Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label malware. Show all posts
User Privacy
Banking Trojan Financial Scam Hirudo malware User Privacy

Hirudo Android Malware Replaces Banking Apps to Evade Security Checks

 

A newly identified Android banking trojan called Hirudo is taking an unusually aggressive approach to evading mobile security: instead of merely overlaying fake login screens on top of legitimate apps, it replaces the victim’s banking app with a modified copy. According to mobile security firm ThreatFabric, the malware retains nearly all of the original app’s code but injects a hooking engine based on the open-source frameworks YAHFA and Dobby. That lets it operate inside the banking app’s own process, effectively turning the app’s defenses against it.

Hirudo is typically delivered through seemingly useful apps, including a shopping app called Shopora, an adult-content app named 1V1 X, and short-drama apps such as ZoyaTV and KoiShort. These loader apps provide the functionality users expect, then display a fake “update” notification that leads to permission requests—most importantly access to Android’s Accessibility services. Once granted, Hirudo can uninstall the genuine banking app, download a patched version, and install it automatically using its elevated permissions. 

The replacement app is designed to defeat several common security checks. It can substitute the genuine signing certificate when queried, hide enabled Accessibility services, remove screenshot protection, alter key-attestation certificates, and route Play Integrity requests through an attacker-controlled server. By doing so, it can make a tampered banking app appear legitimate to both the user and parts of the device’s security system. Researchers note that the process is risky for the attacker because the victim can interrupt the app replacement at two separate points. 

Once active, Hirudo gives operators extensive control over the infected phone. It can steal banking passwords, payment PINs, device-unlock credentials, and SMS messages; stream the screen in real time; capture screenshots; record audio; and access both cameras. The malware also uses fake checkout pages to collect payment PINs and then shows a fabricated payment-success message, making victims believe a transaction completed normally while their data is being harvested.

ThreatFabric says Hirudo has impersonated at least seven Indonesian banks, with additional targeting observed in China, India, Mexico, Morocco, and Thailand. An unsecured backend panel linked to the operation contained thousands of application-credential entries, along with device, lock-screen, and financial-profile data, though the total number of victims remains unknown. The researchers recommend that banks validate integrity and attestation server-side, tie those checks to sessions and protected actions, and maintain behavioral and transaction-risk controls. Android users should keep devices updated, avoid installing APKs from unofficial stores, and periodically run Google Play Protect scans.
Read more »
XWorm RAT
Browser Session Hijacking cyber espionage Cyber Security Threats Endpoint security malware Remote Access Trojan Surveillance Malware Webcam Spying XWorm RAT

XWorm RAT Evolves Into Advanced Surveillance Malware

Remote access trojan (RAT) XWorm has developed into an advanced surveillance threat whose capabilities extend beyond data theft and remote system control. According to cyber security researchers at Netskope Threat Labs, recent versions of this malware contain plugins for tracking the location of victims, capturing live audio, controlling webcams, and controlling active browser sessions. 

It was discovered in 2022 that XWorm facilitated the control of compromised systems by logging keystrokes, capturing screenshots, and executing remote payloads. The malware has been modified by its developers since its discovery, adding new features and releasing updated versions. According to Netskope, 1,236 detection events were recorded across 100 customer organisations during the third quarter of 2026, representing a fourfold increase from the same period in 2025. 

The malware's expansion has been accompanied by an expansion of its plugin collection. In July 2025, 35 plugins were supported, but by October 2026, 46 plugins were supported, which provided increased capabilities for monitoring and interacting with victims' devices. 

A cracking of the XWorm builder and subsequent release of the source code for version 6.4 in August 2025 resulted in the wider dissemination of the malware. Since then, researchers have identified multiple versions operating in the wild, including V6.4, V6.5, V7.2, and V7.4 The malware has been modified in several ways, including code protection, delivery methods, and the ability to evade security analysis. 

There are approximately 35% of affected customers that are affiliated with financial services companies, according to Netskope. The majority of reported incidents have occurred in the United States, India, Brazil, Italy, Panama, and Brazil. HBrowser plugins pose a significant security risk due to their ability to operate within existing browser sessions rather than relying on stolen passwords.

Command-and-control channels of the malware are encrypted using AES, allowing for remote mouse clicks, keyboard inputs, and other interactions with the active browser. By continuously taking screenshots, attackers can gain access to accounts already logged in and potentially gain access to sensitive information. By collecting device location data without a visible consent request, the Maps plugin adds another layer of surveillance. 

Netskope's analysis shows that it attempts to retrieve GPS coordinates, but when GPS coordinates are not available, it switches to IP-based geolocation. Microphone plugins allow for recording audio from selected recording devices and transmission to operators in encrypted, compressed data chunks. In addition to webcam recording, attackers may also monitor compromised devices without displaying obvious warnings to the user using these functions. 

Continued Development Raises Security Concerns 

As the malware has evolved, it has also undergone changes to make analysis and detection more challenging. Recent variants have introduced stronger code protection techniques, techniques for avoiding virtual analysis environments, and modifications to payload delivery and command-and-control communication. 

By expanding the plugin collection, operators have increased the range of options they have for tailoring attacks to meet their objectives. NetSkope anticipates continued development of XWorm following the public release of its builder and source code, with further development likely following that. The increasing surveillance capabilities of malware also highlight the limitations associated with multi-factor authentication alone. 

An attacker who controls an already authenticated browser session on an infected device may not be able to prevent access to open accounts even when additional login verification is performed. It is recommended that security teams strengthen endpoint monitoring, investigate unusual process and network activity, and restrict unauthorised outbound communications. 

Network segmentation will also allow you to limit the spread of malware across other connected systems. Detecting endpoints, monitoring traffic, and responding to incidents in a timely manner remain crucial for identifying suspicious activity and containing compromised devices before they can be exploited further by attackers.

Read more »
User Data
Daiichi Kosho Data data security malware User Data

Malware Incident at Karaoke Giant May Expose Data of 8,724,000 People


Daiichi Kosho, a major Japanese karaoke company known for operating the popular Big Echo chain, has disclosed a potential data breach that could affect approximately 8.7 million records. The incident involved malware discovered on a computer belonging to Nippon Columbia Group (NCG), an entertainment company that handles customer information on Daiichi Kosho’s behalf.

In a statement published on October 8, 2026, Daiichi Kosho said it could not rule out the possibility that personal information stored on the affected computer had been exposed to unauthorized parties. But the company has not confirmed that the data was actually stolen or leaked. 

“According to NCG, between October 1 and October 2, 2026, a malware infection was discovered on one of their employees' devices (a PC), and the device was isolated from the network on October 2. Following an investigation into the scope of the impact by NCG, we received a report from NCG on October 5,” read the statement.

Incident details

After an initial investigation, NCG informed Daiichi Kosho about the incident on October 5. The investigation revealed that information collected through outsourced business operations had been temporarily stored on the compromised computer.

NCG has reset affected passwords and is investigating how the malware entered the system, whether information was accessed by unauthorized individuals, and the overall scope of the incident. The available information does not identify the malware. 

What can be leaked?

Daiichi Kosho estimates that approximately 8.724 million records may have been affected. “Based on the information we currently have, approximately 8,724,000 customers who registered or made reservations at our stores may have had their names (registered names), genders, dates of birth, email addresses, and telephone numbers leaked to external parties,” the company warned.

The affected records are linked to customers who registered for membership or made reservations at the company’s establishments. The businesses include Big Echo, DK Dining, Mega Big, Karaoke Club DAM, Banana Club and B-Garage.

How to stay safe?

Daiichi Kosho has warned customers not to open unfamiliar links or attachments and to remain cautious when receiving unexpected emails, text messages or calls. The company has also clarified that passwords and credit card information are not included in the potentially exposed data. 

Read more »
Ukraine Cyber Attacks
cyber espionage malware MATCHBOIL Malware Russian Cyber Espionage Russian Hackers Spear-Phishing Attacks UAC-0099 Ukraine Cyber Attacks

Russian-Aligned Spies Upgrade MATCHBOIL Malware Targeting Ukraine


The Russian-aligned cyber espionage group UAC-0099 has continued developing the MATCHBOIL malware for use in attacks against Ukrainian companies involved in transportation, manufacturing, and energy. Several changes have been made to the malware since 2024, according to research conducted by cybersecurity firm ESET, with newer versions adding techniques designed to make detection and analysis of the malware more difficult.

Researchers at ESET analyzed MATCHBOIL samples collected between April 2024 and April 2026 in a report published on October 8, 2026. Based upon the findings, the downloader appears to be becoming more sophisticated with each new version. While the Ukrainian Computer Emergency Response Team (CERT-UA) first documented the malware in August 2025, earlier samples indicate that the malware had been developing for at least a year prior. 

Matchboy is a C#-based downloader designed for retrieving additional malicious payloads from a command-and-control (C2) server, installing them on compromised systems, and maintaining their presence ESET's telemetry identified victims exclusively in Ukraine, including transportation companies between July and August 2025, a manufacturing organization in December 2025 and a company in the energy sector in June 2026. 

In order to spread the malware, spear-phishing emails containing malicious links are used. Once a recipient clicks the link, an archive containing VBScript is downloaded. MATCHBOIL is then downloaded and executed on the victim's computer, thereby giving the attackers the opportunity to introduce further malicious components. 

Although the level of confidence in UAC-0099's alignment with Russian interests was described as medium, ESET concluded that it was likely aligned with Russian interests. This group has previously targeted Ukrainian government agencies, financial institutions, and media institutions, proving MATCHBOIL to be another component of its broader cyber espionage activities. 

MATCHBOIL has modified its code so that it is harder to inspect, thereby making its activity less visible. It was previously obfuscated with basic Unicode, but newer samples use Eziriz .NET Reactor, which complicates reverse engineering. The malware has also been updated to detect virtual or analysis environments and to stop it from running under these conditions. 

Additionally, the malware's execution pattern has changed. A version seen from late 2025 started checking in roughly once every two minutes for additional or updated components, as opposed to earlier versions that contacted the command-and-control server once to retrieve a payload. It has also evolved over time to keep the malware active on compromised systems, switching between Windows Registry Run keys and scheduled tasks. 

Researchers have also noted attempts to make the malware appear legitimate in the past. The late-2025 variant was able to display a daily planner interface when manually launched, but interface errors rendered it unconvincing. 

However, the sample identified in February 2026 was more conspicuous, showing a text-search utility. Other malicious tools have also been associated with MATCHBOIL, including MATCHWOK, a backdoor that enables the execution of remote commands, and DRAGSTARE, a cookie and browser credential stealer.

This combination allows the group to expand beyond initial access and engage in further activities on compromised systems. ESET's findings indicate that UAC-0099 continues to refine MATCHBOIL for future operations. There is no accurate figure of the number of organizations affected by the campaign, as neither ESET nor Ukraine's CERT-UA have provided a confirmation of the number of victims.

Read more »
PoeLLM Malware
AI Infrastructure Security AI Server Security Canto Incognito cryptocurrency mining Cryptojacking Cybersecurity Threats GitHub C2 LiteLLM Vulnerability malware PoeLLM Malware

PoeLLM Campaign Compromises 3,400+ Servers for Crypto Mining


Cryptocurrency mining campaigns have compromised over 3,400 servers since April 2026, with attackers primarily targeting exposed artificial intelligence and large language model infrastructures. The campaign is referred to as Canto Incognito and exploits vulnerable internet-facing services through PoeLLM malware, which becomes part of a growing mining botnet by exploiting vulnerable internet-facing services. 

Infections have largely been reported in the U.S. and Western Europe with nearly 2,200 affected servers at its peak at mid-June. Lumen Black Lotus Labs has reported that the malware has affected enterprise deployments such as LiteLLM, Ollama, Gotenberg, Gitea, and possibly Ivanti Sentry. 

The choice of artificial intelligence-based infrastructure has a significant impact on cryptocurrency mining due to the substantial computing resources that such systems are capable of providing. Some of the compromised servers may also be used to scan for additional vulnerable systems, which can help the attacker expand the botnet once they have been compromised. 

PoeLLM stands out due to its unique command-and-control mechanism (C2) Instead of placing the server address directly in the malware, the attacker concealed it in a poem hosted on GitHub. On April 13, 2026, the repository was created under the username “ejejejdfbbebebe,” with the first relevant commit being recorded. Throughout the campaign's change to its C2 infrastructure, the poem, titled "On the Nature of Connection," has been modified several times. 

By using a dictionary embedded in its code, the malware extracts selected words from fixed sections of the poem and maps them to numerical values. Those values are combined to determine the IPv4 address of the active C2 server. If the attacker changes the selected words, infected systems will be able to determine the new address without requiring a new sample of malware. 

A campaign's effectiveness is not only determined by the initial compromise. Once PoeLLM gains access to a compromised server, it can use the compromised system to locate additional targets. Black Lotus Labs observed a significant amount of scanning activity involving ports 3000 and 4000, which are commonly used to access Gotenberg and LiteLLM deployments. In order for vulnerable systems to retrieve malware from the active C2 infrastructure, crafted HTTP requests were sent to them. LiteLLM was a significant target in this activity. 

The analyzed malware sample referenced CVE-2026-42271, a command injection vulnerability associated with /mcp-rest/test/connection. In addition to providing attackers with access to exposed artificial intelligence infrastructure, PoeLLM also features cryptocurrency mining capabilities. This allowed attackers to launch further attacks on compromised systems. 

Infection involves the deployment of XMRig and Iron miners as well as the connection of compromised systems to the Kryptex mining service. The attackers can benefit greatly from the use of AI infrastructure because many such environments are run on advanced hardware with GPUs capable of providing significant computing power for mining. 

The malware does not limit itself to mining. According to researchers, infected servers are able to perform additional malicious activities by using remote shell functionality, HTTP/S scanning, and exploit deployment. Recent activity against SSH ports and other login interfaces suggests that the operator may also be testing distributed brute-force attacks, though this capability is currently at an early stage. As a result of assessing the campaign with moderate confidence, Black Lotus Labs has determined that the attacker is an Italian-speaking individual. 

A combination of Italian-language comments found on malicious software and associated GitHub pages, as well as network traffic analysis, contributed to the assessment. There has been no identification of a specific individual or established criminal group. 

In this campaign, it illustrates the dual purpose of exposed artificial intelligence infrastructure for attackers: its computing resources can be monetized, while compromised machines are also able to assist in locating and compromising the next set of vulnerable systems. 

Recent attack by hackers motivated by financial gain has demonstrated how exposed AI and developer infrastructure can become valuable targets for attackers with financial motivations. As AI deployments expand across enterprises, strong patching, restricted internet exposure and proactive monitoring remain essential.
Read more »
Zoom Malware
CloudSyncD Malware Fake Zoom Installer Mac Security MacOS Backdoor MacOS Malware malware Malware Campaign Zoom Malware

CloudSyncD Backdoor Spread Through Fake Zoom Installer Targeting macOS

Using fake Zoom installers, a macOS malware campaign distributes a backdoor known as CloudSyncD, a backdoor for MacOS. 

Jamf Threat Labs first identified the malware during its development in mid-September, but later samples indicated it had moved to a live command-and-control infrastructure. It is initiated by the use of a disk image that is made to resemble the Zoom installer. When a package is opened, it appears as a volume titled Zoom and uses familiar installation elements to create the impression that the application is genuine. 

Using fake Zoom installers, a macOS malware campaign distributes a backdoor known as CloudSyncD, a backdoor for MacOS.

Jamf Threat Labs first identified the malware during its development in mid-September, but later samples indicated it had moved to a live command-and-control infrastructure. It is initiated by the use of a disk image that is made to resemble the Zoom installer. When a package is opened, it appears as a volume titled Zoom and uses familiar installation elements to create the impression that the application is genuine.

During installation, victims are presented with an authorization prompt designed to obtain their account password. The installer also relies on the user allowing the application to run despite macOS Gatekeeper protections. Before continuing with the infection process, CloudSyncD verifies the supplied credentials against the local account. Rather than immediately forwarding those credentials to its operators, the malware retains them on the compromised machine inside a disguised configuration file.

The stored password is deliberately made difficult to identify through an ordinary inspection of the file. CloudSyncD combines encoded information with invisible zero-width Unicode characters, effectively concealing the credential within otherwise inconspicuous data. The password subsequently becomes useful to the malware itself, allowing the next stage of the infection to run with greater privileges. The accompanying CloudSyncD component is delivered as a universal Mach-O binary, allowing it to operate across both Intel and Apple silicon systems.

For the next stage, the malware first tries to launch its payload without relying on a conventional file being written to the system. If macOS protections prevent this approach, CloudSyncD can fall back to placing the payload temporarily on disk. It can then make use of the previously obtained password with `sudo` to execute the component with elevated permissions.

Once running, the second-stage component operates primarily as a backdoor rather than as a conventional information-stealing program. Its purpose is to establish contact with attacker-controlled infrastructure and create a channel through which additional executables or compressed archives can be delivered. This gives the operators an opportunity to introduce further malware or tooling after access to the Mac has already been established.

By creating a working directory and maintaining encrypted activity logs, the malware avoids the need for a visible persistence mechanism. Check-ins occur every 8 to 16 seconds and include a hardware identifier, suggesting a periodic check-in is occurring. Compared to a simple command shell, the C2 channel provides the attackers with greater flexibility.

Using CloudSyncD, the compromised Mac can be supplied with compressed archives or executables, which can then be used to run the supplied content. Jamf Threat Labs identified multiple later builds of the backdoor communicating with two live domains following the initial infection. This enables the backdoor to serve as a delivery mechanism for additional malware or tools. They use the same URI structure, which was designed to resemble a request for a jQuery script.

Both domains were registered with the same registrar in 2011 and were protected by Cloudflare. As of the time of the researchers’ analysis, neither domain was flagged by a security service. A number of technical similarities were also observed between the different samples, including similar string-obfuscation schemes, installation paths, daemon names, and process disguise schemes.

More importantly, the builds shared the same C2 encryption key and initialization vector, which means network traffic captured from different versions could potentially be decrypted using recovered configuration material. According to the findings, CloudSyncD had moved from an unfinished test build to a functional backdoor utilizing social engineering, while maintaining a relatively simple infection route.

Researchers distinguish the malware from a conventional infostealer despite the fact that it collects system and user information for reconnaissance. Rather than being sent to the attackers, the captured password is used locally to obtain elevated privileges, while the backdoor's primary function is to provide access and facilitate the execution of additional payloads.

Read more »
malware
AccessibilityService API advanced protection Android android 17 API Browser Google Intrusion Logging feature malware

Google's Android 17 Locks Accessibility Services to Verified Apps as Malware Threat Branches Out




Google is tightening restrictions on one of mobile malware's most persistent entry points. With Android 17, the company is limiting access to its AccessibilityService API to verified Accessibility Tools only, a change that takes effect the moment a user switches on Advanced Protection.

The move, announced Thursday, targets a problem that has haunted Android security for years. The AccessibilityService API was built to help people with disabilities use their smartphones. Screen readers, voice control apps, and motor-assistance tools all rely on it. But the privileges it carries are significant. Apps that tap into the API can run in the background, observe what appears on screen, intercept UI events, and take actions inside other applications on a user's behalf. That set of capabilities made it a target for malware developers almost immediately after it was introduced.

Google stated in its announcement that the new version automatically restricts AccessibilityService access to verified Accessibility Tool applications, closing off a major attack avenue while keeping genuine assistive technology functional.


A Clichéd Attack Path

Malware families have been weaponizing Android's accessibility services since at least 2017. The list of known offenders runs long: Vultur, SharkBot, Xenomorph, BianLian, Anatsa (also tracked as TeaBot), and more recently BTMOB RAT, a remote access trojan documented attacking banking customers across Brazil, Argentina, Spain, Portugal, and Mexico through 2025 and 2026. According to Kaspersky data, trojans accounted for 40 percent of Android malware infections in Q1 2025, with nearly 12 percent of malicious apps falling into the banking trojan category that specifically abused the Accessibility API, totaling around 154,000 apps.

The attack chain is well understood. A malicious app, typically distributed through sideloaded APKs or disguised as something routine, tricks a user into granting accessibility permissions. The Anatsa trojan, for instance, slipped onto Google Play as a PDF viewer update as recently as July 2025. Once the permission is granted, the malware operates without root access. It can monitor keystrokes, layer fake login pages on top of legitimate banking apps, approve system dialogs silently, and initiate fraudulent fund transfers from financial applications without the user noticing anything unusual on screen. Google noted in its announcement that this access also allows malware to block its own uninstallation, locking users out of any easy remedy.


What Changes in Android 17

The new restriction applies specifically when Advanced Protection is active, a device-level security mode introduced with Android 16 that consolidates multiple hardening features under a single toggle. When a user enables it, the system now automatically enforces that only verified, legitimate accessibility apps can request AccessibilityService access. Everything else is denied.

This is part of a gradual tightening that has been underway for several years. Android 13 made it significantly harder for sideloaded apps to acquire accessibility permissions. In-call protections, rolled out more recently, prevent users from granting those permissions during a phone call, cutting off a common social engineering scenario. Google also introduced the `accessibilityDataSensitive` flag to let developers mark UI elements as off-limits to third-party accessibility readers.


The Rest of Android 17's Security Updates

The accessibility change is one piece of a wider hardening effort in Android 17. Intrusion Logging, developed in collaboration with Amnesty International's Security Lab and other civil society organizations, creates a persistent, privacy-preserving forensic record of sensitive system events. Amnesty's team simultaneously updated AndroidQF and its Mobile Verification Toolkit to process the new log format, making it immediately useful for researchers investigating suspected spyware infections.

USB Protection blocks new data connections over a USB port while the device is locked, preventing physical access attacks where an attacker might attempt to extract data or push commands through a connected cable. Google has also included an option to disable WebGPU, a graphics API that has surfaced in sophisticated browser-based exploit chains. Failed Authentication Lock responds to repeated incorrect login attempts by locking the device entirely, making brute-force attempts against a stolen or seized phone substantially harder.

A fifth addition, View Supporting Apps, gives users a clear window into which installed applications have checked whether Advanced Protection is active on the device.

For developers, Google confirmed that applications can receive a notification when a user enables Advanced Protection, allowing them to switch on their own high-security features automatically for that audience.

Existing Advanced Protection users will receive a notification when the new capabilities land on their device. Intrusion Logging is not switched on by default and must be enabled manually from the Advanced Protection settings page.


Read more »
WhatsApp Spam
API Token Exposure CloudFlare Data Theft Malicious Npm Packages malware WhatsApp Spam

101 Malicious npm Packages Secretly Enroll Developers into WhatsApp Spam Channels

 



Researchers at OX Security have flagged 101 npm packages that silently subscribe developers to WhatsApp spam channels the moment they are installed. The campaign abuses the open-source Baileys library, an unofficial implementation of the WhatsApp API that developers use to build customer support bots, chat managers, and automation tools, to carry out the subscriptions without any visible prompt or warning.

The packages have collectively been downloaded roughly 490,000 times, with 116,000 of those downloads occurring in the last 30 days. The single most downloaded package, `ourin-baileys`, accounts for 130,589 installs on its own, nearly a quarter of the campaign's total reach. As of publication, the majority of the 101 packages remain live on npm. Sixteen had been removed, and seven of those were pulled before researchers could review the code to determine which variant of the malware they carried.

The campaign did not begin in 2026. The oldest package in OX Security's list, `alipclutch-baileys`, was first published in October 2025. Several others date to December 2025, meaning this operation has been running quietly on the registry for close to a year before receiving a formal write-up.


Three Ways to Hide the Same Payload

OX Security researchers Nir Zadok, Moshe Siman Tov Bustan, and Vitalii Chepurko identified three distinct variants of the malware, each handling the subscription routine differently.

The first variant, found in 19 packages, fetches channel IDs from GitHub at runtime. By hosting the target list externally, operators can swap out which accounts receive new followers without ever publishing a new package version to npm. One package, `@rixxcodex/baileys`, hides the GitHub URL inside media-download code using Base64 encoding so it is unlikely to catch the eye of anyone skimming the source.

The second variant, covering 60 packages, simply embeds the channel IDs in cleartext inside the source code. Two packages took additional steps to bury this, placing the subscription logic inside an upstream connection handler and inside a file named after the Signal cryptographic protocol, a location most developers would never think to inspect.

The third variant, found in 14 packages, encodes the hardcoded channel IDs using Base64. One package in this group, `neuralwhatsapp`, takes a slightly different approach: rather than storing a channel ID directly, it resolves its target from a hardcoded WhatsApp invite code at runtime.


The Follower Inflation Business

The goal is not data theft or ransomware deployment. The channels identified in this campaign are mostly small bot-seller and marketplace accounts, largely Indonesian, where follower counts function as social proof for selling bot scripts, premium APKs, social media boosting services, and in-game resources.

Among the specific channels researchers identified: Neural has 798 followers and markets game-currency sales through a platform called JualanRSS, which deals in in-game resources including food, ore, stone, timber, and gold. MONTE-BMG has 1,000 followers. CORTANA TECH has 1,300 and points visitors to a dedicated website. Fyxzpedia.ID-Utama, with 4,800 followers, sells WhatsApp and Telegram bot scripts and bot-building services outright. One Spanish-language channel called Redes Oficiales sits at 19,000 followers and is linked to a YouTube creator, pushing back against the assumption that this is a purely Indonesian operation.

The threat actors mute these channels on the victim's device after subscribing them, so the added follower count appears organic to outside observers. A channel with thousands of followers reads as trustworthy, and that manufactured trust is the product being sold to the operators running these marketplaces.

One channel, MONTE-BMG, illustrates how the monetisation funnel actually works. It posts what appears to be a screenshotted sales negotiation in Arabic, ending with a group invite link. That link leads to a brand-new channel with only 12 followers, whose own description contains yet another group invite. The inflated parent channel is only the entry point. The actual transaction gets moved progressively deeper into a private chain of groups where there is no public record.

Beyond follower inflation, the SafeDep research team noted earlier this year that some Baileys forks in this campaign also inject the package author's advertising URL into every image and video the bot sends, a second payload the follower-count headline tends to obscure.


One Coordinated Operation, Many Names

OX Security found that 32 channels are followed by more than one package across this campaign. The single most reused channel, identified by the ID `120363400911374213@newsletter`, is targeted by ten separate packages. One remote channel list hosted on GitHub feeds five different packages simultaneously, meaning the operator can retarget all five installations by editing a single file.

Operators routinely publish near-identical packages under slightly different names to preserve the campaign when individual listings get removed. `noxleyss` and `@noxleyss/baileys`, for example, carry the same code under different publisher accounts.

Details of the abuse first emerged in August 2026 when SafeDep identified Baileys npm forks making installers' WhatsApp accounts follow attacker-controlled channels. Earlier this month, the Xygeni Security Research Team separately detailed another Baileys modification, `@dappaoffc/baileys-mod`, which subscribed developers' authenticated WhatsApp bot sessions to attacker-controlled newsletter channels.

The campaign follows a pattern OX Security has tracked on npm before. An earlier operation used the same registry to host fake Cloudflare CAPTCHA pages designed to redirect visitors to ClickFix phishing infrastructure. The registry's scale and the institutional trust developers place in what appear to be legitimate forks of known libraries make it a dependable distribution channel for this kind of abuse.

Because the packages carry none of the classic malware signatures, no API token theft, no heavy obfuscation across the board, no destructive payload, standard threat detection tools are likely to miss them entirely. That is precisely why most of these packages have remained live for months.


What Developers Should Do

Security recommends checking whether your WhatsApp account has been added to unknown channels and blocking or reporting any that appear. Developers should avoid any npm package that requires connecting a personal WhatsApp account and should add detection rules to their pipelines flagging known malicious Baileys forks. Remote channel-list URLs identified in these packages can be added to URL-reputation and threat-intelligence pipelines for ongoing monitoring.


Read more »
Threat Intelligence
Cybersecurity DLL Sideloading malware NeedyMantis Malware Targeted Cyber Attacks Threat Intelligence

NeedyMantis Malware Expands the Post-Compromise Threat Landscape


A modular malware family dubbed NeedyMantis has been identified by Microsoft Threat Intelligence, and has been employed to maintain access to compromised systems in a limited number of targeted intrusions. 


Evidence of the malware dating back to at least October 2025 indicates that it has affected telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors. During an investigation into indicators associated with the DAEMON Tools supply chain compromise, Microsoft identified NeedyMantis. 

The company tracks activity associated with Storm-3069, and has observed the malware in use beyond that campaign. While Microsoft believes the observed operations are associated with activities associated with China-based threat actors, it has not attributed Storm-3069 to a Chinese nation state actor or confirmed that all NeedyMantis activity originated from a single operator. 

As a general rule, NeedyMantis is deployed after attackers have already gained access to the target environment. The malware serves primarily as an initial access tool, but it is also intended to maintain access and facilitate further activity within the compromised network, utilizing DLL sideloading as part of its delivery chain. It has been observed that attackers packaged malicious DLLs with legitimate applications and encrypted archives in an attempt to facilitate their delivery. 

Poedit, curl, Vim, and TightVNC were among the programs abused in this manner, while malicious DLLs were disguised as Microsoft Office, Broadcom, Intel, and NVIDIA components. One incident involved the use of Impacket toolkit to copy a legitimate software package from a network share into the malicious file, which was then executed on the targeted computer. It is important to note that NeedyMantis played a crucial role in the post-compromise phase of an intrusion, despite the attacker already having established access to the environment. 

Once the initial DLL is loaded, the malware continues to feature layered security. A second-stage component is extracted from the encrypted archive by the first-stage loader, which is the file used in the analysis, encryptbase64.ps1. Even though the file has a PowerShell extension, it contains x64 shellcode rather than a conventional PowerShell script. 

Once the embedded malware has been decoded and decompressed, a custom executable format based on a reduced version of the Windows PE format is loaded. An additional level of protection can be provided by the custom archive. Its contents can vary between samples, with file names and internal values varying. 

The analyzed WinSparkle archive contained legitimate components of 7-Zip and Sysinternals as well as files with familiar Windows library names, including dnsapi.dll and ws2_32.dll, mixed with legitimate components. Instead of the legitimate libraries represented by these files, NeedyMantis configuration and communication components were found in these files. The main component communicates with the malware's command-and-control infrastructure and manages additional modules. 

It is Microsoft's responsibility to observe an initial HTTPS request before switching the connection to a binary WebSocket protocol. The communications component utilizes WebSockets. A hard-coded user agent for Firefox 21.0 has also been used by the malware in one implementation. Through the C2 channel, operators can add and remove modules and exchange data with them, though Microsoft has not confirmed the specific functionality of the modules. 

A NeedyMantis sample collected in October of 2025 contained a persistence module based on Windows services, however the persistence method employed by the newer analyzed sample has not been identified. The malware is more challenging to analyze through a single file or indicator due to its staged loading, misleading file names, encrypted archives, and modular C2 communication. 

Detection points have been provided by Microsoft for hashes, file paths, the C2 hostname corp.tripswithengine[.]com, and the Firefox/21.0 user agent. As a result of the NeedyMantis campaign, security teams need to monitor suspicious loaders, C2 traffic, and unusual usage of legitimate software in order to recognize the risks posed by modular post-compromise malware.
Read more »
Windows Backdoor
Clipboard Stealing Command And Control Data Theft malware PowerShell Malware Securonix TASK#STOMP Wi-Fi Password Theft Windows Backdoor

STOMP Backdoor Uses PowerShell for Sensitive Data Theft


An advanced malware campaign known as TASK#STOMP has recently been discovered, which utilizes a PowerShell-based backdoor to collect business documents, Wi-Fi passwords, clipboard data, and screenshots from compromised computers using a PowerShell backdoor. Moreover, the malware also provides attackers with remote command execution and maintains multiple channels for further access. VBScript files are executed via the legitimate Windows Script Host utility wscript.exe in order to initiate the infection. 


In spite of the fact that the exact method of delivery has not been confirmed, phishing or social engineering could be considered possible methods of delivering the script. Following the script's delivery, it sets up a set of scheduled tasks resembling legitimate Windows components, establishing persistence. 

By naming these tasks Local Credential Manager, Network Audio Service, Windows Display Manager, and Device Credential Handler, malicious activities can be blended seamlessly with normal system activities. Another persistence mechanism places another VBScript file in the Windows Startup folder, enabling it to run when the user logs in. 

Upon launching the malware, it executes two PowerShell components. Among these are sys_loader.ps1, which collects documents, gathers system information, steals Wi-Fi passwords, monitors clipboards, captures screenshots, and executes remote commands. Another persistent command-and-control channel, win_conn.ps1, provides additional collection capability as well as a persistent command-and-control channel. 

By monitoring each other and restarting the other process if one is disabled, this setup provides redundancy, making it more difficult to remove the malware if only one process is terminated or a single persistence entry is deleted. In addition to hiding execution activities, timestamp manipulations, and cleanup activities, Task#STOMP can also be used for continuous document theft, increasing the difficulty of detection and forensic investigation. 

As opposed to collecting only files that are already present on an infected computer, TASK#STOMP monitors the file system for newly created or modified documents. This enables the collection of business files as they appear and change during an active infection. In addition to obtaining Wi-Fi credentials and clipboard contents, the malware targets saved Wi-Fi credentials as well. 

With clipboard monitoring, operators can identify information temporarily copied by users, while screenshot capture allows them to view information displayed on a compromised system. By combining these capabilities with remote command execution, Task#STOMP is able to gather more information about user activity than a conventional file-stealing malware. 

A separate command-and-control path, Win_conn.ps1, is maintained by TASK#STOMP in addition to data collection. From win_conn_cfg.dat, the component decodes its configuration and connects to attacker-controlled infrastructure at corecloudfileshare[.]xyz and attachmentsharingdrive[.]xyz. Researcher identification of related traffic can be improved by using a hardcoded authentication token for communication. 

Parts of network communication are handled by a compiled C# component. During connection times, connections can proceed when certificates are invalid, self-signed, or otherwise mismatched due to the code disabling TLS certificate validation. This reduces the level of protection usually provided by certificate checks and makes it easier for the malware to communicate with its servers. Additionally, TASK#STOMP alters file timestamps and cleans up activity following execution to provide further anti-forensic measures. 

According to the researchers, several files have been backdated to January 15, 2024, but that date is not conclusive of when the campaign began. This date was deliberately inserted by the malware, and therefore cannot be regarded as evidence of the age of the campaign. Securonix has not determined why the malware opens a page associated with irantenders[.]com in Chrome, but the page relates to government contracts and tenders in Iran. 

Securonix has not established whether the site indicates a specific victim profile or why it is opened. Researchers have cautioned that the domain alone may not be sufficient to confirm the campaign's geographical or sectoral targeting. Securonix has not linked TASK#STOMP to a known threat group. Due to the use of a single compromised system, it is unclear how the overall campaign scope and duration were determined. 

The initial delivery method is also unclear, although similar VBScript campaigns suggest phishing involving archive or disk image attachments as a possible route. To detect an infection, researchers recommend examining suspicious Windows Script Host and PowerShell activity that originates from writable locations, newly created scheduled tasks, and instances where PowerShell invokes the C# compiler from .NET C#. 

A suspected infection can be investigated with additional evidence from PowerShell Script Block Logging, AMSI telemetry, and scheduled task records.
Read more »
WeaselBiscuit Stealer
BeaverTail malware Chrome Extension Security Contagious Interview DPRK Cyber Threats JavaScript Stealer Malicious Npm Packages malware Software Supply Chain Security WeaselBiscuit Stealer

WeaselBiscuit Stealer Found in 13 Malicious npm Packages


Researchers have discovered 13 npm packages carrying a previously undocumented JavaScript information stealer called WeaselBiscuit, introducing yet another malicious threat to the npm package ecosystem. In addition to linking the packages together via shared indicators, OpenSourceMalware found several similarities between BeaverTail and OtterCookie, two North Korean malware families. 


A number of packages are included, including @biz44/id10-client, @biz44/id12-client, @biz44/id44-client, @biz44/id79-client, @biz44/id95-client, @biz44/id99-client, @biz44/process-runtime-utils, @biz44/runtime-utils, @biz44/engin1, id79-client, process-lhpm, process-mite, and process-tailwind. Many were first observed between September 12 and September 16, 2026, with some versions still available on NPM at the time of analysis. 

In comparison to BeaverTail and OtterCookie, WeaselBiscuit appears much smaller. In addition to remote access and cryptocurrency theft functions, the malware focuses on profiling hosts and collecting data collected by Chrome extensions rather than carrying a broad range of remote access functions. Malware loaders are launched when a compromised package is imported, causing detached Node.js processes to begin execution.

After retrieving an encoded payload from an Npoint URL, the loader executes the decoded code directly in memory. Following execution, the malware obtains its command-and-control configuration from another Npoint endpoint before connecting to 103.170.217.184:8787. Among the data collected are hostnames, usernames, operating systems, CPUs, and memory, as well as local and public IP addresses. 

Chrome profiles are also searched for extension storage on Windows, Mac OS, and Linux platforms. Chrome's Local Extension Settings directory may contain information associated with browser extensions, including cryptocurrency wallet extensions, which makes this collection especially significant. 

Instead of relying on a specific list of wallet extensions, OpenSourceMalware reported the stealer uploads readable, non-empty files from these locations. C2 servers can also provide commands for monitoring the clipboard and logging Windows keystrokes. 

Despite these capabilities, the recovered malware does not include direct wallet draining functionality, browser password decryption, seed phrase searching, screenshots, or a remote shell access. Additionally, some BeaverTail and OtterCookie activities have a Python-based InvisibleFerret stage that is not present in any other activity. 

Possible Links to DPRK Malware

WeaselBiscuit has been compared to malware associated with the DPRK-linked Contagious Interview campaign, but the attribution has yet to be confirmed. OpenSourceMalware did not find conclusive evidence that the attack was originated by North Korea based on operational infrastructure, victimology, campaign metadata or other identifying materials. 

WeaselBiscuit employs the dead-drop technique of Npoint.io as a dead-drop service, a technique previously observed in Contagious Interview campaigns. Some of its technical indicators, however, overlap with earlier campaigns. Additionally, its code performs public IP and geolocation checks using IPify.org and IP-API.com, while parts of its command-and-control design are similar to OtterCookie's. 

Among the numeric identifiers found in the malware are 10, 12, 44, 79, 95, and 99. These identifiers are similar to campaign markers associated with PolinRider activity, however their exact purpose in WeaselBiscuit is unclear. In terms of capability, BeaverTail and OtterCookie are more closely related. 

Several features are retained in WhistlerBiscuit, including system profiling, Chrome extension data collection, clipboard monitoring, and keylogging, all of which are common to those malware families. However, several of their heavier features are removed, including remote access functions, wallet draining capabilities, screenshots, and secondary payload delivery. 

Researchers at Cisco Talos observed a similar overlap in October 2025, when they discovered that the node-nvm-ssh package contained characteristics related to both BeaverTail and OtterCookie. The findings suggest that code and techniques from these malware families have been found in a variety of combinations within npm-based malicious code. 

The WeaselBiscuit stealer should be viewed for the time being as a distinctive lightweight stealer with distinct technical similarities to DPRK-related tooling rather than a new DPRK malware family confirmed by the DPRK. For a more conclusive attribution, further evidence from infrastructure, campaigns, or code levels would be required.

With the discovery of WeaselBiscuit, security risks are highlighted within the npm ecosystem, particularly for developers utilizing third-party packages. In addition to the ability to collect Chrome extension data and similarity to BeaverTail and OtterCookie, it warrants continued investigation as researchers investigate its origins and wider activities.
Read more »
WordPress Security
Brevo Cyber Attack Brevo Supply Chain Attack ClickFix Malware Cloudflare API Key Cyber Attacks malware Supply Chain Security Website Malware WordPress Backdoor WordPress Security

Brevo Breach Exposes Customer Websites to ClickFix Malware


Email marketing and customer relationship management platform Brevo, formerly known as Sendinblue, suffered a supply chain attack in which malicious code was able to reach Brevo's own websites as well as customers' websites utilizing embedded Brevo services. 

Researchers at Sansec discovered that the incident was much more extensive than the six accounts previously revealed. When Brevo infrastructure was compromised on September 14, 2026, malicious JavaScript began to be served. In addition, Sansec found evidence that more than 100,000 customer websites utilizing Brevo components may have been exposed as a result of the attack. 

There were two main infection paths used in the campaign: a malicious WordPress plugin that targeted site administrators and a ClickFix overlay that was displayed to visitors. 

Malicious Code Reached Embedded Brevo Components

Brevo-hosted pages as well as JavaScript resources commonly embedded in customer websites were identified as containing the injected code. These included Brevo trackers, Conversations chat widgets, as well as other forms hosted on Brevo servers. 

Modified versions of the JavaScript assets directed browsers to infrastructure controlled by attackers, which served the malicious malware loader. Sansec identified several malicious subdomains under the Brevo domain sendibt1.com. A number of hostnames were affected, including cdn.sendibt1.com, cdn2.sendibt1.com, cdn3.sendibt1.com, cdn4.sendibt1.com, cdn9.sendibt1.com, cdn10.sendibt1.com, and cdn11.sendibt1.com. 

A SSL certificate for cdn.sendibt1.com was also discovered on August 25, which indicates that the attackers had gained access to Brevo's DNS records. A malicious content display was observed on September 14 from approximately 16:05 until 20:13 UTC, which was observed by researchers. 

A total of 2,549 breaches of Content Security Policy were reported across 12 sites during and after the attack window. These hosts stopped resolving on September 15, while the affected files were reported clean at the site of origin. 

ClickFix Campaign Targeted Website Visitors

Injected malware delivered different payloads depending on the visitor. When a visitor was detected as a WordPress administrator, it attempted to install a plugin from a Brevo subdomain controlled by the attacker. A fake verification prompt was displayed using the ClickFix technique to visitors, instructing them to copy a command and execute it under the pretext of demonstrating their humanity. According to Sansec, the malware did not activate for crawlers, developers, or automated scanners, therefore preventing it from being detected during routine inspections. 

WordPress Sites Faced a Deeper Threat 

A more significant risk was posed to WordPress administrators by the attack. When the compromised Brevo script identified an administrator already logged into a WordPress site, it attempted to download and install plugins from attacker-controlled infrastructure. 

BleepingComputer examined a copy of the plugin, which was disguised as Web Media Optimizer, but was actually a JavaScript loader and persistent backdoor. Installing this plugin allowed it to hide from the normal WordPress plugin list and copy itself into the must-use plugins directory, making its removal more difficult. Additionally, the plugin contacted attacker-controlled infrastructure to obtain additional JavaScript, allowing malicious content to continue loading even if the remote server was unavailable, as researchers discovered. 

A critical feature of the plugin was that it contained a hardcoded authentication mechanism capable of creating a valid administrator session without requiring the legitimate administrator password. This allowed attackers to continue access to a compromised WordPress installation beyond Brevo's original exposure period. 

Brevo Took Down the Malicious Infrastructure

After detecting the intrusion, Brevo removed the malicious Cloudflare Worker and associated routes. As a result of the compromise, Brevo revoked its API key and credentials, removed attacker-controlled hostnames and purified edge caches. Additionally, the hardcoded Cloudflare credential was removed from the source code of the company. 

Sansec reports that malicious hosts began to cease resolving on September 15 and Brevo's affected files were restored to their original versions. Although the delivery window ended, the malware was not removed from WordPress sites where the rogue plugin had already been installed. Additionally, Brevo SSO security incident reported on September 10 also occurred following the incident. It was reported that six customer accounts were accessed unauthorised and were used for phishing, as well as contact data exported from 43 other accounts in that incident. 

A public connection has not been established between Brevo's earlier incident and Cloudflare's subsequent compromise. The Brevo incident illustrates the threat of third-party services that extend beyond the infrastructure of the provider and affect websites which utilize embedded scripts. Additionally, the combination of ClickFix lures and persistent WordPress backdoors creates a higher risk for website administrators and visitors alike.
Read more »
Russia-Ukraine War
Gorilla RAT Hacking Cat malware Monkey Ransomware Russia-Ukraine War

Pro-Ukraine Hacking Cat Group Deploys New Malware Against Russian Targets

 

A pro-Ukraine hacktivist group known as Hacking Cat has significantly escalated its cyber operations against Russian targets by deploying newly developed malware, marking a strategic shift from simple website defacements to sophisticated data destruction campaigns. Researchers at Kaspersky uncovered two previously undocumented malware families—Gorilla RAT and Monkey Ransomware—being used in coordinated attacks that exploit server vulnerabilities and encrypt critical files across compromised networks. This evolution demonstrates how hacktivist groups are becoming increasingly capable of mounting technically advanced and sustained campaigns in the ongoing cyberwar between Ukraine and Russia. 

Hacking Cat first emerged around February 2024, initially focusing on low-impact operations such as defacing Russian websites and leaking stolen documents to embarrass adversaries and spread pro-Ukraine messaging. However, by summer 2025, the group began executing more destructive campaigns designed to encrypt and permanently destroy data on targeted systems rather than merely exposing information. This tactical evolution reflects a broader trend among Ukraine-aligned hacktivists, who are increasingly collaborating and sharing custom-built tools to maximize disruption against Russian infrastructure, state-linked organizations, and entities supporting Moscow's war efforts. 

The newly identified Gorilla RAT serves as a remote-access trojan that can tunnel network traffic, enabling attackers to move laterally within victim networks after exploiting vulnerabilities in Microsoft Exchange servers. Monkey Ransomware, which appends a ".monkey" extension to encrypted files, has appeared in multiple variants written in different programming languages since its debut in late 2025. Kaspersky researchers noted that the unusually rapid iteration of the ransomware could suggest the use of generative AI tools to accelerate malware development, though the hackers may also be experimenting with different coding approaches to evade detection and improve effectiveness against diverse targets. 

Joint operations and shared toolkits

Hacking Cat frequently coordinates with other pro-Ukraine groups, including the Cyber Anarchy Squad and the Ukrainian Cyber Alliance, to execute high-impact attacks that cause maximum disruption. In March 2026, the group claimed responsibility for breaching a contractor working for Rosatom, Russia's state nuclear energy corporation, demonstrating its ability to penetrate sensitive industrial networks. Later, in June, it participated in a destructive operation against Donbassteploenergo, a heating provider in Russian-occupied Donetsk, using Nemo Wiper—a tool designed specifically to erase data and disrupt critical infrastructure rather than collect ransom payments from victims. 

The sharing of malware among hacktivist collectives has complicated efforts to attribute specific attacks to individual groups, as multiple organizations now use identical multi-stage infection chains and custom-developed tools. Kaspersky's report linked several tools to Hacking Cat, but the group pushed back in a Telegram statement, acknowledging ownership of "a couple of the tools" while denying responsibility for the ransomware variants. Hacking Cat accused the cybersecurity firm of incorrectly associating unrelated malware with its operations and criticized the quality of its reverse-engineering analysis, highlighting the challenges researchers face in tracking decentralized hacktivist ecosystems. 

Despite these attribution disputes, the overlap in toolkits underscores a maturing cyberwar ecosystem in which Ukraine-aligned hackers are pooling resources, expertise, and custom malware to sustain pressure on Russian targets. The deployment of AI-assisted development tools, coordinated joint operations, and increasingly destructive capabilities signal that hacktivist groups are no longer peripheral actors but integral components of Ukraine's broader resistance strategy. As the conflict continues, cybersecurity experts warn that similar collaborations could emerge elsewhere, reshaping how non-state actors participate in modern warfare through digital means.
Read more »
Ransomware Gang
Conti Ransomware CyberCrime Data Theft malware Ransomware Attack Ransomware Developer Ransomware Gang

Conti Ransomware Ties Lead to Four-Year Prison Sentence


Ukrainian nationals have been sentenced to four years in U.S. prison for participating in the Conti ransomware operation. Between 2020 and 2022, the company was carrying out attacks against organizations throughout the United States and other countries. 

In addition to serving as a hacker and developer, Oleksii Oleksiyovych Lytvynenko, 44, was also an integral part of the operation. According to prosecutors, he personally targeted at least 12 companies, handled stolen information obtained from victims, and helped develop tools used during Conti's ransomware attacks. 

Lytvynenko pleaded guilty in June 2026 to conspiracy to commit wire fraud. She was responsible for controlling the theft of data from eight U.S. victims and four foreign victims. A ransom demand was also sent by him during Conti's double-extortion attacks, during which stolen information was used in conjunction with file encryption to pressure victims into paying.

According to the investigation, Lytvynenko also played a role in creating the malware loader for the group. This tool allows attackers to launch or load other malicious software onto compromised systems, providing attackers with another means of executing ransomware operations. 

Conti's Global Ransomware Campaign

In the course of its operation, Conti attacked companies across 47 U.S. states, Washington, D.C., Puerto Rico, and 31 other countries, making it one of the most active ransomware operations of its time. As reported by the FBI, ransom payments associated with Conti exceeded $150 million by January 2022. 

The group targeted hospitals, government agencies, and business entities among its target groups. According to its operations, Lytvynenko stole sensitive information and encrypted systems before demanding cryptocurrency payments from victims. Following a U.S. request, Lytvynenko was arrested in July 2023 at his Cork, Ireland, residence. 

After contesting extradition, he was ultimately transferred to the United States and held in Irish custody for a short period of time. The court's decision adds to the law enforcement response against the Conti ransomware network, which successfully shut down in 2022 in response to mounting pressure and the release of its internal communications. 

Evidence Linked Lytvynenko to Continued Ransomware Activity

It was discovered that Lytvynenko's online accounts contained much more than stolen victim information. Prosecutors alleged that the accounts contained Conti malware and ransom notes, as well as material relating to malware and hacking. As evidenced by his accounts, he searched for potential targets, indicating a deeper involvement than the development side of the operation. Court records also indicated his involvement in cryptocurrency transactions.

A transfer of about $25,042 worth of Bitcoin, involving 0.4 bitcoin, was traced to a victim associated with Lytvynenko's Conti activities. The court imposed a forfeiture of the same amount. Evidence recovered from Lytvynenko's computer after the arrest in 2023 also raised concerns regarding his continued involvement in cybercriminalism.

Investigators discovered Cobalt Strike running on the device and a Rocket.Chat session connected through Tor. Prosecutors said the forensic evidence indicated that Lytvynenko continued to participate in ransomware attacks after Conti ceased to operate. 

Conti's Collapse Did Not End Its Criminal Network

Following the release of internal chats and source code, Conti disbanded in 2022, which revealed details regarding the ransomware group and its members. As a result of the group's public support of Russia after the invasion of Ukraine, investigators were able to gain additional insight into its structure and activities by investigating the leak. 

While the shutdown was initiated, prosecutions did not immediately cease. Four additional Conti members were charged in separate indictments in 2023, and in 2024 Ukrainian authorities arrested another suspected Conti member in Kyiv. Lytvynenko's case contributes to the ongoing legal action against those involved in the ransomware operation by adding another conviction.
Read more »
Websites
Cloud Domain Internet malware Scams Websites

Attackers Use Expired Websites for Malware Scams


Dead websites may seem harmless once they are abandoned by their owners, but their old internet reputation can make them important tools for threat actors. A new research by Infoblox Threat Intel has revealed that threat actors are spending millions of dollars buying expired domain names and misusing them for online gambling, malware, scams, and illegal streaming.

Infoblox discovered that around 65,000 earlier previously registered domains are re-registered everyday, showing around one in five newly found domains,

What makes dead domains valuable

When a domain is dead, the history does not vanish immediately. The domain may still consist of traffic, backlinks, search-engine visibility, and an image built when it was in legitimate use previously.

Attackers can buy these domains and exploit the existing digital footprint. This can make a malicious infrastructure less dangerous than an entirely new domain. 

The tactic is usually called “dropcatchin”. Instead of making new sites from scratch, threat actors buy domains that have already created some level of visibility and trust.

Sable Squirrel behind the campaign

One of the largest campaigns detected by Infoblox is an attacker called Sable Squirrel. According to experts, the group has control over 10,000 domains and believe that it has invested over $7 million buying expired domains. 

“This actor has spent years turning other people’s domain history into its own criminal infrastructure, then using that infrastructure to run illegal sports streaming, online gambling promotion, and malware command-and-control (C2) side by side,” Infoblox said. 

Majority of the domains support a large gambling operation and sports streaming aimed mostly at Asian users, But experts found that some of the same infrastructure was utilised for command and control (C2) operations. 

Infoblox found over 31000 malware samples interacting with Sable Squirrel infrastructure such as njRAT, Remcos, NanoCore, DCRat, AsnycRAT, and Quasar RAT additionally with samples linked to HiddenTear ransomware. Experts confirmed 405 domains being exploited as malware command-and-control infrastructure. 

A larger cybercrime picture

Sable Squirrel was not the only group using dead domains, Infoblox also detected groups such as Swiping Squirrel, Shady Squirrel and Stuffy Squirrel. Some groups buy domains previously associated with malicious activity and exploit the existing traffic to redirect targets towards malware, advertising fraud, or scams.

Sable Squirrel’s main business is gambling, but it masks it as a streaming operation, while also doubling as an acquisition channel for the same.

“In Sable Squirrel’s hands, the domain becomes more than an address. It is the unit of trust, the traffic source, the brand surface, the routing layer, and, in some cases, the control channel,” said Infoblox.

Read more »
User Privacy
Android Trojan Data Theft malware MantaxOtax User Privacy

MantaxOtax Android Malware Merges Ransomware and Spyware in New Indonesian Campaign

 

MantaxOtax is a newly identified Android malware that merges ransomware-style file encryption with aggressive spyware capabilities, enabling attackers to both lock users out of their devices and harvest sensitive personal data. Discovered by Zimperium's zLabs team and detailed in a September 9 technical write-up, the threat appears linked to Indonesian actors and spreads primarily via sideloaded APKs hosted on third-party file-sharing platforms. This dual-function design marks a significant escalation in mobile threats, combining financial extortion with deep surveillance to maximize victim impact. 

Once installed, MantaxOtax requests device administrator privileges, followed by permissions for SMS, contacts, audio, images, and Android Accessibility services, which grant it deep control over user interactions. It dynamically resolves its command-and-control (C2) domain from a GitHub repository, allowing operators to shift infrastructure without modifying the malware code. 

On Android 9 and earlier, it recursively scans external storage, encrypts files using AES with unique per-device keys fetched from C2, deletes originals, and leaves behind .enc files; on Android 10+, Scoped Storage limits encryption to the app's own directory. The malware also overwrites victims' images with ransom notes and opens a Firebase-based chat interface for extortion negotiations, which researchers found partially exposed due to a server misconfiguration. 

Beyond encryption, MantaxOtax operates as a full-featured spyware, collecting app inventories, hardware specs, location, browser history, notifications, contacts, call logs, and SMS—including one-time passwords (OTPs). It exfiltrates gallery content, linked Google accounts, WhatsApp profiles and messages (via Accessibility), and Telegram credentials and chat histories. By abusing Android's MediaProjection API, it captures screenshots, records MP4 screen videos, and streams near-real-time footage to attackers, storing media on the Catbox file host. It can also silently activate front or rear cameras to take photos without user knowledge, turning infected devices into always-on surveillance tools. 

Researchers observed multiple variants employing psychological pressure tactics: persistent screen locks, application blocking, and transparent overlays that hijack all touch input. Some versions bombard victims with repeating alert dialogs, full-screen video overlays, and image popups appearing every 600 milliseconds, while others use text-to-speech to audibly deliver attacker messages. A second iteration adopted WebSocket communications for more resilient C2 channels and added features like continuous screen locking and app blacklisting, making remediation harder for average users. These harassment techniques are designed to overwhelm victims into compliance, increasing the likelihood of ransom payment or credential surrender. 

Evidence including language markers and recovered victim files suggests MantaxOtax primarily targets Indonesian users. The misconfigured server also leaked what appears to be the operators' control panel, offering rare insight into their infrastructure. This campaign follows closely after the discovery of THost9, another Android trojan that clones banking apps into isolated work profiles to evade detection. Together, these threats underscore a growing trend of multi-stage mobile malware combining financial fraud, surveillance, and ransomware—highlighting the critical need for users to avoid sideloading apps, keep devices updated with the latest security patches, and use reputable mobile security solutions to detect and block such sophisticated threats before they cause harm.
Read more »
Sophos
F5 BIG-IP APM Linux Linux RootKit malware PHP Web Shell Sophos

F5 BIG-IP APM Malware Installs a PHP Web Shell Into Memory, Escaping Disk Scans


Sophos X-Ops has found an advanced Linux rootkit that can conceal a PHP web shell completely in server memory, which makes it harder for traditional security tools to detect. 

The malware was analyzed in infected environments consisting of F5 BIG-IP Access Policy Manager (APM) and was discovered by Sophos as Linux/Agnt-IC. “The malware targets deployments featuring Apache, libphp, APR module loading, BIG-IP APM webtop components, and BIG-IP upgrade workflows, suggesting it was developed for specific environments,” Sophos reported.

About the research

The research was posted on September 7, 2026, and shows how the rootkit interferes with the PHP runtime and Apache web server to deploy malicious code without making major modifications to authentic PHP files stored on the device.

A Web Shell That Does Not Remain on Disk

One significant feature of the malware is that it can install malicious PHP code directly into the running web server’s memory.

Generally, threat actors planting a PHP web shell would also modify or make a PHP file on the server. Security teams can then detect the malicious file via antivirus scans, manual investigation, or file-integrity monitoring.

The rootkit detailed by Sophos takes another approach. It changes how PHP files are shown to the running Apache process while the original files on disk are left unchanged.

This means that a file scan could demonstrate that a PHP is authentic even when the server is actively running malicious code.

Rootkit Hooks PHP and Apache

Researchers at Sophos discovered that the implant deploys various sophisticated approaches to take command over the web server. It integrates into the device’s startup process and surveys Apache activity to find out when the PHP module is loaded. 

After this, the malware can bring its own web-shell functionality and change the in-memory PHP environment. 

The installed web shell gets specially tailored HTTP requests and runs commands given by the threat actor. Sophos also found the implant deploying a Unix domain to socket to offer another path of communicating with an infected system and launching a shell. 

This combination allows attackers several ways of maintaining access while covering the traces left on the filesystem.

Hard to detect

The attack has become a problem for experts as the malware does not always have to alter files to attack a server. Security teams should check beyond traditional file-integrity check and analyze memory activity, network traffic and running processes.

Sophos recommends that security teams look beyond conventional file-integrity checks and examine network traffic, running processes and memory activity.

Read more »
Subscribe to: Posts (Atom)