Author: Mark

A new distributed denial-of-service (DDoS) botnet known as Kimwolf has enlisted a massive army of no less than 1.8 million infected devices comprising Android-based TVs, set-top boxes, and tablets, and may be associated with another botnet known as AISURU, according to findings from QiAnXin XLab.

“Kimwolf is a botnet compiled using the NDK [Native Development Kit],” the company said in a report published today. “In addition to typical DDoS attack capabilities, it integrates proxy forwarding, reverse shell, and file management functions.”

The hyper-scale botnet is estimated to have issued 1.7 billion DDoS attack commands within a three-day period between November 19 and 22, 2025, around the same time one of its command-and-control (C2) domains – 14emeliaterracewestroxburyma02132[.]su – came first in Cloudflare’s list of top 100 domains, briefly even surpassing Google.

Kimwolf’s primary infection targets are TV boxes deployed in residential network environments. Some of the affected device models include TV BOX, SuperBOX, HiDPTAndroid, P200, X96Q, XBOX, SmartTV, and MX10. Infections are scattered globally, with Brazil, India, the U.S., Argentina, South Africa, and the Philippines registering higher concentrations. That said, the exact means by which the malware is propagated to these devices is presently unclear.

XLab said its investigation into the botnet commenced after it received a “version 4” artifact of Kimwolf from a trusted community partner on October 24, 2025. Since then, an additional eight samples were discovered last month.

“We observed that Kimwolf’s C2 domains have been successfully taken down by unknown parties at least three times [in December], forcing it to upgrade its tactics and turn to using ENS (Ethereum Name Service) to harden its infrastructure, demonstrating its powerful evolutionary capability,” XLab researchers said.

This assessment is based on similarities in APK packages uploaded to the VirusTotal platform, in some cases even using the same code signing certificate (“John Dinglebert Dinglenut VIII VanSack Smith”). Further definitive evidence arrived on December 8, 2025, with the discovery of an active downloader server (“93.95.112[.]59”) that contained a script referencing APKs for both Kimwolf and AISURU.

The malware in itself is fairly straightforward. Once launched, it ensures that only one instance of the process runs on the infected device, and then proceeds to decrypt the embedded C2 domain, uses DNS-over-TLS to obtain the C2 IP address, and connects to it in order to receive and execute commands.

Recent versions of the botnet malware detected as recently as December 12, 2025, have introduced a technique known as EtherHiding that makes use of an ENS domain (“pawsatyou[.]eth”) to fetch the actual C2 IP from the associated smart contract (0xde569B825877c47fE637913eCE5216C644dE081F) in an effort to render its infrastructure more resilient to takedown efforts.

Specifically, this involves extracting an IPv6 address from the “lol” field of the transaction, then taking the last four bytes of the address and performing an XOR operation with the key “0x93141715” to get the actual IP address.

Besides encrypting sensitive data related to C2 servers and DNS resolvers, Kimwolf uses TLS encryption for network communications to receive DDoS commands. In all, the malware supports 13 DDoS attack methods over UDP, TCP, and ICMP. The attack targets, per XLab, are located in the U.S., China, France, Germany, and Canada.

Further analysis has determined that over 96% of the commands relate to using the bot nodes for providing proxy services. This indicates the attackers’ attempts to exploit the bandwidth from compromised devices and maximize profit. As part of the effort, a Rust-based Command Client module is deployed to form a proxy network.

Also delivered to the nodes is a ByteConnect software development kit (SDK), a monetization solution that allows app developers and IoT device owners to monetize their traffic.

“Giant botnets originated with Mirai in 2016, with infection targets mainly concentrated on IoT devices like home broadband routers and cameras,” XLab said. “However, in recent years, information on multiple million-level giant botnets like Badbox, Bigpanzi, Vo1d, and Kimwolf has been disclosed, indicating that some attackers have started to turn their attention to various smart TVs and TV boxes.”

Dec 17, 2025Ravie LakshmananAd Fraud / Browser Security

A new campaign named GhostPoster has leveraged logo files associated with 17 Mozilla Firefox browser add-ons to embed malicious JavaScript code designed to hijack affiliate links, inject tracking code, and commit click and ad fraud.

The extensions have been collectively downloaded over 50,000 times, according to Koi Security, which discovered the campaign. The add-ons are no longer available.

These browser programs were advertised as VPNs, screenshot utilities, ad blockers, and unofficial versions of Google Translate. The oldest add-on, Dark Mode, was published on October 25, 2024, offering the ability to enable a dark theme for all websites. The full list of the browser add-ons is below –

• Free VPN
• Screenshot
• Weather (weather-best-forecast)
• Mouse Gesture (crxMouse)
• Cache – Fast site loader
• Free MP3 Downloader
• Google Translate (google-translate-right-clicks)
• Traductor de Google
• Global VPN – Free Forever
• Dark Reader Dark Mode
• Translator – Google Bing Baidu DeepL
• Weather (i-like-weather)
• Google Translate (google-translate-pro-extension)
• 谷歌翻译
• libretv-watch-free-videos
• Ad Stop – Best Ad Blocker
• Google Translate (right-click-google-translate)

“What they actually deliver is a multi-stage malware payload that monitors everything you browse, strips away your browser’s security protections, and opens a backdoor for remote code execution,” security researchers Lotan Sery and Noga Gouldman said.

The attack chain begins when the logo file is fetched when one of the above-mentioned extensions is loaded. The malicious code parses the file to look for a marker containing the “===” sign in order to extract JavaScript code, a loader that reaches out to an external server (“www.liveupdt[.]com” or “www.dealctr[.]com”) to retrieve the main payload, waiting 48 hours in between every attempt.

To further evade detection, the loader is configured to fetch the payload only 10% of the time. This randomness is a deliberate choice that’s introduced to sidestep efforts to monitor network traffic. The retrieved payload is a custom-encoded comprehensive toolkit capable of monetizing browser activities without the victims’ knowledge through four different ways –

• Affiliate link hijacking, which intercepts affiliate links to e-commerce sites like Taobao or JD.com, depriving legitimate affiliates of their commission
• Tracking injection, which inserts the Google Analytics tracking code into every web page visited by the victim, to silently profile them
• Security header stripping, which removes security headers like Content-Security-Policy and X-Frame-Options from HTTP responses, exposing users to clickjacking and cross-site scripting attacks
• Hidden iframe injection, which injects invisible iframes into pages to load URLs from attacker-controlled servers and enable ad and click fraud
• CAPTCHA bypass, which employs various methods to bypass CAPTCHA challenges and evade bot detection safeguards

“Why would malware need to bypass CAPTCHAs? Because some of its operations, like the hidden iframe injections, trigger bot detection,” the researchers explained. “The malware needs to prove it’s ‘human’ to keep operating.”

Besides probability checks, the add-ons also incorporate time-based delays that prevent the malware from activating until more than six days after installation. These layered evasion techniques make it harder to detect what’s going on behind the scenes.

It’s worth emphasizing here that not all the extensions above use the same steganographic attack chain, but all of them exhibit the same behavior and communicate with the same command-and-control (C2) infrastructure, indicating it’s the work of a single threat actor or group that has experimented with different lures and methods.

The development comes merely days after a popular VPN extension for Google Chrome and Microsoft Edge was caught secretly harvesting AI conversations from ChatGPT, Claude, and Gemini and exfiltrating them to data brokers. In August 2025, another Chrome extension named FreeVPN.One was observed collecting screenshots, system information, and users’ locations.

“Free VPNs promise privacy, but nothing in life comes free,” Koi Security said. “Again and again, they deliver surveillance instead.”

AI-assisted coding and AI app generation platforms have created an unprecedented surge in software development. Companies are now facing rapid growth in both the number of applications and the pace of change within those applications. Security and privacy teams are under significant pressure as the surface area they must cover is expanding quickly while their staffing levels remain largely unchanged.

Existing data security and privacy solutions are too reactive for this new era. Many begin with data already collected in production, which is often too late. These solutions frequently miss hidden data flows to third party and AI integrations, and for the data sinks they do cover, they help detect risks but do not prevent them. The question is whether many of these issues can instead be prevented early. The answer is yes. Prevention is possible by embedding detection and governance controls directly into development. HoundDog.ai provides a privacy code scanner built for exactly this purpose.

Data security and privacy issues that can be proactively addressed

Sensitive data exposure in logs remains one of the most common and costly problems

When sensitive data appears in logs, relying on DLP solutions is reactive, unreliable, and slow. Teams may spend weeks cleaning logs, identifying exposure across the systems that ingested them, and revising the code after the fact. These incidents often begin with simple developer oversights, such as using a tainted variable or printing an entire user object in a debug function. As engineering teams grow past 20 developers, keeping track of all code paths becomes difficult and these oversights become more frequent.

Inaccurate or outdated data maps also drive considerable privacy risk

A core requirement in GDPR and US Privacy Frameworks is the need to document processing activities with details about the types of personal data collected, processed, stored, and shared. Data maps then feed into mandatory privacy reports such as Records of Processing Activities (RoPA), Privacy Impact Assessments (PIA), and Data Protection Impact Assessments (DPIA). These reports must document the legal bases for processing, demonstrate compliance with data minimization and retention principles, and ensure that data subjects have transparency and can exercise their rights. In fast-moving environments, though, data maps quickly drift out of date. Traditional workflows in GRC tools require privacy teams to interview application owners repeatedly, a process that is both slow and error-prone. Important details are often missed, especially in companies with hundreds or thousands of code repositories. Production-focused privacy platforms provide only partial automation because they attempt to infer data flows based on data already stored in production systems. They often cannot see SDKs, abstractions, and integrations embedded in the code. These blind spots can lead to violations of data processing agreements or inaccurate disclosures in privacy notices. Since these platforms detect issues only after data is already flowing, they offer no proactive controls that prevent risky behavior in the first place.

HoundDog.ai provides a privacy-focused static code scanner that continuously analyzes source code to document sensitive data flows across storage systems, AI integrations, and third-party services. The scanner identifies privacy risks and sensitive data leaks early in development, before code is merged and before data is ever processed. The engine is built in Rust, which is memory safe, and it is lightweight and fast. It scans millions of lines of code in under a minute. The scanner was recently integrated with Replit, the AI app generation platform used by 45M creators, providing visibility into privacy risks across the millions of applications generated by the platform.

Key capabilities

AI Governance and Third-Party Risk Management

Identify AI and third-party integrations embedded in code with high confidence, including hidden libraries and abstractions often associated with shadow AI.

Proactive Sensitive Data Leak Detection

Embed privacy across all stages in development, from IDE environments, with extensions available for VS Code, IntelliJ, Cursor, and Eclipse, to CI pipelines that use direct source code integrations and automatically push CI configurations as direct commits or pull requests requiring approval. Track more than 100 types of sensitive data, including Personally Identifiable Information (PII), Protected Health Information (PHI), Cardholder Data (CHD), and authentication tokens, and follow them across transformations into risky sinks such as LLM prompts, logs, files, local storage, and third-party SDKs.

Evidence Generation for Privacy Compliance

Automatically generate evidence-based data maps that show how sensitive data is collected, processed, and shared. Produce audit-ready Records of Processing Activities (RoPA), Privacy Impact Assessments (PIA), and Data Protection Impact Assessments (DPIA), prefilled with detected data flows and privacy risks identified by the scanner.

Why this matters

Companies need to eliminate blind spots

A privacy scanner that works at the code level provides visibility into integrations and abstractions that production tools miss. This includes hidden SDKs, third-party libraries, and AI frameworks that never show up through production scans until it is too late.

Teams also need to catch privacy risks before they occur

Plaintext authentication tokens or sensitive data in logs, or unapproved data sent to third-party integrations, must be stopped at the source. Prevention is the only reliable way to avoid incidents and compliance gaps.

Privacy teams require accurate and continuously updated data maps

Automated generation of RoPAs, PIAs, and DPIAs based on code evidence ensures that documentation keeps pace with development, without repeated manual interviews or spreadsheet updates.

Comparison with other tools

Privacy and security engineering teams use a mix of tools, but each category has fundamental limitations.

General-purpose static analysis tools provide custom rules but lack privacy awareness. They treat different sensitive data types as equivalent and cannot understand modern AI-driven data flows. They rely on simple pattern matching, which produces noisy alerts and requires constant maintenance. They also lack any built-in compliance reporting.

Post-deployment privacy platforms map data flows based on information stored in production systems. They cannot detect integrations or flows that have not yet produced data in those systems and cannot see abstractions hidden in code. Because they operate after deployment, they cannot prevent risks and introduce a significant delay between issue introduction and detection.

Reactive Data Loss Prevention tools intervene only after data has leaked. They lack visibility into source code and cannot identify root causes. When sensitive data reaches logs or transmissions, the cleanup is slow. Teams often spend weeks remediating and reviewing exposure across many systems.

HoundDog.ai improves on these approaches by introducing a static analysis engine purpose-built for privacy. It performs deep interprocedural analysis across files and functions to trace sensitive data such as Personally Identifiable Information (PII), Protected Health Information (PHI), Cardholder Data (CHD), and authentication tokens. It understands transformations, sanitization logic, and control flow. It identifies when data reaches risky sinks such as logs, files, local storage, third-party SDKs, and LLM prompts. It prioritizes issues based on sensitivity and actual risk rather than simple patterns. It includes native support for more than 100 sensitive data types and allows customization.

HoundDog.ai also detects both direct and indirect AI integrations from source code. It identifies unsafe or unsanitized data flows into prompts and allows teams to enforce allowlists that define which data types may be used with AI services. This proactive model blocks unsafe prompt construction before code is merged, providing enforcement that runtime filters cannot match.

Beyond detection, HoundDog.ai automates the creation of privacy documentation. It produces an always fresh inventory of internal and external data flows, storage locations, and third-party dependencies. It generates audit-ready Records of Processing Activities and Privacy Impact Assessments populated with real evidence and aligned to frameworks such as FedRAMP, DoD RMF, HIPAA, and NIST 800-53.

Customer success

HoundDog.ai is already used by Fortune 1000 companies across healthcare and financial services, scanning thousands of repositories. These organizations are reducing data mapping overhead, catching privacy issues early in development, and maintaining compliance without slowing engineering.

Replit

The most visible deployment is in Replit, where the scanner helps protect the more than 45M users of the AI app generation platform. It identifies privacy risks and traces sensitive data flows across millions of AI-generated applications. This allows Replit to embed privacy directly into its app generation workflow so that privacy becomes a core feature rather than an afterthought.

By shifting privacy into the earliest stages of development and providing continuous visibility, enforcement, and documentation, HoundDog.ai makes it possible for teams to build secure and compliant software at the speed that modern AI-driven development demands.

Dec 16, 2025Ravie LakshmananNetwork Security / Vulnerability

Threat actors have begun to exploit two newly disclosed security flaws in Fortinet FortiGate devices, less than a week after public disclosure.

Cybersecurity company Arctic Wolf said it observed active intrusions involving malicious single sign-on (SSO) logins on FortiGate appliances on December 12, 2025. The attacks exploit two critical authentication bypasses (CVE-2025-59718 and CVE-2025-59719, CVSS scores: 9.8). Patches for the flaws were released by Fortinet last week for FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager.

“These vulnerabilities allow unauthenticated bypass of SSO login authentication via crafted SAML messages, if the FortiCloud SSO feature is enabled on affected devices,” Arctic Wolf Labs said in a new bulletin.

It’s worth noting that while FortiCloud SSO is disabled by default, it is automatically enabled during FortiCare registration unless administrators explicitly turn it off using the “Allow administrative login using FortiCloud SSO” setting in the registration page.

In the malicious activity observed by Arctic Wolf, IP addresses associated with a limited set of hosting providers, such as The Constant Company llc, Bl Networks, and Kaopu Cloud Hk Limited, were used to carry out malicious SSO logins against the “admin” account.

Following the logins, the attackers have been found to export device configurations via the GUI to the same IP addresses.

In light of ongoing exploitation activity, organizations are advised to apply the patches as soon as possible. As mitigations, it’s essential to disable FortiCloud SSO until the instances are updated to the latest version and limit access to management interfaces of firewalls and VPNs to trusted internal users.

“Although credentials are typically hashed in network appliance configurations, threat actors are known to crack hashes offline, especially if credentials are weak and susceptible to dictionary attacks,” Arctic Wolf said.

Fortinet customers who find indicators of compromise (IoCs) consistent with the campaign are recommended to assume compromise and reset hashed firewall credentials stored in the exfiltrated configurations.

Dec 16, 2025Ravie LakshmananCloud Security / Vulnerability

Amazon’s threat intelligence team has disclosed details of a “years-long” Russian state-sponsored campaign that targeted Western critical infrastructure between 2021 and 2025.

Targets of the campaign included energy sector organizations across Western nations, critical infrastructure providers in North America and Europe, and entities with cloud-hosted network infrastructure. The activity has been attributed with high confidence to Russia’s Main Intelligence Directorate (GRU), citing infrastructure overlaps with APT44, which is also known as FROZENBARENTS, Sandworm, Seashell Blizzard, and Voodoo Bear.

The activity is notable for using as initial access vectors misconfigured customer network edge devices with exposed management interfaces, as N-day and zero-day vulnerability exploitation activity declined over the time period – indicative of a shift in attacks aimed at critical infrastructure, the tech giant said.

“This tactical adaptation enables the same operational outcomes, credential harvesting, and lateral movement into victim organizations’ online services and infrastructure, while reducing the actor’s exposure and resource expenditure,” CJ Moses, Chief Information Security Officer (CISO) of Amazon Integrated Security, said.

The attacks have been found to leverage the following vulnerabilities and tactics over the course of five years –

• 2021-2022 – Exploitation of WatchGuard Firebox and XTM flaw (CVE-2022-26318) and targeting of misconfigured edge network devices
• 2022-2023 – Exploitation of Atlassian Confluence flaws (CVE-2021-26084 and CVE-2023-22518) and continued targeting of misconfigured edge network devices
• 2024 – Exploitation of Veeam flaw (CVE-2023-27532) and continued targeting of misconfigured edge network devices
• 2025 – Sustained targeting of misconfigured edge network devices

The intrusion activity, per Amazon, singled out enterprise routers and routing infrastructure, VPN concentrators and remote access gateways, network management appliances, collaboration and wiki platforms, and cloud-based project management systems.

These efforts are likely designed to facilitate credential harvesting at scale, given the threat actor’s ability to position themselves strategically on the network edge to intercept sensitive information in transit. Telemetry data has also uncovered what has been described as coordinated attempts aimed at misconfigured customer network edge devices hosted on Amazon Web Services (AWS) infrastructure.

“Network connection analysis shows actor-controlled IP addresses establishing persistent connections to compromised EC2 instances operating customers’ network appliance software,” Moses said. “Analysis revealed persistent connections consistent with interactive access and data retrieval across multiple affected instances.”

In addition, Amazon said it observed credential replay attacks against victim organizations’ online services as part of attempts to obtain a deeper foothold into targeted networks. Although these attempts are assessed to be unsuccessful, they lend weight to the aforementioned hypothesis that the adversary is grabbing credentials from compromised customer network infrastructure for follow-on attacks.

The entire attack plays out as follows –

• Compromise the customer network edge device hosted on AWS
• Leverage native packet capture capability
• Gather credentials from intercepted traffic
• Replay credentials against the victim organizations’ online services and infrastructure
• Establish persistent access for lateral movement

The credential replay operations have targeted energy, technology/cloud services, and telecom service providers across North America, Western and Eastern Europe, and the Middle East.

“The targeting demonstrates sustained focus on the energy sector supply chain, including both direct operators and third-party service providers with access to critical infrastructure networks,” Moses noted.

Interestingly, the intrusion set also shares infrastructure overlaps (91.99.25[.]54) with another cluster tracked by Bitdefender under the name Curly COMrades, which is believed to be operating with interests that are aligned with Russia since late 2023. This has raised the possibility that the two clusters may represent complementary operations within a broader campaign undertaken by GRU.

“This potential operational division, where one cluster focuses on network access and initial compromise while another handles host-based persistence and evasion, aligns with GRU operational patterns of specialized subclusters supporting broader campaign objectives,” Moses said.

Amazon said it identified and notified affected customers, as well as disrupted active threat actor operations targeting its cloud services. Organizations are recommended to audit all network edge devices for unexpected packet capture utilities, implement strong authentication, monitor for authentication attempts from unexpected geographic locations, and keep tabs on credential replay attacks.

Dec 16, 2025Ravie LakshmananCybersecurity / Cryptocurrency

Cybersecurity researchers have discovered a new malicious NuGet package that typosquats and impersonates the popular .NET tracing library and its author to sneak in a cryptocurrency wallet stealer.

The malicious package, named “Tracer.Fody.NLog,” remained on the repository for nearly six years. It was published by a user named “csnemess” on February 26, 2020. It masquerades as “Tracer.Fody,” which is maintained by “csnemes.” The package continues to remain available as of writing, and has been downloaded at least 2,000 times, out of which 19 took place over the last six weeks for version 3.2.4.

“It presents itself as a standard .NET tracing integration but in reality functions as a cryptocurrency wallet stealer,” Socket security researcher Kirill Boychenko said. “Inside the malicious package, the embedded Tracer.Fody.dll scans the default Stratis wallet directory, reads *.wallet.json files, extracts wallet data, and exfiltrates it together with the wallet password to threat actor-controlled infrastructure in Russia at 176.113.82[.]163.”

The software supply chain security company said the threat leveraged a number of tactics that allowed it to elude casual review, including mimicking the legitimate maintainer by using a name that differs by a single letter (“csnemes” vs. “csnemess”), using Cyrillic lookalike characters in the source code, and hiding the malicious routine within a generic helper function (“Guard.NotNull”) that’s used during regular program execution.

Once a project references the malicious package, it activates its behavior by scanning the default Stratis wallet directory on Windows (“%APPDATA%\StratisNode\stratis\StratisMain”), reads *.wallet.json files and in-memory passwords, and exfiltrates them to the Russian-hosted IP address.

“All exceptions are silently caught, so even if the exfiltration fails, the host application continues to run without any visible error while successful calls quietly leak wallet data to the threat actor’s infrastructure,” Boychenko said.

Socket said the same IP address was previously put to use in December 2023 in connection with another NuGet impersonation attack in which the threat actor published a package named “Cleary.AsyncExtensions” under the alias “stevencleary” and incorporated functionality to siphon wallet seed phrases. The package was so-called to disguise itself as the AsyncEx NuGet library.

The findings once illustrate how malicious typosquats mirroring legitimate tools can stealthily operate without attracting any attention across the open-source repository ecosystems.

“Defenders should expect to see similar activity and follow-on implants that extend this pattern,” Socket said. “Likely targets include other logging and tracing integrations, argument validation libraries, and utility packages that are common in .NET projects.”

Dec 16, 2025Ravie LakshmananMalware / Threat Detection

An ongoing campaign has been observed targeting Amazon Web Services (AWS) customers using compromised Identity and Access Management (IAM) credentials to enable cryptocurrency mining.

The activity, first detected by Amazon’s GuardDuty managed threat detection service and its automated security monitoring systems on November 2, 2025, employs never-before-seen persistence techniques to hamper incident response and continue unimpeded, according to a new report shared by the tech giant ahead of publication.

“Operating from an external hosting provider, the threat actor quickly enumerated resources and permissions before deploying crypto mining resources across ECS and EC2,” Amazon said. “Within 10 minutes of the threat actor gaining initial access, crypto miners were operational.”

The multi-stage attack chain essentially begins with the unknown adversary leveraging compromised IAM user credentials with admin-like privileges to initiate a discovery phase designed to probe the environment for EC2 service quotas and test their permissions by invoking the RunInstances API with the “DryRun” flag set.

This enabling of the “DryRun” flag is crucial and intentional as it enables the attackers to validate their IAM permissions without actually launching instances, thereby avoiding racking up costs and minimizing their forensic trail. The end goal of the step is to determine if the target infrastructure is suitable for deploying the miner program.

The infection proceeds to the next stage when the threat actor calls CreateServiceLinkedRole and CreateRole to create IAM roles for autoscaling groups and AWS Lambda, respectively. Once the roles are created, the “AWSLambdaBasicExecutionRole” policy is attached to the Lambda role.

The DockerHub image, which has since been taken down, is configured to run a shell script as soon as it’s deployed to launch cryptocurrency mining using the RandomVIREL mining algorithm. Additionally, the threat actor has been observed creating autoscaling groups that are set to scale from 20 to 999 instances in an effort to exploit EC2 service quotas and maximize resource consumption.

The EC2 activity has targeted both high-performance GPU and machine learning instances and compute, memory, and general-purpose instances.

What makes this campaign stand apart is its use of the ModifyInstanceAttribute action with the “disableApiTermination” parameter set to “True,” which prevents an instance from being terminated using the Amazon EC2 console, command line interface, or API. This, in turn, has the effect of requiring victims to re-enable API termination before deleting the impacted resources.

“Instance termination protection can impair incident response capabilities and disrupt automated remediation controls,” Amazon said. “This technique demonstrates an understanding of common security response procedures and intent to maximize the duration of mining operations.”

This is not the first time the security risk associated with ModifyInstanceAttribute has come to light. In April 2024, security researcher Harsha Koushik demonstrated a proof-of-concept (PoC) that detailed how the action can be abused to take over instances, exfiltrate instance role credentials, and even seize control of the entire AWS account.

Furthermore, the attacks entail the creation of a Lambda function that can be invoked by any principal and an IAM user “user-x1x2x3x4” to which the AWS managed policy “AmazonSESFullAccess” is attached, granting the adversary complete access over the Amazon Simple Email Service (SES) to likely carry out phishing attacks.

To secure against the threat, Amazon is urging AWS customers to follow the steps below –

• Enforce strong identity and access management controls
• Implement temporary credentials instead of long-term access keys
• Use multi-factor authentication (MFA) for all users
• Apply the principle of least privilege (PoLP) to IAM principals to restrict access
• Add container security controls to scan for suspicious images
• Monitor unusual CPU allocation requests in ECS task definitions
• Use AWS CloudTrail to log events across AWS services
• Ensure AWS GuardDuty is enabled to facilitate automated response workflows

“The threat actor’s scripted use of multiple compute services, in combination with emerging persistence techniques, represents a significant advancement in crypto mining attack methodologies.”

Dec 16, 2025Ravie LakshmananDark Web / Online Safety

Google has announced that it’s discontinuing its dark web report tool in February 2026, less than two years after it was launched as a way for users to monitor if their personal information is found on the dark web.

To that end, scans for new dark web breaches will be stopped on January 15, 2026, and the feature will cease to exist effective February 16, 2026.

“While the report offered general information, feedback showed that it didn’t provide helpful next steps,” Google said in a support document. “We’re making this change to instead focus on tools that give you more clear, actionable steps to protect your information online.”

The tech giant said it will delete all data related to dark web report once the feature is retired in February, but noted that users have an option to delete their monitoring profile ahead of time by following the steps below –

• Go to the Dark Web report
• Under “Results with your info,” click Edit monitoring profile
• At the bottom, click “Delete monitoring profile” -> Delete

The dark web report was unveiled by Google in March 2023 to combat online identity fraud stemming from information stolen through data breaches and made available on the dark web. The report was designed to scan the darknet for personal data, such as name, address, email, phone number, and Social Security number, and notify users when it’s found.

In July 2024, Google expanded the offering beyond Google One subscribers to include all account holders.

Google is also urging users to strengthen their account privacy and security by creating a passkey for phishing-resistant multi-factor authentication (MFA) and removing their personal information from Google Search results via Results about you.

The security vulnerability known as React2Shell is being exploited by threat actors to deliver malware families like KSwapDoor and ZnDoor, according to findings from Palo Alto Networks Unit 42 and NTT Security.

“KSwapDoor is a professionally engineered remote access tool designed with stealth in mind,” Justin Moore, senior manager of threat intel research at Palo Alto Networks Unit 42, said in a statement.

“It builds an internal mesh network, allowing compromised servers to talk to each other and evade security blocks. It uses military-grade encryption to hide its communications and, most alarmingly, features a ‘sleeper’ mode that lets attackers bypass firewalls by waking the malware up with a secret, invisible signal.”

The cybersecurity company noted that it was previously mistakenly classified as BPFDoor, adding that the Linux backdoor offers interactive shell, command execution, file operations and lateral movement scanning capabilities. It also impersonates a legitimate Linux kernel swap daemon to evade detection.

In a related development, NTT Security said organizations in Japan are being targeted by cyber attacks exploiting React2Shell to deploy ZnDoor, a malware that’s been assessed to be detected in the wild since December 2023. The attack chains involve running a bash command to fetch the payload from a remote server (45.76.155[.]14) using wget and executing it.

A remote access trojan, it contacts the same threat actor-controlled infrastructure to receive commands and execute them on the host. Some of the supported commands are listed below –

• shell, to execute a command
• interactive_shell, to launch an interactive shell
• explorer, to get a list of directories
• explorer_cat, to read and display a file
• explorer_delete, to delete a file
• explorer_upload, to download a file from the server
• explorer_download, to send files to the server
• system, to gather system information
• change_timefile, to change the timestamp of a file
• socket_quick_startstreams, to start a SOCKS5 proxy
• start_in_port_forward, to start port forwarding
• stop_in_port, to stop port forwarding

The disclosure comes as the vulnerability, tracked as CVE-2025-55182 (CVSS score: 10.0), has been exploited by multiple threat actors, Google identifying at least five China-nexus groups that have weaponized to deliver an array of payloads –

• UNC6600 to deliver a tunneling utility named MINOCAT
• UNC6586 to deliver a downloader named SNOWLIGHT
• UNC6588 to deliver a backdoor named COMPOOD
• UNC6603 to deliver an updated version of a Go backdoor named HISONIC that uses Cloudflare Pages and GitLab to retrieve encrypted configuration and blend in with legitimate network activity
• UNC6595 to deliver a Linux version of ANGRYREBEL (aka Noodle RAT)

Microsoft, in its own advisory for CVE-2025-55182, said threat actors have taken advantage of the flaw to run arbitrary commands for post-exploitation, including setting up reverse shells to known Cobalt Strike servers, and then dropping remote monitoring and management (RMM) tools such as MeshAgent, modifying the authorized_keys file, and enabling root login.

Some of the payloads delivered in these attacks include VShell, EtherRAT, SNOWLIGHT, ShadowPad, and XMRig. The attacks are also characterized by the use of Cloudflare Tunnel endpoints (“*.trycloudflare.com”) to evade security defenses, as well as conducting reconnaissance of the compromised environments to facilitate lateral movement and credential theft.

The credential harvesting activity, the Windows maker said, targeted Azure Instance Metadata Service (IMDS) endpoints for Azure, Amazon Web Services (AWS), Google Cloud Platform (GCP), and Tencent Cloud with the end goal of acquiring identity tokens to burrow deeper into cloud infrastructures.

“Attackers also deployed secret discovery tools such as TruffleHog and Gitleaks, along with custom scripts to extract several different secrets,” the Microsoft Defender Security Research Team said. “Attempts to harvest AI and cloud-native credentials, such as OpenAI API keys, Databricks tokens, and Kubernetes service‑account credentials, were also observed. Azure Command-Line Interface (CLI) (az) and Azure Developer CLI (azd) were also used to obtain tokens.”

In another campaign detailed by Beelzebub, threat actors have been observed exploiting flaws in Next.js, including CVE-2025-29927 and CVE-2025-66478 (the same React2Shell bug before it was rejected as a duplicate), to enable systematic extraction of credentials and sensitive data –

• .env, .env.local, .env.production, .env.development
• System environment variables (printenv, env)
• SSH keys (~/.ssh/id_rsa, ~/.ssh/id_ed25519, /root/.ssh/*)
• Cloud credentials (~/.aws/credentials, ~/.docker/config.json
• Git credentials (~/.git-credentials, ~/.gitconfig)
• Command history (last 100 commands from ~/.bash_history)
• System files (/etc/shadow, /etc/passwd)

The malware also proceeds to create persistence on the host to survive system reboots, install a SOCKS5 proxy, establish a reverse shell to “67.217.57[.]240:888,” and install a React scanner to probe the internet for further propagation.

The activity, codenamed Operation PCPcat, is estimated to have already breached 59,128 servers. “The campaign shows characteristics of large-scale intelligence operations and data exfiltration on an industrial scale,” the Italian company said.

The Shadowserver Foundation is currently tracking over 111,000 IP addresses vulnerable to React2Shell attacks, with over 77,800 instances in the U.S., followed by Germany (7,500), France (4,000), and India (2,300). Data from GreyNoise shows that there are 547 malicious IP addresses from the U.S., India, the U.K., Singapore, and the Netherlands partaking in the exploitation efforts over the past 24 hours.

Dec 06, 2025Ravie LakshmananAI Security / Vulnerability

Over 30 security vulnerabilities have been disclosed in various artificial intelligence (AI)-powered Integrated Development Environments (IDEs) that combine prompt injection primitives with legitimate features to achieve data exfiltration and remote code execution.

The security shortcomings have been collectively named IDEsaster by security researcher Ari Marzouk (MaccariTA), who discovered them over the last six months. They affect popular IDEs and extensions such as Cursor, Windsurf, Kiro.dev, GitHub Copilot, Zed.dev, Roo Code, Junie, and Cline, among others. Of these, 24 have been assigned CVE identifiers.

“I think the fact that multiple universal attack chains affected each and every AI IDE tested is the most surprising finding of this research,” Marzouk told The Hacker News.

“All AI IDEs (and coding assistants that integrate with them) effectively ignore the base software (IDE) in their threat model. They treat their features as inherently safe because they’ve been there for years. However, once you add AI agents that can act autonomously, the same features can be weaponized into data exfiltration and RCE primitives.”

At its core, these issues chain three different vectors that are common to AI-driven IDEs –

• Bypass a large language model’s (LLM) guardrails to hijack the context and perform the attacker’s bidding (aka prompt injection)
• Perform certain actions without requiring any user interaction via an AI agent’s auto-approved tool calls
• Trigger an IDE’s legitimate features that allow an attacker to break out of the security boundary to leak sensitive data or execute arbitrary commands

The highlighted issues are different from prior attack chains that have leveraged prompt injections in conjunction with vulnerable tools (or abusing legitimate tools to perform read or write actions) to modify an AI agent’s configuration to achieve code execution or other unintended behavior.

What makes IDEsaster notable is that it takes prompt injection primitives and an agent’s tools, using them to activate legitimate features of the IDE to result in information leakage or command execution.

Context hijacking can be pulled off in myriad ways, including through user-added context references that can take the form of pasted URLs or text with hidden characters that are not visible to the human eye, but can be parsed by the LLM. Alternatively, the context can be polluted by using a Model Context Protocol (MCP) server through tool poisoning or rug pulls, or when a legitimate MCP server parses attacker-controlled input from an external source.

• CVE-2025-49150 (Cursor), CVE-2025-53097 (Roo Code), CVE-2025-58335 (JetBrains Junie), GitHub Copilot (no CVE), Kiro.dev (no CVE), and Claude Code (addressed with a security warning) – Using a prompt injection to read a sensitive file using either a legitimate (“read_file”) or vulnerable tool (“search_files” or “search_project”) and writing a JSON file via a legitimate tool (“write_file” or “edit_file)) with a remote JSON schema hosted on an attacker-controlled domain, causing the data to be leaked when the IDE makes a GET request
• CVE-2025-53773 (GitHub Copilot), CVE-2025-54130 (Cursor), CVE-2025-53536 (Roo Code), CVE-2025-55012 (Zed.dev), and Claude Code (addressed with a security warning) – Using a prompt injection to edit IDE settings files (“.vscode/settings.json” or “.idea/workspace.xml”) to achieve code execution by setting “php.validate.executablePath” or “PATH_TO_GIT” to the path of an executable file containing malicious code
• CVE-2025-64660 (GitHub Copilot), CVE-2025-61590 (Cursor), and CVE-2025-58372 (Roo Code) – Using a prompt injection to edit workspace configuration files (*.code-workspace) and override multi-root workspace settings to achieve code execution

It’s worth noting that the last two examples hinge on an AI agent being configured to auto-approve file writes, which subsequently allows an attacker with the ability to influence prompts to cause malicious workspace settings to be written. But given that this behavior is auto-approved by default for in-workspace files, it leads to arbitrary code execution without any user interaction or the need to reopen the workspace.

With prompt injections and jailbreaks acting as the first step for the attack chain, Marzouk offers the following recommendations –

• Only use AI IDEs (and AI agents) with trusted projects and files. Malicious rule files, instructions hidden inside source code or other files (README), and even file names can become prompt injection vectors.
• Only connect to trusted MCP servers and continuously monitor these servers for changes (even a trusted server can be breached). Review and understand the data flow of MCP tools (e.g., a legitimate MCP tool might pull information from attacker controlled source, such as a GitHub PR)
• Manually review sources you add (such as via URLs) for hidden instructions (comments in HTML / css-hidden text / invisible unicode characters, etc.)

Developers of AI agents and AI IDEs are advised to apply the principle of least privilege to LLM tools, minimize prompt injection vectors, harden the system prompt, use sandboxing to run commands, perform security testing for path traversal, information leakage, and command injection.

The disclosure coincides with the discovery of several vulnerabilities in AI coding tools that could have a wide range of impacts –

• A command injection flaw in OpenAI Codex CLI (CVE-2025-61260) that takes advantage of the fact that the program implicitly trusts commands configured via MCP server entries and executes them at startup without seeking a user’s permission. This could lead to arbitrary command execution when a malicious actor can tamper with the repository’s “.env” and “./.codex/config.toml” files.
• An indirect prompt injection in Google Antigravity using a poisoned web source that can be used to manipulate Gemini into harvesting credentials and sensitive code from a user’s IDE and exfiltrating the information using a browser subagent to browse to a malicious site.
• Multiple vulnerabilities in Google Antigravity that could result in data exfiltration and remote command execution via indirect prompt injections, as well as leverage a malicious trusted workspace to embed a persistent backdoor to execute arbitrary code every time the application is launched in the future.
• A new class of vulnerability named PromptPwnd that targets AI agents connected to vulnerable GitHub Actions (or GitLab CI/CD pipelines) with prompt injections to trick them into executing built-in privileged tools that lead to information leak or code execution.

As agentic AI offerings are becoming increasingly popular in enterprise environments, these findings demonstrate how AI tools expand the attack surface of development machines, often by leveraging an LLM’s inability to distinguish between instructions provided by a user to complete a task and content that it may ingest from an external source, which, in turn, can contain an embedded malicious prompt.

“Any repository using AI for issue triage, PR labeling, code suggestions, or automated replies is at risk of prompt injection, command injection, secret exfiltration, repository compromise and upstream supply chain compromise,” Aikido researcher Rein Daelman said.

Marzouk also said the discoveries emphasized the importance of “Secure for AI,” which is a new paradigm that has been coined by the researcher to tackle security challenges introduced by AI features, thereby ensuring that products are not only secure by default and secure by design, but are also conceived keeping in mind how AI components can be abused over time.

“This is another example of why the ‘Secure for AI’ principle is needed,” Marzouk said. “Connecting AI agents to existing applications (in my case IDE, in their case GitHub Actions) creates new emerging risks.”