Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label malware. Show all posts
Telegram
AI Development ChatGPT Cyberattacks CyberCrime CyberThreat GhostGPT malware Telegram

Cyberattackers Exploit GhostGPT for Low-Cost Malware Development

 


The landscape of cybersecurity has been greatly transformed by artificial intelligence, which has provided both transformative opportunities as well as emerging challenges. Moreover, AI-powered security tools have made it possible for organizations to detect and respond to threats much more quickly and accurately than ever before, thereby enhancing the effectiveness of their cybersecurity defenses. 

These technologies allow for the analysis of large amounts of data in real-time, the identification of anomalies, and the prediction of potential vulnerabilities, strengthening a company's overall security. Cyberattackers have also begun using artificial intelligence technologies like GhostGPT to develop low-cost malware. 

By utilizing this technology, cyberattackers can create sophisticated, evasive malware, posing a serious threat to the security of the Internet. Therefore, organizations must remain vigilant and adapt their defenses to counter these evolving tactics. However, cybercriminals also use AI technology, such as GhostGPT, to develop low-cost malware, which presents a significant threat to organizations as they evolve. By exploiting this exploitation, they can devise sophisticated attacks that can overcome traditional security measures, thus emphasizing the dual-edged nature of artificial intelligence. 

Conversely, the advent of generative artificial intelligence has brought unprecedented risks along with it. Cybercriminals and threat actors are increasingly using artificial intelligence to craft sophisticated, highly targeted attacks. AI tools that use generative algorithms can automate phishing schemes, develop deceptive content, or even build alarmingly effective malicious code. Because of its dual nature, AI plays both a shield and a weapon in cybersecurity. 

There is an increased risk associated with the use of AI tools, as bad actors can harness these technologies with a relatively low level of technical competence and financial investment, which exacerbates these risks. The current trend highlights the need for robust cybersecurity strategies, ethical AI governance, and constant vigilance to protect against misuse of AI while at the same time maximizing its defense capabilities. It is therefore apparent that the intersection between artificial intelligence and cybersecurity remains a critical concern for the industry, policymakers, and security professionals alike. 

Recently introduced AI chatbot GhostGPT has emerged as a powerful tool for cybercriminals, enabling them to develop malicious software, business email compromise scams, and other types of illegal activities through the use of this chatbot. It is GhostGPT's uniqueness that sets it apart from mainstream artificial intelligence platforms such as ChatGPT, Claude, Google Gemini, and Microsoft Copilot in that it operates in an uncensored manner, intentionally designed to circumvent standard security protocols as well as ethical requirements. 

Because of its uncensored capability, it can create malicious content easily, providing threat actors with the resources to carry out sophisticated cyberattacks with ease. It is evident from the release of GhostGPT that generative AI poses a growing threat when it is weaponized, a concern that is being heightened within the cybersecurity community. 

A tool called GhostGPT is a type of artificial intelligence that enables the development and implementation of illicit activities such as phishing, malware development, and social engineering attacks by automating these activities. A reputable AI model like ChatGPT, which integrates security protocols to prevent abuse, does not have any ethical safeguards to protect against abuse. GhostGPT operates without ethical safeguards, which allows it to generate harmful content unrestrictedly. GhostGPT is marketed as an efficient tool for carrying out many malicious activities. 

A malware development kit helps developers generate foundational code, identify and exploit software vulnerabilities, and create polymorphic malware that can bypass detection mechanisms. In addition to enhancing the sophistication and scale of email-based attacks, GhostGPT also provides the ability to create highly customized phishing emails, business email compromise templates, and fraudulent website designs that are designed to fool users. 

By utilizing advanced natural language processing, it allows you to craft persuasive malicious messages that are resistant to traditional detection mechanisms. GhostGPT offers a highly reliable and efficient method for executing sophisticated social engineering attacks that raise significant concerns regarding security and privacy. GhostGPT uses an effective jailbreak or open-source configuration to execute such attacks. ASeveralkey features are included, such as the ability to produce malicious outputs instantly by cybercriminals, as well as a no-logging policy, which prevents the storage of interaction data and ensures user anonymity. 

The fact that GhostGPT is distributed through Telegram lowers entry barriers so that even people who do not possess the necessary technical skills can use it. Consequently, this raises serious concerns about its ability to escalate cybercrime. According to Abnormal Security, a screenshot of an advertisement for GhostGPT was revealed, highlighting GhostGPT's speed, ease of use, uncensored responses, strict no-log policy, and a commitment to protecting user privacy. 

According to the advertisement, the AI chatbot can be used for tasks such as coding, malware creation, and exploit creation, while also being referred to as a scam involving business email compromise (BEC). Furthermore, GhostGPT is referred to in the advertisement as a valuable cybersecurity tool and has been used for a wide range of other purposes. However, Abnormal has criticized these claims, pointing out that GhostGPT can be found on cybercrime forums and focuses on BEC scams, which undermines its supposed cybersecurity capabilities. 

It was discovered during the testing of the chatbot by abnormal researchers that the bot had the capability of generating malicious or maliciously deceptive emails, as well as phishing emails that would fool victims into believing that the emails were genuine. They claimed that the promotional disclaimer was a superficial attempt to deflect legal accountability, which is a tactic common within the cybercrime ecosystem. In light of GhostGPT's misuse, there is a growing concern that uncensored AI tools are becoming more and more dangerous. 

The threat of rogue AI chatbots such as GhostGPT is becoming increasingly severe for security organizations because they drastically lower the entry barrier for cybercriminals. Through simple prompts, anyone, regardless of whether they possess any coding skills or not, can quickly create malicious code. Aside from this, GhostGPT improves the capabilities of individuals with existing coding experience so that they can improve malware or exploits and optimize their development. 

GhostGPT eliminates the need for time-consuming efforts to jailbreak generative AI models by providing a straightforward and efficient method of creating harmful outcomes from them. Because of this accessibility and ease of use, the potential for malicious activities increases significantly, and this has led to a growing number of cybersecurity concerns. After the disappearance of ChatGPT in July 2023, WormGPT emerged as the first one of the first AI model that was specifically built for malicious purposes. 

It was developed just a few months after ChatGPT's rise and became one of the most feared AI models. There have been several similar models available on cybercrime marketplaces since then, like WolfGPT, EscapeGPT, and FraudGPT. However, many have not gained much traction due to unmet promises or simply being jailbroken versions of ChatGPT that have been wrapped up. According to security researchers, GhostGPT may also busea wrapper to connect to jailbroken versions of ChatGPT or other open-source language models. 

While GhostGPT has some similarities with models like WormGPT and EscapeGPT, researchers from Abnormal have yet to pinpoint its exact nature. As opposed to EscapeGPT, whose design is entirely based on jailbreak prompts, or WormGPT, which is entirely customized, GhostGPT's transparent origins complicate direct comparison, leaving a lot of uncertainty about whether it is a custom large language model or a modification of an existing model.
Read more »
VPN
CyberCrime Cybersecurity CyberThreat Fake VPN Google malware SEO VPN

Malware Infections Surge from Fake VPN Downloads

 


An attacker is reportedly injecting malware into infected devices using popular VPN applications to gain remote control of the devices they are attacking. Google's Managed Defense team reported this disturbing finding, which sheds light on how malicious actors use SEO poisoning tactics to spread what is known as Playfulghost.

It has become increasingly important for individuals who prioritize the protection of their personal data and online privacy to use virtual private networks (VPNs). VPNs establish a secure, encrypted connection between users' devices and the internet, protecting their IP addresses and online activity against prying eyes. 

However, it should be noted that not all VPN applications are trustworthy. The number of fake VPN apps being distributed under the guise of legitimate services is increasing, stealing the sensitive information of unsuspecting users. Researchers have discovered that during the third quarter of 2024, fake VPN applications have become increasingly widespread globally, which is a worrying trend. In comparison to the second quarter, security analysts have reported a 2.5-fold increase in user encounters with fraudulent VPN apps.

These apps were either infected with malware or were built in such a way that they could be exploited by malicious actors. As a result of this alarming development, it is critical to be vigilant when choosing VPN services. Users should take precautionary measures when choosing VPN services and ensure that the apps they download are legitimate before downloading to safeguard their data and devices. 

As more and more home users turn to virtual private networks (VPNs) as a means to safeguard their privacy, to ensure their internet activity is secure, and to circumvent regional content blocks, these VPNs are becoming increasingly popular. Scammers and hackers are aware that the popularity of VPNs is growing, and so they intend to take advantage of that trend as much as possible. 

As an example, recently it has been found that some VPNs have been found to have security vulnerabilities that do not make them as secure as they should be. Playfulghost is a backdoor similar to Gh0st RAT, a remote administration tool that is well-known in the security community. According to Google's expert, Playfulghost is "a backdoor that shares functionality with Gh0st RAT." The latter has been around since 2008, and it is considered one of the best. 

The traffic patterns of Playfulghost can be distinguished from those of other known threats, especially in terms of encryption and traffic patterns. There are several ways hackers use phishing and SEO poisoning to trick their victims into downloading malicious software onto their computers, and according to a Google expert, one victim was tricked into opening a malicious image file for Playfulghost to run remotely from a remote location, which results in the malware being downloaded onto his computer. In the same vein, SEO poisoning techniques employed trojanized virtual private network (VPN) apps to download Playfulghost components from a remote server on the victims' devices (see GIF below). 

Infected with Payfulghost, an attacker can remotely execute a wide range of tasks on the device once it has been infected. It is particularly dangerous as a virus. Data mining is capable of capturing keystrokes, screenshots, and audio, as well as capturing screenshots. In addition to this, attackers can also perform file management activities, including opening, deleting, and writing new files. Security experts from Google have warned that a new malware threat has been detected that is very dangerous. It is known as Playfulghost and is distributed worldwide via fraudulent VPN apps. Researchers have warned that this scam uses sophisticated techniques to trick users into downloading infected VPN software, including what is called "SEO poisoning". 

There is something especially cruel about this latest cyberattack because signing up for one of the best VPN deals is usually an easy way to improve users' level of privacy and security online. Unfortunately, those who installed the fake VPN applications laced with malware in the last few days have now found themselves in the worst possible position due to the malware they have installed. As people know, the purpose of Playfulghost is to allow hackers to monitor every letter users type on their keyboard, a practice known as keylogging. 

It can also record audio from the built-in microphone on users' computers, laptops, tablets, or desktops, and it can also be used as a tool to record what they are seeing on the screen, which is often used for blackmail. The dangerous malware also enables attackers to remotely execute various file management activities, including opening, deleting, and writing new files, This can enable hackers to download and install other types of malware on machines infected with Playfulghost. Playfulghost also makes it possible for attackers to perform various file management activities remotely, such as opening, deleting, and creating files, allowing hackers to download and install other kinds of malware on computers infected with this dangerous malware. 

As it turns out, Playfulghost's functionality is quite similar to Gh0st RAT, which has wreaked havoc on PCs since 2001 and is now a public open-source tool, whose source code was released in 2008. Since this code is widely available, there have been several copies and clones created, including the latest variant. In addition to utilizing distinct traffic patterns and encryption, Google security researchers have pinpointed two methods by which the malware is being spread by hackers, according to their study. The first is using the infected computers' network cables and the second is via the Internet. 

 The first thing to know is that cybercriminals are utilizing phishing emails — unsolicited messages that entice people to download malicious software. One of the earliest examples that was spotted by Google's team involved emails with themes such as "Code of Conduct" which trick users into downloading the attached file, which turned out to be Playfulghost, a nasty infection. 

Another documented case has also been found in which a victim was tricked into opening a malicious image file and when they opened it in the background Playfulghost was automatically installed and activated on their computer from a remote server. Secondly, the malware may also be spread by bundling it with popular VPN apps in a process known as SEO poisoning. This method has been gaining popularity recently among virus creators. Search engine poisoning is the act of manipulating or hacking a search engine to make malicious downloads appear as an official import.
Read more »
malware
fake ads Google Ads Infostealer Malicious Campaign malware

Hackers Employ Fake Mac Homebrew Google Ads in Novel Malicious Campaign

 

Hackers are once more exploiting Google advertisements to disseminate malware, using a fake Homebrew website to compromise Macs and Linux systems with an infostealer that harvests credentials, browsing data, and cryptocurrency wallets. 

Ryan Chenkie discovered the fraudulent Google ad campaign and warned on X regarding the potential of malware infection. The malware employed in this operation is AmosStealer (aka 'Atomic'), an infostealer intended for macOS devices and sold to malicious actors on a monthly subscription basis for $1,000. 

The malware recently appeared in various malvertising campaigns promoting bogus Google Meet conferencing pages, and it is now the preferred stealer for fraudsters targeting Apple customers. 

Targeting Homebrew customers 

Homebrew is a popular open-source package manager for macOS and Linux that lets you install, update, and manage software using the command line. 

A fraudulent Google advertising featured the correct Homebrew URL, "brew.sh," misleading even seasoned users into clicking it. However, the ad redirected users to a bogus Homebrew website hosted at "brewe.sh". Malvertisers have extensively exploited this URL strategy to trick users into visiting what appears to be a legitimate website for a project or organisation.

When the visitor arrives at the site, he or she is requested to install Homebrew by copying and pasting a command from the macOS Terminal or Linux shell prompt. The official Homebrew website provides a similar command for installing legitimate software. However, running the command displayed on the bogus website will download and execute malware on the device. 

Cybersecurity expert JAMESWT discovered that the malware injected in this case [VirusTotal] is Amos, a potent infostealer that targets over 50 cryptocurrency extensions, desktop wallets, and online browser data. Mike McQuaid, Homebrew's project leader, indicated that the project is aware of the situation but that it is beyond its control, criticising Google's lack of oversight. 

"Mac Homebrew Project Leader here. This seems taken down now," McQuaid stated on X. "There's little we can do about this really, it keeps happening again and again and Google seems to like taking money from scammers. Please signal-boost this and hopefully someone at Google will fix this for good.”

At the time of writing, the malicious ad has been removed, but the campaign could still run through other redirection domains, therefore Homebrew users should be aware of sponsored project adverts.

To mitigate the risk of malware infection, while clicking on a link in Google, make sure you are directed to the authentic site for a project or company before entering sensitive information or installing software. Another safe option is to bookmark official project websites that you need to visit frequently when sourcing software and utilise them instead of searching online every time.
Read more »
Sophos
Cyberbreaches CyberCrime Fake IT Support malware Micrpsoft Teams ransomware attacks Sophos

Fake IT Support Used by Ransomware Gangs in Microsoft Teams Breaches

 


The Sophos security team has identified two ransomware campaigns that are utilizing Microsoft Teams to steal data from organizations, and the crooks may be allied with Black Basta and FIN7. In the X-Ops Managed Detection and Response (MDR) service, Sophos X-Ops responds to incidents related to two different groups of threat actors. In each case, the attackers gained access to targeted organizations by using the Microsoft Office 365 platform to steal data and deploy ransomware to steal data. 

This pair of separate clusters of activity were investigated by Sophos MDR in November and December 2024 as a result of customer reports, and the threat is tracked as STAC5143 and STAC5777, respectively. The two groups are utilizing Microsoft Office 365 services, including Teams and Outlook, to gain access to victim organizations, according to Sophos, who has observed over 15 incidents in just the past two weeks, the majority of which took place between November and December 2024. 

According to Sophos, the attackers took advantage of a Microsoft Teams configuration that allows users from external domains to initiate chats or meetings with internal users, thereby taking advantage of a default configuration, he warned. As a result of threat actors exploiting Microsoft Teams to pose as tech support personnel, attackers gain initial access to victim organizations by using the platform, and their goal is to steal data and deploy ransomware, according to a report released on Tuesday by Sophos, which examined ongoing threat campaigns related to these two threats. 

A customer who received over 3,000 spam emails in 45 minutes in November of last year first brought STAC5143 to the attention of the Sophos team. Shortly thereafter, a Microsoft Teams call from outside the organization, coming from a bogus "Help Desk Manager" account, reached out to the customer, and he was instructed to allow a remote screen control session through Microsoft Teams to resolve the issue. 

As it turned out, the attacker was exploiting this vulnerability to inject malicious files into the victim's computer as well as infect the computer with malware by opening a command shell and dropping some files on it. The attacker had downloaded a Java archive (JAR) file (MailQueue-Handler.jar), as well as Python scripts (RPivot backdoor). As soon as the attackers have established a command-and-control channel with their target, they utilize the target's credentials to disable multifactor authentication and antivirus protections. 

They then connect to other computers in the network and move laterally to compromise additional computers and systems. Java code performed some reconnaissance work as well, mostly scoping out the user's account name and local network, before extracting and running from the snow.zip archive the payload contained a Python-based backdoor that could be used to remote control the Windows computer remotely. 

Python code included a lambda function to obfuscate the malware, which matched Python malware loaders previously spotted as part of the FIN7 malware campaign.  Two other Python pieces were extracted as part of the malware, including copies of the publicly available reverse SOCKS proxy RPivot, which FIN7 had previously used in its earlier attacks. 

As with the STAC5777 attacks, the malware started with large amounts of spam emails being sent to targeted organizations, followed by team messages claiming to be from the organization's IT department and requesting that they be contacted to stop the spam. CyberScoop spoke to Sean Gallagher, Sophos's principal threat researcher, and the study's lead author. 

Gallagher explained that his team had observed multiple individuals and at least 15 organizations using these tactics, and most of them were blocked before they were able to compromise the device they were attempting to compromise. Using the social engineering technique of posing as a technical support representative is a well-known social engineering method used by malicious hackers to compromise large, multinational companies.

Cybercriminal groups such as Lapsus$ have used this scheme for several years to compromise large, multinational corporations. It is, however, mainly smaller organizations that have been targeted by Office 365 and Teams, and it illustrates how threat groups have increasingly capitalized on the rush by small and mid-sized businesses to adopt cloud computing and digitization, especially after the COVID-19 virus pandemic. 

A significant portion of these small organizations were left vulnerable by the fact that, for the first time, they were using unfamiliar software like Microsoft Office 365, Teams, and Azure. It is a piece of malware, winhttp.dll, that is sideloaded into a legitimate oneDriveStandaloneUpdater.exe process, which is then relaunched by a PowerShell command when Windows starts up. Through the Windows API, the malicious DLL logs the user's keystrokes, gathers credential information from files and the registry, and scans the network for potential pivot points via SMB, RDP, and WinRM. 

Once a C2 connection has been established, the OneDriveStandaloneUpdater.exe process is started and a check is performed to see if there are any Remote Desktop Protocol hosts or Windows Remote Management hosts that can be accessed with stolen credentials. It appears that the attackers then attempted to move laterally to other hosts to continue their attack. 

One instance of this was when the attackers used the backdoor to uninstall local multifactor authentication integration on a compromised device, and Sophos has also found that the attackers have been hoovering up local files whose names contained the word "password". In one instance, STAC5777 was trying to infect the machine with the Black Basta ransomware - even though Sophos assured that its security protections blocked it from infecting the machine. 

According to the researchers, the threat actor has access to Notepad and Word files that have the word "password" in them. Moreover, the attackers also accessed two Remote Desktop Protocol files, likely searching for credentials. To prevent external domains from initiating messages and calls on Microsoft Teams and disabling Quick Assist in critical environments, organizations should consider implementing these tactics in the ransomware space as they become more prevalent.
Read more »
Trend Micro SafeBreach Vulnerability Attack Security
Cybersecurity Exploit FTP server Infostealer malware PowerShell Trend Micro SafeBreach Vulnerability Attack Security

Malicious GitHub PoC Exploit Spreads Infostealer Malware

 

A malicious GitHub repository disguises a proof-of-concept (PoC) exploit for CVE-2024-49113, also known as "LDAPNightmare," delivering infostealer malware that sends sensitive data to an external FTP server. Disguised as a legitimate PoC, the exploit tricks users into executing malware.

While using fake PoC exploits is not a new tactic, Trend Micro's discovery shows that cybercriminals continue to deceive unsuspecting users. This malicious repository appears to be a fork of SafeBreach Labs' original PoC for CVE-2024-49113, which was released on January 1, 2025.

CVE-2024-49113 is one of two vulnerabilities affecting the Windows Lightweight Directory Access Protocol (LDAP), which was patched by Microsoft during December 2024's Patch Tuesday. The other vulnerability, CVE-2024-49112, is a critical remote code execution (RCE) flaw.

SafeBreach's blog post initially mislabeled the vulnerability as CVE-2024-49112, which sparked interest in LDAPNightmare, potentially attracting threat actors looking to exploit this buzz.

The PoC from the malicious repository contains a UPX-packed executable, 'poc.exe,' which drops a PowerShell script in the victim's %Temp% folder upon execution. The script sets up a scheduled job that runs an encoded script, which fetches another script from Pastebin.

This final payload gathers information such as computer details, process lists, network data, and installed updates, which it then compresses into a ZIP file and uploads to an external FTP server using hardcoded credentials.

Users downloading PoCs from GitHub should exercise caution, trusting only reputable cybersecurity firms and researchers. Verifying repository authenticity and reviewing code before execution is essential. For added security, consider uploading binaries to VirusTotal and avoid anything that appears obfuscated.
Read more »
malware
Data Theft Hacking Ivanti VPN Exploitation malware

Hackers Exploit Ivanti VPN Flaw to Install New Malware

 



A newly discovered vulnerability in Ivanti Connect Secure VPN systems, called CVE-2025-0282, has been actively exploited by hackers to deploy custom malware. This critical security flaw affects older versions of Ivanti’s VPN appliances, including Connect Secure, Policy Secure, and Neurons for ZTA gateways. Despite the wide impact, Ivanti has clarified that the attacks are currently limited to a small number of users.

The problem was a stack-based buffer overflow that could be exploited by hackers using specially crafted requests to breach systems. The breaches were reported to have started in December 2024 by Mandiant, a leading cybersecurity firm. Hackers accessed the compromised devices using this flaw, disabled all important security settings, and installed malicious software.

New Malware Families Identified

During the course of the investigation, two other malware variants, Dryhook and Phasejam, were discovered on infected systems. There is no established connection between these malware families and any known hacking groups. In addition, hackers utilized a toolkit named Spawn, which is also used by suspected Chinese espionage groups. 

Dryhook: This malware captures login credentials, such as usernames and passwords, during the authentication process.

Phasejam: A dropper that installs malicious web shells, allowing hackers to execute commands remotely.  

How the Attack Works  

The attack process involves several steps:  

1. Identifying Targets: Hackers scan devices using specialized HTTP requests to identify vulnerable systems.  

2. Exploitation: They exploit the CVE-2025-0282 flaw to bypass security.

3. Malware Deployment: They disable protections, modify system files, and install tools such as backdoors and tunneling utilities once inside.  

4. Data Theft: They steal sensitive information, including session details and credentials. This data is often archived and staged for transfer via public servers.  

5. Maintaining Access: Hackers alter upgrade processes, making their changes persist even after system updates.

When the vulnerability was discovered, more than 3,600 Ivanti VPN devices were exposed online. Although the number decreased to around 2,800 after the software patch, most systems are still exposed to this threat.

What Can Be Done? 

To defend against this threat, Ivanti advises doing the following:

  • Update Software: Install the latest version of Ivanti Connect Secure, version 22.7R2.5 or newer.
  • Factory Reset: That would erase the entire malware infection by resetting the device.  
  • Monitor for Signs of Attack: That would use Mandiant's shared IoCs and detection rules to identify malicious activity.  

Why it Matters

This makes it strongly essential for organizations to pay much heed to their cybersecurity. Hackers have become really intricate in operation, where they steal the most sensitive data from widely used systems such as VPNs. Businesses need to be alert and update their system with frequent revisions in the security policies to curb these threats.




Read more »
User Security
Banshee Stealer Infostealer macOS malware User Security

New Version of Banshee Malware Targets macOS Users

 

According to the latest study published this week, a new variant of the info-stealing malware known as "Banshee" has been targeting macOS users' passwords, cryptocurrency wallets, browser credentials, and other data for at least the past four months.

Check Point researchers discovered that the latest version targets anyone using a Mac and can be downloaded mostly through malicious GitHub uploads, but also through other websites (GitHub's policies prohibit malware, but this does not mean there is no malware on GitHub). 

This latest Banshee malware often disguises itself as the Telegram messaging app or the Google Chrome browser, two popular apps that other malware attackers use to trick users. This version first surfaced in September last year and attempts to evade detection by using Apple's proprietary string encryption algorithm, XProtect.

This malware targets your browsing activities in Chrome, Brave, Edge, or Vivaldi. It also attempts to steal your cryptocurrency if you have any crypto wallet browser extensions installed, and it may show macOS victims fake login pages in an attempt to steal their usernames and passwords, which it then uses to steal accounts and funds. It will target your Coinbase, Ronin, Slope, TONNE, MetaMask, and other cryptocurrency wallet extensions if you have them. 

The source code for Banshee was leaked online in November. This could have helped antivirus companies ensure their software catches the sneakier version in the months since. Prior versions of this malware were marketed as "stealer-as-a-service" malware on cybercriminal channels, including attacker-controlled Telegram channels, for $3,000 per "license.” 

To stay protected from info-stealer malware, it's a good idea to consider getting a crypto hardware wallet like one from Ledger or Trezor if you have over $1,000 in crypto. In general, it's also a good practice to avoid storing more than $1,000 in any browser extension-based crypto wallet (you can also store funds with an exchange like Coinbase, Robinhood, or Kraken). 

Additionally, passwords should never be kept in an unsecured digital document on your computer (no Google Docs). Instead, think about keeping your crypto seed phrases on paper in a closed box or safe at home.
Read more »
Software
Apple MacOS Banshee Stealer MaaS malware Software

New Variant of Banshee Stealer Targets macOS with Enhanced Evasion Tactics

 




Cybersecurity researchers have identified a dangerous new version of Banshee Stealer, a sophisticated malware specifically targeting macOS users. This updated strain is designed to bypass antivirus defenses and steal sensitive data from millions of macOS devices.

Originally detected in August 2024, Banshee Stealer was offered as malware-as-a-service (MaaS) to cybercriminals for $3,000 per month. Its capabilities included:
  • Data Theft: Stealing browser data, cryptocurrency wallet credentials, and specific file types.
The malware's source code was leaked in late 2024, briefly halting its spread. However, security experts have now discovered ongoing campaigns distributing an updated and more powerful version.

The latest version of Banshee Stealer, uncovered in September 2024, is being spread through:
  • Phishing Websites: Fake websites impersonating legitimate services to trick users into downloading the malware.
  • Fake GitHub Repositories: Malicious repositories posing as popular software like Google Chrome, Telegram, and TradingView.
Additionally, cybercriminals are simultaneously deploying another malware called Lumma Stealer to target Windows systems, signaling a broader, cross-platform attack strategy.

Key Enhancements in the Updated Version

The new variant of Banshee Stealer features several dangerous improvements:
  1. Advanced Encryption: Incorporates sophisticated encryption methods inspired by Apple's XProtect to evade detection by security tools.
  2. Expanded Targeting: Previously restricted from targeting Russian-language systems, this limitation has been removed, broadening the malware's victim pool.
  3. Social Engineering Tactics: The malware disguises itself as software updates or legitimate applications, increasing its chances of tricking users into installing it.

Related Threats on Other Platforms

Beyond Banshee Stealer, other malware families like Nova Stealer and Hexon Stealer are exploiting social engineering techniques on platforms such as Discord. Attackers lure users with fake promises of the latest video game versions, aiming to steal Discord credentials and access linked accounts for further exploitation.

To mitigate the risk of infection, users should adopt the following cybersecurity practices:
  • Download from Trusted Sources: Always install software from official and reputable platforms.
  • Exercise Caution with Links: Avoid clicking on suspicious links or accepting unsolicited invitations, particularly on social platforms like Discord.
  • Keep Security Software Updated: Regularly update antivirus and security tools to guard against the latest threats.
The resurgence of Banshee Stealer underscores the need for continuous vigilance in cybersecurity. Cybercriminals are constantly evolving their methods, blending technical exploits with social engineering to target both human and system vulnerabilities. Staying informed and cautious remains the most effective defense against such sophisticated attacks.
Read more »
VPN malware threats
antivirus software cybersecurity tips malware Phishing Attacks PLAYFULGHOST malware SEO Poisoning VPN malware threats

This New Malware Exploits VPN Apps to Hijack Devices

 

A newly discovered malware, named PLAYFULGHOST, is causing concern among cybersecurity experts due to its versatile capabilities for data theft and system compromise. According to researchers, this malware employs techniques such as screen and audio capture, keylogging, remote shell access, and file transfer, enabling threat actors to launch further attacks.

PLAYFULGHOST is primarily delivered through phishing emails or SEO poisoning techniques, which distribute trojanized VPN applications. Once executed, it establishes persistence using four methods: the run registry key, scheduled tasks, Windows startup folder, and Windows services. This persistence allows the malware to collect a vast array of data, including keystrokes, screenshots, system metadata, clipboard content, and QQ account details, as well as information on installed security products.

The malware also exhibits advanced functionalities such as deploying additional payloads, blocking mouse or keyboard inputs, clearing event logs, deleting cache and browser profiles, and wiping messaging app data. Notably, it can use Mimikatz, a tool for extracting passwords, and a rootkit to conceal registry entries, files, and processes. PLAYFULGHOST further utilizes Terminator, an open-source utility, to disable security processes via a BYOVD (Bring Your Own Vulnerable Driver) attack.

The initial infection often begins with phishing emails containing lures such as warnings about code-of-conduct violations. Alternatively, it leverages SEO poisoning to distribute malicious versions of legitimate VPN apps like LetsVPN. For instance, one victim unknowingly launched a malicious executable disguised as an image file, which subsequently downloaded and executed PLAYFULGHOST. Google’s Managed Defense team notes that this backdoor shares features with the Gh0st RAT, whose source code was leaked in 2008.

PLAYFULGHOST infections employ DLL search order hijacking and sideloading to launch malicious DLLs, decrypting and loading the malware directly into memory. It also uses combined Windows shortcuts and rogue DLL construction for stealthy execution.

How to Protect Yourself

To avoid falling victim to PLAYFULGHOST, adopt the following security practices:
  • Be cautious with phishing emails: Verify the sender and context before clicking links or downloading attachments. If unsure, confirm directly with the sender or relevant departments.
  • Download only from trusted sources: Always access applications from official websites rather than links in emails or messages.
  • Avoid urgency traps: If contacted about urgent matters like account issues, manually visit the company’s website by typing its URL into your browser.
  • Strengthen account security: Use unique passwords, a password manager, two-factor authentication, and robust antivirus software across devices.
For additional protection, consider antivirus programs with integrated VPNs or hardened browsers for enhanced security. Stay informed about phishing techniques and remain vigilant online. As Google’s Managed Defense team warns, “PLAYFULGHOST’s sophistication highlights the need for constant vigilance against evolving cyber threats.”
Read more »
Telegram
Android Malware Fake Apps FireScam malware Social Media Telegram

Android Malware 'FireScam' Poses As Telegram Premium to Steal User Data

Android Malware 'FireScam' Poses As Telegram Premium to Steal User Data

The latest Android malware called 'FireScam' is being shared as a premium variant of the Telegram application through phishing sites on GitHub that impersonate the RuStore, a Russian app market for mobile devices.

About FireScam vulnerability

Russian internet group VK (VKontakte) launched RuStore in May 2022 as an alternative to Apple's App and Google Play Store, after Western sanctions affected Russian users' mobile software. RuStore hosts apps that are compatible with Russian regulations, it was built with the assistance of the Russian Ministry of Digital Development.

Experts from threat management company Cyfirma believe the infected GitHub page impersonating RuStore first sends a dropper module named GetAppsRu.apk.

The dropper APK is covered using DexGuard to avoid getting caught and gets permissions that allow it to pinpoint installed applications, giving it access to the device’s storage and further install packages.

Once this is done, it retrieves and deploys the main malware payload  “Telegram Premium.apk” which asks for permissions to track notifications, see clipboard data, telephony services, SMS, and a lot of other things.

What is FireScam capability?

Once executed, a deceptive WebView screen shows a Telegram login page stealing the user’s login credentials. FireScam communicates with the Firebase Realtime Database, uploads stolen data in real time, and notes the infected devices with individual identifiers to track.

According to Cyfirma, stolen data is temporarily kept in the database and wiped when the hackers filter it for needed information and copy it to another location.

The malware launches a persistent WebSocket connection with the Firebase C2 endpoint for real-time command execution- asking for specific data, downloading and installing additional payloads, prompting immediate uploads to the Firebase database, or tweaking the surveillance parameters. 

Firescam also tracks changes in screen activity, monitors on/off events, logs the running applications, and monitors activity data for events exceeding 1,000 milliseconds

Additionally, Firescam carefully monitors e-commerce payments to steal sensitive financial data. It can capture what you type, copy to clipboards, drag and drop, and hack data filled automatically from password managers. 

How to be safe?

Cyfirma offers no hints about FireScam's operators, but the researchers describe the malware as a "sophisticated and multifaceted threat" that "employs advanced evasion techniques." It suggests customers exercise caution when opening files from potentially malicious sources or clicking on unknown URLs.

Read more »
Social Media Scam
cyberattack news FireScam malware News Online Scam Social Media Scam

‘FireScam’ Malware Targets Android Users with Fake Telegram Premium App

A new Android malware named ‘FireScam’ has surfaced, disguised as a premium version of the Telegram app. Distributed through phishing websites hosted on GitHub, the malware tricks users by mimicking the interface of RuStore, Russia’s official mobile app market. This development underscores the increasing sophistication of cyber threats leveraging trusted platforms and applications. 

RuStore, launched in May 2022 by Russian internet giant VK (VKontakte) with support from the Ministry of Digital Development, was designed as an alternative to Google Play and Apple’s App Store. It was created to ensure Russian users have access to mobile software amid Western sanctions. RuStore hosts applications that comply with Russian regulations, becoming an essential tool for domestic users. However, cybercriminals have exploited RuStore’s credibility to distribute malware under the guise of legitimate applications. 

According to cybersecurity researchers at Cyfirma, the malware is delivered via a GitHub-hosted phishing page mimicking RuStore. The page provides an initial payload named GetAppsRu.apk, a dropper module obfuscated with DexGuard to bypass detection mechanisms. Once installed, the dropper module gains permissions to:

  • Identify installed apps.
  • Access device storage.
  • Install additional packages.
It then installs the main malware payload, Telegram Premium.apk, which requests extensive permissions to monitor notifications, clipboard data, SMS, and telephony services. 
  
Credential Theft and Real-Time Data Exfiltration 
 
Upon execution, FireScam displays a fake Telegram login page via a WebView screen, designed to steal Telegram credentials. The malware establishes communication with a Firebase Realtime Database, where stolen data is uploaded in real-time. Devices are registered using unique identifiers for tracking. Notably, Cyfirma reports that stolen data is temporarily stored in the Firebase database before being filtered and moved to a more secure location. FireScam also maintains a persistent WebSocket connection with a Firebase command-and-control (C2) endpoint. This enables attackers to:
  • Execute real-time commands.
  • Download and execute additional payloads.
  • Adjust surveillance settings.
  • Trigger immediate data uploads.
Advanced Surveillance Features 
 
FireScam actively monitors device activity, logging:
  • Screen on/off events.
  • Active app usage.
  • Activities lasting over 1,000 milliseconds.
A particularly concerning feature is its focus on e-commerce transactions, where it attempts to intercept sensitive financial data. The malware captures everything users type, drag, drop, or copy, including autofilled details from password managers and app-to-app exchanges. 
  
While Cyfirma has yet to identify the operators behind FireScam, they describe it as a “sophisticated and multifaceted threat” that employs advanced evasion techniques. 
 
To mitigate the risk of infection, Cyfirma advises users to:
  • Exercise caution when downloading apps, especially from untrusted sources.
  • Avoid clicking on unfamiliar links.
  • Ensure that app downloads come from official stores like Google Play or verified platforms.
The rise of malware like FireScam highlights the importance of vigilance in the digital era. Users must remain cautious, adopt secure online practices, and rely on trusted platforms to minimize the risk of falling victim to sophisticated cyber threats.
Read more »
trending news
Google Chrome extensions attack malware News trending news

Google Chrome Extensions Compromised in Widespread Cyberattack

A cybersecurity incident has compromised at least 35 Google Chrome extensions, affecting approximately 2.6 million users globally. Over 400,000 devices have reportedly been infected with malicious code as part of a coordinated attack.

Timeline and Attack Methodology

An investigation revealed that the attack began on December 5, although related domains were registered as early as March 2024. This indicates the attackers had been preparing for months before launching their campaign.

One targeted entity was a data loss prevention startup, whose Chrome extension was exploited. The breach reportedly began with a phishing email impersonating a Google policy alert, urging a developer to install a "Privacy Policy Extension." This malicious extension, when granted permissions, allowed attackers to access the developer’s account.

Once access was obtained, the attackers uploaded a malicious update to the compromised extensions. This update bypassed security protocols and was automatically distributed to users, facilitating the infection. The primary objective appeared to be data harvesting, with an emphasis on collecting Facebook-related information from users.

Company Response and Security Observations

The affected company reported that the compromised employee had Google Advanced Protection and multi-factor authentication (MFA) enabled. Despite following standard protocols, the employee inadvertently authorized a malicious third-party application. The company clarified that no suspicious MFA prompts were received, and the employee's Google credentials remained secure.

Domains associated with the attack were initially registered in March 2024, with additional registrations occurring closer to the campaign’s escalation in November and December.

This incident underscores the evolving tactics of cybercriminals and the importance of constant vigilance and robust cybersecurity measures, particularly in the face of sophisticated phishing campaigns.

Read more »
Ukraine
Fake Apps malware RSA Ukraine

Malware Targets Ukrainian Military via Fake App

 



Cybersecurity experts said that a malware campaign targeting Ukraine's military personnel has been released. The malware is spread with the help of a fake installer for an app called "Army+." That installer looks perfectly legitimate but embeds malicious code. It will install the Tor browser and use the hidden PowerShell script to carry on malicious activities; this means that there is misuse of the Tor browser for secretive purposes rather than any other purpose that it was used for.


How the Malware Works

The installation process starts with the fake app ArmyPlusInstaller. It launches a decoy application, ArmyPlus.exe, to avoid suspicion. In the background, a hidden script, init.ps1, works to bypass security restrictions on the system.

It would normally block such unauthorized scripts to keep a computer safe. But the malware will play with security settings by means of specific PowerShell commands to have the liberty of working freely. It even reduces the size of the console window to conceal all its actions and create further illusion. It plants files in strategic locations

The malware spreads its files throughout the folders of the system to remain hidden. For instance, the Tor browser files are stored in a directory called OneDriveData, while OpenSSH files, which give the attackers remote access, are kept in a folder called ssh.

This init.ps1 script plays a crucial role as it can pull down and install the Tor browser for use in secret operations. The init.ps1 script establishes communication between the compromised computer and the attacker, giving them an avenue through which to command the system from a stealth position.


Backdoor That Survives Reboot

After installation, it establishes a backdoor through which attackers secretly command the system remotely. The system information is then transmitted along with a public RSA key through Tor to a remote server. The latter facilitates communication from the attackers side encrypted through that public RSA key. In that manner, an attacker is in a position to issue commands, and if they have their ways, may end up commanding at a very high level within the system.


Exploiting User Trust

A devious malware installer masquerading as a program installation. Requesting administrative credentials, which may be granted unwarily by innocent users. Once the visible, front-end app fails, all the malicious instructions are executed on the backhand in silence silently, including accessing and transmitting some sensitive information it has gathered.


Why Is This Important

This incident highlights how cybercriminals exploit everyday tools, like PowerShell and Tor, to hide their attacks. In this way, they mimic legitimate software, making it harder for standard defenses to detect them.

It is a reminder for all of us to download software only from trusted sources and for organizations to regularly update their security measures. Being alert will help prevent such stealthy cyberattacks from succeeding.

This development underlines the increasing nuances in cyber threats in conflict zones as attackers continue to evolve their techniques to evade detection.


Read more »
Online attacks
cyberattack news malware Mobile Malware News Online attacks

FBI Warns Against Public USB Charging Stations Due to “Juice Jacking” Threat

The FBI has issued a cautionary alert for travelers, urging them to avoid using public USB charging stations found in airports, hotels, and other public spaces. A rising cyber threat, known as “juice jacking,” enables cybercriminals to steal sensitive data and install malware through these ports. While convenient for charging devices on the go, these stations are increasingly being exploited to compromise personal and financial security.

The Mechanics Behind Juice Jacking

Juice jacking takes advantage of a fundamental vulnerability in USB technology, which supports both power delivery and data transfer. When an unsuspecting user plugs their device into a compromised USB port, malware can be silently installed, or data can be extracted without their knowledge. The malicious software may remain dormant, activating later to steal passwords, lock files for ransom, or even mine cryptocurrency, which can drain the device’s battery and degrade its performance.

Adding to the complexity of this threat, even charging cables can be tampered with to include hidden components that extract data as soon as they are connected. This makes it possible for travelers to fall victim to juice jacking even if they avoid public charging stations but use unfamiliar or unverified cables.

The threat of juice jacking extends far beyond U.S. borders. Airports, hotels, and shopping malls worldwide have reported similar incidents, as the universal nature of USB charging technology makes it a convenient vector for cyberattacks. The rise in reported cases has prompted security experts to raise awareness about this subtle yet significant risk, urging travelers to rethink how and where they charge their devices.

How to Protect Yourself

To stay safe, the FBI and cybersecurity professionals recommend adopting these precautions:

  • Carry Personal Chargers: Use your own charging devices and power banks to avoid reliance on public USB ports.
  • Use a USB Data Blocker: This small device allows charging while preventing data transfer, effectively neutralizing the threat of juice jacking.
  • Opt for Wall Outlets: Whenever possible, plug devices directly into a wall outlet for charging, as this eliminates the risk of data theft.

Some airports and transportation hubs are beginning to address the issue by installing “charge-only” stations that disable data transfer capabilities. However, such solutions are not yet widespread, making it essential for individuals to remain vigilant and proactive in protecting their devices.

Corporate and Financial Sector Responses

Businesses are taking the juice jacking threat seriously, with many companies updating travel policies to discourage employees from using public USB ports. Instead, employees are being provided with approved chargers and power banks to ensure the safety of corporate devices and sensitive data.

The financial sector is also raising alarms, advising customers to avoid conducting banking transactions or accessing sensitive accounts while connected to public USB ports. Even a brief connection to a compromised charging station could lead to unauthorized access to financial apps and accounts, potentially resulting in significant losses.

While steps are being taken to make public charging safer, the onus remains on travelers to prioritize device security. By carrying personal charging equipment, avoiding unverified cables, and utilizing tools like USB data blockers, individuals can mitigate the risks of juice jacking and safeguard their personal and financial information against this evolving cyber threat.

Read more »
online games
Cookies Cyber Fraud Discord Email malware online games

Watch Out: Fake Game Invites on Discord Are Stealing Your Personal Data

 



There is a new online scam, where cyber criminals trick people into downloading harmful software under the pretext of beta testing a game. This campaign targets people on platforms such as Discord, email, and even text messages, aiming at stealing personal information and compromising accounts online. 


How does this work?

The scam starts by sending a harmless message. In this case, a user on Discord or elsewhere receives a direct message from a purported game developer claiming to have sent them a new game to play. The user is asked whether they would want to try the supposed game. In most cases, these messages come from compromised accounts, so the request seems all the more real.

If the victim consents, the attacker shares a download link and password to the target so that they can actually access and start downloading the game file. These links are usually Dropbox or even Discord's network because most malware authors upload their creations to an existing, popular platform. But what users download aren't games-these are referred to as information stealers.


What Do These Malware Applications Do?

Once installed, these programs, such as Nova Stealer, Ageo Stealer, or Hexon Stealer, begin extracting sensitive data. This may include: 

1. Saved browser passwords

2. Session cookies for services like Discord or Steam

3. Wallet information for cryptocurrencies

4. Credit card information

6. Two-factor authentication (2FA) backup codes

The Nova Stealer and Ageo Stealer are the new wave called Malware-as-a-Service (MaaS). This enables cybercriminals to rent these tools to conduct attacks. Nova Stealer even leverages a feature called a Discord webhook, allowing it to send information directly to hackers so they could know right away how much data had been stolen and not have to manually check.

Another tool that is used in these scams is the Hexon Stealer. It is a highly dangerous tool since it can gather a wide variety of personal information. Using such information, it hacks into Discord accounts and enables the attackers to send similar fake messages to the contacts of the victim, thereby further spreading the malware. 


Why Do Hackers Target Discord?

The main focus of these attacks is the Discord credentials. When hackers get access to a person's account, they can pretend to be that person, deceive their friends, and expand their network of victims. This cycle of exploitation of trust makes the scam so effective. 


How to Identify Fake Game Websites

Fake download pages are usually built using common web templates. Such sites appear legitimate but host malware. Among them are the following:  

  • dualcorps[.]fr
  • leyamor[.]com 
  • crystalsiege[.]com 
  • mazenugame[.]blogspot.com

These sites are hosted on platforms that are resistant to takedown requests, making it difficult for researchers to shut them down. If one site is removed, attackers can quickly set up a new one. 


How Can You Protect Yourself? 

To keep yourself safe, follow these simple guidelines:

1. Be cautious with unsolicited messages: If someone you don’t know—or even a known contact—sends a download link, verify its authenticity through another platform.  

2. Avoid downloading unknown files: Don’t download or install anything unless you’re certain it’s legitimate.  

3. Use updated security software: An active anti-malware program can block known threats.

4. Be watchful of phony websites: Be on the lookout for amateurism or copy-and-paste designs when viewing suspicious sites.


In the end, this scamming attack is meant to reap a financial reward; it may come in the form of stolen cryptocurrency, credit card information, or other sensitive details. Knowing how this attack works can help you safeguard your data from cybercrime attacks.

Stay informed and be careful—your online safety depends on it.

Read more »
Space Bear
Atos malware News Ransomware attack Space Bear

Atos Denies Ransomware Breach Allegations by Space Bears

French technology giant Atos has refuted claims by the ransomware group Space Bears that its systems were compromised, asserting that no evidence of a breach or ransom demand has been found. In a statement released on December 28, Atos clarified the results of its investigation, addressing concerns raised by the allegations.

“At this stage, the initial analysis shows no evidence of any compromise or ransomware affecting any Atos/Eviden systems in any country, and no ransom demand has been received to date,” the company stated.

Investigation and Clarifications

Although no compromise has been confirmed, Atos has deployed a dedicated cybersecurity team to thoroughly investigate the matter. The claims originated from Space Bears, a ransomware group with ties to Phobos Ransomware as a Service (RaaS). The group alleged that it had breached Atos' internal database and accessed sensitive data.

Atos clarified that the breach targeted “external third-party infrastructure, unconnected to Atos,” which “contained data mentioning the Atos company name but is not managed nor secured by Atos.”

The company emphasized its robust security operations, highlighting its global network of over 6,500 specialized cybersecurity experts and 17 next-generation security operations centers (SOCs) that operate around the clock to protect Atos and its customers.

“Atos has a global network of more than 6,500 specialized experts and 17 new-generation security operations centers (SOCs) operating 24/7 to ensure the security of the Group and its customers,” the statement emphasized.

Space Bears: A Rising Ransomware Threat

Space Bears, which emerged in April 2024, has gained notoriety for its sophisticated and aggressive extortion tactics. The group employs double extortion methods, encrypting victims’ data while threatening to release it publicly unless demands are met. Space Bears operates data leak sites on both the dark web and clearnet, leveraging tactics such as corporate imagery and “walls of shame” to maximize reputational damage.

The ransomware group has previously targeted organizations like Canadian software firm Haylem, orthophonics clinic Un Museau Vaut Mille Mots, and Lexibar, a language disorder provider. More recently, Space Bears claimed responsibility for attacks on Canada’s JRT Automatisation and India’s Aptus in December 2024.

While Atos maintains that no proprietary data, source code, or intellectual property was accessed, the company acknowledged the gravity of the situation. “We take such threats very seriously,” Atos affirmed.

This incident underscores the ever-evolving cyber threat landscape faced by multinational corporations and the growing sophistication of ransomware groups like Space Bears, highlighting the need for constant vigilance and robust cybersecurity measures.

Read more »
trending cybersecurity news
Data threats malware News Palo Alto Networks' Unit 42 research Phising Attacks Social Media threats trending cybersecurity news

Cybercriminals Leverage LLMs to Generate 10,000 Malicious Code Variants

Cybersecurity researchers are raising alarms over the misuse of large language models (LLMs) by cybercriminals to create new variants of malicious JavaScript at scale. A report from Palo Alto Networks Unit 42 highlights how LLMs, while not adept at generating malware from scratch, can effectively rewrite or obfuscate existing malicious code.

This capability has enabled the creation of up to 10,000 novel JavaScript variants, significantly complicating detection efforts.

Malware Detection Challenges

The natural-looking transformations produced by LLMs allow malicious scripts to evade detection by traditional analyzers. Researchers found that these restructured scripts often change classification results from malicious to benign.

In one case, 88% of the modified scripts successfully bypassed malware classifiers.

Despite increased efforts by LLM providers to impose stricter guardrails, underground tools like WormGPT continue to facilitate malicious activities, such as phishing email creation and malware scripting.

OpenAI reported in October 2024 that it had blocked over 20 attempts to misuse its platform for reconnaissance, scripting, and debugging purposes.

Unit 42 emphasized that while LLMs pose significant risks, they also present opportunities to strengthen defenses. Techniques used to generate malicious JavaScript variants could be repurposed to create robust datasets for improving malware detection systems.

AI Hardware and Framework Vulnerabilities

In a separate discovery, researchers from North Carolina State University revealed a side-channel attack known as TPUXtract, which can steal AI model hyperparameters from Google Edge Tensor Processing Units (TPUs) with 99.91% accuracy.

The attack exploits electromagnetic signals emitted during neural network inferences to extract critical model details. Although it requires physical access and specialized equipment, TPUXtract highlights vulnerabilities in AI hardware that determined adversaries could exploit.

Study author Aydin Aysu explained that by extracting architecture and layer configurations, the researchers were able to recreate a close surrogate of the target AI model, potentially enabling intellectual property theft or further cyberattacks.

Exploiting AI Frameworks

Morphisec researchers disclosed another AI-targeted threat involving the Exploit Prediction Scoring System (EPSS), a framework used to evaluate the likelihood of software vulnerabilities being exploited.

By artificially boosting social media mentions and creating GitHub repositories with placeholder exploits, attackers manipulated EPSS outputs.

This resulted in the exploitation likelihood for certain vulnerabilities increasing from 0.1 to 0.14 and shifting their percentile ranking from the 41st to the 51st percentile.

Ido Ikar from Morphisec warned that such manipulation misguides organizations relying on EPSS for vulnerability management, enabling adversaries to distort vulnerability assessments and mislead defenders.

The Double-Edged Sword of Generative AI

While generative AI offers significant potential for bolstering cybersecurity defenses, its misuse by cybercriminals presents a formidable threat.

Organizations must:

  • Invest in advanced AI-driven detection systems capable of identifying obfuscated threats;
  • Implement robust physical security measures to protect AI hardware from side-channel attacks;
  • Continuously monitor and validate AI framework outputs to mitigate manipulation risks.

As adversaries innovate, businesses and researchers must push their operations to stay ahead, leveraging the same AI advancements to fortify their defenses.

Read more »
OtterCookie
Infostealer Malicious Campaign malware North Korean Hackers OtterCookie

North Korean Hackers Deploy OtterCookie Malware in Contagious Interview Campaign

 

The North Korean hackers behind the ongoing Contagious Interview campaign have been observed launching a new JavaScript malware named OtterCookie. 

The campaign includes social engineering techniques, with the hacker team frequently posing as recruiters to trick job seekers into downloading malware during an interview process. This entails sharing malware-laced files via GitHub or the official package registry, paving the way for the propagation of malware like BeaverTail and InvisibleFerret. 

Palo Alto Networks Unit 42, which first detected the activity in November 2023, is tracking the cluster as CL-STA-0240. In September 2024, Singaporean cybersecurity company Group-IB disclosed the deployment of an upgraded version of BeaverTail that employs a modular approach, delegating its information-stealing capability to a collection of Python scripts known as CivetQ. 

According to the latest findings from Japanese cybersecurity company NTT Security Holdings, the JavaScript malware that launches BeaverTail is also designed to fetch and execute OtterCookie. 

The new malware is said to have been launched in September 2024, with a new variant identified in the wild last month. OtterCookie, upon running, establishes connections with a command-and-control (C2) server using the Socket.IO JavaScript library, and awaits further instructions. It is intended to execute shell commands that facilitate data theft, including files, clipboard items, and cryptocurrency wallet keys. 

The older OtterCookie variant discovered in September is functionally identical, but with a slight implementation difference: the cryptocurrency wallet key theft capability is directly incorporated into the malware, rather than a remote shell command. The discovery indicates that attackers are actively updating their tools while leaving the infection chain mostly intact, highlighting the campaign's efficacy. 

This comes as South Korea's Ministry of Foreign Affairs (MoFA) sanctioned 15 individuals and one organisation in connection with a fraudulent IT worker program engineered by North Korea to establish a regular source of funds. These funds are funnelled to North Korea, often through data theft and other illegal means. 

Kim Ryu Song, one of the 15 sanctioned individuals, was also charged by the U.S. Department of Justice (DoJ) earlier this month for allegedly participating in a long-running conspiracy to violate sanctions and commit wire fraud, money laundering, and identity theft by illegally seeking employment in U.S. companies and non-profit organisations.
Read more »
Online Store Security
Cyberattacks CyberCrime Cyberfrauds Cyberhackers Cybersecurity CyberThreat JavaScript malware Online Store Security

Cyberattack Compromises European Space Agency Online Store Security

 


A malware attack on the European Space Agency's official web shop revealed that the application was hacked by loading a JavaScript script that generated a fake Stripe payment page at checkout. With an annual budget of more than 10 billion euros, the European Space Agency (ESA) is dedicated to extending the boundaries of space activity through the training of astronauts and the development of rockets and satellites for exploring our universe's mysteries. 

Thousands of people were put at risk of wire fraud after the European Space Agency (ESA) website was compromised due to the recent exploitation of a credit card skimmer, which was found to be malicious on ESA's webshop. According to researchers from Sansec, the script creates a fake Stripe payment page when the customer is at checkout, which collects information from the customer. 

As a result of the fake payment page being served directly from ESA's web shop, which mimicked an authentic Stripe interface, it appeared authentic to unsuspecting users, who were unaware of the fraudulent payment process. According to Source Defense Research, screenshots of the malicious payment page were provided alongside the real one in the post, but this attack took advantage of domain spoofing with a different top-level domain to exploit domain spoofing, using a nearly identical domain name for the attack. 

The official shop of the European Space Agency is located under the domain "esaspaceshop.com," but the attackers used the domain "esaspaceshop.pics" to deceive visitors. Sansec, who flagged the incident, emphasized that the integration of the webshop with ESA's internal systems could significantly increase the risks for both employees and customers of the agency. 

An examination of the malicious script revealed that its HTML code was obscured, which facilitated detection as well as the theft of sensitive payment information, as it contained obfuscated HTML code derived from the legitimate Stripe SDK. The malicious code was created to create a convincing fake Stripe payment interface that looked legitimate because it was hosted by the official ESA web store domain. 

Although the fake payment page was removed, researchers discovered that the malicious script remained in the source code of the site. As of today, the ESA website has been taken offline, displaying a message indicating it has been taken out of orbit for an extended period. The agency clarified that this store is not hosted by its infrastructure, and they do not manage its associated data. 

As confirmed by whois lookup records indicating different ownership between the main domain of ESA (esa.int) and the compromised web store, it is not known exactly how many customers were affected by the breach, nor what financial impact it had. According to ESA's website, the company is well known for its role in astronaut training and satellite launches. However, it has not yet provided details as to how it intends to strengthen its online security measures after the incident occurred. 

A recent cyberattack on well-respected institutions shows just how vulnerable they can be to cyber attacks, especially when their e-commerce systems are integrated into a broader organization's network. According to cybersecurity experts, e-commerce platforms are urged to prioritize robust security protocols to prevent similar incidents from occurring in the future. This can erode customer trust and result in significant financial consequences. 

The past few months have seen an increase in cyberattacks targeting e-commerce platforms, with criminals using digital skimming methods to steal payment information. Earlier in August 2024, Malwarebytes reported that it had infiltrated Magento-based e-commerce platforms with skimmer code, exposing sensitive customer information, such as credit card numbers, by November 2024, as described by Malwarebytes. 

Sucuri discovered several PHP-based skimmers, such as Smilodon, harvesting payment data covertly. Although these skimmers were highly obfuscated, their detection was significantly hindered. Finland's Cybersecurity Centre reported in December 2024 that skimming attacks were on the rise, where malicious code embedded on payment pages was used to steal credit card information. Those developments highlight the crucial need for e-commerce platforms to implement robust security measures to ensure their customers' data is protected from unauthorized access. 

It is still unclear who was responsible for these attacks, but Magecart, one of the most infamous threat groups around, has been previously linked to similar activities, including installing credit card skimmers on prominent websites, which are typical of such attacks. During March 2023, Malwarebytes speculated that this group was involved in an extensive series of attacks targeting multiple online retailers, but this was not the first mention of the group. 

The majority of victims of credit card fraud that results from such breaches can receive refunds from their banks. Cybercriminals, however, use the stolen funds to finance malicious campaigns, including malware distribution. Likely, significant damage has already been done by the time the affected cards are locked and the funds are returned, even though the stolen funds can be used to finance fraudulent campaigns.
Read more »
Subscribe to: Posts (Atom)