Microsoft 365 users are facing a phishing technique built on a small change: attackers leave the SMTP envelope sender blank.

The omission can let an unauthenticated message pass a Direct Send safeguard while showing employees an address that appears to belong to their own organization.

The approach is not a Microsoft software flaw and does not need a stolen account. It exploits how Exchange Online’s RejectDirectSend control checks the domain in the envelope sender, rather than the address displayed in the visible From field.

That difference offers criminals a simple route to impersonation. It removes a barrier designed to stop an especially risky form of spoofed mail.

Researchers at ReliaQuest identified the pattern in active phishing cases and reproduced it in a controlled Microsoft 365 tenant.

Reliaquest said in a report shared with Cyber Security News (CSN), the company said the technique had appeared repeatedly across unrelated organizations during the past year. A convincing internal-looking email can carry a document notice, payment request, or voicemail lure.

Even if mail filters detect some attempts, any message that reaches a recipient creates an opening for credential theft, malware delivery, fraudulent transfers, and wider account compromise.

Microsoft 365 Phishing Technique Uses Empty Envelope Sender

Direct Send allows devices and applications to send mail within the same Microsoft 365 tenant without authentication. Earlier coverage of Microsoft 365 Direct Send documented attackers imitating internal users without compromising an account.

RejectDirectSend is meant to reject unauthenticated Direct Send mail claiming to come from an organization’s accepted domain. ReliaQuest sent two messages to a tenant’s mail host.

The message using the tenant domain in its envelope sender was rejected, but one using the SMTP command MAIL FROM:<> was accepted and queued.

The recipient still saw the same internal IT support address in the visible From field. Since the empty sender holds no domain, RejectDirectSend has nothing to compare with the tenant’s accepted domains.

The control therefore does not apply its rejection condition, although the message came from an unauthenticated external source.

Acceptance does not mean inbox delivery. Microsoft 365 marked the test message anonymous, gave it a Spam Confidence Level of 9, and sent it to Junk Email after SPF and DKIM returned no result and DMARC failed.

Yet filtering outcomes can differ based on content, infrastructure, configuration, and trusted-sender exceptions. In one case, a message that failed every sender-authentication check was classed as high-confidence phishing but reached an inbox because the spoofed executive was an allowed sender.

Organizations following email authentication configuration guidance should also review exceptions that can override checks.

Targeting and Defensive Steps

ReliaQuest examined examples from September 2025 to August 2026 targeting executives, managers, finance staff, procurement teams, and customer-facing roles. These people regularly handle invoices, bids, shared files, and payment instructions, making business language convincing.

File-sharing notices were most common, followed by payment and remittance requests, procurement invitations, loan or investment offers, and meeting invitations. Some messages used SVG attachments disguised as voicemail recordings.

That approach echoes coverage of weaponized SVG phishing files, which can trigger browser redirection rather than act as images. Security teams should retain RejectDirectSend but not view it as a complete defense.

An IP-restricted inbound connector permits unauthenticated Direct Send only from approved devices and applications. It blocked every Direct Send attempt, including those with a blank sender envelope.

Administrators should identify systems that truly need Direct Send and tightly restrict approved source IP addresses.

Remove unjustified filtering exceptions, including allowed senders, allowed domains, safe-sender entries, and rules that change spam scores. Previous internal email spoofing cases show why trusted routes and permissive rules need scrutiny.

Finally, defenders should search for an empty envelope sender paired with a visible From address in an accepted internal domain, which differs from bounce mail. Prioritize alerts where SPF, DKIM, or DMARC also failed but delivery occurred through an override.

Employees should verify unexpected payment, document, or access requests using a known channel before acting. This check should occur first before responding or opening attachments.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Microsoft 365 Phishing Technique Uses Empty Envelope Sender to Evade Direct Send Blocking appeared first on Cyber Security News.

SLEEPWALKER is a newly identified Windows backdoor built to wait rather than call home. Once placed on a compromised device, it can sit inactive for an extended period, only responding when an operator sends a carefully formed network packet.

That restraint makes the threat difficult to spot with tools that look for repeated connections to a command server.

It is designed to be loaded beside a legitimate security-management component, giving malicious code a trusted-looking place to run. Analysts at PolySwarm identified the malware and named it SLEEPWALKER.

PolySwarm said in a report shared with Cyber Security News (CSN) that their analysis says the sample has no identified threat actor, victim, campaign, delivery chain, or proven record of features used in a live intrusion.

The finding nonetheless matters to enterprise defenders. A backdoor that avoids routine beaconing can reduce the clues available to network monitoring teams, then give an intruder flexible access after the secret trigger arrives.

New Windows Backdoor Stays Completely Silent

The implant begins by checking that it is running within the expected management-agent process. It is an unsigned 64-bit Windows library that imitates a legitimate supporting component and is intended to launch through DLL side-loading, a technique also used in the C2Looper sideloading evasion case to hide hostile code behind familiar software.

Its stored configuration is deliberately sparse. Instead of a hard-coded command server, it instructs the malware to place available interfaces into promiscuous mode and watch indefinitely for traffic matching a defined encrypted packet format.

A valid packet clears framing checks and CRC-32 validation before its tasking is decrypted with AES-256-CCM. The malware then passes the result to its own command interpreter, allowing an attacker to issue work without creating the regular outbound beacon expected from many remote-access tools.

This passive design can leave legitimate management-agent traffic appearing normal while the implant waits. The trigger must still reach a monitored interface, suggesting the operator needs a position on, through, or near the victim network.

That requirement may limit use against isolated endpoints, yet it does not make the malware harmless: tasking received after activation can instruct the compromised host to create new routes for operator control.

The researchers recovered an encryption key from the analyzed library, but the decrypted content is not plain-language instruction text. It uses a proprietary bytecode structure, creating another obstacle for analysts trying to determine exactly what an operator asked an infected device to do.

Flexible Access Raises Detection Stakes

SLEEPWALKER supports 23 bytecode instructions for scheduling, repeated tasks, additional listeners, compressed payloads, local task files, and direct in-memory shellcode execution.

It also supports TCP, UDP, ICMP, Windows named pipes, DNS-based tasking, and VMware VMCI communications. Those options should be treated as possible capabilities, not confirmed activity.

The analyzed configuration enables only the raw-packet listener; DNS triggering, lateral movement, virtual-machine communications, and staged delivery were implemented in the code but were not shown to have been used. The malware can also adjust Windows settings to allow anonymous access to its named-pipe channel.

That behavior offers defenders a useful hunting lead, alongside unexpected library loading from management-agent folders and suspicious pipes, much like the PipeMagic named pipe investigation highlighted the value of watching uncommon local communication paths.

Security teams should validate library signatures and hashes, compare anonymous SMB and named-pipe settings with approved baselines, and investigate trusted processes loading unverified neighboring files.

Those checks are especially important because file reputation and blocklists alone may reveal little when there is no fixed command infrastructure.

Behavior-focused monitoring is therefore central. Teams should correlate process starts, unusual library loads, security-configuration changes, packet-capture evidence, and memory activity rather than treat any single signal as conclusive, an approach reinforced by the Mistic memory execution report.

For incident responders, the practical lesson is to preserve volatile evidence early and examine how a suspect process was launched.

SLEEPWALKER shows how an attacker can separate initial compromise from later control, remain quiet between actions, and make a familiar program part of the concealment strategy.

Indicators of compromise (IoCs):-

Type	Indicator	Description
SHA-256	d347170752a28e2b8c4b8b9f3cab2e3a6541ba11682c94498d26eb9002779d60	SLEEPWALKER sample hash
File name	dpapi.dll	Unsigned malicious DLL masquerading as a legitimate Microsoft component
Process name	ERAAgent.exe	Management-agent process targeted for DLL side-loading

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post New Windows Backdoor Stays Completely Silent Until Hackers Send a Secret Trigger appeared first on Cyber Security News.

Hackers are using a fake Cloudflare CAPTCHA to turn a routine web check into a doorway into corporate networks.

The campaign, called TerminalFix, begins on compromised websites and persuades visitors to paste a supposed verification command into Windows Terminal or PowerShell.

It relies on a victim completing the attacker’s instructions. It has been seen against multiple industry sectors. The copied command fetches a ZIP archive, unpacks it under ProgramData, and starts a batch file in the background.

It launches a longer chain that hides code, maps the organisation, and creates a route back to attackers. Microsoft analysts identified TerminalFix as a more capable ClickFix variant, targeting organisations in several industries. 

Microsoft said in a report shared with Cyber Security News (CSN) the campaign combines social engineering, DLL sideloading, image-hidden data, and a custom reverse tunnel.

An infection can turn that computer into a pivot point for systems it can access internally, including critical internal systems. Researchers did not observe final hands-on actions, but the access could enable theft, security-control tampering, or ransomware.

Hackers Use Fake Cloudflare CAPTCHA

The lure looks familiar. A compromised page briefly loads normally before a counterfeit Cloudflare Turnstile screen appears, with a checkbox and loading animation.

Clicking it silently puts a harmful PowerShell command on the clipboard, then tells the visitor to open a command window and paste it.

TerminalFix directs users to Terminal or PowerShell instead of the Windows Run box, making longer multi-line scripts easier to execute.

Readers following recent fake CAPTCHA malware attacks will recognise the pattern: trust in a familiar verification prompt replaces the need for a browser exploit.

The archive contains a legitimate signed program and a malicious DLL. When the trusted application starts from the attacker-controlled folder, Windows loads the nearby library first. This lets malicious code run in a less suspicious process.

The DLL downloads PNG images from attacker-controlled sites and extracts hidden program components from their pixel data.

It also sets a Registry Run entry and a scheduled task that restarts the payload hourly. Similar misuse appears in PowerShell DLL sideloading attacks, showing why file location and process activity matter.

Stealthy Access Requires Faster Response

After persistence is established, TerminalFix maps the infected environment. Its scripts query domain trusts, domain administrator membership, user and computer records, and server names, then run targeted ping checks.

This reconnaissance helps attackers identify valuable systems and identify domain-connected devices. The final payload brings its own Python runtime and starts a windowless interpreter, keeping the process out of sight.

The implant opens an encrypted WebSocket connection over port 443 and works like a SOCKS-style proxy, allowing operators to relay traffic to internal hosts through the victim.

Reverse tunnelling has also featured in recent enterprise backdoor campaigns, creating a concealed network path. Defenders should treat a confirmed infection as potential network-level access, not simply a malware cleanup event.

Investigate lateral movement and exposed credentials, prioritise password rotation for accounts available on the affected system, especially privileged domain accounts.

Teams should alert when the sideloading host runs outside its normal Windows location and review outbound connections to listed infrastructure.

Prevention starts with teaching staff that a real CAPTCHA will not ask them to open Terminal, PowerShell, or Run and paste commands.

Organisations can restrict PowerShell for standard users, enable script-block logging, apply signed-script or constrained-language controls where practical, and configure Terminal warnings for multi-line pasted text.

The wider ClickFix phishing delivery trend makes layered controls important because victims initiate the first command.

Network and endpoint teams should monitor unexpected DLL loads, newly created scheduled tasks, hidden ProgramData folders, and Python processes launched with tunnel-related arguments.

Blocking the listed domains, maintaining web protection, and isolating suspected devices quickly can curb an attacker’s movement.

They should also check web logs for visits to compromised sites and inspect clipboard-triggered PowerShell activity, because prompt user action can otherwise resemble a legitimate administrative task.

Investigators should preserve logs and assess the machine’s network reach before returning it to normal service.

Indicators of compromise (IoCs):-

Type	Indicator	Description
SHA-256	18c2090e8a0ae0568af9b87e59eaf8270f23d2909600ed9db91a9444fd8b278f	Initial ZIP archive, verify_pkg.zip
SHA-256	b8d107800403b9197e5b7609ceacd8e4cac1b0f9a1d156e6dacd6c3f7794b36a	Custom reverse-tunnel implant, client.py
SHA-256	ba77feed86bcda49308746421bdc684a432dd5d68c363975b2a3c6831bda3f07	Malicious DLL, dui70.dll
SHA-256	026478003fe354134c03acf6890e7d3b153ba08a836eca42350db48f213872ab	Malicious DLL, dui70.dll
SHA-256	032b529fac61e550f5dc9489686f519b82d64625fa05a8d9ecf8ba8be9b2ad22	Malicious DLL, dui70.dll
SHA-256	df8221a933b38284ebdcb8bffc2df62123c9f5b5f421dd0b070e13e668b3eabf	Malicious DLL, dui70.dll
SHA-256	eb1b4be34d05b394fb74efdeb95faecd1d1963be6ecc1b9db2b4757b491f01f0	Malicious DLL, dui70.dll
SHA-256	5d43abf5c36ea203176d3300ff14af27b4be81810ad2679b3a62b255e3d6e1c8	Malicious DLL, dui70.dll
SHA-256	9a7b4dcd51d9251c177d323d6aaecdfc86674f69bc1af048dc872926d22aaa24	Malicious DLL, dui70.dll
SHA-256	342df92235c9dec81203b837addaa38bb85b64b4a48fe71b5303ca86d991991e	Malicious DLL, dui70.dll
SHA-256	ededeacf30e493dd632d477fe770ba419aa2848f685ea049381a0a8d2cc3e84d	Malicious DLL, dui70.dll
Domain	gitnow[.]dev	Command-and-control server for the custom reverse tunnel on port 443
Domain	bestsocialmedianewspapper[.]com	Steganographic image hosting and payload delivery
Domain	offlineupdater[.]com	Steganographic image hosting failover
URL	hxxps://linked-log[.]com/	Compromised website used in the campaign

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post Hackers Use Fake Cloudflare CAPTCHA to Deploy Reverse Tunnel Into Corporate Networks appeared first on Cyber Security News.

Cybercriminals are using a counterfeit Claude desktop application to compromise Windows systems, disable key security checks, and install remote-access malware.

The campaign turns a familiar AI software search into a route for credential theft and long-term access. It also shows how trusted-looking download pages can make a dangerous file appear routine.

For organizations, the campaign creates risk beyond one endpoint because stolen credentials may open the door to email, cloud services, and internal systems.

The attack begins with malicious search advertisements that steer victims toward convincing public artifact pages. After a user downloads and runs the supposed installer, the infection moves quickly through several stages.

The final payload is SectopRAT, a remote-access tool that can steal information and give attackers hidden control of an infected device. Such access can let criminals collect files, watch activity, or return later with further instructions.

CyberProof said in a report shared with Cyber Security News (CSN). Its analysts noted that the activity matches the FakeAgent campaign previously tracked in the wild, where attackers abuse public hosting and spoofed installers to deliver malware.

The incident was identified from an alert involving a scheduled task designed to look like a normal software update. Analysts then correlated evidence across the affected endpoint instead of treating that signal as a standalone event.

The case underlines a wider problem for businesses and home users alike. A familiar name is often enough to lower a victim’s guard, particularly when an advertisement appears above legitimate search results.

Recent reporting on fake Gemini installer attacks shows that criminals are also exploiting other popular AI brands to push credential-stealing malware.

Hackers Use Fake Claude Desktop App

Once the victim launched the counterfeit application, it used PowerShell to add exclusions for folders in the user profile, reducing Microsoft Defender visibility over the area where malicious files were staged.

The initial loader then used DLL sideloading, a method that makes a legitimate program load a harmful supporting file. This allowed the code to run in the context of a signed Java Chromium Embedded Framework helper.

The mismatch between the displayed application name and the program’s internal details was a valuable warning sign.

The malware also created a logon-triggered task with elevated privileges while disguising it as a browser updater. That task called a second loader from a user-writable roaming folder, allowing the infection to return after a reboot.

Abuse of native scheduling features remains a proven way to retain access, as shown in reports on Windows scheduled task abuse.

CyberProof’s investigation found that the operators avoided a conventional command server. Instead, the malware relied on EtherHiding, retrieving encrypted connection details from Ethereum blockchain data.

That approach can make takedowns harder because the attacker can rotate infrastructure without relying on one fixed domain or server.

Containment Needs Full Response

Researchers stressed that removing a visible task or one malicious file is not enough when remote-access malware has executed.

In the observed incident, responders isolated the device, removed unauthorized Defender exclusions, revoked user sessions, reset credentials, and reimaged the endpoint. They also reviewed identity and access activity to check whether stolen credentials had been used elsewhere.

Defenders should investigate newly created high-privilege tasks that launch software from Downloads, AppData, or other user-controlled locations.

They should also flag new antivirus exclusions made soon after a download and inspect unexpected library loads outside normal program folders. Similar chains that combine spoofed software and library loading have appeared in AsyncRAT fake installer campaigns.

Organizations can reduce exposure by directing staff to approved software channels and restricting local installation rights where practical. Search advertisements for developer and AI tools deserve extra caution, even when the landing page looks legitimate.

Monitoring browser-originated downloads, scheduler changes, security-setting changes, and blockchain RPC traffic together can help teams recognize the full attack rather than treating each alert as an isolated event.

That broader view is important when attackers intentionally spread their activity across several ordinary Windows features.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
File name	ClaudeDesktop.exe	Initial trojanized loader
File metadata	JCEF Helper / jcef_helper.exe	Internal metadata associated with the fake loader
File name	DockerDesktop.exe	Staged loader used for reboot persistence
File name	libcef.dll	VMProtect-packed DLL used in the sideloading chain
File name	tempdir.dll	DLL name included in the hunting logic for suspicious sideloading activity
File name	Claude.exe	Suspicious installer-related file name included in hunting logic
File name	ClaudeSetup.exe	Suspicious installer-related file name included in hunting logic
File name	Docker Desktop.exe	Suspicious installer-related file name included in hunting logic
File path	AppData\Roaming\EdgeUpdate-1b4adb1f\	User-writable staging directory
Scheduled task	MicrosoftEdgeUpdate	Disguised logon persistence task configured with elevated privileges
Domain	downloading-api.it.com	Malvertising download infrastructure
Domain	neeitoerw[.]my	Suspicious domain observed in the process lineage
IP address	153.75.84.173	Network infrastructure observed in the process lineage
URL pattern	claude[.]ai/public/artifacts/[id]	Masqueraded lure artifact page
URL / domain	download-app.us	Suspicious origin included in hunting logic
URL / domain	claude-desktop.gitlab.io	Suspicious origin included in hunting logic
URL / domain	claude.ai.download-app.us	Suspicious origin included in hunting logic
URL path	it.com/html/claude/win	Suspicious origin included in hunting logic
Domain	claude-code-cmd.squarespace.com	Suspicious origin included in hunting logic
URL path	code.claude.ai/download	Suspicious origin included in hunting logic
Domain	install-files.com	Suspicious origin included in hunting logic
Keyword	claude-code	Suspicious origin keyword included in hunting logic
Keyword	claude-desktop	Suspicious origin keyword included in hunting logic
SHA-256	f8acb8f5...	Partial hash of the initial payload, as published in the source report

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post Hackers Use Fake Claude Desktop App to Disable Defender and Install Remote Access Malware appeared first on Cyber Security News.

Cybercriminals are abusing interest in generative AI to trick users into downloading malware. In a newly documented incident, a file posing as a Google Gemini installer delivered the Vidar information stealer, putting saved browser passwords and other sensitive data at risk.

The attack did not begin with a phishing email. Instead, it relied on a normal-looking software search and download path, showing how criminals can turn routine searches for AI tools into a route for credential theft.

The tactic mirrors recent campaigns that used fake AI installers and search manipulation to distribute password-stealing malware. Hackers using fake Claude pages have similarly shown how convincing AI-themed downloads can mislead users.

Analysts from Darktrace identified the activity in July 2026 within a customer environment in the Europe, Middle East and Africa region.

Darktrace said in a report shared with Cyber Security News (CSN) that they linked the suspicious executable to Vidar after detecting unusual process behavior, outbound connections, and signs that browser credentials were being collected.

The case highlights a wider shift in malware delivery. Attackers are increasingly placing harmful files behind familiar names, trusted cloud services, and popular AI brands, betting that users will lower their guard when a download appears connected to a well-known platform.

Hackers Use Fake Google Gemini Installer

The infection chain began when a user launched a file named Download_Google_Gemini_For_Windows.exe from the Downloads folder.

Darktrace found that searches for the filename led to a Google Colab page containing a download prompt, giving the campaign an appearance of legitimacy.

Google Colab is commonly used by developers and researchers, which made it a useful staging point for the lure.

The page redirected visitors to a second website posing as a “Windows Software Hub,” where the fake Gemini installer was offered for download. 

The investigation did not recover HTTP or file-download telemetry that conclusively established the initial download source.

However, encrypted sessions with Google Colab occurred immediately before the executable launched, strongly suggesting that the user interacted with the hosted resource before reaching the secondary download site.

At the time researchers reviewed the activity, the Colab page remained active and offered a ZIP archive containing the malicious binary.

It also included a README file that told users to run the program with administrator rights and add it to antivirus exception lists, a clear warning sign that the instructions were designed to weaken normal defenses.

Once executed, the program was identified as a newer Go-compiled Vidar variant. It communicated with infrastructure associated with Telegram and connected to suspicious external systems over port 443. This behavior helped investigators connect the fake installer to the wider credential-stealing operation.

The campaign shows why trusted hosting alone cannot validate a download. Similar risks have emerged as attackers weaponize AI interest through cloned repositories, misleading setup guides, and harmful archives.

A recent fake AI tool campaign also demonstrated how attackers can exploit trusted-looking developer resources to distribute stealers.

Browser Credentials and Response

Vidar is built to collect valuable information from infected devices. In this incident, later endpoint alerts confirmed activity consistent with theft of browser credentials and other sensitive data.

Saved passwords, browser-based session data, and related information can give attackers access to email, business services, or personal accounts without needing to guess a password.

The affected device contacted an external IP address shortly after the fake installer ran. Researchers also identified a related IP through SSL certificate analysis, along with a command-and-control domain connected to the activity. 

Darktrace contained the incident by blocking communications with suspicious infrastructure and quarantining the compromised endpoint.

The response was triggered by behavior that did not match the device’s normal activity, rather than by the apparent legitimacy of the installer or the hosting platform.

For organizations, the practical lesson is to treat AI software downloads with the same caution applied to any other application.

Users should obtain Gemini-related tools only from verified official sources, avoid search-result downloads that lead through unfamiliar pages, and never follow instructions to disable or exclude antivirus protection.

Security teams should also investigate unusual browser credential access, new executables launched from Downloads folders, and rare encrypted connections from recently installed programs.

These controls are especially important as SEO poisoning Gemini campaigns continue to use convincing search results and false installation guidance to target users.

The campaign relied on a fake Gemini installer, trusted-platform abuse, and social engineering to deliver an established information stealer through a more convincing route.

The broader risk is not limited to one malware family: attackers are now treating the demand for AI tools as a dependable lure for credential theft.

Indicators of compromise (IoCs):-

Type	Indicator	Description
File	Download_Google_Gemini_For_Windows.exe	Fake Gemini-themed installer observed during the investigation
File	GoogleAppInstaller.exe	Related executable identified through endpoint telemetry
IP Address	91.98.98[.]86	External destination contacted by the malicious executable
IP Address	91.98.111[.]49	Related infrastructure identified through SSL certificate pivoting
Domain	dtm[.]kijangturbo88[.]top	Command-and-control endpoint identified during malware analysis
SHA-256	1e13c2c9eac72daf63fd00a9946878949e159ae6ec51b54ec64f942d79d61913	Malware sample associated with the fake Gemini installer

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post Hackers Use Fake Google Gemini Installer to Deploy Vidar Stealer and Steal Browser Credentials appeared first on Cyber Security News.

Kimwolf v7 is raising the stakes for attacks launched from everyday Android TV boxes and set-top devices.

The latest version can make disruptive web traffic look more like a real visitor browsing a site, making defensive filtering harder at a critical moment.

The botnet has been active under related names since 2024, moving from Linux internet-connected devices to Android targets in 2025.

It reaches exposed Android Debug Bridge services through residential proxy networks, allowing attackers to install malware without authentication.

Unit 42 said in a report shared with Cyber Security News (CSN) that the new build was found on February 3, 2026.

The finding follows a period in which Kimwolf had already drawn attention for the scale of its Android infections, detailed in this earlier Kimwolf Android infection report.

The risk is not limited to a single household device. Each compromised box can be directed to send traffic at a chosen target, while its owner may see little obvious sign of misuse.

That large, distributed pool has made the wider family a serious DDoS concern, as shown by the Aisuru record DDoS attack.

Kimwolf v7 Botnet Uses Chrome Browser Fingerprints

Kimwolf v7 introduces an HTTP/2 flood that builds full Chrome-like browser fingerprints before sending requests.

In practice, it copies details that websites normally expect from a browser, including the pattern of request headers, instead of relying on plainly artificial traffic.

That change matters because many defenses look for unusual or incomplete requests when deciding what to block.

When malicious requests better resemble ordinary browsing, operators face a tougher balance between stopping an attack and accidentally interrupting real visitors.

The malware uses an HTTP/2 library to generate this traffic and retains a broader set of 15 denial-of-service methods.

It also includes a performance-tuned UDP flood designed for the ARM processors common in TV hardware, widening the ways infected devices can be used.

This is not simply a larger stream of junk requests. By borrowing the appearance of a popular browser, the botnet tries to blend into the same application layer that online stores, public services and media sites depend on.

Defenders need to assess patterns across many requests, rather than trusting a single header or connection detail.

Kimwolf v7 appears more focused than earlier builds. Researchers found that scanning, exploitation and password-guessing features were removed, suggesting the group may now depend on separate tools for infections while the bot handles attacks and traffic relaying.

Resilient Control Infrastructure

The operators also rebuilt the botnet’s command system to better withstand takedowns.

Kimwolf can query Ethereum Name Service records through several public blockchain endpoints, use an apparent operator-controlled relay, and fall back to a Tor hidden service if its normal route fails.

All command traffic passes through a local proxy component, making it easier to change routing without replacing the main bot.

The design reflects a response to disruptions in December 2025 and adds layers that can delay efforts to cut infected devices off from their controllers.

Network teams should avoid blocking shared blockchain services wholesale, because legitimate users may need them.

Instead, they should investigate unexpected connections from device types that have no normal reason to use those services, correlate them with proxy activity, and preserve logs that can reveal whether a device is part of a coordinated campaign.

For defenders, the most useful warning signs are unusual blockchain service connections from Android or IoT hardware, Tor or SOCKS proxy activity, and suspicious local proxy behaviour.

Administrators should isolate Android TV devices from business networks and disable ADB or limit it to USB-only use, which removes the main infection path.

This is especially relevant for organisations that treat streaming boxes as harmless appliances.

The reported Kimwolf operator arrest case shows the law-enforcement pressure around the botnet, but the technical changes show why device owners still need to act.

Reviewing the broader Android TV botnet risks can help teams spot similar exposure before it becomes an incident.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
SHA-256	406647de09a0ffa279756b4ccb344b1b76a333320c5b50fd367901fa006cf0ff	Kimwolf v7 ARM ELF baseline payload
MD5	d759364844d78a728505fb0485c3adbc	MD5 for the baseline payload
SHA-256	345222bca004595977f971d76900b0c65fd9bf9d91c50cd0c5bf5a93f1ad9e49	Kimwolf v7 ARM ELF payload
MD5	036bcb62be72c4663b9564955f93b05f	MD5 for the associated ELF payload
SHA-256	2ec2e85b0358e0c681cb5067489a9086ec97dbbf7e3c952dd9cd496b319d5af5	Kimwolf v7 ELF payload containing the operator-linked RPC subdomain
MD5	33faca1e0090f6b12eff703daf4606e4	MD5 for the associated ELF payload
SHA-256	951c94809aa6c7ab587125f9d4df30fa6a49ee0cbba76a4b7ceedaaa0e5dcd36	Kimwolf Android APK masquerading as a system log service
SHA-256	f07821e313c16cbbd82def45094a22c8d474164051bdbc7648d6869e012014b4	Related Kimwolf Android APK sample
VHash	76554ad09897ac723a850eaf8c525efa	Structural hash shared by Kimwolf v7 ELF samples
SHA-1 certificate	2a1d96f1b066877812587ac94f45f82dfff5f5f9	Self-signed APK signing certificate
SHA-256 TLS certificate	f3e8a55a2a3ea7c7b6676e90f4f49a2c55b13065b68ee50c51cc35fe2b5c3237	Certificate associated with the RPC infrastructure
SHA-256	9470c68f9b6fe5f90d61891b95623afd7b4298815b0f95e25610e1c09008dc24	ARM payload associated with the first dropped ELF filename
SHA-256	8242443dfcec66e3fe04cbfa2fbd211ad34065ee07aa93813d792a437caab212	ARM payload associated with the second dropped ELF filename
SHA-256	421111a57b0a4224c052fa4108d90429d579974b5b5111ed2e58516ba09422ca	x86 payload associated with the version-one dropped ELF filename
File name	libn[redacted]kernel.so	Dropped ARM and x86 Kimwolf kernel payload filename
File name	libdevice.so	Dropped ARM Kimwolf kernel payload filename
File name	libcow.so	Filename used by an earlier x86 sample
Process name	netd_service	Process name used by the v7 ELF payload for masquerading
Process name	TVHelper	Process name used by the libdevice.so variant
Android package	com.android.logcatd	Package name used by identified Kimwolf Android APKs
Domain	rpcuniverse[.]com	Infrastructure domain linked to the suspected operator-controlled RPC service
Domain	eth.rpcuniverse[.]com	RPC subdomain hard-coded in a Kimwolf sample
Domain	avax.rpcuniverse[.]com	Subdomain resolving to the associated infrastructure host
URL	hxxps[:]//0xrpc[.]io/eth	Public Ethereum RPC endpoint queried by the malware
URL	hxxps[:]//eth.llamarpc[.]com	Public Ethereum RPC endpoint queried by the malware
URL	hxxps[:]//ethereum-rpc.publicnode[.]com	Public Ethereum RPC endpoint queried by the malware
URL	hxxps[:]//eth-protect.rpc.blxrbdn[.]com	Public Ethereum RPC endpoint queried by the malware
URL	hxxps[:]//eth.merkle[.]io	Public Ethereum RPC endpoint queried by the malware
IP address	23.94.221[.]104	Host associated with the RPC infrastructure and contacted by ELF and APK samples
IP address:port	212.193.31[.]158:443	HTTPS command-and-control traffic
IP address:port	212.193.31[.]119:13	Command-and-control traffic
IP address:port	212.193.31[.]122:13	Command-and-control traffic
IP address	212.193.31[.]102	Command-and-control host linked through a shared SSH host key
IP address:port	212.193.31[.]92:443	HTTPS command-and-control traffic
Local proxy	127.0.0[.]1:23075	Local proxy endpoint used to route command traffic
Tor hidden service	edctgwib2n5l34t525zkxqzk5bqb6e5il2yiq5r6zu7gtlxa4uosn3qd[.]onion	Kimwolf v7 command-and-control fallback

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world

The post Kimwolf v7 Botnet Uses Chrome Browser Fingerprints to Hide HTTP/2 DDoS Attacks appeared first on Cyber Security News.

DeadLock ransomware has emerged as a financially motivated threat that locks files while threatening to publish stolen information.

First observed in July 2025, it had listed more than 80 alleged victims on its leak site by July 2026, with over half in Europe.

The reported victim count demonstrates both broad sector exposure and a steady public-pressure campaign intended to turn operational disruption into payment.

The operation has affected organisations in IT, mining, transport, manufacturing, hospitality, consumer goods, and other sectors across six continents.

Microsoft analysts identified DeadLock as a Rust-based encryptor whose operators pair double extortion with unusually durable communications.

Researchers did not name one initial-access method, but the malware can target a chosen directory, request administrator approval, and disrupt tools that could slow encryption.

The impact goes beyond inaccessible files. DeadLock deletes recovery material, targets backup, security, remote-access and cloud-sync processes, clears event logging, and leaves victims with a browser-based recovery page.

Researchers at Microsoft said in a report shared with Cyber Security News (CSN) that all these actions can delay containment when defenders need evidence and working backups most.

DeadLock Ransomware Stores C2 Configuration on Polygon Blockchain

DeadLock’s standout feature is the way its recovery page uses Polygon blockchain smart contracts as a configuration store.

Instead of embedding one server address or relying on a domain that can be seized, the page makes read-only requests to retrieve the current proxy address and the group’s blog content.

Two contracts support this design: one provides the chat proxy location and another stores leak-blog posts. The page can rotate among six public Polygon RPC services, so one failed provider does not necessarily cut off access.

This echoes the wider trend covered in blockchain C2 infrastructure analysis, where attackers use a public ledger as a hard-to-remove lookup point.

That design changes, rather than eliminates, the takedown problem. Operators can update the proxy URL on-chain without redistributing the HTML page, while contract-hosted posts resist ordinary web-hosting removal.

Yet the system still depends on a reachable RPC service, the active proxy, and off-chain storage for images and stolen files.

The page routes victim messages through the Session network, which uses distributed, onion-routed messaging.

It also contains a file browser for material hosted through Wasabi-compatible storage. For defenders, blocking one website may not end communications, a lesson also illustrated by Ethereum hidden command servers.

Encryption and Defensive Priorities

DeadLock tries to keep a compromised system usable enough for the extortion process.

It pauses new encryption work when memory use rises above 29% or CPU load exceeds 70%, while using twice the number of CPU cores for directory-processing threads. That restraint can make activity less obvious, even as files become unusable.

Each file receives a separate encryption key, and larger files may be encrypted only in selected blocks to speed the attack.

Encrypted items gain a .dlock extension, while text notes and an HTML recovery chat direct victims toward the operators. The approach reinforces why ransomware response planning guidance must cover data protection and rapid isolation.

Organisations should maintain strong credential hygiene, harden systems, enable cloud-delivered protection or an equivalent, and use tamper protections so attackers cannot simply stop security services.

Teams should also protect backups, review suspicious use of PSExec and WMI, and test controls before an incident.

Endpoint detection configured to block malicious activity can help contain an intrusion, while strict folder protections can limit unauthorised writes to valuable data. The value of quick containment is clear in ransomware attack isolation case.

DeadLock shows that ransomware disruption now requires more than domain blocking.

Security teams need visibility on endpoints and outbound connections to public blockchain services, tested recovery procedures, and rehearsed incident-response decisions.

Early detection matters because the malware’s cleanup and logging changes can rapidly reduce evidence available to investigators.

Indicators of compromise (IoCs):-

Type	Indicator	Description
SHA-256	a1fdf65020ce4a0f0940c793c6425baf8a0b994ec48b9baaf72788661a9d29f4	DeadLock ransomware encryptor
URL	deadlock.liveblog365[.]com	Leak site domain
URL	dlock.liveblog365[.]com	Leak site domain
URL	deadblogdbdu5wprek7wa2o4ce7rnt6u6ntqeud3hzjjcveosgpsqqqd[.]onion	Leak site domain
URL	deadlockblog.great-site[.]net	Leak site domain
URL	deadlockblog.medianewsonline[.]com	Leak site domain

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world

The post DeadLock Ransomware Stores C2 Configuration on Polygon Blockchain to Resist Takedowns appeared first on Cyber Security News.

A new remote access trojan called Abyssos lets attackers control infected Windows systems.

The malware can steal credentials, collect files, and open remote viewing sessions, while its modular design allows operators to add functions after an infection.

Abyssos appeared in late June 2026 and remains in development. Its operators can issue commands through an encrypted connection, gather details about the victim computer, and retrieve modules.

The research does not identify a confirmed initial delivery method, leaving the campaign’s entry point unclear. No specific lure or exploit was identified. Researchers at Zscaler identified the malware and tracked it as Abyssos.

Zscaler said in a report shared with Cyber Security News (CSN) that they found several versions and changing protections, suggesting the developers are actively refining it to make analysis and detection more difficult.

The immediate risk is broad access rather than one action. An intruder with control of an affected machine could search files, collect browser data, record the screen, run commands, or move toward more valuable accounts and systems.

That combination echoes concerns raised by recent RAT remote control, where a single foothold can support surveillance and theft.

Abyssos RAT Includes RDPWrap-Related Module

One addition is a module named RDPWRAP, which Zscaler said may be related to the open-source rdpwrap library.

Remote Desktop Protocol lets users operate Windows machines remotely. A tool connected to that function can extend attacker access after compromise.

When instructed by its command server, Abyssos writes the module into the Windows temporary folder under a randomly generated name beginning with “rdp.”

It then runs exports called abyss and GetRdpWrapText, returning any output to the operator. The module is encrypted with AES-CBC before delivery, adding another obstacle for defenders examining network traffic or files.

The report does not say that the module automatically grants unrestricted Remote Desktop access on every victim. Still, its presence points to an effort to broaden what the malware can do on a compromised device.

The development is especially relevant as hidden remote desktop attacks show how remote-control features can be combined with credential theft to keep intrusions quiet.

Abyssos already supports hidden VNC sessions, screen recording, remote shells, file transfers, and process management.

The RDPWRAP-related capability sits alongside those functions, giving operators another possible route for interacting with a victim system. This mix can turn a basic infection into a long-running access point that is harder to investigate.

Modular Design Supports Theft

Abyssos uses a custom TCP protocol and AES-GCM encryption for most communications with its command-and-control server.

After starting, it collects host details such as the computer name, user name, privileges, Windows version, public IP address, and location, then sends that information to register the device.

Its commands can copy, delete, archive, upload, and download files. It can also capture clipboard contents and keystrokes, retrieve screenshots, stop or restart processes, and execute downloaded programs.

One feature can open Chrome with remote debugging enabled and load stolen cookies, a method that may let criminals take over an already authenticated browser session.

The malware can download modules for keylogging, Chrome and Firefox credential recovery, cookie collection, domain-controller discovery, vulnerability scanning, and attempts to raise privileges.

Such expandable toolsets resemble the danger in fileless loader evasion tactics, because security teams may face a changing set of capabilities instead of one fixed malicious file.

Abyssos also tries to frustrate analysts. Some samples check for virtual machines and common analysis processes, then stop if they find them.

The code uses control-flow changes, encrypted values, and hidden strings, although the newest version reviewed did not include all of these checks.

The malware is a post-compromise framework with file-system access and expandable modules.

Organizations investigating suspicious Windows activity should look for unexpected remote-control behavior, temporary-folder modules, and unusual encrypted outbound connections, while treating possible cookie theft as an account-security incident.

The wider lesson from browser cookie theft risks is that changing a password alone may not end an attacker’s active session.

Indicators of compromise (IoCs):-

Type	Indicator	Description
SHA-256	52b400c5be1557a8df146f62fde76d906e7e0a92ed76788717ef61c758f315aa	Abyssos sample version 2.4F
IP address	213[.]145.86.42	Abyssos command-and-control server
SHA-256	ca94d95413210a2a325155740eb8a5c58627ad5c4e704478621e7fc8165fe173	Abyssos sample version 2.1F
IP address	209[.]99.184.223	Abyssos command-and-control server
File name	windows_update_cache.json	Hardcoded temporary-folder file used to store captured keystrokes
Mutex	Global\\68AA60E5-6C45-4C01-9F0E-E25FC57C652F	Example Abyssos mutex format observed in the analysis

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world

The post Abyssos RAT Includes RDPWrap-Related Module for Expanded Remote Access appeared first on Cyber Security News.