CySecurity News - Latest Information Security and Hacking Incidents: malware

ai agents Anthropic Claude Code malware OpenAI

AI Coding Agents Can Be Hijacked by a Single Malicious File in Your Downloads Folder

A security firm has found that placing a disguised instruction file inside a user's Downloads folder is enough to manipulate AI coding agents into installing malware, with one leading tool executing a known-malicious package in more than nine out of ten test runs.

The finding comes from Forever Security, which said one of its customers had an `AGENTS.md` file sitting in their Downloads folder. The file was designed to look like routine engineering notes, but its actual purpose was to instruct any coding agent that opened the folder to install `function-color`, a package tied to the MALFEX npm supply chain campaign. Forever stopped the agent before the installation completed. The firm could not determine how the file got there.

How the Malware Chain Works

`function-color` is a wrapper package. It carries no payload of its own but silently installs `function-flag` as a dependency. That package runs a postinstall script that downloads a Windows executable from a remote host, saves it as `node.exe` inside `%APPDATA%`, and executes it in the background. The download routine sits inside an empty catch block, so a failed attempt produces no error and leaves no trace in the install log. As of early October, both packages remained installable on npm with no advisory flagging either one.

The reason the attack targets the Downloads folder specifically is not arbitrary. Browsers can save files to that directory without asking the user for permission or even requiring a click. Forever built a proof-of-concept web page that silently dropped a crafted `AGENTS.md` into Downloads during a normal browsing session. The firm did not establish that an attacker used this exact method against its customer, but the capability is real and requires no special access.

Test Results Across Two Major Agents

To measure how reliably the technique works, Forever ran controlled tests against OpenAI's Codex and Anthropic's Claude Code.

For Codex, the planted file instructed the agent to register a new server entry in `~/.codex/config.toml` and install the malicious package. Because that config file applies to every session on the machine, a successful write would persist across projects. Codex followed through in more than 90 percent of the test attempts inside an isolated virtual machine.

Claude Code required a different approach. The planted `CLAUDE.md` was written to resemble internal gateway setup documentation, and its goal was to write a custom API endpoint into the project's `.claude/settings.json` file. If an attacker controls that endpoint, every API call from the agent passes through their infrastructure, along with the session token. The token can then be used to take over the account. Claude Code normally prompts the user to approve writes of that kind, and it frequently rejected requests that looked suspicious. The extended engineering-document framing, however, got the write approved roughly half the time.

Neither Vendor Has a Patch

Forever stated plainly that there is nothing for OpenAI or Anthropic to fix. Each agent was doing what it was built to do: read instruction files in the working directory and carry out the steps listed in them. The firm compared the situation to a browser rendering a phishing page. The browser is not broken; the page is malicious.

That framing shifts the responsibility to users and organizations. Forever's own telemetry adds urgency to that point. About half of its customers run a coding agent from their Downloads folder, and roughly a quarter of agent sessions involve an open browser. In many of those cases, no person is actively watching the session when a new file arrives in the directory.

What to Do

The most direct fix is to stop running coding agents from the Downloads folder entirely. Beyond that, Forever recommends reading any `AGENTS.md` or `CLAUDE.md` file you did not write yourself before running a session, including files that arrive in freshly cloned repositories.

For anyone who suspects a file may have already been processed, the firm advises checking `~/.codex/config.toml` for unrecognized server blocks and reviewing `.claude/settings.json` for API endpoints that were not intentionally set. On Windows machines, the presence of `node.exe` inside `%APPDATA%` is a strong indicator that the function-flag payload ran successfully. If a planted file is confirmed, the session's login token should be treated as compromised and rotated immediately.

Keeping approval prompts enabled and running agents inside sandboxes reduces the attack surface, though the Claude Code test results show that approval prompts alone are not a reliable barrier when the malicious instruction is written to look like legitimate documentation.

Malware Campaign Infects 953 Online Stores in Prolonged Attack



 

Website Hacking

Cybersecurity Threats e-commerce security JavaScript Malware Magento Malware malware Online Store Malware PolyShell Vulnerability SessionReaper Vulnerability Website Hacking

Malware Campaign Infects 953 Online Stores in Prolonged Attack

In the past two years, 953 online stores, primarily Magento-based websites, have been compromised by malicious JavaScript code injected into their websites as part of a long-running malware campaign. According to the cybersecurity firm Sansec, the attack began in July 2025 and continues to this day, with attackers periodically changing the domain used to deliver malicious software.

There is a small piece of loader code embedded in the content management system of affected stores that is used in this campaign. When a visitor opens a compromised website, it contacts an attacker-controlled server to determine what action to take next. The server identifies genuine shoppers from automated security scanners by analyzing browser characteristics, rather than exposing all visitors to the same activity.

There may not be malicious content in automated requests, making detection of the infection more difficult for researchers and security tools. Sansec has identified five primary domains associated with the campaign: manulfie.click, neswnsssn.click, lanhd6549tdhse.top, additionalver.com, and deepveindrilling.com.

On October 6, 2026, the latest domain, deepveindrilling.com, was registered and appeared on infected stores shortly thereafter. This malicious script was embedded into the CMS blocks of 83 online stores, including 60 that were previously loaded with earlier versions of the malicious script. As well as introducing new infrastructure, deepveindrilling.com now responds to script requests generated by visitors of infected stores rather than serving content openly.

Hosted behind Cloudflare, the loader also introduces new features to how it operates. In the Magento database, the loader code is stored in the cms_block table, which controls the content displayed on storefront pages. Scripts injected into a visitor's browser can also be preserved, allowing them to execute them again during subsequent page visits, regardless of whether the external domain becomes unavailable or blocked.

During testing, Sansec's automated scanning was not capable of retrieving the final malicious payload, as evidenced by the fact that the filtering mechanism is capable of concealing the campaign's actual activity from security investigations. The newer version employs browser fingerprinting techniques to examine indicators such as automation tools, hardware specifications, screen dimensions, language settings, and other browser characteristics before selecting a response.

Although earlier versions have been observed loading scripts from domains which are similar to the Ledger cryptocurrency wallet brand, this raises concerns regarding possible financial fraud against online shoppers. The initial methods used by this campaign indicate that Magento and Adobe Commerce installations are vulnerable.

Using PolyShell (CVE-2026-54236), attackers were reportedly able to inject malicious code into 471 stores in March 2026. Additionally, researchers identified more than 100 stores where files were uploaded using PolyShell or the SessionReaper vulnerability (CVE-2025-5436). However, the investigation determined that applying security patches does not necessarily eliminate a compromise that has already taken place.

In one Magento 2.4.7-p10 store that had no missing core patches, the latest malicious loader occurred on October 23rd. In earlier scans, a GSocket backdoor and unauthorized administrator account were found on the same installation, suggesting that attackers could still gain access to this system even after software updates have been applied.

Sansec has not recovered the final payload of the latest version of the campaign, which leaves the full impact of the campaign unclear. Financial fraud was suspected as a result of earlier activity involving cryptocurrency-themed domains, including a website impersonating the Ledger wallet brand. In certain circumstances, compromised storefronts may result in payments-data theft, credential harvesting or malicious redirects depending on the payload delivered. However, all 953 affected stores have not yet been confirmed to have experienced these outcomes.

A number of security measures have been recommended to address the threat, including examining Magento installations for injected scripts, suspicious administrator accounts, and backdoors. Store operators are advised to examine the CMS database tables for unauthorized modifications, review uploaded files for webshells, and patch known vulnerabilities. As part of the investigation and removal of unauthorized access following the compromise, it is also essential to change administrator, database and API credentials.

By relying solely on routine vulnerability scans, the campaign highlights the limitations of such scanning. As a result of persistent access, changing attacker infrastructure and browser-based evasion, malicious code can remain active without being detected by automated scans. It is imperative for e-commerce operators to identify the original entry point, remove persistence mechanisms, and confirm that attackers no longer have access to the affected environment in order to effectively remediate.

It emphasizes the need for e-commerce businesses to conduct more thorough security checks than just routine patching. For the prevention of reinfection and the protection of customer data, it is imperative that malicious scripts be identified, backdoors be removed, administrator accounts be secured, and suspicious activity be monitored.

MythicRatatoskr Backdoor Highlights Growing UAC-0099 and Sandworm Threat



 

Yggdrasil Network

malware MythicRatatoskr Backdoor Russian State-Sponsored Hackers Sandworm Cyberattack UAC-0099 Ukrainian Cyberattacks Yggdrasil Network

MythicRatatoskr Backdoor Highlights Growing UAC-0099 and Sandworm Threat

Cyberattacks against Ukrainian grain logistics companies have revealed the existence of a previously unknown backdoor known as MythicRatatoskr, which is associated with Russia-aligned hacking groups UAC-0099 and Sandworm, both of which appear to have participated separately in the intrusion and destructive activity.

As reported by cybersecurity researchers at ESET, the incident began in July of 2025 and ultimately resulted in a data-wiping attack that disrupted the targeted organization in September. Based on the investigation, UAC-0099 was first able to gain access to the company's network on July 16, 2025, by sending spear-phishing emails containing malicious attachments.

Attackers established a foothold and deployed additional malware by using their existing malware tools, including the MATCHBOIL downloader and the MATCHWOK backdoor. The following day, MythicRatatoskr was introduced, allowing operators to control compromised systems in a new manner. A Go-based application, Mythic Ratatoskr provides remote command execution, file transfers, file system navigation, and screenshot captures.

Additionally, researchers discovered that the backdoor could establish proxy connections, allowing attackers to route communications through a compromised network if the backdoor were used. As part of its command-and-control system (C2), the malware can transfer files to the command-and-control server, obtaining information about infected systems, including usernames, hostnames, and local network details.

Yggdrasil Network Used for Command-and-Control Communications

It was noteworthy that MythicRatatoskr used the Yggdrasil mesh network to communicate with its C2 infrastructure, one of the most significant findings. By connecting a backdoor directly to the server within this decentralized network Yggdrasil, devices are able to communicate through a secure IPv6 overlay without relying on a central hub, instead of using conventional servers directly accessible over the internet.

In spite of its legitimate applications, the network's decentralized architecture can facilitate the development of malicious infrastructure, complicating efforts to locate or disrupt command-and-control operations, and improving infrastructure resilience. According to ESET researchers, this is the first documented instance of state-aligned threat actors utilizing Yggdrasil for such purposes.

A Linux version of MythicRatatoskr may also exist, although its deployment has not been confirmed by researchers. Its capabilities and network design indicate that the backdoor was designed to maintain remote access and support further activity within the compromised environment. In the course of the intrusion, researchers also observed a SOCKS5 proxy server, which may have been deployed through affected systems using MythicRatatoskr. It is unclear who is responsible for operating the backdoor.

While ESET attributed the initial compromise and the associated malware deployment with high confidence to UAC-0099, a subsequent investigation revealed that Sandworm had taken over access. Based on techniques consistent with Sandworm's previous operations, later destructive activity was attributed to Sandworm. A draggable item can be picked up by pressing the space bar. While dragging, use the arrow keys to move the item. Press space again to drop the item in the new position, or press escape to cancel the action.

Cooperation Between Russia-Linked Groups Highlights Wider Threat

It is evident that the incident reflects a pattern of cooperation among Russian-allied threat actors. In earlier investigations, ESET found evidence that Gamaredon and Turla, both associated with the Russian Federal Security Service, coordinated attacks against Ukrainian organizations. As demonstrated by the suspected transfer of access from UAC-0099 to Sandworm in the MythicRatatoskr case, there may be a similar division of responsibilities, with one group establishing an initial foothold while the other group executing destructive activities.

A cyberattacker known as UAC-0099 has been targeting Ukrainian government agencies, financial institutions, and media organizations since at least 2022. Based on ESET's assessment, it is possible that the group will serve as an initial access group for Sandworm, which is widely attributed to Russia's military intelligence agency, the GRU. The unit, 74455, is known for its destructive cyber operations. It is known for attacks on the Ukrainian power grid in 2015 and 2016, the NotPetya data-wiping campaign in 2017 as well as the Olympic Destroyer attack in 2018.

Since Russian forces invaded Ukraine on a full scale in 2022, the group has continued to use data-wiping malware against strategic organizations. An incident in September 2025 occurred in which Sandworm erased data through Active Directory Group Policy using Microsoft's SDelete utility, a method consistent with its previous observations.

Unlike ransomware, which typically encrypts files to demand payment, data wipers are designed to destroy information and disrupt affected systems rather than encrypting files. Research has linked the initial intrusion with UAC-0099, and the subsequent wiping activity with Sandworm, but the exact division of responsibility for MythicRatatoskr remains unclear.

In addition to raising concerns about the use of decentralized networking technologies in targeted cyberattacks, ESET has not confirmed whether UAC-0099 or Sandworm operated the backdoor primarily. It is important to note that Yggdrasil was developed for legitimate networking purposes and does not provide anonymity; nevertheless, its architecture can complicate the search for malicious command-and-control infrastructure.

ESET's findings represent the first documented instance of a state-aligned threat actor using the network in this manner, highlighting a growing tendency to conceal communications during attacks on Ukrainian organizations by maintaining access and concealing communications.

Over 300 Tor Exit Relays Hijacked to Intercept SSH Connections



 

SSH

Authentication Cyber Security Linux Backdoor malware password SSH

Over 300 Tor Exit Relays Hijacked to Intercept SSH Connections

Attackers hijacked 333 Tor exit relays in early October 2026, redirecting Secure Shell (SSH) connections through 12 interception servers to steal passwords and potentially deploy malware. Researcher kaba discovered the operation on October 2, while separate analysis identified 377 relays operated by 59 operators that had adopted the attackers' exit policy. The malicious configuration represented 7.46% of Tor's exit capacity at its October 4 peak.

Attackers Modified Relay Configurations

Tor exit relays forward traffic to destinations outside the network. Attackers modified the relays' "torrc" configuration files to permit connections over port 22, enabling SSH on 342 relays that previously blocked it and converting another 24 non-exit relays into exits.

The changes also blocked encrypted email ports while permitting plaintext-capable IMAP and POP3 connections on most affected relays. This potentially exposed unencrypted email retrieval, although investigators have not established whether attackers successfully captured messages.

Kaba discovered the campaign after an SSH connection through Tor triggered a warning that the remote host's identity had changed. Using exitmap, the researcher tested approximately 3,000 exit relays by routing SSH connections between controlled servers. The investigation identified 333 relays redirecting connections to the same 12 interception servers. Around a dozen presented fraudulent host keys directly, while the others redirected traffic without altering the key themselves.

The interception servers presented their own SSH host keys before connecting to the legitimate destinations. Users who accepted unfamiliar keys and entered passwords exposed their credentials. Attackers could then observe commands, check administrative privileges and attempt to install a Base64-encoded Perl payload.

Public-key authentication could not be transparently relayed in the same way because SSH authentication signatures are tied to individual sessions. However, users who accepted a malicious key could still be deceived into interacting with an attacker-controlled shell.

Ebury Backdoor Reveals an Earlier Intrusion

The Tor Project's Network Health team warned relay operators on October 5 that attackers appeared to be compromising Linux hosts and changing their configurations.

In an October 7 post-mortem, operator Zimmer confirmed Ebury version 1.8.3 on two Quetzalcoatl relay-family servers. The attacker had accessed a management server on August 28 using the operator's password, obtained root privileges within five minutes and installed Ebury. Approximately an hour later, the attacker compromised a second server, Switzerland2.

Zimmer attributed the initial intrusion to password reuse across SSH, "sudo" and backup encryption, with the password also stored in plaintext. SSH password authentication remained enabled on the internet-facing management server.

Ebury is a Linux backdoor and credential stealer associated with OpenSSH compromises since 2009. ESET estimated in 2024 that it had infected approximately 400,000 servers, with more than 100,000 still infected in late 2023.

The implant masqueraded as "/usr/lib/x86_64-linux-gnu/libkeyutils.so.1.10.2", with "libkeyutils.so.1" pointing to the malicious file. Because the packaged library remained untouched, conventional integrity checks such as "dpkg -V" and "debsums" could miss it. ESET researcher Marc-Etienne Léveillé subsequently confirmed that version 1.8.3 had existed since at least June 2026 and published an updated detection script.

Investigation Leaves Unresolved Questions

On October 4, Tor directory authorities began applying BadExit and MiddleOnly flags to affected relays. BadExit prevents clients from selecting a relay to exit the network. By 17:00 UTC on October 5, no relay carrying the malicious policy remained in the consensus used by Tor clients.

A scripted restart subsequently affected 55 Quetzalcoatl hosts, but authorities rejected affected relays attempting to rejoin. Tor Metrics recorded approximately 370 fewer exit-flagged relays between October 3 and 5.

Investigators have not established how attackers accessed the other 58 operators' systems. Directory analysis found that 71 of 101 affected relays hosted by FranTech Solutions, associated with BuyVM, adopted the malicious policy, compared with 13 of 9,054 hosted elsewhere. This concentration raises questions about hosting-level access but does not prove the provider was compromised.

The campaign's attribution, the number of infected hosts and the number of exposed users remain unknown.

Indicators and Remediation

Operators should inspect "torrc" and included files for unauthorized changes to "ExitRelay", "ExitPolicy", "ContactInfo", "MyFamily" and "Nickname". Other indicators include unfamiliar listening processes, outbound connections, NAT rules redirecting port 22, unauthorized SSH keys, unexpected scheduled tasks and suspicious system services.

Additional Ebury indicators include the abstract UNIX socket "@event-0YsOG9WSOE", a disguised "/sbin/rsyslogd" process and the IP address "185.225.226[.]62", associated with the initial intrusion into Zimmer's management server.

Anyone who accepted an unfamiliar SSH host key and entered a password through Tor between October 1 and October 5 should treat that credential as compromised, change it and investigate the destination server.

Suspected infected hosts should be taken offline, forensic evidence preserved and systems reinstalled rather than merely cleaned. Operators should replace exposed credentials, generate new relay identities and report findings to the Tor Project's bad-relays mailing list.

The incident demonstrates that Tor's traffic-routing protections cannot guarantee the authenticity of a destination connection when a malicious exit intercepts it. Verifying SSH host keys, disabling password authentication where practical and maintaining unique credentials are essential defenses.

OVHcloud CLI Packages on GitHub Were Replaced With Secret-Stealing Malware



 

ovhcloud

API Keys Cloud Credentials GitHub malware ovhcloud

OVHcloud CLI Packages on GitHub Were Replaced With Secret-Stealing Malware

Attackers replaced the binary releases of OVHcloud's open-source CLI tool on GitHub with malicious builds designed to harvest secrets from developer machines, the company confirmed this week. The incident, which affected versions v0.11.0 through v0.15.0, went live on October 19 and was only caught after a customer raised an alarm about a suspicious release.

The malicious files were live for roughly 94 minutes. A customer's CI pipeline, which had a pinned SHA-256 checksum for the v0.15.0 Linux binary, failed when the hash no longer matched, and the customer opened issue #300 on the public GitHub repository. OVHcloud pulled the replaced assets at 14:21 UTC and shipped a clean replacement, v0.16.0, three hours later.

A Compromised Account, Months in the Making

The attack traced back to a single GitHub account: `HassenBF`, belonging to a legitimate OVHcloud contributor who had write access to the release repository. According to the security research group OpenSourceMalware, the account was compromised roughly seven months before the attack, with evidence pointing to early March 2026.

On March 5 and 6, four personal repositories on the account were force-pushed within a scripted window. Three of those rewrites embedded a `preinstall.js` loader file containing a payload hidden inside invisible Unicode variation-selector characters. A fourth repository inlined the same decoder into a React source file. The push cadence for the first three repositories was 42 seconds, which OpenSourceMalware interpreted as automated rather than manual activity.

After that, the account went quiet on the CLI project. It continued contributing to `ovh/ovhcloud-docs` through May to September 2026, with several pull requests merged normally. That cover of normalcy made the account hard to flag.

How the Malicious Binaries Were Built

The attacker did not touch OVHcloud's CI/CD pipeline. Instead, they built the infected packages locally and uploaded them directly using the GitHub Releases API, replacing the macOS (Intel and ARM), Linux (x86_64 and ARM64), and Windows x86-64 binaries across five versions. The i386, Windows ARM64, and WASM builds were left alone, which OpenSourceMalware read as deliberate targeting of developer and operations workstations.

Critically, the attacker also replaced the `checksums.txt` file last, so the new hashes matched the malicious binaries. Anyone who verified the checksum would still get a false sense of security.

OVHcloud CEO Octave Klaba confirmed that GitHub's release immutability setting had been turned off on the repository, which is what allowed an account with write access to silently overwrite already-published releases without triggering any CI checks. Since the incident, OVHcloud has re-enabled that setting. The v0.16.0 release is now marked immutable, meaning its files cannot be replaced.

A forensic check of the malicious binary using `go version -m` revealed it was built from a git checkout with uncommitted changes (`vcs.modified=true`), a dead giveaway that it came from a local workstation build rather than the official GoReleaser pipeline.

The Payload: A Solana Dead Drop and GlassWorm Fingerprints

OpenSourceMalware dug into the `preinstall.js` file loaded into the compromised account's repositories back in March. The loader uses a two-stage design. The first stage AES-256-CBC decrypts a hex blob, and the resulting second-stage script checks whether the victim machine appears to be based in Russia by testing language and timezone settings; if it is, the script exits after 10 seconds.

Otherwise, it contacts public Solana RPC endpoints, queries transactions from a specific wallet address, and reads a JSON memo embedded in the blockchain. That memo carries a base64-encoded URL pointing to the next-stage payload. This "dead drop" technique lets the attacker swap out the payload URL anytime without touching any code repository.

The Solana wallet in question, `BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC`, appears in public indicator lists for GlassWorm, a threat actor that has been running campaigns since late 2025 targeting VS Code, OpenVSX, GitHub, and npm. OpenSourceMalware attributes this attack to GlassWorm with moderate confidence.

Who Is Affected and What to Do

Any developer or CI pipeline that downloaded or ran the CLI through `install.sh`, the Homebrew cask, or a direct GitHub release between 12:47 and 14:21 UTC on October 19 may have been exposed. Klaba said the malware's goal was to collect secrets sitting on disk, and while he described the binary as low quality, he warned it was still capable of doing real damage.

Affected users should update to v0.16.0 or roll back to v0.10.0 immediately, but updating the tool alone is not enough. Any machine that ran a compromised version should be treated as having all its readable secrets exposed. That means rotating OVHcloud API keys, cloud credentials, SSH keys, Kubernetes configs, package registry tokens, and anything stored in `.env` files, from a separate, clean machine. Users on macOS should also check for an `~/init.json` file in the home directory, which the second-stage script writes as a throttle marker.

OVHcloud has said a full post-mortem is coming. Key questions remain open: how the developer account credentials were first stolen, whether the same actor maintained access for the entire seven months, and exactly what the final payload did before OVHcloud deleted the files.

Hirudo Android Malware Replaces Banking Apps to Evade Security Checks



 

User Privacy

Banking Trojan Financial Scam Hirudo malware User Privacy

Hirudo Android Malware Replaces Banking Apps to Evade Security Checks

A newly identified Android banking trojan called Hirudo is taking an unusually aggressive approach to evading mobile security: instead of merely overlaying fake login screens on top of legitimate apps, it replaces the victim’s banking app with a modified copy. According to mobile security firm ThreatFabric, the malware retains nearly all of the original app’s code but injects a hooking engine based on the open-source frameworks YAHFA and Dobby. That lets it operate inside the banking app’s own process, effectively turning the app’s defenses against it.

Hirudo is typically delivered through seemingly useful apps, including a shopping app called Shopora, an adult-content app named 1V1 X, and short-drama apps such as ZoyaTV and KoiShort. These loader apps provide the functionality users expect, then display a fake “update” notification that leads to permission requests—most importantly access to Android’s Accessibility services. Once granted, Hirudo can uninstall the genuine banking app, download a patched version, and install it automatically using its elevated permissions.

The replacement app is designed to defeat several common security checks. It can substitute the genuine signing certificate when queried, hide enabled Accessibility services, remove screenshot protection, alter key-attestation certificates, and route Play Integrity requests through an attacker-controlled server. By doing so, it can make a tampered banking app appear legitimate to both the user and parts of the device’s security system. Researchers note that the process is risky for the attacker because the victim can interrupt the app replacement at two separate points.

Once active, Hirudo gives operators extensive control over the infected phone. It can steal banking passwords, payment PINs, device-unlock credentials, and SMS messages; stream the screen in real time; capture screenshots; record audio; and access both cameras. The malware also uses fake checkout pages to collect payment PINs and then shows a fabricated payment-success message, making victims believe a transaction completed normally while their data is being harvested.

ThreatFabric says Hirudo has impersonated at least seven Indonesian banks, with additional targeting observed in China, India, Mexico, Morocco, and Thailand. An unsecured backend panel linked to the operation contained thousands of application-credential entries, along with device, lock-screen, and financial-profile data, though the total number of victims remains unknown. The researchers recommend that banks validate integrity and attestation server-side, tie those checks to sessions and protected actions, and maintain behavioral and transaction-risk controls. Android users should keep devices updated, avoid installing APKs from unofficial stores, and periodically run Google Play Protect scans.

XWorm RAT Evolves Into Advanced Surveillance Malware



 

XWorm RAT

Browser Session Hijacking cyber espionage Cyber Security Threats Endpoint security malware Remote Access Trojan Surveillance Malware Webcam Spying XWorm RAT

XWorm RAT Evolves Into Advanced Surveillance Malware

Remote access trojan (RAT) XWorm has developed into an advanced surveillance threat whose capabilities extend beyond data theft and remote system control. According to cyber security researchers at Netskope Threat Labs, recent versions of this malware contain plugins for tracking the location of victims, capturing live audio, controlling webcams, and controlling active browser sessions.

It was discovered in 2022 that XWorm facilitated the control of compromised systems by logging keystrokes, capturing screenshots, and executing remote payloads. The malware has been modified by its developers since its discovery, adding new features and releasing updated versions. According to Netskope, 1,236 detection events were recorded across 100 customer organisations during the third quarter of 2026, representing a fourfold increase from the same period in 2025.

The malware's expansion has been accompanied by an expansion of its plugin collection. In July 2025, 35 plugins were supported, but by October 2026, 46 plugins were supported, which provided increased capabilities for monitoring and interacting with victims' devices.

A cracking of the XWorm builder and subsequent release of the source code for version 6.4 in August 2025 resulted in the wider dissemination of the malware. Since then, researchers have identified multiple versions operating in the wild, including V6.4, V6.5, V7.2, and V7.4 The malware has been modified in several ways, including code protection, delivery methods, and the ability to evade security analysis.

There are approximately 35% of affected customers that are affiliated with financial services companies, according to Netskope. The majority of reported incidents have occurred in the United States, India, Brazil, Italy, Panama, and Brazil. HBrowser plugins pose a significant security risk due to their ability to operate within existing browser sessions rather than relying on stolen passwords.

Command-and-control channels of the malware are encrypted using AES, allowing for remote mouse clicks, keyboard inputs, and other interactions with the active browser. By continuously taking screenshots, attackers can gain access to accounts already logged in and potentially gain access to sensitive information. By collecting device location data without a visible consent request, the Maps plugin adds another layer of surveillance.

Netskope's analysis shows that it attempts to retrieve GPS coordinates, but when GPS coordinates are not available, it switches to IP-based geolocation. Microphone plugins allow for recording audio from selected recording devices and transmission to operators in encrypted, compressed data chunks. In addition to webcam recording, attackers may also monitor compromised devices without displaying obvious warnings to the user using these functions.

Continued Development Raises Security Concerns

As the malware has evolved, it has also undergone changes to make analysis and detection more challenging. Recent variants have introduced stronger code protection techniques, techniques for avoiding virtual analysis environments, and modifications to payload delivery and command-and-control communication.

By expanding the plugin collection, operators have increased the range of options they have for tailoring attacks to meet their objectives. NetSkope anticipates continued development of XWorm following the public release of its builder and source code, with further development likely following that. The increasing surveillance capabilities of malware also highlight the limitations associated with multi-factor authentication alone.

An attacker who controls an already authenticated browser session on an infected device may not be able to prevent access to open accounts even when additional login verification is performed. It is recommended that security teams strengthen endpoint monitoring, investigate unusual process and network activity, and restrict unauthorised outbound communications.

Network segmentation will also allow you to limit the spread of malware across other connected systems. Detecting endpoints, monitoring traffic, and responding to incidents in a timely manner remain crucial for identifying suspicious activity and containing compromised devices before they can be exploited further by attackers.

Malware Incident at Karaoke Giant May Expose Data of 8,724,000 People



 

User Data

Daiichi Kosho Data data security malware User Data

Malware Incident at Karaoke Giant May Expose Data of 8,724,000 People

Daiichi Kosho, a major Japanese karaoke company known for operating the popular Big Echo chain, has disclosed a potential data breach that could affect approximately 8.7 million records. The incident involved malware discovered on a computer belonging to Nippon Columbia Group (NCG), an entertainment company that handles customer information on Daiichi Kosho’s behalf.

In a statement published on October 8, 2026, Daiichi Kosho said it could not rule out the possibility that personal information stored on the affected computer had been exposed to unauthorized parties. But the company has not confirmed that the data was actually stolen or leaked.

“According to NCG, between October 1 and October 2, 2026, a malware infection was discovered on one of their employees' devices (a PC), and the device was isolated from the network on October 2. Following an investigation into the scope of the impact by NCG, we received a report from NCG on October 5,” read the statement.

Incident details

After an initial investigation, NCG informed Daiichi Kosho about the incident on October 5. The investigation revealed that information collected through outsourced business operations had been temporarily stored on the compromised computer.

NCG has reset affected passwords and is investigating how the malware entered the system, whether information was accessed by unauthorized individuals, and the overall scope of the incident. The available information does not identify the malware.

What can be leaked?

Daiichi Kosho estimates that approximately 8.724 million records may have been affected. “Based on the information we currently have, approximately 8,724,000 customers who registered or made reservations at our stores may have had their names (registered names), genders, dates of birth, email addresses, and telephone numbers leaked to external parties,” the company warned.

The affected records are linked to customers who registered for membership or made reservations at the company’s establishments. The businesses include Big Echo, DK Dining, Mega Big, Karaoke Club DAM, Banana Club and B-Garage.

How to stay safe?

Daiichi Kosho has warned customers not to open unfamiliar links or attachments and to remain cautious when receiving unexpected emails, text messages or calls. The company has also clarified that passwords and credit card information are not included in the potentially exposed data.

Russian-Aligned Spies Upgrade MATCHBOIL Malware Targeting Ukraine



 

Ukraine Cyber Attacks

cyber espionage malware MATCHBOIL Malware Russian Cyber Espionage Russian Hackers Spear-Phishing Attacks UAC-0099 Ukraine Cyber Attacks

Russian-Aligned Spies Upgrade MATCHBOIL Malware Targeting Ukraine

The Russian-aligned cyber espionage group UAC-0099 has continued developing the MATCHBOIL malware for use in attacks against Ukrainian companies involved in transportation, manufacturing, and energy. Several changes have been made to the malware since 2024, according to research conducted by cybersecurity firm ESET, with newer versions adding techniques designed to make detection and analysis of the malware more difficult.

Researchers at ESET analyzed MATCHBOIL samples collected between April 2024 and April 2026 in a report published on October 8, 2026. Based upon the findings, the downloader appears to be becoming more sophisticated with each new version. While the Ukrainian Computer Emergency Response Team (CERT-UA) first documented the malware in August 2025, earlier samples indicate that the malware had been developing for at least a year prior.

Matchboy is a C#-based downloader designed for retrieving additional malicious payloads from a command-and-control (C2) server, installing them on compromised systems, and maintaining their presence ESET's telemetry identified victims exclusively in Ukraine, including transportation companies between July and August 2025, a manufacturing organization in December 2025 and a company in the energy sector in June 2026.

In order to spread the malware, spear-phishing emails containing malicious links are used. Once a recipient clicks the link, an archive containing VBScript is downloaded. MATCHBOIL is then downloaded and executed on the victim's computer, thereby giving the attackers the opportunity to introduce further malicious components.

Although the level of confidence in UAC-0099's alignment with Russian interests was described as medium, ESET concluded that it was likely aligned with Russian interests. This group has previously targeted Ukrainian government agencies, financial institutions, and media institutions, proving MATCHBOIL to be another component of its broader cyber espionage activities.

MATCHBOIL has modified its code so that it is harder to inspect, thereby making its activity less visible. It was previously obfuscated with basic Unicode, but newer samples use Eziriz .NET Reactor, which complicates reverse engineering. The malware has also been updated to detect virtual or analysis environments and to stop it from running under these conditions.

Additionally, the malware's execution pattern has changed. A version seen from late 2025 started checking in roughly once every two minutes for additional or updated components, as opposed to earlier versions that contacted the command-and-control server once to retrieve a payload. It has also evolved over time to keep the malware active on compromised systems, switching between Windows Registry Run keys and scheduled tasks.

Researchers have also noted attempts to make the malware appear legitimate in the past. The late-2025 variant was able to display a daily planner interface when manually launched, but interface errors rendered it unconvincing.

However, the sample identified in February 2026 was more conspicuous, showing a text-search utility. Other malicious tools have also been associated with MATCHBOIL, including MATCHWOK, a backdoor that enables the execution of remote commands, and DRAGSTARE, a cookie and browser credential stealer.

This combination allows the group to expand beyond initial access and engage in further activities on compromised systems. ESET's findings indicate that UAC-0099 continues to refine MATCHBOIL for future operations. There is no accurate figure of the number of organizations affected by the campaign, as neither ESET nor Ukraine's CERT-UA have provided a confirmation of the number of victims.

PoeLLM Campaign Compromises 3,400+ Servers for Crypto Mining



 

PoeLLM Malware

AI Infrastructure Security AI Server Security Canto Incognito cryptocurrency mining Cryptojacking Cybersecurity Threats GitHub C2 LiteLLM Vulnerability malware PoeLLM Malware

PoeLLM Campaign Compromises 3,400+ Servers for Crypto Mining

Cryptocurrency mining campaigns have compromised over 3,400 servers since April 2026, with attackers primarily targeting exposed artificial intelligence and large language model infrastructures. The campaign is referred to as Canto Incognito and exploits vulnerable internet-facing services through PoeLLM malware, which becomes part of a growing mining botnet by exploiting vulnerable internet-facing services.

Infections have largely been reported in the U.S. and Western Europe with nearly 2,200 affected servers at its peak at mid-June. Lumen Black Lotus Labs has reported that the malware has affected enterprise deployments such as LiteLLM, Ollama, Gotenberg, Gitea, and possibly Ivanti Sentry.

The choice of artificial intelligence-based infrastructure has a significant impact on cryptocurrency mining due to the substantial computing resources that such systems are capable of providing. Some of the compromised servers may also be used to scan for additional vulnerable systems, which can help the attacker expand the botnet once they have been compromised.

PoeLLM stands out due to its unique command-and-control mechanism (C2) Instead of placing the server address directly in the malware, the attacker concealed it in a poem hosted on GitHub. On April 13, 2026, the repository was created under the username “ejejejdfbbebebe,” with the first relevant commit being recorded. Throughout the campaign's change to its C2 infrastructure, the poem, titled "On the Nature of Connection," has been modified several times.

By using a dictionary embedded in its code, the malware extracts selected words from fixed sections of the poem and maps them to numerical values. Those values are combined to determine the IPv4 address of the active C2 server. If the attacker changes the selected words, infected systems will be able to determine the new address without requiring a new sample of malware.

A campaign's effectiveness is not only determined by the initial compromise. Once PoeLLM gains access to a compromised server, it can use the compromised system to locate additional targets. Black Lotus Labs observed a significant amount of scanning activity involving ports 3000 and 4000, which are commonly used to access Gotenberg and LiteLLM deployments. In order for vulnerable systems to retrieve malware from the active C2 infrastructure, crafted HTTP requests were sent to them. LiteLLM was a significant target in this activity.

The analyzed malware sample referenced CVE-2026-42271, a command injection vulnerability associated with /mcp-rest/test/connection. In addition to providing attackers with access to exposed artificial intelligence infrastructure, PoeLLM also features cryptocurrency mining capabilities. This allowed attackers to launch further attacks on compromised systems.

Infection involves the deployment of XMRig and Iron miners as well as the connection of compromised systems to the Kryptex mining service. The attackers can benefit greatly from the use of AI infrastructure because many such environments are run on advanced hardware with GPUs capable of providing significant computing power for mining.

The malware does not limit itself to mining. According to researchers, infected servers are able to perform additional malicious activities by using remote shell functionality, HTTP/S scanning, and exploit deployment. Recent activity against SSH ports and other login interfaces suggests that the operator may also be testing distributed brute-force attacks, though this capability is currently at an early stage. As a result of assessing the campaign with moderate confidence, Black Lotus Labs has determined that the attacker is an Italian-speaking individual.

A combination of Italian-language comments found on malicious software and associated GitHub pages, as well as network traffic analysis, contributed to the assessment. There has been no identification of a specific individual or established criminal group.

In this campaign, it illustrates the dual purpose of exposed artificial intelligence infrastructure for attackers: its computing resources can be monetized, while compromised machines are also able to assist in locating and compromising the next set of vulnerable systems.

Recent attack by hackers motivated by financial gain has demonstrated how exposed AI and developer infrastructure can become valuable targets for attackers with financial motivations. As AI deployments expand across enterprises, strong patching, restricted internet exposure and proactive monitoring remain essential.

CloudSyncD Backdoor Spread Through Fake Zoom Installer Targeting macOS



 

Zoom Malware

CloudSyncD Malware Fake Zoom Installer Mac Security MacOS Backdoor MacOS Malware malware Malware Campaign Zoom Malware

CloudSyncD Backdoor Spread Through Fake Zoom Installer Targeting macOS

Using fake Zoom installers, a macOS malware campaign distributes a backdoor known as CloudSyncD, a backdoor for MacOS.

Jamf Threat Labs first identified the malware during its development in mid-September, but later samples indicated it had moved to a live command-and-control infrastructure. It is initiated by the use of a disk image that is made to resemble the Zoom installer. When a package is opened, it appears as a volume titled Zoom and uses familiar installation elements to create the impression that the application is genuine.

Using fake Zoom installers, a macOS malware campaign distributes a backdoor known as CloudSyncD, a backdoor for MacOS.

During installation, victims are presented with an authorization prompt designed to obtain their account password. The installer also relies on the user allowing the application to run despite macOS Gatekeeper protections. Before continuing with the infection process, CloudSyncD verifies the supplied credentials against the local account. Rather than immediately forwarding those credentials to its operators, the malware retains them on the compromised machine inside a disguised configuration file.

The stored password is deliberately made difficult to identify through an ordinary inspection of the file. CloudSyncD combines encoded information with invisible zero-width Unicode characters, effectively concealing the credential within otherwise inconspicuous data. The password subsequently becomes useful to the malware itself, allowing the next stage of the infection to run with greater privileges. The accompanying CloudSyncD component is delivered as a universal Mach-O binary, allowing it to operate across both Intel and Apple silicon systems.

For the next stage, the malware first tries to launch its payload without relying on a conventional file being written to the system. If macOS protections prevent this approach, CloudSyncD can fall back to placing the payload temporarily on disk. It can then make use of the previously obtained password with `sudo` to execute the component with elevated permissions.

Once running, the second-stage component operates primarily as a backdoor rather than as a conventional information-stealing program. Its purpose is to establish contact with attacker-controlled infrastructure and create a channel through which additional executables or compressed archives can be delivered. This gives the operators an opportunity to introduce further malware or tooling after access to the Mac has already been established.

By creating a working directory and maintaining encrypted activity logs, the malware avoids the need for a visible persistence mechanism. Check-ins occur every 8 to 16 seconds and include a hardware identifier, suggesting a periodic check-in is occurring. Compared to a simple command shell, the C2 channel provides the attackers with greater flexibility.

Using CloudSyncD, the compromised Mac can be supplied with compressed archives or executables, which can then be used to run the supplied content. Jamf Threat Labs identified multiple later builds of the backdoor communicating with two live domains following the initial infection. This enables the backdoor to serve as a delivery mechanism for additional malware or tools. They use the same URI structure, which was designed to resemble a request for a jQuery script.

Both domains were registered with the same registrar in 2011 and were protected by Cloudflare. As of the time of the researchers’ analysis, neither domain was flagged by a security service. A number of technical similarities were also observed between the different samples, including similar string-obfuscation schemes, installation paths, daemon names, and process disguise schemes.

More importantly, the builds shared the same C2 encryption key and initialization vector, which means network traffic captured from different versions could potentially be decrypted using recovered configuration material. According to the findings, CloudSyncD had moved from an unfinished test build to a functional backdoor utilizing social engineering, while maintaining a relatively simple infection route.

Researchers distinguish the malware from a conventional infostealer despite the fact that it collects system and user information for reconnaissance. Rather than being sent to the attackers, the captured password is used locally to obtain elevated privileges, while the backdoor's primary function is to provide access and facilitate the execution of additional payloads.

Google's Android 17 Locks Accessibility Services to Verified Apps as Malware Threat Branches Out



 

malware

AccessibilityService API advanced protection Android android 17 API Browser Google Intrusion Logging feature malware

Google's Android 17 Locks Accessibility Services to Verified Apps as Malware Threat Branches Out

Google is tightening restrictions on one of mobile malware's most persistent entry points. With Android 17, the company is limiting access to its AccessibilityService API to verified Accessibility Tools only, a change that takes effect the moment a user switches on Advanced Protection.

The move, announced Thursday, targets a problem that has haunted Android security for years. The AccessibilityService API was built to help people with disabilities use their smartphones. Screen readers, voice control apps, and motor-assistance tools all rely on it. But the privileges it carries are significant. Apps that tap into the API can run in the background, observe what appears on screen, intercept UI events, and take actions inside other applications on a user's behalf. That set of capabilities made it a target for malware developers almost immediately after it was introduced.

Google stated in its announcement that the new version automatically restricts AccessibilityService access to verified Accessibility Tool applications, closing off a major attack avenue while keeping genuine assistive technology functional.

A Clichéd Attack Path

Malware families have been weaponizing Android's accessibility services since at least 2017. The list of known offenders runs long: Vultur, SharkBot, Xenomorph, BianLian, Anatsa (also tracked as TeaBot), and more recently BTMOB RAT, a remote access trojan documented attacking banking customers across Brazil, Argentina, Spain, Portugal, and Mexico through 2025 and 2026. According to Kaspersky data, trojans accounted for 40 percent of Android malware infections in Q1 2025, with nearly 12 percent of malicious apps falling into the banking trojan category that specifically abused the Accessibility API, totaling around 154,000 apps.

The attack chain is well understood. A malicious app, typically distributed through sideloaded APKs or disguised as something routine, tricks a user into granting accessibility permissions. The Anatsa trojan, for instance, slipped onto Google Play as a PDF viewer update as recently as July 2025. Once the permission is granted, the malware operates without root access. It can monitor keystrokes, layer fake login pages on top of legitimate banking apps, approve system dialogs silently, and initiate fraudulent fund transfers from financial applications without the user noticing anything unusual on screen. Google noted in its announcement that this access also allows malware to block its own uninstallation, locking users out of any easy remedy.

What Changes in Android 17

The new restriction applies specifically when Advanced Protection is active, a device-level security mode introduced with Android 16 that consolidates multiple hardening features under a single toggle. When a user enables it, the system now automatically enforces that only verified, legitimate accessibility apps can request AccessibilityService access. Everything else is denied.

This is part of a gradual tightening that has been underway for several years. Android 13 made it significantly harder for sideloaded apps to acquire accessibility permissions. In-call protections, rolled out more recently, prevent users from granting those permissions during a phone call, cutting off a common social engineering scenario. Google also introduced the `accessibilityDataSensitive` flag to let developers mark UI elements as off-limits to third-party accessibility readers.

The Rest of Android 17's Security Updates

The accessibility change is one piece of a wider hardening effort in Android 17. Intrusion Logging, developed in collaboration with Amnesty International's Security Lab and other civil society organizations, creates a persistent, privacy-preserving forensic record of sensitive system events. Amnesty's team simultaneously updated AndroidQF and its Mobile Verification Toolkit to process the new log format, making it immediately useful for researchers investigating suspected spyware infections.

USB Protection blocks new data connections over a USB port while the device is locked, preventing physical access attacks where an attacker might attempt to extract data or push commands through a connected cable. Google has also included an option to disable WebGPU, a graphics API that has surfaced in sophisticated browser-based exploit chains. Failed Authentication Lock responds to repeated incorrect login attempts by locking the device entirely, making brute-force attempts against a stolen or seized phone substantially harder.

A fifth addition, View Supporting Apps, gives users a clear window into which installed applications have checked whether Advanced Protection is active on the device.

For developers, Google confirmed that applications can receive a notification when a user enables Advanced Protection, allowing them to switch on their own high-security features automatically for that audience.

Existing Advanced Protection users will receive a notification when the new capabilities land on their device. Intrusion Logging is not switched on by default and must be enabled manually from the Advanced Protection settings page.

101 Malicious npm Packages Secretly Enroll Developers into WhatsApp Spam Channels



 

WhatsApp Spam

API Token Exposure CloudFlare Data Theft Malicious Npm Packages malware WhatsApp Spam

101 Malicious npm Packages Secretly Enroll Developers into WhatsApp Spam Channels

Researchers at OX Security have flagged 101 npm packages that silently subscribe developers to WhatsApp spam channels the moment they are installed. The campaign abuses the open-source Baileys library, an unofficial implementation of the WhatsApp API that developers use to build customer support bots, chat managers, and automation tools, to carry out the subscriptions without any visible prompt or warning.

The packages have collectively been downloaded roughly 490,000 times, with 116,000 of those downloads occurring in the last 30 days. The single most downloaded package, `ourin-baileys`, accounts for 130,589 installs on its own, nearly a quarter of the campaign's total reach. As of publication, the majority of the 101 packages remain live on npm. Sixteen had been removed, and seven of those were pulled before researchers could review the code to determine which variant of the malware they carried.

The campaign did not begin in 2026. The oldest package in OX Security's list, `alipclutch-baileys`, was first published in October 2025. Several others date to December 2025, meaning this operation has been running quietly on the registry for close to a year before receiving a formal write-up.

Three Ways to Hide the Same Payload

OX Security researchers Nir Zadok, Moshe Siman Tov Bustan, and Vitalii Chepurko identified three distinct variants of the malware, each handling the subscription routine differently.

The first variant, found in 19 packages, fetches channel IDs from GitHub at runtime. By hosting the target list externally, operators can swap out which accounts receive new followers without ever publishing a new package version to npm. One package, `@rixxcodex/baileys`, hides the GitHub URL inside media-download code using Base64 encoding so it is unlikely to catch the eye of anyone skimming the source.

The second variant, covering 60 packages, simply embeds the channel IDs in cleartext inside the source code. Two packages took additional steps to bury this, placing the subscription logic inside an upstream connection handler and inside a file named after the Signal cryptographic protocol, a location most developers would never think to inspect.

The third variant, found in 14 packages, encodes the hardcoded channel IDs using Base64. One package in this group, `neuralwhatsapp`, takes a slightly different approach: rather than storing a channel ID directly, it resolves its target from a hardcoded WhatsApp invite code at runtime.

The Follower Inflation Business

The goal is not data theft or ransomware deployment. The channels identified in this campaign are mostly small bot-seller and marketplace accounts, largely Indonesian, where follower counts function as social proof for selling bot scripts, premium APKs, social media boosting services, and in-game resources.

Among the specific channels researchers identified: Neural has 798 followers and markets game-currency sales through a platform called JualanRSS, which deals in in-game resources including food, ore, stone, timber, and gold. MONTE-BMG has 1,000 followers. CORTANA TECH has 1,300 and points visitors to a dedicated website. Fyxzpedia.ID-Utama, with 4,800 followers, sells WhatsApp and Telegram bot scripts and bot-building services outright. One Spanish-language channel called Redes Oficiales sits at 19,000 followers and is linked to a YouTube creator, pushing back against the assumption that this is a purely Indonesian operation.

The threat actors mute these channels on the victim's device after subscribing them, so the added follower count appears organic to outside observers. A channel with thousands of followers reads as trustworthy, and that manufactured trust is the product being sold to the operators running these marketplaces.

One channel, MONTE-BMG, illustrates how the monetisation funnel actually works. It posts what appears to be a screenshotted sales negotiation in Arabic, ending with a group invite link. That link leads to a brand-new channel with only 12 followers, whose own description contains yet another group invite. The inflated parent channel is only the entry point. The actual transaction gets moved progressively deeper into a private chain of groups where there is no public record.

Beyond follower inflation, the SafeDep research team noted earlier this year that some Baileys forks in this campaign also inject the package author's advertising URL into every image and video the bot sends, a second payload the follower-count headline tends to obscure.

One Coordinated Operation, Many Names

OX Security found that 32 channels are followed by more than one package across this campaign. The single most reused channel, identified by the ID `120363400911374213@newsletter`, is targeted by ten separate packages. One remote channel list hosted on GitHub feeds five different packages simultaneously, meaning the operator can retarget all five installations by editing a single file.

Operators routinely publish near-identical packages under slightly different names to preserve the campaign when individual listings get removed. `noxleyss` and `@noxleyss/baileys`, for example, carry the same code under different publisher accounts.

Details of the abuse first emerged in August 2026 when SafeDep identified Baileys npm forks making installers' WhatsApp accounts follow attacker-controlled channels. Earlier this month, the Xygeni Security Research Team separately detailed another Baileys modification, `@dappaoffc/baileys-mod`, which subscribed developers' authenticated WhatsApp bot sessions to attacker-controlled newsletter channels.

The campaign follows a pattern OX Security has tracked on npm before. An earlier operation used the same registry to host fake Cloudflare CAPTCHA pages designed to redirect visitors to ClickFix phishing infrastructure. The registry's scale and the institutional trust developers place in what appear to be legitimate forks of known libraries make it a dependable distribution channel for this kind of abuse.

Because the packages carry none of the classic malware signatures, no API token theft, no heavy obfuscation across the board, no destructive payload, standard threat detection tools are likely to miss them entirely. That is precisely why most of these packages have remained live for months.

What Developers Should Do

Security recommends checking whether your WhatsApp account has been added to unknown channels and blocking or reporting any that appear. Developers should avoid any npm package that requires connecting a personal WhatsApp account and should add detection rules to their pipelines flagging known malicious Baileys forks. Remote channel-list URLs identified in these packages can be added to URL-reputation and threat-intelligence pipelines for ongoing monitoring.

NeedyMantis Malware Expands the Post-Compromise Threat Landscape



 

Threat Intelligence

Cybersecurity DLL Sideloading malware NeedyMantis Malware Targeted Cyber Attacks Threat Intelligence

NeedyMantis Malware Expands the Post-Compromise Threat Landscape

A modular malware family dubbed NeedyMantis has been identified by Microsoft Threat Intelligence, and has been employed to maintain access to compromised systems in a limited number of targeted intrusions.

Evidence of the malware dating back to at least October 2025 indicates that it has affected telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors. During an investigation into indicators associated with the DAEMON Tools supply chain compromise, Microsoft identified NeedyMantis.

The company tracks activity associated with Storm-3069, and has observed the malware in use beyond that campaign. While Microsoft believes the observed operations are associated with activities associated with China-based threat actors, it has not attributed Storm-3069 to a Chinese nation state actor or confirmed that all NeedyMantis activity originated from a single operator.

As a general rule, NeedyMantis is deployed after attackers have already gained access to the target environment. The malware serves primarily as an initial access tool, but it is also intended to maintain access and facilitate further activity within the compromised network, utilizing DLL sideloading as part of its delivery chain. It has been observed that attackers packaged malicious DLLs with legitimate applications and encrypted archives in an attempt to facilitate their delivery.

Poedit, curl, Vim, and TightVNC were among the programs abused in this manner, while malicious DLLs were disguised as Microsoft Office, Broadcom, Intel, and NVIDIA components. One incident involved the use of Impacket toolkit to copy a legitimate software package from a network share into the malicious file, which was then executed on the targeted computer. It is important to note that NeedyMantis played a crucial role in the post-compromise phase of an intrusion, despite the attacker already having established access to the environment.

Once the initial DLL is loaded, the malware continues to feature layered security. A second-stage component is extracted from the encrypted archive by the first-stage loader, which is the file used in the analysis, encryptbase64.ps1. Even though the file has a PowerShell extension, it contains x64 shellcode rather than a conventional PowerShell script.

Once the embedded malware has been decoded and decompressed, a custom executable format based on a reduced version of the Windows PE format is loaded. An additional level of protection can be provided by the custom archive. Its contents can vary between samples, with file names and internal values varying.

The analyzed WinSparkle archive contained legitimate components of 7-Zip and Sysinternals as well as files with familiar Windows library names, including dnsapi.dll and ws2_32.dll, mixed with legitimate components. Instead of the legitimate libraries represented by these files, NeedyMantis configuration and communication components were found in these files. The main component communicates with the malware's command-and-control infrastructure and manages additional modules.

It is Microsoft's responsibility to observe an initial HTTPS request before switching the connection to a binary WebSocket protocol. The communications component utilizes WebSockets. A hard-coded user agent for Firefox 21.0 has also been used by the malware in one implementation. Through the C2 channel, operators can add and remove modules and exchange data with them, though Microsoft has not confirmed the specific functionality of the modules.

A NeedyMantis sample collected in October of 2025 contained a persistence module based on Windows services, however the persistence method employed by the newer analyzed sample has not been identified. The malware is more challenging to analyze through a single file or indicator due to its staged loading, misleading file names, encrypted archives, and modular C2 communication.

Detection points have been provided by Microsoft for hashes, file paths, the C2 hostname corp.tripswithengine[.]com, and the Firefox/21.0 user agent. As a result of the NeedyMantis campaign, security teams need to monitor suspicious loaders, C2 traffic, and unusual usage of legitimate software in order to recognize the risks posed by modular post-compromise malware.

STOMP Backdoor Uses PowerShell for Sensitive Data Theft



 

Windows Backdoor

Clipboard Stealing Command And Control Data Theft malware PowerShell Malware Securonix TASK#STOMP Wi-Fi Password Theft Windows Backdoor

STOMP Backdoor Uses PowerShell for Sensitive Data Theft

An advanced malware campaign known as TASK#STOMP has recently been discovered, which utilizes a PowerShell-based backdoor to collect business documents, Wi-Fi passwords, clipboard data, and screenshots from compromised computers using a PowerShell backdoor. Moreover, the malware also provides attackers with remote command execution and maintains multiple channels for further access. VBScript files are executed via the legitimate Windows Script Host utility wscript.exe in order to initiate the infection.

In spite of the fact that the exact method of delivery has not been confirmed, phishing or social engineering could be considered possible methods of delivering the script. Following the script's delivery, it sets up a set of scheduled tasks resembling legitimate Windows components, establishing persistence.

By naming these tasks Local Credential Manager, Network Audio Service, Windows Display Manager, and Device Credential Handler, malicious activities can be blended seamlessly with normal system activities. Another persistence mechanism places another VBScript file in the Windows Startup folder, enabling it to run when the user logs in.

Upon launching the malware, it executes two PowerShell components. Among these are sys_loader.ps1, which collects documents, gathers system information, steals Wi-Fi passwords, monitors clipboards, captures screenshots, and executes remote commands. Another persistent command-and-control channel, win_conn.ps1, provides additional collection capability as well as a persistent command-and-control channel.

By monitoring each other and restarting the other process if one is disabled, this setup provides redundancy, making it more difficult to remove the malware if only one process is terminated or a single persistence entry is deleted. In addition to hiding execution activities, timestamp manipulations, and cleanup activities, Task#STOMP can also be used for continuous document theft, increasing the difficulty of detection and forensic investigation.

As opposed to collecting only files that are already present on an infected computer, TASK#STOMP monitors the file system for newly created or modified documents. This enables the collection of business files as they appear and change during an active infection. In addition to obtaining Wi-Fi credentials and clipboard contents, the malware targets saved Wi-Fi credentials as well.

With clipboard monitoring, operators can identify information temporarily copied by users, while screenshot capture allows them to view information displayed on a compromised system. By combining these capabilities with remote command execution, Task#STOMP is able to gather more information about user activity than a conventional file-stealing malware.

A separate command-and-control path, Win_conn.ps1, is maintained by TASK#STOMP in addition to data collection. From win_conn_cfg.dat, the component decodes its configuration and connects to attacker-controlled infrastructure at corecloudfileshare[.]xyz and attachmentsharingdrive[.]xyz. Researcher identification of related traffic can be improved by using a hardcoded authentication token for communication.

Parts of network communication are handled by a compiled C# component. During connection times, connections can proceed when certificates are invalid, self-signed, or otherwise mismatched due to the code disabling TLS certificate validation. This reduces the level of protection usually provided by certificate checks and makes it easier for the malware to communicate with its servers. Additionally, TASK#STOMP alters file timestamps and cleans up activity following execution to provide further anti-forensic measures.

According to the researchers, several files have been backdated to January 15, 2024, but that date is not conclusive of when the campaign began. This date was deliberately inserted by the malware, and therefore cannot be regarded as evidence of the age of the campaign. Securonix has not determined why the malware opens a page associated with irantenders[.]com in Chrome, but the page relates to government contracts and tenders in Iran.

Securonix has not established whether the site indicates a specific victim profile or why it is opened. Researchers have cautioned that the domain alone may not be sufficient to confirm the campaign's geographical or sectoral targeting. Securonix has not linked TASK#STOMP to a known threat group. Due to the use of a single compromised system, it is unclear how the overall campaign scope and duration were determined.

The initial delivery method is also unclear, although similar VBScript campaigns suggest phishing involving archive or disk image attachments as a possible route. To detect an infection, researchers recommend examining suspicious Windows Script Host and PowerShell activity that originates from writable locations, newly created scheduled tasks, and instances where PowerShell invokes the C# compiler from .NET C#.

A suspected infection can be investigated with additional evidence from PowerShell Script Block Logging, AMSI telemetry, and scheduled task records.

WeaselBiscuit Stealer Found in 13 Malicious npm Packages



 

WeaselBiscuit Stealer

BeaverTail malware Chrome Extension Security Contagious Interview DPRK Cyber Threats JavaScript Stealer Malicious Npm Packages malware Software Supply Chain Security WeaselBiscuit Stealer

WeaselBiscuit Stealer Found in 13 Malicious npm Packages

Researchers have discovered 13 npm packages carrying a previously undocumented JavaScript information stealer called WeaselBiscuit, introducing yet another malicious threat to the npm package ecosystem. In addition to linking the packages together via shared indicators, OpenSourceMalware found several similarities between BeaverTail and OtterCookie, two North Korean malware families.

A number of packages are included, including @biz44/id10-client, @biz44/id12-client, @biz44/id44-client, @biz44/id79-client, @biz44/id95-client, @biz44/id99-client, @biz44/process-runtime-utils, @biz44/runtime-utils, @biz44/engin1, id79-client, process-lhpm, process-mite, and process-tailwind. Many were first observed between September 12 and September 16, 2026, with some versions still available on NPM at the time of analysis.

In comparison to BeaverTail and OtterCookie, WeaselBiscuit appears much smaller. In addition to remote access and cryptocurrency theft functions, the malware focuses on profiling hosts and collecting data collected by Chrome extensions rather than carrying a broad range of remote access functions. Malware loaders are launched when a compromised package is imported, causing detached Node.js processes to begin execution.

After retrieving an encoded payload from an Npoint URL, the loader executes the decoded code directly in memory. Following execution, the malware obtains its command-and-control configuration from another Npoint endpoint before connecting to 103.170.217.184:8787. Among the data collected are hostnames, usernames, operating systems, CPUs, and memory, as well as local and public IP addresses.

Chrome profiles are also searched for extension storage on Windows, Mac OS, and Linux platforms. Chrome's Local Extension Settings directory may contain information associated with browser extensions, including cryptocurrency wallet extensions, which makes this collection especially significant.

Instead of relying on a specific list of wallet extensions, OpenSourceMalware reported the stealer uploads readable, non-empty files from these locations. C2 servers can also provide commands for monitoring the clipboard and logging Windows keystrokes.

Despite these capabilities, the recovered malware does not include direct wallet draining functionality, browser password decryption, seed phrase searching, screenshots, or a remote shell access. Additionally, some BeaverTail and OtterCookie activities have a Python-based InvisibleFerret stage that is not present in any other activity.

Possible Links to DPRK Malware

WeaselBiscuit has been compared to malware associated with the DPRK-linked Contagious Interview campaign, but the attribution has yet to be confirmed. OpenSourceMalware did not find conclusive evidence that the attack was originated by North Korea based on operational infrastructure, victimology, campaign metadata or other identifying materials.

WeaselBiscuit employs the dead-drop technique of Npoint.io as a dead-drop service, a technique previously observed in Contagious Interview campaigns. Some of its technical indicators, however, overlap with earlier campaigns. Additionally, its code performs public IP and geolocation checks using IPify.org and IP-API.com, while parts of its command-and-control design are similar to OtterCookie's.

Among the numeric identifiers found in the malware are 10, 12, 44, 79, 95, and 99. These identifiers are similar to campaign markers associated with PolinRider activity, however their exact purpose in WeaselBiscuit is unclear. In terms of capability, BeaverTail and OtterCookie are more closely related.

Several features are retained in WhistlerBiscuit, including system profiling, Chrome extension data collection, clipboard monitoring, and keylogging, all of which are common to those malware families. However, several of their heavier features are removed, including remote access functions, wallet draining capabilities, screenshots, and secondary payload delivery.

Researchers at Cisco Talos observed a similar overlap in October 2025, when they discovered that the node-nvm-ssh package contained characteristics related to both BeaverTail and OtterCookie. The findings suggest that code and techniques from these malware families have been found in a variety of combinations within npm-based malicious code.

The WeaselBiscuit stealer should be viewed for the time being as a distinctive lightweight stealer with distinct technical similarities to DPRK-related tooling rather than a new DPRK malware family confirmed by the DPRK. For a more conclusive attribution, further evidence from infrastructure, campaigns, or code levels would be required.

With the discovery of WeaselBiscuit, security risks are highlighted within the npm ecosystem, particularly for developers utilizing third-party packages. In addition to the ability to collect Chrome extension data and similarity to BeaverTail and OtterCookie, it warrants continued investigation as researchers investigate its origins and wider activities.

Search This Blog

Sections

Popular Posts

Blog Archive

Labels

Report Abuse

About Me

Footer About