Author: Mark

Big companies are getting smaller, and their CEOs want everyone to know it. Wells Fargo has cut its workforce by 23% over five years, Bank of America has shed 88,000 employees since 2010, and Verizon’s CEO recently boasted that headcount is “going down all the time.” What was once a sign of corporate distress has become a badge of honor, with executives celebrating lean operations and AI-driven efficiency.

But while C-suite leaders tout “doing more with less,” CISOs are left with fewer resources, while every preventable security incident becomes exponentially costlier. With security teams already stretched thin and developer-to-security ratios reaching unsustainable levels, these workforce reductions push already distressed teams past their breaking point. Against this backdrop of workforce optimization, hardcoded secrets represent a particularly dangerous blind spot that can no longer be managed through manual processes and reactive firefighting.

The Numbers Don’t Lie

The credential crisis is already here. According to IBM’s latest research, 86% of breaches involve stolen or compromised credentials, with the average time to identify and contain these incidents stretching to a staggering 292 days.

The financial stakes have never been higher. In the United States, breach costs surged to an all-time high of $10.22 million, driven by higher regulatory fines and detection costs. For credential-based incidents specifically, HashiCorp’s research shows these breaches carry a $750,000 premium, meaning US organizations face potential costs exceeding $11 million when hardcoded secrets are involved.

But the hidden costs may be even more devastating. Organizations waste nearly $1.4 million annually on managing secrets manually. This includes developer time spent on credential rotation and exposure investigation ($936,000) and security analysts triaging false positives and chasing down leaked credentials (>$500,000).

The real-world impact is already visible. Canva experienced days of downtime across multiple teams due to a single leaked secret, consuming engineering resources that should have been focused on product development.

Why Lean Teams Amplify the Risk

Workforce reductions mean longer mean-time-to-remediate incidents, and the 292-day average containment window becomes even more dangerous. Each security incident pulls already-stretched teams away from core business functions, creating costly context-switching overhead that lean organizations can’t afford.

The scope of the problem continues expanding even as teams shrink. Large organizations harbor thousands of unmanaged secrets scattered across code repositories, CI/CD pipelines, Slack channels, Jira tickets, and collaboration platforms.

HashiCorp’s research indicates that up to 40% of these secrets fall into high-risk categories, often providing direct production access.

This creates a multiplication effect: one hardcoded API key can enable lateral movement, supply chain compromise, and large-scale ransomware deployment. The recent s1ngularity attack demonstrates this perfectly: what began as a GitHub Action token-stealing pull request compromised Nx packages, stealing 2,349 credentials, and cascaded into attackers exposing 82,901 additional secrets by making over 10,000 private repositories public.

The Strategic Response: Precision Over Volume

GitGuardian’s approach to secrets security recognizes a fundamental truth: detection alone isn’t enough. Without effective remediation, alerts become expensive noise that overwhelms already-stretched teams. For CISOs managing learner security operations, this distinction is critical.

Secrets present a fundamentally different challenge than traditional vulnerabilities. While a developer can typically patch a code vulnerability independently, remediating exposed secrets requires understanding the broader infrastructure context—where the secret is used across multiple services, which systems depend on it, and who has the authority to rotate it. This often demands coordination between development, platform, and DevOps teams, each with its own priorities and workflows. Gathering this context manually becomes prohibitively expensive when security teams are already operating at capacity, turning what should be quick fixes into complex, multi-team investigations that can stretch for weeks.

Advanced platforms now shift focus from “What is exposed?” to “What is the magnitude of exposure?” by providing contextual information, including roles, permissions, ownership, and threat scope. This holistic approach directly addresses the false positive burden that costs organizations over $500,000 annually in wasted analyst time.

Cutting Remediation Time from Weeks to Hours

Effective remediation frameworks align perfectly with lean team constraints:

Proactive Detection: Platforms that implement both preventive scanning during commits and reactive scanning for existing leaks catch issues before they reach the 292-day average containment window.

Clear Ownership: Instead of broadcasting vague alerts, modern tools assign ownership for every secret, ensuring responsible developers receive notifications with full context. This eliminates time waste hunting down secret owners.

Informed Decision Making: Teams receive precise location data, understand what each secret unlocks, and know whether it’s still active. According to the Hashicorp research mentioned above, this targeted approach prevents the $936,000 annual productivity drain from manual investigation tasks.

Workflow Integration: Developers get clear remediation guidance directly within their existing tools, reducing the context switching costs that plague smaller teams. Advanced platforms now offer automated secret revocation capabilities and can generate code-fixing pull requests directly within version control systems, meeting developers exactly where they work rather than forcing them into separate security tools.

The ROI of Smart Remediation

By pinpointing specific files and lines of code where secrets are hardcoded, GitGuardian’s approach transforms the economics of incident response. Instead of developers spending hours searching codebases, they focus their efforts exactly where needed. Real-time remediation tracking provides security teams with visibility without manual oversight.

This precision approach directly tackles the core challenge facing downsized security teams: doing more with less while maintaining security posture.

Cybersecurity researchers have disclosed details of a new botnet that customers can rent access to conduct distributed denial-of-service (DDoS) attacks against targets of interest.

The ShadowV2 botnet, according to Darktrace, predominantly targets misconfigured Docker containers on Amazon Web Services (AWS) cloud servers to deploy a Go-based malware that turns infected systems into attack nodes and co-opt them into a larger DDoS botnet. The cybersecurity company said it detected the malware targeting its honeypots on June 24, 2025.

“At the center of this campaign is a Python-based command-and-control (C2) framework hosted on GitHub Codespaces,” security researcher Nathaniel Bill said in a report shared with The Hacker News.

“What sets this campaign apart is the sophistication of its attack toolkit. The threat actors employ advanced methods such as HTTP/2 Rapid Reset, a Cloudflare under attack mode (UAM) bypass, and large-scale HTTP floods, demonstrating a capability to combine distributed denial-of-service (DDoS) techniques with targeted exploitation.”

The activity is notable for incorporating a Python-based spreader module to breach Docker daemons, mainly those running on AWS EC2, while the Go-based remote access trojan (RAT) enables command execution and communication with its operators using the HTTP protocol. ShadowV2 has been described by the authors as an “advanced attack platform.”

Campaigns targeting exposed Docker instances are known to typically leverage the access to either drop a custom image or leverage an existing image on Docker Hub to deploy the necessary payloads. However, ShadowV2 takes a slightly different approach by first spawning a generic setup container from an Ubuntu image and installing various tools in it.

An image of the created container is then built and deployed as a live container. It’s currently not known why this method was chosen by the attackers, although Darktrace said it’s possible that they are trying to avoid leaving any forensic artifacts by carrying it out directly on the victim machine.

It also incorporates features to conduct HTTP/2 Rapid Reset attacks as opposed to a traditional HTTP flood and sidestep Cloudflare’s Under Attack mode by using the ChromeDP tool to solve the JavaScript challenge presented to users and obtain the clearance cookie for use in subsequent requests. That said, the bypass is unlikely to work given that these challenges are explicitly designed to block headless browser traffic.

Further analysis of C2 infrastructure has found that the server is hosted behind Cloudflare to conceal its true origins. It also makes use of FastAPI and Pydantic, and supports a login panel and operator interface, indicating that the tool is being developed with the idea of offering a “DDoS-for-Hire” service.

The API endpoints allow operators to add, update, or delete users, configure the type of attacks those users can execute, provide a list of endpoints from which the attack has to be launched, and exclude a list of sites from being targeted.

“By leveraging containerization, an extensive API, and with a full user interface, this campaign shows the continued development of cybercrime-as-a-service,” Bill said. “The ability to deliver modular functionality through a Go-based RAT and expose a structured API for operator interaction highlights how sophisticated some threat actors are.”

The disclosure comes as F5 Labs said it detected a web scanning botnet that uses Mozilla-related browser user agents to target internet-exposed systems for known security flaws. So far, the botnet is said to have used 11,690 different Mozilla User-Agent strings for its scans.

It also comes as Cloudflare said it autonomously blocked hyper-volumetric DDoS attacks that peaked at 22.2 terabits per second (Tbps) and 10.6 billion packets per second (Bpps), respectively, according to a post shared on X today. The DDoS attack, the largest ever recorded to date, lasted only 40 seconds.

Earlier this month, the web infrastructure company revealed it had mitigated a record-setting volumetric distributed denial-of-service (DDoS) attack that peaked at 11.5 terabits per second (Tbps) and lasted only about 35 seconds.

Chinese security firm QiAnXin XLab, in a technical report last week, said the botnet known as AISURU is responsible for the attack. A variant of AIRASHI, it has infected nearly 300,000 devices, most of which are routers and security cameras. The botnet, per the company, is managed by three individuals – Snow, Tom, and Forky – who take care of development, vulnerability integration, and sales, respectively.

Recent iterations of the malware include a modified RC4 algorithm to decrypt source code strings, conduct speed tests to find the lowest-latency server, and steps to check compromised devices to determine the presence of network utilities like tcpdump, Wireshark, as well as virtualization frameworks like VMware, QEMU, VirtualBox, and KVM.

“The AISURU botnet has launched attacks worldwide, spanning multiple industries,” XLab noted. “Its primary targets have been located in regions such as China, the United States, Germany, the United Kingdom, and Hong Kong. The new samples support not only DDoS attacks but also Proxy functionality. As global law enforcement increases pressure on cybercrime, demand for anonymization services is rising.”

Sep 23, 2025Ravie LakshmananSupply Chain Attack / Malware

GitHub on Monday announced that it will be changing its authentication and publishing options “in the near future” in response to a recent wave of supply chain attacks targeting the npm ecosystem, including the Shai-Hulud attack.

This includes steps to address threats posed by token abuse and self-replicating malware by allowing local publishing with required two-factor authentication (2FA), granular tokens that will have a limited lifetime of seven days, and trusted publishing, which enables the ability to securely publish npm packages directly from CI/CD workflows using OpenID Connect (OIDC).

Trusted publishing, besides eliminating the need for npm tokens, establishes cryptographic trust by authenticating each publish using short-lived, workflow-specific credentials that cannot be exfiltrated or reused. Even more significantly, the npm CLI automatically generates and publishes provenance attestations for the package.

“Every package published via trusted publishing includes cryptographic proof of its source and build environment,” GitHub noted back in late July 2025. “Your users can verify where and how your package was built, increasing trust in your supply chain.”

To support these changes, the Microsoft-owned company said it will be enacting the following steps –

• Deprecate legacy classic tokens.
• Deprecate time-based one-time password (TOTP) 2FA, migrating users to FIDO-based 2FA.
• Limit granular tokens with publishing permissions to a shorter expiration.
• Set publishing access to disallow tokens by default, encouraging usage of trusted publishers or 2FA-enforced local publishing.
• Remove the option to bypass 2FA for local package publishing.
• Expand eligible providers for trusted publishing.

The development comes a week after a supply chain attack codenamed Shai-Hulud injected a self-replicating worm into hundreds of npm packages that scanned developer machines for sensitive secrets and transmitted them to an attacker-controlled server.

“By combining self-replication with the capability to steal multiple types of secrets (and not just npm tokens), this worm could have enabled an endless stream of attacks had it not been for timely action from GitHub and open source maintainers,” GitHub’s Xavier René-Corail said.

Npm Package Includes QR Code-Based

The disclosure comes as software supply chain security company Socket said it identified a malicious npm package named fezbox that’s capable of harvesting browser passwords using a novel steganographic technique. The package is no longer available for download from npm. It attracted a total of 476 downloads since it was first published on August 21, 2025.

“In this package, the threat actor (npm alias janedu; registration email janedu0216@gmail[.]com) executes a payload within a QR code to steal username and password credentials from web cookies, within the browser,” security researcher Olivia Brown said.

Fezbox claims to be a JavaScript utility consisting of common helper functions. But, in reality, it harbors stealthy code to fetch a QR code from a remote URL, parse the QR code, and execute the JavaScript payload contained within that URL.

The payload, for its part, attempts to read document.cookie, extracts username and password information from the cookie, and transmits the information to an external server (“my-nest-app-production>.up.railway[.]app”) via an HTTPS POST request.

“Most applications no longer store literal passwords in cookies, so it’s difficult to say how successful this malware would be at its goal,” Brown noted. “However, the use of a QR code for further obfuscation is a creative twist by the threat actor. This technique demonstrates how threat actors continue to improve their obfuscation techniques and why having a dedicated tool to check your dependencies is more important than ever.”

Sep 23, 2025Ravie LakshmananSEO Poisoning / Malware

Cybersecurity researchers are calling attention to a search engine optimization (SEO) poisoning campaign likely undertaken by a Chinese-speaking threat actor using a malware called BadIIS in attacks targeting East and Southeast Asia, particularly with a focus on Vietnam.

The activity, dubbed Operation Rewrite, is being tracked by Palo Alto Networks Unit 42 under the moniker CL-UNK-1037, where “CL” stands for cluster and “UNK” refers to unknown motivation. The threat actor has been found to share infrastructure and architectural overlaps with an entity referred to as Group 9 by ESET and DragonRank.

“To perform SEO poisoning, attackers manipulate search engine results to trick people into visiting unexpected or unwanted websites (e.g., gambling and porn websites) for financial gain,” security researcher Yoav Zemah said. “This attack used a malicious native Internet Information Services (IIS) module called BadIIS.”

BadIIS is designed to intercept and modify incoming HTTP web traffic with the end goal of serving malicious content to site visitors using legitimate compromised servers. In other words, the idea is to manipulate search engine results to direct traffic to a destination of their choosing by injecting keywords and phrases into legitimate websites carrying a good domain reputation.

The IIS module is equipped to flag visitors originating from search engine crawlers by inspecting the User-Agent header in the HTTP request, allowing it to contact an external server to fetch the poisoned content to alter the SEO and cause the search engine to index the victim site as a relevant result for the terms found in the command-and-control (C2) server response.

Once the sites have been poisoned in this manner, all it takes to complete the scheme is ensnaring victims who search for those terms in a search engine and end up clicking on the legitimate-but-compromised site, ultimately redirecting them to a scam site instead.

In at least one incident investigated by Unit 42, the attackers are said to have leveraged their access to a search engine crawler to pivot to other systems, create new local user accounts, and drop web shells for establishing persistent remote access, exfiltrating source code, and uploading BadIIS implants.

“The mechanism first builds a lure and then springs the trap,” Unit 42 said. “The lure is built by attackers feeding manipulated content to search engine crawlers. This makes the compromised website rank for additional terms to which it would otherwise have no connection. The compromised web server then acts as a reverse proxy — an intermediary server getting content from other servers and presenting it as its own.”

Some of the other tools deployed by the threat actors in their attacks include three different variants of BadIIS modules –

• A lightweight ASP.NET page handler that achieves the same goal of SEO poisoning by proxying malicious content from a remote C2 server
• A managed .NET IIS module that can inspect and modify every request that passes through the application to inject spam links and keywords from a different C2 server, and
• An all-in-one PHP script that combines user redirection and dynamic SEO poisoning

“The threat actor tailored all the implants to the goal of manipulating search engine results and controlling the flow of traffic,” Unit 42 said. “We assess with high confidence that a Chinese-speaking actor is operating this activity, based on direct linguistic evidence, as well as infrastructure and architecture links between this actor and the Group 9 cluster.”

The disclosure comes weeks after ESET detailed a previously undocumented threat cluster dubbed GhostRedirector that has managed to compromise at least 65 Windows servers primarily located in Brazil, Thailand, and Vietnam with a malicious IIS module codenamed Gamshen to facilitate SEO fraud.

Organizations in Belarus, Kazakhstan, and Russia have emerged as the target of a phishing campaign undertaken by a previously undocumented hacking group called ComicForm since at least April 2025.

The activity primarily targeted industrial, financial, tourism, biotechnology, research, and trade sectors, cybersecurity company F6 said in an analysis published last week.

The attack chain involves sending emails bearing subject lines like “Waiting for the signed document,” “INvoice for Payment,” or “Reconciliation Act for Signature,” urging recipients to open an RR archive, within which there exists a Windows executable that masquerades as a PDF document (e.g., “Акт_сверки pdf 010.exe”). The messages, written in Russian or English, are sent from email addresses registered in the .ru, .by, and .kz top-level domains.

The executable is an obfuscated .NET loader designed to launch a malicious DLL (“MechMatrix Pro.dll”), which subsequently runs a third-stage payload, another DLL named “Montero.dll” that serves as a dropper for the Formbook malware, but not before creating a scheduled task and configuring Microsoft Defender exclusions to evade detection.

Interestingly, the binary has also been found to contain Tumblr links pointing to completely harmless GIFs of comic superheroes like Batman, giving the threat actor its name. “These images were not used in any attack, but were merely part of the malware code,” F6 researcher Vladislav Kugan said.

Analysis of ComicForm’s infrastructure has revealed signs that phishing emails have also been directed against an unspecified company operating in Kazakhstan in June 2025 and a Belarusian bank in April 2025.

F6 also said it detected and blocked phishing emails sent to Russian manufacturing companies from the email address of a Kazakhstan-based industrial company as recently as July 25, 2025. These digital missives prompt prospective targets to click on an embedded link to confirm their account and avoid a potential block.

Users who click on the link are redirected to a bogus landing page mimicking the login page of a domestic document management service to facilitate credential theft by transmitting the entered information to an attacker-controlled domain in the form of an HTTP POST request.

“Additionally, JavaScript code was found in the page body that extracts the email address from URL parameters, populates the input field with id=”email” , extracts the domain from the email address, and sets a screenshot of that domain’s website (via the screenshotapi[.]net API) as the background of the phishing page,” Kugan explained.

The attack aimed at the Belarusian bank involved sending a phishing email with an invoice-themed lure to trick users into entering their email addresses and phone numbers in a form, which are then captured and sent to an external domain.

“The group attacks Russian, Belarusian, and Kazakh companies from various sectors, and the use of English-language emails suggests that the attackers are also targeting organizations in other countries,” F6 said. “The attackers employ both phishing emails distributing FormBook malware and phishing resources disguised as web services to harvest access credentials.”

Pro-Russian Group Targets South Korea with Formbook

The disclosure comes as the NSHC ThreatRecon Team disclosed details of a pro-Russian cybercrime group that has targeted manufacturing, energy, and semiconductor sectors in South Korea. The activity has been attributed to a cluster called SectorJ149 (aka UAC-0050).

The attacks, observed in November 2024, commenced with spear-phishing emails targeting executives and employees using lures related to production facility purchases or quotation requests, leading to the execution of commodity malware families like Lumma Stealer, Formbook, and Remcos RAT by means of a Visual Basic Script distributed as a Microsoft cabinet (CAB) archive.

The Visual Basic Script is engineered to run a PowerShell command that reaches out to a Bitbucket or GitHub repository to fetch a JPG image file, which conceals a loader executable responsible for launching the final stealer and RAT payloads.

“The PE Malware executed directly in the memory area is a loader-type Malware that downloads additional malicious data disguised as a text file (.txt) through a URL included in the provided parameter values, decrypts it, and then generates and executes the PE Malware,” the Singaporean cybersecurity company said.

“In the past, the SectorJ149 group primarily operated for financial gain, but the recent hacking activities targeting Korean companies are believed to have a strong hacktivist nature, using hacking techniques to convey political, social, or ideological messages.”

Sep 22, 2025Ravie Lakshmanan

The security landscape now moves at a pace no patch cycle can match. Attackers aren’t waiting for quarterly updates or monthly fixes—they adapt within hours, blending fresh techniques with old, forgotten flaws to create new openings. A vulnerability closed yesterday can become the blueprint for tomorrow’s breach.

This week’s recap explores the trends driving that constant churn: how threat actors reuse proven tactics in unexpected ways, how emerging technologies widen the attack surface, and what defenders can learn before the next pivot.

Read on to see not just what happened, but what it means—so you can stay ahead instead of scrambling to catch up.

⚡ Threat of the Week

Google Patches Actively Exploited Chrome 0-Day — Google released security updates for the Chrome web browser to address four vulnerabilities, including one that it said has been exploited in the wild. The zero-day vulnerability, CVE-2025-10585, has been described as a type confusion issue in the V8 JavaScript and WebAssembly engine. The company did not share any additional specifics about how the vulnerability is being abused in real-world attacks, by whom, or the scale of such efforts. “Google is aware that an exploit for CVE-2025-10585 exists in the wild,” it acknowledged. CVE-2025-10585 is the sixth zero-day vulnerability in Chrome that has been either actively exploited or demonstrated as a proof-of-concept (PoC) since the start of the year.

• AI-Powered Villager Pen Testing Tool Hits 11,000 PyPI Downloads — A new artificial intelligence (AI)-native penetration testing tool called Villager has reached nearly 11,000 downloads on the Python Package Index (PyPI) just two months after release. The rapid adoption of what appears to be a legitimate tool echoes the trajectory of Cobalt Strike, Sliver, and Brute Ratel C4 (BRc4), which were created for legitimate use but have since become some of the favorite tools among cybercriminals. The release of Villager has also raised concerns over dual-use abuse, with threat actors potentially misusing it to run advanced intrusions with speed and efficiency.
• RowHammer Attack Against DDR5 RAM From SK Hynix — Researchers have devised a new technique to trigger RowHammer bit flips inside the memory cells of DDR5 RAM modules, which were believed to be protected against such attacks. The attack allows controlled memory modification, leading to privilege escalation exploits or the leaking of sensitive data stored in restricted memory regions. “Our reverse-engineering efforts show that significantly longer RowHammer patterns are nowadays necessary to bypass these new protections,” the researchers said. “To trigger RowHammer bit flips, such patterns need to remain in-sync with thousands of refresh commands, which is challenging. Our new RowHammer attack, called Phoenix, resynchronizes these long patterns as necessary to trigger the first DDR5 bit flips in devices with such advanced TRR protections.”
• Scattered Spider Members Arrested — Law enforcement authorities in the U.K. arrested two teen members of the Scattered Spider hacking group in connection with their alleged participation in an August 2024 cyber attack targeting Transport for London (TfL), the city’s public transportation agency. Thalha Jubair (aka EarthtoStar, Brad, Austin, and @autistic), 19, from East London, and Owen Flowers, 18, from Walsall, West Midlands were arrested at their home addresses. In parallel, the U.S. Department of Justice (DoJ) unsealed a complaint charging Jubair with conspiracies to commit computer fraud, wire fraud, and money laundering in relation to at least 120 computer network intrusions and extorting 47 U.S. entities from May 2022 to September 2025. Victims of the ransomware attacks paid at least $115,000,000 in payments. In a related but separate announcement, the Los Angeles Metropolitan Police Department said a teenage male surrendered by himself on September 17, 2025, for allegedly attacking multiple Las Vegas casino properties between August and October 2023. The juvenile suspect has been charged with three counts of Obtaining and Using Personal Identifying Information of Another Person to Harm or Impersonate Person, one count of extortion, one count of Conspiracy to Commit Extortion, and one count of Unlawful Acts Regarding Computers. The arrests came as 15 well-known e-crime groups, including Scattered Spider, ShinyHunters, and LAPSUS$, announced that they are shutting down their operations. The collective announcement was posted on BreachForums, where the groups claimed they had achieved their goals of exposing weaknesses in digital infrastructure rather than profiting through extortion. While it’s very much possible that some of the members may have decided to step back and enjoy their earnings, it does not stop copycat groups from rising up and taking their spots, or even for the threat actors to resurface under a different brand.
• Gameredon and Turla Join Hands to Strike Ukraine — The Russian hacker group known as Turla has carried out some of the most innovative hacking feats in the history of cyber espionage, including hijacking other hackers’ operations to cloak their own data extraction. Even when they’re operating on their home turf, they have adopted equally remarkable methods, such as using their control of Russia’s internet service providers to directly plant spyware on the computers of their targets in Moscow. The latest approach involves leveraging the access obtained by fellow FSB group Gamaredon to selectively target high-value targets with a backdoor known as Kazuar. The development marks the first known cases of collaboration between Gamaredon and Turla.
• Microsoft and Cloudflare Dismantle RaccoonO365 PhaaS — Microsoft’s Digital Crimes Unit said it teamed up with Cloudflare to coordinate the seizure of 338 domains used by RaccoonO365, a financially motivated threat group that was behind a phishing-as-a-service (PhaaS) toolkit used to steal more than 5,000 Microsoft 365 credentials from 94 countries since July 2024. RaccoonO365 is marketed to other cybercriminals under a subscription model, allowing them to mount phishing and credential harvesting attacks at scale with little to no technical expertise. A 30-day plan costs $355, and a 90-day plan is priced at $999. Cloudflare said it banned all identified domains, placed interstitial “phish warning” pages in front of them, terminated the associated Workers scripts, and suspended the user accounts.
• Self-Replicating Worm Hits npm Registry — Another software supply chain attack hit the npm registry, this time infecting several packages with a self-replicating worm that searches developer machines for secrets using TruffleHog’s credential scanner and transmits them to an external server under the attacker’s control. The attack is capable of targeting both Windows and Linux systems. The incident is estimated to have affected over 500 packages.

‎️‍🔥 Trending CVEs

Hackers don’t wait. They exploit newly disclosed vulnerabilities within hours, transforming a missed patch or a hidden bug into a critical point of failure. One unpatched CVE is all it takes to open the door to a full-scale compromise. Below are this week’s most critical vulnerabilities, making waves across the industry. Review the list, prioritize patching, and close the window of opportunity before attackers do.

This week’s list includes — CVE-2025-10585 (Google Chrome), CVE-2025-55241 (Microsoft Azure Entra), CVE-2025-10035 (Fortra GoAnywhere Managed File Transfer), CVE-2025-58434 (Flowise), CVE-2025-58364, CVE-2025-58060 (Linux CUPS), CVE-2025-8699 (KioSoft), CVE-2025-5821 (Case Theme User), CVE-2025-41248, CVE-2025-41249 (Spring Framework), CVE-2025-38501 (Linux Kernel KSMBD), CVE-2025-9242 (WatchGuard Firebox), CVE-2025-9961 (TP-Link), CVE-2025-5115, CVE-2025-59474 (Jenkins), CVE-2025-59340 (HubSpot Jinjava), CVE-2025-58321 (Delta Electronics DIALink), CVE-2023-49564 (Nokia CloudBand Infrastructure Software and Container Service), and path traversal (LVE-2025-0257) and authentication bypass or local privilege escalation (LVE-2025-0264) flaws in LG’s webOS for smart TVs.

📰 Around the Cyber World

• China’s Great Firewall Leak — The Great Firewall of China (GFW) suffered its largest-ever internal data breach after unknown actors published a 600 GB trove of sensitive material – including source code, work logs, configuration files, and internal communications. The data appears to have come from the servers of Geedge Networks and the Massive and Effective Stream Analysis (MESA) Lab at the Institute of Information Engineering, Chinese Academy of Sciences. The leaked data detail efforts to conduct deep packet inspection, real-time mobile internet monitoring, instructions on how to carry out granular control over data traffic, and censorship rules tailored to different regions. InterSecLab also argues the data indicates Chinese authorities can locate netizens, adding Geedge’s contributions to the Great Firewall may be copies of security appliances made by vendors Greynoise and Fortinet. The development came as Geedge Networks has been flagged for exporting technology to build national censorship firewalls. The governments of Kazakhstan, Ethiopia, Pakistan, and Myanmar have purchased and installed equipment from the company. “The company not only provides services to local governments in Xinjiang, Jiangsu, and Fujian, but also exports censorship and surveillance technology to countries such as Myanmar, Pakistan, Ethiopia, and Kazakhstan under the ‘Belt and Road’ framework,” the Great Firewall Report said.
• Cyber Scam Centers Likely Shift to Vulnerable Jurisdictions — Transnational criminal groups appear to be moving cyber scam centers to vulnerable countries through criminal foreign direct investment (FDI). The United Nations Office on Drugs and Crime (UNDOC) warned it had found “indications of scam center activity, including SIM cards and satellite internet devices” at a hotel in the Special Administrative Region of Oecusse-Ambeno (RAEOA). “With growing awareness and understanding of scam centers and related criminal activity, law enforcement pressure has intensified across Southeast Asia, making it more difficult for organized crime groups to operate in traditional hotspot areas,” UNDOC advised. “As a result, syndicates actively create avenues for expanding operations to new jurisdictions with limited experience in scam center responses, including Timor-Leste.”
• Phishing Campaigns Drop RMM Tools — Phishing campaigns have been observed dropping remote monitoring and management (RMM) tools ITarian (aka Comodo), PDQ, SimpleHelp, and Atera, using a variety of social engineering lures, such as fake browser updates, meeting invitations, party invitations, and fake government forms. “Adversaries often use RMM tools in a stealthy and effective way to retain control over compromised systems without raising immediate alarms,” Zscaler-owned Red Canary said. “Hands-on-keyboard actions allow the adversary to modify their behaviors so they blend in with day-to-day administrator activity, complicating detection opportunities.” Attacks that deploy ITarian have even been found to leverage the access to deliver Hijack Loader and DeerStealer malware.
• SVG Attachments in Phishing Emails Deliver RATs — Threat actors are continuing to leverage SVG file attachments in phishing emails to filelessly deliver XWorm and Remcos via Windows batch scripts. “These campaigns often begin with a ZIP archive, typically hosted on trusted-looking platforms such as ImgKit, and are designed to appear as legitimate content to entice user interaction,” Seqrite Labs said. Upon extraction, the ZIP file contains a highly obfuscated BAT script that serves as the initial stage of the infection chain. These BAT files use advanced techniques to evade static detection and are responsible for executing PowerShell-based loaders that inject the RAT payload directly into memory.”
• Buterat Backdoor Detailed — A Windows backdoor known as Buterat has been identified as being distributed via phishing campaigns, malicious attachments, or trojanized software downloads to seize control of infected endpoints remotely, deploy additional payloads, and exfiltrate sensitive information. “Once executed, it disguises its processes under legitimate system tasks, modifies registry keys for persistence, and uses encrypted or obfuscated communication channels to avoid network-based detection,” Point Wild said.
• Mac.c Stealer Rebrands to MacSync — The macOS-focused information stealer known as Mac.c Stealer has been rebranded to MacSync, but follows the same malware-as-a-service (MaaS) model. “The old project risked dying from lack of time and funding, so it was purchased and will be developed further without dwelling on past difficulties,” the threat actors said in an interview with security researcher g0njxa. “MacSync Stealer is a reliable stealer with broad functionality that emphasizes simplicity and effectiveness. Literally, you can start using it immediately after purchase.” According to MacPaw Moonlock Lab, MacSync includes a fully-featured Go-based agent acting as a backdoor, expanding its functionality far beyond basic data exfiltration. “This makes MacSync one of the first known cases of a macOS stealer with modular, remote command-and-control capabilities,” the company said. AMOS, which was also updated in July 2025 with its own backdoor, relies on C-based components and curl for C2 communication. In contrast, MacSync’s approach is stealthier as it utilizes the native net/http library for HTTPS requests. MacSync infections have been detected in Europe and North America, with the most activity originating from Ukraine, the U.S., Germany, and the U.K.
• Google Releases VaultGemma — Google has released VaultGemma, a large language model (LLM) designed to keep sensitive data private during training. The model uses differential privacy techniques to prevent individual data points from being exposed by adding calibrated noise, which makes it safer for handling confidential information in healthcare, finance, and government sectors. “VaultGemma represents a significant step forward in the journey toward building AI that is both powerful and private by design,” Google said. “While a utility gap still exists between DP-trained and non-DP–trained models, we believe this gap can be systematically narrowed with more research on mechanism design for DP training.” Last month, the tech giant released a new active learning method for curating high-quality data that reduces training data requirements for fine-tuning LLMs by orders of magnitude. “The process can be applied to datasets of hundreds of billions of examples to iteratively identify the examples for which annotation would be most valuable and then use the resulting expert labels for fine-tuning,” it noted. “The ability to retrain models with just a handful of examples is especially valuable for handling the rapidly changing landscapes of domains like ads safety.”
• Indonesia Targeted by Mobile Malware Campaign — A Chinese-speaking threat group has been exploiting Indonesia’s state pension fund, TASPEN, to launch a sophisticated mobile malware campaign targeting senior citizens and enabling full-spectrum data theft and financial fraud. The attack uses a phishing site mimicking TASPEN to trick users into downloading the malicious APK file. Users are directed to these links via SEO poisoning campaigns. “Disguised as an official app, the spyware steals banking credentials, OTPs, and even biometric data, enabling large-scale fraud,” CloudSEK said. “Beyond financial loss, the attack erodes public trust, threatens Indonesia’s digital transformation, and sets a dangerous precedent for pension fund attacks across Southeast Asia.” Technical artifacts found within the malware’s distribution network and communication channels, including error messages and developer comments written in Simplified Chinese, strongly suggest the involvement of a well-organized, Chinese-speaking threat actor group.
• Luno Botnet Combines Crypto Mining and DDoS Features — A new Linux botnet campaign dubbed Luno has combined cryptocurrency mining, remote command execution, and modular DDoS attack capabilities targeting gaming platforms, suggesting long-term monetization and operational flexibility. It’s advertised via the domain main.botnet[.]world. The malware launches watchdog threads that continuously monitor the parent process and respawn it under a disguised name if it terminates. It’s also designed to ignore termination signals (SIGSEGV, SIGTERM, SIGINT, SIGHUP, and SIGPIPE) to protect itself from easy termination while disguising itself as bash.” “Unlike conventional crypto miners or DDoS botnets, LunoC2 exhibits process masquerading, binary replacement, and a self-update system, suggesting the malware is designed as a long-term criminal infrastructure tool,” Cyble said.
• Apple macOS Users Targeted by Odyssey Stealer — Threat actors are exploiting a fake Microsoft Teams download site to deliver the Odyssey macOS stealer via the ClickFix social engineering tactic. “Once executed, the malware harvests credentials, cookies, Apple Notes, and crypto wallets, exfiltrating data to a C2 server before ensuring persistence through LaunchDaemons and even replacing Ledger Live with a trojanized version,” CloudSEK said.
• FIDO Authentication Downgrade Demonstrated — A new FIDO downgrade attack against Microsoft Entra ID can trick users into authenticating with weaker login methods, making them susceptible to phishing and session hijacking. The weaker authentication methods are vulnerable to adversary-in-the-middle (AitM) phishing attacks that employ tools like Evilginx, allowing attackers to capture valid session cookies and hijack the accounts. The attack, devised by Proofpoint, employs a custom phishlet within the Evilginx AitM framework to spoof a browser user agent that lacks FIDO support. Specifically, this involves spoofing Safari on Windows, which is not compatible with FIDO-based authentication in Microsoft Entra ID. “This seemingly insignificant gap in functionality can be leveraged by attackers,” the company said. “A threat actor can adjust the AiTM to spoof an unsupported user agent, which is not recognized by a FIDO implementation. Subsequently, the user would be forced to authenticate through a less secure method. This behavior, observed on Microsoft platforms, is a missing security measure.” This causes the authentication system to fallback to a less secure verification method, such as OTPs, enabling the AitM proxy to intercept a user’s credentials and tokens. To prevent this type of attack, customers are recommended to deploy phishing-resistant authentication methods, along with Conditional Access enforcement.
• Canada Shuts Down TradeOgre — The Royal Canadian Mounted Police (RCMP) shut down the TradeOgre cryptocurrency exchange and seized more than $40 million believed to originate from criminal activities, marking the first time a cryptocurrency exchange platform has been dismantled by Canadian law enforcement. The RCMP said the platform violated Canadian laws by failing to register with the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) as a money services business and that it has “reason to believe that the majority of funds transacted on TradeOgre came from criminal sources.” The service had gone offline towards the end of July 2025.
• Windows SCM for Lateral Movement — Cybersecurity researchers have demonstrated a stealthy lateral movement technique that uses Windows Service Control Manager (SCM) to execute commands on remote PCs discreetly. “Attackers can execute malicious payloads without ever dropping a file on disk by remotely modifying service configurations via built-in APIs such as ChangeServiceConfigA,” Trellix said. “This type of fileless lateral movement is extremely difficult to detect with traditional security solutions that only monitor endpoints or files. Attackers may use legitimate credentials, avoid writing to disk, and blend into normal administrative behavior, making their actions appear benign.”

• Security Flaws in Novakon ICS Devices — Half a dozen security flaws (from CVE-2025-9962 through CVE-2025-9966) have been discovered in industrial control system (ICS) products made by Taiwan-based Novakon that could allow remote code execution with root privileges, retrieve and manipulate system files, and abuse weakly protected services and processes. Given that no patches have been released by the company, users are advised to restrict network access to the device and disable Ethernet configuration if serial ports are used for PLC communication.
• U.S. Sounds Alarm on Hidden Radios in Solar-Powered Devices — The U.S. Department of Transportation’s Federal Highway Department alerted highway agencies and infrastructure firms that “solar-powered highway infrastructure including chargers, roadside weather stations, and traffic cameras should be scanned for the presence of rogue devices — such as hidden radios — secreted inside batteries and inverters,” according to a report from Reuters, raising fresh supply chain concerns. The note did not specify where the products containing undocumented equipment had been imported from. The risk underscores the need for suppliers to provide something akin to a Software Bill of Materials (SBOM) to inventory the hardware components in their equipment for improved visibility.
• New Zealand Sanctions Russian Hackers — New Zealand has imposed sanctions on Russian military intelligence hackers accused of cyberattacks on Ukraine, including members of a notorious hacking unit previously tied to destructive malware campaigns. The sanctions target Unit 29155 of Russia’s GRU intelligence agency, which is also tracked as Cadet Blizzard and Ember Bear.
• DarkCloud Stealer Targets Financial Orgs — Financial enterprises are the target of a malware campaign distributing DarkCloud Stealer since August 2025 through phishing emails with malicious RAR attachments. “The observed samples were programmed to target Windows users and programmed to steal login credentials from email clients, FTP clients, and data from browsers,” CyberProof said. “DarkCloud operators are also seen using the DarkCloud loader embedded into a JPG file, which is downloaded using PowerShell in the attack chain.” Contained within the archive is a VBE file that, when executed, downloads the JPG image, which is then unpacked to launch the DarkCloud loader .NET DLL.
• Model Namespace Reuse Aims for AI Supply Chains — Cybersecurity researchers demonstrated a technique called Model Namespace Reuse that exploits a fundamental flaw in the AI supply chain to gain Remote Code Execution (RCE) and additional capabilities on major platforms like Microsoft’s Azure AI Foundry, Google’s Vertex AI, and Hugging Face. “Model Namespace Reuse occurs when cloud provider model catalogs or code retrieve a deleted or transferred model by name,” Palo Alto Networks Unit 42 said. “By re-registering an abandoned namespace and recreating its original path, malicious actors can target pipelines that deploy models based solely on their name. This potentially allows attackers to deploy malicious models and gain code execution capabilities, among other impacts.” A severe consequence of this threat is that developers who rely on the trusted model catalogs of major cloud AI services could unknowingly deploy malicious models originally hosted on Hugging Face without ever interacting with Hugging Face directly. To mitigate the risks associated with Model Namespace Reuse, it’s advised to pin the used model to a specific commit, clone the model and store it in a trusted location, and treat model references like any other dependency subject to policy and review.

• New VoidProxy PhaaS Detailed — A new Phishing-as-a-Service (PhaaS) named VoidProxy has been spotted in the wild using Adversary-in-the-Middle (AitM) techniques to intercept authentication flows in real-time, capturing credentials, MFA codes and any session tokens established during the sign-in event. “VoidProxy is a novel and highly evasive service used by attackers to target Microsoft and Google accounts,” Okta said. “The service is also capable of redirecting accounts protected by third-party single sign-on (SSO) providers like Okta to second-stage phishing pages.” Campaigns relying on the phishing kit have leveraged compromised accounts of legitimate Email Service Providers (ESPs) such as Constant Contact, Active Campaign (Postmarkapp), and NotifyVisitors, to bypass spam filters and send email messages that trick users into providing their credentials by clicking on links that are shortened using URL shorteners like TinyURL. Before any of the phishing landing sites load, the user is presented with a Cloudflare Captcha challenge to determine if the request is from an interactive user or a bot. The malicious sites are hosted on disposable low-cost domains on .icu, .sbs, .cfd, .xyz, .top, and .home, which are protected by Cloudflare to hide their real IP addresses.
• SideWinder Strikes Nepal with Android Malware — The advanced persistent threat actor SideWinder capitalized on the recent Gen-Z protests in Nepal to phish government entities and infect them with Android and Windows malware masquerading as legitimate emergency services. The malware, designed to siphon sensitive data, is distributed via phishing websites spoofing the Nepalese Emergency Service or an Emergency Helpline portal. In a related development, the threat actor known as Rattlesnake (aka APT-C-24) has been observed using Windows shortcut (LNK) files as payloads to execute malicious scripts in remote URLs. “These scripts are multi-layered and complex obfuscation, which eventually loads the execution attack components in memory to achieve remote control of the target host.” Another campaign, attributed to Patchwork, has leveraged spear-phishing lures to distribute Quasar RAT, AsyncRAT, and the Mythic post-exploitation framework in attacks aimed at Pakistan.
• WordPress Plugin Flaw Under Active Attack — Threat actors are exploiting a vulnerability (CVE-2025-5821, CVSS score: 9.8) in Case Theme User, a WordPress plugin bundled with various commercial WordPress themes. “This vulnerability makes it possible for an unauthenticated attacker to gain access to any account on a site, including accounts used to administer the site, if the attacker knows, or can find, the associated email address,” Wordfence said. The plugin is installed on more than 12,000 websites. A patch for the flaw was released on August 13, 2025, with exploitation activity beginning on August 22.
• Google Releases CSE for Sheets — Google has made available a conversion tool to convert decrypted Google Sheets files encrypted using client-side encryption into a Microsoft Excel file. Currently, client-side encryption is available in Google Drive, Docs, Gmail, Calendar, and Meet.
• Israel Defense Ministry Orders Seizure of IRGC Crypto Wallets — Israel’s Ministry of Defense announced that it was ordering the seizure of 187 cryptocurrency wallets that allegedly belong to Iran’s Islamic Revolutionary Guard Corps (IRGC), alleging that they are “used for the perpetration of a severe terror crime.” These addresses have collectively received $1.5 billion in Tether’s USDT stablecoin, although it’s currently not known if all the transactions are directly linked to the IRGC, as blockchain analytics firm Elliptic said that “some of the addresses may be controlled by cryptocurrency services and could be part of wallet infrastructure used to facilitate transactions for many customers.”
• Europol Adds Spanish University Professor to Most Wanted List — Europol placed Enrique Arias Gil (aka Desinformador Ruso), 37, a former Spanish university professor, on its most wanted list over accusations of helping the pro-Russian hacker group NoName057(16), according to Spain’s National Police. In a message on his Telegram channel, Arias Gil demanded that Spanish law enforcement drop the case within 10 hours or risk the release of alleged kompromat on senior officials. Noname057(16) has called the move a witch hunt.
• Pro-Kremlin Op CopyCopy Sets Up New Sites — The Russian covert influence operation known as CopyCop, or Storm-1516, has been linked to new infrastructure since March 2025. This includes “200 new fictional media websites targeting the United States, France, and Canada, in addition to websites impersonating media brands and political parties and movements in France, Canada, and Armenia.” The network is also said to have established a regionalized network of websites posing as a fictional fact-checking organization publishing content in Turkish, Ukrainian, and Swahili languages, Recorded Future said. In all, the group has established over 300 websites since the start of the year. These websites are likely operated by John Mark Dougan with support from the Moscow-based Center for Geopolitical Expertise (CGE) and the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU). “CopyCop’s core influence objectives remain eroding public support for Ukraine and undermining democratic processes and political leaders in Western countries supporting Ukraine,” the company said.
• Decade-Old Pixie Dust Wi-Fi Hack Still Affects Many Devices — Many current router models are still susceptible to a 10-year-old Wi-Fi attack named Pixie Dust, which was first disclosed in 2014. The attack allows threat actors to recover a router’s Wi-Fi Protected Setup (WPS) PIN and access its Wi-Fi network by exploiting weaknesses in the key generation mechanism in the WPS protocol. According to a study by NetRise, 24 devices, including routers, range extenders, access points, and hybrid Wi-Fi/powerline products, spanning six vendors, have been found to be vulnerable to the exploit. “As of this writing, 13 devices remain actively supported but unpatched,” the company said. “Another seven reached their end of life without ever receiving fixes.”
• TikTok Takes Down Influence Operation From Thailand — TikTok said it took down several influence operation networks in July 2025 that targeted the political discourse in Thailand, Ukraine, Azerbaijan, and Israel and Palestine, as well as the war between Russia and Ukraine. The largest network, comprising 398 accounts, operated from Thailand and targeted Chinese-speaking audiences. “The individuals behind this network created inauthentic accounts in order to amplify narratives of Chinese dominance and Western inefficiencies,” TikTok said. “The network was found to use AI-generated content, which often incorporated various animal characters, as commentary on global events.”
• GitHub Announces Post-Quantum SSH Key Exchange Support — GitHub announced it’s adding a new post-quantum secure SSH key exchange algorithm, known alternately as sntrup761x25519-sha512 and sntrup761x25519-sha512@openssh.com, to its SSH endpoints for accessing Git data. This is part of efforts to counter the threat of future decryption attacks once quantum computers become broadly available. “This only affects SSH access and doesn’t impact HTTPS access at all,” GitHub said. “It also does not affect GitHub Enterprise Cloud with data residency in the United States region.” The new algorithm was enabled on September 17, 2025, for GitHub.com and GitHub Enterprise Cloud with data residency. It is also expected to be included in GitHub Enterprise Server 3.19.
• Consumer Reports Urges Microsoft to Extend October 2025 Deadline — Consumer Reports called on Microsoft to extend the October 14, 2025, deadline that will cut off free security updates for Windows 10 computers, stating the move “risks harming the consumer as well as co-opting the machine to perpetuate attacks against other entities, risking national security.” Around 46.2 percent of people around the world still use Windows 10 as of August 2025.
• China Announces Stricter Data Breach Requirements — The Chinese government will require critical infrastructure operators to report security breaches within an hour of detection. The new deadline requires that all serious incidents be reported to the relevant authorities within 60 minutes – or in the case of “particularly major” events, 30 minutes. Companies that fail to report such incidents risk facing penalties. The new reporting rules will take effect starting November 1, 2025, according to the Cyberspace Administration of China (CAC). “If the network operator reports late, omitted, falsely reported or concealed network security incidents, causing major harmful consequences, the network operator and the relevant responsible persons shall be punished more severely according to law,” Beijing warned.
• Possible Ties Between Belsen Group and ZeroSevenGroup? — Cybersecurity company KELA suggested a possible connection between the Belsen Group and ZeroSevenGroup, two cybercriminal entities with ties to Yemen that emerged in January 2025 and July 2024, respectively. Both groups are known for leaking and monetizing stolen data, as well as sharing similarities in writing style and post formatting. “While these overlaps are not conclusive, they suggest a possible connection,” it said.
• SmokeLoader Returns with New Changes — SmokeLoader, which was disrupted as part of Operation Endgame in May 2024, has resurfaced with a new version in July 2025 with a modified network protocol that breaks compatibility with prior versions. The new variant is being tracked by Zscaler ThreatLabz as version 2025. Also detected earlier this February is a variant named version 2025 alpha that included bug fixes that caused performance degradation. “SmokeLoader consists of two main components: a stager and a main module,” Zscaler said. “The stager has two main purposes: hinder analysis, detect virtual environments (and terminate if present), and inject the SmokeLoader main module into explorer.exe. The main module performs the bulk of the malicious functionality, including establishing persistence, beaconing to the C2 server, and executing tasks and plugins.” The main function of the loader is to download and execute second-stage malware. It may also use optional plugins to perform tasks such as stealing data, launching distributed denial of service attacks, and mining cryptocurrency.
• E.U. Spyware Vendors Pocket Startup Subsidies — A new report from Follow The Money found cases of spyware and surveillance companies using E.U. startup subsidies to create hacking tools that are then used against E.U. citizens. “The beneficiaries include some big names in the market such as the Intellexa Alliance, Cy4Gate, Verint Systems, and Cognyte, along with smaller European firms,” the report said.
• PyPI Invalidates Tokens Stolen in GhostAction Attack — The maintainers of the Python Package Index (PyPI) said they invalidated all PyPI tokens stolen from GitHub repos by a malicious action on September 5 in a supply chain attack known as GhostAction. None of the tokens were abused to upload malware to the registry, and impacted project maintainers have been notified. Users who rely on GitHub Actions to publish to PyPI are advised to replace long-lived tokens with Trusted Publishers and review account history for any suspicious activity.
• U.K. MI6 Launches Silent Courier — The UK’s foreign intelligence service, MI6, launched Silent Courier, an online portal (“mi6govukbfxe5pzxqw3otzd2t4nhi7v6x4dljwba3jmsczozcolx2vqd.onion”) hosted on the dark web designed to let potential spies from Russia and elsewhere communicate with U.K. intelligence. The idea is to recruit spies “anywhere in the world with access to sensitive information relating to terrorism or hostile intelligence activity.”
• New Information Stealers Detected — Cyble, CYFIRMA, and Point Wild shared details on three new information stealer families called Maranhão Stealer, XillenStealer, and Raven, respectively.
• New and Emerging Ransomware Strains Detected — Some of the nascent ransomware operations that have been documented in recent weeks include BlackLock, BlackNevas, BQTLOCK, Crypto24, CyberVolk, EXTEN, GAGAKICK, Gentleman, Jackpot, KillSec, LockBeast, NEZHA, Obscura, and Yurei. In particular, the Crypto24 ransomware group has been observed using a custom version of the open-source RealBlindingEDR tool to disable security software running on infected hosts prior to deploying the locker. “The threat actor’s customized version employs advanced evasion, likely via unknown vulnerable drivers, showcasing deep technical expertise and ongoing tool refinement,” Trend Micro said. “The group’s ability to maintain persistence before encryption reflects patience and strategic planning uncommon in commodity ransomware.”

🎥 Cybersecurity Webinars

• AI + Human Workflows: Your Simple Blueprint for Secure Automation: AI can speed up your work—but only if you use it wisely. In this webinar, Thomas Kinsella, Co-founder and Chief Customer Officer at Tines, will show how top teams mix human skills, rules-based steps, and AI tools to build workflows that are clear, secure, and easy to audit. You’ll walk away knowing where AI fits best and how to avoid the common traps of over-engineering.
• Banish Costly Breaches: A Practical Blueprint for Stronger Password Security: Passwords are still the easiest way for attackers to break in—and the hardest headache for IT teams. This Halloween, join The Hacker News and Specops Software to uncover real password breach stories, see why old password rules fail, and watch a live demo of tools that block stolen credentials in real time. You’ll leave with a clear, simple plan to protect your company, meet compliance needs, and end password problems for good—without making life harder for users.
• See Every Risk from Code to Cloud—Before Hackers Spot the Gap: Modern apps move fast—from code changes to cloud deployment—but hidden gaps in visibility give attackers room to strike. Join us to see how code-to-cloud mapping unites developers, DevOps, and security teams on one clear view of risk. You’ll learn how to spot vulnerabilities, secrets, and misconfigurations early, link them to real runtime exposure, and cut noise so teams can fix issues faster and with confidence.
• Seal Every Gap: Practical Steps to Lock Down Python Packages and Containers: Python projects face bigger security risks than ever in 2025—malicious packages, repo hijacks, and vulnerable base images can all open the door to attackers. Join us to learn simple, proven ways to protect your Python supply chain. We’ll show real examples of recent attacks, demo the latest scanning and signing tools, and share steps you can take now to lock down your code, containers, and dependencies with confidence.

🔧 Cybersecurity Tools

• NPM Malware Scanner: It is a command-line tool that helps you spot dangerous or suspicious npm packages before they reach production. It scans GitHub repositories or local projects, checks every package.json file, and flags known malware or risky dependencies using a built-in database. Designed for speed and clear results, it gives developers and security teams an easy way to keep their JavaScript projects safe without extra setup.
• VMDragonSlayer: It is a research framework built to uncover and analyze binaries protected by virtual machine–based obfuscation. It combines techniques like dynamic taint tracking, symbolic execution, pattern matching, and machine learning to speed up reverse engineering that normally takes weeks or months. With integrations for tools such as Ghidra, IDA Pro, and Binary Ninja, it helps researchers detect VM-based protectors and understand complex, custom malware environments through structured, automated analysis.

Disclaimer: The tools featured here are provided strictly for educational and research purposes. They have not undergone full security audits, and their behavior may introduce risks if misused. Before experimenting, carefully review the source code, test only in controlled environments, and apply appropriate safeguards. Always ensure your usage aligns with ethical guidelines, legal requirements, and organizational policies.

🔒 Tip of the Week

Catch Fake Cell Towers Before They Catch You — Cell-site simulators—also known as IMSI catchers or “stingrays”—mimic real cell towers to intercept calls or track devices. They’re showing up in more places and can silently scoop up data from nearby phones.

Use open-source detection tools to monitor your environment. Rayhunter, created by the Electronic Frontier Foundation, runs on inexpensive mobile hotspots and watches the control traffic between your device and the cell network. It flags suspicious behavior—like forced 2G downgrades or fake tower identifiers—without snooping on your personal data.

Other Options to Explore:

• SnoopSnitch (Android) – Uses your phone’s radio diagnostics to warn of fake towers.
• Cell Spy Catcher – Detects IMSI catchers by monitoring unusual network changes.
• Stingray Detector apps & SDR projects – For advanced users with software-defined radios.

Quick Win: Set up one of these tools during events, protests, or when traveling in high-risk areas. Even if you’re not a security pro, these tools give you a visible early warning when someone tries to spy on mobile traffic.

Pro move: Combine mobile-network monitoring with strong basics—use end-to-end encrypted messaging (like Signal) and keep your phone’s OS updated. This layered defense makes it far harder for attackers to gather useful data, even if they’re nearby.

Conclusion

The threat landscape won’t slow down, but that doesn’t mean you’re powerless. Awareness is leverage: it lets you patch faster, question assumptions, and spot weak spots before they become incidents. Keep these takeaways in mind, share them with your team, and turn today’s lessons into tomorrow’s advantage.

The threat landscape won’t slow down, but that doesn’t mean you’re powerless. Awareness is leverage: it lets you patch faster, question assumptions, and spot weak spots before they become incidents. Keep these takeaways in mind, share them with your team, and turn today’s lessons into tomorrow’s advantage.

We hear this a lot:

“We’ve got hundreds of service accounts and AI agents running in the background. We didn’t create most of them. We don’t know who owns them. How are we supposed to secure them?”

Every enterprise today runs on more than users. Behind the scenes, thousands of non-human identities, from service accounts to API tokens to AI agents, access systems, move data, and execute tasks around the clock.

They’re not new. But they’re multiplying fast. And most weren’t built with security in mind.

Traditional identity tools assume intent, context, and ownership. Non-human identities have none of those. They don’t log in and out. They don’t get offboarded. And with the rise of autonomous agents, they’re beginning to make their own decisions, often with broad permissions and little oversight.

It’s already creating new blind spots. But we’re only at the beginning.

In this post, we’ll look at how non-human identity risk is evolving, where most organizations are still exposed, and how an identity security fabric helps security teams get ahead before the scale becomes unmanageable.

The rise (and risk) of non-human identities

Cloud-first architectures increased infrastructure complexity and triggered a surge in background identities. As these environments grow, the number of background identities grows with them, many of which get created automatically, without clear ownership or oversight. In many cases, these identities outnumber human users by more than 80 to 1.

What makes that especially risky is how little most teams know about them. NHIs often get created automatically during deployment or provisioning, then disappear from the radar, untracked, unowned, and often over-permissioned.

Service accounts, in particular, are everywhere. They move data between systems, run scheduled jobs, and authenticate headless services. But their sprawl is rarely visible, and their permissions are rarely reviewed. Over time, they become perfect vehicles for lateral movement and privilege escalation.

But service accounts are only part of the picture. As AI adoption grows, a new category of non-human identity introduces even more unpredictable risk.

Why AI agents behave differently and why that matters

Unlike most machine identities, AI agents initiate actions on their own; interacting with APIs, querying data, and making decisions autonomously.

That autonomy comes at a cost. AI agents often need access to sensitive data and APIs, but few organizations have guardrails for what they can do or how to revoke that access.

Worse, most AI agents lack clear ownership, follow no standard lifecycle, and offer little visibility into their real-world behavior. They can be deployed by developers, embedded in tools, or called via external APIs. Once live, they can run indefinitely, often with persistent credentials and elevated permissions.

And because they’re not tied to a user or session, AI agents are difficult to monitor using traditional identity signals like IP, location, or device context.

The cost of invisible access

Secrets get hardcoded. Tokens get reused. Orphaned identities remain active for months, sometimes years.

These risks are not new, but static credentials and wide-open access may have been manageable when you had a few dozen service accounts. But with thousands, or tens of thousands, of NHIs operating independently across cloud services, manual tracking simply doesn’t scale.

That’s why many security teams are revisiting how they define identity in the first place. Because if an AI agent can authenticate, access data, and make decisions, it is an identity. And if that identity isn’t governed, it’s a liability.

Common NHI security challenges

Understanding that non-human identities represent a growing risk is one thing; managing that risk is another. The core problem is that the tools and processes built for human identity management don’t translate to the world of APIs, service accounts, and AI agents. This disconnect creates several distinct and dangerous security challenges that many organizations are only beginning to confront.

See how Okta and AWS help organizations bring order to NHI sprawl. [Download the guide] to get started.

A critical token validation failure in Microsoft Entra ID (previously Azure Active Directory) could have allowed attackers to impersonate any user, including Global Administrators, across any tenant.

The vulnerability, tracked as CVE-2025-55241, has been assigned the maximum CVSS score of 10.0. It has been described by Microsoft as a privilege escalation flaw in Azure Entra. There is no indication that the issue was exploited in the wild. It has been addressed by the Windows maker as of July 17, 2025, requiring no customer action.

Security researcher Dirk-jan Mollema, who discovered and reported the shortcoming on July 14, said the shortcoming made it possible to compromise every Entra ID tenant in the world, with the likely exception of national cloud deployments.

The problem stems from a combination of two components: the use of service-to-service (S2S) actor tokens issued by the Access Control Service (ACS) and a fatal flaw in the legacy Azure AD Graph API (graph.windows.net) that did not adequately validate the originating tenant, which effectively allowed the tokens to be used for cross-tenant access.

What makes this noteworthy is that the tokens are subject to Microsoft’s Conditional Access policies, enabling a bad actor with access to the Graph API to make unauthorized modifications. To make matters worse, the lack of API level logging for the Graph API meant that it could be exploited to access user information stored in Entra ID, group and role details, tenant settings, application permissions, and device information and BitLocker keys synced to Entra ID without leaving any traces.

An impersonation of the Global Administrator could allow an attacker to create new accounts, grant themselves additional permissions, or exfiltrate sensitive data, resulting in a full tenant compromise with access to any service that uses Entra ID for authentication, such as SharePoint Online and Exchange Online.

“It would also provide full access to any resource hosted in Azure, since these resources are controlled from the tenant level and Global Admins can grant themselves rights on Azure subscriptions,” Mollema noted.

Microsoft has characterized such instances of cross-tenant access as a case of “High-privileged access” (HPA) that “occurs when an application or service obtains broad access to customer content, allowing it to impersonate other users without providing any proof of user context.”

It’s worth noting that the Azure AD Graph API has been officially deprecated and retired as of August 31, 2025, with the tech giant urging users to migrate their apps to Microsoft Graph. The initial announcement of the deprecation was made in 2019.

“Applications that were configured for extended access that still depend on Azure AD Graph APIs will not be able to continue using these APIs starting in early September 2025,” Microsoft noted back in late June 2025.

Cloud security company Mitiga said a successful exploitation of CVE-2025-55241 can bypass multi-factor authentication (MFA), Conditional Access, and logging, leaving no trail of the incident.

“Attackers could craft these [actor] tokens in ways that tricked Entra ID into thinking they were anyone, anywhere,” Mitiga’s Roei Sherman said. “The vulnerability arose because the legacy API failed to validate the tenant source of the token.”

“This meant that an attacker could obtain an Actor token from their own, non-privileged test environment and then use it to impersonate a Global Admin in any other company’s tenant. The attacker didn’t need any pre-existing access to the target organization.”

Previously, Mollema also detailed a high-severity security flaw affecting on-premise versions of Exchange Server (CVE-2025-53786, CVSS score: 8.0) that could allow an attacker to gain elevated privileges under certain conditions. Another piece of research found that Intune certificate misconfigurations (such as spoofable identifiers) can be abused by regular users to perform an ESC1 attack targeting Active Directory environments.

The development comes weeks after Binary Security’s Haakon Holm Gulbrandsrud disclosed that the shared API Manager (APIM) instance used to facilitate software-as-a-service (SaaS) connectors can be invoked directly from the Azure Resource Manager to achieve cross-tenant access.

“API Connections allow anyone to fully compromise any other connection worldwide, giving full access to the connected backend,” Gulbrandsrud said. “This includes cross-tenant compromise of Key Vaults and Azure SQL databases, as well as any other externally connected service, such as Jira or Salesforce.”

It also follows the discovery of several cloud-related flaws and attack methods in recent weeks –

• An Entra ID OAuth misconfiguration that granted unauthorized access to Microsoft’s Engineering Hub Rescue even with a personal Microsoft account, exposing 22 internal services and associated data.
• An attack that exploits Microsoft OneDrive for Business Known Folder Move (KFM) feature, allowing a bad actor who compromises a Microsoft 365 user with OneDrive sync to gain access to their apps and files synced to SharePoint Online.
• The leak of Azure AD application credentials in a publicly accessible Application Settings (appsettings.json) file that could have been exploited to authenticate directly against Microsoft’s OAuth 2.0 endpoints, and exfiltrate sensitive data, deploy malicious apps, or escalate privileges.
• A phishing attack containing a link to a rogue OAuth application registered in Microsoft Azure that tricked a user into granting it permissions to extract Amazon Web Services (AWS) access keys for a sandbox environment within the compromised mailbox, allowing unknown actors to enumerate AWS permissions and exploit a trust relationship between the sandbox and production environments to elevate privileges, gain complete control over the organization’s AWS infrastructure, and exfiltrate sensitive data.
• An attack that involves exploiting Server-Side Request Forgery (SSRF) vulnerabilities in web applications to send requests to the AWS EC2 metadata service with the goal of accessing the Instance Metadata Service (IMDS) to compromise cloud resources by retrieving temporary security credentials assigned to the instance’s IAM role.
• A now-patched issue in AWS’s Trusted Advisor tool that could be exploited to sidestep S3 Security Checks by tweaking certain storage bucket policies, causing the tool to incorrectly report publicly-exposed S3 buckets as secure, thereby leaving sensitive data exposed to data exfiltration and data breaches.
• A technique code AWSDoor that modifies IAM configurations related to AWS role and trust policies to set up persistence on AWS environments.

The findings show that even all-too-common misconfigurations in cloud environments can have disastrous consequences for the organizations involved, leading to data theft and other follow-on attacks.

“Techniques such as AccessKey injection, trust policy backdooring, and the use of NotAction policies allow attackers to persist without deploying malware or triggering alarms,” RiskInsight researchers Yoann Dequeker and Arnaud Petitcol said in a report published last week.

“Beyond IAM, attackers can leverage AWS resources themselves – such as Lambda functions and EC2 instances – to maintain access. Disabling CloudTrail, modifying event selectors, deploying lifecycle policies for silent S3 deletion, or detaching accounts from AWS Organizations are all techniques that reduce oversight and enable long-term compromise or destruction.”

Threat actors with ties to the Democratic People’s Republic of Korea (aka DPRK or North Korea) have been observed leveraging ClickFix-style lures to deliver a known malware called BeaverTail and InvisibleFerret.

“The threat actor used ClickFix lures to target marketing and trader roles in cryptocurrency and retail sector organizations rather than targeting software development roles,” GitLab Threat Intelligence researcher Oliver Smith said in a report published last week.

First exposed by Palo Alto Networks in late 2023, BeaverTail and InvisibleFerret have been deployed by North Korean operatives as part of a long-running campaign dubbed Contagious Interview (aka Gwisin Gang), wherein the malware is distributed to software developers under the pretext of a job assessment. Assessed to be a subset of the umbrella group Lazarus, the cluster has been active since at least December 2022.

Over the years, BeaverTail has also been propagated via bogus npm packages and fraudulent Windows videoconferencing applications like FCCCall and FreeConference. Written in JavaScript, the malware acts as an information stealer and a downloader for a Python-based backdoor known as InvisibleFerret.

An important evolution of the campaign involves the use of the ClickFix social engineering tactic to deliver malware such as GolangGhost, PylangGhost, and FlexibleFerret – a sub-cluster of activity tracked as ClickFake Interview.

The latest attack wave, observed in late May 2025, is worth highlighting for two reasons: Employing ClickFix to deliver BeaverTail (rather than GolangGhost or FlexibleFerret) and delivering the stealer in the form of a compiled binary produced using tools like pkg and PyInstaller for Windows, macOS, and Linux systems.

A fake hiring platform web application created using Vercel serves as a distribution vector for the malware, with the threat actor advertising cryptocurrency trader, sales, and marketing roles at various Web3 organizations, as well as urging targets to invest in a Web3 company.

“The threat actor’s targeting of marketing applicants and impersonation of a retail sector organization is noteworthy given BeaverTail distributors’ usual focus on software developers and the cryptocurrency sector,” Smith said.

Users who land on the site have their public IP addresses captured and are instructed to complete a video assessment of themselves, at which point a fake technical error about a non-existent microphone issue is displayed and they are asked to an operating system-specific command to supposedly address the problem, effectively leading to the deployment of a leaner version of BeaverTail either by means of a shell script or Visual Basic Script.

“The BeaverTail variant associated with this campaign contains a simplified information stealer routine and targets fewer browser extensions,” GitLab said. “The variant targets only eight browser extensions rather than the 22 targeted in other contemporary BeaverTail variants.”

Another important omission is the removal of functions related to stealing data from web browsers other than Google Chrome. The Windows version of BeaverTail has also been found relying on a password-protected archive shipped along with the malware to load Python dependencies related to InvisibleFerret.

While password-protected archives are a fairly common technique that various threat actors have adopted for some time, this is the first time the method has been used for payload delivery in connection with BeaverTail, indicating that the threat actors are actively refining their attack chains.

What’s more, the low prevalence of secondary artifacts in the wild and the absence of social engineering finesse suggest that the campaign may have been a limited test and unlikely to be deployed at scale.

“The campaign suggests a slight tactical shift for a subgroup of North Korean BeaverTail operators, expanding beyond their traditional software developer targeting to pursue marketing and trading roles across cryptocurrency and retail sectors,” GitLab said. “The move to compiled malware variants and continued reliance on ClickFix techniques demonstrates operational adaptation to reach less technical targets and systems without standard software development tools installed.”

The development comes as a joint investigation from SentinelOne, SentinelLabs, and Validin found that at least 230 individuals have been targeted by the Contagious Interview campaign in fake cryptocurrency job interview attacks between January and March 2025 by impersonating companies such as Archblock, Robinhood, and eToro.

This campaign essentially involved using ClickFix themes to distribute malicious Node.js applications dubbed ContagiousDrop that are designed to deploy malware disguised as updates or essential utilities. The payload is tailored to the victim’s operating system and system architecture. It’s also capable of cataloging victim activities and triggering an email alert when the affected individual starts the fake skill assessment.

“This activity […] involved the threat actors examining cyber threat intelligence (CTI) information related to their infrastructure,” the companies noted, adding the attackers engaged in a coordinated effort to evaluate new infrastructure before acquisition as well as monitor for signs of detection of their activity through Validin, VirusTotal, and Maltrail.

North Korean hackers have a long history of attempting to gather threat intelligence to further their operations. As early as 2021, Google and Microsoft revealed that Pyongyang-backed hackers targeted security researchers working on vulnerability research and development using a network of fake blogs and social media accounts to steal exploits.

Then last year, SentinelOne warned of a campaign undertaken by ScarCruft (aka APT37) targeting consumers of threat intelligence reporting with fake technical reports as decoys to deliver RokRAT, a custom-written backdoor exclusively used by the North Korean threat group.

However, recent ScarCruft campaigns have witnessed a departure of sorts, taking the unusual step of infecting targets with custom VCD ransomware, alongside an evolving toolkit comprising stealers and backdoors CHILLYCHINO (aka Rustonotto) and FadeStealer. A Rust-based implant, CHILLYCHINO is a new addition to the threat actor’s arsenal from June 2025. It’s also the first known instance of APT37 using a Rust-based malware to target Windows systems.

FadeStealer, on the other hand, is a surveillance tool first identified in 2023 that’s equipped to log keystrokes, capture screenshots and audio, track devices and removable media, and exfiltrate data through password-protected RAR archives. It leverages HTTP POST and Base64 encoding for communication with its command-and-control (C2) server.

The attack chain, per Zscaler ThreatLabz, entails using spear-phishing messages to distribute ZIP archives containing Windows shortcuts (LNK) or help files (CHM) that drop CHILLYCHINO or its known PowerShell counterpart Chinotto, which then contacts the C2 server to retrieve a next-stage payload responsible for launching FadeStealer.

“The discovery of ransomware marks a significant shift from pure espionage operations toward financially motivated and potentially destructive activity,” S2W said. “This evolution highlights not only functional diversification but also a broader strategic realignment in the group’s objectives.”

New Kimsuky Campaigns Exposed

The findings also come as the North Korea-aligned Kimsuky (aka APT43) hacking group — which allegedly suffered a breach, likely exposing the tactics and tools of a China-based actor working for the Hermit Kingdom (or that of a Chinese operator emulating its tradecraft) — has been attributed to two different campaigns, one of which involves the abuse of GitHub repositories for delivering stealer malware and data exfiltration.

“The threat actor leveraged a malicious LNK file [present within ZIP archives] to download and execute additional PowerShell-based scripts from a GitHub repository,” S2W said. “To access the repository, the attacker embedded a hardcoded GitHub Private Token directly within the script.”

The PowerShell script retrieved from the repository comes fitted with capabilities to collect system metadata, including last boot time, system configuration, and running processes; write the information to a log file; and upload it to the attacker-controlled repository. It also downloads a decoy document to avoid raising any suspicion.

Given the use of trusted infrastructure for malicious purposes, users are advised to monitor traffic to api.github.com and the creation of suspicious scheduled tasks, indicating persistence.

The second campaign tied to Kimsuky concerns the abuse of OpenAI’s ChatGPT to forge deepfake military ID cards in a spear-phishing campaign against South Korean defense-affiliated entities and other individuals focused on North Korean affairs, such as researchers, human rights activists, and journalists.

Phishing emails using the military ID deepfake decoy were observed on July 17, 2025, following a series of ClickFix-based phishing campaigns between June 12 and 18, paving the way for malware that facilitates data theft and remote control.

The multi-stage infection chain has been found to employ ClickFix-like CAPTCHA verification pages to deploy an AutoIt script that connects to an external server to run batch file commands issued by the attacker, South Korean cybersecurity company Genians said in a report published last week.

Alternately, the burst of recent attacks have also relied on bogus email messages to redirect unsuspecting users to credential harvesting pages as well as sending messages with booby-trapped links that, when clicked, download a ZIP archive containing a LNK file, which, in turn, executes a PowerShell command to download synthetic imagery created using ChatGPT and batch script that ultimately does the same AutoIt script in a cabinet archive file.

“This was classified as an APT attack impersonating a South Korean defense-related institution, disguised as if it were handling ID issuance tasks for military-affiliated officials,” Genians said. “This is a real case demonstrating the Kimsuky group’s application of deepfake technology.”

Sep 20, 2025Ravie LakshmananSoftware Security / Malware

LastPass is warning of an ongoing, widespread information stealer campaign targeting Apple macOS users through fake GitHub repositories that distribute malware-laced programs masquerading as legitimate tools.

“In the case of LastPass, the fraudulent repositories redirected potential victims to a repository that downloads the Atomic infostealer malware,” researchers Alex Cox, Mike Kosak, and Stephanie Schneider from the LastPass Threat Intelligence, Mitigation, and Escalation (TIME) team said.

Beyond LastPass, some of the popular tools impersonated in the campaign include 1Password, Basecamp, Dropbox, Gemini, Hootsuite, Notion, Obsidian, Robinhood, Salesloft, SentinelOne, Shopify, Thunderbird, and TweetDeck, among others. All the GiHub repositories are designed to target macOS systems.

The attacks involve the use of Search Engine Optimization (SEO) poisoning to push links to malicious GitHub sites on top of search results on Bing and Google, that then instruct users to the download the program by clicking the “Install LastPass on MacBook” button, redirecting them a GitHub page domain.

“The GitHub pages appear to be created by multiple GitHub usernames to get around takedowns,” LastPass said.

The GitHub page is designed to take the user to another domain that provides ClickFix-style instructions to copy and execute a command on the Terminal app, resulting in the deployment of the Atomic Stealer malware.

It’s worth noting similar campaigns have been previously leveraged malicious sponsored Google Ads for Homebrew to distribute a multi-stage dropper through a bogus GitHub repository that can run detect virtual machines or analysis environments, and decode and execute system commands to establish connection with a remote server, per security researcher Dhiraj Mishra.

In recent weeks, threat actors have been spotted leveraging public GitHub repositories to host malicious payloads and distribute them via Amadey, as well as employ dangling commits corresponding to an official GitHub repository to redirect unwitting users to malicious programs.