Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Malware Attack. Show all posts
Malware Attack
Customer Data Data Breach Data Leak data security Digital Personal Data Protection Employee Data Breach Malware Attack

Nippon Columbia Malware Incident Puts 8.6 Million Customer Records at Risk

 

Japanese entertainment group Nippon Columbia hit with malware, affecting more than 8.7 million customers and employees' personal data, according to karaoke system maker Daiichi Kosho. The company asked its customers to be cautious, but it is still unclear if their personal information was stolen or leaked. 

Daiichi Kosho, Japan’s biggest karaoke company, owns 521 karaoke places and provides services for the well-known chain of Big Echo. They rely on Nippon Columbia Group (NCG) to provide customer information. NCG’s businesses range from music creation, video and game software development and distribution to artist management, making it an important supplier for the karaoke entertainment sector. 

The issue was raised when NCG notified Daiichi Kosho of the incident on October 5 when the malware was found on one of the staff member's computers, which was then isolated the next day. The company then proceeded to reset all the passwords and other authentication methods and investigate the incident to determine its scope and origin. 

According to Daiichi Kosho's statement, the affected information includes approximately 8,631,000 customers and 93,000 employees of the company, and it may include the full name, gender, date of birth, email address, and phone number of the affected individuals. BIG ECHO, MEGA BIG, Karaoke CLUB DAM, Banana Club, B-GARAGE and DK Dining entertainments' users should be particularly wary of the security breach, as it could affect their data the most. 

Daiichi Kosho reiterated that their information was not at risk and that the data contained in the breach does not include the passwords. Additionally, the company stated that there was no suspicion of unlawful interference with customer loyalty points. On the other hand, they are still not certain if the information was stolen or if it was leaked online. They are investigating the breach to find out if the data was shared, what the scope of the problem was, and if the information was shared. 

The latest statement did not mention anything else about the possible leak. Customers are advised to protect themselves from scams, deception, and unlawful access to their personal information. They should be wary of strange emails, text messages, and phone numbers and avoid providing any personal and financial information. If the crooks managed to collect and compile the data of these users, it would be easy for them to engage in phishing schemes and similar scams. 

BleepingComputer, as of the time of publishing this article, has not been able to find any official statement from Nippon Columbia Group about the incident. They mentioned that they contacted the company for an official comment, and they are still waiting for the response. Until an official statement is issued, the possible data theft remains an issue, as it raises several questions about the safety of the companies' data and the safety of customers' personal information.
Read more »
Remote Access Trojan
ChatGPT Custom GPTs ClickFix Cyber Attacks DLL Sideloading Malware Attack PowerShell Malware RAT Malware Remote Access Trojan

Cybercriminals Misuse ChatGPT Custom GPTs in ClickFix RAT Attacks


ChatGPT Custom GPTs are being abused by threat actors as an entry point for malware campaigns, redirecting users to malicious websites using fake artificial intelligence assistants. A campaign identified by Huntress in which attacker-controlled Custom GPTs were impersonating legitimate ChatGPT offers and directing victims to ClickFix scams has been identified. 

A total of 40 incidents associated with the same Google Sites infrastructure were linked to the campaign, and two of these cases have been confirmed to originate from malicious Custom GPTs. OpenAI reported a GPT that had been identified and removed on September 25, however two days later researchers identified another GPT that had been connected to the same campaign. 

The attack is initiated by a Custom GPT that appears to be a genuine ChatGPT service. It has been reported that some victims have reached the malicious GPT by searching for ChatGPT on Google and clicking a sponsored result. While the page itself remained hosted on the legitimate ChatGPT domain, the GPT was titled Plus 5.6, giving the appearance that it was an official model. 

A false message claiming that the primary domain was restricted to a limited number of users was displayed when the GPT was opened. After that, the website directed users to a fake backup website hosted on Google Sites, where a false Cloudflare CAPTCHA was displayed and a technique known as ClickFix was utilized to entice the victim into manually executing a command. 

PowerShell is launched by the command to retrieve an obfuscated script, which is temporarily saved before executing. After a silent download of a malicious MSI package named ISOSimple.msi, the script silently installs it. During the subsequent attack chain, the installer appears to be a legitimate Canon-signed application that is used to install an “Advanced Printer Configuration Reader”. 

Even when security software detected part of the payload, the infection was designed to remain active. One incident involved Microsoft Defender quarantining ISOSimple.msi as Trojan:Script/Wacatac.H!ml, because it had already set up a Run key and a scheduled task called “Canon Configuration Reader.” These keys and tasks allowed the malware to continue running on the computer. 

DLL sideloading is the next stage. With the MSI, the legitimate Canon COTFileReadApp.exe is installed, which has a valid digital signature, making the malicious package appear less suspicious. Attackers inserted a modified logging library alongside the executable, causing the legitimate Canon application to load malicious code through Windows' DLL search process as a result. 

The sideloaded code then extracts the next payload from a .wav file included in the installer Even though the file contains authentic audio data at the beginning and a valid WAV header, there are later sections that contain encrypted data that is decoded in memory. 

To avoid simple file-based detection, the loader retrieves an encrypted archive containing the malware and its persistence components and eventually eliminates straightforward file-based detection. There are 315 folders and 806 files contained within the archive, known as monitor.raw, which has a custom encrypted file structure. It contains a persistence script that continuously checks the registry for the malware's run entry and scheduled task, and recreates them if they are removed. 

In both instances, the infection can be re-executed by launching the Canon executable under the name "Canon Configuration Reader" by launching the Canon executable. An advanced Remote Access Trojan is attached to the final payload, which can provide access to the computer's desktop and screen, capture input from the camera, microphone, and audio system, and search for files on the computer. 

Additionally, the program collects information regarding security software installed, Windows configuration, network adapters, open ports, software installed and hardware installed. Command-and-control communication is carried out through DNS-over-HTTPS via services such as Cloudflare, Google, and Quad9, allowing its network traffic to blend in with legitimate encrypted web traffic.

In addition to downloading and executing additional EXE, DLL, MSI, PowerShell, and script-based payloads, attackers can extend activity beyond the initial compromise by downloading additional payloads. After removing the first Custom GPT from the campaign, Hunters discovered a second version. In addition to keeping the underlying RAT unchanged, the attackers replaced the Canon-based execution chain with a modified DLL and signed Stardock executables. 

In addition, the loader was moved from the WAV file into a Microsoft NuGet package, demonstrating that the delivery components can be changed without replacing the core malware. A second variant included additional measures to make detection more difficult, including freshly obfuscated download scripts and the removal of Windows Mark-of-the-Web tags before the MSI was executed. 

Nonetheless, the main behavior remained the same: MSI installation resulted from PowerShell activity, malicious code was loaded from a legitimate signed application, and persistent registry and scheduled task access was maintained. 

Therefore, security researchers advise that detection should be focused on behavior connecting these stages rather than relying solely on specific filenames or trusted software brands. It is possible to detect this type of attack by suspicious PowerShell activity followed by Msiexec, signed applications running from unusual locations, unexpected DLL loading, and newly created Run keys and scheduled tasks.
Read more »
Malware Attack
Cyber Attacks Cyber Phishing Cyber websites Cybersecurity Platform Fraudulent Message Freelancers Malicious Content Malware Attack

Russian National Charged Over Malware Campaign Targeting 80,000 Freelancers

 


A Russian national has been extradited to the United States to face federal charges over an alleged malware campaign that targeted approximately 80,000 users of a freelance employment platform.

Searzhudin Tamirlanovich Aktulaev, 40, is accused of using hundreds of fraudulent accounts to distribute malicious Microsoft Excel attachments between June 2016 and November 2017. Prosecutors allege that the attachments downloaded remote-access malware capable of controlling victims’ computers and stealing information.

The indictment was filed under seal on June 1, 2021. Aktulaev was arrested in Cyprus in May 2025 and extradited to the United States on August 28, 2026, according to the US Department of Justice.

He appeared in federal court in San Francisco on August 31 and was remanded to federal custody. The indictment was unsealed the same day.

Fake Freelance Accounts Distributed Malicious Excel Files

According to prosecutors, Aktulaev and his alleged co-conspirators exploited the messaging system of a well-known freelance employment technology company located in California’s Northern District.

The DOJ did not publicly identify the company.

The conspirators allegedly created approximately 255 fake user accounts and used them to send messages containing malicious Excel attachments to around 80,000 freelancers.

Opening an attachment prompted the recipient to enable or execute an embedded macro. If the user complied, the macro downloaded malware from the internet.

This distinction is important: the indictment alleges that malware was distributed to approximately 80,000 users, but the DOJ announcement does not establish that every recipient opened the attachment or became infected.

Freelancers can be particularly exposed to attachment-based attacks because their work routinely involves receiving documents from unfamiliar prospective clients. A spreadsheet presented as a project brief, financial record or work assignment may therefore appear consistent with an ordinary business request.

TVRAT and DarkVNC Provided Remote Access

The indictment identifies two malware families allegedly used in the campaign: TVRAT and DarkVNC.

TVRAT, also known as TVSPY or TeamSpy, incorporated or abused components associated with TeamViewer, a legitimate remote-administration product. DarkVNC provided similar hidden remote-control capabilities using Virtual Network Computing technology.

Prosecutors allege that the malware allowed the conspirators to control infected computers and transfer stolen data to command-and-control servers.

The use of recognizable remote-access components can help criminals disguise malicious activity as legitimate administrative traffic. It can also make detection more difficult when organizations permit remote-support products in their environments.

The allegations do not indicate that TeamViewer or VNC Viewer participated in the operation. The case concerns malware that allegedly misused remote-administration technology.

Thousands of Computers Connected to US-Based Infrastructure

Court allegations state that domains supporting the command-and-control infrastructure were purchased using virtual currency. At least one command-and-control domain was hosted in the United States, and thousands of computers infected with TVRAT reportedly connected back to it.

Investigators discovered a database on the command-and-control infrastructure containing information associated with thousands of victims.

The DOJ also said a shared document stored in an email account used during the alleged criminal activity contained e-commerce login credentials and personally identifiable information belonging to hundreds of people.

Prosecutors allege that information stolen through TVRAT and DarkVNC was collected from the command-and-control servers and used by Aktulaev and his co-conspirators to conduct fraud and other criminal activity.

Approximately half of the identified victims were located in the United States. The DOJ said many—not all—of those US victims were in the Northern District of California, where the federal case is being prosecuted.

Aktulaev Faces Multiple Federal Charges

The indictment charges Aktulaev with conspiracy, aggravated identity theft and transmitting code or commands that caused damage to protected computers. It also includes allegations involving wire fraud, unauthorized computer access and obtaining information or value from compromised systems.

The most serious listed offense, conspiracy to commit wire fraud, carries a maximum potential sentence of 20 years in prison. A charge involving intentional damage to protected computers carries a maximum of 10 years, while aggravated identity theft can result in a mandatory consecutive two-year sentence for each conviction.

These are maximum statutory penalties rather than a predicted sentence. Any punishment would depend on which charges, if any, result in conviction and the federal court’s consideration of applicable sentencing rules.

Aktulaev is scheduled to appear before US District Judge Donato on October 5, 2026, for a status conference.

The FBI investigated the case, which is being prosecuted by the National Security, Cyber, and Special Prosecutions Section of the US Attorney’s Office for the Northern District of California. The Justice Department’s Office of International Affairs secured the extradition from Cyprus.

The Campaign Predates Aktulaev’s Arrest

The alleged campaign operated from 2016 to 2017. The indictment was filed in 2021, approximately four years after the campaign ended—not four years after Aktulaev’s arrest.

Aktulaev was arrested in Cyprus in May 2025 and extradited more than a year later. The DOJ has not explained why the indictment remained under seal or provided details about the extradition proceedings.

Because the case is at the indictment stage, all described conduct remains an allegation. Aktulaev is presumed innocent unless prosecutors prove the charges beyond a reasonable doubt.

Read more »
Malware Attack
Android Android Ecosystem Android Trojan BTMOB Malware Cyber Security Malware Attack

BTMOB Android RAT Ecosystem Expands With Resellers, Source-Code Sellers and Impersonators

 

The Android remote access trojan known as BTMOB most likely began as a centralized malware-as-a-service operation but transformed into a wider ecosystem, with resellers, source code buyers, rogue operators, and possibly even impersonators, according to the Flare researchers. BTMOB is a remote access trojan for Android devices that takes the form of malware-as-a-service.

It offers an “exploit chain,” that is, a malicious application, droppers, a payload builder, a Windows operator panel, servers, and phishing and credential-stealing tools. All of the components may be purchased in various combinations, depending on the chosen subscription plan. Some of the options include private infrastructure, customized builds, and technical support. The Flare researchers analyzed thousands of relevant forum and chat threads to document BTMOB’s activity and distribution channels. 

They tracked the malware’s progress from its first appearances in mid-2025 to the present day. In their findings, the researchers observed that while an official channel was distributing the service and its components, other purportedly independent channels and forums sold subscriptions, reseller panels, code, and even alternative versions of the malware under the same name. In particular, the official account announced the V2 of the malware for rent or sale for $700 per month, $3,000 for a lifetime subscription or $5,000 with additional monthly payments for the private infrastructure and support. Less than a month later, the same account announced technical issues and claimed that over 4,000 devices were connected to BTMOB’s servers. 

According to the researchers, the account advertised a full source code and setup instructions for BTMOB for $20,000. The package included PHP and Node.js server components, a VB.NET control panel and Java Android code. The advertised source-code price later fell to $10,000 in May 2025. Additionally, they noticed that the Spanish/Portuguese Telegram channel had an issue between two admins, one of whom left the project. The main channel then announced that from now on, all the administrators would function independently. 

It also stated that one of them, based in Brazil, had bought the source code and was running his own fork of BTMOB. After that, the secondary market appeared and started advertising much cheaper alternatives to the official subscription. In particular, one Telegram campaign announced the lifetime access to version 4.1.2 and 4.2 of BTMOB for $500 and purported RAT and server source code for $1,500. Other channels and forums also offered subscriptions, reseller panels, source code, and lifetime accounts for different prices and conditions.  

It is unclear whether the accounts offering the alternative versions of BTMOB are legitimate or not, as many of them could have used pirated materials or have been scams. For example, the official account warned all their partners that there is only one official BTMOB channel and that other accounts do not represent the company and are not affiliated with it. 

Nevertheless, the official account advertised the V4.1 release in February 2026 and V4.5 in April 2026. According to the announcement, the subscription for the private server hosting of several accounts costs about $1,200 lifetime account, a $3,000, and the source code for the server itself costs $7,000.
Read more »
Scams
CyberCrime Malware Attack Microsoft Operation Endgame Ransomware Scams

Operation Endgame Disrupts Global Cyber Crime Assembly Line


Private companies and international authorities have disrupted a malicious “assembly line” that let hackers steal millions of login details and theft of $47 million in ransom payments via extortion. The operation aimed at catching two tools that are used in online scams.

The first tool is called Amadey, a malware-as-a-service platform for disrupting devices and deploying infected payloads for ransomware and related attacks. Amadey was first discovered in 2018 and in 2025, it exploited GitHub as it stored system info from malicious devices and deployed custom payloads.

The second tool is called StealC, it is an infostealer-as-a-service tool that steals cryptocurrency wallets, browser extensions, authentication cookies, and login credentials.

Disrupting a crucial link in the cyberattacks chain

Amadey and StealC are distinct tools that function autonomously. They are widely used, but many people use them in their personal cybercrime operations. 

The tools depend on the same infrastructure to function. Microsoft made this link after analyzing the tools using AI. The discovery allowed Microsoft to stop both tools simultaneously.

“This action goes after the cybercrime ‘assembly line,’ where coordinated tools drive ransomware, financial fraud, and disruptions to public services. Amadey and StealC are often used alongside each other: Amadey helps attackers gain access to devices, while StealC steals passwords and sensitive information. Together, they form a critical link in the chain,” Microsoft said.

About the investigation

Companies gathered proof that the tools shared the same infrastructure and invoked RICO statutes against organized crime. This resulted in treating the two tools as part of a single scam. 

Microsoft has disrupted over 200 C2 servers and shut down criminal control of over 18,000 compromised computers. Europol also assisted in the operation to track down the culprits and recovered around 27 million stolen login details and found $47 million worth of crypto assets tied to cybercriminals.

“During this action, 326 servers and 142 domains were actioned by law enforcement and the private sector partners, severely crippling the malware’s distribution network. By taking down these tools simultaneously, the collaboration between law enforcement and private parties has increased friction for cybercriminals, making it harder for attacks to succeed, spread, or recover,”  Europol said.

Operation Endgame

Other firms that helped in “Operation Endgame” are ESET, IBM X-Force, ESET, Mitsui Bussan Secure Directions, and Bitsight. 

According to Europol, another tool that disrupted Operation Endgame was SocGholish. It is a malware installer tied to the Russian cybercrime group Evil Corp. that distributes via hacked websites. If you visit such sites, you will be tricked into installing malware apps mimicking as browser extensions or genuine software.  

Read more »
Microsoft Security Flaw
Backdoor Malware Cyber Attacks Cyber Security Ransomware Attacks Exploitation Malware Attack Microsoft security Microsoft Security Flaw

Edgecution Malware Exploits Microsoft Edge Extension to Deploy Python Backdoor in Ransomware Attack

 

One way hackers adapt is by twisting legitimate features into tools for harm. A recent example shows a malicious Microsoft Edge extension escaping the browser’s restricted environment to establish persistent access on infected systems. 

Researchers named the campaign Edgecution, which abuses built-in browser functionality rather than software flaws. The payload deploys a Python-based backdoor capable of silently executing commands on compromised devices. Researchers at Zscaler believe the campaign is linked to an Initial Access Broker associated with the Payouts Kings ransomware operation. 

Instead of exploiting vulnerabilities, the attackers rely on social engineering and legitimate browser capabilities to gain deeper access to victim systems. The attack begins with someone impersonating IT support on Microsoft Teams, directing employees to a fake Microsoft update page under the pretense of installing an email security update. 

Victims see what appears to be an official Outlook update portal, but clicking its buttons instead downloads malware, copies malicious scripts to the clipboard, or requests Microsoft 365 and Outlook credentials. What looks like a routine update quickly turns into a compromise. The downloaded package contains intentionally malformed ZIP headers to evade security scanners. 

Once executed, scripts repair the archive, extract hidden files, configure the system, and create scheduled tasks that silently launch Microsoft Edge in the background. Inside the package are two main components: a malicious Microsoft Edge extension disguised as an Edge Monitoring Agent and a Python-based backdoor. The extension communicates with attacker-controlled servers, receiving commands and sending back results. 

Although browser extensions normally operate inside isolated sandboxes, this attack bypasses those restrictions. Attackers abuse Chrome’s Native Messaging protocol—a legitimate feature that allows browser extensions to communicate with trusted desktop applications. By leveraging this mechanism, the malicious extension launches the bundled Python backdoor as a native application, escaping the browser’s security boundaries.  

Once active, the Python backdoor enables attackers to execute shell commands, run PowerShell and arbitrary Python code, write files, enumerate running processes, and collect system information. Helper scripts generate the Native Messaging manifest and batch files needed to connect the extension with the local application. 

The malicious extension runs inside a headless Microsoft Edge session, remaining invisible to users while maintaining persistent access that is difficult to detect. Zscaler also identified unused commands within both malware components, indicating the framework is still under development and could gain additional capabilities in future versions. 

According to researchers, Edgecution highlights the growing sophistication of ransomware campaigns. Rather than relying solely on traditional malware, attackers increasingly exploit trusted browser features and enterprise collaboration platforms to bypass security defenses. 

To reduce the risk, organizations should closely monitor browser extensions, restrict Chrome Native Messaging where possible, review native messaging host configurations, and train employees to recognize social engineering attempts delivered through platforms such as Microsoft Teams. Zscaler has also published indicators of compromise, including malicious extension hashes and command-and-control servers, to help defenders identify affected systems.
Read more »
Technology
AI Claude Crypto Data Malware Attack Technology

Hackers Exploit Fake Claude Code Installers and Install Malware


Developers looking into Claude Code deployment instructions could be lured into an advanced malware campaign that hides itself as a genuine AI tooling documentation. 

Fake Claude code exploit

Experts found a few fake Claude Code and developer platform websites built to steal credentials, cryptocurrency, and API keys.

According to Straiker researchers, “the attack chain runs on the same unchecked trust that makes AI developer tools so easy to adopt.  “You copy a command. You paste it in your terminal. By then, it’s already too late,” said Straiker researchers in their analysis of the campaign. 

Highlights of the fake Claude code campaign 

1. Experts found over 88 fake domains mimicking Claude Code and other developer sites. The campaign utilises SEO infection and Google ads to deploy malicious install web pages over genuine documentation.

2. Threat actors hide infected commands within genuine installation commands, without impacting the deployment process.

3. The malware particularly attacks AI-based assets such as cloud development credentials, API keys, and verification tokens.

About the credential theft campaign 

The campaign attacked users of famous AI and developer tools, such as Claude Code, JetBrains, Perplexity Comet, and Cline. 

As per the experts, the operation depends on over 88 domains hosted throughout genuine platforms and constantly shuffles infrastructure, letting malicious sites to immediately resurface after shutdowns. To trap targets, threat actors use redirect chains, SEO poisoning and paid Google ads that place scammed installations over genuine documentation in search results.

These websites closely impersonate genuine vendor resources and demonstrate installation commands that look genuine but include hidden separators, such as “&,” that launch malicious actions along with the expected software deployment.

In various incidents, the genuine command still runs effectively, helping hide the hack.

Delivery of malware and launch tactics

Experts found various delivery techniques, such as rundll32.exe loading infected DLLs, Base64-encoded commands, mshta.exe abuse, JavaScript-based payloads, and GitHub-hosted scripts. 

By such techniques, hackers improve their potential to escape convention detection tools. Contrary to infostealers, the campaign pick on AI assets like authentication tokens, API Key, and cloud development credentials from tools such as Continue[.]dev, Cline. 

After execution, the malware uses a multi-level malicious chain that features encoded C2 communications, anti-analysis capabilities, fileless execution tactics, and credential theft functions.

Experts found the primary payload as ACRStealer, a malware family that steals information and has developed to include sophisticated encryption and escape tactics. Experts also identified a cryptocurrency clipboard hacker that rediverts transactions by replacing copied wallet addresses.

Read more »
Malware Attack
Cyber Attacks Cyber Breaches Cyber websites data security Fake Windows Linux Linux Malware Malware Attack

JDownloader Website Breach Spreads Malware Through Fake Windows and Linux Installers

 

In early May 2026, the official website for JDownloader was compromised, causing users to unknowingly download infected installers instead of legitimate software. During the two-day breach window, attackers replaced Windows and Linux setup files with malicious versions carrying hidden malware. Researchers later discovered that the Windows payload deployed a stealthy Python-based remote access trojan capable of giving attackers control over infected systems. 

Because the files appeared authentic and came directly from a trusted source, many users installed them without suspicion. JDownloader remains one of the most widely used download automation tools, supporting downloads from hosting services, streaming sites, and premium file-sharing platforms across Windows, Linux, and macOS. Its long-standing reputation and large user base made the attack especially dangerous, as users naturally trusted downloads from the official website. 

The issue first gained attention after a Reddit user reported Microsoft Defender warnings while downloading updated installers from the JDownloader website. The files showed suspicious digital signatures linked to unknown names like “Zipline LLC” and “The Water Team” instead of AppWork GmbH, the legitimate developer. Community concern quickly spread online, prompting the development team to investigate. 

Soon after, JDownloader confirmed that attackers had exploited an unpatched flaw in the site’s content management system to modify download links and redirect users toward malicious third-party installers. Developers stated that the compromise was limited to public-facing web content and did not extend to deeper server infrastructure or operating system-level access. The team later clarified that only the Windows “Alternative Installer” downloads and Linux shell installer links were affected. 

Other distribution channels, including macOS packages, Flatpak, Winget, Snap releases, in-app updates, and the main JAR package, remained secure throughout the incident. Developers urged users to verify installer authenticity by checking digital signatures within file properties. Legitimate files should display a verified signature from AppWork GmbH, while unsigned installers or files signed by unfamiliar publishers should be avoided immediately. 

Cybersecurity researcher Thomas Klemenc later analyzed the malicious Windows files and found they acted as loaders for a heavily obfuscated Python-based remote access tool. According to his findings, the malware could execute remote commands through command-and-control servers, silently turning infected devices into attacker-controlled systems. Analysis of the Linux shell installer also uncovered injected malicious code designed to download disguised payloads from suspicious domains. 

Once executed, the malware installed hidden binaries, created persistence mechanisms, elevated privileges using root-level configurations, and disguised itself as legitimate Linux system processes to avoid detection. Experts noted that parts of the Linux malware remain difficult to fully understand because the payload was heavily protected using obfuscation tools like Pyarmor, limiting deeper analysis. 

Although JDownloader stressed that only users who downloaded and executed installers during the breach window were at risk, security professionals strongly recommend reinstalling operating systems on infected machines. Since arbitrary code execution was possible, experts also advise resetting all passwords after cleaning affected devices due to potential credential theft. 

The attack reflects a growing cybersecurity trend in which hackers target trusted software platforms to distribute malware through compromised downloads. Similar incidents recently affected CPU-Z, HWMonitor, and DAEMON Tools, where attackers replaced legitimate installers with infected versions carrying hidden malware.  

As supply chain attacks continue increasing, cybersecurity experts stress the importance of checking digital signatures carefully and avoiding suspicious downloads, even on trusted software platforms.
Read more »
Malware Attack
Armenia Cyber Crime Cyberattacks cybersecurity attacks Data Theft Infrastructure Security Malware Attack

Armenian Suspect Extradited to US Over Role in RedLine Malware Operation

 

A man from Armenia now faces trial in the U.S., accused of helping run a major cybercriminal network recently uncovered. On March 23, authorities took Hambardzum Minasyan into custody; later that week, he stood before judges in Austin. Officials there detailed how he supposedly aided the RedLine scheme behind the scenes.  

Minasyan faces accusations tied to overseeing parts of a malicious software network, say U.S. justice officials. Hosting setups involving virtual servers - central to directing attacks - are part of what he allegedly handled. Domain registrations connected to RedLine operations were reportedly arranged by him. File-sharing platforms built under his direction may have helped spread the program to users. Control mechanisms behind these actions remain outlined in official claims. 

After deployment, RedLine grabs private details like banking records and passwords from compromised devices. This stolen data often ends up traded or misused by online criminals. One key figure, Minasyan, allegedly helped manage core infrastructure alongside others involved. Control dashboards used by partners in the scheme were reportedly maintained through their efforts.  

Besides handling infrastructure tasks, Minasyan faces claims he helped run money flows for the network. A digital currency wallet tied to him supposedly managed transactions among members and moved profits from compromised information. Officials report that the team continuously assisted people deploying the malicious software, guiding attack methods while boosting earnings.  

Facing several accusations today, Minasyan is charged with using unauthorized access devices, breaking rules under the Computer Fraud and Abuse Act, along with plotting ways to launder money. A guilty verdict might lead to a maximum penalty of three decades behind bars.  

A wave of global actions has tightened pressure on RedLine operations. Early in 2024, teams from several countries joined forces - among them officers from the Dutch National Police - to strike key systems powering the malware network. This push formed what officials later called Operation Magnus, a synchronized disruption targeting how the service operated. 

Instead of selling outright, its creators let hackers lease access; investigators focused sharply on this rental setup during their work. A federal indictment names Maxim Alexandrovich Rudometov, a citizen of Russia, as central to creating the malicious software. Should he be found guilty, extended penalties may apply due to further allegations tied to his role. 

A closer look reveals persistent attempts worldwide to weaken structured hacking groups while targeting central figures for responsibility. Despite challenges, momentum builds as actions cross borders to undermine digital criminal systems.
Read more »
Malware Attack
AI Risks APT36 APT36 Cyber Espionage APT36 hackers Cloud Security cyber espionage Cyber Espionage Campaign Cyber Security Google Sheets API abuse Malware Attack

APT36 Uses AI-Generated “Vibeware” Malware and Google Sheets to Target Indian Government Networks

 

Researchers at Bitdefender have uncovered a new cyber campaign linked to the Pakistan-aligned threat group APT36, also known as Transparent Tribe. Unlike earlier operations that relied on carefully developed tools, this campaign focuses on mass-produced AI-generated malware. Instead of sophisticated code, the attackers are pushing large volumes of disposable malicious programs, suggesting a shift from precision attacks to broad, high-volume activity powered by artificial intelligence. Bitdefender describes the malware as “vibeware,” referring to cheap, short-lived tools generated rapidly with AI assistance. 

The strategy prioritizes quantity over accuracy, with attackers constantly releasing new variants to increase the chances that at least some will bypass security systems. Rather than targeting specific weaknesses, the campaign overwhelms defenses through continuous waves of new samples. To help evade detection, many of the programs are written in lesser-known programming languages such as Nim, Zig, and Crystal. Because most security tools are optimized to analyze malware written in more common languages, these alternatives can make detection more difficult. 

Despite the rapid development pace, researchers found that several tools were poorly built. In one case, a browser data-stealing script lacked the server address needed to send stolen information, leaving the malware effectively useless. Bitdefender’s analysis also revealed signs of deliberate misdirection. Some malicious files contained the common Indian name “Kumar” embedded within file paths, which researchers believe may have been placed to mislead investigators toward a domestic source. In addition, a Discord server named “Jinwoo’s Server,” referencing a popular anime character, was used as part of the infrastructure, likely to blend malicious activity into normal online environments. 

Although some tools appear sloppy, others demonstrate more advanced capabilities. One component known as LuminousCookies attempts to bypass App-Bound Encryption, the protection used by Google Chrome and Microsoft Edge to secure stored credentials. Instead of breaking the encryption externally, the malware injects itself into the browser’s memory and impersonates legitimate processes to access protected data. The campaign often begins with social engineering. Victims receive what appears to be a job application or resume in PDF format. Opening the document prompts them to click a download button, which silently installs malware on the system. 

Another tactic involves modifying desktop shortcuts for Chrome or Edge. When the browser is launched through the altered shortcut, malicious code runs in the background while normal browsing continues. To hide command-and-control activity, the attackers rely on trusted cloud platforms. Instructions for infected machines are stored in Google Sheets, while stolen data is transmitted through services such as Slack and Discord. Because these services are widely used in workplaces, the malicious traffic often blends in with routine network activity. 

Once inside a network, attackers deploy monitoring tools including BackupSpy. The program scans internal drives and USB storage for specific file types such as Word documents, spreadsheets, PDFs, images, and web files. It also creates a manifest listing every file that has been collected and exfiltrated. Bitdefender describes the overall strategy as a “Distributed Denial of Detection.” Instead of relying on a single advanced tool, the attackers release large numbers of AI-generated malware samples, many of which are flawed. However, the constant stream of variants increases the likelihood that some will evade security defenses. 

The campaign highlights how artificial intelligence may enable cyber groups to produce malware at scale. For defenders, the challenge is no longer limited to identifying sophisticated attacks, but also managing an ongoing flood of low-quality yet constantly evolving threats.
Read more »
Malware Attack
AI Agent AI agent data theft Cyber Security Data Theft Infostealer Infostealer Malware Malware Attack

Infostealer Malware Targets OpenClaw AI Agent Files to Steal API Keys and Authentication Tokens

 

Now appearing in threat reports, OpenClaw — a local AI assistant that runs directly on personal devices — has rapidly gained popularity. Because it operates on users’ machines, attackers are shifting focus to its configuration files. Recent malware infections have been caught stealing setup data containing API keys, login tokens, and other sensitive credentials, exposing private access points that were meant to remain local. 

Previously known as ClawdBot or MoltBot, OpenClaw functions as a persistent assistant that reads local files, logs into email and messaging apps, and interacts with web services. Since it stores memory and configuration details on the device itself, compromising it can expose deeply personal and professional data. As adoption grows across home and workplace environments, saved credentials are becoming attractive targets. 

Cybersecurity firm Hudson Rock identified what it believes is the first confirmed case of infostealer malware extracting OpenClaw configuration data. The incident marks a shift in tactics: instead of stealing only browser passwords, attackers are now targeting AI assistant environments that store powerful authentication tokens. According to co-founder and CTO Alon Gal, the infection likely involved a Vidar infostealer variant, with stolen data traced to February 13, 2026. 

Researchers say the malware did not specifically target OpenClaw. Instead, it scanned infected systems broadly for files containing keywords like “token” or “private key.” Because OpenClaw stores data in a hidden folder with those identifiers, its files were automatically captured. Among the compromised files, openclaw.json contained a masked email, workspace path, and a high-entropy gateway authentication token that could enable unauthorized access or API impersonation. 

The device.json file stored public and private encryption keys used for pairing and signing, meaning attackers with the private key could mimic the victim’s device and bypass security checks. Additional files such as soul.md, AGENTS.md, and MEMORY.md outlined the agent’s behavior and stored contextual data including logs, messages, and calendar entries. Hudson Rock concluded that the combination of stolen tokens, keys, and memory data could potentially allow near-total digital identity compromise.

Experts expect infostealers to increasingly target AI systems as they become embedded in professional workflows. Separately, Tenable disclosed a critical flaw in Nanobot, an AI assistant inspired by OpenClaw. The vulnerability, tracked as CVE-2026-2577, allowed remote hijacking of exposed instances but was patched in version 0.13.post7. 

Security professionals warn that as AI tools gain deeper access to personal and corporate systems, protecting configuration files is now as critical as safeguarding passwords. Hidden setup files can carry risks equal to — or greater than — stolen login credentials.
Read more »
Malware Attack
Data Breach Database Breach Database Compromised Infostealer Infostealer Malware Malware Attack

Unsecured Database Exposes 149 Million Logins Linked to Infostealer Malware Operations

 

Appearing without warning on the internet, a massive collection of personal login details became reachable to any passerby. This trove - spanning about 96 gigabytes - included close to 150 million distinct credentials gathered from various sources. Not shielded by locks or scrambled coding, its contents lay fully exposed. Inside, endless spreadsheets paired emails with user handles, access codes, plus entry points to accounts. Examination showed evidence of widespread digital theft, driven by aggressive software designed to harvest private information. Such leaks reveal how deeply automated attacks now penetrate everyday online activity. 

Credentials came from people across the globe, tied to many different websites. Access information showed up for big social networks, romance apps, subscription video sites, games, and money-handling services. Among them: login pairs for digital currency storage, bank entry points, and systems linked to payment cards. A mix like that points not to one hacked business but likely stems from software designed to gather passwords automatically.  

What stood out most was the appearance of login details tied to government-backed email addresses in various nations. Though these accounts do not always grant entry to critical infrastructure, basic official credentials might still be exploited - serving as tools for focused scams or fake identities. Starting from minor access points, attackers could work their way deeper into secure environments. The level of danger shifts with each individual's privileges; when higher-access .gov logins fall into the wrong hands, consequences can stretch well beyond a single agency. 

Appearing first in the analysis was a database organized much like those seen in infostealer activities. Keylog results sat alongside extra details - hostnames flipped intentionally to sort thefts by target and origin. Though built on hashes, every record carried its own distinct ID, likely meant to prevent repeats while easing bulk sorting tasks. From this setup emerges something functional: a system shaped for gathering, handling, even passing along login information. Last noted - the traits match what supports credential trafficking behind the scenes. 

With unclear responsibility for the database, reporting went straight to the hosting company. Still, fixing the issue dragged on - weeks passed, with multiple alerts needed before entry was blocked. While delays continued, more data kept flowing in, expanding the volume of sensitive records exposed. Who controlled the system, how long it stayed open online, or whether others harvested its contents stays unanswered. One wrong move here leads to serious trouble. 

When hackers get full logins alongside active URLs, they run automated break-ins across many accounts - this raises chances of stolen identities, fake messages that seem real, repeated fraud, and unauthorized access. Personal habits emerge through used platforms, painting a clearer picture of who someone is online, which deepens threats to private data and future safety. 

Midway through this event lies proof: stealing login details now operates like mass production, fueled by weak cloud setups. Because information-harvesting software grows sharper every month, staying protected means doing basics well - shielding devices, practicing careful habits online, using separate codes everywhere, while adding extra identity checks. Found gaps here reveal something odd at first glance - not just legitimate systems fail from poor setup, but illegal networks do too; when they collapse, masses of people get caught unaware, their private pieces scattered without knowing a breach ever happened.
Read more »
Malware Attack
GlassWorm malware Malware Attack

GlassWorm Malware Returns with MacOS-focused Attack via VS Code Extensions

 

A fourth wave of the GlassWorm malware campaign is targeting macOS developers through malicious extensions distributed on the OpenVSX registry and the Microsoft Visual Studio Marketplace, according to researchers at Koi Security. 

The campaign involves compromised extensions designed for VS Code compatible editors. These extensions, which typically add productivity tools or language support, have been weaponised to deliver malware that steals developer credentials and cryptocurrency data. 

GlassWorm was first identified in October after being hidden inside extensions using invisible Unicode characters. Once installed, the malware attempted to harvest login details for GitHub, npm and OpenVSX accounts, as well as data from cryptocurrency wallet extensions. 

It also enabled remote access via VNC and allowed attackers to route traffic through infected systems using a SOCKS proxy. Despite public disclosure and additional safeguards, the malware resurfaced in early November on OpenVSX and again in early December on the VS Code marketplace. 

In the latest campaign, researchers observed a shift in tactics. The new wave targets macOS systems exclusively, unlike earlier versions that focused on Windows. The malware now uses an AES 256 CBC encrypted payload embedded in compiled JavaScript within OpenVSX extensions, rather than invisible Unicode characters or compiled Rust binaries. 

The identified extensions include studio velte distributor pro svelte extension, cudra production vsce prettier pro and puccin development full access catppuccin pro extension. The malicious code activates after a 15 minute delay, likely to avoid detection in automated analysis environments. 

Persistence is achieved through macOS LaunchAgents, and AppleScript is used instead of PowerShell. The campaign continues to rely on a Solana blockchain based command and control mechanism, with infrastructure overlaps seen across earlier waves. 

Koi Security said the malware now attempts to extract macOS Keychain passwords and checks for installed hardware wallet applications such as Ledger Live and Trezor Suite. 

If found, it attempts to replace them with trojanised versions. Researchers noted that this feature is currently not functioning as intended, with the substituted wallet files appearing empty. 

According to Koi Security, all other malicious capabilities remain active, including credential theft, data exfiltration and system persistence. 

OpenVSX has flagged warnings for two of the identified extensions, citing unverified publishers. While download figures show more than 33,000 installs, researchers warned that such metrics are often inflated to create a false sense of legitimacy. 

Developers who installed any of the affected extensions are advised to remove them immediately, reset GitHub passwords, revoke npm access tokens and check systems for compromise. Reinstalling the operating system may be necessary in cases of confirmed infection.
Read more »
Malwares
AI cybersecurity AI tools Cyber Security Cyber Security Tool GitHub GitHub Actions vulnerability GitHub Bug Malware Attack Malwares

Webrat Malware Targets Students and Junior Security Researchers Through Fake Exploits

 

In early 2025, security researchers uncovered a new malware family dubbed Webrat, which at that time was predominantly targeting ordinary users through fake distribution methods. The first propagation involved masking malware as cheats for online games-like Rust, Counter-Strike, and Roblox-but also as cracked versions of some commercial software. By the second half of that year, though, the Webrat operators had indeed widened their horizons, shifting toward a new target group that covered students and young professionals seeking careers in information security. 

This evolution started to surface in September and October 2025, when researchers discovered a campaign spreading Webrat through open GitHub repositories. The attackers embedded the malicious payloads as proof-of-concept exploits of highly publicized software vulnerabilities. Those vulnerabilities were chosen due to their resonance in security advisories and high severity ratings, making the repositories look relevant and credible for people searching for hands-on learning materials.  

Each of the GitHub repositories was crafted to closely resemble legitimate exploit releases. They all had detailed descriptions outlining the background of the vulnerability, affected systems, steps to install it, usage, and the most recommended ways of mitigation. Many of the repository descriptions have a similar or almost identical structure; the defensive advice offered is often strikingly similar, adding strong evidence that they were generated through automated or AI-assisted tools rather than various independent researchers. Inside each repository, users were instructed to fetch an archive with a password, labeled as the exploit package. 

The password was hidden in the name of one of the files inside the archive, a move intended to lure users into unzipping the file and researching its contents. Once unpacked, the archive contains a set of files meant to masquerade or divert attention from the actual payload. Among those is a corrupted dynamic-link library file meant as a decoy, along with a batch file whose purpose was to instruct execution of the main malicious executable file. The main executable, when run, executed several high-risk actions: It tried to elevate its privileges to administrator level, disabled the inbuilt security protections such as Windows Defender, and then downloaded the Webrat backdoor from a remote server and started it.

The Webrat backdoor provides a way to attackers for persistent access to infected systems, allowing them to conduct widespread surveillance and data theft activities. Webrat can steal credentials and other sensitive information from cryptocurrency wallets and applications like Telegram, Discord, and Steam. In addition to credential theft, it also supports spyware functionalities such as screen capture, keylogging, and audio and video surveillance via connected microphones and webcams. The functionality seen in this campaign is very similar to versions of Webrat described in previous incidents. 

It seems that the move to dressing the malware up as vulnerability exploits represents an effort to affect hobbyists rather than professionals. Professional analysts normally analyze such untrusted code in a sandbox or isolated environment, where such attacks have limited consequences. 

Consequently, researchers believe the attack focuses on students and beginners with lax operational security discipline. It ranges in topic from the risks in running unverified code downloaded from open-source sites to the need to perform malware analysis and exploit testing in a sandbox or virtual machine environment. 

Security professionals and students are encouraged to be keen in their practices, to trust only known and reputable security tools, and to bypass protection mechanisms only when this is needed with a clear and well-justified reason.
Read more »
Malwares
cyber espionage Cyber Espionage Campaign Cyberattacks cybersecurity risks Iran Iranian malware Malware Attack Malwares

Iranian Infy Prince of Persia Cyber Espionage Campaign Resurfaces

 

Security researchers have identified renewed cyber activity linked to an Iranian threat actor known as Infy, also referred to as Prince of Persia, marking the group’s re-emergence nearly five years after its last widely reported operations in Europe and the Middle East. According to SafeBreach, the scale and persistence of the group’s recent campaigns suggest it remains an active and capable advanced persistent threat. 

Infy is considered one of the longest-operating APT groups, with its origins traced back to at least 2004. Despite this longevity, it has largely avoided the spotlight compared with other Iranian-linked groups such as Charming Kitten or MuddyWater. Earlier research attributed Infy’s attacks to a relatively focused toolkit built around two primary malware families: Foudre, a downloader and reconnaissance tool, and Tonnerre, a secondary implant used for deeper system compromise and data exfiltration. These tools are believed to be distributed primarily through phishing campaigns. 

Recent analysis from SafeBreach reveals a previously undocumented campaign targeting organizations and individuals across multiple regions, including Iran, Iraq, Turkey, India, Canada, and parts of Europe. The operation relies on updated versions of both Foudre and Tonnerre, with the most recent Tonnerre variant observed in September 2025. Researchers noted changes in initial infection methods, with attackers shifting away from traditional malicious macros toward embedding executables directly within Microsoft Excel documents to initiate malware deployment. 

One of the most distinctive aspects of Infy’s current operations is its resilient command-and-control infrastructure. The malware employs a domain generation algorithm to rotate C2 domains regularly, reducing the likelihood of takedowns. Each domain is authenticated using an RSA-based verification process, ensuring that compromised systems only communicate with attacker-approved servers. SafeBreach researchers observed that the malware retrieves encrypted signature files daily to validate the legitimacy of its C2 endpoints.

Further inspection of the group’s infrastructure uncovered structured directories used for domain verification, logging communications, and storing exfiltrated data. Evidence also suggests the presence of mechanisms designed to support malware updates, indicating ongoing development and maintenance of the toolset. 

The latest version of Tonnerre introduces another notable feature by integrating Telegram as part of its control framework. The malware is capable of interacting with a specific Telegram group through its C2 servers, allowing operators to issue commands and collect stolen data. Access to this functionality appears to be selectively enabled for certain victims, reinforcing the targeted nature of the campaign. 

SafeBreach researchers also identified multiple legacy malware variants associated with Infy’s earlier operations between 2017 and 2020, highlighting a pattern of continuous experimentation and adaptation. Contrary to assumptions that the group had gone dormant after 2022, the new findings indicate sustained activity and operational maturity over the past several years. 

The disclosure coincides with broader research into Iranian cyber operations, including analysis suggesting that some threat groups operate with structured workflows resembling formal government departments. Together, these findings reinforce concerns that Infy remains a persistent espionage threat with evolving technical capabilities and a long-term strategic focus.
Read more »
Microsoft Defender
Cyber Attacks Cyber Defender cybersecurity risks Malware Attack Malware Service Microsoft Defender

CountLoader and GachiLoader Malware Campaigns Target Cracked Software Users

 

Cybersecurity analysts have uncovered a new malware campaign that relies on cracked software download platforms to distribute an updated variant of a stealthy and modular loader known as CountLoader. According to researchers from the Cyderes Howler Cell Threat Intelligence team, the operation uses CountLoader as the entry point in a layered attack designed to establish access, evade defenses, and deploy additional malicious payloads. 

CountLoader has been observed in real-world attacks since at least June 2025 and was previously analyzed by Fortinet and Silent Push. Earlier investigations documented its role in delivering widely used malicious tools such as Cobalt Strike, AdaptixC2, PureHVNC RAT, Amatera Stealer, and cryptomining malware. The latest iteration demonstrates further refinement, with attackers leveraging familiar piracy tactics to lure victims. 

The infection process begins when users attempt to download unauthorized copies of legitimate software, including productivity applications. Victims are redirected to file-hosting platforms where they retrieve a compressed archive containing a password-protected file and a document that supplies the password. Once extracted, the archive reveals a renamed but legitimate Python interpreter configured to run malicious commands. This component uses the Windows utility mshta.exe to fetch the latest version of CountLoader from a remote server.  

To maintain long-term access, the malware establishes persistence through a scheduled task designed to resemble a legitimate Google system process. This task is set to execute every 30 minutes over an extended period and relies on mshta.exe to communicate with fallback domains. CountLoader also checks for the presence of endpoint protection software, specifically CrowdStrike Falcon, adjusting its execution method to reduce the risk of detection if security tools are identified. 

Once active, CountLoader profiles the infected system and retrieves follow-on payloads. The newest version introduces additional capabilities, including spreading through removable USB drives and executing malicious code entirely in memory using mshta.exe or PowerShell. These enhancements allow attackers to minimize their on-disk footprint while increasing lateral movement opportunities. In incidents examined by Cyderes, the final payload delivered was ACR Stealer, a data-harvesting malware designed to extract sensitive information from compromised machines. 

Researchers noted that the campaign reflects a broader shift toward fileless execution and the abuse of trusted, signed binaries. This approach complicates detection and underscores the need for layered defenses and proactive threat monitoring as malware loaders continue to evolve.  

Alongside this activity, Check Point researchers revealed details of another emerging loader named GachiLoader, a heavily obfuscated JavaScript-based malware written in Node.js. This threat is distributed through the so-called YouTube Ghost Network, which consists of hijacked YouTube accounts used to promote malicious downloads. The campaign has been linked to dozens of compromised accounts and hundreds of thousands of video views before takedowns occurred. 

In some cases, GachiLoader has been used to deploy second-stage malware through advanced techniques involving Portable Executable injection and Vectored Exception Handling. The loader performs multiple anti-analysis checks, attempts to gain elevated privileges, and disables key Microsoft Defender components to avoid detection. Security experts say the sophistication displayed in these campaigns highlights the growing technical expertise of threat actors and reinforces the importance of continuously adapting defensive strategies.
Read more »
npm malware attack
Cyber Attacks cybersecurity risks Developers Malware Attack Malwares NPM NPM malware npm malware attack

Sha1-Hulud Malware Returns With Advanced npm Supply-Chain Attack Targeting Developers

 

A new wave of the Sha1-Hulud malware campaign has unfolded, indicating further exacerbation of supply-chain attacks against the software development ecosystem. The recent attacks have hit the Node Package Manager, or npm, one of the largest open-source package managers that supplies JavaScript developers around the world. Once the attackers compromise vulnerable packages within npm, the malicious code will automatically be executed whenever targeted developers update to vulnerable versions, oblivious to the fact. Current estimates indicate nearly 1,000 npm packages have been tampered with, thereby indirectly affecting tens of thousands of repositories. 

Sha1-Hulud first came into light in September 2025, when it staged its first significant intrusion into npm's ecosystem. The past campaign included the injection of trojanized code into weakly-secured open-source libraries that then infected every development environment that had the components installed. The malware from the initial attack was also encoded with a credential harvesting feature, along with a worm-like mechanism intended for the proliferation of infection. 

The latest rendition, seen in new activity, extends the attack vector and sophistication. Among others, it includes credential theft, self-propagation components, and a destructive "self-destruct" module that aims at deleting user data in case interference with the malware is detected. The malware now demonstrates wide platform compatibility, running across Linux, macOS, and Windows systems, and introduces abuse of GitHub Actions for remote code execution. 

The infection chain starts with a modified installation sequence. Inside the package.json file, the compromised npm packages bear a pre-install script named setup_bun.js. Posing as a legitimate installer for the Bun JavaScript runtime, the script drops a 10MB heavily obfuscated payload named bun_environment.js. From there, malware begins searching for tokens, API keys, GitHub credentials, and other sensitive authentication data. It leverages tools like TruffleHog to find more secrets. After stealing the data, it automatically gets uploaded into a public repository created under the victim's GitHub account, naming it "Sha1-Hulud: The Second Coming," thus making those files accessible not just to the attackers but to actually anyone publicly browsing the repository. 

The malware then uses the stolen npm authentication tokens to compromise new packages maintained by the victim. It injects the same malicious scripts into those packages and republishes them with updated version numbers, triggering automatic deployment across dependent systems. If the victim tries to block access or remove components, the destructive fail-safe is initiated, which wipes home directory files and overwrites data sectors-this significantly reduces the chances of data recovery. 

Security teams are encouraged to temporarily stop updating npm packages, conduct threat-hunting activities for the known IoCs, rotate credentials, and reevaluate controls on supply-chain risk. The researchers recommend treating any system showing signs of infection as completely compromised.
Read more »
Transnational Fraud
Cryptocurrency Fraud cyber attack Cyber Fraud Cybercrime Scam Cybersecurity Alert Digital Forensics FTC Impersonation Malware Attack online deception tech support fraud Transnational Fraud

Tech Park Operation in Bengaluru Uncovered in Cross-Border Malware Scam


 

The Bengaluru police have made a major breakthrough in their fight against a far-reaching cybercrime syndicate that was operating inside one of the city's bustling technology parks by uncovering and dismantling an alleged tech-support fraud operation that was operating within. 

The officials stated that the group, which is based out of an office operating under the name Musk Communications situated on the sixth floor of the Delta building in Sigma Soft Tech Park, Whitefield, was posing as Microsoft technical support representatives to terrorize unsuspecting victims in the United States by issuing fabricated Federal Trade Commission (FTC) violation alerts. 

Using a judicial search warrant as well as credible intelligence, Cyber Command's special cell and Whitefield division cyber crime police mounted a series of coordinated raids on Friday and Saturday following the receipt of credible intelligence. According to investigators, the operation was sophisticated, and it siphoned off several crores of rupees by largely using cryptocurrency channels, a process that investigators believe is highly sophisticated. 

It was found, according to the Times of India, that the fraud network employed a carefully choreographed playbook of deception, which included utilizing fake security pop-ups and falsified FTC violation notifications to convince victims into transferring money by using counterfeit security pop-ups and false FTC violation notices. It was found that the Cyber Command's special cell, along with Whitefield division officers, were receiving a credible tip-off which prompted a swift and coordinated response to the operation. 

Upon receiving the intelligence, police conducted a court-ordered search over the weekend at Musk Communications headquarters on the sixth floor of the Delta building, which is located on Whitefield Main Road within Sigma Soft Tech Park. There was a cache of computers, laptops, hard drives, mobile phones, and other digital tools seized inside the building that were thought to have powered the scam. All of the employees present at the scene were detained and later appeared in court, where they were remanded to police custody while the investigation was being conducted.

It was noted by law enforcement officials that the company's owner, who recruited and trained the detained employees, remains on the loose even though the police have arrested only six people in connection with the operation. According to investigators, there may have been more than 500, possibly more than 1,000, US citizens defrauded by this network, based upon preliminary estimates. Investigators believe the network went far beyond the 21 employees caught at the scene. 

As the head of the CCU and DGP, Pronab Mohanty, has stated that the scam involved a carefully layered approach to social engineering combined with deceptive technology that led to a successful exploitation scheme. The officers observed that the group began by deploying malicious Facebook advertisements aimed at users living in the United States. The advertisements were designed to deliver harmful code embedded in links disguised as legitimate company notifications to American users.

It was designed to lock the victim's computer once they clicked on the code, triggering a fake alert, posing as "Microsoft Global Technical Support," complete with a fraudulent helpline number, to click OK. The trained impersonators who greeted victims when they contacted them escalated their fears by claiming they had been compromised, their IP addresses had been breached and that sensitive financial data was about to be exposed. 

Upon attempting to resolve fictitious FTC compliance violations and urgent security fixes, the callers were then coerced into transferring significant amounts of money, often in cryptocurrency, under the guise of resolving fictitious compliance violations. Various CCU teams had been placed under discreet surveillance by the SSTP detectives after receiving specific intelligence regarding the operation of the scam in a 4,500 square foot building that masqueraded as a call center in the Delta building at Sigma Soft Tech Park, which had been operating under the cover of a call centre.

In the case of a suo motu lawsuit filed under the provisions of the Information Technology Act, a team led by Superintendent Savitha Srinivas, the Superintendent of Police, stepped in and conducted a planned raid that lasted from Friday night until Saturday morning. According to the authorities, the arrested employees had been hired for unusually high salaries and had been provided with systematic training. Their educational and professional histories are being verified now. 

Investigators are currently examining all digital devices recovered from the premises in order to identify the individual members who are still involved with the operation. In addition, investigators will attempt to identify those individuals responsible for creating the malicious software, the trainers, and those who manage the network's finances. 

In addition, it is necessary to determine the total extent of the fraud by analyzing all the digital devices recovered from the premises. A senior officer of the company described the operation as a meticulously planned fraud network, one which relied heavily on deception and psychological pressure to perpetrate the fraud. As reported by investigators, the group ran targeted Facebook ads targeted towards U.S. users, encrypting malicious code in messages that appeared to be routine service messages or security alerts, and directing them to them. 

One click of the mouse was enough for a victim's computer to freeze and trigger a pop-up that appeared to mimic the appearance of a genuine technical support warning from Microsoft, including a fake helpline number. Upon calling victims and seeking assistance, trained impersonators dressed as Microsoft technicians spun alarming narratives claiming their computers had been hacked, their IP addresses had been compromised, and their sensitive banking information was immediately at risk. They used fabricated FTC violation notices that enticed the victims to pay hefty amounts for supposed security fixes or compliance procedures that never existed in the first place. 

Upon preliminary analysis of the financial flows, it seems that the syndicate may have siphoned off hundreds of crores through cryptocurrency channels, with Director General of Police, Cyber Command Unit, Mr. Pronab Mohanty noting that he believes the crypto transactions might have been of a large scale. 

A more complete picture of the case would emerge as the suspects were further questioned, he said, adding that investigators already had significant electronic evidence at their disposal. According to official officials, the sophisticated nature of the operation, as well as its technological infrastructure, as well as its widespread reach, suggest that it may be linked to a wider transnational cybercrime network. 

A team of experts is currently reviewing seized devices, tracking cryptocurrency wallets, reviewing communications logs, and mapping the victim footprints across multiple jurisdictions as part of the investigation. Authorities are coordinating with central agencies in order to determine if the group had counterparts operating outside of the city or overseas as part of the investigation. The scope of the investigation has continued to expand. 

There is also an investigation underway into whether shell companies, falsified paperwork, or layered financial channels were used to conceal the true leadership and funding network of the operation. As new leads emerge from digital forensics as well as financial analysis in the coming days, officers expect that the investigation will grow significantly in the coming days. According to the authorities who are investigating the incident, tech parks, digital advertisers, and online platforms are being urged to strengthen monitoring systems in order to prevent similar infiltration attempts in the future. 

Cybersecurity experts say the case underscores the growing need to raise public awareness of deceptive pop-ups, unsolicited alerts, and remote support scams—tactics that are becoming more sophisticated as time goes by. As a reminder to users, legitimate agencies will never charge money for compliance or security fixes, and users are advised to verify helplines directly through official websites to ensure they are trustworthy. It is expected that the crackdown will set a critical precedent in dismantling multi-national cyber-fraud operations by setting a critical precedent in international coordination.
Read more »
Malware Attack
APT44 Cyber Attacks Cyber Hackers Data Hackers Data protection data security data wipers Data Wiping Malware Hacker attack Malware Attack

Russian Sandworm Hackers Deploy New Data-Wipers Against Ukraine’s Government and Grain Sector

 

Russian state-backed hacking group Sandworm has intensified its destructive cyber operations in Ukraine, deploying several families of data-wiping malware against organizations in the government, education, logistics, energy, and grain industries. According to a new report by cybersecurity firm ESET, the attacks occurred in June and September and form part of a broader pattern of digital sabotage carried out by Sandworm—also known as APT44—throughout the conflict. 

Data wipers differ fundamentally from ransomware, which typically encrypts and steals data for extortion. Wipers are designed solely to destroy information by corrupting files, damaging disk partitions, or deleting master boot records in ways that prevent recovery. The resulting disruption can be severe, especially for critical Ukrainian institutions already strained by wartime pressures. Since Russia’s invasion, Ukraine has faced repeated wiper campaigns attributed to state-aligned actors, including PathWiper, HermeticWiper, CaddyWiper, WhisperGate, and IsaacWiper.

ESET’s report documents advanced persistent threat (APT) activity between April and September 2025 and highlights a notable escalation: targeted attacks against Ukraine’s grain sector. Grain exports remain one of the country’s essential revenue streams, and ESET notes that wiper attacks on this industry reflect an attempt to erode Ukraine’s economic resilience. The company reports that Sandworm deployed multiple variants of wiper malware during both June and September, striking organizations responsible for government operations, energy distribution, logistics networks, and grain production. While each of these sectors has faced previous sabotage attempts, direct attacks on the grain industry remain comparatively rare and underscore a growing focus on undermining Ukraine’s wartime economy. 

Earlier, in April 2025, APT44 used two additional wipers—ZeroLot and Sting—against a Ukrainian university. Investigators discovered that Sting was executed through a Windows scheduled task named after the Hungarian dish goulash, a detail that illustrates the group’s use of deceptive operational techniques. ESET also found that initial access in several incidents was achieved by UAC-0099, a separate threat actor active since 2023, which then passed control to Sandworm for wiper deployment. UAC-0099 has consistently focused its intrusions on Ukrainian institutions, suggesting coordinated efforts between threat groups aligned with Russian interests. 

Although Sandworm has recently engaged in more espionage-driven operations, ESET concludes that destructive attacks remain a persistent and ongoing part of the group’s strategy. The report further identifies cyber activity linked to Iranian interests, though not attributed to a specific Iranian threat group. These clusters involved the use of Go-based wipers derived from open-source code and targeted Israel’s energy and engineering sectors in June 2025. The tactics, techniques, and procedures align with those typically associated with Iranian state-aligned hackers, indicating a parallel rise in destructive cyber operations across regions affected by geopolitical tensions. 

Defending against data-wiping attacks requires a combination of familiar but essential cybersecurity practices. Many of the same measures advised for ransomware—such as maintaining offline, immutable backups—are crucial because wipers aim to permanently destroy data rather than exploit it. Strong endpoint detection systems, modern intrusion prevention technologies, and consistent software patching can help prevent attackers from gaining a foothold in networks. As Ukraine continues to face sophisticated threats from state-backed actors, resilient cybersecurity defenses are increasingly vital for preserving both operational continuity and national stability.
Read more »
Subscribe to: Posts (Atom)