusted IP addresses.

“If your PaperCut NG/MF Application Server is accessible from the public internet, immediately restrict web access to trusted IP addresses only (e.g. internal IP addresses).” states the advisory. “Use firewall rules, network access controls, or equivalent measures to ensure the PaperCut server’s web interfaces cannot be reached from untrusted internet addresses. Take this action now, even if you have not observed suspicious activity.”

The company confirmed incidents affecting customers and said its investigation is still underway.

“PaperCut Software security response team is investigating active exploitation of a vulnerability affecting PaperCut NG and PaperCut MF.” reads the advisory. “We are aware of confirmed customer incidents and are treating this matter with the highest priority. Our investigation is ongoing. We will update this security bulletin as verified information becomes available, including indicators of compromise and remediation guidance.”

PaperCut has not yet disclosed details about the vulnerability, the attack method, or the attackers behind the campaign.

So far, the company has identified several indicators of compromise:

• Intrusion-detection, endpoint-security, or network-monitoring tools may flag suspicious activity involving the PaperCut Application Server, especially activity linked to pc-app.exe.
• Attackers may delete, truncate, or alter PaperCut server.log files to hide their activity.
• The server.log file may contain these entries:
  • ERROR No suitable driver found for jdbc:no:x
  • ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST

Users running PaperCut should check their systems for these signs of compromise.

In May 2023, Microsoft warned that Iran-linked APT groups were exploiting another flaw, tracked as CVE-2023-27350, in attacks against PaperCut MF/NG print management servers. The CVE-2023-27350 flaw is a PaperCut MF/NG Improper Access Control Vulnerability. PaperCut MF/NG contains an improper access control vulnerability within the SetupCompleted class that allows authentication bypass and code execution in the context of SYSTEM.

In April 2023, Microsoft linked the attacks exploiting the CVE-2023-27350 and CVE-2023-27351 vulnerabilities in print management software PaperCut to a financially motivated threat actor tracked as Lace Tempest (formerly DEV-0950). The group is known to be an affiliate of the Clop ransomware RaaS affiliate, it has been linked to GoAnywhere attacks and Raspberry Robin infection. Since April 13, 2023, Lace Tempest added the PaperCut exploits to its arsenal.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Zero-Day)

Cybercriminals are using a counterfeit Claude desktop application to compromise Windows systems, disable key security checks, and install remote-access malware.

The campaign turns a familiar AI software search into a route for credential theft and long-term access. It also shows how trusted-looking download pages can make a dangerous file appear routine.

For organizations, the campaign creates risk beyond one endpoint because stolen credentials may open the door to email, cloud services, and internal systems.

The attack begins with malicious search advertisements that steer victims toward convincing public artifact pages. After a user downloads and runs the supposed installer, the infection moves quickly through several stages.

The final payload is SectopRAT, a remote-access tool that can steal information and give attackers hidden control of an infected device. Such access can let criminals collect files, watch activity, or return later with further instructions.

CyberProof said in a report shared with Cyber Security News (CSN). Its analysts noted that the activity matches the FakeAgent campaign previously tracked in the wild, where attackers abuse public hosting and spoofed installers to deliver malware.

The incident was identified from an alert involving a scheduled task designed to look like a normal software update. Analysts then correlated evidence across the affected endpoint instead of treating that signal as a standalone event.

The case underlines a wider problem for businesses and home users alike. A familiar name is often enough to lower a victim’s guard, particularly when an advertisement appears above legitimate search results.

Recent reporting on fake Gemini installer attacks shows that criminals are also exploiting other popular AI brands to push credential-stealing malware.

Hackers Use Fake Claude Desktop App

Once the victim launched the counterfeit application, it used PowerShell to add exclusions for folders in the user profile, reducing Microsoft Defender visibility over the area where malicious files were staged.

The initial loader then used DLL sideloading, a method that makes a legitimate program load a harmful supporting file. This allowed the code to run in the context of a signed Java Chromium Embedded Framework helper.

The mismatch between the displayed application name and the program’s internal details was a valuable warning sign.

The malware also created a logon-triggered task with elevated privileges while disguising it as a browser updater. That task called a second loader from a user-writable roaming folder, allowing the infection to return after a reboot.

Abuse of native scheduling features remains a proven way to retain access, as shown in reports on Windows scheduled task abuse.

CyberProof’s investigation found that the operators avoided a conventional command server. Instead, the malware relied on EtherHiding, retrieving encrypted connection details from Ethereum blockchain data.

That approach can make takedowns harder because the attacker can rotate infrastructure without relying on one fixed domain or server.

Containment Needs Full Response

Researchers stressed that removing a visible task or one malicious file is not enough when remote-access malware has executed.

In the observed incident, responders isolated the device, removed unauthorized Defender exclusions, revoked user sessions, reset credentials, and reimaged the endpoint. They also reviewed identity and access activity to check whether stolen credentials had been used elsewhere.

Defenders should investigate newly created high-privilege tasks that launch software from Downloads, AppData, or other user-controlled locations.

They should also flag new antivirus exclusions made soon after a download and inspect unexpected library loads outside normal program folders. Similar chains that combine spoofed software and library loading have appeared in AsyncRAT fake installer campaigns.

Organizations can reduce exposure by directing staff to approved software channels and restricting local installation rights where practical. Search advertisements for developer and AI tools deserve extra caution, even when the landing page looks legitimate.

Monitoring browser-originated downloads, scheduler changes, security-setting changes, and blockchain RPC traffic together can help teams recognize the full attack rather than treating each alert as an isolated event.

That broader view is important when attackers intentionally spread their activity across several ordinary Windows features.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
File name	ClaudeDesktop.exe	Initial trojanized loader
File metadata	JCEF Helper / jcef_helper.exe	Internal metadata associated with the fake loader
File name	DockerDesktop.exe	Staged loader used for reboot persistence
File name	libcef.dll	VMProtect-packed DLL used in the sideloading chain
File name	tempdir.dll	DLL name included in the hunting logic for suspicious sideloading activity
File name	Claude.exe	Suspicious installer-related file name included in hunting logic
File name	ClaudeSetup.exe	Suspicious installer-related file name included in hunting logic
File name	Docker Desktop.exe	Suspicious installer-related file name included in hunting logic
File path	AppData\Roaming\EdgeUpdate-1b4adb1f\	User-writable staging directory
Scheduled task	MicrosoftEdgeUpdate	Disguised logon persistence task configured with elevated privileges
Domain	downloading-api.it.com	Malvertising download infrastructure
Domain	neeitoerw[.]my	Suspicious domain observed in the process lineage
IP address	153.75.84.173	Network infrastructure observed in the process lineage
URL pattern	claude[.]ai/public/artifacts/[id]	Masqueraded lure artifact page
URL / domain	download-app.us	Suspicious origin included in hunting logic
URL / domain	claude-desktop.gitlab.io	Suspicious origin included in hunting logic
URL / domain	claude.ai.download-app.us	Suspicious origin included in hunting logic
URL path	it.com/html/claude/win	Suspicious origin included in hunting logic
Domain	claude-code-cmd.squarespace.com	Suspicious origin included in hunting logic
URL path	code.claude.ai/download	Suspicious origin included in hunting logic
Domain	install-files.com	Suspicious origin included in hunting logic
Keyword	claude-code	Suspicious origin keyword included in hunting logic
Keyword	claude-desktop	Suspicious origin keyword included in hunting logic
SHA-256	f8acb8f5...	Partial hash of the initial payload, as published in the source report

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post Hackers Use Fake Claude Desktop App to Disable Defender and Install Remote Access Malware appeared first on Cyber Security News.

GitLab flaw CVE-2026-19478 is now under active exploitation, allowing unauthenticated attackers to modify or delete public projects.

WatchTowr researchers warn of active exploitation of critical GitLab flaw CVE-2026-19478 (CVSS score of 9.4). This week, GitLab pushed out an emergency patch to address this flaw, which could let an attacker with zero credentials remotely modify or delete public projects and user data.

“GitLab has remediated an issue that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.” reads the advisory.

GitLab issued an emergency patch on August 17, five days after its regular update. The vulnerability impacts only self-managed installations, users should upgrade to versions  19.2.4, 19.1.6, 19.0.8, and 18.11.11.

There’s a gap worth flagging for anyone still sitting on an older release. The available patches don’t cover the 18.2 through 18.10 branches, even though those versions technically fall inside the affected range. If you’re running anything in that window, staying put isn’t really an option; you’ll need to upgrade to a patched branch entirely rather than waiting for a fix that isn’t coming for your current one.

hiimguardian reported the flaw through the company HackerOne bug bounty program.

Organizations should urgently patch internet-facing GitLab servers. Until they can update, they should restrict unauthenticated access to /api/graphql, disable public repositories where possible, and check logs for requests containing @gl_introduced.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CVE-2026-19478)

Cybercriminals are abusing interest in generative AI to trick users into downloading malware. In a newly documented incident, a file posing as a Google Gemini installer delivered the Vidar information stealer, putting saved browser passwords and other sensitive data at risk.

The attack did not begin with a phishing email. Instead, it relied on a normal-looking software search and download path, showing how criminals can turn routine searches for AI tools into a route for credential theft.

The tactic mirrors recent campaigns that used fake AI installers and search manipulation to distribute password-stealing malware. Hackers using fake Claude pages have similarly shown how convincing AI-themed downloads can mislead users.

Analysts from Darktrace identified the activity in July 2026 within a customer environment in the Europe, Middle East and Africa region.

Darktrace said in a report shared with Cyber Security News (CSN) that they linked the suspicious executable to Vidar after detecting unusual process behavior, outbound connections, and signs that browser credentials were being collected.

The case highlights a wider shift in malware delivery. Attackers are increasingly placing harmful files behind familiar names, trusted cloud services, and popular AI brands, betting that users will lower their guard when a download appears connected to a well-known platform.

Hackers Use Fake Google Gemini Installer

The infection chain began when a user launched a file named Download_Google_Gemini_For_Windows.exe from the Downloads folder.

Darktrace found that searches for the filename led to a Google Colab page containing a download prompt, giving the campaign an appearance of legitimacy.

Google Colab is commonly used by developers and researchers, which made it a useful staging point for the lure.

The page redirected visitors to a second website posing as a “Windows Software Hub,” where the fake Gemini installer was offered for download. 

The investigation did not recover HTTP or file-download telemetry that conclusively established the initial download source.

However, encrypted sessions with Google Colab occurred immediately before the executable launched, strongly suggesting that the user interacted with the hosted resource before reaching the secondary download site.

At the time researchers reviewed the activity, the Colab page remained active and offered a ZIP archive containing the malicious binary.

It also included a README file that told users to run the program with administrator rights and add it to antivirus exception lists, a clear warning sign that the instructions were designed to weaken normal defenses.

Once executed, the program was identified as a newer Go-compiled Vidar variant. It communicated with infrastructure associated with Telegram and connected to suspicious external systems over port 443. This behavior helped investigators connect the fake installer to the wider credential-stealing operation.

The campaign shows why trusted hosting alone cannot validate a download. Similar risks have emerged as attackers weaponize AI interest through cloned repositories, misleading setup guides, and harmful archives.

A recent fake AI tool campaign also demonstrated how attackers can exploit trusted-looking developer resources to distribute stealers.

Browser Credentials and Response

Vidar is built to collect valuable information from infected devices. In this incident, later endpoint alerts confirmed activity consistent with theft of browser credentials and other sensitive data.

Saved passwords, browser-based session data, and related information can give attackers access to email, business services, or personal accounts without needing to guess a password.

The affected device contacted an external IP address shortly after the fake installer ran. Researchers also identified a related IP through SSL certificate analysis, along with a command-and-control domain connected to the activity. 

Darktrace contained the incident by blocking communications with suspicious infrastructure and quarantining the compromised endpoint.

The response was triggered by behavior that did not match the device’s normal activity, rather than by the apparent legitimacy of the installer or the hosting platform.

For organizations, the practical lesson is to treat AI software downloads with the same caution applied to any other application.

Users should obtain Gemini-related tools only from verified official sources, avoid search-result downloads that lead through unfamiliar pages, and never follow instructions to disable or exclude antivirus protection.

Security teams should also investigate unusual browser credential access, new executables launched from Downloads folders, and rare encrypted connections from recently installed programs.

These controls are especially important as SEO poisoning Gemini campaigns continue to use convincing search results and false installation guidance to target users.

The campaign relied on a fake Gemini installer, trusted-platform abuse, and social engineering to deliver an established information stealer through a more convincing route.

The broader risk is not limited to one malware family: attackers are now treating the demand for AI tools as a dependable lure for credential theft.

Indicators of compromise (IoCs):-

Type	Indicator	Description
File	Download_Google_Gemini_For_Windows.exe	Fake Gemini-themed installer observed during the investigation
File	GoogleAppInstaller.exe	Related executable identified through endpoint telemetry
IP Address	91.98.98[.]86	External destination contacted by the malicious executable
IP Address	91.98.111[.]49	Related infrastructure identified through SSL certificate pivoting
Domain	dtm[.]kijangturbo88[.]top	Command-and-control endpoint identified during malware analysis
SHA-256	1e13c2c9eac72daf63fd00a9946878949e159ae6ec51b54ec64f942d79d61913	Malware sample associated with the fake Gemini installer

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post Hackers Use Fake Google Gemini Installer to Deploy Vidar Stealer and Steal Browser Credentials appeared first on Cyber Security News.

Hackers are exploiting a macOS Screen Sharing flaw to gain root access and install Monero miners on Macs with port 5900 exposed online.

The Dutch National Cyber Security Centre confirmed active exploitation of a critical macOS authentication flaw, tracked as CVE-2026-65400 (CVSS score of 9.8), less than two weeks after Apple shipped the fix.

The bug sits in macOS’s built-in Screen Sharing feature, the remote desktop tool baked into every Mac. Apple’s fix improved how the system manages authentication state, closing a gap that let attackers on the network authenticate to Screen Sharing without valid credentials at all.

Apple patched this issue with the release of  macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9, crediting researcher Alfredo Pesoli (@__rev) at Bynario Atlas (bynar.io) for the discovery.

“An attacker on the network may be able to authenticate to Screen Sharing without valid credentials” reads the advisory.

That’s a fast, coordinated fix by industry standards. It just wasn’t fast enough to beat whoever started scanning for exposed systems.

NCSC-NL says it received reports of active abuse hitting multiple systems where port 5900, the port Screen Sharing runs on, was reachable directly from the internet.

“The vulnerability concerns an authentication issue in the Screen Sharing functionality where network attackers can gain access without valid credentials. This is made possible by insufficient state management during the authentication process. As a result, unauthorized individuals can perform authentication attempts that would normally not be accepted.” reads the advisory. “The NCSC has received a security advisory indicating that active exploitation of this vulnerability has been observed on multiple systems where port 5900 was accessible from the internet. In all these cases, root access was obtained on the affected system and a Monero crypto miner was placed.”

In every case documented so far, attackers gained root access and dropped a Monero cryptocurrency miner on the compromised machine. Cryptomining is a relatively boring payload compared to what root access on a Mac could actually enable, which makes this look more like opportunistic scanning than a targeted campaign, for now.

This flaw sits in the same source code file as two other Screen Sharing bugs Apple patched a month earlier in macOS 26.6, one of them a genuinely pre-authentication flaw that a researcher going by @osxreverser described needing nothing but a target’s IP address to exploit, no password, no username, nothing.

That researcher claimed to have found around 40,000 exposed Screen Sharing hosts on the internet during a scan, nearly half of them in the US, spanning residential connections, university networks, and at least a few corporate servers.

What ties both bugs together is how mechanically simple they are to trigger. Security firm Calif, which analyzed the flaws, found no memory corruption, no exploitation trickery, no race condition to win, just logic errors that let a couple of correctly ordered packets walk straight past authentication. Calif also said it built a working exploit for both vulnerabilities in about four hours using an AI coding agent, which is the detail that should worry defenders more than the Monero miner itself: the gap between a patch note and a working exploit keeps shrinking, and it’s shrinking because building the exploit barely takes effort anymore.

If you’re running a Mac with Screen Sharing enabled and haven’t updated yet, do it now rather than after finishing this article. And if updating isn’t possible immediately, turn Screen Sharing off entirely under General, Sharing, until you can; leaving port 5900 open to the internet at this point is less a risk than an open invitation.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Monero)

Lazarus targets defense professionals with fake Lockheed Martin jobs, exploiting a Windows zero-day to deploy backdoors and evade security controls.

Check Point Research has uncovered a new wave of Operation Dream Job, the long-running North Korean campaign that lures defense and aerospace professionals with convincing fake job offers. This iteration is more dangerous than previous versions: it includes a previously unknown Windows vulnerability now patched as CVE-2026-68820, a newly documented backdoor called Troy, and command infrastructure built almost entirely from legitimate servers the attackers didn’t build, they hijacked them. Targets confirmed in France, Germany, Brazil, and India.

“The attackers used a previously unknown vulnerability in Windows (CVE-2026-68820) to gain full control of infected computers and evade EDR visibility. Check Point reported the issue to Microsoft, which released a fix before this research was published” reads the report published by Check Point Research. “Rather than running their own servers, the attackers are hijacking legitimate but compromised websites and webmail servers to relay commands, making the malicious traffic harder to distinguish from normal activity”

The vulnerability, CVE-2026-68820, is the same actively exploited zero-day that Microsoft patched on August 11 as part of Patch Tuesday, a privilege escalation flaw in AFD.sys, the kernel driver underlying Windows Sockets. Check Point reported the issue to Microsoft on July 28, Microsoft confirmed it three days later, and the fix shipped two weeks after that. The zero-day in this campaign and the zero-day under active exploitation are the same bug.

The attack runs through two parallel infection chains. In the first, victims download an encrypted archive containing a legitimate signed PDF viewer and a malicious DLL. The DLL displays a convincing Lockheed Martin job description while silently loading MISTPEN, a lightweight downloader that communicates through Microsoft Graph API and OneDrive. MISTPEN then runs reconnaissance modules, triggers the AFD.sys exploit to achieve SYSTEM privileges, and deploys ForestTiger, a well-documented Lazarus backdoor, along with an updated version of the group’s kernel-mode rootkit, FudModule 3.1, which can now tamper with Windows Smart App Control to bypass software verification.

“The second chain is more recent and shares several characteristics with a campaign described by ESET against the UAV sector in 2025. Victims are instructed to download SecurityPDF, a trojanized PDF viewer, from one of several websites impersonating Enveil, a legitimate privacy technology company with no actual connection to the attack. Once installed, the modified viewer inspects any PDF opened through it for a hidden marker.” continues the report. “When the marker is present, the application decrypts and launches an embedded payload that loads the Troy backdoor directly into memory.”

Troy is a single DLL implant that supports 17 operator commands covering file operations, shell access, process termination, in-memory DLL injection, and configuration updates. Its name comes from a PDB path embedded in the binary that Check Point also observed in earlier Lazarus samples. Enveil has no connection to the campaign; its brand was simply borrowed because it sounds credible to defense sector professionals.

The C2 infrastructure is built from compromised Roundcube webmail installations and WordPress sites, many vulnerable to CVE-2025-49113, infected with a previously undocumented PHP webshell called RelayShell. RelayShell functions as a relay rather than a traditional backdoor, exchanging commands and responses through simple text files. In at least one confirmed case, an already-breached French organization was used to send phishing messages to new victims — the attackers borrowed the company’s reputation to get past filters. Check Point identified at least 17 unique server identifiers in this relay network, with operators connecting through commercial VPNs to further obscure their location.

The most urgent action is applying the August 2026 Patch Tuesday update, which contains the CVE-2026-68820 fix. For organizations running public-facing Roundcube or CMS installations, the secondary risk is becoming part of the relay infrastructure rather than the intended target: the servers used in this campaign were compromised through leaked credentials and a known unpatched vulnerability, not anything exotic. The full indicators of compromise are in Check Point’s report.

“Given the combination of a zero day vulnerability that now have a patch, a new modular backdoor, and web based infrastructure designed to resemble legitimate traffic, security teams in these sectors should prioritize the August Patch Tuesday update, review the indicators of compromise published in Check Point Research publication, and apply the same level of scrutiny to unsolicited recruiting outreach that they would apply to any unverified download request.” concludes the report.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Lazarus)

Kimwolf v7 is raising the stakes for attacks launched from everyday Android TV boxes and set-top devices.

The latest version can make disruptive web traffic look more like a real visitor browsing a site, making defensive filtering harder at a critical moment.

The botnet has been active under related names since 2024, moving from Linux internet-connected devices to Android targets in 2025.

It reaches exposed Android Debug Bridge services through residential proxy networks, allowing attackers to install malware without authentication.

Unit 42 said in a report shared with Cyber Security News (CSN) that the new build was found on February 3, 2026.

The finding follows a period in which Kimwolf had already drawn attention for the scale of its Android infections, detailed in this earlier Kimwolf Android infection report.

The risk is not limited to a single household device. Each compromised box can be directed to send traffic at a chosen target, while its owner may see little obvious sign of misuse.

That large, distributed pool has made the wider family a serious DDoS concern, as shown by the Aisuru record DDoS attack.

Kimwolf v7 Botnet Uses Chrome Browser Fingerprints

Kimwolf v7 introduces an HTTP/2 flood that builds full Chrome-like browser fingerprints before sending requests.

In practice, it copies details that websites normally expect from a browser, including the pattern of request headers, instead of relying on plainly artificial traffic.

That change matters because many defenses look for unusual or incomplete requests when deciding what to block.

When malicious requests better resemble ordinary browsing, operators face a tougher balance between stopping an attack and accidentally interrupting real visitors.

The malware uses an HTTP/2 library to generate this traffic and retains a broader set of 15 denial-of-service methods.

It also includes a performance-tuned UDP flood designed for the ARM processors common in TV hardware, widening the ways infected devices can be used.

This is not simply a larger stream of junk requests. By borrowing the appearance of a popular browser, the botnet tries to blend into the same application layer that online stores, public services and media sites depend on.

Defenders need to assess patterns across many requests, rather than trusting a single header or connection detail.

Kimwolf v7 appears more focused than earlier builds. Researchers found that scanning, exploitation and password-guessing features were removed, suggesting the group may now depend on separate tools for infections while the bot handles attacks and traffic relaying.

Resilient Control Infrastructure

The operators also rebuilt the botnet’s command system to better withstand takedowns.

Kimwolf can query Ethereum Name Service records through several public blockchain endpoints, use an apparent operator-controlled relay, and fall back to a Tor hidden service if its normal route fails.

All command traffic passes through a local proxy component, making it easier to change routing without replacing the main bot.

The design reflects a response to disruptions in December 2025 and adds layers that can delay efforts to cut infected devices off from their controllers.

Network teams should avoid blocking shared blockchain services wholesale, because legitimate users may need them.

Instead, they should investigate unexpected connections from device types that have no normal reason to use those services, correlate them with proxy activity, and preserve logs that can reveal whether a device is part of a coordinated campaign.

For defenders, the most useful warning signs are unusual blockchain service connections from Android or IoT hardware, Tor or SOCKS proxy activity, and suspicious local proxy behaviour.

Administrators should isolate Android TV devices from business networks and disable ADB or limit it to USB-only use, which removes the main infection path.

This is especially relevant for organisations that treat streaming boxes as harmless appliances.

The reported Kimwolf operator arrest case shows the law-enforcement pressure around the botnet, but the technical changes show why device owners still need to act.

Reviewing the broader Android TV botnet risks can help teams spot similar exposure before it becomes an incident.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
SHA-256	406647de09a0ffa279756b4ccb344b1b76a333320c5b50fd367901fa006cf0ff	Kimwolf v7 ARM ELF baseline payload
MD5	d759364844d78a728505fb0485c3adbc	MD5 for the baseline payload
SHA-256	345222bca004595977f971d76900b0c65fd9bf9d91c50cd0c5bf5a93f1ad9e49	Kimwolf v7 ARM ELF payload
MD5	036bcb62be72c4663b9564955f93b05f	MD5 for the associated ELF payload
SHA-256	2ec2e85b0358e0c681cb5067489a9086ec97dbbf7e3c952dd9cd496b319d5af5	Kimwolf v7 ELF payload containing the operator-linked RPC subdomain
MD5	33faca1e0090f6b12eff703daf4606e4	MD5 for the associated ELF payload
SHA-256	951c94809aa6c7ab587125f9d4df30fa6a49ee0cbba76a4b7ceedaaa0e5dcd36	Kimwolf Android APK masquerading as a system log service
SHA-256	f07821e313c16cbbd82def45094a22c8d474164051bdbc7648d6869e012014b4	Related Kimwolf Android APK sample
VHash	76554ad09897ac723a850eaf8c525efa	Structural hash shared by Kimwolf v7 ELF samples
SHA-1 certificate	2a1d96f1b066877812587ac94f45f82dfff5f5f9	Self-signed APK signing certificate
SHA-256 TLS certificate	f3e8a55a2a3ea7c7b6676e90f4f49a2c55b13065b68ee50c51cc35fe2b5c3237	Certificate associated with the RPC infrastructure
SHA-256	9470c68f9b6fe5f90d61891b95623afd7b4298815b0f95e25610e1c09008dc24	ARM payload associated with the first dropped ELF filename
SHA-256	8242443dfcec66e3fe04cbfa2fbd211ad34065ee07aa93813d792a437caab212	ARM payload associated with the second dropped ELF filename
SHA-256	421111a57b0a4224c052fa4108d90429d579974b5b5111ed2e58516ba09422ca	x86 payload associated with the version-one dropped ELF filename
File name	libn[redacted]kernel.so	Dropped ARM and x86 Kimwolf kernel payload filename
File name	libdevice.so	Dropped ARM Kimwolf kernel payload filename
File name	libcow.so	Filename used by an earlier x86 sample
Process name	netd_service	Process name used by the v7 ELF payload for masquerading
Process name	TVHelper	Process name used by the libdevice.so variant
Android package	com.android.logcatd	Package name used by identified Kimwolf Android APKs
Domain	rpcuniverse[.]com	Infrastructure domain linked to the suspected operator-controlled RPC service
Domain	eth.rpcuniverse[.]com	RPC subdomain hard-coded in a Kimwolf sample
Domain	avax.rpcuniverse[.]com	Subdomain resolving to the associated infrastructure host
URL	hxxps[:]//0xrpc[.]io/eth	Public Ethereum RPC endpoint queried by the malware
URL	hxxps[:]//eth.llamarpc[.]com	Public Ethereum RPC endpoint queried by the malware
URL	hxxps[:]//ethereum-rpc.publicnode[.]com	Public Ethereum RPC endpoint queried by the malware
URL	hxxps[:]//eth-protect.rpc.blxrbdn[.]com	Public Ethereum RPC endpoint queried by the malware
URL	hxxps[:]//eth.merkle[.]io	Public Ethereum RPC endpoint queried by the malware
IP address	23.94.221[.]104	Host associated with the RPC infrastructure and contacted by ELF and APK samples
IP address:port	212.193.31[.]158:443	HTTPS command-and-control traffic
IP address:port	212.193.31[.]119:13	Command-and-control traffic
IP address:port	212.193.31[.]122:13	Command-and-control traffic
IP address	212.193.31[.]102	Command-and-control host linked through a shared SSH host key
IP address:port	212.193.31[.]92:443	HTTPS command-and-control traffic
Local proxy	127.0.0[.]1:23075	Local proxy endpoint used to route command traffic
Tor hidden service	edctgwib2n5l34t525zkxqzk5bqb6e5il2yiq5r6zu7gtlxa4uosn3qd[.]onion	Kimwolf v7 command-and-control fallback

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world

The post Kimwolf v7 Botnet Uses Chrome Browser Fingerprints to Hide HTTP/2 DDoS Attacks appeared first on Cyber Security News.

DeadLock ransomware has emerged as a financially motivated threat that locks files while threatening to publish stolen information.

First observed in July 2025, it had listed more than 80 alleged victims on its leak site by July 2026, with over half in Europe.

The reported victim count demonstrates both broad sector exposure and a steady public-pressure campaign intended to turn operational disruption into payment.

The operation has affected organisations in IT, mining, transport, manufacturing, hospitality, consumer goods, and other sectors across six continents.

Microsoft analysts identified DeadLock as a Rust-based encryptor whose operators pair double extortion with unusually durable communications.

Researchers did not name one initial-access method, but the malware can target a chosen directory, request administrator approval, and disrupt tools that could slow encryption.

The impact goes beyond inaccessible files. DeadLock deletes recovery material, targets backup, security, remote-access and cloud-sync processes, clears event logging, and leaves victims with a browser-based recovery page.

Researchers at Microsoft said in a report shared with Cyber Security News (CSN) that all these actions can delay containment when defenders need evidence and working backups most.

DeadLock Ransomware Stores C2 Configuration on Polygon Blockchain

DeadLock’s standout feature is the way its recovery page uses Polygon blockchain smart contracts as a configuration store.

Instead of embedding one server address or relying on a domain that can be seized, the page makes read-only requests to retrieve the current proxy address and the group’s blog content.

Two contracts support this design: one provides the chat proxy location and another stores leak-blog posts. The page can rotate among six public Polygon RPC services, so one failed provider does not necessarily cut off access.

This echoes the wider trend covered in blockchain C2 infrastructure analysis, where attackers use a public ledger as a hard-to-remove lookup point.

That design changes, rather than eliminates, the takedown problem. Operators can update the proxy URL on-chain without redistributing the HTML page, while contract-hosted posts resist ordinary web-hosting removal.

Yet the system still depends on a reachable RPC service, the active proxy, and off-chain storage for images and stolen files.

The page routes victim messages through the Session network, which uses distributed, onion-routed messaging.

It also contains a file browser for material hosted through Wasabi-compatible storage. For defenders, blocking one website may not end communications, a lesson also illustrated by Ethereum hidden command servers.

Encryption and Defensive Priorities

DeadLock tries to keep a compromised system usable enough for the extortion process.

It pauses new encryption work when memory use rises above 29% or CPU load exceeds 70%, while using twice the number of CPU cores for directory-processing threads. That restraint can make activity less obvious, even as files become unusable.

Each file receives a separate encryption key, and larger files may be encrypted only in selected blocks to speed the attack.

Encrypted items gain a .dlock extension, while text notes and an HTML recovery chat direct victims toward the operators. The approach reinforces why ransomware response planning guidance must cover data protection and rapid isolation.

Organisations should maintain strong credential hygiene, harden systems, enable cloud-delivered protection or an equivalent, and use tamper protections so attackers cannot simply stop security services.

Teams should also protect backups, review suspicious use of PSExec and WMI, and test controls before an incident.

Endpoint detection configured to block malicious activity can help contain an intrusion, while strict folder protections can limit unauthorised writes to valuable data. The value of quick containment is clear in ransomware attack isolation case.

DeadLock shows that ransomware disruption now requires more than domain blocking.

Security teams need visibility on endpoints and outbound connections to public blockchain services, tested recovery procedures, and rehearsed incident-response decisions.

Early detection matters because the malware’s cleanup and logging changes can rapidly reduce evidence available to investigators.

Indicators of compromise (IoCs):-

Type	Indicator	Description
SHA-256	a1fdf65020ce4a0f0940c793c6425baf8a0b994ec48b9baaf72788661a9d29f4	DeadLock ransomware encryptor
URL	deadlock.liveblog365[.]com	Leak site domain
URL	dlock.liveblog365[.]com	Leak site domain
URL	deadblogdbdu5wprek7wa2o4ce7rnt6u6ntqeud3hzjjcveosgpsqqqd[.]onion	Leak site domain
URL	deadlockblog.great-site[.]net	Leak site domain
URL	deadlockblog.medianewsonline[.]com	Leak site domain

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world

The post DeadLock Ransomware Stores C2 Configuration on Polygon Blockchain to Resist Takedowns appeared first on Cyber Security News.

A new remote access trojan called Abyssos lets attackers control infected Windows systems.

The malware can steal credentials, collect files, and open remote viewing sessions, while its modular design allows operators to add functions after an infection.

Abyssos appeared in late June 2026 and remains in development. Its operators can issue commands through an encrypted connection, gather details about the victim computer, and retrieve modules.

The research does not identify a confirmed initial delivery method, leaving the campaign’s entry point unclear. No specific lure or exploit was identified. Researchers at Zscaler identified the malware and tracked it as Abyssos.

Zscaler said in a report shared with Cyber Security News (CSN) that they found several versions and changing protections, suggesting the developers are actively refining it to make analysis and detection more difficult.

The immediate risk is broad access rather than one action. An intruder with control of an affected machine could search files, collect browser data, record the screen, run commands, or move toward more valuable accounts and systems.

That combination echoes concerns raised by recent RAT remote control, where a single foothold can support surveillance and theft.

Abyssos RAT Includes RDPWrap-Related Module

One addition is a module named RDPWRAP, which Zscaler said may be related to the open-source rdpwrap library.

Remote Desktop Protocol lets users operate Windows machines remotely. A tool connected to that function can extend attacker access after compromise.

When instructed by its command server, Abyssos writes the module into the Windows temporary folder under a randomly generated name beginning with “rdp.”

It then runs exports called abyss and GetRdpWrapText, returning any output to the operator. The module is encrypted with AES-CBC before delivery, adding another obstacle for defenders examining network traffic or files.

The report does not say that the module automatically grants unrestricted Remote Desktop access on every victim. Still, its presence points to an effort to broaden what the malware can do on a compromised device.

The development is especially relevant as hidden remote desktop attacks show how remote-control features can be combined with credential theft to keep intrusions quiet.

Abyssos already supports hidden VNC sessions, screen recording, remote shells, file transfers, and process management.

The RDPWRAP-related capability sits alongside those functions, giving operators another possible route for interacting with a victim system. This mix can turn a basic infection into a long-running access point that is harder to investigate.

Modular Design Supports Theft

Abyssos uses a custom TCP protocol and AES-GCM encryption for most communications with its command-and-control server.

After starting, it collects host details such as the computer name, user name, privileges, Windows version, public IP address, and location, then sends that information to register the device.

Its commands can copy, delete, archive, upload, and download files. It can also capture clipboard contents and keystrokes, retrieve screenshots, stop or restart processes, and execute downloaded programs.

One feature can open Chrome with remote debugging enabled and load stolen cookies, a method that may let criminals take over an already authenticated browser session.

The malware can download modules for keylogging, Chrome and Firefox credential recovery, cookie collection, domain-controller discovery, vulnerability scanning, and attempts to raise privileges.

Such expandable toolsets resemble the danger in fileless loader evasion tactics, because security teams may face a changing set of capabilities instead of one fixed malicious file.

Abyssos also tries to frustrate analysts. Some samples check for virtual machines and common analysis processes, then stop if they find them.

The code uses control-flow changes, encrypted values, and hidden strings, although the newest version reviewed did not include all of these checks.

The malware is a post-compromise framework with file-system access and expandable modules.

Organizations investigating suspicious Windows activity should look for unexpected remote-control behavior, temporary-folder modules, and unusual encrypted outbound connections, while treating possible cookie theft as an account-security incident.

The wider lesson from browser cookie theft risks is that changing a password alone may not end an attacker’s active session.

Indicators of compromise (IoCs):-

Type	Indicator	Description
SHA-256	52b400c5be1557a8df146f62fde76d906e7e0a92ed76788717ef61c758f315aa	Abyssos sample version 2.4F
IP address	213[.]145.86.42	Abyssos command-and-control server
SHA-256	ca94d95413210a2a325155740eb8a5c58627ad5c4e704478621e7fc8165fe173	Abyssos sample version 2.1F
IP address	209[.]99.184.223	Abyssos command-and-control server
File name	windows_update_cache.json	Hardcoded temporary-folder file used to store captured keystrokes
Mutex	Global\\68AA60E5-6C45-4C01-9F0E-E25FC57C652F	Example Abyssos mutex format observed in the analysis

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world

The post Abyssos RAT Includes RDPWrap-Related Module for Expanded Remote Access appeared first on Cyber Security News.

Brown Health Medical Group-MA breach exposed personal, medical, and financial data of over 311,000 individuals after hackers accessed its servers.

Brown Health Medical Group-MA data breach exposed personal, medical, and financial data of over 311,000 individuals after hackers accessed its servers.

The healthcare group identified a data security breach involving a legacy file server on December 16, 2025 and launched an investigation into the incident that found unauthorized access occurred between December 15–16, 2025. The organization immediately isolated the affected server. According to the notification letter, the security breach did not impact the electronic health record system.

The organization determined the potential scope of exposed data on June 22, 2026, and notified affected individuals as a precaution.

“We first became aware of a data security incident impacting a historic file server at the Practice on December 16, 2025. We immediately initiated an investigation and isolated the server. Through our investigation, we determined that the unauthorized access to the server occurred between December 15–16, 2025. This incident did not impact the Practice’s electronic health record system.” reads the data breach notification letter.

The compromised information may include personal details, employment and HR records, medical or disability-related information, government identification numbers, payment card data, and financial account information. Not all data categories were affected for every individual.

“Due to the nature of the incident, we have been unable to conclusively determine exactly what information was impacted. However, on June 22, 2026, we determined the scope of personal information that may have been impacted by this incident, and we are providing this notice out of an abundance of caution.” continues the letter.”The following are the categories of information that may have been impacted: demographic information (such as name, date of birth, and contact information); personnel and human resources records (such as compensation or payroll information, licensure or credentialing information, and medical or disability-related records); and other personal information (such as Social Security numbers, driver’s license numbers or other government-issued identification numbers, credit or debit card numbers, and financial account information). Not all categories of information were impacted for all individuals.”

The Practice stated that it is taking steps to address the incident, including employee retraining, additional security measures, and cooperation with law enforcement. It also offered affected individuals two years of free identity protection and fraud monitoring services through Experian IdentityWorks, while advising them to monitor financial accounts for suspicious activity.

Brown Health Medical Group-MA reported the breach to the U.S. HHS revealing that 311,760 individuals were impacted.

At this time, no ransomware group has claimed responsibility for the attack.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Brown Health Medical Group-MA)

SMOKE#SCREEN uses fake Zoom updates to install ScreenConnect RMM, giving attackers persistent remote access while bypassing defenses.

Securonix Threat Research has been tracking an active multi-wave campaign they’ve named SMOKE#SCREEN, in which unknown attackers use rotating social engineering lures, fake Zoom updates, Adobe software notices, business document reviews, system maintenance utilities, to silently install ConnectWise ScreenConnect on victim machines.

ScreenConnect is a legitimate remote monitoring and management tool used by IT teams worldwide. Once installed, it gives the attacker persistent full remote access that looks exactly like authorized IT activity. That’s the point.

“The campaign relies on a toolkit of VBScript droppers, batch file loaders, compiled .NET executables and a HTML phishing page, all ultimately pointing to a live WsgiDAV-based staging server at 207.174.0.143:8080.” reads the report published by Securonix. “Victims who execute any of the initial access files end up with a fully functional ScreenConnect agent silently installed and beaconing to one of three attacker-controlled relay servers, providing the threat actor with persistent, legitimate-looking remote access to compromised hosts.”

Researchers found a live server hosting the malicious files, while frequent payload changes help attackers avoid detection based only on file hashes.

Securonix found the staging server by following a single VBScript dropper named zoom-update.vbs, and when they looked at it, the entire directory was openly browsable, exposing 15 payload files. The same IP address (207.174.0[.]143) that hosts the staging server also runs the primary ScreenConnect relay on port 8041. One machine delivering payloads and maintaining remote control over already-compromised hosts. Efficient.

The campaign has evolved significantly since its earliest samples, and tracking that evolution tells you more about the attacker than any single sample would. The first VBScript dropper used XOR encryption, a state machine execution flow to confuse static analysis, junk arithmetic operations to alter byte signatures between builds, and environment checks that abort if the machine has less than 2 GB of RAM or runs analysis tools like Wireshark or Process Monitor.

The third sample abandoned all that subtlety and went fully aggressive: a batch file that disables AMSI via memory patching, re-launches itself with a UAC prompt disguised as a system maintenance tool, kills SmartScreen through registry modifications, adds the entire C:\ drive as a Defender exclusion path, stops and permanently disables the WinDefend service, and strips the Zone.Identifier stream from the downloaded MSI before running it silently.

“The actor’s delivery strategy has also rotated across multiple trusted hosting services. An early phishing page (zoom-update.html) delivers its payload via a Dropbox shared link, bypassing domain reputation filters since Dropbox is an allow-listed platform in most corporate environments. A compiled .NET loader (MemoryLoader.cs) references a Cloudflare Quick Tunnel (subscription-magnetic-recommended-meat.trycloudflare.com), a service designed for temporary local server exposure that is rarely monitored.” continues the report. “The staging server itself runs cloudflared.exe, confirming that the actor uses the Cloudflare binary directly on their infrastructure to generate these ephemeral tunnels.”

The researchers noted that the fake Zoom update HTML page is particularly polished: correct logo SVG, correct brand color hex code, a fake version number, urgency messaging about secure connections failing, and a JavaScript timer that triggers the download automatically after two seconds, no click required. The page then instructs the victim to run the downloaded MSI to complete the update. By the time they do, the attacker already has a relay waiting.

The most significant finding came when Securonix observed a major payload rotation mid-investigation. The actor replaced their aggressive MemoryLoader.cs, which executed a nine-step Defender destruction sequence within 15 seconds of execution, with a new loader.cs that takes the opposite approach: avoid detection entirely instead of destroying controls.

“The most revealing addition is an explicit comment in the source code:

// WAIT 3 MINUTES (Breaks Elastic correlation)

Thread.Sleep(180000);

The actor is deliberately introduced a 180-second delay between MSI installation and service start to break EDR event correlation windows, and they are targeting Elastic specifically.” continues the report. “This is direct evidence of adversary testing against commercial security products. The removal of the entire Defender destruction sequence strongly suggests those behavioral detections were working. The actor has pivoted from a “destroy the AV” to an “avoid the AV” strategy.

The removal of the Defender destruction sequence in the new version strongly suggests those behavioral detections were working. The attacker noticed, adapted, and published cleaner code. The campaign also has a macOS variant: ZoomUpdateInstaller.pkg connects to the same primary relay server as the Windows MSIs.

The final payload in every attack path is a legitimate ConnectWise-signed ScreenConnect MSI, signed with a valid DigiCert certificate chain.

“All MSI files are signed with a valid Authenticode certificate issued to Connectwise, LLC by DigiCert’s trusted root chain. This is the most significant evasion technique in the arsenal, many EDR products apply reduced scrutiny to binaries signed by recognized enterprise software vendors, and ScreenConnect in particular is a known legitimate RMM tool used by IT teams worldwide.” states Securonix.

“Once installed, each agent silently connects to its configured relay server with the URL parameters e=Access&y=Guest, presenting as a guest access connection. The threat actor uses the relay server to establish a remote desktop session with the victim’s machine.”

The practical detection guidance from Securonix focuses on behavior rather than signatures: alert on processes stopping WinDefend, adding C:\ as a Defender exclusion path, or installing MSIs from %TEMP% or AppData. Block unauthorized RMM tools connecting to raw IP addresses rather than vendor domains. And treat any ScreenConnect connection to an IP address rather than a ConnectWise subdomain as a red flag worth investigating immediately.

“The SMOKE#SCREEN campaign demonstrates a capable, actively maintained, and rapidly adapting threat actor who has built a diversified toolkit around a single objective: gaining persistent, legitimate-looking remote access to victim systems through weaponized ScreenConnect deployments.” concludes the report. “What makes this campaign particularly notable for defenders is the observable arc of the actor’s tradecraft. From cautious XOR-encrypted VBScript droppers to aggressive nine-step Defender destruction sequences and then, most recently, a pivot back to stealth with anti-EDR timing and self-contained encrypted bundles, the campaign reads like a real-time arms race between attacker and defender. “

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, SMOKE#SCREEN)

An alleged Ryuk ransomware member pleaded guilty in the U.S. for helping deploy attacks on American companies and faces up to 15 years in prison.

Armenian national Karen Serobovich Vardanyan (34) pleaded guilty in the U.S. for his role in Ryuk ransomware attacks targeting American organizations between 2019 and 2020. Extradited from Ukraine after his 2025 arrest, he admitted providing initial access to corporate networks that enabled ransomware deployment.

“An Armenian national extradited from Ukraine to the United States pleaded guilty yesterday for his role in Ryuk ransomware attacks and an extortion conspiracy targeting companies throughout the United States, including a technology company operating in Oregon.” reads the press release published by DoJ. “Karen Serobovich Vardanyan, 34, pleaded guilty to conspiracy and computer fraud.”

Between November 2019 and April 2020, Karen Vardanyan illegally accessed corporate networks and helped deploy Ryuk ransomware on hundreds of servers and workstations.

The attacks encrypted victims’ data and demanded Bitcoin payments in exchange for decryption keys. Among the victims were a Michigan company that paid 200 Bitcoin (worth over $1.1 million at the time), a company in Oregon, and a school in Texas. Overall, the group is believed to have collected around 1,610 Bitcoin, valued at more than $15 million when the ransoms were paid.

A U.S. federal grand jury indicted Vardanyan in February 2024 on conspiracy, computer fraud, and extortion charges. He faces up to 15 years in prison and will be sentenced on September 22, 2026. Under his plea agreement, he also agreed to pay more than $1.1 million in restitution.

According to a report published by Advanced-intel and HYAS in 2021, Ryuk was a highly profitable ransomware operation, generating an estimated $150 million in Bitcoin ransom payments. Researchers traced 61 wallet addresses linked to the group and identified laundering mechanisms involving brokers, intermediary wallets, and cryptocurrency exchanges such as Binance and Huobi. The operators used professional money-flow techniques and created unique ProtonMail addresses for each victim to improve operational security and avoid detection.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Ryuk ransomware)

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape

Malware Newsletter

Hijacked npm Packages Use Novel VSCode Autorun and Blockchain Dead Drops to Deploy a Credential/Crypto Stealer  

Building a CI/CD pipeline for Sigma rules  

Inside StegoAd: How a Threat Actor Evolved to Fuel Silent Ad Fraud and Credential Theft at Scale 

A Djinn in the Machine: TaskWeaver’s Node.js Intrusion Chain  

Chromium extension uses AI‑related branding to redirect browser search  

Mustang Panda targets India’s government and energy sectors with ZOHOMURK and MINIRECON  

RustDuck: An In-Depth Analysis of a Two-Stage Botnet  

From Langflow to Monero: Inside CVE-2026-33017 Cryptominer  

The SOC Files: ScreenConnect masked as freeware. An inside look at a large-scale campaign

Veil#Drop: Blogspot-Hosted PowerShell Loader Delivers PureLog Stealer Through XOR-Encoded In-Memory .NET Payloads

Analysis of Ongoing Ousaban Attacks Targeting the Iberian Peninsula    

Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique      

Popa: From Sourcing to Distribution  

From CitrixBleed 2 to Cloudflared: The Tools and Techniques Behind Anubis Ransomware Attacks      

ToddyCat: your hidden email assistant. Part 2 

PamStealer: a Rust-based macOS infostealer that validates credentials through PAM

Analysis of Ongoing Ousaban Attacks Targeting the Iberian Peninsula

JADEPUFFER: Agentic ransomware for automated database extortion        

Don’t Eat The ChocoPoCs! How Vulnerability Researchers Were Repeatedly Targeted By Trojanised Exploits

PolinRider: North Korea-Linked Supply Chain Campaign Expands Across Open Source Ecosystems      

Lazarus-Linked npm Malware Masquerades as Rollup Polyfills

Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malware

AI-Generated PowerShell Malware: An Experimental Framework and Dataset

A Lightweight Framework for Android Malware Detection via SDAE-Based Multi-View Static Feature Fusion

Addressing Data Scarcity in Malware Classification via Pixel-Level Synthetic Image Generation

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

81 Million Login Attempts, 78 Compromised Accounts: The LSHIY Password Spray Hitting Azure CLI

Huntress researchers have been tracking a massive automated password spray campaign against Microsoft Azure CLI environments since June 12, 2026.

A password spray attack is when attackers try a small number of common passwords across many accounts instead of many passwords on one account. This helps avoid lockouts while exploiting weak or reused passwords. It is often used in large-scale account takeover attempts.

In fourteen days, the attackers made over 81 million login attempts against Huntress customer accounts and successfully broke into 78 Microsoft accounts across 64 organizations. Last week the pace accelerated sharply: on June 22 alone, 30 user accounts across 23 businesses were compromised in a single day.

The traffic originates almost entirely from the IPv6 range 2a0a:d683::/32, controlled by LSHIY LLC, an internet infrastructure provider registered to AS32167.

“LSHIY operates to distinct ASNs: in addition to AS32167 (which was registered June 14, 2021), it also operates AS955 (registered June 22, 2022). Third parties report that the IPv6 ranges associated with both of these autonomous systems originate in China. Upon further investigation into this IPv6 range of interest, Huntress found specific IPv6 addresses in that range that were recent, including one from a maintainer created on June 11, 2026.” reads the report published by Huntress.

LSHIY lists business addresses at two factory buildings in Hong Kong and Wuhan, and one at a shared office rental space in New York. Huntress reported the activity through the company’s abuse channel, but it received no reply.

The attacker’s method is straightforward and effective. They replay old username and password combinations from breach data against the OAuth ROPC flow, the Resource Owner Password Credentials grant type, which sends credentials directly to the /token endpoint with no interactive MFA prompt.

“In the campaign, threat actors replayed validated credentials via the OAuth ROPC (Resource Owner Password Credentials) flow. ROPC is an OAuth 2.0 grant type that has been deprecated in OAuth 2.1. This auth flow takes a username/password at the /token endpoint for a tenant and mints a new user-delegated token once provided with the correct credentials.” continues the report. “This matters because many of the compromised businesses had implemented multi-factor authentication (MFA) via a Conditional Access Policy (CAP), but the MFA was not configured to cover this specific flow that attackers used. “

No MFA challenge fires because ROPC doesn’t support modern authentication flows, making it an effective bypass for organizations that haven’t specifically blocked it.

Here’s the part that should make every Microsoft 365 admin uncomfortable. Of the 23 businesses hit on June 22, 15 had MFA enforced via Conditional Access Policy. It didn’t help them.

“When analyzing the June 22 spike in attacks that impacted 23 businesses, we found that 15 of those companies had MFA implemented and enforced via CAP.” states the report.”However, while these organizations thought they were protected by MFA, the MFA did not fire for various reasons during this campaign.”

Some had MFA scoped to specific apps like Microsoft Admin Portals rather than all cloud apps. Others enforced MFA only for admin accounts, not regular users. Several triggered MFA only from untrusted locations, and the attacker’s IP addresses — inconsistently geolocated between China and Nebraska depending on the tool, slipped through the trusted location check. Two organizations had MFA in report-only mode, meaning it was set up but never enforced. Eight impacted businesses had no MFA policy at all.

The volume of this type of attack is not new but it’s growing fast. In the past six months, Huntress has seen credential spray attacks increase by over 155 times across its customer base, with a current mean of roughly 1,964 failed attempts per month per protected tenant. The targeting appears purely opportunistic, driven by which credentials appear most frequently in compromised password lists rather than by business sector or size.

The fix is not complicated but requires precision. Conditional Access Policies need to cover all users, all cloud apps, and all client app types without exceptions, partial coverage is what this campaign exploits. Enabling the userStrongAuthClientAuthNRequired setting enforces strong authentication at the client level and blocks ROPC flows outright. Restricting Azure CLI access for non-admin users removes another attack surface. And on the detection side, Huntress notes that triggering response based on spray volume alone points defenders at the most-sprayed and least-compromised tenants; prioritizing by credential validity is more effective.

“One glaring error here is that legacy protocols like ROPC can bypass some poorly-configured CAPs entirely since they don’t go through the authorization endpoint where policies are enforced. However, some of the other issues outlined above – such as misconfigured trusted locations or user groups – can also lead to gaps.” concludes the report.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, password spray campaign)

Microsoft warns of a phishing campaign targeting the hospitality sector with fake guest emails that install TonRAT using resilient persistence.

Microsoft Threat Intelligence published a detailed analysis on an ongoing hacking campaign against hospitality organizations that has been running since April 2026. The targets are specific: device names observed across compromised environments include strings like “reception,” “frontdesk,” “reservations,” “accueil,” “recepcja,” and “recepce” in English, French, Polish, Czech, and Spanish. The attacker knows exactly who opens guest-related emails without thinking twice about it.

The delivery mechanism is what Microsoft calls authentication laundering.

“The threat actor uses Calendly’s email notification system and Google’s URL redirect functionality to construct a multi-hop delivery chain in which the direct Calendly path passes Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC) checks.” reads the report published by Microsoft.

The emails arrive with the display name “Booking Manager (via Calendly)” and carry lures about bedbug infestations, health inspections, guest complaints, final warnings, and threatened suspensions. They came in Japanese, Danish, and Dutch, with Japanese the most common. The researchers observed that the messages have no recipient name, no property name which suggests this is high-volume list-driven sending, not tailored spearphishing.

Upon clicking the embedded link, the victim is routed through four hops: a Calendly redirect to share.google, then to www.google.com, then to a freshly registered Cloudflare-fronted .cfd domain sitting behind a Turnstile challenge. That challenge serves double duty as an anti-analysis gate and a geolocation filter before the payload lands. The downloaded archive contains a shortcut file named IMG-<numbers>.png.lnk in Wave 1 or PHOTO-<numbers>.png.lnk in Wave 2, both sized consistently between 1,989 and 2,079 bytes, suggesting the same builder tool across the campaign.

Opening the shortcut fires PowerShell. The script uses BigInt arithmetic to decode a download URL, a technique that evolved across seven distinct obfuscation phases over the course of the campaign.

“A defining characteristic of this campaign is its steady but disciplined obfuscation evolution. Microsoft observed seven PowerShell obfuscation phases over the course of the campaign, but the underlying logic remained consistent: decode embedded data through arithmetic operations, recover the next-stage content, and retrieve a PowerShell script that runs from the %TEMP% folder.” continues the report. “This pattern suggests that the threat actor is iterating for durability against static detections rather than experimenting with entirely new tradecraft. “

The operators never abandoned PowerShell or Node.js. They just kept re-skinning the same working loader as detections caught up.

The decoded script downloads a legitimate Node.js v24.13.0 runtime from nodejs.org into user space, then runs a JavaScript implant tracked as TonRAT from AppData\Local\Nodejs\. No system-wide Node installation is needed. Wave 2 added an intermediate stage: the downloaded PowerShell script triggers dynamic .NET DLL compilation through csc.exe and cvtres.exe, producing small 3,072-byte DLLs with random names before reaching Node.js. Microsoft assesses this step is preparatory or conditional, as the compiled DLL wasn’t observed being explicitly loaded in available telemetry.

The persistence design is what makes this campaign technically notable.

“The persistence design itself is a meaningful post-compromise observation. The combination of a durable Node.js launch point in HKCU\Run and a repeatedly refreshed ProgramData payload through HKCU\RunOnce suggests an effort to maintain execution options across user sign-ins while also preserving a secondary recovery path.” states Microsoft. “This RunOnce loop is unusual enough that it might provide defenders with a strong hunting pivot even when file names, domains, or script syntax change.”

The RunOnce entry doesn’t fire once and disappear: the payload refreshes its own persistence after each execution, creating a loop. Microsoft observed this in practice: Defender blocked the PE payload xmnrwv9l.exe on a confirmed compromised device, but the Node.js Run key survived. Two days later, the implant reactivated, reconnected to new C2 domains, and resumed pushing additional payloads. Blocking one path left the other alive.

Post-compromise activity on a subset of devices included C2 beaconing to fixed IPs over non-standard ports including 56001, 56002, 56003, 8443, 8445, 8453, and 5555. Some hosts showed headless browser automation with --headless --no-sandbox flags, a geolocation check via ip-api.com, and a forced shutdown through cmd /c shutdown -s -t 0.

The forced shutdown may have served to interrupt user activity, reduce defender response time at a specific stage, or conceal visible symptoms after automated browser tasks completed. Microsoft has not confirmed data theft, ransomware deployment, or named any victims. The campaign’s ultimate objective remains unclear, which is itself a useful piece of information: whoever built this invested heavily in persistence and evasion for something they haven’t shown yet.

Complete remediation requires removing both persistence mechanisms simultaneously: the HKCU\RunOnce entry pointing into ProgramData, the HKCU\Run key pointing to the Node.js component, the Node.js runtime itself, and all associated .js files under AppData\Local\Nodejs\. Start with reception, reservations, and front office systems, and treat any device where Node.js appears in user-space paths as potentially compromised until proven otherwise.

The report includes Indicators of compromise (IoCs) for this campaign.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, hospitality)

DirtyClone: a Linux kernel privilege escalation that silently rewrites executables in memory, leaving no disk trace. Patch now.

JFrog Security Research published a working exploit walkthrough on June 25 for CVE-2026-43503 (CVSS score of 8.8), a Linux kernel privilege escalation they call DirtyClone. It’s the fourth vulnerability in the DirtyFrag family, all sharing the same root failure: file-backed memory gets treated as packet data, and an in-place network operation writes where it should have copied. CVSSIf your kernel doesn’t have the May 21 mainline patch, update now.

“The severity of this issue is significant because it allows any unprivileged local user to gain root access (LPE) by manipulating the Linux page cache.” reads the report published by JFrog. “The attack is silent, leaves no kernel logs or audit traces, and bypasses common on-disk integrity monitoring tools.”

The attacker loads a privileged binary like /usr/bin/su into memory, wires those pages into a network packet, and forces the kernel to clone it through a loopback IPsec tunnel they control. The decryption step overwrites the binary’s authentication logic with attacker-chosen bytes, and the next run of su hands over root — while the file on disk stays untouched.

The exploit requires CAP_NET_ADMIN to configure the IPsec environment. On Debian and Fedora that capability is reachable by any local user through unprivileged user namespaces, which are enabled by default.

“The attacker begins by creating a fresh network namespace:

unshare -Urn

This provides network administrative capabilities inside the namespace.” continues the report. “While capabilities are namespaced, page cache is shared at the host level, so if file-backed pages are modified through shared mappings, the effects may propagate to other processes using those pages.”

Ubuntu 24.04 and later restrict namespace creation via AppArmor, blocking the default exploit path, but every other distribution with default namespace configurations is exposed.

The DirtyFrag family now has four members. Copy Fail (CVE-2026-31431) arrived in late April. DirtyFrag (CVE-2026-43284 and CVE-2026-43500) followed on May 7. Fragnesia (CVE-2026-46300) appeared on May 13, bypassing the DirtyFrag patch through a flag-dropping bug in skb_try_coalesce().

“DirtyFrag is a family of Linux kernel memory corruption vulnerabilities in the core networking stack affecting how socket buffers (skb) reference shared page-cache memory, which are subsequently weaponized through in-place cryptographic transformations in subsystems like XFRM/IPsec or RxRPC.” continues the report. “Despite targeting different packet cloning or forwarding paths, variants like DirtyFrag, Fragnesia, and DirtyClone all rely on a shared technique: tricking the kernel into treating read-only, file-backed page cache memory as writable network buffers.”

Each patch closed one code path and left others open. The underlying contract, that every function moving socket buffer fragments must preserve the shared-frag flag, every time, was never fully enforced across the codebase.

The original DirtyFrag researcher Hyunwoo Kim submitted a broader multi-site patch on May 16 covering the remaining fragment-transfer helpers. JFrog independently rediscovered one of the affected functions on May 19, built a working exploit, and reported it. The combined fix merged on May 21, CVE-2026-43503 was published on May 23, and Linux v7.1-rc5 shipped on May 24 as the first fixed release. Ubuntu, Debian, and SUSE have published advisories; Red Hat has a Bugzilla tracking entry.

If patching today isn’t an option, two workarounds reduce the attack surface. Setting kernel.unprivileged_userns_clone=0 on Debian and Ubuntu blocks the namespace-based path to CAP_NET_ADMIN. Blacklisting the esp4, esp6, and rxrpc kernel modules removes the in-place decryption primitives the exploit needs, though that breaks IPsec and AFS. Neither is a fix. The DirtyFrag class probably isn’t finished: any fragment-transfer function that drops the shared-frag flag along the way is a potential new variant, and auditing every such path in the kernel networking stack is a large and unfinished job.

JFrog published a Proof Of Concept video for the exploitation of the flaw.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Linux)