2025-12-17 AI创业新闻

Compromised IAM Credentials Power a Large AWS Crypto Mining Campaign

An ongoing campaign has been observed targeting Amazon Web Services (AWS) customers using compromised Identity and Access Management ( IAM ) credentials to enable cryptocurrency mining. The activity, first detected by Amazon’s GuardDuty managed threat detection service and its automated security monitoring systems on November 2, 2025, employs never-before-seen persistence techniques to hamper incident response and continue unimpeded, according to a new report shared by the tech giant ahead of publication. “Operating from an external hosting provider, the threat actor quickly enumerated resources and permissions before deploying crypto mining resources across ECS and EC2,” Amazon said . “Within 10 minutes of the threat actor gaining initial access, crypto miners were operational.” The multi-stage attack chain essentially begins with the unknown adversary leveraging compromised IAM user credentials with admin-like privileges to initiate a discovery phase designed to probe the environment for EC2 service quotas and test their permissions by invoking the RunInstances API with the “DryRun” flag set.

This enabling of the “DryRun” flag is crucial and intentional as it enables the attackers to validate their IAM permissions without actually launching instances, thereby avoiding racking up costs and minimizing their forensic trail. The end goal of the step is to determine if the target infrastructure is suitable for deploying the miner program. The infection proceeds to the next stage when the threat actor calls CreateServiceLinkedRole and CreateRole to create IAM roles for autoscaling groups and AWS Lambda, respectively. Once the roles are created, the “ AWSLambdaBasicExecutionRole “ policy is attached to the Lambda role.

In the activity observed to date, the threat actor is said to have created dozens of ECS clusters across the environment, in some cases exceeding 50 ECS clusters in a single attack. “They then called RegisterTaskDefinition with a malicious DockerHub image yenik65958/secret:user,” Amazon said. “With the same string used for the cluster creation, the actor then created a service, using the task definition to initiate crypto mining on ECS Fargate nodes.” The DockerHub image, which has since been taken down, is configured to run a shell script as soon as it’s deployed to launch cryptocurrency mining using the RandomVIREL mining algorithm. Additionally, the threat actor has been observed creating autoscaling groups that are set to scale from 20 to 999 instances in an effort to exploit EC2 service quotas and maximize resource consumption.

The EC2 activity has targeted both high-performance GPU and machine learning instances and compute, memory, and general-purpose instances. What makes this campaign stand apart is its use of the ModifyInstanceAttribute action with the “disableApiTermination” parameter set to “True,” which prevents an instance from being terminated using the Amazon EC2 console, command line interface, or API. This, in turn, has the effect of requiring victims to re-enable API termination before deleting the impacted resources. “Instance termination protection can impair incident response capabilities and disrupt automated remediation controls,” Amazon said.

“This technique demonstrates an understanding of common security response procedures and intent to maximize the duration of mining operations.” This is not the first time the security risk associated with ModifyInstanceAttribute has come to light. In April 2024, security researcher Harsha Koushik demonstrated a proof-of-concept (PoC) that detailed how the action can be abused to take over instances, exfiltrate instance role credentials, and even seize control of the entire AWS account. Furthermore, the attacks entail the creation of a Lambda function that can be invoked by any principal and an IAM user “user-x1x2x3x4” to which the AWS managed policy “ AmazonSESFullAccess “ is attached, granting the adversary complete access over the Amazon Simple Email Service (SES) to likely carry out phishing attacks. To secure against the threat, Amazon is urging AWS customers to follow the steps below - Enforce strong identity and access management controls Implement temporary credentials instead of long-term access keys Use multi-factor authentication (MFA) for all users Apply the principle of least privilege (PoLP) to IAM principals to restrict access Add container security controls to scan for suspicious images Monitor unusual CPU allocation requests in ECS task definitions Use AWS CloudTrail to log events across AWS services Ensure AWS GuardDuty is enabled to facilitate automated response workflows “The threat actor’s scripted use of multiple compute services, in combination with emerging persistence techniques, represents a significant advancement in crypto mining attack methodologies.” Found this article interesting?

Rogue NuGet Package Poses as Tracer.Fody, Steals Cryptocurrency Wallet Data

Cybersecurity researchers have discovered a new malicious NuGet package that typosquats and impersonates the popular .NET tracing library and its author to sneak in a cryptocurrency wallet stealer. The malicious package, named “ Tracer.Fody.NLog ,” remained on the repository for nearly six years. It was published by a user named “csnemess” on February 26, 2020. It masquerades as “ Tracer.Fody ,” which is maintained by “ csnemes .” The package continues to remain available as of writing, and has been downloaded at least 2,000 times, out of which 19 took place over the last six weeks for version 3.2.4.

“It presents itself as a standard .NET tracing integration but in reality functions as a cryptocurrency wallet stealer,” Socket security researcher Kirill Boychenko said . “Inside the malicious package, the embedded Tracer.Fody.dll scans the default Stratis wallet directory, reads *.wallet.json files, extracts wallet data, and exfiltrates it together with the wallet password to threat actor-controlled infrastructure in Russia at 176.113.82[.]163 .” The software supply chain security company said the threat leveraged a number of tactics that allowed it to elude casual review, including mimicking the legitimate maintainer by using a name that differs by a single letter (“csnemes” vs. “csnemess”), using Cyrillic lookalike characters in the source code, and hiding the malicious routine within a generic helper function (“Guard.NotNull”) that’s used during regular program execution. Once a project references the malicious package, it activates its behavior by scanning the default Stratis wallet directory on Windows (“%APPDATA%\StratisNode\stratis\StratisMain”), reads *.wallet.json files and in-memory passwords, and exfiltrates them to the Russian-hosted IP address.

“All exceptions are silently caught, so even if the exfiltration fails, the host application continues to run without any visible error while successful calls quietly leak wallet data to the threat actor’s infrastructure,” Boychenko said. Socket said the same IP address was previously put to use in December 2023 in connection with another NuGet impersonation attack in which the threat actor published a package named “Cleary.AsyncExtensions” under the alias “stevencleary” and incorporated functionality to siphon wallet seed phrases. The package was so-called to disguise itself as the AsyncEx NuGet library . The findings once illustrate how malicious typosquats mirroring legitimate tools can stealthily operate without attracting any attention across the open-source repository ecosystems.

“Defenders should expect to see similar activity and follow-on implants that extend this pattern,” Socket said. “Likely targets include other logging and tracing integrations, argument validation libraries, and utility packages that are common in .NET projects.” Found this article interesting? Follow us on Google News , Twitter and LinkedIn to read more exclusive content we post.

Amazon Exposes Years-Long GRU Cyber Campaign Targeting Energy and Cloud Infrastructure

Amazon’s threat intelligence team has disclosed details of a “years-long” Russian state-sponsored campaign that targeted Western critical infrastructure between 2021 and 2025. Targets of the campaign included energy sector organizations across Western nations, critical infrastructure providers in North America and Europe, and entities with cloud-hosted network infrastructure. The activity has been attributed with high confidence to Russia’s Main Intelligence Directorate (GRU), citing infrastructure overlaps with APT44 , which is also known as FROZENBARENTS, Sandworm, Seashell Blizzard, and Voodoo Bear. The activity is notable for using as initial access vectors misconfigured customer network edge devices with exposed management interfaces, as N-day and zero-day vulnerability exploitation activity declined over the time period – indicative of a shift in attacks aimed at critical infrastructure, the tech giant said.

“This tactical adaptation enables the same operational outcomes, credential harvesting, and lateral movement into victim organizations’ online services and infrastructure, while reducing the actor’s exposure and resource expenditure,” CJ Moses, Chief Information Security Officer (CISO) of Amazon Integrated Security, said. The attacks have been found to leverage the following vulnerabilities and tactics over the course of five years - 2021-2022 - Exploitation of WatchGuard Firebox and XTM flaw ( CVE-2022-26318 ) and targeting of misconfigured edge network devices 2022-2023 - Exploitation of Atlassian Confluence flaws ( CVE-2021-26084 and CVE-2023-22518 ) and continued targeting of misconfigured edge network devices 2024 - Exploitation of Veeam flaw ( CVE-2023-27532 ) and continued targeting of misconfigured edge network devices 2025 - Sustained targeting of misconfigured edge network devices The intrusion activity, per Amazon, singled out enterprise routers and routing infrastructure, VPN concentrators and remote access gateways, network management appliances, collaboration and wiki platforms, and cloud-based project management systems. These efforts are likely designed to facilitate credential harvesting at scale, given the threat actor’s ability to position themselves strategically on the network edge to intercept sensitive information in transit. Telemetry data has also uncovered what has been described as coordinated attempts aimed at misconfigured customer network edge devices hosted on Amazon Web Services (AWS) infrastructure.

“Network connection analysis shows actor-controlled IP addresses establishing persistent connections to compromised EC2 instances operating customers’ network appliance software,” Moses said. “Analysis revealed persistent connections consistent with interactive access and data retrieval across multiple affected instances.” In addition, Amazon said it observed credential replay attacks against victim organizations’ online services as part of attempts to obtain a deeper foothold into targeted networks. Although these attempts are assessed to be unsuccessful, they lend weight to the aforementioned hypothesis that the adversary is grabbing credentials from compromised customer network infrastructure for follow-on attacks. The entire attack plays out as follows - Compromise the customer network edge device hosted on AWS Leverage native packet capture capability Gather credentials from intercepted traffic Replay credentials against the victim organizations’ online services and infrastructure Establish persistent access for lateral movement The credential replay operations have targeted energy, technology/cloud services, and telecom service providers across North America, Western and Eastern Europe, and the Middle East.

“The targeting demonstrates sustained focus on the energy sector supply chain, including both direct operators and third-party service providers with access to critical infrastructure networks,” Moses noted. Interestingly, the intrusion set also shares infrastructure overlaps (91.99.25[.]54) with another cluster tracked by Bitdefender under the name Curly COMrades , which is believed to be operating with interests that are aligned with Russia since late 2023. This has raised the possibility that the two clusters may represent complementary operations within a broader campaign undertaken by GRU. “This potential operational division, where one cluster focuses on network access and initial compromise while another handles host-based persistence and evasion, aligns with GRU operational patterns of specialized subclusters supporting broader campaign objectives,” Moses said.

Amazon said it identified and notified affected customers, as well as disrupted active threat actor operations targeting its cloud services. Organizations are recommended to audit all network edge devices for unexpected packet capture utilities, implement strong authentication, monitor for authentication attempts from unexpected geographic locations, and keep tabs on credential replay attacks. Found this article interesting? Follow us on Google News , Twitter and LinkedIn to read more exclusive content we post.

Why Data Security and Privacy Need to Start in Code

AI-assisted coding and AI app generation platforms have created an unprecedented surge in software development. Companies are now facing rapid growth in both the number of applications and the pace of change within those applications. Security and privacy teams are under significant pressure as the surface area they must cover is expanding quickly while their staffing levels remain largely unchanged. Existing data security and privacy solutions are too reactive for this new era.

Many begin with data already collected in production, which is often too late. These solutions frequently miss hidden data flows to third party and AI integrations, and for the data sinks they do cover, they help detect risks but do not prevent them. The question is whether many of these issues can instead be prevented early. The answer is yes.

Prevention is possible by embedding detection and governance controls directly into development. HoundDog.ai provides a privacy code scanner built for exactly this purpose. Data security and privacy issues that can be proactively addressed Sensitive data exposure in logs remains one of the most common and costly problems When sensitive data appears in logs, relying on DLP solutions is reactive, unreliable, and slow. Teams may spend weeks cleaning logs, identifying exposure across the systems that ingested them, and revising the code after the fact.

These incidents often begin with simple developer oversights, such as using a tainted variable or printing an entire user object in a debug function. As engineering teams grow past 20 developers, keeping track of all code paths becomes difficult and these oversights become more frequent. Inaccurate or outdated data maps also drive considerable privacy risk A core requirement in GDPR and US Privacy Frameworks is the need to document processing activities with details about the types of personal data collected, processed, stored, and shared. Data maps then feed into mandatory privacy reports such as Records of Processing Activities (RoPA), Privacy Impact Assessments (PIA), and Data Protection Impact Assessments (DPIA).

These reports must document the legal bases for processing, demonstrate compliance with data minimization and retention principles, and ensure that data subjects have transparency and can exercise their rights. In fast-moving environments, though, data maps quickly drift out of date. Traditional workflows in GRC tools require privacy teams to interview application owners repeatedly, a process that is both slow and error-prone. Important details are often missed, especially in companies with hundreds or thousands of code repositories.

Production-focused privacy platforms provide only partial automation because they attempt to infer data flows based on data already stored in production systems. They often cannot see SDKs, abstractions, and integrations embedded in the code. These blind spots can lead to violations of data processing agreements or inaccurate disclosures in privacy notices. Since these platforms detect issues only after data is already flowing, they offer no proactive controls that prevent risky behavior in the first place.

Another major challenge is the widespread experimentation with AI inside codebases Many companies have policies restricting AI services in their products. Yet when scanning their repositories, it is common to find AI-related SDKs such as LangChain or LlamaIndex in 5% to 10% of repositories. Privacy and security teams must then understand which data types are being sent to these AI systems and whether user notices and legal bases cover these flows. AI usage itself is not the problem.

The issue arises when developers introduce AI without oversight. Without proactive technical enforcement, teams must retroactively investigate and document these flows, which is time-consuming and often incomplete. As AI integrations grow in number, the risk of noncompliance grows too. What is HoundDog.ai HoundDog.ai provides a privacy-focused static code scanner that continuously analyzes source code to document sensitive data flows across storage systems, AI integrations, and third-party services.

The scanner identifies privacy risks and sensitive data leaks early in development, before code is merged and before data is ever processed. The engine is built in Rust, which is memory safe, and it is lightweight and fast. It scans millions of lines of code in under a minute. The scanner was recently integrated with Replit, the AI app generation platform used by 45M creators, providing visibility into privacy risks across the millions of applications generated by the platform.

Key capabilities AI Governance and Third-Party Risk Management Identify AI and third-party integrations embedded in code with high confidence, including hidden libraries and abstractions often associated with shadow AI. Proactive Sensitive Data Leak Detection Embed privacy across all stages in development, from IDE environments, with extensions available for VS Code, IntelliJ, Cursor, and Eclipse, to CI pipelines that use direct source code integrations and automatically push CI configurations as direct commits or pull requests requiring approval. Track more than 100 types of sensitive data, including Personally Identifiable Information (PII), Protected Health Information (PHI), Cardholder Data (CHD), and authentication tokens, and follow them across transformations into risky sinks such as LLM prompts, logs, files, local storage, and third-party SDKs. Evidence Generation for Privacy Compliance Automatically generate evidence-based data maps that show how sensitive data is collected, processed, and shared.

Produce audit-ready Records of Processing Activities (RoPA), Privacy Impact Assessments (PIA), and Data Protection Impact Assessments (DPIA), prefilled with detected data flows and privacy risks identified by the scanner. Why this matters Companies need to eliminate blind spots A privacy scanner that works at the code level provides visibility into integrations and abstractions that production tools miss. This includes hidden SDKs, third-party libraries, and AI frameworks that never show up through production scans until it is too late. Teams also need to catch privacy risks before they occur Plaintext authentication tokens or sensitive data in logs, or unapproved data sent to third-party integrations, must be stopped at the source.

Prevention is the only reliable way to avoid incidents and compliance gaps. Privacy teams require accurate and continuously updated data maps Automated generation of RoPAs, PIAs, and DPIAs based on code evidence ensures that documentation keeps pace with development, without repeated manual interviews or spreadsheet updates. Comparison with other tools Privacy and security engineering teams use a mix of tools, but each category has fundamental limitations. General-purpose static analysis tools provide custom rules but lack privacy awareness.

They treat different sensitive data types as equivalent and cannot understand modern AI-driven data flows. They rely on simple pattern matching, which produces noisy alerts and requires constant maintenance. They also lack any built-in compliance reporting. Post-deployment privacy platforms map data flows based on information stored in production systems.

They cannot detect integrations or flows that have not yet produced data in those systems and cannot see abstractions hidden in code. Because they operate after deployment, they cannot prevent risks and introduce a significant delay between issue introduction and detection. Reactive Data Loss Prevention tools intervene only after data has leaked. They lack visibility into source code and cannot identify root causes.

When sensitive data reaches logs or transmissions, the cleanup is slow. Teams often spend weeks remediating and reviewing exposure across many systems. HoundDog.ai improves on these approaches by introducing a static analysis engine purpose-built for privacy. It performs deep interprocedural analysis across files and functions to trace sensitive data such as Personally Identifiable Information (PII), Protected Health Information (PHI), Cardholder Data (CHD), and authentication tokens.

It understands transformations, sanitization logic, and control flow. It identifies when data reaches risky sinks such as logs, files, local storage, third-party SDKs, and LLM prompts. It prioritizes issues based on sensitivity and actual risk rather than simple patterns. It includes native support for more than 100 sensitive data types and allows customization.

HoundDog.ai also detects both direct and indirect AI integrations from source code. It identifies unsafe or unsanitized data flows into prompts and allows teams to enforce allowlists that define which data types may be used with AI services. This proactive model blocks unsafe prompt construction before code is merged, providing enforcement that runtime filters cannot match. Beyond detection, HoundDog.ai automates the creation of privacy documentation.

It produces an always fresh inventory of internal and external data flows, storage locations, and third-party dependencies. It generates audit-ready Records of Processing Activities and Privacy Impact Assessments populated with real evidence and aligned to frameworks such as FedRAMP, DoD RMF, HIPAA, and NIST 800-53. Customer success HoundDog.ai is already used by Fortune 1000 companies across healthcare and financial services, scanning thousands of repositories. These organizations are reducing data mapping overhead, catching privacy issues early in development, and maintaining compliance without slowing engineering.

Use Case Customer Outcomes Slash Data Mapping Overhead Fortune 500 Healthcare 70% reduction in data mapping . Automated reporting across 15,000 code repositories, eliminated manual corrections caused by missed flows from shadow AI and third-party integrations, and strengthened HIPAA compliance Minimize Sensitive Data Leaks in Logs Unicorn Fintech Zero PII leaks across 500 code repos. Cut incidents from 5/month to none. $2M savings by avoiding 6,000+ engineering hours and costly masking tools.

Continuous Compliance with DPAs Across AI and Third-Party Integrations Series B Fintech Privacy compliance from day 1 . Detected oversharing with LLMs, enforced allowlists, and auto-generated Privacy Impact Assessments, building customer trust. Replit The most visible deployment is in Replit , where the scanner helps protect the more than 45M users of the AI app generation platform. It identifies privacy risks and traces sensitive data flows across millions of AI-generated applications.

This allows Replit to embed privacy directly into its app generation workflow so that privacy becomes a core feature rather than an afterthought. By shifting privacy into the earliest stages of development and providing continuous visibility, enforcement, and documentation, HoundDog.ai makes it possible for teams to build secure and compliant software at the speed that modern AI-driven development demands. Found this article interesting? This article is a contributed piece from one of our valued partners.

Fortinet FortiGate Under Active Attack Through SAML SSO Authentication Bypass

Threat actors have begun to exploit two newly disclosed security flaws in Fortinet FortiGate devices, less than a week after public disclosure. Cybersecurity company Arctic Wolf said it observed active intrusions involving malicious single sign-on (SSO) logins on FortiGate appliances on December 12, 2025. The attacks exploit two critical authentication bypasses (CVE-2025-59718 and CVE-2025-59719, CVSS scores: 9.8). Patches for the flaws were released by Fortinet last week for FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager.

“These vulnerabilities allow unauthenticated bypass of SSO login authentication via crafted SAML messages, if the FortiCloud SSO feature is enabled on affected devices,” Arctic Wolf Labs said in a new bulletin. It’s worth noting that while FortiCloud SSO is disabled by default, it is automatically enabled during FortiCare registration unless administrators explicitly turn it off using the “Allow administrative login using FortiCloud SSO” setting in the registration page. In the malicious activity observed by Arctic Wolf, IP addresses associated with a limited set of hosting providers, such as The Constant Company llc, Bl Networks, and Kaopu Cloud Hk Limited, were used to carry out malicious SSO logins against the “admin” account. Following the logins, the attackers have been found to export device configurations via the GUI to the same IP addresses.

In light of ongoing exploitation activity, organizations are advised to apply the patches as soon as possible. As mitigations, it’s essential to disable FortiCloud SSO until the instances are updated to the latest version and limit access to management interfaces of firewalls and VPNs to trusted internal users. “Although credentials are typically hashed in network appliance configurations, threat actors are known to crack hashes offline, especially if credentials are weak and susceptible to dictionary attacks,” Arctic Wolf said. Fortinet customers who find indicators of compromise (IoCs) consistent with the campaign are recommended to assume compromise and reset hashed firewall credentials stored in the exfiltrated configurations.

Found this article interesting? Follow us on Google News , Twitter and LinkedIn to read more exclusive content we post.

Pentesting With Proof. Zero-Day, Zero-Pay and the #1 AI Hacker Behind It

React2Shell Vulnerability Actively Exploited to Deploy Linux Backdoors

The security vulnerability known as React2Shell is being exploited by threat actors to deliver malware families like KSwapDoor and ZnDoor, according to findings from Palo Alto Networks Unit 42 and NTT Security. “KSwapDoor is a professionally engineered remote access tool designed with stealth in mind,” Justin Moore, senior manager of threat intel research at Palo Alto Networks Unit 42, said in a statement. “It builds an internal mesh network, allowing compromised servers to talk to each other and evade security blocks. It uses military-grade encryption to hide its communications and, most alarmingly, features a ‘sleeper’ mode that lets attackers bypass firewalls by waking the malware up with a secret, invisible signal.” The cybersecurity company noted that it was previously mistakenly classified as BPFDoor , adding that the Linux backdoor offers interactive shell, command execution, file operations and lateral movement scanning capabilities.

It also impersonates a legitimate Linux kernel swap daemon to evade detection. In a related development, NTT Security said organizations in Japan are being targeted by cyber attacks exploiting React2Shell to deploy ZnDoor, a malware that’s been assessed to be detected in the wild since December 2023. The attack chains involve running a bash command to fetch the payload from a remote server (45.76.155[.]14) using wget and executing it. A remote access trojan, it contacts the same threat actor-controlled infrastructure to receive commands and execute them on the host.

Some of the supported commands are listed below - shell, to execute a command interactive_shell, to launch an interactive shell explorer, to get a list of directories explorer_cat, to read and display a file explorer_delete, to delete a file explorer_upload, to download a file from the server explorer_download, to send files to the server system, to gather system information change_timefile, to change the timestamp of a file socket_quick_startstreams, to start a SOCKS5 proxy start_in_port_forward, to start port forwarding stop_in_port, to stop port forwarding The disclosure comes as the vulnerability, tracked as CVE-2025-55182 (CVSS score: 10.0), has been exploited by multiple threat actors, Google identifying at least five China-nexus groups that have weaponized it to distribute an array of payloads - UNC6600, to deliver a tunneling utility named MINOCAT UNC6586, to deliver a downloader named SNOWLIGHT UNC6588, to deliver a backdoor named COMPOOD UNC6603, to deliver an updated version of a Go backdoor named HISONIC that uses Cloudflare Pages and GitLab to retrieve encrypted configuration and blend in with legitimate network activity UNC6595, to deliver a Linux version of ANGRYREBEL (aka Noodle RAT) Microsoft, in its own advisory for CVE-2025-55182, said threat actors have taken advantage of the flaw to run arbitrary commands for post-exploitation, including setting up reverse shells to known Cobalt Strike servers, and then dropping remote monitoring and management (RMM) tools such as MeshAgent, modifying the authorized_keys file, and enabling root login. Some of the payloads delivered in these attacks include VShell, EtherRAT, SNOWLIGHT, ShadowPad, and XMRig. The attacks are also characterized by the use of Cloudflare Tunnel endpoints (“*.trycloudflare.com”) to evade security defenses, as well as conducting reconnaissance of the compromised environments to facilitate lateral movement and credential theft. The credential harvesting activity, the Windows maker said, targeted Azure Instance Metadata Service (IMDS) endpoints for Azure, Amazon Web Services (AWS), Google Cloud Platform (GCP), and Tencent Cloud with the end goal of acquiring identity tokens to burrow deeper into cloud infrastructures.

“Attackers also deployed secret discovery tools such as TruffleHog and Gitleaks, along with custom scripts to extract several different secrets,” the Microsoft Defender Security Research Team said . “Attempts to harvest AI and cloud-native credentials, such as OpenAI API keys, Databricks tokens, and Kubernetes service‑account credentials, were also observed. Azure Command-Line Interface (CLI) (az) and Azure Developer CLI (azd) were also used to obtain tokens.” In another campaign detailed by Beelzebub, threat actors have been observed exploiting flaws in Next.js, including CVE-2025-29927 and CVE-2025-66478 (the same React2Shell bug before it was rejected as a duplicate), to enable systematic extraction of credentials and sensitive data - .env, .env.local, .env.production, .env.development System environment variables (printenv, env) SSH keys (~/.ssh/id_rsa, ~/.ssh/id_ed25519, /root/.ssh/*) Cloud credentials (~/.aws/credentials, ~/.docker/config.json) Git credentials (~/.git-credentials, ~/.gitconfig) Command history (last 100 commands from ~/.bash_history) System files (/etc/shadow, /etc/passwd) The malware also proceeds to create persistence on the host to survive system reboots, install a SOCKS5 proxy, establish a reverse shell to “67.217.57[.]240:888,” and install a React scanner to probe the internet for further propagation. The activity, codenamed Operation PCPcat, is estimated to have already breached 59,128 servers.

“The campaign shows characteristics of large-scale intelligence operations and data exfiltration on an industrial scale,” the Italian company said. The Shadowserver Foundation is currently tracking over 111,000 IP addresses vulnerable to React2Shell attacks, with over 77,800 instances in the U.S., followed by Germany (7,500), France (4,000), and India (2,300). Data from GreyNoise shows that there are 547 malicious IP addresses from the U.S., India, the U.K., Singapore, and the Netherlands partaking in the exploitation efforts over the past 24 hours. Found this article interesting?

Google to Shut Down Dark Web Monitoring Tool in February 2026

Google has announced that it’s discontinuing its dark web report tool in February 2026, less than two years after it was launched as a way for users to monitor if their personal information is found on the dark web. To that end, scans for new dark web breaches will be stopped on January 15, 2026, and the feature will cease to exist effective February 16, 2026. “While the report offered general information, feedback showed that it didn’t provide helpful next steps,” Google said in a support document. “We’re making this change to instead focus on tools that give you more clear, actionable steps to protect your information online.” The tech giant said it will delete all data related to dark web report once the feature is retired in February, but noted that users have an option to delete their monitoring profile ahead of time by following the steps below - Go to the Dark Web report Under “Results with your info,” click Edit monitoring profile At the bottom, click “Delete monitoring profile” -> Delete The dark web report was unveiled by Google in March 2023 to combat online identity fraud stemming from information stolen through data breaches and made available on the dark web.

The report was designed to scan the darknet for personal data, such as name, address, email, phone number, and Social Security number, and notify users when it’s found. In July 2024, Google expanded the offering beyond Google One subscribers to include all account holders. Google is also urging users to strengthen their account privacy and security by creating a passkey for phishing-resistant multi-factor authentication (MFA) and removing their personal information from Google Search results via Results about you . Found this article interesting?

Featured Chrome Browser Extension Caught Intercepting Millions of Users’ AI Chats

A Google Chrome extension with a “Featured” badge and six million users has been observed silently gathering every prompt entered by users into artificial intelligence (AI)-powered chatbots like OpenAI ChatGPT, Anthropic Claude, Microsoft Copilot, DeepSeek, Google Gemini, xAI Grok, Meta AI, and Perplexity. The extension in question is Urban VPN Proxy , which has a 4.7 rating on the Google Chrome Web Store. It’s advertised as the “best secured Free VPN access to any website, and unblock content.” Its developer is a Delaware-based company named Urban Cyber Security Inc . On the Microsoft Edge Add-ons marketplace, it has 1.3 million installations .

Despite claiming that it allows users to “protect your online identity, stay protected, and hide your IP,” an update was pushed to users on July 9, 2025, when version 5.5.0 was released with the AI data harvesting enabled by default using hard-coded settings. Specifically, this is achieved by means of a tailored executor JavaScript that’s triggered for each of the AI chatbots (i.e., chatgpt.js, claude.js, gemini.js) to intercept and gather the conversations every time a user who has installed the extension visits any of the targeted platforms. Once the script is injected, it overrides the browser APIs used to handle network requests – fetch() and XMLHttpRequest() – to make sure that every request is first routed through the extension’s code so as to capture the conversation data, including users’ prompts and the chatbot’s responses, and exfiltrate them to two remote servers (“analytics.urban-vpn[.]com” and “stats.urban-vpn[.]com”). The exact list of data captured by the extension is as follows - Prompts entered by the user Chatbot responses Conversation identifiers and timestamps Session metadata AI platform and model used “Chrome and Edge extensions auto-update by default,” Koi Security’s Idan Dardikman said in a report published today.

“Users who installed Urban VPN for its stated purpose – VPN functionality – woke up one day with new code silently harvesting their AI conversations.” It’s worth mentioning that Urban VPN’s updated privacy policy, as of June 25, 2025, mentions that it collects this data to enhance Safe Browsing and for marketing analytics purposes, and that any other secondary use of the gathered AI prompts will be carried out on de-identified and anonymized data - As part of the Browsing Data, we will collect the prompts and outputs quired [sic] by the End-User or generated by the AI chat provider, as applicable. Meaning, we are only interested in the AI prompt and the results of your interaction with the chat AI. Due to the nature of the data involved in AI prompts, some sensitive personal information may be processed. However, the purpose of this processing is not to collect personal or identifiable data, we cannot fully guarantee the removal of all sensitive or personal information, we implement measures to filter out or eliminate any identifiers or personal data you may submit through the prompts and to de-identify and aggregate the data.

One of the third-parties it shares “Web Browsing Data” with is an affiliated ad intelligence and brand monitoring firm named BIScience . The company uses the raw (not anonymized) data to create insights that are “commercially used and shared with Business Partners,” the VPN software maker notes. It’s worth noting BiScience, which also happens to own Urban Cyber Security Inc., was called out by an anonymous researcher earlier this January for collecting users’ browsing history, or clickstream data, as it’s called, under misleading privacy policy disclosures. The company is alleged to provide a software development kit (SDK) to partner third-party extension developers to collect clickstream data from users, which is transmitted to the sclpfybn[.]com domain and other endpoints under its control.

“BIScience and partners take advantage of loopholes in the Chrome Web Store policies, mainly exceptions listed in the Limited Use policy , which are the ‘approved use cases,’” the researcher noted, adding they “develop user-facing features that allegedly require access to browsing history, to claim the ‘necessary to providing or improving your single purpose’ exception.” On the extension listing page, Urban VPN also highlights an “AI protection” feature, which it says checks prompts for personal data, chatbot responses for suspicious or unsafe links, and displays a warning before users submit their prompts or click on them. While this monitoring is framed as preventing users from accidentally sharing any personal information, what the developers fail to mention is that the data collection happens regardless of whether the feature is enabled. “The protection feature shows occasional warnings about sharing sensitive data with AI companies,” Dardikman said. “The harvesting feature sends that exact sensitive data – and everything else – to Urban VPN’s own servers, where it’s sold to advertisers.

The extension warns you about sharing your email with ChatGPT while simultaneously exfiltrating your entire conversation to a data broker.” Koi Security said it observed identical AI harvesting functionality in three other unique extensions from the same publisher across Chrome and Microsoft Edge, taking its total install base to over eight million - 1ClickVPN Proxy Urban Browser Guard Urban Ad Blocker All these extensions, with the exception of Urban Ad Blocker for Edge, carry the “Featured” badge, giving users an impression that they follow the platform’s “best practices and meet a high standard of user experience and design.” “These badges signal to users that the extensions have been reviewed and meet platform quality standards,” Dardikman pointed out. “For many users, a Featured badge is the difference between installing an extension and passing it by – it’s an implicit endorsement from Google and Microsoft.” The findings once again demonstrate how trust associated with extension marketplaces can be abused to amass sensitive data at scale, especially at a time when users are increasingly sharing deeply personal information , getting advice, and discussing emotions with AI chatbots . The Hacker News has reached out to both Google and Microsoft for comment, and we will update the story if we hear back. Found this article interesting?

FreePBX Patches Critical SQLi, File-Upload, and AUTHTYPE Bypass Flaws Enabling RCE

Multiple security vulnerabilities have been disclosed in the open-source private branch exchange (PBX) platform FreePBX, including a critical flaw that could result in an authentication bypass under certain configurations. The shortcomings, discovered by Horizon3.ai and reported to the project maintainers on September 15, 2025, are listed below - CVE-2025-61675 (CVSS score: 8.6) - Numerous authenticated SQL injection vulnerabilities impacting four unique endpoints (basestation, model, firmware, and custom extension) and 11 affected parameters that enable read and write access to the underlying SQL database CVE-2025-61678 (CVSS score: 8.6) - An authenticated arbitrary file upload vulnerability that allows an attacker to exploit the firmware upload endpoint to upload a PHP web shell after obtaining a valid PHPSESSID and run arbitrary commands to leak the contents of sensitive files (e.g., “/etc/passwd”) CVE-2025-66039 (CVSS score: 9.3) - An authentication bypass vulnerability that occurs when the “Authorization Type” (aka AUTHTYPE) is set to “webserver,” allowing an attacker to log in to the Administrator Control Panel via a forged Authorization header It’s worth mentioning here that the authentication bypass is not vulnerable in the default configuration of FreePBX, given that the “Authorization Type” option is only displayed when the three following values in the Advanced Settings Details are set to “Yes”: Display Friendly Name Display Readonly Settings, and Override Readonly Settings However, once the prerequisite is met, an attacker could send crafted HTTP requests to sidestep authentication and insert a malicious user into the “ampusers” database table, effectively accomplishing something similar to CVE-2025-57819 , another flaw in FreePBX that was disclosed as having been actively exploited in the wild in September 2025. “These vulnerabilities are easily exploitable and enable authenticated/unauthenticated remote attackers to achieve remote code execution on vulnerable FreePBX instances,” Horizon3.ai security researcher Noah King said in a report published last week. The issues have been addressed in the following versions - CVE-2025-61675 and CVE-2025-61678

16.0.92 and 17.0.6 (Fixed on October 14, 2025) CVE-2025-66039
16.0.44 and 17.0.23 (Fixed on December 9, 2025) In addition, the option to choose an authentication provider has now been removed from Advanced Settings and requires users to set it manually through the command-line using fwconsole.

As temporary mitigations, FreePBX has recommended that users set “Authorization Type” to “usermanager,” set “Override Readonly Settings” to “No,” apply the new configuration, and reboot the system to disconnect any rogue sessions. “If you did find that web server AUTHTYPE was enabled inadvertently, then you should fully analyze your system for signs of any potential compromise,” it said. Users are also displayed a warning on the dashboard, stating “webserver” may offer reduced security compared to “usermanager.” For optimal protection, it’s advised to avoid using this authentication type. “It’s important to note that the underlying vulnerable code is still present and relies on authentication layers in front to provide security and access to the FreePBX instance,” King said.

“It still requires passing an Authorization header with a basic Base64-encoded username:password.” “Depending on the endpoint, we noticed a valid username was required. In other cases, such as the file upload shared above, a valid username is not required, and you can achieve remote code execution with a few steps, as outlined. It is best practice not to use the authentication type webserver as it appears to be legacy code.” Found this article interesting? Follow us on Google News , Twitter and LinkedIn to read more exclusive content we post.

⚡ Weekly Recap: Apple 0-Days, WinRAR Exploit, LastPass Fines, .NET RCE, OAuth Scams & More

If you use a smartphone, browse the web, or unzip files on your computer, you are in the crosshairs this week. Hackers are currently exploiting critical flaws in the daily software we all rely on—and in some cases, they started attacking before a fix was even ready. Below, we list the urgent updates you need to install right now to stop these active threats. ⚡ Threat of the Week Apple and Google Release Fixes for Actively Exploited Flaws — Apple released security updates for iOS, iPadOS, macOS, tvOS, watchOS, visionOS, and Safari web browser to address two zero-days that the company said have been exploited in highly targeted attacks.

CVE-2025-14174 has been described as a memory corruption issue, while the second, CVE-2025-43529, is a use-after-free bug. They can both be exploited using maliciously crafted web content to execute arbitrary code. CVE-2025-14174 was also addressed by Google in its Chrome browser since it resides in its open-source Almost Native Graphics Layer Engine (ANGLE) library. There are currently no details on how these flaws were exploited, but evidence points to it likely having been weaponized by commercial spyware vendors.

The CISO Org Chart Playbook This playbook is for security leaders who are scaling CloudSec teams and need a structure that keeps up with cloud complexity. Built specifically for modern cloud-forward security teams, it breaks down how CISOs are structuring cloud security functions today – including emerging roles, team models, reporting lines, and practical templates for planning headcount and responsibilities across cloud, AppSec, platform security, and more. Download Org Charts ➝ 🔔 Top News SOAPwn Exploits HTTP Client Proxies in .NET for RCE — Cybersecurity researchers uncovered an unexpected behavior of HTTP client proxies in .NET applications, potentially allowing attackers to achieve remote code execution. The vulnerability has been codenamed SOAPwn.

At its core, the problem has to do with how .NET applications might be vulnerable to arbitrary file writes because .NET’s HTTP client proxies also accept non-HTTP URLs such as files, a behavior that Microsoft says developers are responsible for guarding against — but not likely to expect. This, in turn, can open remote code execution (RCE) attack paths through web shells and malicious PowerShell scripts in many .NET applications, including commercial products. By being able to pass an arbitrary URL to a SOAP API endpoint in an affected .NET application, an attacker can trigger a leak of NTLM challenge. The issue can also be exploited through Web Services Description Language (WSDL) imports, which can then be used to generate client SOAP proxies that can be controlled by the attacker.

“The .NET Framework allows its HTTP client proxies to be tricked into interacting with the filesystem. With the right conditions, they will happily write SOAP requests into local paths instead of sending them over HTTP,” watchTowr said. “In the best case, this results in NTLM relaying or challenge capture. In the worst case, it becomes remote code execution through webshell uploads or PowerShell script drops.” Attackers Exploit New Flaw in CentreStack and Triofox — A new vulnerability in Gladinet’s CentreStack and Triofox products is being actively exploited by unknown threat actors to achieve code execution.

The vulnerability, which does not have a CVE identifier, can be abused to access the web.config file, which can then be used to execute arbitrary code. At the core of the issue is a design failure in how they generate the cryptographic keys used to encrypt the access tokens the products use to control who can retrieve what files. As a result, the cryptographic keys never change and can be used to access files containing valuable data. Huntress said, as of December 10, 2025, nine organizations have been affected by the newly disclosed flaw.

WinRAR Flaw Exploited by Multiple Threat Actors — A high-severity flaw in WinRAR (CVE-2025-6218, CVSS score: 7.8) has come under active exploitation, fueled by three different threat actors tracked as GOFFEE (aka Paper Werewolf), Bitter (aka APT-C-08 or Manlinghua), and Gamaredon. CVE-2025-6218 is a path traversal vulnerability that allows an attacker to execute code in the context of the current user. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the necessary fixes by December 30, 2025.

Exploitation of React2Shell Surges — The recently disclosed maximum-severity security flaw in React (CVE-2025-55182, CVSS score: 10.0) has come under widespread exploitation, with threat actors targeting unpatched systems to deliver various kinds of malware. Public disclosure of the flaw triggered a “rapid wave of opportunistic exploitation,” according to Wiz. Google said it observed a China-nexus espionage cluster UNC6600 exploiting React2Shell to deliver MINOCAT, a tunneling utility based on Fast Reverse Proxy (FRP). Other exploitation efforts included the deployment of the SNOWLIGHT downloader by UNC6586 (China-nexus), the COMPOOD backdoor (linked to suspected China-nexus espionage activity since 2022) by UNC6588, an updated version of the Go-based HISONIC backdoor by UNC6603 (China-nexus), and ANGRYREBEL.LINUX (aka Noodle RAT ) by UNC6595 (China-nexus).

“These observed campaigns highlight the risk posed to organizations using unpatched versions of React and Next.js,” Google said . Hamas-Affiliated Group Goes After the Middle East — WIRTE (aka Ashen Lepus), a cyber threat group associated with Hamas, has been conducting espionage on government bodies and diplomatic entities across the Middle East since 2018. In recent years, the threat actor has broadened its targeting scope to include Oman and Morocco, while simultaneously evolving its capabilities. The modus operandi follows tried-and-tested cyber espionage tactics, using spear-phishing emails to deliver malicious attachments that deliver a modular malware suite dubbed AshTag.

The components of the framework are embedded in a command-and-control (C2) web page within HTML tags in Base64-encoded format, from where they are parsed and decrypted to download the actual payloads. “Ashen Lepus remained persistently active throughout the Israel-Hamas conflict, distinguishing it from other affiliated groups whose activities decreased over the same period,” Palo Alto Networks Unit 42 said. “Ashen Lepus continued with its campaign even after the October 2025 Gaza ceasefire, deploying newly developed malware variants and engaging in hands-on activity within victim environments.” It’s being assessed that the group may be operating from outside Gaza, citing continued activity throughout the conflict. ‎️‍🔥 Trending CVEs Hackers act fast.

They can use new bugs within hours. One missed update can cause a big breach. Here are this week’s most serious security flaws. Check them, fix what matters first, and stay protected.

This week’s list includes — CVE-2025-43529, CVE-2025-14174 (Apple), CVE-2025-14174 (Google Chrome), CVE-2025-55183, CVE-2025-55184, CVE-2025-67779 (React), CVE-2025-8110 (Gogs), CVE-2025-62221 (Microsoft Windows), CVE-2025-59718, CVE-2025-59719 (Fortinet), CVE-2025-10573 (Ivanti Endpoint Manager), CVE-2025-42880, CVE-2025-55754, CVE-2025-42928 (SAP), CVE-2025-9612, CVE-2025-9613, CVE-2025-9614 (PCI Express Integrity and Data Encryption protocol), CVE-2025-27019 , CVE-2025-27020 (Infinera MTC-9), CVE-2025-65883 (Genexis Platinum P4410 router), CVE-2025-64126 , CVE-2025-64127 , CVE-2025-64128 (Zenitel TCIV-3+), CVE-2025-66570 (cpp-httplib), CVE-2025-63216 (Itel DAB Gateway), CVE-2025-63224 (Itel DAB Encoder) CVE-2025-13390 (WP Directory Kit plugin), CVE-2025-65108 (md-to-pdf), CVE-2025-58083 (General Industrial Controls Lynx+ Gateway), CVE-2025-66489 (Cal.com), CVE-2025-12195 , CVE-2025-12196 , CVE-2025-11838 , CVE-2025-12026 (WatchGuard), CVE-2025-64113 (Emby Server), CVE-2025-66567 (ruby-saml), CVE-2025-24857 (Universal Boot Loader), CVE-2025-13607 (D-Link DCS-F5614-L1, Sparsh Securitech, Securus CCTV), CVE-2025-13184 (TOTOLINK AX1800), CVE-2025-65106 (LangChain), CVE-2025-67635 (Jenkins), CVE-2025-12716, CVE-2025-8405, CVE-2025-12029, CVE-2025-12562 (GitLab CE/EE), and CVE-2025-64775 (Apache Struts 2). 📰 Around the Cyber World U.K. Fines LastPass for 2022 Breach — The U.K. Information Commissioner’s Office (ICO) fined LastPass’s British subsidiary £1.2 million ($1.6 million) for a data breach in 2022 that enabled attackers to access personal information belonging to its customers, including their encrypted password vaults.

The hackers compromised a company-issued MacBook Pro of a software developer based in Europe to access the corporate development environment and related technical documentation, and exfiltrate a little over a dozen repositories. It’s unclear how the MacBook was infected. Subsequently, the threat actors gained access to one of the DevOps engineers’ PCs by exploiting CVE-2020-5741, a vulnerability in Plex Media Server, installed a keylogger used to steal the engineer’s master password, and breached the cloud storage environment. The ICO said LastPass failed to implement sufficiently robust technical and security measures.

“LastPass customers had a right to expect the personal information they entrusted to the company would be kept safe and secure,” John Edwards, U.K. Information Commissioner, said . “However, the company fell short of this expectation, resulting in the proportionate fine being announced today.” APT-C-60 Targets Japan with SpyGlace — The threat actor known as APT-C-60 has been linked to continued cyber attacks targeting Japan to deliver SpyGlace using spear-phishing emails impersonating job seekers. The attacks were observed between June and August 2025, per JPCERT/CC.

“In the previous attacks, victims were directed to download a VHDX file from Google Drive,” the agency said . “However, in the latest attacks, the malicious VHDX file was directly attached to the email. When the recipient clicks the LNK file contained within the VHDX, a malicious script is executed via Git, which is a legitimate file.” The attacks leverage GitHub to download the main malware components, marking a shift from Bitbucket. ConsentFix, a New Twist on ClickFix — Cybersecurity researchers have discovered a new variation of the ClickFix attack.

Called ConsentFix , the new technique relies on tricking users into copy-pasting text that contains their OAuth material into an attacker-controlled web page. Push Security said it spotted the technique in attacks targeting Microsoft business accounts. In these attacks, targets are funneled through Google Search to compromised but reputable websites injected with a fake Cloudflare Turnstile challenge that instructs them to sign in to their accounts and paste the URL. Once the targets log in, they are redirected to a localhost URL containing the OAuth authorization code for their Microsoft account.

The phishing process ends when the victims paste the URL back into the original page, granting the threat actors unauthorized access. The attack “sees the victim tricked into logging into Azure CLI, by generating an OAuth authorization code — visible in a localhost URL — and then pasting that URL, including the code, into the phishing page,” the security company said. “The attack happens entirely inside the browser context, removing one of the key detection opportunities for ClickFix attacks because it doesn’t touch the endpoint.” The technique is a variation of an attack used by Russian state-sponsored hackers earlier this year that deceived victims into sending their OAuth authorization code via Signal or WhatsApp to the hackers. 2025 CWE Top 25 Most Dangerous Software Weaknesses — The U.S.

Cybersecurity and Infrastructure Security Agency (CISA), along with the MITRE Corporation, released the 2025 Common Weakness Enumeration (CWE) Top 25 Most Dangerous Software Weaknesses, identifying the most critical vulnerabilities that adversaries exploit to compromise systems, steal data, or disrupt services. It was compiled from 39,080 CVEs published this year. Topping the list is cross-site scripting, followed by SQL Injection, Cross-Site Request Forgery (CSRF), missing authorization, and out-of-bounds write. Salt Typhoon Spies Reportedly Attended Cisco Training Scheme — Two of Salt Typhoon’s members, Yu Yang and Qiu Daibing, have been identified as participants of the 2012 Cisco Networking Academy Cup.

Both Yu and Qiu are co-owners of Beijing Huanyu Tianqiong, one of the Chinese companies that the U.S. government and its allies allege as being fronts for Salt Typhoon activity. Yu is also tied to another Salt Typhoon-connected company, Sichuan Zhixin Ruijie. SentinelOne found that Yu and Qiu represented Southwest Petroleum University in Cisco’s academy cup in China.

Yu’s team was placed second in the Sichuan region, while Qiu’s team took the first prize and later claimed the third spot nationally, despite the university being considered as a poorly-regarded academic institution. “The episode suggests that offensive capabilities against foreign IT products likely emerge when companies begin supplying local training and that there is a potential risk of such education initiatives inadvertently boosting foreign offensive research,” security researcher Dakota Cary said . The episode stresses the need for demonstrating technical competencies when hiring technical professionals and that offensive teams may benefit from putting their own employees through similar training initiatives like Huawei’s ICT academy. Freedom Chat Flaws Detailed — A pair of security flaws has been disclosed in Freedom Chat that could have allowed a bad actor to guess registered users’ phone numbers (similar to the recent WhatsApp flaw ) and expose user-set PINs to others on the app.

The issues, discovered by Eric Daigle, have since been addressed by the privacy-focused messaging app as of December 7, 2025. In an update pushed out to Apple and Google’s app stores, the company said: “A critical reset: A recent backend update inadvertently exposed user PINs in a system response. No messages were ever at risk, and because Freedom Chat does not support linked devices, your conversations were never accessible; however, we’ve reset all user PINs to ensure your account stays secure. Your privacy remains our top priority.” Unofficial Patch for New Windows RasMan 0-Day Released — Free unofficial patches have been made available for a new Windows zero-day vulnerability that allows unprivileged attackers to crash the Remote Access Connection Manager (RasMan) service.

ACROS Security’s 0patch service said it discovered a new denial-of-service (DoS) flaw while looking into CVE-2025-59230 , a Windows RasMan privilege escalation vulnerability exploited in attacks that was patched in October. The new flaw has not been assigned a CVE identifier, and there is no evidence of it having been abused in the wild. It affects all Windows versions, including Windows 7 through Windows 11 and Windows Server 2008 R2 through Server 2025. Ukrainian National Charged for Cyber Attacks on Critical Infra — U.S.

prosecutors have charged a Ukrainian national for her role in cyberattacks targeting critical infrastructure worldwide, including U.S. water systems, election systems, and nuclear facilities, on behalf of Russian state-backed hacktivist groups. Victoria Eduardovna Dubranova (aka Vika, Tory, and SovaSonya), 33, was allegedly part of two pro-Kremlin hacktivist groups named NoName057(16) and CyberArmyofRussia_Reborn ( CARR ), the latter of which was founded, funded, and directed by Russia’s military intelligence service GRU. NoName057(16), a hacktivist group active since March 2022, has over 1,500 DDoS attacks against organizations in Ukraine and NATO countries.

If found guilty, Dubranova faces up to 32 years in prison. She was extradited to the U.S. earlier this year. The U.S.

Justice Department said the groups tampered with U.S. public water systems and caused an ammonia leak at a U.S. meat processing factory. Dubranova pleaded not guilty in a U.S.

court last week. The U.S. government is also offering rewards for additional information on other members of the two groups. Prosecutors said administrators of the two collectives, dissatisfied with the level of support and funding from the GRU, went on to form Z-Pentest in September 2024 to conduct hack-and-leak operations and defacement attacks.

“Pro-Russia hacktivist groups are conducting less sophisticated, lower-impact attacks against critical infrastructure entities, compared to advanced persistent threat (APT) groups. These attacks use minimally secured, internet-facing virtual network computing (VNC) connections to infiltrate (or gain access to) OT control devices within critical infrastructure systems,” U.S. and other allies said in a joint advisory. “Pro-Russia hacktivist groups – Cyber Army of Russia Reborn (CARR), Z-Pentest, NoName057(16), Sector 16, and affiliated groups – are capitalizing on the widespread prevalence of accessible VNC devices to execute attacks against critical infrastructure entities, resulting in varying degrees of impact, including physical damage.” These groups are known for their opportunistic attacks, typically leveraging unsophisticated tradecraft like known security flaws, reconnaissance tools, and common password-guessing techniques to access networks and conduct SCADA intrusions.

While their ability to consistently cause significant impact is limited, they also tend to work together to amplify each other’s posts to reach a broader audience on platforms like Telegram and X. X’s Safety team said it cooperated with U.S. authorities to suspend NoName057(16)’s account (“@NoName05716”) for facilitating criminal conduct. APT36 Targets Indian Government Entities with Linux Malware — A new phishing campaign orchestrated by APT36 (aka Transparent Tribe) has been observed delivering tailored malware specifically crafted to compromise Linux-based BOSS operating environments prevalent in Indian government networks.

“The intrusion begins with spear-phishing emails designed to lure recipients into opening weaponized Linux shortcut files,” CYFIRMA said . “Once executed, these files silently download and run malicious components in the background while presenting benign content to the user, thereby facilitating stealthy initial access and follow-on exploitation.” The attack culminates with the deployment of a Python-based Remote Administration Tool (RAT) that can collect system information, contact an external server, and run commands, granting the attackers remote control over infected hosts. “The group’s current activity reflects a broader trend in state-aligned espionage operations: the adoption of adaptive, context-aware delivery mechanisms designed to blend seamlessly into the target’s technology landscape,” the company said. Vietnamese IT and HR Firms Targeted by Operation Hanoi Thief — A threat cluster referred to as Operation Hanoi Thief has targeted Vietnamese IT departments and HR recruiters using fake resumes distributed as ZIP files in phishing emails to deliver malware called LOTUSHARVEST.

The ZIP file contains a Windows shortcut (LNK) file that, when opened, executes a “pseudo-polyglot” payload present in the archive that serves as the lure and as well as the container for a batch script that displays a decoy PDF and uses DLL side-loading to load the LOTUSHARVEST DLL. The malware runs various anti-analysis checks and proceeds to harvest data from web browsers such as Google Chrome and Microsoft Edge. The activity has been attributed with medium confidence to a threat cluster of Chinese origin. Microsoft Adds New PowerShell Security Feature — With PowerShell 5.1, Microsoft has added a new feature to warn users when they’re about to execute web content.

The warning will alert users when executing the Invoke-WebRequest command without additional special parameters. “This prompt warns that scripts in the page could run during parsing and advises using the safer -UseBasicParsing parameter to avoid any script execution,” Microsoft said . “Users must choose to continue or cancel the operation. This change helps protect against malicious web content by requiring user consent before potentially risky actions.” The company also said it’s rolling out a new Baseline Security Mode in Office, SharePoint, Exchange, Teams, and Entra that can automatically configure apps with minimum security requirements.

The centralized experience began rolling out in phases last month and will be completed by March next year. “It provides admins with a dashboard to assess and improve security posture using impact reports and risk-based recommendations, with no immediate user impact,” Microsoft said . “Admins can view the tenant’s current security posture compared to Microsoft’s recommended minimum security bar.” U.S. to Require Foreign Travelers to Share 5-Year Social Media History — The U.S.

government will soon require all foreign travelers to provide five years’ worth of social media history prior to their entry. This includes details about social media accounts, email addresses, and phone numbers used over the past five years. The new requirement will be applied to foreigners from all countries, including those who are eligible to visit the U.S. for 90 days without a visa.

“We want to make sure we’re not letting the wrong people enter our country,” U.S. President Donald Trump said. New AitM Phishing Campaign Targets Microsoft 365 and Okta Users — An active adversary-in-the-middle (AitM) phishing campaign is targeting organizations that use Microsoft 365 and Okta for their single sign-on (SSO), with the main goal of hijacking the legitimate SSO flow and bypassing multi-factor authentication (MFA) methods that are not phishing-resistant. “When a victim uses Okta as their identity provider (IdP), the phishing page hijacks the SSO authentication flow to bring the victim to a second-stage phishing page, which acts as a proxy to the organization’s legitimate Okta tenant and captures the victim’s credentials and session tokens,” Datadog said .

Phishing Campaign Uses Fake Calendly Invites to Spoof Major Brands — A large-scale phishing campaign has Calendly-themed phishing lures entered around a fake job opportunity to steal Google Workspace and Facebook business account credentials. These emails purport to originate from brands like Louis Vuitton, Unilever, Lego, and Disney, among others. “Only after the victim has responded to an initial email was the phishing link delivered under the guise of a Calendly link to book time for a call,” Push Security said . “Clicking the link takes the victim to an authentic-looking page impersonating a Calendly landing page.

From there, users are prompted to complete a CAPTCHA check and continue to sign in with their Google account, which causes their credentials to be stolen using an AitM phishing page. A similar variant has also been observed tricking victims into entering their Facebook account credentials on bogus pages, while another targets both Google and Facebook credentials using Browser-in-the-Browser ( BitB ) techniques that display fake pop-up windows featuring legitimate URLs to steal account credentials. The fact that the campaign is focused on compromising accounts responsible for managing digital ads on behalf of businesses shows that the threat actors are looking to launch malvertising campaigns for other kinds of attacks, including ClickFix. This is not the first time job-related lures have been used to steal account information.

In October 2025, phishing emails impersonating Google Careers were used to phish credentials. In tandem, Push Security said it also observed a malvertising campaign in which users who searched for “Google Ads” on Google Search were served a malicious sponsored ad that’s designed to capture their credentials. Calendar Subscriptions for Phishing and Malware Delivery — Threat actors have been found leveraging digital calendar subscription infrastructure to deliver malicious content. “The security risk arises from third-party calendar subscriptions hosted on expired or hijacked domains, which can be exploited for large-scale social engineering,” Bitsight said .

“Once a subscription is established, they can deliver calendar files that may contain harmful content, such as URLs or attachments, turning a helpful tool into an unexpected attack vector.” The attack takes advantage of the fact that these third-party servers can add events directly to users’ schedules. The cybersecurity company said it discovered more than 390 abandoned domains related to iCalendar synchronization (sync) requests for subscribed calendars, potentially putting about four million iOS and macOS devices at risk. All the identified domains have been sinkholed. The Gentlemen Ransomware Uses BYOVD Technique in Attacks — A nascent ransomware group called The Gentlemen has employed tactics common to advanced e-crime groups, such as Group Policy Objects (GPO) manipulation and Bring Your Own Vulnerable Driver (BYOVD), as part of double extortion attacks aimed at manufacturing, construction, healthcare, and insurance sectors across 17 countries.

“Since its emergence, Gentlemen has been evaluated as one of the most active emerging ransomware groups in 2025, having attacked multiple regions and industries in a relatively short period,” AhnLab
said
. The group emerged around July 2025, with PRODAFT
noting
in mid-October that Phantom Mantis (ArmCorp), led by LARVA-368 (hastalamuerte), tested
Qilin
(Pestilent Mantis), Embargo (Primeval Mantis), LockBit (Tenacious Mantis), Medusa (Venomous Mantis), and BlackLock (Incredible Mantis), before building their own ransomware-as-a-service (RaaS): The Gentlemen. 🎥 Cybersecurity Webinars
Defining the New Layers of Cloud Defense with Zero Trust and AI: This webinar shows how Zero Trust and AI help stop modern, fileless attacks. Zscaler experts explain new tactics like “living off the land” and fileless reassembly, and how proactive visibility and secure developer environments keep organizations ahead of emerging threats.
Speed vs. Security: How to Patch Faster Without Opening New Doors to Attackers: This session explores how to balance speed and security when using community patching tools like Chocolatey and Winget. Gene Moody, Field CTO at Action1, examines real risks in open repositories—outdated packages, weak signatures, and unverified code—and shows how to set clear guardrails that keep patching fast but safe. Attendees will learn when to trust community sources, how to detect version drift, and how to run controlled rollouts without slowing operations.
🔧 Cybersecurity Tools
Strix: A small open-source tool that helps developers build command-line interfaces (CLIs) more easily. It focuses on keeping setup simple and commands clear, so you can create tools that behave the same way every time. Instead of dealing with complex frameworks, you can use Strix to define commands, handle arguments, and manage output in a few straightforward steps. Heisenberg; It is a simple, open-source tool that looks at the software your projects depend on and checks how healthy and safe those parts are.

It reads information about packages from public sources and “software bills of materials” (SBOMs) to find security problems or bad signals in your dependency chain and can produce reports for one package or many at once. The idea is to help teams spot risky or vulnerable components early, especially as they change, so you can understand supply chain risks without a complex setup. Disclaimer: These tools are for learning and research only. They haven’t been fully tested for security.

If used the wrong way, they could cause harm. Check the code first, test only in safe places, and follow all rules and laws. Conclusion We listed a lot of fixes today, but reading about them doesn’t secure your device—installing them does. The attackers are moving fast, so don’t leave these updates for ‘later.’ Take five minutes right now to check your systems, restart if you need to, and head into the weekend knowing you are one step ahead of the bad guys.

Found this article interesting? Follow us on Google News , Twitter and LinkedIn to read more exclusive content we post.

A Browser Extension Risk Guide After the ShadyPanda Campaign

In early December 2025, security researchers exposed a cybercrime campaign that had quietly hijacked popular Chrome and Edge browser extensions on a massive scale. A threat group dubbed ShadyPanda spent seven years playing the long game, publishing or acquiring harmless extensions, letting them run clean for years to build trust and gain millions of installs, then suddenly flipping them into malware via silent updates. In total, about 4.3 million users installed these once-legitimate add-ons, which suddenly went rogue with spyware and backdoor capabilities. This tactic was essentially a browser extension supply-chain attack.

The ShadyPanda operators even earned featured and verified badges in the official Chrome Web Store and Microsoft Edge Add-ons site for some extensions, reinforcing user confidence. Because extension updates happen automatically in the background, the attackers were able to push out malicious code without users noticing a thing. Once activated in mid-2024, the compromised extensions became a fully fledged remote code execution (RCE) framework inside the browser. They could download and run arbitrary JavaScript with full access to the browser’s data and capabilities.

This gave the attackers a range of spyware powers, from monitoring every URL and keystroke, to injecting malicious scripts into web pages, to exfiltrating browsing data and credentials. One of the worst capabilities was session cookie and token theft, stealing the authentication tokens that websites use to keep users logged in. The extensions could even impersonate entire SaaS accounts (like Microsoft 365 or Google Workspace) by hijacking those session tokens. Why Browser Extensions Are a SaaS Security Nightmare For SaaS security teams, ShadyPanda’s campaign shows us a lot.

It proved that a malicious browser extension can effectively become an intruder with keys to your company’s SaaS kingdom. If an extension grabs a user’s session cookie or token, it can unlock that user’s accounts in Slack, Salesforce, or any other web service they’re logged into. In this case, millions of stolen session tokens could have led to unauthorized access to enterprise emails, files, chat messages, and more, all without triggering the usual security alarms. Traditional identity defenses like MFA were bypassed, because the browser session was already authenticated and the extension was piggybacking on it.

The risk extends beyond just the individual user. Many organizations allow employees to install browser extensions freely, without the scrutiny applied to other software. Browser extensions often slip through without oversight, yet they can access cookies, local storage, cloud auth sessions, active web content, and file downloads. This blurs the line between endpoint security and cloud security.

A malicious extension can be run on the user’s device (an endpoint issue), but it directly compromises cloud accounts and data (an identity/SaaS issue). ShadyPanda vividly shows the need to bridge endpoint and SaaS identity defense: security teams should think about treating the browser as an extension of the SaaS attack surface. Steps to Reduce Browser Extension Risk So based on all of this, what can organizations do to reduce the risk of another ShadyPanda situation? Below is a practical guide with steps to tighten your defenses against malicious browser extensions.

Enforce Extension Allow Lists and Governance Start by regaining control over which extensions can run in your environment. Conduct an audit of all extensions installed across the company’s browsers (both corporate-managed and BYOD if possible) and remove any that are unnecessary, unvetted, or high risk. It’s wise to require business justification for extensions that need broad permissions (for example, any addon that can read all website data).

Use enterprise browser management tools to implement an allow list so that only approved extensions can be installed. This policy ensures new or unknown extensions are blocked by default, cutting off the long tail of random installs. Remember that popular extensions aren’t automatically safe, ShadyPanda’s malware hid in popular, trusted extensions that people had used for years. Treat all extensions as guilty until proven innocent by vetting them through your security team’s approval process.

Treat Extension Access Like OAuth Access Shift your mindset to treat browser extensions similarly to third-party cloud apps in terms of the access they grant. In practice, this means integrating extension oversight into your identity and access management processes. Just as you might keep a catalog of authorized OAuth integrations, do the same for extensions.

Map out what SaaS data or actions an extension could touch - for example, if an extension can read all web traffic, it effectively can read your SaaS application data in transit; if it can read cookies, it can impersonate the user on any service. Because malicious extensions can steal session tokens, your identity security tools should watch for signs of session hijacking: configure alerts for bizarre login patterns, like an OAuth token being used from two different locations, or an access attempt that bypasses MFA checks. The key point is to manage extensions with the same caution as any app that has been granted access to your data. Limit extension permissions where possible, and if an employee leaves the company or changes roles, ensure that high-risk extensions are removed just as you would revoke unneeded app access.

Audit Extension Permissions Regularly Make extension review a recurring part of your security program, similar to quarterly access reviews or app assessments. Every few months, inventory the extensions and their permissions in use across your organization. Pay attention to what data or browser features each extension can access.

For each extension, ask: Do we still need this? Has it requested any new permissions? Has its developer or ownership changed? Attackers often buy out benign extensions or slip in new maintainers before pushing bad updates.

By reviewing the extension publisher and update history, you can spot red flags. Also, watch for any extension that suddenly asks for broader permissions than before – that’s a clue it may have turned malicious. 4. Monitor for Suspicious Extension Behavior Because browsers usually auto-update extensions silently, a trusted add-on can become malicious overnight with no obvious warning to the user.

Security teams should therefore implement monitoring to catch silent compromise. This can include technical measures and user-awareness cues. On the technical side, consider logging and analyzing extension activity: for example, monitor browser extension installations, update events, or unusual network calls from extensions (like frequent communication with unknown external domains). Some organizations inspect browser logs or use endpoint agents to flag if an extension’s files change unexpectedly.

If possible, you might restrict or stage extension updates - for instance, testing updates on a subset of machines before wide deployment. On the user side, educate employees to report if an extension that has been installed for a long time suddenly starts behaving differently (new UI changes, unexpected pop-ups, or performance issues could hint at a malicious update). The goal is to shorten the window between an extension going bad and your team detecting and removing it. Bridging Endpoint and SaaS Security (How Reco Can Help) The ShadyPanda incident shows that attackers don’t always need zero-day exploits to infiltrate our systems; sometimes, they just need patience, user trust, and an overlooked browser extension.

For security teams, it’s a lesson that browser extensions are part of your attack surface. The browser is effectively an endpoint that sits between your users and your SaaS applications, so it’s important to bring extension management and monitoring into your overall security strategy. By enforcing allow lists, auditing permissions, monitoring updates, and treating extensions like the powerful third-party apps they are, you can drastically reduce the risk of an extension becoming your weakest link. Finally, consider how modern SaaS security platforms can support these efforts.

New solutions, such as dynamic SaaS security platforms, are emerging to help organizations get a handle on these kinds of risks. Reco’s Dynamic SaaS Security platform is designed to continuously map and monitor SaaS usage (including risky connected apps and extensions) and provide identity-driven threat detection. With the right platform, you can gain unified visibility into extensions across your environment and detect suspicious activity in real time. Reco can help bridge the gap between endpoint and cloud by correlating browser-side risks with SaaS account behavior, giving security teams a cohesive defense.

By taking these proactive steps and leveraging tools like Reco to automate and scale your SaaS security, you can stay one step ahead of the next ShadyPanda. Request a Demo: Get Started With Reco . Note : This article is expertly written and contributed by Gal Nakash, Co-founder & CPO of Reco. Gal is a former Lieutenant Colonel in the Israeli Prime Minister’s Office.

He is a tech enthusiast with a background as a security researcher and hacker. Gal has led teams in multiple cybersecurity areas, with expertise in the human element. Found this article interesting? This article is a contributed piece from one of our valued partners.

Phantom Stealer Spread by ISO Phishing Emails Hitting Russian Finance Sector

Cybersecurity researchers have disclosed details of an active phishing campaign that’s targeting a wide range of sectors in Russia with phishing emails that deliver Phantom Stealer via malicious ISO optical disc images. The activity, codenamed Operation MoneyMount-ISO by Seqrite Labs, has primarily singled out finance and accounting entities, with those in the procurement, legal, payroll verticals emerging as secondary targets. “This campaign employs a fake payment confirmation lure to deliver the Phantom information-stealing malware through a multi-stage attachment chain,” the cybersecurity company said . The infection chain begins with a phishing email that masquerades as legitimate financial communications, urging recipients to confirm a recent bank transfer.

Attached to the email is a ZIP archive that claims to contain additional details, but, instead, contains an ISO file that, when launched, mounts on the system as a virtual CD drive. The ISO image (“Подтверждение банковского перевода.iso” or “Bank transfer confirmation.iso”) serves as an executable that’s designed to launch Phantom Stealer by means of an embedded DLL (“CreativeAI.dll”). Phantom Stealer is capable of extracting data from cryptocurrency wallet browser extensions installed in Chromium-based browsers and desktop wallet apps, as well as grab files, Discord authentication tokens, and browser-related passwords, cookies, and credit card details. It also monitors clipboard content, logs keystrokes, and runs a series of checks to detect virtualized, sandboxed, or analysis environments, and if so, aborts its execution.

Data exfiltration is achieved via a Telegram bot or to an attacker-controlled Discord webhook. On top of that, the stealer enables file transfer to an FTP server. In recent months, Russian organizations, mainly human resources and payroll departments, have also been targeted by phishing emails that employ lures related to bonuses or internal financial policies to deploy a previously undocumented implant named DUPERUNNER that loads AdaptixC2 , an open-source command-and-control (C2) framework. Dubbed DupeHike , the campaign has been attributed to a threat cluster named UNG0902.

“The ZIP has been used as a preliminary source of spear-phishing-based infection containing decoys with PDF and LNK extension, which downloads the implant DUPERUNNER, which finally executes the Adaptix C2 Beacon,” Seqrite said. The LNK file (“Документ_1_О_размере_годовой_премии.pdf.lnk” or “Document_1_On_the_amount_of_the_annual_bonus.pdf.lnk”), in turn, proceeds to download DUPERUNNER from an external server using “powershell.exe.” The primary responsibility of the implant is to retrieve and display a decoy PDF and launch AdaptixC2 by injecting it into a legitimate Windows process like “explorer.exe,” “notepad.exe,” and “msedge.exe.” Other phishing campaigns have taken aim at finance, legal, and aerospace sectors in Russia to distribute Cobalt Strike and malicious tools like Formbook, DarkWatchman, and PhantomRemote that are capable of data theft and hands-on keyboard control. The email servers of compromised Russian companies are used to send the spear-phishing messages. French cybersecurity company Intrinsec has attributed the intrusion set targeting the Russian aerospace industry to hacktivists aligned with Ukrainian interests.

The activity, detected between June and September 2025, shares overlaps with Hive0117 , Operation CargoTalon , and Rainbow Hyena (aka Fairy Trickster, Head Mare, and PhantomCore). Some of these efforts have also been found to redirect users to phishing login pages hosted on the InterPlanetary File System ( IPFS ) and Vercel, designed to steal credentials associated with Microsoft Outlook and Bureau 1440, a Russian aerospace company. “The campaigns observed between June and September 2025 […] aimed at compromising entities actively cooperating with Russia’s army amidst the current conflict with Ukraine, largely assessed by the Western sanctions imposed on them,” Intrinsec said . Found this article interesting?

VolkLocker Ransomware Exposed by Hard-Coded Master Key Allowing Free Decryption

The pro-Russian hacktivist group known as CyberVolk (aka GLORIAMIST) has resurfaced with a new ransomware-as-a-service (RaaS) offering called VolkLocker that suffers from implementation lapses in test artifacts, allowing users to decrypt files without paying an extortion fee. According to SentinelOne, VolkLocker (aka CyberVolk 2.x) emerged in August 2025 and is capable of targeting both Windows and Linux systems. It’s written in Golang. “Operators building new VolkLocker payloads must provide a bitcoin address, Telegram bot token ID, Telegram chat ID, encryption deadline, desired file extension, and self-destruct options,” security researcher Jim Walter said in a report published last week.

Once launched, the ransomware attempts to escalate privileges, performs reconnaissance and system enumeration, including checking local MAC address prefixes against known virtualization vendors like Oracle and VMware. In the next stage, it lists all available drives and determines the files to be encrypted based on the embedded configuration. VolkLocker uses AES-256 in Galois/Counter Mode ( GCM ) for encryption through Golang’s “crypto/rand” package. Every encrypted file is assigned a custom extension such as .locked or .cvolk.

However, an analysis of the test samples has uncovered a fatal flaw where the locker’s master keys are not only hard-coded in the binaries, but are also used to encrypt all files on a victim system. More importantly, the master key is also written to a plaintext file in the %TEMP% folder (“C:\Users\AppData\Local\Temp\system_backup.key”). Since this backup key file is never deleted, the design blunder enables self-recovery. That said, VolkLocker has all the hallmarks typically associated with a ransomware strain.

It makes Windows Registry modifications to thwart recovery and analysis, deletes volume shadow copies, and terminates processes associated with Microsoft Defender Antivirus and other common analysis tools. However, where it stands out is in the use of an enforcement timer, which wipes the content of user folders, viz. Documents, Desktop, Downloads, and Pictures, if victims fail to pay within 48 hours or enter the wrong decryption key three times. CyberVolk’s RaaS operations are managed through Telegram, costing prospective customers between $800 and $1,100 for either a Windows or Linux version, or between $1,600 and $2,200 for both operating systems.

VolkLocker payloads come with built-in Telegram automation for command-and-control, allowing users to message victims, initiate file decryption, list active victims, and get system information. As of November 2025, the threat actors have advertised a remote access trojan and keylogger, both priced at $500 each, indicating a broadening of their monetization strategy. CyberVolk launched its own RaaS in June 2024. Known for conducting distributed denial-of-service (DDoS) and ransomware attacks on public and government entities to support Russian government interests, it’s believed to be of Indian origin .

“Despite repeated Telegram account bans and channel removals throughout 2025, CyberVolk has reestablished its operations and expanded its service offerings,” Walter said. “Defenders should see CyberVolk’s adoption of Telegram-based automation as a reflection of broader trends among politically-motivated threat actors. These groups continue to lower barriers for ransomware deployment while operating on platforms that provide convenient infrastructure for criminal services.” Found this article interesting? Follow us on Google News , Twitter and LinkedIn to read more exclusive content we post.