Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

Google Rolls Out Android Developer Verification to Curb Anonymous App Distribution

  Google has formally begun rolling out a comprehensive verification framework for Android developers, a move aimed at tackling the persiste...

All the recent news you need to know
Online
Google Internet IT malware North Korea Online

North Korean Hackers Target Softwares that Support Online Services


Hackers target behind-the-scenes softwares

Hackers associated with North Korea hacked the behind-the-scenes software that operates various online functions to steal login credentials that could trigger cyber operations, according to Google. 

Threat actors hacked Axios, a program that links apps and web services, by installing their malicious software in an update. An expert at Sentinel said that “Every time you load a website, check your bank balance, or open an app on your phone, there’s a good chance Axios is running somewhere in the background making that work.” 

About the compromised software

The malicious software has been removed. But if it were successful, it could carry out data theft and other cyberattacks. The software is open-source, not a proprietary commercial product. This means the code can be openly licensed and changed by the users. 

Experts described the incident as a supply chain attack in which hackers could compromise downstream entities. According to experts, you don’t have to click anything or make a mistake, as the software you trust does it for you. 

Who is responsible?

Google attributed the hack to a group it tracks as UNC1069. In a February report, Google stated that the group has been active since at least 2018 and is well-known for focusing on the banking and cryptocurrency sectors.

According to a statement from John Hultquist, principal analyst for Google's threat intelligence group, "North Korean hackers have deep experience with supply chain attacks, which they primarily use to ⁠steal cryptocurrency."

The U.S. government claims that North Korea uses stolen cryptocurrency to finance its weapons and other initiatives while avoiding sanctions.

Attack tactic

A request for comment was not immediately answered by North Korea's mission to the United Nations.

The hackers created versions of the malware that could infect macOS, Windows, and Linux operating systems, according to an analysis published by cybersecurity ⁠firm Elastic ​Security.

According to Elastic, "the attacker gained a delivery mechanism with potential reach into millions of environments" as a result of the hackers' techniques. The number of times the dangerous program was downloaded was unclear.

Attempts to get in touch with the hackers failed.

Read more »
State Surveillance
Cyber Governance data localization Digital Sovereignty End To End Encryption Messaging Security Network Control Privacy State Surveillance

Russia promotes Max platform as questions grow over user data security


 

Russian daily communication has been disrupted in recent weeks, as familiar digital channels are experiencing problems under mounting regulatory pressure, disrupting the rhythms of everyday communication. 

What appears at first glance to be a technical inconvenience is in fact a deliberate realignment of the country's information ecosystem that has been going on for several years. A domestically developed alternative known as Max has been elevated by authorities in parallel to globally embedded messaging platforms such as WhatsApp and Telegram, while authorities restrict access to these platforms. 

There is no subtlety or incident in the shift. It is an assertive attempt to redefine the boundaries of digital interaction within the state's sphere of influence. Millions of users are directed towards a platform that remains closely aligned with Kremlin interests in terms of architecture and governance.

With Max, introduced in 2025 by VK, the platform becomes much more than just a conventional messaging platform, marking a significant escalation in this strategy. By consolidating communication tools with state-linked utilities, such as access to government services, financial transactions, and the development of a digital identity framework, it provides the functionality of an integrated digital ecosystem.

Despite bearing structural similarities to WeChat, the implementation is in line with Moscow's long-standing pursuit of technological autonomy. Although adoption is a voluntary process, infrastructure incentives and regulatory constraints have combined to create conditions in which disengagement has become increasingly difficult.

A secure and sovereign alternative has been framed by endorsements from Vladimir Putin, reinforcing the policy direction, as noted by internet governance scholar Marielle Wijermars, that has culminated efforts to reconfigure the nation's internet architecture toward tighter state oversight. 

As part of the transition, technical integration and controlled accessibility are being implemented. Max has been pre-installed on numerous domestically sold consumer devices since September, reducing entry barriers while subtly standardizing its presence. 

A number of features are included in the interface, including private messaging, broadcast channels, and user engagement, which minimize friction for new users as it mimics established platforms. However, its differentiation lies in its privileged network status: by being included on Russia's approved "white list," the company ensures uninterrupted connectivity during periodic connectivity restrictions, which authorities attribute to defensive measures against external threats. 

Furthermore, geopolitical considerations also play a role, as initial restrictions on Russian and Belarusian SIM cards have been expanded selectively to a limited group of countries who are considered politically aligned. 

Although the platform has been widely distributed in countries such as the European Union and Ukraine, these markets are notably absent, even as the platform becomes enmeshed in larger information dynamics, including its perceived role as a means of countering rival cross-border coordination applications such as Telegram and WhatsApp. 

Russia itself continues to receive uneven receptions, suggesting an increasing divide between state-driven digital consolidation and a population long accustomed to more open communication systems. As a result of this transition, established communication patterns are disrupted, which has already begun to affect professionals who rely on continuity and reliability as part of their workflows. 

Before routine connectivity began to fail without warning, Marina, a freelance copywriter based in Tula, had been relying on WhatsApp for both client interactions and personal exchanges. There has also been little success in shifting conversations to Telegram, reflecting a broader trend experienced by millions as Roskomnadzor imposed restrictions on voice and messaging functions across the country's most widely used platforms in mid-August. 

There have been concerns about the timing of these limitations, which coincide with the rapid deployment of the state-backed Max ecosystem. With WhatsApp's user base estimated at approximately 97 million, and Telegram's user base estimated at 90 million, this disruption goes far beyond inconvenience, reaching into the foundations of social and economic interaction on a daily basis. 

These platforms have been providing informal digital backbones for many years, facilitating everything from family coordination and residential management groups to hyperlocal commerce in areas lacking conventional internet access. For example, message applications often serve as a substitute for broader digital infrastructure in remote parts of the Russian Far East, enabling services such as ride coordination and small-scale transactions as well as information sharing within the community. 

In addition to implementing end-to-end encryption, both platforms have also implemented security architectures that prevent intermediaries, including service providers, from gaining access to communications' contents. 

Russian authorities assert that the restrictions are justified by compliance failures, particularly the refusal to localize user data within national borders, along with concerns over fraud. Based on available financial sector data, however, most scams remain perpetrated through traditional mobile networks rather than encrypted applications, according to data available to the financial sector. 

Analysts and segments of the public view these measures as part of a broader effort to improve visibility into interpersonal networks and information flows, with a less technical but more strategic interpretation.

According to Marina, who requested anonymity due to concerns about possible consequences, the shift is not simply one of technology, but one of social space narrowing, with the ability to maintain connections outside of state-mediated channels gradually becoming increasingly restricted. 

Through regulatory pressure as well as institutional dependency, Max is being reinforced within everyday workflows. 

To maintain access to essential services, individuals across sectors report a growing requirement for the platform. In her experience, Irina describes being forced to utilize Max to communicate with her children's school communications and navigate the Gosuslugi, where patient appointments are increasingly coordinated. 

Across corporate and educational environments, similar patterns are emerging as employers and schools standardize their internal communication platforms. The public visibility of Max is also increasing as celebrities and digital influencers migrate their content ecosystems to Max, enhancing its normalization, parallel to this structural push. 

According to analysts such as Dmitry Zakharchenko, the campaign has been unusually strong, comparing it to the centrally orchestrated messaging efforts of earlier eras, which has nonetheless been able to accelerate adoption to approximately 100 million users within a short period of time. 

In terms of technical characteristics, the platform represents a broader trajectory of Russia's "sovereign internet" initiative, which prioritizes control over data flows and infrastructure over international interoperability. As opposed to Telegram and WhatsApp, Max does not utilize end-to-end encryption technology, and its data governance framework requires that all user information be stored on domestic servers, thereby making it subject to the jurisdiction of government regulators and security agencies. 

Many users express only a limited level of concern, regarding compliance as inconsequential when there is no perceived risk. However, others have sought alternatives, including IMO, or have refused to adopt Max altogether. However, this resistance appears to be increasingly constrained as Max's structural integration into critical services increases.

Even among skeptics, prevailing sentiment indicates that participation may soon become unavoidable as the country's digital environment narrows toward a state-defined center of gravity. For policymakers, technologists, and civil society observers, Max's trajectory provides a valuable example of how digital sovereignty and user autonomy are evolving in an increasingly dynamic environment. 

By rapidly integrating the platform into essential services, people can see how infrastructure can be a subtly effective tool for shaping behavioral compliance, particularly when alternatives are systematically restricted. As a result, centralized control over communication ecosystems raises further concerns regarding transparency, data governance, and long-term consequences. 

Russia is likely to continue to grapple with a defining tension as they advance this model in order to balance national security objectives with individual privacy rights. This type of system will ultimately be determined by the level of state enforcement as well as the level of trust among users, the resilience of alternative networks, and the worldwide response to fragmented digital environments.
Read more »
Cyber Security
Access control Access Controls Account customer complaints Customer Service Issues Cyber Outage Cyber Security

X Faces Global Outage Twice in Hours, Thousands of Users Report Access Issues

 

Hours apart, fresh disruptions hit X - once called Twitter - as glitches blocked entry for countless people across regions. Though brief, these lapses fuel unease over stability under Musk’s control, following a trail of prior breakdowns just lately. A pattern forms without needing bold claims: service falters too often now. 

Early afternoon saw service disruptions start across the U.S., per Downdetector figures, hitting a high point near 3:50 PM EST with about 25,000 affected individuals. Later that evening, roughly at 8:00 PM EST, another wave emerged - over 6,000 people then faced login difficulties. 

Problems surfaced across multiple areas, according to user feedback. Close to fifty percent struggled just to open the app on their phones. Some saw broken features within the feed or site navigation failing mid-use. Interruptions popped up globally - not confined by borders - hitting people in both UK cities and Indian towns alike. 

Fewer incidents appeared out of India at first, yet the next wave brought a clear rise - more than six hundred alerts came through by dawn. That same split trend showed up elsewhere, too: data from StatusGator backed the idea of two separate waves hitting at different times. 

Even though the problem spread widely, X stayed silent on what triggered it. Still, users asking about glitches got answers from Grok, its built-in chat assistant. A hiccup in systems stopped feeds from refreshing, according to the bot. Pages showed errors instead of content during the episode. Past patterns hint at fast fixes when similar faults occurred. Resolution could come without delay, the machine implied. 

Frustration spread through user communities when services went down unexpectedly. Online spaces filled quickly as people shared what they encountered during the downtime. Some saw pages fail to load halfway; others found nothing loaded at all. Reports pointed to repeated problems over recent weeks, not just isolated moments. 

A pattern emerged - not sudden failure, but lingering instability across visits. Still reeling from another outage, X faces mounting pressure as service disruptions chip away at reliability worldwide. A fresh breakdown underscores persistent weaknesses in its operational backbone. 

With each failure, trust erodes just a bit more among users who depend on steady access. Problems aren’t isolated - they ripple through regions where uptime matters most. Behind the scenes, fixes appear slow, inconsistent, or both. What looked like progress now seems fragile under repeated strain.
Read more »
User Privacy
Data Breach Japanese Firm Mazda Security Breach User Privacy

Mazda Data Breach Exposes Employee, Partner Records

 

Mazda Motor Corporation, a leading Japanese automaker producing over 1.2 million vehicles annually, recently disclosed a significant security breach affecting its internal systems. The incident, detected in mid-December 2025, involved unauthorized access to a warehouse management system handling parts procured from Thailand. While customer data remained untouched, the breach exposed sensitive information from 692 records belonging to employees, group companies, and business partners. 

The attackers exploited unpatched vulnerabilities in the application's software, gaining entry without deploying ransomware or malware, according to Mazda's investigation. Compromised data included user IDs, full names, corporate email addresses, company names, and business partner IDs. Mazda promptly notified Japan's Personal Information Protection Commission and collaborated with external cybersecurity experts to assess the damage. No evidence of data misuse has surfaced, but the company warned of potential phishing risks targeting those affected. 

In response, Mazda implemented robust security enhancements across its IT infrastructure. These measures include applying security patches, limiting internet exposure, enhancing activity monitoring, and enforcing stricter access controls from approved IP ranges. The automaker extended these fixes to similar systems company-wide, demonstrating a proactive approach to preventing recurrence. A spokesperson confirmed no operational disruptions or attacker communications occurred. 

This breach underscores persistent vulnerabilities in supply chain systems, even for global giants like Mazda with $24 billion in revenue. Automotive firms face rising cyber threats, as seen in prior Clop ransomware claims against Mazda entities in 2025, though unrelated to this event. Experts note that simple unpatched flaws can lead to substantial exposures, emphasizing the need for continuous vulnerability management. Mazda's three-month disclosure delay aligned with Japanese regulations requiring thorough probes before public alerts. 

The incident serves as a wake-up call for industries reliant on third-party logistics. Companies must prioritize automated patching, zero-trust access, and regular pentests to safeguard employee data. While Mazda contained the breach effectively, it highlights how targeted social engineering could exploit leaked identifiers. Ongoing vigilance remains essential in an era of sophisticated supply chain attacks.
Read more »
PowerShell
ClickFix Attacks Credentials Stolen DeepLoad malware PowerShell

DeepLoad Malware Found Stealing Browser Data Using ClickFix

 


A contemporary cyber campaign is using a deceptive method known as ClickFix to distribute a previously undocumented malware loader called DeepLoad, raising fresh concerns about newly engineered attack techniques.

Researchers from ReliaQuest report that the malware is designed with advanced evasion capabilities. It likely incorporates AI-assisted obfuscation to make analysis more difficult and relies on process injection to avoid detection by conventional security tools. Alarmingly, the malware begins stealing credentials almost immediately after execution, capturing passwords and active session data even if the initial infection stage is interrupted.

The attack chain starts with a ClickFix lure, where users are misled into copying and executing a PowerShell command via the Windows Run dialog. The instruction is presented as a solution to a problem that does not actually exist. Once executed, the command leverages “mshta.exe,” a legitimate Windows binary, to download and launch a heavily obfuscated PowerShell-based loader.

To conceal its true purpose, the loader’s code is filled with irrelevant and misleading variable assignments. This approach is believed to have been enhanced using artificial intelligence tools to generate complex obfuscation layers that can bypass static analysis systems.

DeepLoad is carefully engineered to blend into normal system behavior. It disguises its payload as “LockAppHost.exe,” a legitimate Windows process responsible for managing the system lock screen, making its activity less suspicious to both users and security tools.

The malware also attempts to erase traces of its execution. It disables PowerShell command history and avoids standard PowerShell functions. Instead, it directly calls underlying Windows system functions to execute processes and manipulate memory, effectively bypassing monitoring mechanisms that track PowerShell activity.

To further evade detection, DeepLoad dynamically creates a secondary malicious component. By using PowerShell’s Add-Type feature, it compiles C# code during runtime, generating a temporary Dynamic Link Library (DLL) file in the system’s Temp directory. Each time the malware runs, this DLL is created with a different name, making it difficult for security solutions to detect based on file signatures.

Another key technique used is asynchronous procedure call (APC) injection. This allows the malware to execute its payload within a legitimate Windows process without writing a fully decoded malicious file to disk. It achieves this by launching a trusted process in a suspended state, injecting malicious code into its memory, and then resuming execution.

DeepLoad’s primary objective is to steal user credentials. It extracts saved passwords from web browsers and deploys a malicious browser extension that intercepts login information as users type it into websites. This extension remains active across sessions unless it is manually removed.

The malware also includes a propagation mechanism. When it detects the connection of removable media such as USB drives, it copies malicious shortcut files onto the device. These files use deceptive names like “ChromeSetup.lnk,” “Firefox Installer.lnk,” and “AnyDesk.lnk” to appear legitimate and trick users into executing them.

Persistence is achieved through Windows Management Instrumentation (WMI). The malware sets up a mechanism that can reinfect a system even after it appears to have been cleaned, typically after a delay of several days. This technique also disrupts standard detection methods by breaking the usual parent-child process relationships that security tools rely on.

Overall, DeepLoad appears to be designed as a multi-functional threat capable of operating across several stages of a cyberattack lifecycle. Its ability to avoid writing clear artifacts to disk, mimic legitimate system processes, and spread across devices makes it particularly difficult to detect and contain.

The exact timeline of when DeepLoad began appearing in real-world attacks and the overall scale of its use remain unclear. However, researchers describe it as a relatively new threat, and its use of ClickFix suggests it could spread more widely in the near future. There are also indications that its infrastructure may resemble a shared or service-based model, although it has not been confirmed whether it is being offered as malware-as-a-service.

In a separate but related finding, researchers from G DATA have identified another malware loader called Kiss Loader. This threat is distributed through phishing emails containing Windows Internet Shortcut files. When opened, these files connect to a remote WebDAV server hosted on a TryCloudflare domain and download another shortcut that appears to be a PDF document.

When executed, the downloaded file triggers a chain of scripts. It starts with a Windows Script Host process that runs JavaScript, which then retrieves and executes a batch script. This script displays a decoy PDF to avoid suspicion, establishes persistence by adding itself to the system’s Startup folder, and downloads the Python-based Kiss Loader.

In its final stage, Kiss Loader decrypts and executes Venom RAT, a remote access trojan, using APC injection. The extent of this campaign is currently unknown, and it is not clear whether the malware is part of a broader malware-as-a-service offering. The threat actor behind the operation has claimed to be based in Malawi, although this has not been independently verified.

Cyber threats are taking new shapes every day. Attackers are increasingly combining social engineering, fileless execution techniques, and advanced obfuscation to bypass traditional defenses. This evolution highlights the growing need for continuous monitoring, stronger endpoint protection, and improved user awareness to defend against increasingly sophisticated attacks.

Read more »
GDPR obligations
Compliance Compliance Management Customer Trust Cyber Security GDPR GDPR Breach GDPR compliance GDPR obligations

Delve Faces Allegations of Fake Compliance Reports and Security Gaps Amid Customer Backlash

 

A whistleblower-style article on Substack has thrust Delve into scrutiny, alleging it misrepresented its alignment with key privacy frameworks like GDPR and HIPAA. Though unverified, the claims suggest numerous clients were led to believe they met regulatory requirements when they might not have. With little public response so far, questions grow over how thoroughly those assurances were vetted before being offered. 

Some affected firms could now face fines or lawsuits due to reliance on Delve’s stated compliance. Details remain sparse, yet the situation highlights vulnerabilities in trusting third-party validation without deeper checks. A report surfaced online, attributed to someone using the name “DeepDelver,” said to have ties to one of the firm’s past clients. Following claims of a security lapse exposing private documents, unease started spreading among users. 

While executives at Delve stated there was no external breach of information, trust started fraying regardless. Questions about stability emerged even though official statements downplayed risk. Some say Delve speeds up compliance using methods that stretch credibility - like creating fake board minutes, false test results, or made-up operational records. Reports appear ready long before audits begin, prepared ahead of time without clear verification. 

A small circle of auditing partners handles most reviews, which invites questions. Close ties between these firms and Delve blur lines. Oversight might be weaker than it should be. Doubts grow when proof of activity emerges only after approval deadlines pass. What stands out is how clients reportedly faced pressure to use ready-made documents instead of carrying out their own compliance checks. 

It turns out the platform might have displayed public trust pages outlining security measures that weren’t entirely in place, leaving regulators and others possibly misinformed. Delve hit back hard at the allegations, labeling the document “misleading” while pointing out factual errors. What followed was a clear distinction: certification isn’t something they deliver. Their role? Streamlining compliance information through automated systems. Independent auditors - licensed professionals - not Delve sign off on final evaluations. 

These third parties alone hold responsibility for approved documentation. Organization of data is their core function, nothing more. Not long ago, Delve dismissed accusations about fabricated proof, explaining it offers uniform templates so users can record procedures - much like peers across the sector. Clients decide independently whether to pick external auditors or go with those linked to its ecosystem. Still, the unnamed informant insisted several issues linger - audit independence, how data is secured. 

Yet more allegations emerged; outside analysts pointed to weak spots in Delve’s setup, adding pressure. Scrutiny grows. With every new development, questions about reliability begin to surface more clearly. Though designed to assist, these systems now face scrutiny over openness and responsibility. Where once efficiency was praised, doubt has started to take hold instead.
Read more »
Subscribe to: Comments (Atom)

Featured