Category: Cybersecurity

Oct 28, 2025Ravie LakshmananEncryption / Hardware Security

A group of academic researchers from Georgia Tech, Purdue University, and Synkhronix have developed a side-channel attack called TEE.Fail that allows for the extraction of secrets from the trusted execution environment (TEE) in a computer’s main processor, including Intel’s Software Guard eXtensions (SGX) and Trust Domain Extensions (TDX) and AMD’s Secure Encrypted Virtualization with Secure Nested Paging (SEV-SNP) and Ciphertext Hiding.

The attack, at its core, involves the use of an interposition device built using off-the-shelf electronic equipment that costs under $1,000 and makes it possible to physically inspect all memory traffic inside a DDR5 server.

“This allows us for the first time to extract cryptographic keys from Intel TDX and AMD SEV-SNP with Ciphertext Hiding, including in some cases secret attestation keys from fully updated machines in trusted status,” the researchers noted on an informational site.

“Beyond breaking CPU-based TEEs, we also show how extracted attestation keys can be used to compromise Nvidia’s GPU Confidential Computing, allowing attackers to run AI workloads without any TEE protections.”

The findings come weeks after the release of two other attacks aimed at TEEs, such as Battering RAM and WireTap. Unlike these techniques that target systems using DDR4 memory, TEE.Fail is the first attack to be demonstrated against DDR5, meaning they can be used to undermine the latest hardware security protections from Intel and AMD.

The latest study has found that the AES-XTS encryption mode used by Intel and AMD is deterministic and, therefore, not sufficient to prevent physical memory interposition attacks. In a hypothetical attack scenario, a bad actor could leverage the custom equipment to record the memory traffic flowing between the computer and DRAM, and observe the memory contents during read and write operations, thereby opening the door to a side-channel attack.

This could be ultimately exploited to extract data from confidential virtual machines (CVMs), including ECDSA attestation keys from Intel’s Provisioning Certification Enclave (PCE), necessary in order to break SGX and TDX attestation.

“As attestation is the mechanism used to prove that data and code are actually executed in a CVM, this means that we can pretend that your data and code is running inside a CVM when in reality it is not,” the researchers said. “We can read your data and even provide you with incorrect output, while still faking a successfully completed attestation process.”

The study also pointed out that SEV-SNP with Ciphertext Hiding neither addresses issues with deterministic encryption nor prevents physical bus interposition. As a result, the attack facilitates the extraction of private signing keys from OpenSSL’s ECDSA implementation.

“Importantly, OpenSSL’s cryptographic code is fully constant-time and our machine had Ciphertext Hiding enabled, thus showing these features are not sufficient to mitigate bus interposition attacks,” they added.

While there is no evidence that the attack has been put to use in the wild, the researchers recommend using software countermeasures to mitigate the risks arising as a result of deterministic encryption. However, they are likely to be expensive.

In response to the disclosure, AMD said it has no plans to provide mitigations since physical vector attacks are out of scope for AMD SEV-SNP. Intel, in a similar alert, noted that TEE.fail does not change the company’s previous out-of-scope statement for these types of physical attacks.

Oct 28, 2025Ravie LakshmananMalware / Mobile Security

Cybersecurity researchers have disclosed details of a new Android banking trojan called Herodotus that has been observed in active campaigns targeting Italy and Brazil to conduct device takeover (DTO) attacks.

“Herodotus is designed to perform device takeover while making first attempts to mimic human behaviour and bypass behaviour biometrics detection,” ThreatFabric said in a report shared with The Hacker News.

The Dutch security company said the Trojan was first advertised in underground forums on September 7, 2025, as part of the malware-as-a-service (MaaS) model, touting its ability to run on devices running Android version 9 to 16.

It’s assessed that while the malware is not a direct evolution of another banking malware known as Brokewell, it certainly appears to have taken certain parts of it to put together the new strain. This includes similarities in the obfuscation technique used, as well as direct mentions of Brokewell in Herodotus (e.g., “BRKWL_JAVA”).

Herodotus is also the latest in a long list of Android malware to abuse accessibility services to realize its goals. Distributed via dropper apps masquerading as Google Chrome (package name “com.cd3.app”) through SMS phishing or other social engineering ploys, the malicious program leverages the accessibility feature to interact with the screen, serve opaque overlay screens to hide malicious activity, and conduct credential theft by displaying bogus login screens atop financial apps.

Additionally, it can also steal two-factor authentication (2FA) codes sent via SMS, intercept everything that’s displayed on the screen, grant itself extra permissions as required, grab the lockscreen PIN or pattern, and install remote APK files.

But where the new malware stands out is in its ability to humanize fraud and evade timing-based detections. Specifically, this includes an option to introduce random delays when initiating remote actions such as typing text on the device. This, ThreatFabric said, is an attempt by the threat actors to make it seem like the input is being entered by an actual user.

“The delay specified is in the range of 300 – 3000 milliseconds (0,3 – 3 seconds),” it explained. “Such a randomization of delay between text input events does align with how a user would input text. By consciously delaying the input by random intervals, actors are likely trying to avoid being detected by behaviour-only anti-fraud solutions spotting machine-like speed of text input.”

ThreatFabric said it also obtained overlay pages used by Herodotus targeting financial organisations in the U.S., Turkey, the U.K., and Poland, along with cryptocurrency wallets and exchanges, indicating that the operators are attempting to actively expand their horizons.

“It is under active development, borrows techniques long associated with the Brokewell banking Trojan, and appears purpose-built to persist inside live sessions rather than simply steal static credentials and focus on account takeover,” the company noted.

Threat actors tied to North Korea have been observed targeting the Web3 and blockchain sectors as part of twin campaigns tracked as GhostCall and GhostHire.

According to Kaspersky, the campaigns are part of a broader operation called SnatchCrypto that has been underway since at least 2017. The activity is attributed to a Lazarus Group sub-cluster called BlueNoroff, which is also known as APT38, CageyChameleon, CryptoCore, Genie Spider, Nickel Gladstone, Sapphire Sleet (formerly Copernicium), and Stardust Chollima.

Victims of the GhostCall campaign span several infected macOS hosts located in Japan, Italy, France, Singapore, Turkey, Spain, Sweden, India, and Hong Kong, whereas Japan and Australia have been identified as the major hunting grounds for the GhostHire campaign.

“GhostCall heavily targets the macOS devices of executives at tech companies and in the venture capital sector by directly approaching targets via platforms like Telegram, and inviting potential victims to investment-related meetings linked to Zoom-like phishing websites,” Kaspersky said.

“The victim would join a fake call with genuine recordings of this threat’s other actual victims rather than deepfakes. The call proceeds smoothly to then encourages the user to update the Zoom client with a script. Eventually, the script downloads ZIP files that result in infection chains deployed on an infected host.”

On the other hand, GhostHire involves approaching prospective targets, such as Web3 developers, on Telegram and luring them into downloading and executing a booby-trapped GitHub repository under the pretext of completing a skill assessment within 30 minutes of sharing the link, so as to ensure a higher success rate of infection.

Once installed, the project is designed to download a malicious payload onto the developer’s system based on the operating system used. The Russian cybersecurity company said it has been keeping tabs on the two campaigns since April 2025, although it’s assessed that GhostCall has been active since mid-2023, likely following the RustBucket campaign.

RustBucket marked the adversarial collective’s major pivot to targeting macOS systems, following which other campaigns have leveraged malware families like KANDYKORN, ObjCShellz, and TodoSwift.

It’s worth noting that various aspects of the activity have been documented extensively over the past year by multiple security vendors, including Microsoft, Huntress, Field Effect, Huntabil.IT, Validin, and SentinelOne.

The GhostCall Campaign

Targets who land on the fake Zoom pages as part of the GhostCall campaign are initially served a bogus page that gives the illusion of a live call, only to display an error message three to five seconds later, urging them to download a Zoom software development kit (SDK) to address a purported issue with continuing the call.

Should the victims fall for the trap and attempt to update the SDK by clicking on the “Update Now” option, it leads to the download of a malicious AppleScript file onto their system. In the event the victim is using a Windows machine, the attack leverages the ClickFix technique to copy and run a PowerShell command.

At each stage, every interaction with the fake site is recorded and beaconed to the attackers to track the victim’s actions. As recently as last month, the threat actor has been observed transitioning from Zoom to Microsoft Teams, using the same tactic of tricking users into downloading a TeamsFx SDK this time to trigger the infection chain.

Regardless of the lure used, the AppleScript is designed to install a phony application disguised as Zoom or Microsoft Teams. It also downloads another AppleScript dubbed DownTroy that checks stored passwords associated with password management applications and installs additional malware with root privileges.

DownTroy, for its part, is engineered to drop several payloads as part of eight distinct attack chains, while also bypassing Apple’s Transparency, Consent, and Control (TCC) framework –

• ZoomClutch or TeamsClutch, which uses a Swift-based implant that masquerades as Zoom or Teams while harboring functionality to prompt the user to enter their system password in order to complete the app update and exfiltrate the details to an external server
• DownTroy v1, which uses a Go-based dropper to launch the AppleScript-based DownTroy malware that’s then responsible for downloading additional scripts from the server until the machine is rebooted.
• CosmicDoor, which uses a C++ binary loader called GillyInjector (aka InjectWithDyld) to run a benign Mach-O app and inject a malicious payload into it at runtime. When it’s run with the –d flag, GillyInjector activates its destructive capabilities and irrevocably wipes all files in the current directory. The injected payload is a backdoor written in Nim named CosmicDoor that can communicate with an external server to receive and execute commands. It’s believed that the attackers first developed a Go version of CosmicDoor for Windows, before moving to Rust, Python, and Nim variants. It also downloads a bash script stealer suite named SilentSiphon.
• RooTroy, which uses Nimcore loader to launch GillyInjector, which then injects a Go backdoor called RooTroy (aka Root Troy V4) to collect device information, enumerate running processes, read payload from a specific file, and download additional malware (counting RealTimeTroy) and execute them.
• RealTimeTroy, which uses Nimcore loader to launch GillyInjector, which then injects a Go backdoor called RealTimeTroy that communicates with an external server using the WSS protocol to read/write files, get directory and process information, upload/download files, terminate a specified process, and get device information.
• SneakMain, which uses Nimcore loader to launch a Nim payload called SneakMain to receive and execute additional AppleScript commands received from an external server.
• DownTroy v2, which uses a dropper named CoreKitAgent to launch Nimcore loader, which then launches AppleScript-based DownTroy (aka NimDoor) to download an additional malicious script from an external server.
• SysPhon, which uses a lightweight version of RustBucket named SysPhon and SUGARLOADER, a known loader previously to have delivered the KANDYKORN malware. SysPhon, also employed in the Hidden Risk campaign, is a downloader written in C++ that can conduct reconnaissance and fetch a binary payload from an external server.

SilentSiphon is equipped to harvest data from Apple Notes, Telegram, web browser extensions, as well as credentials from browsers and password managers, and secrets stored in configuration files related to a long list of services: GitHub, GitLab, Bitbucket, npm, Yarn, Python pip, RubyGems, Rust cargo, NET Nuget, AWS, Google Cloud, Microsoft Azure, Oracle Cloud, Akamai Linode, DigitalOcean API, Vercel, Cloudflare, Netlify, Stripe, Firebase, Twilio, CircleCI, Pulumi, HashiCorp, SSH, FTP, Sui Blockchain, Solana, NEAR Blockchain, Aptos Blockchain, Algorand, Docker, Kubernetes, and OpenAI.

“While the video feeds for fake calls were recorded via the fabricated Zoom phishing pages the actor created, the profile images of meeting participants appear to have been sourced from job platforms or social media platforms such as LinkedIn, Crunchbase, or X,” Kaspersky said. “Interestingly, some of these images were enhanced with [OpenAI] GPT-4o.”

The GhostHire Campaign

The GhostHire campaign, the Russian cybersecurity company added, also dates back to mid-2023, with the attackers initiating contact with the targets directly on Telegram, sharing details of a job offer along with a link to a LinkedIn profile impersonating recruiters at financial companies based in the U.S. in an attempt to lend the conversations a veneer of legitimacy.

“Following up on initial communication, the actor adds the target to a user list for a Telegram bot, which displays the impersonated company’s logo and falsely claims to streamline technical assessments for candidates,” Kaspersky explained.

“The bot then sends the victim an archive file (ZIP) containing a coding assessment project, along with a strict deadline (often around 30 minutes) to pressure the target into quickly completing the task. This urgency increases the likelihood of the target executing the malicious content, leading to initial system compromise.”

The project in itself is innocuous, but incorporates a malicious dependency in the form of a malicious Go module hosted on GitHub (e.g., uniroute), causing the infection sequence to be triggered once the project is executed. This includes first determining the operating system of the victim’s computer and delivering an appropriate next-stage payload (i.e., DownTroy) programmed in PowerShell (Windows), bash script (Linux), or AppleScript (macOS).

Also deployed via DownTroy in the attacks targeting Windows are RooTroy, RealTimeTroy, a Go version of CosmicDoor, and Rust-based loader named Bof that’s used to decode and launch an encrypted shellcode payload stored in the “C:Windowssystem32” folder.

“Our research indicates a sustained effort by the actor to develop malware targeting both Windows and macOS systems, orchestrated through a unified command-and-control infrastructure,” Kaspersky said. “The use of generative AI has significantly accelerated this process, enabling more efficient malware development with reduced operational overhead.”

“The actor’s targeting strategy has evolved beyond simple cryptocurrency and browser credential theft. Upon gaining access, they conduct comprehensive data acquisition across a range of assets, including infrastructure, collaboration tools, note-taking applications, development environments, and communication platforms (messengers).”

In cybersecurity, speed isn’t just a win — it’s a multiplier. The faster you learn about emerging threats, the faster you adapt your defenses, the less damage you suffer, and the more confidently your business keeps scaling. Early threat detection isn’t about preventing a breach someday: it’s about protecting the revenue you’re supposed to earn every day.

Companies that treat cybersecurity as a reactive cost center usually find themselves patching holes, paying ransoms, and dealing with downtime. Companies that invest in proactive visibility, threat intelligence, and early detection mechanisms stay in the game longer. With trust, uptime, and innovation intact.

Let’s break down why this strategy directly connects to long-term business success:

1. Early detection drastically lowers the cost of incidents

A breach caught at initial access might cost just internal response hours. Caught at data exfiltration — multiply the cost by 10, and a breach caught after regulatory violations kick in causes damage multiplied by 100+.

Every malicious action not taken because you stopped the threat early equals:

• No stolen customer data
• No recovery downtime eating your revenue
• No brand-damaging PR nightmare
• No fines from regulators
• No expensive rebuild of infrastructure.

Early detection keeps risks tiny — before they evolve into crises.

2. Faster response = confident operations = competitive power

Business leaders care about ships sailing smoothly: new feature rollouts, customer onboarding, digital transformation — security must accelerate that, not block it.

When SOC analysts receive enriched alerts and clear context instantly, decision-making shifts from:

“Do we even know what this is?” to “Here’s the threat and here’s the action — done.”

Security becomes a growth enabler, not a roadblock. Customers stick with companies that appear competent and trustworthy.

3. A mature cyber posture unlocks serious business opportunities

As you scale, new markets require compliance and certifications. Want to sell to an international bank? Host global data? Expand your cloud footprint? Proof of early detection capability becomes a contract requirement.

Investors, partners, and enterprise clients love companies that can say: “We detect attacks early, and we can prove it.”

Security maturity = business expansion power.

How Threat Intelligence Helps Achieve Early Detection

A real-time stream of verified Indicators of Compromise (IOCs) mapped to active global malware campaigns. Your SIEM gets a steady flow of fresh indicators tied to active malware and a view into newly spun-up malicious infrastructure.

The data comes from live malware detonations in ANY.RUN Sandbox enabling 500,000 malware analysts and 15 000 security teams to observe kill chains, malware configurations, and study TTPs in a safe interactive environment. It’s rich with telemetry from threat actors’ infrastructure and curated by ANY.RUN’s experts.

Key features:

• 99% unique, up-to-the-minute IPs, domains, URLs tied to real attacks;
• STIX/TAXII format ready for integration with SIEM/SOAR systems;
• Tags for malware family and risk level.

ANY.RUN’s Threat Intelligence Feeds: data, features, integration

Your environment lights up the moment something suspicious appears, not a week later when the headlines drop. The business outcomes are:

• Expanded threat coverage that includes emerging campaigns;
• Faster and more accurate detections to prevent incidents before they strike;
• Lower workload thanks to strict filtering of false positives draining SOC time;
• Shorter MTTR thanks to context-enriched indicators, providing teams with the attack visibility they need.

Threat Intelligence Lookup

ANY.RUN’s TI Lookup provides instant context and reputation insights for any suspected indicator your SOC discovers. The information is derived from fresh incident investigations by over 15K corporate SOCs worldwide. Query artifacts and indicators leveraging more than 40 search parameters, view sandbox analyses exposing full attack chains, shrink MTTD to seconds.

When your SOC already sees an alert, ANY.RUN’s TI Lookup tells them:

• what malware family it belongs to
• whether it’s part of a known campaign
• how dangerous it is
• what to do next.

Instant context. Instant prioritization. Instant action. Together, they transform a SOC from overwhelmed to proactive.

ANY.RUN’s Threat Intelligence Lookup: turn raw indicators into actionable information

Analysts resolve what matters — and stop chasing noise. Time saved implies lower operational costs, and finally, lower dwell time equals lower risk.

The bottom line

Attackers are now faster than ever, using automation, AI, and endless ingenuity. The only way to outpace them is by detecting earlier and reacting smarter.

And that’s exactly what Threat Intelligence Feeds + TI Lookup deliver:

• Earlier visibility into active threats
• Faster enrichment and triage of alerts
• Stronger, more confident cyber posture
• Reduced risk = sustained growth and customer trust.

Early threat detection isn’t just a security outcome — it’s a business advantage. It paves your path to grow. It keeps your reputation intact. It ensures today’s success becomes tomorrow’s stability.

If your organization is ready to stop fearing threats and start anticipating them, it’s time to give your SOC the intelligence edge it deserves.

The New Reality for Lean Security Teams

If you’re the first security or IT hire at a fast-growing startup, you’ve likely inherited a mandate that’s both simple and maddeningly complex: secure the business without slowing it down.

Most organizations using Google Workspace start with an environment built for collaboration, not resilience. Shared drives, permissive settings, and constant integrations make life easy for employees—and equally easy for attackers.

The good news is that Google Workspace provides an excellent security foundation. The challenge lies in properly configuring it, maintaining visibility, and closing the blind spots that Google’s native controls leave open.

This article breaks down the key practices every security team—especially small, lean ones—should follow to harden Google Workspace and defend against modern cloud threats.

1. Lock Down the Basics

Enforce Multi-Factor Authentication (MFA)

MFA is the single most effective way to stop account compromise. In the Google Admin console, go to:

Security → Authentication → 2-Step Verification

• Set the policy to “On for everyone”.
• Require security keys (FIDO2) or Google’s prompt-based MFA instead of SMS codes.
• Enforce context-aware access for admins and executives—only allow logins from trusted networks or devices.

Even with perfect phishing detection, stolen credentials are inevitable. MFA makes them useless.

Harden Admin Access

Admin accounts are a prime target. In Admin Console → Directory → Roles,

• Limit the number of Super Admins to as few as possible.
• Assign role-based access—e.g., Groups Admin, Help Desk Admin, or User Management Admin—instead of blanket privileges.
• Turn on admin email alerts for privilege escalations or new role assignments.

This ensures one compromised admin account doesn’t mean total compromise.

How Material Extends Google Workspace Security

1. Email Security Beyond the Inbox

   Material detects and neutralizes sophisticated phishing, internal impersonation, and BEC-style attacks that slip past Google’s filters.

   • It uses relationship modeling to understand who your employees regularly communicate with and flags anomalies instantly.
   • Automated playbooks handle remediation at machine speed—quarantining, removing, or flagging threats across inboxes in seconds.
2. Account Takeover Detection and Response

   Material monitors a rich set of behavioral signals—forwarding rule changes, credential resets, unusual data access—to detect compromised accounts early.

   • Automated workflows isolate affected accounts, revoke tokens, and stop data exfiltration in real time.
   • This transforms detection from hours to seconds, eliminating the long dwell times that make takeovers so damaging.
3. Data Discovery and Protection at Scale

   Material continuously scans Gmail and Drive to identify sensitive data—PII, contracts, source code—and applies customizable, risk-based access controls.

   • For example, a user trying to open a payroll file might be prompted to re-authenticate with MFA.
   • Drive sharing violations can trigger automatic permission revocations or user notifications, ensuring self-healing security that doesn’t slow teams down.
4. Unified Visibility Across the Cloud Office

   Instead of managing dozens of disjointed alerts, Material correlates identity, data, and email signals into a unified dashboard—providing context, prioritization, and automated enforcement.

Final Thoughts

Google Workspace offers a secure foundation, but it’s only that—a foundation.

As your company grows, your threat surface expands, and the native tools’ limits start to show.

Building on Google’s strong base with solutions like Material Security gives teams the leverage to:

• Automate what used to take hours of manual effort.
• See and stop sophisticated threats across email, data, and accounts.
• Protect the information that defines your business—without adding friction.

Interested in seeing how Material secures your entire Google Workspace?

Request a demo of Material Security

The zero-day exploitation of a now-patched security flaw in Google Chrome led to the distribution of an espionage-related tool from Italian information technology and services provider Memento Labs, according to new findings from Kaspersky.

The vulnerability in question is CVE-2025-2783 (CVSS score: 8.3), a case of sandbox escape which the company disclosed in March 2025 as having come under active exploitation as part of a campaign dubbed Operation ForumTroll targeting organizations in Russia. The cluster is also tracked as TaxOff/Team 46 by Positive Technologies and Prosperous Werewolf by BI.ZONE. It’s known to be active since at least February 2024.

The wave of infections involved sending phishing emails containing personalized, short-lived links inviting recipients to the Primakov Readings forum. Clicking the links through Google Chrome or a Chromium-based web browser was enough to trigger an exploit for CVE-2025-2783, enabling the attackers to break out of the confines of the program and deliver tools developed by Memento Labs.

Headquartered in Milan, Memento Labs (also stylized as mem3nt0) was formed in April 2019 following the merger of InTheCyber Group and HackingTeam (aka Hacking Team), the latter of which has a history of selling offensive intrusion and surveillance capabilities to governments, law enforcement agencies, and corporations, including creating spyware designed to monitor the Tor browser.

Most notably, the infamous surveillance software vendor suffered a hack in July 2015, resulting in the leak of hundreds of gigabytes of internal data, including tools and exploits. Among these was an Extensible Firmware Interface (EFI) development kit dubbed VectorEDK that would later go on to become the foundation for a UEFI bootkit known as MosaicRegressor. In April 2016, the company courted a further setback after Italian export authorities revoked its license to sell outside of Europe.

Most notably, the attacks have been found to pave the way for a previously undocumented spyware developed by Memento Labs called LeetAgent, owing to the use of leetspeak for its commands.

The starting point is a validator phase, which is a small script executed by the browser to check if the visitor to the malicious site is a genuine user with a real web browser, and then leverages CVE-2025-2783 to detonate the sandbox escape in order to achieve remote code execution and drop a loader responsible for launching LeetAgent.

The malware is capable of connecting to a command-and-control (C2) server over HTTPS and receiving instructions that allow it to perform a wide range of tasks –

• 0xC033A4D (COMMAND) – Run command using cmd.exe
• 0xECEC (EXEC) – Execute a process
• 0x6E17A585 (GETTASKS) – Get a list of tasks that the agent is currently executing
• 0x6177 (KILL) – Stop a task
• 0xF17E09 (FILE x09) – Write to file
• 0xF17ED0 (FILE xD0) – Read a file
• 0x1213C7 (INJECT) – Inject shellcode
• 0xC04F (CONF) – Set communication parameters
• 0xD1E (DIE) – Quit
• 0xCD (CD) – Change current working directory
• 0x108 (JOB) – Set parameters for keylogger or file stealer to harvest files matching extensions *.doc, *.xls, *.ppt, *.rtf, *.pdf, *.docx, *.xlsx, and *.pptx

The malware used in the intrusions has been traced all the way back to 2022, with the threat actor also linked to a broader set of malicious cyber activity aimed at organizations and individuals in Russia and Belarus using phishing emails carrying malicious attachments as a distribution vector.

“Proficiency in Russian and familiarity with local peculiarities are distinctive features of the ForumTroll APT group, traits that we have also observed in its other campaigns,” Larin said. “However, mistakes in some of those other cases suggest that the attackers were not native Russian speakers.”

It’s worth noting that at this stage, Positive Technologies, in a report published in June 2025, also disclosed an identical cluster of activity that involved the exploitation of CVE-2025-2783 by a threat actor it tracks as TaxOff to deploy a backdoor called Trinper. Larin told The Hacker News that the two sets of attacks are connected.

“In several incidents, the LeetAgent backdoor used in Operation ForumTroll directly launched the more sophisticated Dante spyware,” Larin explained.

“Beyond that handoff, we observed overlaps in tradecraft: identical COM-hijacking persistence, similar file-system paths, and data hidden in font files. We also found shared code between the exploit/loader and Dante. Taken together, these points indicate the same actor/toolset behind both clusters.”

Dante, which emerged in 2022 as a replacement for another spyware referred to as Remote Control Systems (RCS), comes with an array of protections to resist analysis. It obfuscates control flow, hides imported functions, adds anti-debugging checks, and nearly every string in the source code is encrypted. It also queries the Windows Event Log for events that may indicate the use of malware analysis tools or virtual machines to fly under the radar.

Once all the checks are passed, the spyware proceeds to launch an orchestrator module that’s engineered to communicate with a C2 server via HTTPS, load other components either from the file system or memory, and remote itself if it doesn’t receive commands within a set number of days specified in the configuration, and erase traces of all activity.

There is currently no information about the nature of additional modules launched by the spyware. While the threat actor behind Operation ForumTroll has not been observed using Dante in the campaign exploiting the Chrome security flaw, Larin said that there is evidence to suggest wider usage of Dante in other attacks. But he pointed out it’s too early to reach any definitive conclusion about scope or attribution.

Oct 28, 2025Ravie LakshmananCyber Espionage / Malware

A European embassy located in the Indian capital of New Delhi, as well as multiple organizations in Sri Lanka, Pakistan, and Bangladesh, have emerged as the target of a new campaign orchestrated by a threat actor known as SideWinder in September 2025.

The activity “reveals a notable evolution in SideWinder’s TTPs, particularly the adoption of a novel PDF and ClickOnce-based infection chain, in addition to their previously documented Microsoft Word exploit vectors,” Trellix researchers Ernesto Fernández Provecho and Pham Duy Phuc said in a report published last week.

The attacks, which involved sending spear-phishing emails in four waves from March through September 2025, are designed to drop malware families such as ModuleInstaller and StealerBot to gather sensitive information from compromised hosts.

While ModuleInstaller serves as a downloader for next-stage payloads, including StealerBot, the latter is a .NET implant that can launch a reverse shell, deliver additional malware, and collect a wide range of data from compromised hosts, including screenshots, keystrokes, passwords, and files.

It should be noted that both ModuleInstaller and StealerBot were first publicly documented by Kaspersky in October 2024 as part of attacks mounted by the hacking group targeting high-profile entities and strategic infrastructures in the Middle East and Africa.

As recently as May 2025, Acronis revealed SideWinder’s attacks aimed at government institutions in Sri Lanka, Bangladesh, and Pakistan using malware-laden documents susceptible to known Microsoft Office flaws to launch a multi-stage attack chain and ultimately deliver StealerBot.

The latest set of attacks, observed by Trellix post September 1, 2025, and targeting Indian embassies, entails the use of Microsoft Word and PDF documents in phishing emails with titles such as “Inter-ministerial meeting Credentials.pdf” or “India-Pakistan Conflict -Strategic and Tactical Analysis of the May 2025.docx.” The messages are sent from the domain “mod.gov.bd.pk-mail[.]org” in an attempt to mimic the Ministry of Defense of Pakistan.

“The initial infection vector is always the same: a PDF file that cannot be properly seen by the victim or a Word document that contains some exploit,” Trellix said. “The PDF files contain a button that urges the victim to download and install the latest version of Adobe Reader to view the document’s content.”

Doing so, however, triggers the download of a ClickOnce application from a remote server (“mofa-gov-bd.filenest[.]live”), which, when launched, sideloads a malicious DLL (“DEVOBJ.dll”), while simultaneously launching a decoy PDF document to the victims.

The ClickOnce application is a legitimate executable from MagTek Inc. (“ReaderConfiguration.exe”) that masquerades as Adobe Reader and is signed with a valid signature to avoid raising any red flags. Furthermore, requests to the command-and-control (C2) server are region-locked to South Asia and the path to download the payload is dynamically generated, complicating analysis efforts.

The rogue DLL, for its part, is designed to decrypt and launch a .NET loader named ModuleInstaller, which then proceeds to profile the infected system and deliver the StealerBot malware.

The findings indicate an ongoing effort on the part of the persistent threat actors to refine their modus operandi and circumvent security defenses to accomplish their goals.

“The multi-wave phishing campaigns demonstrate the group’s adaptability in crafting highly specific lures for various diplomatic targets, indicating a sophisticated understanding of geopolitical contexts,” Trellix said. “The consistent use of custom malware, such as ModuleInstaller and StealerBot, coupled with the clever exploitation of legitimate applications for side-loading, underscores SideWinder’s commitment to sophisticated evasion techniques and espionage objectives.”

Oct 27, 2025Ravie LakshmananData Protection / Authentication

Social media platform X is urging users who have enrolled for two-factor authentication (2FA) using passkeys and hardware security keys like Yubikeys to re-enroll their key to ensure continued access to the service.

To that end, users are being asked to complete the re-enrollment, either using their existing security key or enrolling a new one, by November 10, 2025.

“After November 10, if you haven’t re-enrolled a security key, your account will be locked until you: re-enroll; choose a different 2FA method; or elect not to use 2FA (but we always recommend you use 2FA to protect your account!),” the company’s Safety handle wrote in a post on X.

The move is part of the company’s efforts to formally retire the twitter[.]com domain. Twitter, which was acquired by SpaceX and Tesla CEO Elon Musk in October 2022, was rebranded to X in July 2023.

In a follow-up post, X noted that the change does not apply to users who have enrolled for 2FA using other methods, such as authenticator apps.

“Security keys enrolled as a 2FA method are currently tied to the twitter[.]com domain,” it added. “Re-enrolling your security key will associate them with x[.]com, allowing us to retire the Twitter domain.”

X also supports 2FA using text messages, but the option is limited to non-Premium subscribers as of March 20, 2023. To enroll for 2FA, users can follow the steps below –

• Navigate to Settings and privacy > Security and account access > Security > Two-factor authentication
• Select Security key > Manage security keys > Delete existing keys
• Select the Security key option > Enter X password > Enter confirmation code sent via email
• Click Start > Insert key into the computer’s USB port or connect via Bluetooth/NFC > Once inserted, touch the button on the key
• Follow the on-screen instructions to finish setup

Oct 27, 2025Ravie LakshmananArtificial Intelligence / Vulnerability

Cybersecurity researchers have discovered a new vulnerability in OpenAI’s ChatGPT Atlas web browser that could allow malicious actors to inject nefarious instructions into the artificial intelligence (AI)-powered assistant’s memory and run arbitrary code.

“This exploit can allow attackers to infect systems with malicious code, grant themselves access privileges, or deploy malware,” LayerX Security Co-Founder and CEO, Or Eshed, said in a report shared with The Hacker News.

The attack, at its core, leverages a cross-site request forgery (CSRF) flaw that could be exploited to inject malicious instructions into ChatGPT’s persistent memory. The corrupted memory can then persist across devices and sessions, permitting an attacker to conduct various actions, including seizing control of a user’s account, browser, or connected systems, when a logged-in user attempts to use ChatGPT for legitimate purposes.

Memory, first introduced by OpenAI in February 2024, is designed to allow the AI chatbot to remember useful details between chats, thereby allowing its responses to be more personalized and relevant. This could be anything ranging from a user’s name and favorite color to their interests and dietary preferences.

The attack poses a significant security risk in that by tainting memories, it allows the malicious instructions to persist unless users explicitly navigate to the settings and delete them. In doing so, it turns a helpful feature into a potent weapon that can be used to run attacker-supplied code.

“What makes this exploit uniquely dangerous is that it targets the AI’s persistent memory, not just the browser session,” Michelle Levy, head of security research at LayerX Security, said. “By chaining a standard CSRF to a memory write, an attacker can invisibly plant instructions that survive across devices, sessions, and even different browsers.”

“In our tests, once ChatGPT’s memory was tainted, subsequent ‘normal’ prompts could trigger code fetches, privilege escalations, or data exfiltration without tripping meaningful safeguards.”

The attack plays out as follows –

• User logs in to ChatGPT
• The user is tricked into launching a malicious link by social engineering
• The malicious web page triggers a CSRF request, leveraging the fact that the user is already authenticated, to inject hidden instructions into ChatGPT’s memory without their knowledge
• When the user queries ChatGPT for a legitimate purpose, the tainted memories will be invoked, leading to code execution

Additional technical details to pull off the attack have been withheld. LayerX said the problem is exacerbated by ChatGPT Atlas’ lack of robust anti-phishing controls, the browser security company said, adding it leaves users up to 90% more exposed than traditional browsers like Google Chrome or Microsoft Edge.

In tests against over 100 in-the-wild web vulnerabilities and phishing attacks, Edge managed to stop 53% of them, followed by Google Chrome at 47% and Dia at 46%. In contrast, Perplexit’s Comet and ChatGPT Atlas stopped only 7% and 5.8% of malicious web pages.

This opens the door to a wide spectrum of attack scenarios, including one where a developer’s request to ChatGPT to write code can cause the AI agent to slip in hidden instructions as part of the vibe coding effort.

The development comes as NeuralTrust demonstrated a prompt injection attack affecting ChatGPT Atlas, where its omnibox can be jailbroken by disguising a malicious prompt as a seemingly harmless URL to visit. It also follows a report that AI agents have become the most common data exfiltration vector in enterprise environments.

“AI browsers are integrating app, identity, and intelligence into a single AI threat surface,” Eshed said. “Vulnerabilities like ‘Tainted Memories’ are the new supply chain: they travel with the user, contaminate future work, and blur the line between helpful AI automation and covert control.”

“As the browser becomes the common interface for AI, and as new agentic browsers bring AI directly into the browsing experience, enterprises need to treat browsers as critical infrastructure, because that is the next frontier of AI productivity and work.”

Oct 27, 2025Ravie LakshmananCybersecurity / Hacking News

Security, trust, and stability — once the pillars of our digital world — are now the tools attackers turn against us. From stolen accounts to fake job offers, cybercriminals keep finding new ways to exploit both system flaws and human behavior.

Each new breach proves a harsh truth: in cybersecurity, feeling safe can be far more dangerous than being alert.

Here’s how that false sense of security was broken again this week.

⚡ Threat of the Week

Newly Patched Critical Microsoft WSUS Flaw Comes Under Attack — Microsoft released out-of-band security updates to patch a critical-severity Windows Server Update Service (WSUS) vulnerability that has since come under active exploitation in the wild. The vulnerability in question is CVE-2025-59287 (CVSS score: 9.8), a remote code execution flaw in WSUS that was originally fixed by the tech giant as part of its Patch Tuesday update published last week. According to Eye Security and Huntress, the security flaw is being weaponized to drop a .NET executable and Base64-encoded PowerShell payload to run arbitrary commands on infected hosts.

• YouTube Ghost Network Delivers Stealer Malware — A malicious network of YouTube accounts has been observed publishing and promoting videos that lead to malware downloads. Active since 2021, the network has published more than 3,000 malicious videos to date, with the volume of such videos tripling since the start of the year. The campaign leverages hacked accounts and replaces their content with “malicious” videos that are centred around pirated software and Roblox game cheats to infect unsuspecting users searching for them with stealer malware. Some of the videos have amassed hundreds of thousands of views.
• N. Korea’s Dream Job Campaign Targets Defense Sector — Threat actors with ties to North Korea have been attributed to a new wave of attacks targeting European companies active in the defense industry as part of a long-running campaign known as Operation Dream Job. In the observed activity, the Lazarus group sends malware-laced emails purporting to be from recruiters at top companies, ultimately tricking recipients into infecting their own machines with malware such as ScoringMathTea. ESET noted that the attacks singled out companies that supply military equipment, some of which are currently deployed in Ukraine. One of the targeted companies is involved in the production of at least two unmanned aerial vehicles currently used in Ukraine.
• MuddyWater Targets 100+ Organisations in Global Espionage Campaign — The Iranian nation-state group known as MuddyWater has been attributed to a new campaign that has leveraged a compromised email account to distribute a backdoor called Phoenix to various organizations across the Middle East and North Africa (MENA) region, including over 100 government entities. The end goal of the campaign is to infiltrate high-value targets and facilitate intelligence gathering using a backdoor called Phoenix that’s distributed via spear-phishing emails. MuddyWater, also called Boggy Serpens, Cobalt Ulster, Earth Vetala, Mango Sandstorm (formerly Mercury), Seedworm, Static Kitten, TA450, TEMP.Zagros, and Yellow Nix, is assessed to be affiliated with Iran’s Ministry of Intelligence and Security (MOIS).
• Meta Launches New Tools to Protect WhatsApp and Messenger Users from Scams — Meta said it is launching new tools to protect Messenger and WhatsApp users from potential scams. This includes introducing new warnings on WhatsApp when users attempt to share their screen with an unknown contact during a video call. On Messenger, users can opt to enable a setting called “Scam detection” by navigating to Privacy & safety settings. Once it’s turned on, users are alerted when they receive a potentially suspicious message from an unknown connection that may contain signs of a scam. The social media giant also said it detected and disrupted close to 8 million accounts on Facebook and Instagram since the start of the year that are associated with criminal scam centers targeting people, including the elderly, across the world through messaging, dating apps, social media, crypto, and other apps. According to Graphika, the illicit money-making schemes target older adults and victims of previous scams. “The scammers use major social media platforms to attract their targets, then redirect them to fraudulent websites or private messages to divulge financial details or sensitive personal data,” it said. “The operations follow a recurring pattern we’ve seen across our scams work: build trust, usher victims off-platform, and extract personal or financial data through registration for non-existent relief programs or submission of complaint forms based on organizational trust.”
• Jingle Thief Strikes Cloud for Gift Card Fraud — A cybercriminal group called Jingle Thief has been observed targeting cloud environments associated with organizations in the retail and consumer services sectors for gift card fraud. “Jingle Thief attackers use phishing and smishing to steal credentials, to compromise organizations that issue gift cards,” Palo Alto Networks Unit 42 said. “Once they gain access to an organization, they pursue the type and level of access needed to issue unauthorized gift cards.” The end goal of these efforts is to leverage the issued gift cards for monetary gain by likely reselling them on gray markets.

‎️‍🔥 Trending CVEs

Hackers move fast. They often exploit new vulnerabilities within hours, turning a single missed patch into a major breach. One unpatched CVE can be all it takes for a full compromise. Below are this week’s most critical vulnerabilities gaining attention across the industry. Review them, prioritize your fixes, and close the gap before attackers take advantage.

This week’s list includes — CVE-2025-54957 (Dolby Unified Decoder), CVE-2025-6950, CVE-2025-6893 (Moxa), CVE-2025-36727, CVE-2025-36728 (SimpleHelp), CVE-2025-8078, CVE-2025-9133 (Zyxel), CVE-2025-61932 (Lanscope Endpoint Manager), CVE-2025-61928 (Better Auth), CVE-2025-57738 (Apache Syncope), CVE-2025-40778, CVE-2025-40780, CVE-2025-8677 (BIND 9), CVE-2025-11411 (Unbound), CVE-2025-61865 (I-O DATA NarSuS App), CVE-2025-53072, CVE-2025-62481 (Oracle E-Business Suite), CVE-2025-11702, CVE-2025-10497, CVE-2025-11447 (GitLab), CVE-2025-22167 (Atlassian Jira), CVE-2025-54918 (Microsoft), and CVE-2025-52882 (Claude Code for Visual Studio Code).

📰 Around the Cyber World

• Apple’s iOS 26 Deletes Spyware Evidence — Apple’s latest mobile operating system update, iOS 26, has made a notable change to a log file named “shutdown.log” that stores evidence of past spyware infections. According to iPhone forensics and investigations firm iVerify, the company is now rewriting the file after every device reboot, instead of appending new data at the end. While it’s not clear if this is an intentional design decision or an inadvertent bug, iVerify said “this automatic overwriting, while potentially intended for system hygiene or performance, effectively sanitizes the very forensic artifact that has been instrumental in identifying these sophisticated threats.”
• Google Details Information Ops Targeting Poland — Google said it observed multiple instances of pro-Russia information operations (IO) actors promoting narratives related to the reported incursion of Russian drones into Polish airspace that occurred in September 2025. “The identified IO activity, which mobilized in response to this event and the ensuing political and security developments, appeared consistent with previously observed instances of pro-Russia IO targeting Poland—and more broadly the NATO Alliance and the West,” the company said. The messaging involved denying Russia’s culpability, blaming the West, undermining domestic support for the government, and undercutting Polish domestic support for its government’s foreign policy position towards Ukraine. The activity has been attributed to three clusters tracked as Portal Kombat (aka Pravda Network), Doppelganger, and an online publication named Niezależny Dziennik Polityczny. NDP is assessed to be a significant amplifier within the Polish information space of pro-Russia disinformation surrounding Russia’s ongoing invasion of Ukraine.
• RedTiger-based infostealer Used to Steal Discord Accounts — Threat actors have been observed exploiting an open-source, Python-based red-teaming tool called RedTiger in attacks targeting gamers and Discord accounts. “The RedTiger infostealer targets various types of sensitive information, with a primary focus on Discord accounts,” Netskope said. “The infostealer injects a custom JavaScript into Discord’s client index.js file (discord_desktop_core) to monitor and intercept Discord traffic. Additionally, it collects browser-stored data (including payment information), game-related files, cryptocurrency wallet data, and screenshots from the host system. It can also spy through the victim’s webcam and overload storage devices by mass-spawning processes and creating files.” Additionally, the tool facilitates what’s called mass file and process spamming, creating 100 files with random file extensions and launching 100 threads to kick off 400 total processes simultaneously, effectively overloading the system resources and hindering analysis efforts. The campaign is another example of threat actors exploiting any legitimate platform to gain false legitimacy and bypass protections. The development comes as gamers have also been the target of another multi-function Python RAT that leverages the Telegram Bot API as a command and control (C2) channel, allowing attackers to exfiltrate stolen data and remotely interact with victim machines. The malware, which masquerades as legitimate Minecraft software “Nursultan Client,” can capture screenshots, take photos from a user’s webcam, steal Discord authentication tokens, and open arbitrary URLs on the victim’s machine.
• UNC6229 Uses Fake Job Postings to Spread RATs — A financially motivated threat cluster operating out of Vietnam has leveraged fake job postings on legitimate platforms like LinkedIn (or their own fake job posting websites such as staffvirtual[.]website) to target individuals in the digital advertising and marketing sectors with malware and phishing kits with the ultimate aim of compromising high-value corporate accounts and hijack digital advertising accounts. Google, which disclosed details of the “persistent and targeted” campaign, is tracking it as UNC6229. “The effectiveness of this campaign hinges on a classic social engineering tactic where the victim initiates the first contact. UNC6229 creates fake company profiles, often masquerading as digital media agencies, on legitimate job platforms,” it noted. “They post attractive, often remote, job openings that appeal to their target demographic.” Once the victim submits the application, the threat actor contacts the applicant via email to deceive them into opening malicious ZIP attachments, leading to remote access trojans or clicking on phishing links that capture their corporate credentials. Another aspect that makes this campaign noteworthy is that the victims are more likely to trust the email messages, since they are in response to a self-initiated action, establishing a “foundation of trust.”

• XWorm 6.0 Detailed — The threat actors behind XWorm have unleashed a new version (version 6.0) of the malware with improved process protection and anti-analysis capabilities. “This latest version includes additional features for maintaining persistence and evading analysis,” Netskope said. “The loader includes new Antimalware Scan Interface (AMSI)-bypass functionality using in-memory modification of CLR.DLL to avoid detection.” The infection chain begins with a Visual Basic Script likely distributed via social engineering, which sets up persistence and proceeds to drop a PowerShell loader responsible for fetching the XWorm 6.0 payload from a public GitHub repository. One of the new features is its ability to prevent process termination by marking itself as a critical process and terminating itself when it detects execution on Windows XP. “This change may be an effort to prevent researchers or analysts from running the payload in a sandbox or legacy analysis environment,” the company added.
• Spike in Attacks Abusing Microsoft 365 Direct Send — Cisco Talos said it has observed increased activity by malicious actors leveraging Microsoft 365 Exchange Online Direct Send as part of phishing campaigns and business email compromise (BEC) attacks. It described the feature abuse as an opportunistic exploitation of a trusted pathway as it bypasses DKIM, SPF, and DMARC protections. “Direct Send preserves business workflows by allowing messages from these appliances to bypass more rigorous authentication and security checks,” security researcher Adam Katz said. “Adversaries emulate device or application traffic and send unauthenticated messages that appear to originate from internal accounts and trusted systems.”
• CoPhish Attack Steals OAuth Tokens via Copilot Studio Agents — Cybersecurity researchers found a way by which a Copilot Studio agent’s “Login” settings can be used to redirect a user to any URL, resulting in an OAuth consent attack, which makes use of malicious third-party Entra ID applications to seize control of victim accounts. Copilot Studio agents are chatbots hosted on copilotstudio.microsoft[.]com. “This increases the attack’s legitimacy by redirecting the user from copilotstudio.microsoft.com,” Datadog said. The attack technique has been codenamed CoPhish. It essentially involves configuring an agent’s sign-in process with a malicious OAuth application and modifying the agent to send the resulting user token issued by Entra ID to access the application to a URL under their control. Thus, when the attacker sends a malicious CoPilot Studio agent link to a victim via phishing emails and they attempt to access it, they are prompted to login to the service, at which point they are redirected to a malicious OAuth application for consent. “The malicious agent does not need to be registered in the target environment: in other words, an attacker can create an agent in their own environment to target users,” Datadog added. It should be noted that the redirect action when the victim user clicks on the Login button can be configured to redirect to any malicious URL, and the application consent workflow URL is just one possibility for the threat actor.

• Abuse of AzureHound in the Wild — Multiple threat actors such as Curious Serpens (Peach Sandstorm), Void Blizzard, and Storm-0501 have leveraged a Go-based open-source data collection tool called AzureHound in their attacks. “Threat actors misuse this tool to enumerate Azure resources and map potential attack paths, enabling further malicious operations,” Palo Alto Networks Unit 42 said. “Collecting internal Azure information helps threat actors uncover misconfigurations and indirect privilege escalation opportunities that might not be obvious without this full view of the target Azure environment. Threat actors also run the tool after obtaining initial access to the victim environment, downloading and running AzureHound on assets to which they have gained access.”
• Modified Telegram Android App Delivers Baohuo Backdoor — A modified version of the Telegram messaging app for Android, named Telegram X, is being used to deliver a new backdoor called Baohuo, while remaining functional. Once launched, it connects to a Redis database for command-and-control (C2) and receives instructions to execute them on the compromised device. “In addition to being able to steal confidential data, including user logins and passwords, as well as chat histories, this malware has a number of unique features,” Doctor Web said. “For example, to prevent itself from being detected and to cover up the fact that an account has been compromised, Baohuo can conceal connections from third-party devices in the list of active Telegram sessions. Moreover, it can add and remove the user from Telegram channels and also join and leave chats on behalf of the victim, also concealing these actions.” The backdoor has infected more than 58,000 Android-based smartphones, tablets, TV box sets, and even cars to date since it began to be distributed in mid-2024 via in-app ads in mobile apps that trick users into installing the malicious APK from an external site that mimics an app marketplace. The rogue Android app has also been detected on legitimate third-party app catalogs like APKPure, ApkSum, and AndroidP. Some of the countries with the largest number of infections include Colombia, Brazil, Egypt, Algeria, Iraq, Russia, India, Bangladesh, Pakistan, Indonesia, and the Philippines.
• Windows Disables File Explorer Previews for Security — Microsoft has disabled File Explorer previews for files downloaded from the internet (i.e., those that are marked with Mark of the Web). The change was rolled out for security reasons during this month’s Patch Tuesday updates. “This change mitigates a vulnerability where NTLM hash leakage might occur if users preview files containing HTML tags (such as <link>, <src>, and so forth) referencing external paths. Attackers could exploit this preview feature to capture sensitive credentials,” Microsoft said. Once the latest updates are installed, the File Explorer preview pane will display the following message: “The file you are attempting to preview could harm your computer. If you trust the file and the source you received it from, open it to view its contents.” To remove the block, users are required to right-click on the downloaded file, select Properties, and then Unblock. It’s believed that the change is also designed to tackle CVE-2025-59214, a File Explorer spoofing issue that could be exploited to leak sensitive information over the network. CVE-2025-59214 is a bypass for CVE-2025-50154, which in turn is a bypass for CVE-2025-24054, a zero-click NTLM credential leakage vulnerability that came under active exploitation in the wild earlier this year.
• Phishing Campaigns Employ New Evasion Tactics — Kaspersky has warned that threat actors are increasingly employing diverse evasion techniques in their phishing campaigns and websites. “In email, these techniques include PDF documents containing QR codes, which are not as easily detected as standard hyperlinks,” the Russian company said. “Another measure is password protection of attachments. In some instances, the password arrives in a separate email, adding another layer of difficulty to automated analysis. Attackers are protecting their web pages with CAPTCHAs, and they may even use more than one verification page.”
• Fraudulent Perplexity Comet Browser Domains Found — BforeAI said it has observed over 40 fraudulent domains promoting Perplexity’s AI-powered Comet browser, with bad actors also publishing copycat apps on Apple App Store and Google Play Store. “The timing of domain registrations closely follows Comet’s launch timeline, indicating opportunistic cybercriminals monitoring for emerging technology trends,” BforeAI said. “The use of international registrars, privacy protection services, and parking pages suggests coordination among threat actors.”
• LockBit 5.0 Claims New Victims — LockBit, which recently resurfaced with a new version (codenamed “ChuongDong”) following being disrupted in early 2024, is already extorting new victims, claiming over a dozen victims across Western Europe, the Americas, and Asia, affecting both Windows and Linux systems. Half of them have been infected by the newly released LockBit 5.0 variant, and the rest by LockBit Black. The development is a “clear sign that LockBit’s infrastructure and affiliate network are once again active,” Check Point said. The latest version introduces multi-platform support, stronger evasion, faster encryption, and randomized 16-character file extensions to evade detection. “To join, affiliates must deposit roughly $500 in Bitcoin for access to the control panel and encryptors, a model aimed at maintaining exclusivity and vetting participants,” the company said. “Updated ransom notes now identify themselves as LockBit 5.0 and include personalized negotiation links granting victims a 30-day deadline before stolen data is published.”
• Data Collection Consent Changes for New Firefox Extensions — Starting November 3, Mozilla will require all Firefox extensions to specifically declare in the manifest.json file if they collect and transmit personal data to third parties. This information is expected to be integrated into Firefox permission prompts when users attempt to install the browser add-on on the addons.mozilla.org page. “This will apply to new extensions only, and not new versions of existing extensions,” Mozilla said. “Extensions that do not collect or transmit any personal data are required to specify this by setting the none required data collection permission in this property.”
• Hackers Target WordPress Websites by Exploiting Outdated Plugins — A mass-exploitation campaign is targeting WordPress sites with GutenKit and Hunk Companion plugins vulnerable to known security flaws such as CVE-2024-9234, CVE-2024-9707, and CVE-2024-11972 to take over sites for malicious ends. “These vulnerabilities make it possible for unauthenticated threat actors to install and activate arbitrary plugins, which can be leveraged to achieve remote code execution,” Wordfence said. The exploitation activity is assessed to have commenced on October 8, 2025. Over 8,755,000 exploit attempts targeting these vulnerabilities have been blocked. In some of the incidents, the attack leads to the download of a ZIP archive hosted on GitHub that can automatically log in an attacker as an administrator and run scripts to upload and download arbitrary files. It also drops a PHP payload that comes with mass defacement, file management, network-sniffing capabilities, and installing further malware via a terminal. In scenarios where a full admin backdoor cannot be obtained, the attackers have been found to install a vulnerable “wp-query-console” to achieve unauthenticated remote code execution. The disclosure comes as the WordPress security company detailed how threat actors craft malware that uses variable functions and cookies for obfuscation.
• Unusual Phishing Attack Bypasses SEGs Using JavaScript — A “cunning new phishing attack” is bypassing Secure Email Gateways (SEGs) by making use of a phishing script with random domain selection and dynamic server-driven page replacement to steal credentials. The threat was first detected in February 2025 and remains ongoing. The campaign involves distributing phishing emails containing HTML attachments that contain an embedded URL leading to the fake landing page, or through emails with embedded links that spoof enterprise collaboration platforms like DocuSign, Microsoft OneDrive, Google Docs, and Adobe Sign. “In the tactic, the script picks a random .org domain from a hardcoded, predefined list,” Cofense said. “The .org domains on the list appear to be dynamically generated in bulk without using words, likely in an attempt to bypass block lists or AI/ML tools designed to block domains based on certain word structures. The script then generates a dynamic UUID (Universal Unique Identifier), which can be used to track victims and serve as a campaign identifier, suggesting that this script may be part of a package that can be reused in different campaigns, potentially with different spoofed brands on credential phishing pages.” The script is configured to send an HTTP(s) POST request to the random server, causing it to respond back with a dynamically generated login form based on the victim’s context.
• Russia Plans China-Like Bug Disclosure Law — According to RBC, Russia is reportedly preparing a new bill that would require security researchers, security firms, and other white-hat hackers to report all vulnerabilities to the Federal Security Service (FSB), the country’s principal security agency. This is similar to the legislation that was passed by China in July 2021. Security researchers who fail to report vulnerabilities to the FAB will face criminal charges for “unlawful transfer of vulnerabilities.” The possibility of the creation of a register of white-hat hackers is also being discussed, the Russian media publication said. It should be noted that the use of zero-days by Chinese nation-state hacking groups has surged since the law went into effect. “Chinese threat activity groups have shifted heavily toward the exploitation of public-facing appliances since at least 2021,” Recorded Future said in a November 2023 report. “Over 85% of known zero-day vulnerabilities exploited by Chinese state-sponsored groups during this subsequent period were in public-facing appliances such as firewalls, enterprise VPN products, hypervisors, load balancers, and email security products.” In an analysis published in June 2025, the Atlantic Council said “China’s 2021 Vulnerability Disclosure Law forces engagement with the overall offensive pipeline,” adding “China uses its [Capture the Flag] and regulatory ecosystem to solicit bugs informally from hackers for national security use, [and] its major technology companies are strategic allies in sourcing exploits.”
• Dozens of Nations Sign U.N. Cybercrime Treaty — As many as 72 countries have agreed to fight cybercrime, including by sharing data and mutually extraditing suspected criminals, under a new United Nations treaty, despite warnings over privacy and security by Big Tech and rights groups. The United Nations Convention against Cybercrime was adopted by the General Assembly of the United Nations on 24 December 2024. INTERPOL said “the Convention provides an enhanced legal and operational foundation for coordinated global action against cybercrime.” In a statement on its website, the Human Rights Watch and other signatories said the treaty “obligates states to establish broad electronic surveillance powers to investigate and cooperate on a wide range of crimes, including those that don’t involve information and communication systems” and does so without “adequate human rights safeguards.” The U.N. Office on Drugs and Crime (UNODC) has defended the Convention, arguing the need for improved cooperation to tackle transnational crimes and protect children against online child grooming.
• New Caminho Loader Spotted in the Wild — A new Brazilian-origin Loader-as-a-Service (LaaS) operation called Caminho has been observed employing Least Significant Bit (LSB) steganography to conceal .NET payloads within image files hosted on legitimate platforms. “Active since at least March 2025, with a significant operational evolution in June 2025, the campaign has delivered a variety of malware and infostealers such as Remcos RAT, XWorm, and Katz Stealer to victims within multiple industries across South America, Africa, and Eastern Europe,” Arctic Wolf said. “Extensive Portuguese-language code throughout all samples supports our high-confidence attribution of this operation to a Brazilian origin.” Attack chains distributing the loader involve using spear-phishing emails with archived JavaScript (JS) or Visual Basic Script files using business-themed social engineering lures that, when launched, activate a multi-stage infection. This includes downloading an obfuscated PowerShell payload from Pastebin-style services, which then downloads steganographic images hosted on the Internet Archive (archive[.]org). The PowerShell script also extracts the loader from the image and launches it directly in memory. The loader ultimately retrieves and injects the final malware into the calc.exe address space without writing artifacts to disk. Persistence is established through scheduled tasks that re-execute the infection chain.

• F5 Breach Began in Late 2023 — The recently disclosed security breach at F5 began in late 2023, much earlier than previously thought, per a report from Bloomberg. The hack came to light in August 2025, indicating the hackers managed to stay undetected for nearly two years. “The attackers penetrated F5’s computer systems by exploiting software from the company that had been left vulnerable and exposed to the internet,” the report said, adding the company’s own staff failed to follow the cybersecurity guidelines it provides customers. It’s believed that Chinese state-sponsored actors are behind the attack, although a Chinese official has called the accusations “groundless.”
• Multiple Flaws in EfficientLab WorkExaminer Professional — Several vulnerabilities (CVE-2025-10639, CVE-2025-10640, and CVE-2025-10641) have been discovered in EfficientLab’s WorkExaminer Professional employee monitoring software, including ones that can allow an attacker on the network to take control of the system and collect screenshots or keystrokes. “An attacker can also exploit missing server-side authentication checks to get unauthenticated administrative access to the WorkExaminer Professional server and therefore the server configuration and data,” SEC Consult said. “In addition, all data between console, monitoring client, and server is transmitted unencrypted. An attacker with access to the wire can therefore monitor all transmitted sensitive data.” The issues remain unpatched.
• U.S. Accuses Former Government Contractor of Selling Secrets to Russia — The U.S. Justice Department has unveiled charges against Peter Williams, a former executive of Trenchant, the cyber unit of defense contractor L3Harris, for allegedly stealing trade secrets and selling them to a buyer in Russia for $1.3 million. The court documents allege Williams allegedly stole seven trade secrets from two companies between April 2022 and in or about June 2025, and an additional eighth trade secret between June and August 6, 2025. The names of the companies were not disclosed, nor was any information provided regarding the identity of the buyer. Prosecutors are also seeking to forfeit Williams’ property in Washington, D.C., as well as multiple luxury watches, handbags, and jewelry derived from proceeds traceable to the offense. The charges come as Trenchant is in the midst of investigating a leak of its hacking tools, TechCrunch reported.
• How Threat Actors are Abusing Azure Blob Storage — Microsoft has detailed the various ways threat actors are leveraging Azure Blob Storage, its object data service, at various stages of the attack cycle, owing to its critical role in storing and managing massive amounts of unstructured data. “Threat actors are actively seeking opportunities to compromise environments that host downloadable media or maintain large-scale data repositories, leveraging the flexibility and scale of Blob Storage to target a broad spectrum of organizations,” the company said.

• Vault Viper Shares Links to SE Asian Scam Operations — A custom web browser under the name Universe Browser is being distributed by a “white label” iGaming (aka online gambling) software supplier that has ties to a cluster of cyber-enabled gambling and fraud platforms operated by criminal syndicates based in Cambodia, according to a report from Infoblox. The browser, available for Android, iOS, and Windows, is advertised as “privacy-friendly” and offers the ability to bypass censorship in countries where online gambling is prohibited. In reality, the browser “routes all connections through servers in China and covertly installs several programs that run silently in the background.” While there is no evidence that the program has been used for malicious purposes, it bears all the hallmarks typically associated with a remote access trojan, including keylogging, extracting the user’s current location, launching surreptitious connections, and modifying device network configurations. “Universe Browser has been modified to remove many functionalities that allow users to interact with the pages they visit or inspect what the browser is doing,” the company added. “The right-click settings access and developer tools, for instance, have all been removed, while the browser itself is run with several flags disabling major security features, including sandboxing, and the support of insecure SSL protocols.” The threat actor behind the operation is Baoying Group (寶盈集團) and BBIN, which have been given the moniker Vault Viper. Some aspects of the Universe Browser were previously documented by the UNODC. “While technical analysis is ongoing, preliminary examination reveals that U Browser not only enables involuntary, systematic screenshots to be taken on the infected device but also contains other hidden functionality allowing the software to capture keystrokes and clipboard contents – features consistent with malware evoking remote access trojans and various cryptocurrency and infostealers,” UNODC noted. Baoying Group has maintained a large operational base in the Philippines since 2006, Infoblox said, but conceals the full extent of its activities through an “intricate web of companies and shell structures registered in dozens of countries in Asia, Europe, Latin America, and the Pacific Islands.” The investigation has led to the discovery of no less than 1,000 unique name servers hosting thousands of active websites dedicated to illegal online gambling, including several known to be operated by criminal groups engaged in large-scale cyber-enabled fraud, money laundering, and other crimes.

🎥 Cybersecurity Webinars

🔧 Cybersecurity Tools

• FlareProx — It is a lightweight tool that uses Cloudflare Workers to spin up HTTP proxy endpoints in seconds. It lets you route traffic to any URL while masking your IP through Cloudflare’s global network. Ideal for developers and security teams who need quick IP rotation, API testing, or simple redirection without servers. Supports all HTTP methods and includes a free tier with 100k requests per day.
• Rayhunter — Rayhunter is an open-source tool from the EFF that detects fake cell towers (IMSI catchers or Stingrays) used for phone surveillance. It runs on a cheap Orbic mobile hotspot, monitors cell network traffic, and alerts users when suspicious activity is found—like forced 2G downgrades or unusual ID requests. Simple to install and use, Rayhunter helps journalists, activists, and researchers spot cellular spying in real time.

Disclaimer: These tools are for educational and research use only. They haven’t been fully security-tested and could pose risks if used incorrectly. Review the code before trying them, test only in safe environments, and follow all ethical, legal, and organizational rules.

🔒 Tip of the Week

Validate Dependencies at the Source — Not Just the Package — Developers tend to trust package managers more than they should — and attackers count on it. Every major ecosystem, from npm to PyPI, has been hit by supply-chain attacks using fake packages or hijacked maintainer accounts to slip in hidden malware. Installing from a public registry doesn’t mean you’re getting the same code that’s on GitHub — it just means you’re downloading what someone uploaded.

Real security starts at the source. Use Sigstore Cosign to verify signed images and artifacts, and osv-scanner to check dependencies against vulnerability data from OSV.dev. For npm, add lockfile-lint to restrict downloads to trusted registries and enable audit signatures. Always pin exact versions and include checksum validation for anything fetched remotely.

Whenever possible, host verified dependencies in your own mirror — tools like Verdaccio, Artifactory, or Nexus keep builds from pulling directly from the internet. Integrate these checks into CI/CD so pipelines automatically scan dependencies, verify signatures, and fail if trust breaks.

Bottom line: don’t trust what you can install — trust what you can verify. In today’s supply chain, the real risk isn’t your code — it’s everything your code depends on. Build a clear chain of trust, and you turn that weak link into your strongest defense.

Conclusion

The stories change every week, but the message stays the same: cybersecurity isn’t a one-time task — it’s a habit. Keep your systems updated, question what feels too familiar, and remember: in today’s digital world, trust is something you prove, not assume.