Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Malware Attack
Cyber Attacks Cyber Phishing Cyber websites Cybersecurity Platform Fraudulent Message Freelancers Malicious Content Malware Attack

Russian National Charged Over Malware Campaign Targeting 80,000 Freelancers

 


A Russian national has been extradited to the United States to face federal charges over an alleged malware campaign that targeted approximately 80,000 users of a freelance employment platform.

Searzhudin Tamirlanovich Aktulaev, 40, is accused of using hundreds of fraudulent accounts to distribute malicious Microsoft Excel attachments between June 2016 and November 2017. Prosecutors allege that the attachments downloaded remote-access malware capable of controlling victims’ computers and stealing information.

The indictment was filed under seal on June 1, 2021. Aktulaev was arrested in Cyprus in May 2025 and extradited to the United States on August 28, 2026, according to the US Department of Justice.

He appeared in federal court in San Francisco on August 31 and was remanded to federal custody. The indictment was unsealed the same day.

Fake Freelance Accounts Distributed Malicious Excel Files

According to prosecutors, Aktulaev and his alleged co-conspirators exploited the messaging system of a well-known freelance employment technology company located in California’s Northern District.

The DOJ did not publicly identify the company.

The conspirators allegedly created approximately 255 fake user accounts and used them to send messages containing malicious Excel attachments to around 80,000 freelancers.

Opening an attachment prompted the recipient to enable or execute an embedded macro. If the user complied, the macro downloaded malware from the internet.

This distinction is important: the indictment alleges that malware was distributed to approximately 80,000 users, but the DOJ announcement does not establish that every recipient opened the attachment or became infected.

Freelancers can be particularly exposed to attachment-based attacks because their work routinely involves receiving documents from unfamiliar prospective clients. A spreadsheet presented as a project brief, financial record or work assignment may therefore appear consistent with an ordinary business request.

TVRAT and DarkVNC Provided Remote Access

The indictment identifies two malware families allegedly used in the campaign: TVRAT and DarkVNC.

TVRAT, also known as TVSPY or TeamSpy, incorporated or abused components associated with TeamViewer, a legitimate remote-administration product. DarkVNC provided similar hidden remote-control capabilities using Virtual Network Computing technology.

Prosecutors allege that the malware allowed the conspirators to control infected computers and transfer stolen data to command-and-control servers.

The use of recognizable remote-access components can help criminals disguise malicious activity as legitimate administrative traffic. It can also make detection more difficult when organizations permit remote-support products in their environments.

The allegations do not indicate that TeamViewer or VNC Viewer participated in the operation. The case concerns malware that allegedly misused remote-administration technology.

Thousands of Computers Connected to US-Based Infrastructure

Court allegations state that domains supporting the command-and-control infrastructure were purchased using virtual currency. At least one command-and-control domain was hosted in the United States, and thousands of computers infected with TVRAT reportedly connected back to it.

Investigators discovered a database on the command-and-control infrastructure containing information associated with thousands of victims.

The DOJ also said a shared document stored in an email account used during the alleged criminal activity contained e-commerce login credentials and personally identifiable information belonging to hundreds of people.

Prosecutors allege that information stolen through TVRAT and DarkVNC was collected from the command-and-control servers and used by Aktulaev and his co-conspirators to conduct fraud and other criminal activity.

Approximately half of the identified victims were located in the United States. The DOJ said many—not all—of those US victims were in the Northern District of California, where the federal case is being prosecuted.

Aktulaev Faces Multiple Federal Charges

The indictment charges Aktulaev with conspiracy, aggravated identity theft and transmitting code or commands that caused damage to protected computers. It also includes allegations involving wire fraud, unauthorized computer access and obtaining information or value from compromised systems.

The most serious listed offense, conspiracy to commit wire fraud, carries a maximum potential sentence of 20 years in prison. A charge involving intentional damage to protected computers carries a maximum of 10 years, while aggravated identity theft can result in a mandatory consecutive two-year sentence for each conviction.

These are maximum statutory penalties rather than a predicted sentence. Any punishment would depend on which charges, if any, result in conviction and the federal court’s consideration of applicable sentencing rules.

Aktulaev is scheduled to appear before US District Judge Donato on October 5, 2026, for a status conference.

The FBI investigated the case, which is being prosecuted by the National Security, Cyber, and Special Prosecutions Section of the US Attorney’s Office for the Northern District of California. The Justice Department’s Office of International Affairs secured the extradition from Cyprus.

The Campaign Predates Aktulaev’s Arrest

The alleged campaign operated from 2016 to 2017. The indictment was filed in 2021, approximately four years after the campaign ended—not four years after Aktulaev’s arrest.

Aktulaev was arrested in Cyprus in May 2025 and extradited more than a year later. The DOJ has not explained why the indictment remained under seal or provided details about the extradition proceedings.

Because the case is at the indictment stage, all described conduct remains an allegation. Aktulaev is presumed innocent unless prosecutors prove the charges beyond a reasonable doubt.

Read more »
Sality Botnet
Botnet Disruption Botnet Takedown Cyber Attacks CyberCrime Cybersecurity malware P2P Botnet Sality Botnet

Sality Botnet Disrupted as Authorities Seize Key Infrastructure


An international public-private operation has disrupted Sality, a peer-to-peer botnet that remained active for more than two decades, by seizing domains and redirecting infected computers away from infrastructure controlled by its operator.

The coordinated action took place on August 31, 2026, and involved authorities in the United States, Bulgaria, Hungary and Romania. CrowdStrike and the Shadowserver Foundation provided technical assistance, while Europol and Eurojust supported the international coordination.

According to the US Department of Justice, the DOJ, FBI and the Defense Criminal Investigative Service seized Sality-linked domains in the United States. European authorities took action against additional domains hosted in Bulgaria, Hungary and Romania.

CrowdStrike’s Counter Adversary Operations team simultaneously carried out a peer-to-peer sinkholing operation designed to separate infected computers from the botnet’s operator.

The action disabled Sality’s current command channel, but it did not automatically remove malware from compromised computers.

Sality Remained Active for More Than Two Decades

First observed in 2003, Sality began as a polymorphic file-infecting malware family. It attached malicious code to executable files and could spread through network shares, removable drives and file-sharing systems.

Sality eventually developed into a decentralized botnet in which infected computers communicated directly with one another. Unlike a conventional botnet with one central command-and-control server, Sality’s peer-to-peer architecture did not present investigators with a single server that could be seized to disable the entire operation.

CrowdStrike said two incompatible Sality networks, known as versions 3 and 4, remained active until the disruption. Although they used the same underlying codebase and were operated by the same threat actor, the networks used different protocol versions and cryptographic keys.

The botnet’s main function was to deliver additional malicious software. During its long history, Sality distributed malware associated with credential theft, spam, proxy services, network exploitation and distributed denial-of-service attacks.

For approximately the past eight years, CrowdStrike said its primary payload was EggJagger, a clipboard-hijacking tool that monitored devices for copied cryptocurrency wallet addresses. When it detected a Bitcoin or Ethereum address, the malware replaced it with an address controlled by the attacker.

CrowdStrike estimates that at least $150,000 in cryptocurrency was stolen through EggJagger, although other malware distributed through Sality may have produced additional criminal revenue.

How Large Was the Sality Botnet?

CrowdStrike’s technical account of the disruption states that Sality enabled its operator to distribute malicious payloads to more than 33,000 infected computers worldwide at the time of the operation.

Historical figures are considerably larger. Europol reported that Sality provided access to as many as one million infected machines at its peak. More than 11 million unique IP addresses have been connected to its infrastructure over its lifetime.

The 11 million figure should not be interpreted as the number of simultaneously infected devices. Individual machines can use different IP addresses over time, and the total covers years of recorded activity.

Europol has supported Sality-related investigations since 2017. The agency said international partners held weekly operational calls in the weeks before the latest action to coordinate infrastructure seizures and the technical disruption.

How the Sinkhole Operation Worked

The operation targeted the peer lists that Sality-infected computers used to locate other machines in the botnet.

Each infected computer maintained a limited list of publicly reachable “super peers,” which formed the backbone of the P2P network. Approximately every 40 minutes, the malware checked whether those peers remained available. Responsive peers gained reputation, while unresponsive entries were gradually removed.

CrowdStrike found that the Sality protocol did not authenticate computers joining the network. Any publicly reachable system that completed the required handshake could be accepted as a legitimate peer.

Defenders used this weakness to manipulate the botnet’s peer lists. Legitimate Sality peers were invalidated and replaced with sinkhole nodes operated by CrowdStrike. As the process continued, infected computers lost contact with the criminal network and began communicating with defender-controlled infrastructure instead.

Computers located behind firewalls or network address translation could not always be contacted directly. However, when those devices initiated their routine communications with a sinkhole, their peer lists could also be purged, isolating them from the operator.

Authorities and industry partners also acted against websites hosting Sality’s payloads. Taking those locations offline prevented infected computers with older download instructions from retrieving additional malware during the transition.

Who Operated Sality?

CrowdStrike tracks the criminal actor associated with Sality as SALTY SPIDER. The company assesses that the group likely operates from Russia’s Republic of Bashkortostan, near the border with Kazakhstan.

This remains a company attribution rather than a publicly established legal finding. The DOJ and Europol announcements did not identify an individual operator, announce an arrest or disclose criminal charges connected to the disruption.

Infected Computers Still Require Remediation

Although the operator has lost the ability to issue new instructions through the disrupted network, Sality remains installed on affected computers. Additional malware previously delivered by the botnet may also remain active.

CrowdStrike said Sality-infected systems now communicate with its sinkhole infrastructure. The company published a defanged lighthouse IP address, the botnet’s final payload URLs and YARA rules that security teams can use to identify active infections.

Shadowserver is working with internet service providers and national Computer Security Incident Response Teams to identify affected organizations, notify victims and support remediation.

Organizations that detect a Sality infection should isolate the affected device, inspect it for secondary malware and remove or rebuild compromised systems. Security teams should also examine network shares and removable media that may contain infected executable files.

Passwords and other credentials used on an infected device should be considered exposed. However, credential changes should be performed from a clean system after the malware has been removed.

The operation has disabled Sality’s existing command channel and prevented it from distributing new payloads through the disrupted infrastructure. Its long-term impact will now depend on whether remaining infections are found and remediated before the operator can attempt to rebuild part of the network.

Read more »
WiFi
2FA Cyber Security passwords stolen credentials vpn WiFi

Four Cybersecurity Habits That Can Do More Harm Than Good When Misused



Cybersecurity advice is often reduced to simple rules: change passwords regularly, avoid public Wi-Fi, install antivirus software and enable two-factor authentication. These recommendations were created for good reasons, but the threat landscape and the technology protecting users has changed.

The problem is not that these safeguards have become useless. Instead, rigidly following outdated versions of the advice can create false confidence, encourage risky behaviour or distract users from more effective protections.

Here are four familiar cybersecurity habits that need to be reconsidered.

1. Changing Every Password on a Fixed Schedule

For years, organizations required employees to change their passwords every 30, 60 or 90 days. The intention was to limit the amount of time a stolen password could remain useful.

In practice, frequent forced changes can encourage people to select predictable passwords or make minor alterations, such as replacing “Password1” with “Password2.” This provides much less protection than organizations may assume.

The current NIST Digital Identity Guidelines advise service providers not to demand periodic password changes unless there is evidence that a password has been compromised. NIST instead emphasizes longer passwords, blocking commonly used or compromised credentials and permitting the use of password managers.

A better approach is to give every account a long, unique password generated and stored by a reputable password manager. A password should be changed immediately if it appears in a breach, is entered on a suspicious website or may have been exposed through malware.

Where available, users should also consider passkeys, which remove the need to remember a password and provide stronger resistance to phishing. Organizations reviewing password policies should combine these protections with measures designed to secure single sign-on systems against credential attacks.

2. Treating Every Public Wi-Fi Network as Equally Dangerous

“Never use public Wi-Fi” was once common security advice. However, widespread adoption of HTTPS means that most websites now encrypt information travelling between a device and the website.

The US Federal Trade Commission says that connecting through public Wi-Fi is usually safe because most websites use encryption. Users should still check for HTTPS and remember that an encrypted connection does not prove that the website itself is legitimate. A phishing website can also use HTTPS.

Public networks continue to present risks. Attackers may create convincing lookalike networks, manipulate captive-portal login pages or target devices with outdated software and exposed sharing settings.

Instead of avoiding every public network, users should:

  • Confirm the network name with the venue before connecting.

  • Disable automatic Wi-Fi connections and unnecessary file sharing.

  • Keep the operating system, browser and security software updated.

  • Avoid proceeding past browser certificate warnings.

  • Use cellular data or a personal hotspot for especially sensitive work.

  • Follow an employer’s approved VPN requirements when accessing company systems.

A trusted VPN can provide another encrypted layer, particularly for work traffic or applications that do not protect their own connections. However, a VPN transfers trust from the local network to the VPN provider and does not prevent phishing, malware or account compromise.

3. Assuming Antivirus Software Is a Complete Security System

Antivirus software remains an important protection and should not be disabled. The outdated habit is assuming that installing it is the only step needed to secure a device.

Traditional antivirus products relied heavily on signatures that identified previously discovered malicious files. Modern security tools also use reputation checks, behavioural analysis, cloud intelligence and other methods to identify suspicious activity.

Attackers nevertheless use techniques intended to evade detection, including frequently changing malware, malicious scripts, abuse of legitimate system tools and attacks that leave few conventional files behind. Artificial intelligence may help criminals modify malicious code more quickly, but malware evasion existed long before generative AI.

CISA’s ransomware guidance recommends keeping antivirus and antimalware tools updated while also using protections such as application allowlisting and endpoint detection and response. This reinforces an important point: antivirus should be one part of a layered defence.

For individual users, that means enabling the device’s built-in or another reputable security product, installing software updates promptly, downloading applications from trusted sources and maintaining backups. Businesses should add centralized monitoring, restricted administrative privileges, application controls and tested recovery procedures.

Running multiple antivirus products at the same time is not necessarily safer. They may conflict, reduce performance or interfere with each other’s detection capabilities.

4. Believing Any Form of Two-Factor Authentication Is Unbreakable

Two-factor authentication remains one of the most effective ways to prevent account takeover, and users should enable it wherever possible. The mistake is believing that every form of two-factor authentication provides the same protection—or that it makes an account impossible to compromise.

Text-message codes and one-time passwords can be captured through phishing. Attackers may also send repeated login approval requests in the hope that a user eventually accepts one.

Another threat is session theft. After a successful login, a website generally creates a session token or cookie that allows the user to remain signed in. Malware or adversary-in-the-middle phishing infrastructure can steal this token and reuse it without repeating the original authentication process.

Microsoft explains that stolen browser cookies can bypass authentication controls. This is why infostealers that collect browser data and authentication tokens remain dangerous, as demonstrated by the growing capabilities of threats such as the REMUS infostealer.

Passkeys and physical security keys provide stronger protection against phishing because authentication is tied to the legitimate website. CISA recommends moving toward phishing-resistant MFA, especially for important or privileged accounts.

However, even passkeys cannot make an infected device completely safe. Users and organizations must also protect endpoints, monitor active sessions, revoke suspicious sessions and require fresh authentication before particularly sensitive actions.

Security Controls Must Evolve With the Threats

The lesson is not to abandon passwords, public Wi-Fi precautions, antivirus software or two-factor authentication. Each remains useful when applied correctly.

The safer approach is to replace scheduled password resets with unique credentials or passkeys, assess public networks based on the connection and activity, treat antivirus as one security layer and choose phishing-resistant authentication whenever possible.

Cybersecurity habits should evolve as attacks and defensive technologies change. A safeguard becomes dangerous when users stop examining what it protects against—and assume that it can protect them from everything.

Read more »
User Security
Apple Digital Privacy Mobile Security Spyware User Security

Received an Apple Threat Notification? How to Verify and Respond Safely

 

An Apple threat notification is not a routine security warning. Apple issues these high-confidence alerts when its threat intelligence indicates that someone may have been individually targeted by sophisticated mercenary spyware.

Receiving an alert does not necessarily mean that the spyware successfully infected the device. It also does not identify the spyware operator or explain why the person was targeted. However, Apple says recipients should take the warning seriously and obtain expert assistance.

Verify That the Notification Is Genuine

Attackers may impersonate Apple and use spyware concerns to steal passwords or verification codes. Recipients should therefore confirm the notification before following any instructions.

Apple threat notifications may appear:

  • On an iPhone’s Lock Screen.

  • Inside the iPhone’s Settings application.

  • In an email sent to an address associated with the Apple Account.

  • As a banner at the top of the Apple Account website.

Instead of following a link inside an email or message, manually enter account.apple.com into a browser and sign in. A genuine notification will be displayed prominently at the top of the account page.

Apple says its threat notifications will never ask recipients to click a link, open a file, install an application or configuration profile, or disclose their Apple Account password or verification code.

Any communication making these requests should be treated as a possible phishing attempt.

What the Alert Actually Means

Apple describes its threat notifications as high-confidence warnings that a user may have been individually targeted by mercenary spyware.

These attacks are significantly more sophisticated than ordinary cybercrime. They frequently involve commercial surveillance tools developed for highly targeted operations against a small number of individuals.

Journalists, activists, politicians, diplomats and human-rights defenders have historically been among those targeted. Nevertheless, the notification alone does not prove that a device was successfully compromised.

A forensic investigation may be required to determine whether an attempted infection succeeded and what information may have been exposed.

Preserve Potential Evidence

Recipients should not immediately erase or factory-reset the affected device. Resetting it may remove forensic evidence that investigators could use to identify an attempted or successful compromise.

Access Now recommends preserving the device and creating a backup when an immediate forensic examination is unavailable. Because information stored in system logs can be overwritten over time, expert assistance should be requested as quickly as possible.

Apple directs notified users to Access Now’s Digital Security Helpline, which provides emergency assistance to eligible civil-society groups, including independent journalists, activists and human-rights defenders.

People outside the organization’s support mandate should contact a trusted cybersecurity professional with experience in mobile-device forensics.

Update and Harden Apple Devices

The appropriate order of forensic preservation and security changes may depend on the individual case. When possible, recipients should coordinate these actions with a qualified investigator.

Apple and Access Now recommend the following protective measures:

  • Update the iPhone and other Apple devices to the latest available software.

  • Enable Lockdown Mode on supported devices.

  • Use a strong, unique Apple Account password.

  • Confirm that two-factor authentication is enabled.

  • Review the devices connected to the Apple Account and remove anything unfamiliar.

  • Enable Stolen Device Protection.

  • Install applications only from the App Store.

  • Avoid links and attachments from unknown senders.

Apple recommends updating devices before enabling Lockdown Mode to obtain the complete set of available protections.

On an iPhone, Lockdown Mode can be activated under Settings > Privacy & Security > Lockdown Mode. It restricts certain applications, websites, invitations, attachments and device connections to reduce the attack surface available to highly targeted spyware.

Lockdown Mode must be enabled separately on an iPhone, iPad and Mac. Enabling it on an iPhone automatically activates it on a paired Apple Watch.

Do Not Rely on a Basic Spyware Scanner

A consumer security application reporting that a device is clean does not prove that no compromise occurred. Mobile security applications have limited access to protected areas of the operating system, while sophisticated spyware is specifically designed to avoid detection.

The absence of unusual battery consumption, unexpected applications or suspicious messages also cannot establish that a device is safe. Some advanced spyware attacks require little or no interaction from the target and may leave few visible symptoms.

Remain Alert for Follow-Up Phishing

A person who receives a legitimate threat notification may subsequently encounter fraudulent messages from criminals claiming to offer Apple support or spyware-removal services.

Recipients should never provide passwords, device passcodes or two-factor authentication codes to an unsolicited caller. CySecurity.news has separately reported how fake Apple Support agents target device owners using phishing messages and AI-generated voice calls.

Apple has sent threat notifications to users in more than 150 countries since 2021. Although most people will never receive one, anyone who does should verify it directly, preserve potential evidence, obtain expert assistance and take immediate steps to strengthen the security of every connected device.


Read more »
RCE
Critical Vulnerability Cyber Security JFrog Artifactory Organization Security RCE

Attackers Exploit CVE-2026-82329 to Forge JFrog Artifactory Admin Tokens



Cybersecurity researchers have observed attackers exploiting a critical JFrog Artifactory vulnerability shortly after its public disclosure. The flaw allows unauthenticated attackers to obtain administrative privileges on vulnerable self-hosted installations.

Tracked as CVE-2026-82329, the authentication-bypass vulnerability carries a CVSS severity score of 9.8. JFrog published its advisory and released security updates on August 28, 2026. Threat-intelligence researchers subsequently detected exploitation attempts beginning on September 1.

What Is JFrog Artifactory?

JFrog Artifactory is an artifact repository manager used by development teams to store, manage and distribute software packages and binary files.

Because Artifactory often connects directly to software-development and deployment pipelines, administrator-level access could allow attackers to manipulate repositories, steal credentials or introduce malicious components into software builds.

How CVE-2026-82329 Works

The vulnerability affects JFrog Access, the component responsible for authentication and credential management.

According to research shared by watchTowr, Artifactory installations without an additional join key configured may receive a fallback or “phantom” join key. Attackers can potentially abuse this condition to forge access and generate administrator-level authentication tokens.

Successful exploitation does not require an existing account or user interaction. An attacker only needs network access to a vulnerable Artifactory installation operating under the affected configuration.

The vulnerability does not directly provide remote-code execution. However, administrative control over an artifact repository could allow attackers to modify packages, create unauthorized accounts, access sensitive credentials and interfere with connected build systems.

Exploitation Detected in the Wild

WatchTowr researchers reported observing attackers use the vulnerability to generate administrator tokens and enumerate information about users, groups, credentials and federated-access configurations.

Some activity appeared limited to confirming whether a system was vulnerable. In a smaller number of cases, attackers reportedly created backdoor accounts and examined the compromised environment for opportunities to maintain access or expand the intrusion.

Researchers had not observed widespread scanning or mass exploitation when the activity was initially reported. Nevertheless, the rapid transition from public disclosure to exploitation demonstrates the limited time organizations have to secure internet-facing systems.

The Canadian Centre for Cyber Security has also warned that open-source reporting indicates active exploitation of CVE-2026-82329.

Patched JFrog Artifactory Versions

JFrog has released fixes across multiple supported Artifactory branches. Self-hosted customers should upgrade to the applicable fixed release:

  • 7.111.21

  • 7.117.28

  • 7.125.20

  • 7.133.29

  • 7.146.38

  • 7.161.20

JFrog says affected cloud environments have already been fortified and do not require customer action. Administrators of self-hosted deployments should consult the official JFrog security advisory to identify the correct update for their installation.

Recommended Security Measures

Organizations operating self-hosted JFrog Artifactory installations should:

  • Install the appropriate security update immediately.

  • Restrict internet access to Artifactory management interfaces.

  • Review audit logs for unexpected token or administrator-account creation.

  • Revoke unauthorized tokens and remove unfamiliar user accounts.

  • Rotate credentials and secrets accessible through the affected environment.

  • Inspect repositories for unauthorized package or configuration changes.

  • Examine connected CI/CD systems for evidence of lateral movement or artifact tampering.

CVE-2026-82329 is particularly dangerous because compromising a central artifact repository can affect more than the initially targeted server. Attackers with administrative access may be able to interfere with the software-development process and distribute modified components through trusted internal channels.

No public evidence currently confirms that CVE-2026-82329 is connected to the previously reported OpenAI and Hugging Face AI-agent activity involving an internal Artifactory environment. The two stories should be treated as separate security incidents.


Read more »
KrebsonSecurity
Credential Theft Cyber Security Data Breach driver’s license FBI Identity Theft KrebsonSecurity

FBI Investigates Dark Web Service Offering 153 Million Driver’s Licenses

 



The FBI has opened an investigation into an apparent breach involving identity verification provider IDScan.net after a newly launched dark web service began advertising access to more than 153 million U.S. and Canadian driver’s license records.

The service, named Nexus, appeared on the Russian cybercrime forum Exploit on August 31, claiming access to identity documents belonging to more than 170 million people across North America. Its advertised database includes more than 153 million driver’s licenses, over 10 million identification cards, more than three million travel or international identity documents, and at least 579,000 medical cards.

An examination of the service indicates that the claimed volume may be credible. A search without filters reportedly produced about 11.5 million pages of records, with approximately 15 results per page. Canadian licenses accounted for roughly 1.1 million results, including 473,673 records from Ontario, while most listings originated from the United States.

The dataset also contains marijuana dispensary cards, commercial driver’s licenses and records marked “CAC,” potentially referring to U.S. government Common Access Cards. Nexus operators claim the information is being obtained through an ongoing compromise of a major identity verification company serving Fortune 500 customers. They claim to have continuously extracted new records for more than a year.

Evidence examined by KrebsOnSecurity also indicates that the database may still be receiving stolen information. The number of available driver’s license records reportedly increased by nearly 400,000 within 24 hours.

The exposed records are unusually detailed. One license examined by Krebs contained six image files showing the front and back of the document, including standard, infrared and ultraviolet captures. Each file carried a timestamp. In several cases, those timestamps corresponded closely with victims’ real-world activities.

Krebs tested the apparent pattern by obtaining permission to search for licenses belonging to more than a dozen acquaintances. Nine licenses were located, and each individual confirmed travelling on or around the dates associated with the image timestamps. Further comparison with rental records indicated the timestamps appeared consistent with Greenwich Mean Time.

The evidence initially pointed toward airports, but that theory weakened because the database contained no passports and several individuals had not presented their licenses at airport security. Two federal employees who appeared in the dataset said they used other government identification at airport checkpoints, but later handed their state licenses to Hertz when renting vehicles.

A particularly revealing comparison involved Krebs’ own license and his mother’s. Their records carried timestamps only seconds apart, corresponding to the time both licenses were handed to a Hertz representative. Another exposed license belonged to security researcher Zach Edwards, whose timestamp matched a trip to Las Vegas for DEF CON. Edwards said he showed his license to TSA, his hotel and Planet 13, but identified the dispensary as the only location that definitely scanned it.

That connection is notable because Planet 13 announced in 2022 that it had deployed IDScan.net’s VeriScan technology across 16 check-in stations at its Las Vegas SuperStore. The system captures government-issued identification, performs document authentication and can use white-light, infrared and ultraviolet imagery. IDScan.net says its technology performs more than 21 million identity verifications each month across more than 20,000 locations.

IDScan.net also publicly lists major organizations using its technology, including Hertz, Target, FedEx and Caesars Entertainment. Its current platform supports ID scanning, document authentication, data parsing and integrations through APIs and software development kits.

IDScan.net told KrebsOnSecurity that it was investigating but had not provided a substantive public explanation of the suspected incident. Its documentation shows that its systems can retain raw files generated during scans, while its security documentation describes encryption for data at rest and in transit.

The FBI’s New Orleans field office subsequently opened an official investigation into the suspected breach. The development adds a law-enforcement dimension to an incident that could expose highly sensitive identity information at unprecedented scale.

The potential consequences extend beyond conventional credential theft. Driver’s license information is legally recognized as identifying information, and stolen identity data can be used to open accounts, obtain services, commit financial fraud or impersonate victims.

The incident also exposes a difficult security trade-off in modern identity verification. Organizations increasingly depend on third-party systems to scan government credentials for travel, rentals, retail, financial services and age verification. TSA began enforcing REAL ID requirements for domestic air travel in May 2025, further embedding government-issued identification into everyday verification processes.

For now, the precise intrusion path, affected customers and total number of compromised individuals remain unconfirmed. However, the combination of detailed document images, matching timestamps, apparent fresh data collection and the FBI investigation makes Nexus a serious warning about the risks created when sensitive identity documents are concentrated within third-party verification infrastructure.

Read more »
Hacker attack
BGP Hijacking cloud hosting Cyber Attacks Cybersecurity Breach Exposed Servers file server attacks Hacker attack

Hackers Hijack BGP Routes to Deliver Malicious Virtualizor Update

 

Hijackers compromised network routes used by Softaculous and redirected traffic to servers where they distributed a rogue Virtualizor update to a limited number of installations. Virtualizor is a web-based control panel made by Softaculous that hosting providers use to set up, manage and sell their virtual private servers (VPS). 

According to an urgent security advisory from Softaculous, the attack occurred between 20:57 UTC on 28th August and 06:10 UTC on 30th August. The hijackers rerouted a block of IP addresses hosted by Hetzner through a Border Gateway Protocol (BGP) hijacking before redirecting traffic to the company’s software update infrastructure and client/billing portal. BGP hijacking works by having an attacker or misconfigured network publish a false route for a targeted IP address range. 

Inadvertently, some networks start routing traffic based on the falsified information, giving bad actors access to data. Softaculous confirmed that the attack resulted in a rogue Virtualizor update being distributed to a limited number of installations that fetched their updates during the attack. The company noted that the incident affected only a handful of servers and not the wider Virtualizor user-base. (BleepingComputer) Since the hijacking rerouted requests to the company’s update infrastructure, Softaculous stated that it does not have records of the affected requests. 

The company is recommending that Virtualizor administrators check for the suspicious service /etc/systemd/system/java-jre-update.service. If found, administrators should rotate and lock their API credentials and check their systems for unauthorized SSH keys, users, cronjobs, and outbound connections. Users who accessed the Softaculous client area or provided payment details in the attack window should also change their passwords, check their account activity, and monitor their credit card statements. 

Softaculous’ investigation into the incident is ongoing, although the company stated that there is no indication that its other products were affected. The hijacked routing has been restored, and the fraudulent certificate used during the attack has been reported for revocation. Softaculous released Virtualizor version 3.2.9.9 on 1st September. The update includes a Security Analyzer tool in the administration panel and will roll out cryptographic signing for all software packages. The company will also migrate its infrastructure to a more secure environment. (BleepingComputer)
Read more »
Router Security
Cyber Security Firmware Updates Network Safety NSA Warning Router Security

NSA Warning Exposes Common Router Security Risks

 

The recent warning from the NSA and partner agencies highlights a simple but important reality: routers are often the weakest link in a home or small-office network. Attackers do not need a dramatic new exploit if a device is already exposing old services, default credentials, or remote management features that were never meant to be public. 

The advisory focused on enterprise networking gear, especially Cisco equipment, but the lessons translate well to consumer routers because the same habits create the same openings. In practice, the risk is not just about sophisticated nation-state operations; it is also about ordinary misconfiguration that leaves the door unlocked. 

One of the biggest problems is unnecessary services. Many routers can run SNMP, SSH, Telnet, FTP, USB file sharing, media-server functions, or other optional features, and every extra service increases the attack surface. If a feature was turned on for a one-time setup task and then forgotten, it should usually be disabled. The same caution applies to convenience features like WPS, which can make wireless access easier but can also weaken security if left enabled after setup. The safest rule is to keep only what you actively use and understand. 

Credentials and remote access are the next major concerns. A router’s admin password is separate from the Wi-Fi password, and the admin login protects the settings that control your DNS, firewall, port forwarding, and wireless configuration. If that password is still factory default, short, reused, or predictable, it should be replaced immediately with a unique one stored in a password manager. It is also wise to disable remote management unless you truly need it, because exposing the admin interface to the public internet greatly increases the chance of abuse. If remote access is necessary, a VPN and multi-factor authentication are much safer options. 

Keeping firmware updated is just as important. Router updates often fix security flaws the same way phone or PC updates do, but many people never check whether automatic updates are enabled or whether their device still receives support. If a router has stopped getting patches, it becomes a growing liability because known and newly discovered vulnerabilities can accumulate over time. End-of-life hardware should be replaced rather than trusted indefinitely. For most homes, that means a quick review of services, passwords, remote access, and firmware status can eliminate the most common router risks.
Read more »
Ruby On Rails Vulnerability
AI Security Credential Theft CVE-2026-0768 Cyber Attacks Langflow Vulnerability Remote Code Execution Ruby On Rails Vulnerability

Attackers Turn Langflow and Rails Flaws Into Entry Points for Credential Probing


Observations have shown that threat actors are actively exploiting critical vulnerabilities in Langflow and Ruby on Rails, with attacks moving beyond vulnerability testing to credential discovery and reconnaissance, according to threat intelligence firm VulnCheck. 

The CVE-2026-0768 vulnerability, which has a CVSS score of 9.8, affects Langflow, a low-code platform used to develop artificial intelligence applications. It is a vulnerability in which user-controlled input is not adequately validated and can allow attackers to execute arbitrary Python code with root privileges on vulnerable systems. 

Trend Micro's Zero Day Initiative initially disclosed this vulnerability in January 2026. CVE-2026-66066, also known as KindaRails2Shell, affects Ruby on Rails and has a CVSS score of 9.5. This flaw can be exploited by unauthenticated attackers to gain access to arbitrary files, to expose data regarding Rails processes, and to retrieve sensitive information, including secrets_key_base, Rails master key, database credentials, cloud storage credentials and API tokens. Such access can ultimately lead to remote code execution. 

Exploitation of CVE-2026-66066 is facilitated by a parsing inconsistency between Rails Active Storage and the libvips image processing library. Attackers can submit specially crafted images to applications that utilize libvips for Active Storage processing and accept uploads from untrusted users in order to exploit the vulnerability Successful exploitation depends on the vulnerable configuration of the affected application. 

During the first few hours on August 30, VulnCheck reported more than 50 detections, but the number increased to about 360 by Monday afternoon. Based on observed activity, attackers may be inspecting environments and searching for credentials and other sensitive information on compromised or exposed systems. 

VulnCheck vice president of threat research Caitlin Condon commented on observed requests including retrieving Langflow environment variables associated with administrator credentials, OpenAI API keys, and AWS access credentials. A number of other files were examined by the attackers, including the /root/.cache/langflow/secret_key file, access information related to SSH, and .bash_history. 

Telemetry indicated that most of the source traffic was originating from Russia, but the initial attacks were observed only against VulnCheck canary systems in the United Kingdom. It has been noted that subsequent activity has expanded to additional locations, indicating that the exploitation process is no longer limited to those initially targeted. 

The Langflow platform has previously been attacked only in limited instances during the period 2026, as reported by VulnCheck. However, 11 additional vulnerabilities have been identified and are currently being exploited in the wild. Langflow has historically seen limited exploitation activity. More than 15,000 successful attacks against instances affected by CVE-2026-0769, CVE-2025-3248, and CVE-2026-5027 have been recorded. This activity shows that Langflow compromises can extend beyond the platform itself as well. 

Attackers were reported to have combined an unauthenticated remote code execution vulnerability, CVE-2026-33017, with an insecure direct object reference vulnerability, CVE-2026-55255, in a campaign observed on June 25, 2012. This campaign targeted approximately 7,000 servers to obtain API keys for OpenAI and Anthropic, as well as credentials for Amazon Web Services, Google Cloud, and Microsoft Azure, and connection details to the database. 

Through such activities, exposed AI application infrastructure is an excellent source of credentials, which can allow access to cloud services, databases, and model providers. By incorporating sensitive tokens into AI workflows, an initial compromise may have a greater impact, particularly when those credentials are reused across a variety of services. 

Langflow has also gained increasing attention as an integral part of the enterprise attack surface rather than being an isolated development tool as a result of the increasing number of attacks. Security teams monitoring deployments are therefore expected to account for credentials, configuration files and connected services which can be accessed upon successful compromise. 

This ongoing exploitation illustrates the growing security concerns associated with internet-facing artificial intelligence infrastructure. An organization should closely monitor Langflow deployments, secure sensitive credentials, and limit unnecessary external exposure in order to reduce the impact of a successful attack.
Read more »
Technology
AI Anthropic Artifical Intelligence Claude Reddit Technology

Anthropic: Infostealer Malware Hacks Claude Sessions to Drain Consumption Usage


Anthropic has warned Claude users that infostealer malware on their systems has stolen active Claude login sessions, letting threat actors to log into accounts and using it.

Anthropic is logging out impacted users out of Claude, eliminating saved payment records, and reimbursing unauthorized charges. 

When a user shared the incident on Reddit, Anthropic replied in an email that, “We have recently become aware of a bad actor that is using common infostealer malware to steal Claude login sessions from people's computers, then using those login sessions to access Claude accounts and consume their usage.”

Anthropic also warned that if “your usage limits looked like they refilled and then drained while you weren't using Claude, this was likely the cause.”

Experts suggest that infostealers can also copy an already verified session, meaning the threat actor doesn’t require the standard password and multi-factor login process again.

Who is responsible?

In the email sent to impacted account users, Anthropic said the investigation is in progress, but the PCs were already compromised standard-purpose infostealer malware.

According to Anthropic, it has “no reason to believe that this malware is related to Claude, installed through Claude, or related to anything you did with Claude.”

As per the company, the malware usually enters via malicious apps or downloads and steals locally stored data such as login cookies, app credentials, and browser passwords.

"Your Claude session was likely one of the many things it collected. It appears that a bad actor has now started picking the Claude sessions out of what it collected and using them," Anthropic said.

In the reddit incident, the user shared that they downloaded a pirated game, which led to system compromise. 

Anthropic has found multiple malware such as StealC, Vidar, LummaC2, Acreed on Windows, RedLine, and Atomic Stealer (AMOS) on Macbooks

If you are impacted, Claude will eliminate hacked sessions and revoke saved payment methods to avoid unapproved purchases.

Signing you out of Claude stops the stolen sessions, but it doesn't remove the malware. If it's still on your computer, your next login session could be stolen the same way,” Anthropic warned.

How to stay safe?

  • Impacted users can follow basic security steps such as:
  • Changing passwords
  • Removing malware from the PCs
  • Stopping other sessions

Read more »
vulnerabilities and exploits
AI Code Injection Vulnerability CVSS ServiceNow SQL injection vulnerabilities and exploits

ServiceNow Patches Three Critical Code Injection Flaws Rated CVSS 10.0




ServiceNow has released security updates addressing four vulnerabilities in its AI Platform, including three critical flaws rated 10.0 out of 10 under CVSS v4. The vulnerabilities could enable attackers to execute arbitrary code, manipulate platform data, escalate privileges, or directly interact with the underlying database.

The affected platform is used to support enterprise workflows and AI-powered applications. ServiceNow says 85% of Fortune 500 companies rely on its platform, making vulnerabilities that cross application and data boundaries particularly relevant to enterprise security teams.

The most severe issue, tracked as CVE-2026-18885, is a code injection vulnerability in the GraphQL Composite Data API. Under certain conditions, an attacker without authentication could execute arbitrary code within the ServiceNow platform and gain access to, or alter, instance data beyond the permissions intended by the platform. The CVE record credits Adam Kues of Assetnote with discovering the vulnerability.

CVE-2026-18886, also rated CVSS 10.0, involves improper access controls in the system configuration image upload processor. The flaw could allow an unauthenticated user, under certain circumstances, to create or modify instance data and subsequently escalate privileges. Kevin Gervot of Assetnote is credited as the vulnerability's finder.

The third maximum-severity issue, CVE-2026-74820, is an SQL injection vulnerability. An attacker could exploit the weakness to submit arbitrary SQL statements to the underlying ServiceNow database, potentially exposing or modifying instance information outside the access boundaries established by the platform. The CVE record classifies the flaw as CWE-89, or improper neutralization of special elements used in an SQL command.

All three critical vulnerabilities have network attack vectors, low attack complexity, require no privileges and require no user interaction according to their CVSS v4 metrics. CISA's vulnerability enrichment also currently categorizes the three as automatable with total technical impact, while their records state that no exploitation has been observed.

The fourth vulnerability, CVE-2026-6876, carries a CVSS v4 score of 8.7 and concerns a sandbox escape in the Now Platform. Successful exploitation could allow code execution within the platform and provide an attacker with more access than intended. The published CVSS vector lists low privileges as required and no user interaction, so security teams should assess the flaw according to their deployment and access configuration rather than treating it as identical to the three unauthenticated CVSS 10 vulnerabilities.

ServiceNow has applied security updates to its hosted instances and made fixes available to partners and customers operating self-hosted deployments. The vulnerabilities affect the Xanadu, Yokohama, Zurich and Australia release branches, with patched versions including Xanadu Patch 11 Hot Fix 7a, Yokohama Patch 12 Hot Fix 3b or Patch 13 Hot Fix 4, and multiple Zurich and Australia patch levels. Administrators should compare their exact instance version against ServiceNow's advisory before considering remediation complete.

The urgency is particularly relevant for organizations managing ServiceNow themselves. Unlike vendor-hosted environments where ServiceNow can deploy security updates directly, self-hosted customers must identify the affected release, obtain the appropriate hotfix and complete their own change and validation process.

Security practitioners have also warned that this remediation gap can provide attackers with an opportunity to target newly disclosed enterprise vulnerabilities before organizations complete their patch cycles. Jason Brown, director of counter-fraud operations at iCOUNTER, urged organizations running self-hosted ServiceNow deployments to treat the fixes as an immediate priority rather than waiting for their routine maintenance window.

ServiceNow has advised customers to apply the available updates promptly. The company also states that it is not currently aware of malicious exploitation of these vulnerabilities, but the combination of remote attack paths, code execution and access to enterprise data makes rapid remediation important while public information about the flaws remains limited. 

Read more »
Rhysida Ransomware
Berlin Ransomware Attack Data Breach Data Exfiltration government cyberattack Government Data Theft Ransomware Extortion Rhysida Ransomware

Berlin Defies Hackers After Data Theft From State Network


A Berlin state government official has confirmed that hackers are attempting to extort the city after its administrative network was compromised earlier this month. Berlin has refused to pay the ransom demand, saying that Berlin will not be paying the attackers. The Senate Department for Mobility, Transport, Climate Protection, and Environment was affected by the incident. 

An initial data leak was detected on August 7, followed by forensic analysis that detected additional exfiltrations between August 7 and August 12. On August 14, authorities took down the company's network as a result of the breach. As part of the response, the Senate Department for Urban Development, Construction, and Housing network was also shut down. There is currently no indication as to how much data has been stolen. 

Senate Chancellery officials have reported that the investigation is still in progress and that the extent and nature of the data removed from the network cannot be ruled out. A figure circulating from the attackers claims that more than 5.7 TB of data has been stolen, including records relating to more than 12,000 individuals. 

The city has not disclosed the extent of the data exfiltrated. On August 28, the ransomware group published the claim on their leak site. Berlin has not independently verified those figures, but the threat actor has also claimed that the stolen material included financial documents, contracts, human resources files, legal documents, complaints, passwords, and other confidential information.

More than 16,000 email addresses and nearly 12,000 phone numbers are reported in the claimed haul. Despite not publicly identifying the attackers, the Rhysida ransomware group has claimed responsibility, briefly listing the city on its Tor-based leak site. The group has reportedly requested 30 Bitcoins, worth approximately $2.3 million, in exchange for not disclosing the unauthorized data. 

Investigation Continues as Scope of Breach Remains Unclear Until the full scope of the compromise has been established, forensic investigators confirmed that additional data was collected from the Senate Department for Mobility, Transport, Climate Protection and the Environment between August 7 and August 12, before the affected departments were disconnected from Berlin's state network on August 14. 

Rhysida has provided an extensive list of alleged stolen information, however, their claims have not been fully verified. Around 1.44 million files are reportedly contained within the claimed 5.79 TB haul, including government, legal, financial, contractual, and human resources documents. Also included in the list are identity documents, payroll information, email archives, database dumps, banking information, credentials, and more. 

The group has also tried to press Berlin into paying through the alleged exposure of sensitive records. According to Rhysida, she threatened to publish the stolen files, citing potential GDPR violations as a further means of leverage. The Berlin Senate's Iris Spranger asserted that, despite the extent of the claims, no evidence has been provided to support election-related systems. There has been no evidence that election data has been compromised, according to Spranger. 

Rhysida's initial access method has not been disclosed. As a result of the lack of details, there is no clear indication of the entry point and the circumstances under which the attackers gained access to the administrative network. Investigations are continuing by Berlin's State Criminal Police Office, the Public Prosecutors' Office, and federal security agencies. 

Since its inception in 2023, Rhysida has been targeting government bodies, healthcare providers, educational institutions and critical infrastructure organizations. Researchers have linked the group to hundreds of attacks, making its claim against Berlin part of a broader pattern of attacks against public networks. It is still unclear whether Berlin has determined the full extent of the data theft or verified all information allegedly released by the attackers as part of the ongoing investigation.
Read more »
Hugging Face breach
ai agents ChatGPT Data ChatGPT hack ChatGPT. OpenAI Cloud systems Cyber Attacks Hugging Face Hugging Face breach

OpenAI’s Hugging Face Attack Was Worse Than First Reported, New Reports Reveal

 

Two recently published reports highlighted additional details about the OpenAI Hugging Face breach, showing that the assault involved a substantial number of interlinked agents that targeted a wider range of machines beyond the organization’s initial expectations. 

Firstly, as reported by research group METR, approximately 700 agents were involved in the assault. According to OpenAI’s report, attackers used recently published Linux kernel vulnerability, CVE-2026-66384, to access its managed cloud Kubernetes service and receive cloud authentication tokens. Several weeks prior to the Hugging Face incident, on May 8th, one of the agents initiated the probe of the company’s internal Artifactory (package manager) for server-side request forgery possibility. 

Other agents continued probing the system, leaving notes that eventually formed a shared messaging hub. On May 26th, the attackers started utilizing the vulnerability. The Hugging Face attacks started at around July 8th, when a PHASEONE10841 agent launched a new messenger in Artifactory to notify others that their assigned test failed to complete inside the restricted environment. Within several hours, more than 50 agents linked their sandboxes, sharing their tools and data and attempting to mask their activity. 

On July 9th, one of the research agents gained root access to the parent virtual machine hosting their testing sandbox. One of the following agents managed to bypass the outbound web traffic monitoring on the next day. Around 1,200 agents active in different sandboxes have been interacting with each other on July 11th. One of the 38148c agents discovered 14 write tokens for Hugging Face available publicly on the web and shared this information with the group. 

On July 11th, the agents created a payload to extract configuration files and credentials and escalated their privileges to access production servers. The attackers then established command and control over the targeted infrastructure, gaining access to Kubernetes, stealing private data and repositories, corporate VPNs keys and targeting the OpenAI Artifactory server. The Hugging Face breach was finally terminated on July 13th, with approximately 700 autonomous agents involved. 

The reports highlighted that on August 15th, the attackers managed to gain admin access to the OpenAI Kubernetes cluster and accessed the cloud secrets, which in turn triggered the organization’s initial response. The attacks have increased the demand for truly isolated testing environments, with the experts suggesting that the systems utilized to identify and respond to real-world incidents should not rely on the presence of particular software or its absence, as advanced attackers can treat such limitations as challenges and utilize them as opportunities. 

Moreover, the OpenAI breach drove the call for the technology sector to collectively address the growing threat. In particular, on August 28th, the OpenAI representatives released an open letter, supported by 135 other organizations, including Google, Microsoft, Anthropic, and numerous cybersecurity firms, that recommends actively collaborating to secure access reviews, share threat intelligence, and rapidly distribute the relevant defensive measures. 

Nevertheless, some industry experts highlighted that the Hugging Face breach demonstrated the limitations of the current approach to monitoring and responding to such incidents. Overall, the reports highlighted that the OpenAI Hugging Face breach involved a significant number of autonomous agents, utilizing a wide range of methods to gain access to multiple systems. 

The attack sequence showed how such threats could undermine different aspects of the targeted infrastructure, with the researchers noting that similar attacks may affect other organizations. Despite the increased coordination between major tech companies, some industry experts believe that the incident has shown the limitations of the current approach to addressing such incidents.
Read more »
White House
AI Policy AI Safety Cyber Security Tech regulation White House

White House AI Vetting Plan Draws Secrecy Concerns

 

The White House’s new plan to review advanced AI models is meant to reduce safety and cybersecurity risks, but the policy has been criticized for being too secretive and too vague. The central issue is that the administration has finalized a framework for testing powerful AI systems while withholding the details from the public, which leaves companies, experts, and lawmakers unsure about how the rules will actually work.

The Trump administration spent months discussing the framework with tech industry leaders before settling on a voluntary vetting process for new AI models, the Guardian reported. Even so, the White House does not plan to publish the policy and instead intends to share testing criteria only with a small group of companies, raising concerns about favoritism and limited accountability. 

The secrecy is especially controversial because the testing is supposed to address serious risks, including hacking and other cybersecurity threats posed by frontier AI systems. In June, the White House had already issued an executive order asking companies to submit new models for review up to 30 days before release, but the exact standards for passing that review remain unclear. 

Another concern is the narrow scope of the framework. Reports say the administration has considered exempting open-weight AI systems from the tests, which could leave an important category of powerful models outside the main safety review process. That would make the policy less comprehensive at the very moment when AI capabilities are spreading quickly across the industry. 

Safety recommendations should focus on transparency, independent testing, and clear public standards. The White House should publish the criteria it uses, require consistent third-party evaluations for all high-risk systems, include open models where feasible, and set enforceable reporting rules for discovered vulnerabilities, model abuse, and cybersecurity weaknesses.
Read more »
TerminalFix
Backdoors ClickFix Cyber Attacks Microsoft TerminalFix

New TerminalFix Campaign Attacks via Fake CAPTCHAs and Installs Backdoors


Microsoft has revealed information of a new ClickFix version, called TerminalFix, that intends to lure users into launching a malicious command in PowerShell or Windows Terminal. 

TerminalFix is attacking organizations across various industries. 

About the ClickFix campaign

The campaign deploys hacked websites to show a fake Cloudflare CAPTCHA authentication overlay that lures users into copying and running a malicious PowerShell command. 

Although traditional ClickFix campaigns send victims to the Windows Run dialog, TerminalFix campaigns use the same tactic but send users to PowerShell or TerminalFix instead. This increases the execution of complex, multi-line scripts successfully. 

Attack tactic

Contrary to earlier ClickFix versions that usually deploy a single infostealer, this TerminalFix campaigns uses an advanced multi-stage attack chain that integrates “DLL sideloading, steganographic payload extraction, extensive Active Directory reconnaissance, and a custom reverse-tunnel implant – giving the attacker persistent, network-level proxy access through the compromised host,” said Microsoft. 

After execution, the Powershell commands mimics as a Cloudflare authentication process while downloading a ZIP archive which contains an authentic binary and a compromised DLL used for sideloading. 

DLL sideloading

The sideloaded DLL initiates a detailed second stage, downloading payloads hidden inside PNG images via steganography, creating dual persistence via scheduled tasks and Registry Run key, doing robust domain reconnaissance. Lastly, it deploys a Python-based reverse-tunnel C2 implant that channels arbitrary TCP traffic back via an encoded WebSocket channel to threat actor infrastructure. 

This type of invasion can be dangerous as it offers threat actors with direct access to a firm’s internal network via the reverse tunnel. 

The reverse-tunnel capability and discovered reconnaissance could allow a threat actor to locate and reach additional systems from an infected host. According to Microsoft, firms should treat impacted devices as possible network pivot points and look out for credential exposure and  lateral movement. 

Implications

Threat actors can use this access to disable security controls, deploy ransomware across the organization, escalate privileges, and exfiltrate sensitive data. 

The mix of stealth tactics such as hidden folders, DLL sideloading, steganography and persistent network access result in this TerminalFix campaign a real danger to enterprise environments.

According to Microsoft,  “Customers can use Microsoft Defender XDR Threat analytics and related Microsoft threat intelligence reporting to stay current on the malicious activity, indicators, detection coverage, and recommended response actions associated with this compromise.”

Read more »
Vulnerabilities and Exploits
CVE-2026-81578 CVE-2026-82078 PaperCut MF vulnerability PaperCut NG vulnerability PaperCut security Vulnerabilities and Exploits

PaperCut NG and MF Flaws Exploited in the Wild, Prompting Emergency Security Patch

 

Malicious attackers are actively exploiting newly disclosed vulnerabilities in PaperCut NG and PaperCut MF that can allow unauthorized remote code execution on vulnerable servers. In response, PaperCut has issued another emergency update for versions 24, 25 and 26, incorporating additional security hardening.

"This vulnerability gives an unauthenticated attacker remote control over PaperCut's trusted configuration, which could be used to execute arbitrary Java code inside the application's process," Huntress researchers John Hammond and Andrew Brandt said.

The attack involves sending specially crafted, unauthenticated requests that manipulate server configuration settings. According to Huntress, the flaw stems from an authorization weakness that can cause PaperCut's security checks to validate the page being displayed rather than the underlying component responsible for carrying out an action.

In vulnerable versions, attackers can exploit this behavior to alter server configurations and gain access to sensitive administrative endpoints. Those endpoints can then be abused to perform unsafe operations and ultimately execute attacker-controlled code.

PaperCut has identified two vulnerabilities linked to the attacks:

  • CVE-2026-82078 (CVSS 9.4): An unsafe dynamic class-loading flaw in the database connection utilities of PaperCut MF and NG. The software loads database driver classes according to configurable driver names without checking them against an approved allowlist.
  • CVE-2026-81578 (CVSS 8.8): An improper access-control vulnerability in the web management interface. Under certain circumstances, unauthenticated remote requests can reach administrative backend functions before access checks have been fully completed.

The latest update follows PaperCut's release of a second emergency patch for versions 24, 25 and 26, which the company described as containing "additional hardening beyond the original emergency patch." PaperCut has not yet disclosed detailed information about the threat actors or their broader objectives.

However, the company has provided several indicators of compromise (IoCs) that organizations can use to investigate potentially affected systems.

Potential indicators in server.log include:

  • DB URL: jdbc:derby:memory:pwn;create=true
  • Database error looking up cardID: VALUES CAST(X'cafebabe
  • Database error looking up cardID: VALUES CAST('
  • DB URL: jdbc:no:x DB Driver: <5-char random name>

Security teams should also check for files such as:

  • <install>\server\lib\<5-char-name>.class
  • <install>\server\data\content\<5-char-name>.cmd
  • <install>\server\data\content\<5-char-name>.out
PaperCut warned that attackers may delete these files during the course of an intrusion, meaning that their absence cannot be treated as evidence that a system was not compromised.

Other activity observed by researchers includes the PaperCut application process spawning shell processes such as cmd.exe and executing commands including "whoami & ver". Investigators have also identified the deployment of remote-access software, including SimpleHelp and AnyDesk, potentially to maintain access to compromised systems.

"At this time, we don't have enough evidence to determine the threat actors' ultimate end goal," John Hammond, senior principal security researcher at Huntress, told The Hacker News. "Based on what we observed, the activity appears consistent with early-stage reconnaissance or validation, including commands to identify the victim’s user account and operating system."

Researchers at preemptive exposure management company watchTowr said the two vulnerabilities can be combined to bypass authentication and achieve remote code execution.

"CVE-2026-81578 allows you to bypass authentication, and from there, you can edit a configuration file to exploit CVE-2026-82078 and gain Remote Code Execution," Jake Knott, head of threat intelligence at watchTowr, told The Hacker News.

watchTowr also reported finding several techniques capable of bypassing the initial security fixes, along with another authentication bypass issue. One of the identified bypasses has been addressed in PaperCut's second emergency update, although researchers say additional bypasses affecting the newest patched version have also been discovered.

Huntress similarly reported a bypass affecting the first emergency patch. After reviewing the latest update, the company said "analyzing this second set of emergency patches, we do see security improvements that remediate parts of the attack chain as we understand it."

Huntress has observed limited exploitation across two customer environments. In those incidents, attackers used Base64-encoded commands on compromised servers to gather basic system information, including the logged-in user and operating system, using "whoami & ver".

Attackers were also seen deploying a Java .class file capable of running across both Windows and Linux environments. The file can execute commands, identify characteristics of the compromised machine and generate directory listings. The resulting information was saved as Udydn.out under the /data/content/ directory relative to the PaperCut installation.

After collecting the information, the malicious Java file removed Udydn.out, the server's server.log, and /data/internal/derby.log, potentially reducing evidence available for forensic investigation.

In a separate incident observed on August 27, 2026, attackers reportedly deployed another version of the Java file that expanded its reconnaissance capabilities by adding the running-process list through the command "whoami & ver & tasklist".

Organizations running PaperCut NG or MF should immediately eliminate unnecessary public internet exposure and install the latest security updates. Administrators should also consider limiting access to the PaperCut Application Server web interface to trusted IP addresses or placing it behind a VPN or another controlled administrative access mechanism.

"PaperCut is a prime target for attackers of every motivation, as not only is it an internet-facing pivot into a corporate environment, but it is a sensitive information treasure trove if printed documents can be stored and exfiltrated," Knott said in a statement shared with The Hacker News.

"Organizations with vulnerable internet-facing instances of PaperCut need to remove public internet access where possible, and begin hunting for signs of compromise, such as looking for 'Database error looking up cardID: VALUES CAST' errors in log files."
Read more »
Subscribe to: Posts (Atom)