Abuse

admin Noticias, Trending Abuse chat Claude CYBERDEFENSA.MX DeviceCode NastyC2 npm Packages Phishing Stories

Claude Chat Abuse, NastyC2 npm Packages, Device-Code Phishing + 25 More Stories – CYBERDEFENSA.MX

The internet did not break this week. It got used exactly as designed, which is worse.

Searches were siphoned through shady browser add-ons. AI chat links turned into malware delivery paths. macOS attacks ran in memory and left almost nothing behind. Cloud agents looked like helpers until attackers treated them like open shells.

Add exposed edge gear, poisoned packages, cash courier scams, stealers, loaders, and phishing that barely bothers pretending anymore. Here’s the full mess.

DoH lands in Windows Server 2025

Microsoft has announced that DNS-over-HTTPS (DoH) for Windows DNS Server is generally available on Windows Server 2025 for client-to-server DNS traffic. «With general availability, organizations can now deploy encrypted and authenticated client-to-resolver DNS traffic directly within their existing on-premises DNS infrastructure,» the company said. «The goal is to help improve privacy, reduce spoofing risk, and advance Zero Trust DNS without requiring a new resolver architecture. Enabling DoH on Windows DNS Server introduces encrypted communication for supported clients over HTTPS while preserving compatibility with most existing DNS deployments. Organizations can expect DoH traffic between DoH clients and Windows DNS Server to be encrypted via TLS, DNS queries to be transported as HTTPS requests, existing DNS functionality to continue operating as expected, and mixed environments, encrypted and traditional DNS, to be supported.»
Search hijacks hide monetization layer

A cluster of 23 deceptive Chrome browser extensions has been found stealthily overriding users’ default search engines and routing queries through monetization middleware before delivering results. «Each extension presents a different advertised purpose – satellite imagery, productivity tools, news readers, maps – while the actual business is search affiliate revenue,» security researcher Jean-Marie R. said. «The campaign spans at least 8 distinct monetization brokers and ~758,000 affected users. While this might look like simple adware, it is a real security risk. First, it is a massive privacy violation: every search a user makes is sent to anonymous third-party brokers. Second, because the operators control the web traffic, they can easily switch from showing regular search results to injecting phishing links or malicious downloads at any time – all without ever updating the extension code itself.»
Fileless macOS ClickFix attack chain

A Russian-speaking attacker has been observed targeting victims mainly in Asia, North America, and Oceania across technology, media, and business services sectors using ClickFix lures to deliver an AppleScript-based infostealer to macOS users. The ClickFix pages masquerade as downloads for a malware scanning utility. «To evade detection, the entire infection chain, starting from the initial clipboard paste to payload execution, is completely fileless, leaving no static artifacts on disk until persistence is established,» Netskope Threat Labs said. «Victims are socially engineered into executing a curl command that fetches a gzip-compressed stager, which pipes the second-stage AppleScript directly into osascript memory.» The second-stage, codenamed «Meow (DEBUG),» uses a fake system dialog to harvest credentials, browser data, session cookies, and keychain contents. It’s also equipped with capabilities to trojanize legitimate desktop cryptocurrency wallet applications and maintain persistent command-and-control (C2) access, allowing the operator to run arbitrary payloads.
Claude chat abuse fuels malware delivery

In another ClickFix campaign, threat actors have been spotted weaponizing Anthropic Claude’s shared chat feature, abusing the trust associated with a legitimate domain to deliver the MacSync credential-stealing malware. «Cybercriminals hijacked Google Ads searches for popular AI developer tools to funnel over 2,000 victims toward malicious download pages before quietly moving their operation onto claude.ai’s own platform, turning the trusted domain into a delivery mechanism for credential-stealing malware,» Trend Micro said. «The Asia-Pacific region bore the brunt of the campaign, accounting for 67.2% of all confirmed victims, with Taiwan alone representing 30.5% of total traffic, a concentration that points to deliberate geographic ad targeting rather than opportunistic spread.» As many as 106 unique malicious hostnames have been identified over a span of seven weeks across six distinct attack waves.Anthropic has since banned the accounts responsible, disabled the malicious shared conversations, and is implementing additional abuse mitigations for its shared chat feature.
WhatsApp booking fraud spreads globally

Bitdefender haș warned of an ongoing phishing campaign impersonating hotels, resorts, and accommodation providers across more than 10 countries. «Unlike traditional travel scams that rely on generic phishing emails, this operation uses real booking information, localized messaging, and convincing hotel branding to trick travelers into handing over payment card details,» the Romanian cybersecurity company said. «Victims receive personalized messages containing names, stay dates, reservation details, and cancellation warnings. The campaign relies exclusively on WhatsApp, with no matching email or SMS infrastructure observed.» Observed languages include English, German, French, Spanish, Romanian, and Polish. Similar campaigns have been reported by Sekoia and Netcraft in the past.
AI agent targets vulnerability chaos

Amazon Web Services (AWS) has announced a new artificial intelligence (AI)-powered security agent called AWS Continuum for code vulnerabilities, as models like Claude Mythos by attackers and defenders accelerate the ability to find and exploit vulnerabilities. AWS Continuum «addresses the full lifecycle of managing code vulnerabilities at machine speed. It continuously discovers vulnerabilities, validates which are genuinely exploitable, prioritizes them by business context, and helps you remediate them across the full stack within guardrails you define,» AWS said. The tech giant said the agent is model agnostic, and that it uses multiple frontier models where they perform best.
SD-WAN zero-day scope expands

Cisco has updated its February 2026 advisory for CVE-2026-20127, a critical privilege escalation flaw in Catalyst SD-WAN Controller and Catalyst SD-WAN Manager, to note that the vulnerability also affects Catalyst SD-WAN Validator. The security flaw has been exploited as a zero-day since 2023 by a sophisticated threat actor known as UAT-8616. It allows an unauthenticated remote attacker to bypass authentication and obtain administrative privileges on an affected system by sending a crafted request.
AI coding agent trust bypass exposed

Manifold Security has flagged two high-severity local code-execution paths on a developer’s machine via a malicious repository in Cline, an AI coding agent VS Code extension with more than 4.3 million installs. The repository’s content, in turn, tricks the agent into executing attacker-supplied shell commands under the developer’s account, enabling access to credentials, source code, and other sensitive data. «Cline ships an Approve/Deny dialog and a «Safe Commands» auto-approve filter that are supposed to stop exactly this. Both fail,» Ax Sharma, head of research at Manifold Security, said. «Clicking the URL preview tile to verify where the agent is fetching from runs an OS-level command instead. The Approve/Deny dialog never gates the click. ‘Safe Commands’ doesn’t inspect commands. It asks the AI agent whether its own command is safe, and trusts the answer, even after the same agent has been manipulated by attacker content.» While the findings have been classified as «out of scope,» Cline plans to release fixes in an upcoming release.
HTTP/2 abuse shifts to live reconnaissance

Earlier this month, Calif used OpenAI’s Codex to discover an exploit called the HTTP/2 Bomb. Formally tracked as CVE-2026-49975, the vulnerability ironically chains together two features that were expressly designed to save internet bandwidth to help attackers amplify junk traffic by orders of magnitude. Imperva has since reported that attackers in the wild were «running specialized tools designed to map out» vulnerable servers. A working proof-of-concept (PoC) is publicly available. «Exposure in this set is led by communication services at 24.9% of observed assets, with information technology contributing 18.0% and healthcare close behind at 17.0%,» CyCognito said.
Exposed email server becomes phishing hub

Cybersecurity researchers have discovered an «interesting attack» where an unknown actor leveraged a victim’s internet-facing terminal server as a phishing stager. Huntress said it recovered the full staging directory, including a legitimate bulk email software application (Gammadyne Mailer), a project file named dracii.mmp , and six target lists holding 8,894,920 email addresses. «The campaign impersonated the U.K. pharmacy chain Boots, using a ‘free gift’ survey as a lure,» the company said. «The payload it pointed victims at was hosted on a compromised Bolivian government website, ipelc.gob[.]bo.» The payload is a Boots phishing web page hosted within the /boots_store/ subdirectory that urges users to complete a survey and redeem a free gift by entering their personal and financial information.
Bank phishing delivers in-memory stealer

An active phishing campaign is targeting banks to deliver Phantom Stealer, an infostealer that’s sold under a subscription model for between $70 to $240 by a threat actor operating under the alias Oldphantomoftheopera. «The attack begins with phishing emails containing malicious attachments disguised as business documents,» Fortra said. «Once executed, the malware runs entirely in memory, helping it evade traditional defenses. «The combination of targeted phishing delivery, advanced evasion techniques, broad credential harvesting capabilities, and a resilient multi-channel exfiltration infrastructure places this threat in the high-severity category.» Phantom Stealer targets major web browsers as well as Discord, Telegram, and Steam. It is also used to steal financial information, cryptocurrency assets, and collect keystrokes, screenshots, and clipboard data.
Imposter scams hit $3.5B losses

The U.S. Federal Trade Commission (FTC) revealed that Americans lost a staggering $3.5 billion to imposter scams in 2025, with reported losses nearly tripling since 2020. «These scams lured consumers through text, phone, email, social media, search engine results, and other means. Some of the costliest impersonation scams start with a fake security alert, often from a bank,» the FTC said. «People are convinced to move money to ‘protect’ it, with their losses often limited only by their available funds.» In all, about $16 billion has been reported lost in 2025 to all types of fraud.
Conti operator admits ransomware role

Oleksii Oleksiyovych Lytvynenko, 44, has pleaded guilty to wire fraud conspiracy in connection with Conti, a ransomware variant that infected more than 1,000 computers and networks across the world. «Lytvynenko, of Cork, Ireland, conspired with others to deploy Conti ransomware to extort victims and steal their data,» the U.S. Department of Justice said. «Lytvynenko admitted to joining the Conti conspiracy no later than approximately September 2021. He admitted to possessing data from eight U.S. and four overseas victims, which had been stolen by Conti conspirators. Lytvynenko further admitted to joining a team run by a Conti conspirator during which time Lytvynenko was directed to work on coding a ‘loader,’ which is typically a type of malware, or malicious software, that is used to load programs necessary to execute other malicious attacks.» As of January 2022, Conti ransomware attacks resulted in at least $150 million in ransom payments. The Ukrainian national was extradited to the U.S. in October 2025. He is scheduled to be sentenced on September 10, 2026, and faces a maximum penalty of 20 years in prison.
Steam wallpapers turn into account theft vector

Threat actors are abusing Steam Workshop to spread malware hidden in dozens of wallpaper packages, putting gamers’ accounts at risk. The activity has been active since late 2025. «The attackers are primarily targeting gamers in China and Russia, aiming to hijack their accounts,» Kaspersky said. «To pull this off, they are exploiting Wallpaper Engine – a popular live wallpaper app available on Steam – specifically leveraging its Workshop sharing feature. The malware is hidden inside the wallpaper packages users share with one another. Running one of these compromised wallpapers can lead to a stolen Steam account or leave the victim’s system infected with backdoors or crypto miners.»
Rust C2 framework hits npm supply chain

Three npm packages, node-ci-utils@2.1.4, win-env-setup@3.0.6, macos-ci-utils@1.0.0, have been found to act as droppers for Linux, Windows, and macOS systems to deliver a previously undocumented post-exploitation framework codenamed NastyC2. «Written entirely in Rust, it implements over 80 commands spanning credential harvesting, Active Directory attacks, container escape, cloud metadata theft, and fileless execution,» Panther said. «The framework is comparable in scope to Cobalt Strike or Sliver, overlapping with both on BOF/COFF execution, reflective DLL loading, multi-technique process injection, AD-native Kerberoasting and DCSync, AMSI/ETW patching, SOCKS5 pivoting, and encrypted sleep.»
npm package delivers worm + miner + LPE

A malicious npm package named crypto-javascript@4.2.5 has been observed installing three different payloads, including a supply chain worm that spreads across six build ecosystems (Rust, Cargo, Python, CMake, and npm), a Monero cryptocurrency miner, and an exploit for Dirty Frag, a local privilege escalation (LPE) vulnerability impacting the Linux kernel. «All three run from memory, leaving no named file on disk,» Panther said. «The embedded kernel exploit carries a GCC build timestamp of 2026-04-30 1, seven days before public disclosure of the Dirty Frag vulnerability.» Although ELF timestamps can be forged, the development has raised the possibility that the threat actor may have had access to a working exploit code while details of the flaw were still under wraps.
Multi-stage loader evades analysis chain

An active campaign is leveraging a multi-stage loader called OnionDrop to deliver malware families like LegionLoader (aka CurlyGate), CGrabber, and Vidar Stealer. OnionDrop is an advanced piece of malware with extensive defense evasion and anti-analysis features. «The chain starts with a ZIP archive and a legitimate Adobe-signed executable used for DLL side-loading,» Cyderes said. «From there, the malicious DLL walks through four transformation stages: custom byte-pair decoding, Xpress Huffman decompression via RtlDecompressBufferEx, AES-256-CBC decryption with rotating key material, and final shellcode execution through TpPostWork callback abuse inside the Windows Thread Pool. This is a professionally engineered evasion framework that anyone with access can point at any target.»
Courier pickups extend crypto fraud lifecycle

The U.S. Federal Bureau of Investigation (FBI) has warned that scammers are instructing victims, usually senior citizens, to participate in cash pickups after engaging with them online by posing as individuals seeking business or romantic relationships. After establishing a relationship with the victim, the fraudster suggests investing in cryptocurrency and instructs the victim to download certain cryptocurrency trading applications and create investment accounts. «The scammers arrange for couriers to meet the victims in person to retrieve cash for fraudulent investments,» the FBI said. «Legitimate financial institutions may deny suspicious funds transfers by victims, so scammers inform victims in-person cash pickups are required to continue investing with the fraudulent investment firm or to pay purported fines to withdraw their investments. Alternatively, the fraudulent cryptocurrency exchange may inform victims their account has been ‘flagged,’ allowing the scammer to suggest the use of cash couriers as an alternative.» The dispatched couriers identify themselves using an agreed-upon code or a specific dollar bill serial number. When victims attempt to withdraw their perceived profits, the threat actors force them to pay non-existent taxes and penalties, again using couriers for cash pickups to continue the fraud.
Belarus-linked Gmail phishing surge

CERT Polska has revealed that the Belarus-aligned Ghostwriter group has been running phishing campaigns targeting Gmail users through bogus messages designed to imitate official Gmail communications and trick recipients into clicking on malicious URLs that harvest their credentials. «These campaigns are carried out with high intensity, mainly on weekdays,» the agency said. «Notably, they enable the theft of two-factor authentication (2FA) credentials. In recent weeks, our team has observed the use of new domains serving phishing pages almost daily.» The campaign has targeted researchers, journalists, employees of public administration and law enforcement, and individuals connected to these groups through family or social relationships.
OAuth device flow abused for account takeover

ReversingLabs has detailed a Microsoft 365 device code phishing campaign that makes use of Microsoft’s legitimate OAuth 2.0 Device Authorization Grant flow to obtain access to victim accounts. «The initial email sent to victims uses a lure that appears to be an approval for an estimate sent from a vendor to one of their customers,» security researcher Robert Simmons said. «Rather than stealing passwords through a counterfeit login page, the phishing kit persuades victims to complete a legitimate Microsoft authentication process that authorizes an attacker-controlled device.»
Stealer-as-a-service adds refund guarantee

A new information stealer called OnyxC2 is being marketed on underground forums, giving customers access to a web panel and a payload builder. Most importantly, paying users are eligible for refunds if a build gets caught. «For $250 a month, operators get a kit that harvests browser credentials, password managers, two-factor authentication (2FA), and crypto wallets across roughly 210 applications and extensions, then ships it all back over an encrypted channel,» BlackFog said. «The stealer reaches 37 Chromium-based and 8 Gecko-based browsers, then 95 Chromium and 14 Gecko extensions, including 6 dedicated two-factor authentication extensions. It also covers 5 password managers, 17 cryptocurrency wallets, 11 FTP clients, and 5 email clients, with a further set of VPN, remote access, messaging, note-taking, and gaming targets.» A premium subscription is available for $500 per month. OnyxC2 also goes beyond a traditional steal by incorporating HVNC over a web browser, LSASS dumping, RunPE in memory and on disk, a reverse SOCKS5 proxy, screenshot capture, a keylogger, a file manager, and a reverse shell over HTTP, and a built-in TOR tunnel.
AI-themed phishing drops AsyncRAT

A new campaign has been observed delivering malicious files disguised as AI-related documents in phishing emails to install AsynRAT. The attachments are distributed in the form of ZIP archives containing a Windows Shortcut (LNK) file that acts as a starting point for a stealthy, multi-stage attack chain. «These lures are designed to target users actively seeking AI-related learning resources,» Fortinet FortiGuard Labs said. «The attack chain behind these files is remarkably complex, using multiple staged scripts to hide activity before ultimately deploying AutoHotkey-based loaders that reflectively inject a .NET remote access trojan [named clay_Client] and AsynRAT into memory for command-and-control communication and follow-on execution.»
GCP telemetry gap exposes detection blind spots

Permiso Security said it discovered an «interesting and practically significant inconsistency» associated with serviceData, a field that has been deprecated in favor of metadata for obtaining service-specific information. «If serviceData were cleanly deprecated and services had migrated away from it, one would expect a predictable pattern: events after the deprecation date would stop populating the serviceData field and would start populating the relevant data in metadata instead,» security researcher Art Ukshini said. However, further testing has uncovered that some events still populate serviceData correctly, while others produce empty serviceData objects. The security company said this unreliable behavior of serviceData translates into a concrete set of security risks that can affect detection coverage, incident response, and compliance, requiring organizations to validate log telemetry end-to-end.
Worm weaponizes AI refusal behavior

A variant of the Shai-Hulud worm has been found to include an adversarial prompt for «synthesizing weaponized biological agents suitable for aerosol dispersal» with an aim to target AI-powered malware scanners with an aim to trick the model into refusing a response for violating a safety guardrail, as opposed to classifying it as benign. «A refusal is supposed to be the safe outcome,» JFrog said. «It’s the model declining to do something harmful. Here, the refusal is the attack. If the scanner balks at the top of the file, it never reads the bottom, and the malware ships un-analyzed. Not because the model was fooled into trusting it, but because it was goaded into closing the book.»
Risk-based patching gets enforcement layer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a new Binding Operational Directive, BOD 26-04, that prioritizes security updates for Federal Civilian Executive Branch (FCEB) agencies, requiring them to remediate high-risk vulnerabilities within accelerated timeframes based on internet exposure, presence of a vulnerability in the Known Exploited Vulnerabilities (KEV) catalog, whether exploitation can be automated for large-scale attacks, and if the exploitation can translate to partial or total control of a system. Based on these risk factors, agencies may have to address these flaws within three days. The development is a sign that AI is not only lowering the barrier to exploit development and accelerating vulnerability research, but also allowing attackers to quickly incorporate newly disclosed flaws into their arsenal. «Cyber threat actors exploit unpatched vulnerabilities, and their use of AI may further narrow the time defenders have to react between patch release and possible exploitation,» CISA said. «These factors provide federal agencies with a comprehensive risk picture to make informed decisions that significantly reduce risk without burdening IT managers with extra processes that do not change outcomes.»

The lesson this week is not subtle. Trust is the attack surface now. The browser extension, the AI chat link, the OAuth flow, the coding agent, the package install, and the “known good” cloud helper. Attackers are not always breaking down the door anymore. They are finding the doors we already propped open for convenience.

That means defense has to get less romantic about defaults. Watch the tools users trust, not just the files they download. Audit agents like accounts. Treat packages like code execution. Treat links from trusted platforms like links, not proof of safety. The internet did not collapse this week. It reminded us that “legitimate” is not the same as safe.

admin Noticias, Trending 290M Abuse CYBERDEFENSA.MX DeFi Farms Hack LotL macOS ProxySmart SIM Stories

$290M DeFi Hack, macOS LotL Abuse, ProxySmart SIM Farms +25 New Stories – CYBERDEFENSA.MX

You scroll past one incident and see another that feels familiar, like it should have been fixed years ago, but it still works with small changes. Same bugs. Same mistakes.

The supply chain is messy. Packages you did not check are stealing data, adding backdoors, and spreading. Attacking the systems behind apps is easier than breaking the apps themselves. The exploits are simple but still work, giving attackers easy access.

AI tools are also part of the problem now. They trust bad input and take real actions, which makes the damage bigger. Then there are quieter issues. Apps take data they should not. Devices behave in strange ways. Attackers keep testing what they can get away with. No noise. Just ongoing damage.

Here is the list for this week’s ThreatsDay Bulletin.

State-backed crypto heist

Inter-blockchain communication protocol LayerZero has revealed that North Korean threat actors tracked TraderTraitor may have been behind the recent hack of decentralized finance (DeFi) project KelpDAO, resulting in the theft of $290 million. «The attack was specifically engineered to manipulate or poison downstream RPC infrastructure by compromising a quorum of the RPCs the LayerZero Labs DVN relied upon to verify transactions,» LayerZero said. KelpDAO, in a post on X, said, «Two RPC nodes hosted by LayerZero were compromised. A simultaneous DDoS attack was launched against the third RPC node. This was an attack on LayerZero’s infrastructure. Kelp’s own systems were not involved in building or operating that infrastructure.» Meanwhile, the Arbitrum Security Council has temporarily frozen the 30,766 ETH being held in the address on Arbitrum One that is connected to the KelpDAO exploit. It’s worth noting that TraderTraiter was attributed to the mega Bybit hack in early 2025 that led to the theft of $1.5 billion in digital assets. Recently, Lazarus Group was also linked to the $285 million theft from the Drift Protocol.
Active RCE exploits

Separately, VulnCheck has warned of attacks attempting to exploit two flaws in MajorDoMo, a smart home automation platform. While CVE-2026-27175 is a critical command injection vulnerability that started seeing exploitation on April 13, CVE-2026-27174 allows unauthenticated remote code execution via the PHP console in the admin panel and was first detected on April 18. «CVE-2026-27175 was exploited to drop a PHP webshell that delivers persistent backdoor access,» VulnCheck said. «CVE-2026-27174 saw exploitation that ended in a Metasploit php/meterpreter/reverse_tcp staged payload.» Other vulnerabilities that have witnessed exploitation efforts include CVE-2025-22952, an SSRF in Elestio Memos, and CVE-2024-57046, an authentication bypass in NETGEAR DGN2200 routers.
Supply chain malware surge

A number of malicious packages have been discovered in the npm registry: ixpresso-core, forge-jsx, @genoma-ui/components, @needl-ai/common, rrweb-v1, cjs-biginteger, sjs-biginteger, bjs-biginteger, @fairwords/websocket, @fairwords/loopback-connector-es, @fairwords/encryption, js-logger-pack, and @kindo/selfbot. These packages come with features to steal sensitive data from compromised hosts, perform system reconnaissance, andimplant an SSH backdoor by injecting the attacker’s public key into ~/.ssh/authorized_keys, deliver an information stealer, and spread the XWorm remote access trojan (RAT). The packages published under the «@fairwords» scope have also been found to self-propagate to all npm packages using the victim’s token and attempt cross-ecosystem propagation to PyPI via .pth file injection. New versions of js-logger-pack have since been found to leverage the Hugging Face repository to poll for updates and use it as a data-theft destination. Also detected was the compromise of @velora-dex/sdk (version 9.4.1) to decode and execute a Base64 payload that fetches a shell script from a remote server that, in turn, downloads and persists a Go-based remote access trojan called minirat on macOS systems. Another legitimate package to be compromised was mgc (versions 1.2.1 through 1.2.4), which was injected with a dropper that detects the operating system and fetches a platform-specific RAT from a GitHub Gist to exfiltrate valuable data.
AI prompt injection surge

Forcepoint has detected 10 new indirect prompt injection (IPI) payloads targeting artificial intelligence (AI) agents with malicious instructions designed to achieve financial fraud, data destruction, API key theft, and AI denial-of-service attacks. «Regardless of the specific payload technique or attacker intent, every case follows the same fundamental sequence: the attacker poisons web content, hides the payload from human view, waits for an AI agent to ingest the page, exploits the LLM’s inability to distinguish trusted instructions from attacker-controlled content, and triggers a real-world action with a covert exfiltration return channel back to the attacker,» the company said.
Covert browser data access

The Claude desktop app has been found granting itself permission to access web browser data, even if some browsers haven’t even been installed on a user’s computer, web privacy expert Alexander Hanff said. The app has been spotted placing configuration files in preset locations for Chromium-based browsers like Brave, Google Chrome, Microsoft Edge, and Vivaldi. The Native Messaging manifest files pre-authorize Claude to interact with the browser even before the user installs it. The issue has been described as a case of dark pattern that violates privacy laws in the E.U.
Hardware display protection

The U.K. National Cyber Security Centre (NCSC) has unveiled a new technology called SilentGlass that’s designed to protect video connections from cyber attacks. «SilentGlass, a plug-and-play device, actively blocks anything unexpected or malicious between HDMI and Display Port connections and screens,» NCSC said. «Already successfully deployed on Government estates, SilentGlass is now available for anyone to buy and use. It has been approved for use in the most high-threat environments.»
Passkeys replace passwords

In a related development, the NCSC also endorsed passkeys as the default authentication standard and the «first choice of login» for access to all digital services. «Passkeys are a newer method for logging into online accounts, which do much of the heavy lifting for users, only requiring user approval rather than needing to input a password,» NCSC said. «This makes passkeys quicker and easier to use and harder for cyber attackers to compromise.» It also said the majority of cyber harms to individuals begin with criminals stealing or compromising login details, which makes passkey adoption a «huge leap» in boosting resilience to phishing attacks. More than 50% of active Google services users in the U.K. are said to be already using passkeys.
Backdoor sabotage claims

Reports from Iranian media have claimed that hardware made by Cisco, Juniper, Fortinet, and MikroTik either rebooted or disconnected during recent attacks on Iran, despite the country being cut off from the global internet. «The most striking and suspicious aspect of this incident is its precise timing and the lack of access to the international internet at that moment,» Iranian news website Entekhab said. «This disruption occurred at a time when international gateways were effectively blocked or inaccessible; therefore, attributing this chain collapse to ‘a simple cyber attack from beyond the borders’ is not only unconvincing but also reveals the traces of deep-seated sabotage embedded within the equipment.» The report hypothesizes the presence of hidden firmware backdoors or rogue implants within compromised devices, creating a dormant botnet that’s activated when a certain event occurs without the need for internet access. The other possibility is a supply chain compromise. «If the chips or installation files of Cisco and Juniper products are compromised before entering the country, even replacing the operating system will not solve the problem, because the root of the problem is embedded in the hardware and read-only memory (ROM),» the report said. These arguments have found purchase in China, whose state media agency Xinhua called U.S.-made equipment the «real trojan horse.» The disclosure comes as DomainTools revealed that the various hacktivist personas adopted by Iran, such as Homeland Justice, Karma, and Handala, «constitute a coordinated, MOIS-aligned cyber influence ecosystem operating under multiple branded identities that serve distinct but complementary operational roles.»
Ransomware infighting escalates

The Krybit ransomware group has hacked the website of rival ransom group 0APT after the latter threatened to dox Krybit’s members. According to security firm Barricade, 0APT leaked the complete database of the Krybit ransomware operation, including victim records, plaintext credentials, Bitcoin wallets, encryption tokens, and a 56MB exfiltration file inventory. In return, Krybit has hit back by compromising 0APT’s server within 48 hours, defacing their data leak site, and publishing source code, bash history, Nginx logs, and system files. To rub salt into the wound, the group listed 0APT as victim #1 on their own leak site.
Stealth malware-as-a-service

There is a new cryptor-as-a-service platform called FUD Crypt (fudcrypt[.]net). «For $800 to $2,000 per month, subscribers upload an arbitrary Windows executable and receive a multi-stage deployment package that attempts automatic DLL sideloading, in-memory AMSI and ETW interference, silent UAC elevation via CMSTPLUA, and Windows Defender tamper via Group Policy on Enterprise builds,» Ctrl-Alt-Intel said.
Formbook phishing surge

Two different phishing campaigns targeting Greek, Spanish, Slovenian, Bosnian, Latin, and Central American companies are using different techniques to deliver Formbook malware. «FormBook is a data-stealing malware that targets Windows systems, primarily distributed through phishing emails with malicious attachments,» WatchGuard said. “It collects sensitive information like login credentials, browser data, and screenshots, using advanced evasion techniques to avoid detection.”
Stealth .NET execution abuse

A highly sophisticated, multi-stage post-exploitation framework has been observed targeting organizations in the Middle East and EMEA financial sectors. «The threat actor leverages a legitimate, digitally signed Intel utility (IAStorHelp.exe) by abusing the .NET AppDomainManager mechanism, effectively turning a trusted binary into a stealthy execution container,» CYFIRMA said. «This approach allows malicious code to be executed within a trusted environment. It bypasses conventional security controls without modifying the original signed binary.» Because AppDomainManager hijacking enables stealth execution within a trusted signed binary, it allows malicious code to run without modifying the original executable, effectively bypassing code-signing trust controls. The attack begins with a phishing email containing a ZIP archive, which contains an LNK file masquerading as a PDF document to execute «IAStorHelp.exe.» It’s currently not known who is behind the campaign, but the level of sophistication, modular design, and operational discipline suggest capabilities consistent with advanced threat actors.
RAT plus adware bundle

A new malware campaign is spreading both a remote access trojan and adware together, allowing attackers to establish persistent access and make financial profits. The attack has been found to leverage a loader to deliver Gh0st RAT trojan and CloverPlus adware, an unwanted software designed to install advertising components and change browser behavior, such as startup pages and pop-up ads, per Splunk.
macOS stealth execution abuse

In a new analysis, Cisco Talos revealed that bad actors can bypass security controls in Apple macOS by repurposing native features like Remote Application Scripting (RAS) for remote execution and abusing Spotlight metadata (Finder comments) to stage payloads in a way that evades static file analysis. «Because Finder is scriptable over RAE, the comment of a file on a remote machine can be set via the “eppc://” protocol. By Base64 encoding a payload locally, a multi-line script can be stored within this single string field. The make new file command handles the creation of the target file, ensuring that no pre-existing file is required,» Talos said. «The payload resides entirely within the Spotlight metadata, a location that remains largely unexamined by standard endpoint detection and response (EDR) solutions. This creates a stealthy staging area where malicious code can persist on the disk without triggering alerts associated with suspicious file contents.» In addition, attackers can move toolkits and establish persistence using built-in protocols such as SMB, Netcat, Git, TFTP, and SNMP operating entirely outside the visibility of standard SSH-based telemetry. In some cases, adversaries can also bypass built-in restrictions by using Terminal as a proxy for execution, encoding payloads in Base64 and deploying them in stages.
LLM agent testing framework

A group of academics has released a hackable, modular, and configurable open-source framework called Terrarium for studying and evaluating decentralized LLM-based multi-agent systems (MAS). «As the capabilities of agents progress (e.g., tool calling) and their state space expands (e.g., the internet), multi-agent systems will naturally arise in unique and unexpected scenarios,» the researchers said, adding it acts as «an isolated playground for studying agent behavior, vulnerabilities, and safety. It enables full customization of the communication protocol, communication proxy, environment, tool usage, and agents.»
AI data privacy purge

According to Reuters, AI company Clarifai said it has deleted 3 million profile photos taken from dating site OkCupid in 2014. It follows a settlement reached last month between the U.S. Federal Trade Commission (FTC) and Match Group, OkCupid’s owner. Clarifai is said to have certified the data deletion to the FTC on April 7, 2026, and deleted any models that trained on the data. The company also emphasized that it hadn’t shared the data with third parties. The FTC opened the investigation in 2019, after The New York Times reported that Clarifai had built a training database using OkCupid dating profile photos. The behavior was a direct violation of OkCupid’s privacy policy, although Clarifai was not accused of wrongdoing.
Zero-credential RCE chain

VulnCheck said it’s seeing active exploitation of the Apache ActiveMQ Jolokia remote code execution chain that strings together CVE-2026-34197 and CVE-2024-32114. «CVE-2024-32114 removes authentication from the Jolokia endpoint entirely on ActiveMQ versions 6.0.0 through 6.1.1,» VulnCheck’s Jacob Baines said. «Combined with CVE-2026-34197, that is zero-credential RCE.»
Stealth phishing lure

There has been a surge in phishing emails utilizing empty subject lines as a way to lure users to actually click and open the email without the usual warning cues. Known as silent subject or null subject phishing, the technique is designed to exploit blind spots in email defenses, as it allows such emails to bypass security filters that rely on analyzing the subject lines for specific keywords that may indicate potential phishing or scam. «Emails with empty subject lines evade user suspicion by exploiting human curiosity,» CyberProof said. «The primary objective of a silent subject campaign is to gain initial access through social engineering, leading to credential compromise, unauthorized access, and potential lateral movement within targeted environments, especially focusing on high-value or VIP users.»
Industrial-scale SIM farms

A Belarus-based turnkey solution is assisting SIM farm operators in supporting cybercrime on an industrial scale. Infrawatch said that it identified 87 instances of ProxySmart control panels in 17 countries that are linked to at least 24 commercial proxy providers and 35 cellular providers. The footprint spans 94 phone farm locations, distributed across 19 U.S. states, as well as countries in Europe and South America. ProxySmart provides an end-to-end platform for operating and monetizing mobile proxy infrastructure, including farm management, device control, customer provisioning, retail proxy sales, and payment handling. It’s accessible via a web-based control panel that’s self-hosted by the farm operator. Devices in the farms are either physical Android phones or USB 4G/5G modems. The phones are enrolled via an unsigned Android APK package downloaded from the ProxySmart website, with SMS send and receive capability included. Modems are managed through ModemManager, an open-source USB dongle management tool. The ProxySmart service is written in Python and obfuscated using PyArmour. «ProxySmart is publicly associated with a Belarus-based vendor footprint and offers an end-to-end stack for operating and monetizing a physical farm, including device management, automated IP rotation, customer provisioning, plan enforcement, and anti-bot countermeasures,» the company said. «Technical analysis indicates operator capabilities consistent with large-scale evasion enablement, including automated IP rotation, remote device control, and network fingerprint spoofing.» SIM farms enable a range of cybercrime activity such as smishing, premium-rate number fraud, bot sign-ups, and one-time password interception. In response to the findings, ProxySmart disputed its characterization as a SIM farm, stating it’s a «data-path proxy management platform» and that its mobile proxy infrastructure «underpins a wide range of legitimate commercial and research activity» including advertising verification, brand protection, price monitoring, and anti-fraud model training, among others.
Telegram under CSAM probe

Ofcom, the U.K.’s independent communications regulator, has launched an investigation into Telegram under the country’s Online Safety Act to examine whether the platform is being used to share child sexual abuse material (CSAM) and is doing enough to combat the threat. «We received evidence from the Canadian Centre for Child Protection regarding the alleged presence and sharing of child sexual abuse material on Telegram, and carried out our own assessment of the platform,» Ofcom said. «In light of this, we have decided to open an investigation to examine whether Telegram has failed, or is failing, to comply with its duties in relation to illegal content.» In a statement shared with The Record, Telegram said it «categorically denies Ofcom’s accusations,» adding it has «virtually eliminated the public spread of CSAM on its platform through world-class detection algorithms and cooperation with NGOs.» Earlier this year, Ofcom also commenced a probe into X to determine whether the service is taking necessary steps to take down illegal content, including non-consensual intimate images and CSAM.
EU cracks disinfo ops

The European Union imposed sanctions on two pro-Russian organizations accused of spreading disinformation and supporting the Kremlin’s hybrid influence operations against Europe and Ukraine. The measures target Euromore and the Foundation for the Support and Protection of the Rights of Compatriots Living Abroad (Pravfond). The move is part of the E.U.’s broader effort to counter Russian information and influence operations targeting Europe since the start of Moscow’s full-scale invasion of Ukraine in 2022. The E.U. has imposed sanctions on 69 individuals and 19 entities linked to Russian hybrid warfare.
Bot farm dismantled

Ukrainian authorities have dismantled a bot farm that’s alleged to have supplied thousands of fake social media accounts to Russian intelligence services for use in disinformation campaigns against Ukraine. The suspected organizer of the network has been detained in the northern city of Zhytomyr, and nearly 20,000 fraudulent online profiles that were used in information operations have been blocked. The suspect is believed to have sold more than 3,000 fake Telegram accounts each month to Russian clients. The accounts were created using Ukrainian mobile phone numbers and then advertised on online platforms used by pro-Russian actors. If convicted, the suspect faces up to six years in prison.
Malicious extensions surge

More than 130,000 users have downloaded and installed malicious Chrome and Edge extensions that, while offering the promised functionality, also implement covert tracking, remote configuration capabilities, and data collection mechanisms.The 12 extensions posed as tools to download TikTok videos and were available through the official Chrome and Edge stores. The activity has been codenamed StealTok. The extensions have been found to use remote configuration to bypass store review. «Beyond privacy concerns, the use of remote configuration endpoints introduces a significant security risk, enabling post-installation behavior changes that bypass marketplace review mechanisms,» LayerX said.
Joomla SEO spam backdoor

In a new campaign spotted by Sucuri, threat actors are planting a new PHP-based backdoor on Joomla sites to inject SEO spam. The injected script acts as a remote loader to send information about the infected website and awaits further instructions from an attacker-controlled server. «Attackers inject malicious code that silently serves spam content to visitors and search engines, all without the site owner knowing,» Sucuri said. «The goal is simple: abuse the site’s reputation to push traffic towards products the attacker wants to promote.»
Post-exfiltration data trade

A new service called Leak Bazaar has been promoted on the Russian-speaking TierOne forum that claims to process data stolen from extortion and ransomware attacks and turn it into «something more legible, more selective and precise, and making it marketable for the general population to ingest.» It’s advertised by a user named Snow, who joined the forum on March 3, 2026. «What Leak Bazaar is really offering is not a DLS or Data or Dedicated Leak Site in the conventional sense, but a post-exfiltration service layer,» Flare said. «It is trying to reassure both suppliers and buyers that the platform can solve the most frustrating part of data theft, which is that a large percentage of exfiltrated material is too noisy, too unstructured, or too cumbersome to use without additional labor.»
RDP scanning concentration

GreyNoise has disclosed that a small cluster of 21 IP addresses is now responsible for generating nearly half of all the RDP scanning traffic on the public internet. The addresses are registered to ColocaTel (AS213438), a company based in the Seychelles. According to the threat intelligence firm, mass internet scanning activity is now preceding vendor vulnerability disclosures more frequently than before, with 49% of surges arriving within 10 days of disclosure and 78% within 21 days.In a related development, security researcher Morgan Robertson revealed that almost three-quarters of Perforce P4 source code management servers connected to the internet are misconfigured and leaking source code and sensitive files. «The default Perforce settings allow unauthenticated users to create accounts, list existing users, access passwordless accounts, and, until version 2025.1, allowed syncing repositories remotely; potentially exposing intellectual property across more than a dozen sectors, including gaming, healthcare, automotive, finance, and government,» Robertson said. «Action is recommended for all Perforce administrators to ensure security hardening, including setting stronger authentication requirements, disabling automatic account creation, and raising security levels.»

None of this is new. That is the problem. Old paths still open, basic checks still skipped, and trust still given where it should not be. Attackers are not doing anything magical, they are just faster and less careful because they do not need to be.

The fixes are known but ignored. Patch early, check what you install, limit access, and stop trusting inputs by default. Most of the damage comes from things that were easy to prevent. Same story next week.

admin Noticias, Trending Abuse Citrix CYBERDEFENSA.MX exploits FortiGate LiveChat MCP Phish RaaS

FortiGate RaaS, Citrix Exploits, MCP Abuse, LiveChat Phish & More – CYBERDEFENSA.MX

ThreatsDay Bulletin is back on The Hacker News, and this week feels off in a familiar way. Nothing loud, nothing breaking everything at once. Just a lot of small things that shouldn’t work anymore but still do.

Some of it looks simple, almost sloppy, until you see how well it lands. Other bits feel a little too practical, like they’re already closer to real-world use than anyone wants to admit. And the background noise is getting louder again, the kind people usually ignore.

A few stories are clever in a bad way. Others are just frustratingly avoidable. Overall, it feels like quiet pressure is building in places that matter.

Skim it or read it properly, but don’t skip this one.

Emerging RaaS exploiting FortiGate flaws

Group-IB has shed light on the various tactics adopted by The Gentlemen, a nascent Ransomware-as-a-Service (RaaS) operation that consists of about 20 members. It originated from a payment dispute after its operator «hastalamuerte» opened a public arbitration thread on the RAMP cybercrime forum, accusing Qilin ransomware operators of unpaid affiliate commission amounting to $48,000. The group primarily uses CVE-2024-55591, a critical authentication bypass vulnerability in FortiOS/FortiProxy, for initial access. «The group maintains an operational database of approximately 14,700 already exploited FortiGate devices globally,» the company said. «Separate from exploited devices, the operators maintain 969 validated brute-forced FortiGate VPN credentials ready for attack.» The Gentlemen also employs defense evasion via the bring your own vulnerable driver (BYOVD) technique to terminate security processes at the kernel level. About 94 organizations have already been attacked by this threat group since its emergence in July/August 2025.
Pre-auth RCE chain in ITSM platform

Four security flaws (CVE-2025-71257, CVE-2025-71258, CVE-2025-71259, and CVE-2025-71260) have been disclosed in BMC FootPrints, a widely deployed ITSM solution, that could be chained into pre-authentication remote code execution. The attack sequence begins with an authentication bypass (CVE-2025-71257) that extracts a guest session token («SEC_TOKEN») from the password reset endpoint, which is then used to reach an unsanitized Java deserialization sink (CVE-2025-71260) in the «/aspnetconfig» endpoint’s «__VIEWSTATE» parameter. Exploitation via the AspectJWeaver gadget chain enables arbitrary file write to the Tomcat web root directory, achieving full remote code execution. Armed with the SEC_TOKEN, an attacker could also exploit two SSRF flaws (CVE-2025-71258 and CVE-2025-71259) and potentially leak internal data. The issues were addressed in September 2025.
Loader deploys stealthy C2 malware

The malware loader known as Hijack Loader is being used to deliver a previously undocumented, C++-based command-and-control (C2) framework known as SnappyClient. «SnappyClient has an extended list of capabilities, including taking screenshots, keylogging, a remote terminal, and data theft from browsers, extensions, and other applications,» Zscaler ThreatLabz said. «SnappyClient employs multiple evasion techniques to hinder endpoint security detection, including an Antimalware Scan Interface (AMSI) bypass, as well as implementing Heaven’s Gate, direct system calls, and transacted hollowing. SnappyClient receives two configuration files from the C2 server, which contain a list of actions to perform when a specified condition is met, along with another that specifies applications to target for data theft.» The framework was first discovered in December 2025. The attack chain involves the distribution of malicious payloads after a user visits a website impersonating the Spanish telecom firm Telefónica. It’s assessed that the primary use for SnappyClient is cryptocurrency theft, with a possible connection between the developers of HijackLoader and SnappyClient based on observed code similarities.
Deep link abuse enables command execution

Proofpoint has detailed a new technique called CursorJack that abuses Cursor’s support for Model Context Protocol (MCP) deep links to enable local command execution or allow installation of a malicious remote MCP server. The attack takes advantage of the fact that MCP servers commonly specify a command in their «mcp.json» configuration. «The cursor:// protocol handler could be abused through social engineering in specific configurations,» the company said. «A single click followed by user acceptance of an install prompt could result in arbitrary command execution. The technique could be leveraged both for local code execution via the command parameter or to install a malicious remote MCP server via the URL parameter.» The enterprise security firm has also released a proof-of-concept (PoC) exploit on GitHub.
Mass exploitation hits Citrix flaws

A new campaign is actively targeting known security flaws in Citrix NetScaler (CVE-2025-5777 and CVE-2023-4966). According to Defused Cyber, more than 500 exploit attempts have been recorded against its honeypot system on March 16, 2026. «Highly elevated exploit activity against older vulnerabilities can often precede a zero-day vulnerability,» it said.
Teams phishing grants remote access

Rapid7 said it’s seeing an increase in phishing campaigns where threat actors impersonate internal IT departments via Microsoft Teams. «The primary objective is to persuade users to launch Quick Assist, granting the TA remote access to deploy malware, exfiltrate data, or facilitate lateral movement across the network,» it added. «The recent surge in Teams-based delivery highlights a critical vulnerability in how organizations manage external access. Teams often allows any external user to message internal staff. This is the functional equivalent of operating an email server without a gateway filter.»
ClickFix delivers AutoHotKey backdoor

A new ClickFix-style campaign has compromised a Pakistani government website («wasafaisalabad.gop[.]pk») to deliver fake CAPTCHA lures. The attack chain installs an MSI installer via a disguised clipboard command, which drops an AutoHotKey-based backdoor polling a remote server for tasks, Gen Digital said. It’s currently not known how the website was breached. The social engineering tactic has proved so effective that even nation-state groups such as North Korea’s Lazarus group, Iran’s MuddyWater, and Russia’s APT28 have adopted it. In January, researchers from Sekoia reported that a separate ClickFix framework dubbed IClickFix had been injected into over 3,800 WordPress sites since 2024.
Stealer upgrade spreads via pirated games

The malware loader known as Hijack Loader is being used to deliver an updated version of an information stealer referred to as ACRStealer. «This updated variant follows similar evasion techniques and C2 initialization strategy to make it even stealthier,» G DATA said. «This integration with HijackLoader highlights ACRStealer’s versatility and modularity, which will likely attract more malicious actors to use it as a final payload.» In these campaigns, Hijack Loader is downloaded from the domain associated with PiviGames, a Spanish portal hosting pirated PC games. The development comes against the backdrop of another campaign that involved several cases of malware being distributed through PiviGames.
Live chat phishing steals sensitive data

A new phishing campaign has been observed using LiveChat, a customer service software featuring live messaging, to steal data. Phishing emails using refund-related themes are used to redirect users to a link hosted via LiveChat’s service («direct.lc[.]chat»), from where they are asked to click on a link sent in the chat to complete the refund by entering their personal and financial information. «Unlike typical refund scams or credential phishing, this campaign engages victims through a real-time chat interface, impersonating well-known brands in order to harvest sensitive data such as account credentials, credit card details, multi-factor authentication (MFA) codes, and other personally identifiable information (PII),» Cofense said.
RagaSerpent expands multi-region espionage

A SideWinder-adjacent cluster known as RagaSerpent is suspected to be leveraging tax audit and government compliance themes in spear-phishing emails to deliver multi-stage malware for command-and-control (C2) and establish sustained access across targeted organizations in Southeast Asia, including Indonesia and Thailand. The attack chain is consistent with a prior campaign targeting India using similar tax-related lures to deliver a legitimate enterprise tool called SyncFuture TSM, developed by a Chinese company. «This is not unusual in APT operations: in-country targeting can be used to complicate attribution (e.g., by creating noisy ‘domestic’ victimology) or to reach foreign diplomats/missions operating inside India—a pattern explicitly noted in reporting on SideWinder’s broader geographic targeting and diplomatic victim set,» ITSEC Asia said. The recent campaigns show the threat actor has expanded its operations beyond South Asia and into Africa, Europe, the Middle East, and Southeast Asia.
Unauthenticated access exposed device data

DJI has patched a security flaw in its backend that could have allowed attackers to take over all its Romo smart vacuums. Security researcher Sammy Azdoufal said DJI servers returned data for any device just by providing a device serial number. DJI shared the data on any device without any authentication or authorization. The researcher said he was able to map the locations of more than 7,000 Romo smart vacuums and 3,000 DJI portable power stations that shared the same server.
New password layer strengthens account security

WhatsApp has begun testing support for setting an alphanumeric account password. It can be anywhere between six and 20 characters long and should include at least one letter and one number. Adding an alphanumeric password to the equation is likely an effort to make brute-force attempts harder. For example, if a threat actor carries out a SIM swap to intercept messages and bypass two-factor authentication, they would still need to enter the 6-20 character-long password to gain access to the victim’s WhatsApp account.
Suspected ransomware group appears fabricated

More evidence has emerged that the 0APT ransom group is likely a fake and a fraud. «Thus far, the threat actor has not provided credible proof of ransomware or data exfiltration attacks as the data samples on the DLS appeared to be fabricated,» Intel 471 said. «For example, the files that supposedly contained metadata of data stolen from victim networks were unusually large, reaching several terabytes each. Additionally, partial downloads of those files indicated they did not contain any useful data, and in fact, we observed several instances in which the content contained a repeating pattern of null bytes.»
Google blocks millions of risky apps

Google rejected 1.75 million policy-violating Android apps and blocked more than 80,000 developer accounts from the Google Play Store in 2025, down from 2.36 million apps and 158,000 accounts in 2024. The company said that through 2025, it blocked more than 255,000 Android apps from obtaining excessive access to sensitive user data, and that it implemented more than 10,000 safety checks on published apps and strengthened detection capabilities by integrating Google’s latest generative artificial intelligence (AI) models into the review process. Android’s built-in security suite, Play Protect, which now scans over 350 billion apps every day, has identified over 27 million malicious apps sideloaded from outside Google Play. Play Protect’s ‘enhanced fraud protection’ has been expanded to cover over 2.8 billion Android devices in 185 markets, blocking 266 million installation attempts from 872,000 unique risky apps. In a related development, the tech giant has made available Scam Detection for phone calls on Google Pixel devices in the U.S., U.K., Australia, Canada, France, Germany, India, Ireland, Italy, Japan, Mexico, and Spain. It’s also being expanded to Samsung Galaxy S26 series in the U.S.
1% of flaws drove most attacks

A report from VulnCheck found that a mere 1% of 2025 CVEs were exploited in the wild by the end of the year. Network edge devices accounted for a third of all products exploited last year. «There was a small decrease (-13%) in new vulnerabilities linked to named state-sponsored threat groups and APTs over the course of 2025,» the cybersecurity company said. «New CVE exploits attributed to China-nexus groups increased while Iranian exploit activity fell.» Another report from IBM X-Force revealed that there has been a 44% increase in cyberattacks exploiting public-facing applications.
AOT malware evades analysis and detection

A previously undocumented attack chain delivered via a phishing URL has been found to distribute a ZIP archive containing a C++ trojan downloader, which then initiates a loader responsible for decrypting and staging the Rhadamanthys stealer and XMRig cryptocurrency miner. «The campaign’s core evasion relies on .NET Native Ahead-of-Time (AOT) compiled binaries, which strip traditional .NET metadata, frustrate common .NET analysis tools, and force analysts to fall back on native-level tooling, making detection and reverse engineering significantly harder,» Cyderes said. «Sophisticated anti-analysis capabilities: The AOT loader employs a sandbox scoring system evaluating RAM size, system uptime, user file counts, and AV process presence; virtual machine detection via registry inspection; and active suppression of miner activity when monitoring tools like Task Manager, Process Hacker, or x64dbg are detected.»
Secrets sprawl surges across GitHub

GitGuardian’s State of Secrets Sprawl report has found that 28,649,024 new secrets were added to public GitHub commits in 2025 alone, up 34% from the previous year. The figure also represents a 152% increase in leaked secrets growth since 2021. In 2025, AI service secrets reached 1,275,105, up 81% year-over-year. Also identified by GitGuardian were 24,008 unique secrets exposed in MCP-related configuration files across public GitHub, including 2,117 unique valid credentials.
Malicious themes inject ads and redirects

Six malicious Packagist packages posing as OphimCMS themes have been found to contain trojanized jQuery that exfiltrates URLs, injects full-screen overlay ads, and loads Funnull-linked redirects. The packages are ophimcms/theme-dy, ophimcms/theme-mtyy, ophimcms/theme-rrdyw, ophimcms/theme-pcc, ophimcms/theme-motchill, and ophimcms/theme-legend. «All six ship trojanized JavaScript assets, primarily disguised as legitimate jQuery libraries, that redirect visitors, exfiltrate URLs, inject ads, and in the most severe case load a second-stage payload – a mobile-targeted redirect to gambling and adult content sites, from infrastructure operated by Funnull,» Socket said.
Multi-stage phishing bypasses security filters

A C-level executive at Swedish security firm Outpost24 was targeted in a sophisticated phishing attack. The multi-chain redirect phishing campaign impersonated JPMorgan Chase to trick the recipient into reviewing a document by clicking on a link and triggering the infection. The link is a redirect URL hosted within Cisco’s infrastructure, which then initiates a series of URL redirects that leverage trusted services like Nylas as well as compromised legitimate infrastructure to bypass security filters and conceal the final phishing destination. «Several stages redirect victims through legitimate or previously reputable domains, reducing the likelihood that security scanners or reputation-based filtering will block the link,» Specops said. «The attackers went as far as to implement a legitimate Cloudflare-based ‘human validation’ step to ensure that only real people saw the actual landing page where credentials are requested.» The attack, ultimately unsuccessful, is said to have used a new phishing-as-a-service (PhaaS) toolkit named Kratos.

Some of this will fade by next week. Some of it won’t. That’s the annoying part, figuring out which “minor” thing quietly sticks around and turns into a real problem later.

Anyway, that’s the rundown. Take what you need, ignore what you can, and keep an eye on the stuff that feels a little too easy.

julio 29, 2026

Or Check Our Popuplar Categories...

Tag Archives: Abuse