Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

Cybersecurity Falls Behind as Threat Scale Outpaces Capabilities

Cyber defence is entering its 2026 year with the balance of advantage increasingly being determined by speed rather than sophistication. Wit...

All the recent news you need to know
Malwares
Cyber Security GootLoader Malicious Codes Malicious Files Malware attacks Malwares

GootLoader Malware Uses Malformed ZIP Archives to Evade Detection

 

A fresh tactic has emerged among cybercriminals using GootLoader, a JavaScript-driven malware installer. Instead of standard compression, they now distribute broken ZIP files designed to slip past digital defenses. These flawed archives exploit differences across decompression programs - some fail to process them, others do so partially. This mismatch lets malicious code stay concealed during scans yet run normally when opened by users. Findings detailed by Expel show that inconsistent parsing logic in software plays right into attacker hands. Hidden scripts activate only when handled by specific tools found on typical machines. 

Starting with a strange structure, these harmful ZIP files combine around 500 to 1,000 smaller archives into one large package. Because of this layered setup, standard programs like WinRAR or 7-Zip cannot properly read them - tools often relied on during malware checks. Due to the confusion they create, automatic detection systems frequently skip examining what's inside. Yet, when opened through Windows’ own built-in decompression feature, the file works without issue. 

That smooth operation lets victims unknowingly unpack dangerous content. Since 2020, GootLoader has maintained a presence among cyber threats, primarily spreading via manipulated search results and deceptive online ads. People looking for official forms or corporate paperwork may unknowingly land on hacked WordPress sites offering infected files. These corrupted archives, once opened, trigger the payload delivery mechanism embedded within the software. Acting as a gateway tool, it paves the way for additional harmful programs - ransomware being one frequent outcome. 

The chain of infection begins quietly, escalating quickly under the radar. By late 2025, Expel researchers noticed subtle upgrades, showing how the attack method keeps shifting. Instead of just stacking archives, hackers shorten key metadata inside ZIP structures - especially tampering with the end of central directory entries. That tweak triggers failures in numerous analysis programs, yet files still open in Windows Explorer. 

Inside the package, unimportant sections get scrambled too, throwing off predictable reading patterns and making automated inspection harder. Researchers refer to this method as "hashbusting," delivering a distinct ZIP file to each target. Every time someone downloads it, differences in the archive's layout and data prevent standard hash checks from working. Even the JavaScript inside changes form with each instance. Detection systems relying on repeated patterns struggle as a result. 

 What makes the delivery hard to catch lies in its method. Rather than sending a typical ZIP archive, attackers transmit the malicious code as an XOR-encrypted flow of data, rebuilt only after reaching the target's browser. It grows by adding copies of itself over and over, expanding until it meets a specific volume - this skirts detection meant for compressed files. After launch, the script runs using built-in Windows tools, skipping any need to unpack completely, so the attack unfolds without drawing attention. 

Once active, it stays on the machine by placing shortcuts into the Windows Startup directory - then triggers further scripts through native utilities like cscript or PowerShell. From there, data collection begins: details about the system get pulled and sent back to distant servers that control the attack, setting up what comes next without delay. 

Although often overlooked, limiting access to built-in tools such as wscript.exe helps block common attack paths. Instead of running scripts automatically, setting systems to display code in basic viewers adds another layer of protection. As seen with GootLoader’s shifts over time, attackers now twist everyday OS functions into stealthy weapons, staying active even when defenses improve.
Read more »
phishing attack Canada
Canada investment regulator CIRO Cybersecurity Incident Data Breach investor data breach phishing attack Canada

CIRO Discloses Phishing Breach Impacting Personal Data of 750,000 Individuals

 

The Canadian Investment Regulatory Organization (CIRO) serves as the country’s national self-regulatory authority for investment dealers and marketplaces, with responsibilities that include investor protection, regulatory enforcement, and ensuring the integrity and efficiency of Canada’s capital markets.

CIRO has disclosed that a phishing attack in August 2025 led to the unauthorized access and theft of personal information belonging to approximately 750,000 individuals. While the incident required certain systems to be taken offline as a precaution, the organization confirmed that its core operations remained unaffected.

According to CIRO, the security incident was swiftly contained, and investigations found no evidence of an ongoing threat. The compromised data primarily related to member firms and registered employees, along with some investor and investigative records.

The organization detected the cyber intrusion in August 2025 and acted promptly to limit its impact. CIRO informed law enforcement and relevant regulatory authorities and engaged external cybersecurity specialists to conduct a detailed forensic investigation. Findings revealed that only a restricted portion of investigative, compliance, and investor-related data had been copied.

“In August 2025, CIRO identified a cybersecurity incident. We took immediate steps to contain the incident, secure our systems and protect the information in our care. We notified law enforcement and all relevant authorities including privacy commissions across Canada.” reads the FAQ page published by CIRO. “Once contained, we retained a leading third-party forensic IT investigator to determine what information was impacted. After more than 9,000 hours of review, that investigation determined that a limited subset of investigative, compliance and market surveillance data, including some of investor information, was copied from our system.”

CIRO explained that the exposed information included sensitive personal and financial details such as income data, identification documents, contact information, account numbers, and financial statements gathered during regulatory and investigative processes. The organization emphasized that no passwords or PINs were compromised and stated that it has not identified any misuse of the data or signs of it appearing on the dark web.

“CIRO received this information in the normal course of carrying out its regulatory mandate to protect investors from improper investment conduct and practices, and through its investigative, compliance assessment and market regulation work,” the organization says. “CIRO will delete investor information when no longer required for its investigative, compliance assessment and market surveillance work, however we are unable to process individual deletion requests.”

As a precautionary measure, CIRO continues to monitor for any suspicious activity and has offered affected individuals two years of complimentary credit monitoring and identity theft protection services.
Read more »
User Security
Browser Extension GhostPoster LayerX malware User Security

GhostPoster Malware Campaign Exposes Browser Extension Risks

 

A stealthy malware operation has been discovered by cybersecurity researchers, which remained undetected for a period of up to five years and accumulated more than 840,000 downloads on various platforms. The research began with a study by Koi Security of a Firefox browser extension called GhostPoster, which embedded its malicious code in a seemingly innocuous PNG image file. Such a trick allowed the malware to evade static analysis and manual reviews by browser markets. 

Based on the findings of Koi Security, the LayerX researchers decided to dig deeper into the infrastructure and discovered 17 more extensions that used the same backend infrastructure and had the same tactics, techniques, and procedures (TTPs). In total, these extensions had more than 840,000 downloads, with some of them remaining undetected on the users' devices for almost five years. LayerX researchers also discovered a more complex variant of the malware that used other evasion techniques and had 3,822 downloads on its own. 

The operation emanates from Microsoft Edge and then methodically moves to chrome and Firefox, which looks like the work of a patient, evolving threat actor that is focused on stealth and trust-building. The extensions used to mimic legitimate functionality at first, avoiding suspicion, while the infrastructure was in place after many years. This stress test mentality highlights how cybercriminals abuse browser extensions as a low-friction vector to compromise user security without raising alarms in the short term. 

Following the revelations, Mozilla and Microsoft immediately removed the offending extensions from their official stores, preventing further downloads. However, this removal does nothing to those copies already installed on users browsers, meaning millions might be left vulnerable to potential attacks unless they take action. LayerX’s blog stressed that users need to take an active role in mitigating ongoing risk by reviewing for and deleting the extensions. 

Browser extensions have become a lucrative target for cybercriminals as hackers exploit the deep access these extensions have to browsing data and permissions, raising the stakes for vigilance in the evolving threat landscape. Users are advised to regularly review the installed add-ons' permissions, disable the ones they don't use or need, and remove the ones they don't trust. This is a warning that even extensions or add-ons that have been trusted for a long time can potentially contain malicious code, and it effectively calls for those using any major browser to adopt a more proactive approach to security.
Read more »
URL
Artificial Intelligence Cyber Security Data Exfiltration Microsoft Copilot Reprompt URL

Security Researchers Warn of ‘Reprompt’ Flaw That Turns AI Assistants Into Silent Data Leaks

 



Cybersecurity researchers have revealed a newly identified attack technique that shows how artificial intelligence chatbots can be manipulated to leak sensitive information with minimal user involvement. The method, known as Reprompt, demonstrates how attackers could extract data from AI assistants such as Microsoft Copilot through a single click on a legitimate-looking link, while bypassing standard enterprise security protections.

According to researchers, the attack requires no malicious software, plugins, or continued interaction. Once a user clicks the link, the attacker can retain control of the chatbot session even if the chat window is closed, allowing information to be quietly transmitted without the user’s awareness.

The issue was disclosed responsibly, and Microsoft has since addressed the vulnerability. The company confirmed that enterprise users of Microsoft 365 Copilot are not affected.

At a technical level, Reprompt relies on a chain of design weaknesses. Attackers first embed instructions into a Copilot web link using a standard query parameter. These instructions are crafted to bypass safeguards that are designed to prevent direct data exposure by exploiting the fact that certain protections apply only to the initial request. From there, the attacker can trigger a continuous exchange between Copilot and an external server, enabling hidden and ongoing data extraction.

In a realistic scenario, a target might receive an email containing what appears to be a legitimate Copilot link. Clicking it would cause Copilot to execute instructions embedded in the URL. The attacker could then repeatedly issue follow-up commands remotely, prompting the chatbot to summarize recently accessed files, infer personal details, or reveal contextual information. Because these later instructions are delivered dynamically, it becomes difficult to determine what data is being accessed by examining the original prompt alone.

Researchers note that this effectively turns Copilot into an invisible channel for data exfiltration, without requiring user-entered prompts, extensions, or system connectors. The underlying issue reflects a broader limitation in large language models: their inability to reliably distinguish between trusted user instructions and commands embedded in untrusted data, enabling indirect prompt injection attacks.

The Reprompt disclosure coincides with the identification of multiple other techniques targeting AI-powered tools. Some attacks exploit chatbot connections to third-party applications, enabling zero-interaction data leaks or long-term persistence by injecting instructions into AI memory. Others abuse confirmation prompts, turning human oversight mechanisms into attack vectors, particularly in development environments.

Researchers have also shown how hidden instructions can be planted in shared documents, calendar invites, or emails to extract corporate data, and how AI browsers can be manipulated to bypass built-in prompt injection defenses. Beyond software, hardware-level risks have been identified, where attackers with server access may infer sensitive information by observing timing patterns in machine learning accelerators.

Additional findings include abuses of trusted AI communication protocols to drain computing resources, trigger hidden tool actions, or inject persistent behavior, as well as spreadsheet-based attacks that generate unsafe formulas capable of exporting user data. In some cases, attackers could manipulate AI development platforms to alter spending controls or leak access credentials, enabling stealthy financial abuse.

Taken together, the research underlines that prompt injection remains a persistent and evolving risk. Experts recommend layered security defenses, limiting AI privileges, and restricting access to sensitive systems. Users are also advised to avoid clicking unsolicited AI-related links and to be cautious about sharing personal or confidential information in chatbot conversations.

As AI systems gain broader access to corporate data and greater autonomy, researchers warn that the potential impact of a single vulnerability increases substantially, underscoring the need for careful deployment, continuous monitoring, and ongoing security research.


Read more »
Malicious Codes
AWS AWS Hijacking Cyber Attacks Cyber flaws cybersecurity risks GitHub Hacker attack Malicious Codes

AWS CodeBuild Misconfiguration Could Have Enabled Full GitHub Repository Takeover

 

One mistake in how Amazon Web Services set up its CodeBuild tool might have let hackers grab control of official AWS GitHub accounts. That access could spill into more parts of AWS, opening doors for wide-reaching attacks on software supplies. Cloud security team Wiz found the weak spot and called it CodeBreach. They told AWS about it on August 25, 2025. Fixes arrived by September that year. Experts say key pieces inside AWS were at stake - like the popular JavaScript SDK developers rely on every day. 

Into trusted repositories, attackers might have slipped harmful code thanks to CodeBreach, said Wiz team members Yuval Avrahami and Nir Ohfeld. If exploited, many apps using AWS SDKs could face consequences - possibly even disruptions in how the AWS Console functions or risks within user setups. Not a bug inside CodeBuild caused this, but gaps found deeper in automated build processes. These weak spots lived where tools merge and deploy code automatically. 

Something went wrong because the webhook filters had been set up incorrectly. They’re supposed to decide which GitHub actions get permission to start CodeBuild tasks. Only certain people or selected branches should be allowed through, keeping unsafe code changes out of high-access areas. But in a few open-source projects run by AWS, the rules meant to check user IDs didn’t work right. The patterns written to match those users failed at their job. 

Notably, some repositories used regex patterns missing boundary markers at beginning or end, leading to incomplete matches rather than full validation. This gap meant a GitHub user identifier only needed to include an authorized maintainer's number within a larger sequence to slip through. Because GitHub hands out IDs in order, those at Wiz showed how likely it became for upcoming identifiers to accidentally align with known legitimate ones. 

Ahead of any manual effort, bots made it possible to spam GitHub App setups nonstop. One after another, these fake apps rolled out - just waiting for a specific ID pattern to slip through broken checks. When the right match appeared, everything changed quietly. A hidden workflow fired up inside CodeBuild, pulled from what should have stayed locked down. Secrets spilled into logs nobody monitored closely. For aws-sdk-js-v3, that leak handed total control away - tied straight to a powerful token meant to stay private. If hackers gained that much control, they might slip harmful code into secure branches without warning. 

Malicious changes could get approved through rigged pull requests, while hidden data stored in the repo gets quietly pulled out. Once inside, corrupted updates might travel unnoticed through trusted AWS libraries to users relying on them. AWS eventually confirmed some repos lacked tight webhook checks. Still, they noted only certain setups were exposed. 

Now fixed, Amazon says it adjusted those flawed settings. Exposed keys were swapped out, safeguards tightened around building software. Evidence shows CodeBreach wasn’t used by attackers, the firm added. Yet specialists warn - small gaps in automated pipelines might lead to big problems down the line. Now worries grow around CI/CD safety, a new report adds fuel. 

Lately, studies have revealed that poorly set up GitHub Actions might spill sensitive tokens. This mistake lets hackers gain higher permissions in large open-source efforts. What we’re seeing shows tighter checks matter. Running on minimal needed access helps too. How unknown data is processed in builds turns out to be critical. Each step shapes whether systems stay secure.
Read more »
supply chain security
Cybersecurity Education Cybersecurity Workforce Data Breach Data Breaches Digital Espionage Emerging Market Cyber Risks global cybercrime ransomware attacks Regulatory Cyber Frameworks supply chain security

Surge in Cybercrime Undermines Online Safety Efforts


 

With data breaches, ransomware incidents, and state-sponsored digital espionage increasingly dominating global headlines, cybersecurity has become a strategic priority for governments and corporations alike, moving from a back-office concern to a front-line concern. 

A widening gap between risk and readiness is visible in almost all industries due to the rapid acceleration of the threat landscape. This has resulted in a global demand for qualified cybersecurity professionals. 

Among the findings of the 2024 ISC2 Cybersecurity Workforce Study, which underscores the magnitude of the problem, is the finding that the shortage has now exceeded four million cybersecurity professionals worldwide, and it is only expected to increase. 

Currently, this imbalance is affecting both job seekers and career changers, reshaping the workforce and positioning cybersecurity as a field of unparalleled resilience and opportunity in the digital economy. In a world where skilled personnel are scarce, but essential to safeguarding critical infrastructure and sensitive data worldwide, cybersecurity has become one of the most valuable and resilient fields. 

The concept of cybercrime, which consists of criminal activity that targets or exploits computers, networks, or connected devices, has evolved into a complex and globally networked threat ecosystem. 

Cybercriminals continue to be motivated primarily by financial gain, but they are also influenced by political, ideological, or personal goals, such as espionage and disruption, which contributes to the increase in cybercrime attacks. 

There are many kinds of threat actors, from loosely organized novice hackers to highly coordinated criminal syndicates with sophisticated tools and techniques. In emerging economies, internet penetration has steadily increased.

As a result, regions like Africa have become increasingly the testing ground for new cyberattack techniques as they have deepened across emerging economies. GI-TOC (Global Initiative Against Transnational Organized Crime) published a report that revealed that cybercrime has been rising steadily over the African continent in recent years, with Kenya, Nigeria, and South Africa, which is among the most digitally connected countries in sub-Saharan Africa, facing a constant attack from cybercriminals.

There is evidence that malicious actors are testing new strains of ransomware and cyber-based attacks in these environments before they are deployed elsewhere, underscoring the global nature and adaptiveness of the threat. However, India is faced with a parallel challenge that is shaped by its digital transformation on a scale and at a pace that cannot be matched. 

With the advent of online banking, e-commerce, government platforms, and mobile services, the country has seen a surge in cybercrime, affecting individuals and businesses alike. This is a result of the ongoing implementation of technology in everyday life. 

According to official data released by the National Cyber Reporting Platform in 2024, over 1.7 million complaints about cybercrime were filed, an increase of more than 10 percent from last year. This is a result of a growing awareness of cybercrime and an increase in attacks. 

It has been found that a significant proportion of these incidents were linked to transnational cybercrime hubs located in Southeast Asia. Thus, it highlights the limitations of purely domestic defenses against cybercrime. Several reports, such as PwC's Global Digital Trust Insights for India for 2025, rank cyber and digital risks among the top concerns for corporate leaders across the country. 

Cyber and digital risks have also been ranked high in the assessment as prevalent concerns among Indian businesses. In addition to this, security researchers report that Indian websites receive millions of malicious requests every year, while attackers are increasingly targeting mobile applications and potentially exposed APIs, pointing to a strategic shift to disrupt connected and consumer-facing digital services and networks as a result. 

As cybercrime becomes more sophisticated and sophisticated across Africa, structural weaknesses in law enforcement and regulatory capacity are compounding this problem, so there is an increasingly uneven playing field between the states and the sophisticated criminal networks that are well funded. 

GI-TOC analysts noted that a number of law enforcement agencies in the continent lack advanced digital forensics capabilities, secure evidence storage systems, and real-time network monitoring technologies, as well as advanced digital forensics capabilities. 

These limitations have a significant impact on the ability of law enforcement agencies to investigate cybercriminal activities and dismantle transnational cybercriminals in a timely manner. 

Due to this capability gap, attackers have enhanced their techniques by targeting vulnerable government institutions and businesses in critical sectors such as finance, energy, and manufacturing, so that they can then export these techniques to jurisdictions with strengthened defenses. 

It is generally believed that ransomware and distributed denial-of-service attacks remain some of the most prevalent ways for hackers to disrupt economic and social systems, causing severe economic and social disruption. In terms of the financial toll, cyber incidents have cost African economies billions of dollars each year, and are causing a great deal of damage. 

As a result of high-profile attacks, Ghana's national power distribution system has been disrupted, health and statistical agencies in Nigeria and South Africa have been compromised, sensitive customer data has been exposed in Namibia, and the Ugandan central bank has sustained considerable losses. 

The incidents underscore the fragmentation of regulations, underdeveloped infrastructure, and lack of policy coordination that have made some parts of the African continent a hub of illicit activity. This includes the large-scale online fraud and the digitally enabled transnational crimes that are taking place there. 

The GI-TOC estimates that in 2025, cybercrime would account for nearly one-third of reported criminal activity in West and East Africa, totaling approximately $3 billion in lost revenue and reputational damages, figures which, the organization warns may be understated due to systemic transparency gaps. 

Cybercrime has emerged as one of the biggest vulnerabilities in the cybersecurity industry against this backdrop, and the shortage of cybersecurity professionals has become an even more critical concern. 

A well-structured cybersecurity education has become a cornerstone of resilience, giving individuals the technical skills to identify weaknesses in systems, respond to evolving threats, and maintain ethical and regulatory standards as well as enabling them to identify system weaknesses. 

It is now possible to take courses ranging from foundational courses covering networks, operating systems, to advanced, role-specific courses in cloud security, application protection, and governance, risk, and compliance, among others. 

It is becoming increasingly important for national security and economic stability to develop a skilled, well-trained workforce in order to combat cyber threats that are becoming more complex and interconnected. 

In addition to deploying technical defenses themselves, a single cyber incident can result in severe consequences, which extend well beyond the financial losses caused by the incident, ranging from data breaches to malware infections to ransomware attacks. 

Based on the findings of the Hiscox Cyber Readiness Report 2024, there are a large number of businesses that have suffered a cyberattack over the past year. More than two-thirds of them report that they have experienced a rise in cyberattacks since the previous 12-month period, while half also report that they have experienced a rise in incidents during that period. 

It is often difficult for organizations to attract new customers and retain existing clients due to a long-term fallout. Many organizations reported experiencing erosion of existing client relationships, and sustained reputational damage due to negative publicity. 

There are many aspects of these attacks that are not limited to businesses, but also individuals caught in them, who may face identity theft, direct financial loss, and a loss of trust in digital systems as a result. 

The emergence of remote work and hybrid work models has made small and medium-sized enterprises or SME's particularly attractive targets, especially due to the greater digital attack surfaces they offer and the increase in security resources they already have. 

There have been a significant number of high-profile incidents involving widely used service providers and their trusted third-party vendors, highlighting the fact that cybercriminals are increasingly exploiting supply chain vulnerabilities to compromise multiple organizations simultaneously. As reported by a number of industry experts, SMEs are often unable to cope with the financial and operational shocks resulting from a successful cyberattack. 

In fact, a substantial number are indicating that they may have to suspend operations if such an event occurs. In response to the escalating threat environment, governments and international bodies have increased their efforts to coordinate and regulate.

A growing number of law enforcement agencies across borders are collaborating more closely with one another, while new legislative frameworks, including strengthened European network security directives and global cybercrime conventions, are bringing greater accountability to organizations regarding the safeguarding and strengthening of information, and the timely disclosure of breaches as part of a broad effort to reduce cybercrime's economic and social costs.

The combination of all of these developments suggests that the world is entering a turning point in its digital economy, where cybersecurity is no longer just a niche function, but has become a fundamental element needed for sustained growth and public trust. 

Despite the fact that cyber threats continue to transcend borders, sectors, and technologies, the effective governance and response to future cyber threats will be dependent on ensuring that strong policy frameworks are in place, cross-border cooperation is encouraged, and sustained investments in human capital are made. 

Cybersecurity education and reskilling programs can help to create inclusive economic opportunities as well as close workforce gaps, particularly in regions that are most vulnerable to digital threats. 

While organizations need to move beyond reactive security models in order to remain compliant with the threat landscape, they should also make sure they build cyber resilience into their business strategies, supply chain governance practices, and technology designs from the very beginning. 

Having clear accountability, regular risk assessments, and transparent incident reporting can further strengthen collective defenses. 

In the end, as digital systems become more intertwined with daily life and critical infrastructure, it is imperative to create a cybersecurity ecosystem that is resilient so that not only financial and operational losses can be minimized, but confidence in the digital transformation that is shaping economies globally will also be reinforced.
Read more »
Subscribe to: Comments (Atom)

Featured