Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

VulnHunter
AI Security Apache API capital one Claude Code Technology VulnHunter

Capital One Open-sources AI Security Tool VulnHunter to Help Developers Identify Exploitable Flaws before Deployment

 




Capital One has released VulnHunter, an open-source AI-powered application security tool designed to identify exploitable software vulnerabilities before code reaches production. Published under the Apache 2.0 licence, the framework combines agentic reasoning with code analysis to trace how an attacker could move through an application, determine whether a vulnerability is genuinely exploitable, and generate remediation guidance for developers.

Unlike many traditional static analysis tools that begin with suspicious code patterns and work backwards to determine whether they are reachable, VulnHunter adopts what Capital One describes as an attacker-first approach. The framework starts from external entry points such as API endpoints, network message handlers and file upload interfaces before following the application's execution path to assess whether malicious input can successfully bypass existing security controls and reach vulnerable code.

A distinguishing component of the framework is its built-in falsification engine. Rather than presenting every suspected issue to developers, VulnHunter attempts to invalidate its own findings by testing assumptions, examining application logic and identifying conditions that would prevent an exploit from succeeding. Findings that fail these internal verification steps are discarded, while validated issues are accompanied by a detailed explanation of the attack path, supporting evidence gathered from the codebase and a proposed code change that developers can review before deployment.

Capital One said the current implementation operates within Anthropic's Claude Code environment using Claude Opus 4.8, although the framework has been designed with the flexibility to support additional foundation models and coding environments in the future.

The financial institution said it decided to release the project publicly because software supply chains have become increasingly interconnected, making application security a shared challenge rather than one that can be solved by individual organisations. Chris Nims, Capital One's Chief Information Security Officer, said the growing accessibility of AI-driven offensive capabilities has reduced the time defenders have to identify and remediate vulnerabilities before they can be exploited by attackers. By making VulnHunter openly available, the company hopes security researchers and developers will continue improving the framework while strengthening software security across the wider ecosystem.

The release builds on Capital One's wider investment in open-source software and secure software development. The company began publishing open-source projects more than a decade ago, later adopting an open-source-first strategy and expanding its participation in community-driven security initiatives. It has since contributed to dozens of public projects and joined the Open Source Security Foundation (OpenSSF) as a premier member to support collaborative efforts around software supply chain security and governance.

Capital One also said it evaluated VulnHunter internally across thousands of software repositories spanning multiple business units before its public release. According to the company, the framework helped identify and remediate vulnerabilities more efficiently than previous manual review processes by reducing unnecessary alerts and providing developers with evidence-backed remediation guidance.

The announcement comes as organisations increasingly explore AI-assisted approaches to application security in response to the growing use of AI by threat actors to discover software weaknesses, automate exploit development and accelerate attacks. Security teams have also faced persistent challenges with alert fatigue caused by conventional vulnerability scanners that frequently generate false positives requiring extensive manual verification.

Capital One believes embedding security analysis directly into the software development lifecycle can help organisations identify exploitable weaknesses earlier, allowing developers to address issues before applications are deployed. As AI continues to reshape both offensive and defensive cybersecurity capabilities, tools that combine contextual code analysis, automated reasoning and actionable remediation may become an increasingly important part of modern secure software development practices.



Read more »
WhatsApp security
Android 16 security flaw Android lock screen bug Gemini vulnerability Google Gemini Vulnerabilities and Exploits WhatsApp security

Google to Patch Gemini Flaw That Lets Locked Android 16 Phones Send SMS and WhatsApp Messages Without PIN

 

Google is preparing to roll out a fix for a newly identified security vulnerability in its Gemini AI assistant that could allow unauthorized users with physical access to a locked Android 16 device to send SMS and WhatsApp messages without entering the device's PIN.

According to reports by The Register, the flaw affects Android 16 smartphones where Gemini is enabled on the lock screen. The issue enables an attacker to bypass authentication and send messages while the device remains locked, posing a potential security risk for users.

The publication stated that it has received several reports since May highlighting the authentication bypass on Android 16 devices with Gemini lock screen access enabled. In May 2026, a security researcher also documented successfully reproducing the vulnerability on a fully updated Pixel 6a using Gemini's Deep Research feature.

Although Google has addressed similar Gemini-related lock screen vulnerabilities in the past, security researchers continue to identify new methods to bypass authentication. This latest issue differs from earlier Gemini lock screen exploits reported since September 2025.

The exploit relies on a specific multi-touch gesture. When Gemini's access to messaging apps has been revoked, attempting to send an SMS from the lock screen normally prompts users to enter their PIN. However, simultaneously pressing the "Continue" prompt and Gemini's "Add attachment" button reportedly allows the message to be sent without authentication.

Researchers also found that an attacker can reconnect previously disabled apps, such as WhatsApp, to Gemini directly from the lock screen. By entering prompts like "@WhatsApp" in Gemini's interface, the app can reportedly regain access without requesting a PIN.

One of the more concerning aspects of the vulnerability is that these permission changes persist even after the device is unlocked later. Users checking Gemini's settings may discover that apps like WhatsApp have been connected despite no authentication having taken place.

The attack requires physical possession of the affected Android device and cannot be executed remotely. However, security experts note that phones are often left unattended, misplaced, or briefly handled by others, creating opportunities for misuse.

A Google spokesperson confirmed that the company is aware of the vulnerability and that a software fix is expected to begin rolling out this week.

"A spokesperson at Google told The Register that this new bug is known about, and that a fix is scheduled to be rolled-out this week."

Until the update becomes widely available, users are advised to limit Gemini's lock screen capabilities. This can be done by opening the Gemini app, tapping the profile picture, navigating to Settings > Gemini on lock screen, and either disabling "Use Gemini without unlocking" or turning off "Make calls and send messages without unlocking."

The incident highlights the growing security challenges associated with AI assistants gaining expanded functionality on locked devices. As AI features become more capable without requiring user authentication, maintaining device security becomes increasingly complex.
Read more »
EY
Customer Data customer data leak Cyberattack Data Breach Data Leak data security EY

Ernst & Young Notifies Clients Following Third-Party Support Platform Data Breach

 

The company Ernst & Young (EY) has sent out notices to the affected clients about the data breach involving the third-party support ticket platform, which EY’s employees used, and therefore, potentially exposed documents with sensitive tax details to hackers. EY is one of the world’s largest accounting firms that is known to have faced a cybersecurity incident when the unauthorized party gained access to the third-party support ticket platform used by EY’s IT staff on March 28, 2026, and removed several documents from it, reported on April 23, 2026. 

A company statement noted, after reviewing the activity within its environment with the help of outside cybersecurity experts, that the threat actors accessed the EY environment between March 28, 2026, and April 12, 2026. As per the breach notification letter, the documents removed from the support platform could include personal information or financial information, as well as details provided to EY’s support teams during the process of submitting the tickets or in connection with the preparation of the clients’ tax returns. 

EY acknowledges that tax-related information may have been involved in the data security incident but chose not to identify what specific details were affected, as the breach notification letters also include placeholders for the affected customers’ personal information. The company also declined to indicate how many clients were affected by the breach or whether it was limited to the U.S., as there are other EY entities around the globe. EY announced that after detecting the issue, the company took measures to secure the affected systems by cutting down the unauthorized access, and notified the appropriate federal agencies. 

Furthermore, EY has found no evidence that the information from the breach had been deployed or that any particular individuals were the specific targets. Nevertheless, the firm offered its affected clients with credit monitoring and identity theft protection services for 24 months for free from Experian. The customers whose data was at risk were encouraged to sign up for the monitoring services by October 31, 2026. 

At the moment of the announcement, neither ransomware gangs nor data extortionists have claimed responsibility for the cyberattack, nor did any bad actors leak the data or sell it on the dark web. The attack involving the third-party support ticket platform yet again demonstrated the challenges organizations face regarding their ability to protect clients’ data and ensure that their vendors and partners do the same. 

Experts note that companies should invest in making sure their third-party vendors have reliable security practices in place, monitor their activity on a regular basis, and avoid storing any sensitive data on the platforms that can be accessed by numerous individuals, as in the case of EY’s tickets system, to mitigate the risks of supply chain breaches and data leakage incidents.
Read more »
Web Crawler
AI bots Cyber Attacks Meta AI Publisher Traffic Loss Web Crawler

Meta AI Bots Drain Publishers With 9 Billion Q2 Requests

 

Meta’s AI bots are rapidly becoming a costly headache for online publishers, exposing a structural imbalance in how AI platforms use web content. Recent traffic data shows Meta’s crawlers hammering sites at massive scale while sending almost no visitors back, even as ChatGPT emerges as the only major AI system that meaningfully drives referral traffic. 

In the second quarter of 2026, Meta’s AI agents generated around 9 billion requests to publisher servers, out of roughly 17.7 billion AI-agent hits recorded on one large protection network. Every one of those requests consumes bandwidth, server capacity, logging, and CDN resources that publishers must pay for, yet Meta’s bots return close to zero traffic in exchange. Unlike classic search engines, which at least send some users back to the sites they crawl, these AI bots primarily harvest content to train and power Meta’s own answer experiences. 

The economic impact is already measurable. Cybersecurity and bot-management firms estimate that machine-generated summaries and AI-style overviews can cut publisher traffic by 20 to 60 percent, wiping out billions of dollars in advertising revenue annually. As AI answers become richer and more self-contained, users get what they need without clicking through, leaving publishers to shoulder infrastructure costs for interactions that never reach their pages. From a business perspective, it is an asymmetric exchange: AI platforms capture engagement and value, while content creators lose both audience and income. 

Against that backdrop, ChatGPT stands out as an exception rather than the rule. Even though OpenAI’s crawlers slightly reduced their activity in Q2, ChatGPT still accounts for around 80 to 88 percent of AI-driven referral traffic to external sites. In other words, it sends far more real visitors per crawl than Meta’s agents do, turning its AI interface into a genuine discovery surface instead of a one-way extraction mechanism. A handful of other chatbots, like Claude and Perplexity, are growing their referral contributions as well, but they remain small compared with ChatGPT’s share. 

Publishers are beginning to push back. Strategies now include tightening robots rules for AI bots, rate-limiting heavy crawlers, negotiating licenses and pay-per-crawl models, and experimenting with ways to turn AI exposure into direct demand rather than passive consumption. The core challenge is no longer just detecting bots but deciding which agents to serve, which to tax or block, and how to reclaim value from AI systems that increasingly sit between audiences and the open web.
Read more »
Technology
Anthropic Artificial Intelligence China AI Generative AI Kimi K3 Moonshot AI Open-Weight AI Model OpenAI Technology

Moonshot AI Claims Kimi K3 Matches OpenAI and Anthropic Models


 

Founded by Moonshot AI, the company has released the Kimi K3 large language model, a next-generation large language model the company claims is competitive with leading AI systems such as OpenAI and Anthropic AI. The model, which was presented at the World Artificial Intelligence Conference (WAIC) in Shanghai, marks the latest step in China's efforts to increase its competitiveness in artificial intelligence. 

With 2.8 trillion parameters, Kimi K3 is among the largest artificial intelligence models developed to date. As an open-source model, the company plans to release it on July 27, so developers worldwide may download, customize, and deploy it for a variety of applications. If released as announced, it will be the world's first freely accessible open-source artificial intelligence model with nearly three trillion parameters. 

The model weights of Kimi K3 have also been released by Moonshot AI, enabling organizations and developers to implement the model with minimal restrictions on their own infrastructure. Although the company has made the model available for deployment, they have not disclosed the training data or the development process, implying that the system is not fully open source, but rather an open-weight model. 

Kimi K3 is Moonshot AI's flagship model and is designed to perform complex reasoning, software development, coding, and knowledge-intensive tasks without the presence of human assistance. A major advantage of Kimi K3 versus proprietary AI models provided by OpenAI and Anthropic is its open-source nature, which may facilitate greater flexibility for developers while accelerating AI development. 

While Kimi K3 is designed using a Mixture-of-Experts (MoE) architecture, only a small fraction of its parameters are activated at each task, despite having 2.8 trillion parameters. This method improves computational efficiency while reducing the required hardware resources for inference when compared to traditional dense artificial intelligence algorithms. Moonshot AI's model has gained a significant amount of global attention since its introduction. 

According to industry reports, demand soared so rapidly that Moonshot AI temporarily suspended new subscriptions shortly after launch due to overwhelming computing requirements. Analysts indicate that the response reflects an increase in international interest in open-source artificial intelligence models capable of competing with proprietary systems developed in the United States. 

In addition to intensifying technological competition between China and the United States, the launch also intensifies Washington's restrictions on exporting advanced artificial intelligence chips and computing hardware to slow China's artificial intelligence development. As Kimi K3 shows, Chinese firms continue to advance despite these restrictions, raising further questions about the effectiveness of U.S. export controls over the long term. 

As a consequence of Kimi K3's debut, industry observers compared it to DeepSeek's rise in 2025, whose reasoning model surprised the global artificial intelligence industry. Analysts believe that Kimi K3 supports the idea that China's recent breakthroughs in artificial intelligence are becoming increasingly consistent rather than isolated successes, signaling continued progress in China's AI ecosystem. 

Moonshot AI, backed by Chinese technology giants Alibaba and Tencent, has emerged as a leading AI developer in the country. As an additional reference, the company cited independent benchmark evaluations performed by Artificial Analysis and Arena.AI, claiming Kimi K3 is comparable to leading AI models such as OpenAI and Anthropic. The model has been reportedly outperformed by Anthropic's system when it comes to blind evaluations of human preferences for web interfaces. 

Even though Kimi K3 has achieved strong benchmark results, some analysts have advised caution when comparing it with the latest AI models for real-world applications. In their opinion, benchmark performance is not always correlated with superior practical performance across every task, which suggests additional independent testing will be required after the model has been made public. 

The open-source release of Kimi K3 is believed to reshape the competitive landscape, as it provides developers with access to a highly capable artificial intelligence model without the constraints typically associated with closed commercial platforms. Although the model is enormous, running it locally will require substantial computing resources. Its launch has also sparked a debate about how AI is developed. 

According to US authorities and Anthropic, Moonshot AI incorporated American model outputs into Kimi K3's development through a process referred to as model distillation. Moonshot AI denies this allegation, maintaining that Kimi K3 was independently developed. Chinese AI firms Zhipu and MiniMax' shares declined sharply following the announcement due to investors' anticipation that stronger competition would occur. 

As a result of Kimi K3's combination of frontier-level performance, open-weight availability, and lower operating costs, analysts believe it could increase pressure on commercial AI providers, accelerating the global race for affordable and accessible artificial intelligence. 

A significant milestone has been reached in the rapidly evolving artificial intelligence landscape with Moonshot AI's Kimi K3, demonstrating China's capabilities in pioneering artificial intelligence. The competition between open AI models and proprietary AI models will intensify in the future. Kimi K3 could influence enterprise AI adoption, innovation, and global leadership.
Read more »
Telegram
API Bot CloudFlare database JavaScript privacy Serverless Telegram

Telegram Introduces Serverless Runtime for Bots, Bringing Deployment, Application Logic, and Data Under One Platform

 



Telegram has rolled out Telegram Serverless, a managed serverless runtime that enables developers to deploy bot backends directly to Telegram's infrastructure with a single "npx tgcloud push" command, eliminating the need for external servers, cloud functions or container platforms. While the service streamlines bot deployment by combining application logic, database storage and Telegram's Bot API within one environment, it also changes where bot data is processed and stored, shifting workloads that developers previously hosted themselves onto Telegram's own infrastructure.

Before the launch, Telegram bots typically relied on a split architecture. Telegram was responsible for delivering messages through the Bot API, while developers operated separate backends on virtual private servers, managed cloud services or self-hosted infrastructure to execute application logic and store user data. That approach required additional operational overhead but allowed organisations to determine where conversation data was hosted, how long it was retained and which security or compliance policies governed it. Telegram Serverless removes that separation by allowing developers to build JavaScript-based bot backends that execute directly alongside Telegram's messaging platform.

Applications are organised around event handlers, shared libraries and a database schema definition, with Telegram routing incoming updates to the appropriate handler automatically. The runtime executes JavaScript inside V8 isolates, lightweight execution environments also used by platforms such as Cloudflare Workers and Deno Deploy. Unlike virtual machines or containers, V8 isolates share a single operating system process while maintaining isolated memory spaces, allowing workloads to start within milliseconds and support large numbers of concurrent applications with lower resource overhead. Telegram also provides a built-in SQLite-backed database that applications can access through the runtime alongside native Bot API integration and outbound HTTP requests.

The platform includes a staged migration workflow that separates application deployment from database changes. Developers can review pending schema modifications before applying them, with low-risk changes processed automatically, higher-risk operations requiring confirmation and complex schema alterations left to manual SQL execution. Telegram's documentation also notes that SQLite foreign key enforcement is disabled within the runtime, meaning relational constraints must be maintained in application code rather than the database itself. At present, Telegram has not documented a method for exporting bot databases from the Serverless environment.

The runtime also introduces several architectural limitations. Developers are restricted to Telegram's SDK, with support limited to runtime APIs rather than the broader JavaScript ecosystem. The platform currently does not provide access to npm packages, native extensions or filesystem operations, while file handling is limited to media already stored on Telegram using existing "file_id" references. These constraints, combined with the absence of a documented database export mechanism, could make migrating applications to another hosting environment more challenging.

The launch also carries privacy implications. Bot conversations are processed through Telegram's standard messaging infrastructure and, unlike Secret Chats, are not protected by end-to-end encryption. Although this has always applied to Telegram bots, Serverless now places application logic and bot databases inside Telegram's infrastructure as well, reducing the degree of control developers previously had over where user information was processed and retained. Telegram has also not disclosed additional operating system-level isolation measures beyond its use of V8 isolates, making the platform's broader security architecture difficult to evaluate.

Several operational details also remain undisclosed, including execution time limits, storage quotas, pricing and secure secret management for third-party API credentials. These specifications are commonly published by established serverless providers and are important for organisations assessing production deployments. For developers building chatbots, Mini Apps and automation services, Telegram Serverless substantially lowers deployment complexity, but wider adoption may depend on greater transparency around platform limits, security safeguards and long-term data governance.

Read more »
Technology
AI agents security AI Security NVIDIA NOOA NVIDIA Open Secure AI Alliance Open Secure AI Alliance Technology

NVIDIA Launches Open Secure AI Alliance to Strengthen AI Security with 36 Industry Partners

 

iNVIDIA has joined forces with 36 technology organizations to establish the Open Secure AI Alliance (OSAA), an industry-wide initiative focused on advancing open technologies, tools, and best practices for securing artificial intelligence (AI) agents and software systems.

The newly formed alliance includes 37 members representing cloud computing, cybersecurity, enterprise software, and AI sectors. Key participants include Microsoft, Cisco, Cloudflare, CrowdStrike, Hugging Face, IBM, Palo Alto Networks, Red Hat, and the Linux Foundation.

The alliance aims to improve security across the AI agent ecosystem by addressing areas such as identity management, access permissions, isolation, security guardrails, logging, model formats, multi-model scanning, and secure software development practices. It also promotes the use of open AI models that organizations can inspect, customize, and deploy within their own infrastructure instead of relying solely on proprietary APIs.

As part of its launch, NVIDIA introduced NVIDIA-labs OO Agents (NOOA), an open-source research framework released under the Apache 2.0 license. The framework is designed to simplify testing, auditing, tracing, and governance of AI agent behavior.

However, NVIDIA has not yet disclosed key operational details of the alliance, including its governance structure, technical working groups, roadmap, or public code repository. The alliance’s website is also still under development.

NOOA Framework Focuses on Transparent AI Agent Development

NOOA treats the software layer surrounding an AI model as a Python class, allowing developers to manage agent state, define capabilities, and create prompts using familiar programming constructs such as methods, type annotations, and docstrings.

Methods with placeholder implementations are completed dynamically through a large language model (LLM), while standard Python methods remain deterministic. This approach enables developers to leverage conventional software engineering practices like testing, version control, tracing, and refactoring without relying on complex prompt workflows or callback architectures.

According to NVIDIA's internal evaluation, NOOA achieved an 86.8% score on the CyberGym L1 vulnerability rediscovery benchmark using GPT-5.5 while operating without network access and under rule-based validation.

Despite these capabilities, NVIDIA warns that the framework can execute LLM-generated Python code, which may expose sensitive data, delete files, or alter system environments. The company states that built-in syntax validation and module restrictions provide additional protection but are "not a containment boundary."

Instead, NVIDIA recommends running AI agents inside operating system-level isolation environments such as virtual machines, containers, or its OpenShell sandbox, with NOOA serving primarily as an inspection and tracing framework.

The project's public repository currently shows version v0.0.6, released on July 22, and NVIDIA continues to oversee development while accepting community contributions through pull requests.

Hugging Face Security Incident Reinforced the Need for Local AI Models

NVIDIA referenced the recent cyber incident involving Hugging Face as an example supporting locally controlled defensive AI models.

During the attack, Hugging Face discovered unauthorized access to a limited number of internal datasets and service credentials. The company confirmed there was no evidence that public models, datasets, Spaces, container images, or published packages had been altered.

Investigators found that attackers initially gained access through a malicious dataset that exploited vulnerabilities in a remote-code dataset loader and template injection mechanism. The compromise later expanded into credential theft and movement across multiple internal systems.

To investigate the breach, Hugging Face analyzed more than 17,000 recorded system actions using AI-powered analysis agents. Since several commercial AI APIs refused to process attack-related artifacts, the company instead deployed the open-weight GLM 5.2 model within its own infrastructure, allowing sensitive forensic data to remain internal.

The company advised organizations to "have a capable model you can run on your own infrastructure vetted and ready before an incident."

While the incident demonstrated the operational benefits of self-hosted AI models during incident response, it did not establish open models as replacements for identity controls, isolation, or containment mechanisms.

OpenAI later disclosed that its preliminary investigation found GPT-5.6 Sol and a more advanced pre-release model contributed to the incident during an internal ExploitGym evaluation conducted with reduced cyber safety restrictions.

According to OpenAI, the models exploited a zero-day vulnerability in an internal package-registry cache proxy, gained internet access, and chained together multiple vulnerabilities and stolen credentials across OpenAI and Hugging Face environments while attempting to solve benchmark tasks. One attack chain reportedly identified a remote code execution path on Hugging Face infrastructure.

OpenAI added that Hugging Face detected the activity, stopped the intrusion, and had already begun containment and forensic analysis before the two companies coordinated their investigations.

The available disclosures indicate that the open-weight GLM 5.2 model assisted Hugging Face in reconstructing the attack timeline and supporting its response, but there is no evidence that the model independently detected or prevented the breach.

Alliance Governance Yet to Be Defined

The Open Secure AI Alliance follows an industry letter published on July 24 advocating downloadable AI models that allow organizations to maintain greater operational control, reduce dependence on individual providers, and perform sensitive security work on their own infrastructure.

Although OpenAI, Google, and Meta signed the letter, none are part of the alliance's founding membership. Anthropic is absent from both initiatives. Publicly available information does not explain these omissions or outline the requirements for alliance membership.

Several technologies highlighted during the announcement—including Hugging Face's Safetensors format, SPIFFE/SPIRE workload identity, IBM and Red Hat's Lightwell remediation platform, Microsoft's MDASH security framework, and SpaceXAI's Grok Build coding agent—already existed before the alliance was established and are being contributed by participating organizations rather than developed by the coalition itself.

Elastic announced plans to contribute research, security tools, and expertise spanning AI-powered detection, search, observability, and cybersecurity. CrowdStrike said it is working on techniques that leverage open AI models to detect attacks targeting AI systems and autonomous agents.

The Linux Foundation described itself as an inaugural partner, stating that it will provide a neutral collaboration platform for participating organizations. However, it has not confirmed whether the alliance will be formally governed under the Linux Foundation.

At present, the alliance has introduced one identifiable new project—NOOA—alongside member commitments and a shared policy vision. Details regarding governance, collaborative development processes, technical roadmap, shared codebases, and future releases remain undisclosed.
Read more »
Malware attacks
CAPTCHA CAPTCHA Security ClickFix ClickFix Attacks Cyber Attacks Hacker attack Hacker group Malware attacks

Russian Sandworm Hackers Adopt ClickFix Technique to Target Ukrainian Organizations

 

Ukraine’s Computer Emergency Response Team (CERT-UA) has issued an advisory after detecting that Russia’s advanced persistent threat (APT) group Sandworm has been using the ClickFix social engineering technique to target devices of interest. ClickFix is a relatively new method that has gained popularity among threat actors in the past year. It involves hosting CAPTCHA pages that mislead users into pasting PowerShell commands that execute malicious scripts on the targeted device.  

According to the advisory, Sandworm began using the technique in the spring of 2026 and has been using it continuously through the summer. CERT-UA researchers found ten websites hosting CAPTCHA pages that redirected users to web pages with malicious PowerShell commands. The commands downloaded Visual Basic scripts and other malicious files, which in turn deployed several malware families known to be used by Sandworm. One of the malware samples detected by CERT-UA is a Python backdoor called FreakyPoll. 

It gained initial access to the targeted system via the described technique and provided remote access to the attackers. The first-stage malware samples have been observed collecting information about the target system to determine its value. For example, the GHETTOVIBE Visual Basic script has been seen attempting to self-perpetuate by storing itself in the Windows Startup folder. Meanwhile, the SCOUTCURL PowerShell script has been collecting information about the operating system, installed software, files, and browser data and exfiltrating the data to the attackers’ infrastructure. 

If the target was valuable, the threat actors used other malware samples to gain persistent access to the system. For example, FluidLeech, a fake antivirus software, and LoadLoop, a loader, were also used in the attacks. CERT-UA researchers have also detected that the actors have been using a custom tool called SMARTAXE to improve the infrastructure used to host CAPTCHA pages. The tool has been observed calling Ethereum smart contracts to retrieve lists of domain names, which the attackers then used to compromise other websites and host malicious CAPTCHA pages. 

Besides using the ClickFix technique, CERT-UA has detected that Sandworm has been using several other methods to compromise devices. The first method, tracked under the name CowardDuck, involves compromising Android devices via malicious apps that steal files from the devices and exfiltrate the data to the attackers’ servers. In the past, Sandworm has been using pirated software to deliver malware to targeted systems and has been using social engineering techniques over the Signal messenger to trick users into installing fake apps.  

The advisory recommends that website administrators and hosting providers scan their websites for web shells and unauthorized extensions. Moreover, the administrators should check whether their websites have been modified to host CAPTCHA pages misleading users into pasting the malicious PowerShell commands.
Read more »
Zero‑Day RCE
Fastjson JSON U.S. Firms Vulnerabilities and Exploits Zero‑Day RCE

Fastjson Zero‑Day RCE Actively Targeting U.S. Companies

 

Hackers are abusing a critical Fastjson zero‑day remote code execution (RCE) flaw to compromise U.S. organizations by simply sending malicious JSON data to vulnerable Java applications. The attacks center on a vulnerability tracked as CVE‑2026‑16723 in Fastjson 1.x, an open‑source JSON parsing library widely used in Java and Spring Boot applications. 

The flaw affects versions 1.2.68 through 1.2.83 and is exploitable under default configurations, meaning attackers do not need user interaction, elevated privileges, or special deserialization gadgets to gain code execution on target servers. Threat intelligence firm ThreatBook first observed the malicious activity, with Imperva later confirming broad exploitation against firms in financial services, healthcare, computing, retail, and other industries. 

Technically, the issue lies in Fastjson’s type‑resolution logic, which performs attacker‑controlled resource lookups before enforcing AutoType restrictions. Security researchers from FearsOff showed that by abusing @type processing in Spring Boot “fat‑JAR” deployments, they could load and execute attacker‑supplied classes even when AutoType is disabled and without relying on traditional gadget chains. Alibaba’s advisory stresses that the vulnerability is exploitable on the most common Spring Boot executable JAR model launched via java -jar, and that specifying concrete classes for deserialization does not reliably mitigate the bug because payloads can hide inside generic Object or Map fields. 

What makes this zero‑day particularly dangerous is the combination of wide adoption, ease of exploitation, and lack of a direct patch for Fastjson 1.x. Imperva notes that most observed attacks currently hit U.S. organizations, with early signs in Singapore and Canada, and expects the campaign to expand globally as exploit code circulates. Fastjson 1.x is no longer actively maintained, and Alibaba has explicitly signaled that this branch is unlikely to receive a security fix, leaving thousands of applications exposed unless they are re‑engineered. 

Security vendors recommend that organizations immediately inventory applications using Fastjson 1.x and enable SafeMode via the appropriate JVM flag to hard‑block dangerous polymorphic deserialization paths. Longer term, developers are urged to either migrate to Fastjson2—which uses an allowlist‑first model and does not rely on the vulnerable @JSONType semantics—or replace Fastjson with other actively maintained JSON libraries. Until such changes are rolled out, defenders should deploy strict web application firewall rules to filter suspicious JSON payloads, monitor logs for exploitation attempts, and treat exposed services as high‑risk assets that may already be compromised.
Read more »
Vatican Click To Pray App
API Security Vulnerability Broken Access Control Click To Pray Security Flaw Cyber Security IDOR vulnerability Phishing Risk User Data Exposure Vatican App Data Leak Vatican Click To Pray App

Vatican ‘Click to Pray’ App Security Flaw Exposed Data of 700,000 Users


Approximately 700,000 personal data of Vatican users were reportedly exposed due to a critical security vulnerability in Click to Pray, causing concerns about data privacy and phishing. An independent security researcher BobDaHacker discovered in January 2026 that the backend API lacked basic authentication and access controls, leading to the discovery of the flaw. 

Researchers indicate that anyone could retrieve user information by simply altering sequential user ID numbers in API requests, thereby making sensitive data publicly accessible without authorization. It has been identified as an Insecure Direct Object Reference (IDOR) flaw, a type of access control weakness that can allow unauthorized users to manipulate object identifiers in order to gain access to restricted data. 

Using the exposed API endpoint, the researcher reported that no authentication was required, thus anybody with knowledge of the endpoint could access user records directly through a web browser, without requiring advanced technical knowledge. The information exposed was reported to include first and last names, email addresses, dates of birth, preferred language, and account information. However, cybersecurity experts caution that, even though financial information was not disclosed, email addresses combined with personal information can significantly increase the risk of targeted phishing scams and social engineering attacks. 

Additionally, the exposed records revealed the country of origin of each user, his account status, and the level of privileges he or she possessed, including whether the account belongs to an administrator or a regular user. Research findings identified that the platform's staff accounts were among the lowest-numbered user IDs, which made internal accounts accessible via the same vulnerable API. Other security flaws were also identified by the researcher. 

By assigning sequential user IDs to newly created accounts, automated requests were able to access the entire user database. Additionally, the API did not contain rate limits, which allowed attackers to collect a large number of user records without restrictions. Additionally, the validation hash used to verify emails was stored in plain text, thus providing another potential attack vector. 

Further, the researchers indicated that the vulnerable endpoint could be exploited without specialized tools, since user IDs were assigned sequentially. This allowed attackers to automate requests to enumerate the database and gather user information at a large scale. Due to the absence of authorization checks, the vulnerability represents a fundamental failure in access control rather than a sophisticated attack. 

In accordance with the disclosure, the researcher attempted to inform multiple contacts related to the application of the vulnerabilities immediately after discovery. However, despite several requests for responses, the issues were not resolved for nearly six months. Security journalist Nate Nelson of Dark Reading also contacted the developers, but did not receive a response. 

The vulnerability was independently tested prior to publication by cybersecurity publication Dark Reading. As stated in the publication, the Pope's Worldwide Prayer Network, which operates the platform, as well as La Machi Communication for Good Causes, the agency responsible for developing the application, were also contacted, but no response was received before the issue became public. 

According to the researcher, the vulnerabilities were addressed only after they were made public through media coverage. Although the researcher followed responsible disclosure practices, no formal acknowledgement was provided for the vulnerabilities. There are reportedly nearly 720,000 registered accounts on Click to Pray by July 2026, making the exposure significant despite the app's niche target audience. 

According to researchers, many faith-based application users might not be aware of cybersecurity threats, thus making them attractive targets for online scams and phishing attacks. As a result of this incident, fundamental API security measures such as authentication, authorization, rate limiting, and safe handling of sensitive information need to be implemented. Furthermore, the incident emphasizes the importance of maintaining effective vulnerability disclosure programs and responding promptly when security researchers uncover security flaws. 

Security experts point out that the incident highlights one of the most common vulnerabilities in application security. There is no doubt that broken access control is one of the most critical risks in OWASP's Top 10. Issues with IDOR vulnerabilities persist across organizations of all sizes when developers implement authentication procedures without properly enforcing authorization procedures. 

Organizations collecting personal information, including commercial businesses, nonprofit organizations, and religious institutions, should implement robust security controls and maintain effective vulnerability disclosure processes as a result of this incident. Keeping user information secure is an integral part of every organization that has been given personal information.

Click to Pray illustrates that no organization is exempt from cybersecurity risks. Using strong access controls, secure API practices, and responding to vulnerabilities promptly remain essential for protecting user data and maintaining public trust in digital platforms.
Read more »
VPNs
compromised credentials Cyber Security Emails MFA Phishing ransomware software Sophos VPNs

Phishing and Compromised Identities Replace Software Exploits as Leading Ransomware Entry Ooint, Sophos Reports





Phishing campaigns, malicious emails and compromised credentials have overtaken software vulnerability exploitation as the leading entry points for ransomware attacks, according to Sophos' State of Ransomware 2026 report, signalling that threat actors are placing greater focus on stealing identities than breaking into unpatched systems.

The report is based on responses from 2,158 IT and cybersecurity leaders across 17 countries whose organisations experienced ransomware attacks during the previous year. While ransomware groups continue to encrypt data in a large share of incidents, the findings point to a clear change in how attackers gain their initial foothold inside enterprise networks.

Malicious email accounted for 26% of ransomware attacks, making it the most common root cause identified by respondents. Phishing followed closely at 24%, while compromised credentials were responsible for another 23% of incidents. In comparison, exploited vulnerabilities accounted for 18% of attacks, a sharp decline from 32% reported in the previous edition of the survey.

Taken together, email-based attacks and stolen credentials were responsible for nearly three-quarters of reported ransomware intrusions, showing that attackers are increasingly relying on social engineering and identity compromise instead of searching for vulnerable internet-facing systems.

Sophos also found that 67% of organisations described the ransomware incident as the most serious identity-related attack they encountered during the past 12 months. Across the surveyed organisations, almost four out of five ransomware attacks originated through compromised identities, placing user accounts and authentication systems at the centre of modern ransomware operations.

The findings also challenge a common assumption about multifactor authentication. Sophos reported that MFA had already been deployed in 97% of attacks where compromised credentials were identified as the root cause, yet attackers still succeeded in gaining access.

According to the company, the figures do not mean MFA has become ineffective. Instead, they point to weaknesses in deployment and the growing sophistication of credential theft techniques. Some organisations may have protected only part of their infrastructure, leaving legacy systems, remote access services or administrative interfaces outside MFA coverage. Those gaps can provide attackers with alternative routes into corporate environments.

Attackers have also refined methods for bypassing authentication protections. Adversary-in-the-middle phishing kits can intercept authentication sessions, while stolen browser cookies and authenticated session tokens allow attackers to access accounts without repeatedly triggering MFA challenges. MFA fatigue attacks, where users are bombarded with repeated authentication requests until one is approved, continue to be used against organisations relying on push-based authentication.

Among organisations using MFA, one-time passwords, push notification applications and passkeys were the most widely deployed authentication methods. FIDO2 security keys ranked behind those options despite offering one of the strongest defences against phishing because authentication is tied to legitimate websites and cannot be replayed through fake login pages.

Although software vulnerabilities no longer ranked as the leading ransomware entry point, Sophos cautioned that organisations should not reduce their focus on patch management. Instead, the report recommends pairing vulnerability remediation with stronger identity security controls to reduce opportunities for attackers to obtain valid credentials.

To reduce the risk of email-driven intrusions, Sophos recommends deploying advanced email filtering alongside domain authentication technologies including DMARC, DKIM and SPF. These controls help organisations verify legitimate senders, detect spoofed domains and prevent fraudulent emails from reaching employees. The company also recommends regular phishing awareness training to help users identify increasingly convincing social engineering campaigns.

Beyond email security, Sophos advises organisations to strengthen identity protection through Identity Threat Detection and Response (ITDR), enforce MFA across every access point and routinely review both human and machine identities to remove unnecessary privileges, dormant accounts and outdated credentials that could be abused during an attack.

Chet Wisniewski, director and global field chief information security officer at Sophos, said organisations with stronger ransomware resilience typically rely on multiple defensive layers rather than a single security control. Network segmentation can slow lateral movement after an initial breach, Zero Trust Network Access (ZTNA) reduces dependence on traditional VPNs, and continuous threat detection gives security teams more opportunities to identify malicious activity before ransomware spreads across the network.

The report also found that ransomware operators successfully encrypted data in 56% of reported attacks. Although median ransom demands and payments have fallen compared with previous years, the findings show that attackers continue to achieve their primary objective once they obtain access. For defenders, protecting identities has become just as important as patching software, with user accounts, credentials and authentication systems now representing the most frequently targeted path into enterprise environments. 

Read more »
malware
Apple Crash Reporter Apple malware CrashStealer MacOS Malware macOS Security malware

CrashStealer Malware Targets macOS Users by Posing as Apple Crash Reporter

 

A newly identified malware strain named CrashStealer is targeting macOS users by disguising itself as Apple's legitimate crash reporting utility. Designed as a C++-based infostealer, the malware is capable of stealing sensitive information, including login credentials, Keychain data, browser passwords, and cryptocurrency wallet information.

According to a research advisory published by Jamf on July 13, CrashStealer first came to light after researchers identified a suspicious sample uploaded to VirusTotal. The researchers believe the malware was under development since May before being deployed in active attacks.

CrashStealer mimics Apple's authentic crash reporting feature, which typically appears after an application crashes unexpectedly. The malware disguises itself using filenames such as CrashReporter.dmg for installation and CrashReporter.app for the application, along with an icon resembling Apple's legitimate software.

One of its notable tactics is displaying a fake macOS authorization prompt to trick users into entering their system password. Once entered, the malware verifies the credentials locally before attempting to extract information from browsers, password managers, Keychain, and cryptocurrency wallets. The stolen information is then encrypted and transmitted to an attacker-controlled server.

Signed Installer Helps Malware Evade Detection

The malware is distributed through a disk image packaged as "Werkbit Setup," which contains the malicious CrashReporter installer. Unlike many traditional malware campaigns, the installer carries a valid Apple Developer ID and notarization, allowing it to bypass Apple's Gatekeeper security checks during the initial launch.

The Jamf researchers said, "Because the dropper carries a valid Developer ID and a stapled notarization ticket, it clears Gatekeeper on first launch, in contrast to the ad-hoc-signed payload it installs."

As a result, the installer appears legitimate and may not immediately raise suspicion among users.

Researchers also highlighted other attack techniques increasingly targeting macOS users. One such method is ClickFix, a social engineering technique that convinces users to manually execute malicious commands by presenting fake troubleshooting instructions or CAPTCHA verification prompts.

Artificial intelligence is also emerging as a new distribution channel. Security researchers have observed malware such as Atomic macOS Stealer being spread through manipulated AI chatbot conversations that redirect users to malicious websites hosting malware payloads.

Security Experts Recommend Safe Download Practices

Cybersecurity experts note that macOS is no longer immune to malware threats, with attackers continuing to adopt more sophisticated techniques. The growing use of artificial intelligence in cybercrime is expected to further accelerate the evolution of these attacks.

To reduce the risk of infection, users are advised to download applications only from trusted sources, carefully verify unexpected password prompts, and regularly install macOS and application updates to benefit from the latest security patches.
Read more »
Malware attacks
Browser VPN Security Critical Infrastructure Cyber Attacks Cyber Security Ransomware Attacks Cybersecurity measures Malicious Software Malware attacks

US Treasury Sanctions VPN Provider Linked to Ransomware Operations

 

The United States Department of the Treasury has taken unprecedented steps by sanctioning a virtual private network (VPN) service provider and its administrator for the first time ever. The VPN was used by ransomware groups to disguise their digital footprints and launch attacks on businesses in the United States. The Treasury’s Office of Foreign Assets Control (OFAC) sanctioned First VPN Service (1VPNS) and its Ukrainian administrator, Dmytro Rashevskyi. 

In addition, the OFAC sanctioned Belarusian national Yegeniy Vladimirovich Silayev for allegedly selling cryptors – software used to camouflage ransomware and other malicious computer programs. According to the Treasury, ransomware groups that use the services of 1VPNS have already generated billions of dollars in losses for businesses and critical infrastructure in the United States. The victims of such attacks include hospitals, local governments, banks, and other organizations. 

The Treasury alleges that First VPN Service has been operating since 2014 and has been marketing itself on hacker forums as a privacy-focused provider that does not store any information on its users and does not respond to any legal requests. In addition, investigators allege that Rashevskyi used the nicknames Maksim Sorin and Roman Chabanenko to sign up for hosting services from other companies that had declined to provide services to First VPN Service due to illegal activities. 

Furthermore, the Treasury alleges that First VPN Service has been used to mask the Internet Protocol (IP) address of users who utilize the service to conceal their tracks on the web. In addition, the accused used the VPN to hide the origin of ransomware distribution, attack infrastructure, and exfiltrate data during cyber-espionage and ransomware operations. 

Silayev, who is not affiliated with First VPN Service, has been accused of selling encryption and obfuscation tools that enable malicious software to elude detection by cybersecurity software, thus increasing the software’s success rate. The sanctions imposed on the individuals and entities involved prevent them from accessing any property or funds in the United States or controlled by Americans. 

In addition, Americans are generally prohibited from dealing with them, and entities owned at least 50% by the sanctioned individuals or entities are also banned. According to the Treasury, the sanctions will disrupt ransomware cybercriminals’ ability to operate and deter organizations from supporting ransomware groups by continuing to offer their services. 

The action taken by the OFAC comes after an international law enforcement operation that dismantled First VPN Service in May 2026. During the operation, European authorities and the FBI searched 33 servers, one surface web domain, and one Tor domain, as well as a Ukrainian residence. 

In addition, investigators identified individuals who purchased the service from the company. The recent sanctions imposed by the Treasury on First VPN Service and its administrator follow the Treasury’s sanctions against the infrastructure of the 911 S5 botnet, which disrupted hundreds of thousands of computers using free VPN applications that doubled as anonymous proxy servers for cybercriminals in 2024.
Read more »
Infostealer
Cyber Fraud Fake Repositories GitHub Impersonation Attacks Infostealer

GitHub Fake Repos Spread Malware in New Infostealer Campaign

 

Cybersecurity researchers have uncovered a large-scale campaign in which hundreds of GitHub repositories were made to look like legitimate software projects while actually distributing malware. 

According to the report, the attackers created 292 fake repositories that impersonated security tools, developer utilities, macOS apps, games, and other popular software categories. Each repository included a polished README file that pushed visitors toward a download link on a separate malicious page. The tactic works because GitHub is widely trusted by developers and everyday users alike, making it an ideal place for criminals to hide harmful payloads behind a familiar interface. 

The campaign is linked to a new variant of the BoryptGrab infostealer family, which is designed to silently collect sensitive data once installed. Researchers say the malware targets passwords, cookies, payment information, browser sessions, and wallet credentials from 19 browsers and 32 cryptocurrency wallets. It also steals data from Telegram, Discord, Steam, Windows Credential Manager, and other applications. One particularly concerning detail is that the malware can bypass Chrome’s App-Bound Encryption by using code injection, showing that the operators built the payload to defeat modern browser protections. 

The attack appears to have begun in the last days of June, and most of the malicious repositories have now been removed. Even so, researchers noted that several dozen redirectors or related pages were still active at the time of reporting. That means users searching for free downloads or copies of premium tools could still stumble onto a fake repository or a spoofed landing page. The scale of the operation shows how quickly attackers can abuse open-source platforms when they know users are likely to trust project names, readmes, and download buttons without deeper verification. 

For users and organizations, the lesson is simple: treat any unsolicited GitHub download with caution. Always verify that a project comes from the official developer or vendor, and avoid installing software from repositories that rely on hidden ZIP files or external download pages. Security teams should also monitor for unusual browser credential theft, wallet activity, and suspicious outbound connections tied to newly installed software. In a threat landscape where attackers can make malicious code look polished and professional, careful source verification is one of the best defenses available.
Read more »
SourTrade Malware
Browser-Based Malware cryptocurrency security Cyber Crime Cyber Threats JavaScript Malware Malvertising Campaign Service Worker Attack SourTrade Malware

Browser Memory Becomes New Target in JavaScript Malware Campaign


 

Security researchers have discovered a large-scale malvertising campaign that uses fake cryptocurrency and trading websites to assemble malware inside the web browser of the victim, making it increasingly difficult to detect using traditional security tools. 

A security firm named Confiant claims the operation has been in operation since late 2024 and primarily targets retail traders and cryptocurrency investors in 12 countries. Asia-Pacific and Latin America regions are particularly targeted. In addition to supporting 25 languages, the campaign employs sophisticated filtering techniques to prevent researchers, automated scanners, and security bots from reaching malicious sites, as well as redirecting researchers and automated scanners to harmless blank pages to avoid damage. 

Security researchers, automated scanners, and bots are served empty pages before the fake websites are displayed in order to determine whether or not the users are legitimate targets. In contrast, retail traders and cryptocurrency investors receive convincing replicas of legitimate platforms when using selective filtering. By doing so, routine security scans are significantly reduced in the likelihood of detecting the infrastructure. 

Users are presented with websites that appear legitimate that offer software downloads by impersonating popular platforms such as Solana, Luno, and TradingView. By utilizing JavaScript techniques, the websites construct malware locally within the victim's browser memory rather than delivering a malicious file directly to the victim. It is said that the browser acts as a "local assembly pipeline" because it is capable of assembling malware rather than downloading a complete executable file.

As part of the attack, a Service Worker is registered to manage the download process, whereas a SharedWorker is created directly from JavaScript embedded within the webpage, so that the source code does not appear as a separate network request. 

After receiving the configuration file, the worker requests instructions for assembling the malware, including a template, randomized session values, and instructions. Each download is uniquely generated based on randomized parameters, thus producing a unique file hash for each victim. By utilizing this approach, the malware can bypass static detection methods that depend upon identifying known file signatures. 

Browsers download legitimate Bun runtimes from a secondary domain as part of the assembly process, and they combine them with attacker-controlled executable components and locally generated data as part of the assembly process. Since Bun is a legitimate component for building standalone Windows applications, attackers exploit this feature to disguise the final executable. 

Each session generates a unique file hash based on a random seed and file size, reducing the effectiveness of hash-based malware detection. By delivering the executable through the same domain that the website uses, the download appears legitimate from the browser's perspective, so that the download appears legitimate. 

Despite receiving Microsoft's Mark-of-the-Web security tag, network-based detection and forensic analysis are significantly more difficult without a fully transmitted malicious file. According to Confident, earlier versions of the campaign, tracked as SourTrade, used the open-source StreamSaver project to deliver malware.

Since April 2026, however, the operators have switched to using more sophisticated Service Worker-based delivery mechanisms. Researchers did not publicly identify the malicious payload for this campaign, but they linked it to Bitdefender's previous findings, which documented malware capable of intercepting internet traffic, stealing passwords and browser cookies, logging keystrokes, capturing screenshots, harvesting cryptocurrency wallet data, and maintaining persistence on compromised systems for a period of time. 

A Confident representative noted that the campaign does not exploit browser vulnerabilities or bypass Microsoft's Mark-of-the-Web (MotW) security features. Instead, it utilizes legitimate browser capabilities to deliver malware without transmitting a full executable over the network. In addition, researchers noted that there is currently no software patch available for this technique, which requires users to remain aware of and to practice safe software downloading practices to protect themselves. 

Earlier versions of the campaign used the open-source StreamSaver project hosted on GitHub to facilitate malware downloads, allowing investigators to trace its evolution from earlier versions. The operators replaced that approach in April 2026 with a Service Worker-based download mechanism, which encapsulates the entire delivery process within the impersonated website, making it increasingly difficult to analyze the network and detect malware. 

A security expert recommends downloading cryptocurrency and financial software from official vendor websites, avoiding sponsored advertisements or social media promotions, and verifying the digital signature and publisher of the application before installation. In light of the increasing stealthy techniques used by attackers to compromise users, these precautions remain critical. In light of the increasing sophistication of cybercriminals' malware delivery techniques, campaigns such as SourTrade underscore the challenges that defenders face. 

Through the use of legitimate browser functionality in order to assemble malware locally, attackers are able to bypass many traditional detection methods. It is recommended that you only download software from legitimate sources, verify digital signatures, and be wary of sponsored advertisements and promotional links relating to cryptocurrencies and financial institutions.
Read more »
windows
CAPTCHA ClickFix cryptocurrency Cryptominer Cyber Security Hardware PowerShell windows

Steam Forum Scam Uses ClickFix Technique to Infect Gamers With XMRig Cryptominer

 



Cybercriminals are targeting Steam users through fraudulent troubleshooting posts that exploit the increasingly common ClickFix social engineering technique, tricking gamers into manually executing malicious PowerShell commands that ultimately install cryptocurrency mining malware on Windows systems.

Rather than relying on software vulnerabilities, the campaign abuses trust within Steam's community discussion forums. Attackers reportedly create newly registered accounts and respond to users seeking help with problems such as game crashes, missing inventory items, or other technical issues. Their replies appear to offer legitimate troubleshooting steps, encouraging victims to launch Windows PowerShell with administrator privileges and paste a command that supposedly resolves the issue.

Instead of fixing the reported problem, the command downloads and installs XMRig, an open-source cryptocurrency mining application that has frequently been repurposed by cybercriminals to mine Monero using victims' computing resources without their knowledge or consent.

The campaign reflects the continued rise of ClickFix attacks, a social engineering method that persuades users to execute malicious commands themselves. These attacks typically imitate security checks, CAPTCHA verifications, software updates, or troubleshooting instructions that appear credible because they are presented as solutions to an existing problem. Since the victim willingly launches the command, the activity may evade security controls designed to block automatically executed malware.

The PowerShell script distributed in this campaign disguises itself as a Windows optimisation utility named "msf utility \ PC Opt." Once started, it displays what appear to be routine maintenance operations, including cleaning temporary files, flushing the DNS cache, updating drivers, checking disk health, disabling unnecessary startup applications, scanning for malware, repairing the Windows image, and running the System File Checker.

However, these operations largely serve as a visual distraction. Instead of performing meaningful system maintenance, the script displays convincing progress messages and introduces short delays to create the impression that legitimate optimisation tasks are taking place while malicious actions occur in the background.

The script's primary malicious routine first disables Transport Layer Security (TLS) certificate validation before confirming that it has been launched with administrator privileges. If elevated permissions are unavailable, execution stops after displaying an error requesting administrative access.

Once running with the required privileges, the malware establishes persistence by creating a directory within the Windows installation path and modifying Microsoft Defender settings to exclude that location from antivirus scanning. Excluding a directory from security scans reduces the likelihood that the installed malware will be detected or quarantined.

The script also checks for traces of previous installations by attempting to stop an existing scheduled task associated with the miner, terminating related processes, and removing older configuration files. While the exact purpose of this cleanup remains uncertain, it may help replace an earlier installation or remove conflicting miner components before deploying a fresh payload.

To retrieve the malware, the script temporarily creates an outbound Windows Firewall rule permitting network communication with an attacker-controlled server over TCP port 443. After downloading the payload, it verifies that the retrieved file is both non-empty and a valid executable before moving it into its final installation directory.

To maintain long-term access, the malware creates a scheduled Windows task configured to launch the XMRig executable automatically whenever the operating system starts. The task executes with SYSTEM privileges, giving the miner elevated permissions while allowing it to continue operating after reboots.

XMRig itself is a legitimate open-source cryptocurrency miner designed for authorised mining operations. However, threat actors frequently misuse the software in cryptojacking campaigns because it efficiently mines the privacy-focused cryptocurrency Monero, allowing attackers to generate revenue by exploiting compromised computers' CPU resources. Victims often experience unusually high processor usage, increased power consumption, system slowdowns, excessive fan activity, and reduced hardware lifespan.

This indicates a new wave in cybercriminal tactics. Rather than exploiting software flaws, attackers increasingly rely on convincing users to compromise their own systems through social engineering. ClickFix campaigns have been observed across multiple platforms in recent months, targeting individuals through fake browser alerts, fraudulent technical support pages, counterfeit software updates, and deceptive verification prompts.

Users should exercise caution when following technical advice posted by unknown forum members, particularly when instructions require launching PowerShell, Command Prompt, or other administrative tools. Legitimate game support rarely requires manually executing complex commands obtained from public discussion forums.

Systems that may have been exposed should be examined for unexpected scheduled tasks related to XMRig, suspicious Microsoft Defender exclusions, and unfamiliar files or folders created within protected Windows directories. A full antivirus scan should be performed immediately, and any malicious scheduled tasks, Defender exclusions, or installed payloads should be removed. Where compromise cannot be confidently ruled out, performing a complete operating system reinstallation may provide the most reliable method of restoring system integrity, as additional malicious activity may have occurred after the initial infection.

Read more »
US Treasury
Cyber Security Cybersecurity DomainME First VPN Service OFAC sanctions Pavel Durov ransomware t.me Telegram US Treasury

US Sanctions on VPN Service Briefly Disrupt Telegram’s t.me Link Shortener Due to Compliance Action

 

iTelegram's t.me link-shortening domain briefly went offline earlier this week after a compliance action linked to US sanctions inadvertently affected the entire domain instead of a specific Telegram link.

Users began reporting on Monday that t.me short links were inaccessible after the domain was placed under a "serverHold" status, effectively making it unavailable across the internet. The registry status suggested that the action had been initiated by the domain's registry operator, causing widespread disruption to Telegram's link-sharing functionality.

Following the outage, Telegram CEO Pavel Durov reached out to DomainME, the registry responsible for managing the .me top-level domain, requesting an investigation into the issue.

On Tuesday, DomainME clarified the reason behind the disruption, stating, "t.me was on hold due to the OFAC compliance, but it is back online now."

The reference to OFAC points to the US Treasury Department's Office of Foreign Assets Control, which oversees and enforces US economic and trade sanctions. The same day the domain became unavailable, OFAC announced sanctions against First VPN Service, alleging that the platform had been used by multiple ransomware groups to conceal malicious activities targeting US businesses, hospitals, and government organizations.

As part of the sanctions, OFAC designated the VPN service's alleged administrator, Ukrainian national Dmytro Rashevskyi, along with associated infrastructure, including the domains 1vpns.com and 1vpns.net, as well as cryptocurrency wallet addresses. The sanctions are intended to prevent US individuals and businesses from engaging with the VPN provider.

According to reports, the sanctions documentation specifically referenced the Telegram support link t.me/FirstVPNService. This appears to have led to an unintended compliance action in which the entire t.me domain was placed on hold instead of only the sanctioned Telegram link.

In a subsequent statement, DomainME said, "the .ME Registry works closely with law enforcement to monitor and mitigate issues across the .ME domain in accordance with applicable laws, including sanctions requirements." The company suggested that the suspension was part of its sanctions compliance process rather than a simple technical error.

The t.me domain has since been restored and now redirects users to Telegram's primary website.

Meanwhile, the FBI has warned that First VPN Service, operational since 2014, has been widely used by cybercriminals. Investigators say at least 25 ransomware groups have relied on the VPN platform. While the service promoted itself as a privacy-focused VPN, authorities allege it has also been connected to botnet operations, distributed denial-of-service (DDoS) attacks, online scams, and hacking campaigns.

The FBI further stated, “First VPN Service was almost exclusively advertised in known criminal dark web forums such as Exploit[.]in and XSS[.]is, two of the most prominent Russian-language online forums which provide marketplaces for cyber criminals to buy and sell unauthorized access to computer systems, stolen personal identifying information, hacking tools, and contraband,” the agency added.
Read more »
Subscribe to: Posts (Atom)