LiteLLM deployments can expose far more than an organization’s AI spending. Newly disclosed weaknesses in the open-source gateway could let attackers run code as root inside a container, reach connected tools, and retrieve cloud credentials that open a path into a wider environment.

The risk is serious where the service is internet-facing or retains its example master key. A gateway sits between applications, model providers, internal data, and automation, so its compromise can turn one overlooked service into a central point of failure.

Researchers at Wiz.io identified the issues while examining public LiteLLM installations. Their scan of 3,074 internet-facing instances found that 294, or 9.6%, accepted a default master key or had no authentication enabled.

Wiz.io said in a report shared with Cyber Security News (CSN) that the MCP authentication bypass, tracked as CVE-2026-59822, was observed in the wild through its honeypot systems.

CISA added the flaw to its Known Exploited Vulnerabilities catalog on September 2, increasing urgency for organizations with reachable instances.

LiteLLM Flaws Let Attackers Execute Code

CVE-2026-59821 affects LiteLLM’s Custom Code Guardrails feature, which lets administrators supply Python-like policies that run around model requests.

Before the fix, the endpoint used to register a guardrail did not apply the safety checks present in the testing interface, allowing supplied code to execute immediately.

The result could be root-level command execution in the LiteLLM container when an attacker had administrative access.

That access may be available where authentication is absent, the default master key remains, or another administrative weakness is abused. Readers can compare it with the earlier LiteLLM admin API flaw, which affected configuration controls.

The RCE requires an authenticated administrator and cannot be reached solely through the MCP bypass. Yet weak deployment settings can remove that barrier.

In releases before version 1.82.0, an unchanged default credential could make the code-execution path effectively available before normal authentication.

The MCP issue creates a different entry point. A meaningless Bearer token could establish a valid session with a connected MCP server, potentially allowing an intruder to use available database, repository, file-system, or workflow tools.

This differs from the LiteLLM RCE exploitation in the wild, which involved another vulnerability chain. LiteLLM corrected the guardrail weaknesses in release 1.82.0 by enforcing an administrator role and applying sandbox protections during registration.

It later fixed the MCP authentication bypass in version 1.84.0. Organizations should identify their version, patch promptly, and check for exposed older containers or test instances.

Cloud Keys at Risk

The findings show why AI gateways require the protection given to other privileged cloud services. LiteLLM may hold provider API keys and communicate with internal systems, while its workload identity can carry permissions to invoke models, read secrets, or interact with other cloud services.

A pass-through feature can forward requests to an administrator-defined destination without checking whether it is an internal address or cloud metadata service. With administrator access, an attacker could use it to obtain temporary AWS IAM credentials.

It is not a standalone vulnerability, but it becomes hazardous when access controls fail. The configuration-update route controlling pass-through settings also lacked an administrator check before version 1.83.0, a separate issue tracked as CVE-2026-35029.

The pattern is reflected in AI infrastructure credential theft, where exposed gateways can bridge attackers to secrets, persistence, and costly resource misuse.

Administrators should replace example credentials with a strong, unique master key and review guardrails for unexpected entries. Restarting the process can clear code retained in memory.

They should audit pass-through settings, restrict container outbound traffic, and apply least-privilege IAM permissions to workload identities.

Remove management interfaces from the public internet and limit access to trusted networks and authenticated administrators.

Rotate provider keys and cloud credentials if an exposed vulnerable instance might have been accessed, then review logs for suspicious administrative activity and unusual outbound requests.

The LiteLLM supply chain exposure likewise shows why gateways need careful configuration, identity, and update control.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post LiteLLM Flaws Let Attackers Execute Code as Root and Steal Cloud Credentials appeared first on Cyber Security News.

Mac users seeking AI tools face a malware trap. Attackers are using fake Claude and ChatGPT installers and sponsored search results to push MacSync, a macOS password stealer.

The campaign relies on persuasion instead of a software flaw. A visitor is told that a download, connection, or verification step has failed, then instructed to copy a command into Terminal. That single action gives the attacker a route into the device.

MacSync is a malware-as-a-service operation, meaning its developers supply the tool and infrastructure to other criminal groups. Researchers said the threat emerged in 2025.

The risk goes beyond a stolen password. MacSync is designed to gather browser logins, session cookies, Mac Keychain data, SSH keys, cloud credentials, messaging sessions, and cryptocurrency wallet information.

SEQRITE said in a report shared with Cyber Security News (CSN) that it can also establish lasting access, leaving personal accounts and workplace systems exposed.

Hackers Use Fake Claude and ChatGPT Installers

The first stage often begins with a search for a desktop AI app. Criminals buy or manipulate search placements and send people to pages that imitate Claude AI, ChatGPT, developer tools, or other trusted services.

A previous report on malicious macOS Google ads shows how paid results can steer high-intent users toward a fraudulent AI download page. Instead of providing a normal application package, the page displays a ClickFix prompt.

These prompts may claim a WebSockets connection needs repair, a CAPTCHA must be completed, or an audio problem requires attention. Victims are asked to paste a helpful-looking command into Terminal, starting the infection themselves.

That technique is effective because it turns the user into the final delivery step. Traditional warning signs, such as an unsolicited attachment, may be absent.

The wider pattern was documented in coverage of macOS ClickFix credential theft, where fake verification pages similarly pushed commands to Mac users. After execution, a shell script launches a background component and unpacks the native MacSync stager.

The stager detaches from the Terminal session, suppresses visible output, and retrieves further instructions from attacker-controlled infrastructure. This layered design lets operators change later payloads.

Stealer Collects Data Quietly

MacSync downloads an AppleScript directly into memory and runs it through a built-in macOS automation utility, rather than saving the script as an obvious file.

The script can display a password request that resembles a system dialog, then collect credentials and other data from the compromised Mac.

The malware packages information, including browser vaults and wallet databases, before sending it to its operators in fixed-size pieces.

If a transfer fails, it retries with increasing delays. After a successful upload, it removes temporary material to reduce evidence for users or incident responders.

It can then deploy a remote-access component that uses the macOS launch mechanism to start after login. A helper program may also request screen-recording permission, giving criminals another opportunity to watch activity or capture sensitive content.

The result is a campaign that can move from a fake installer to account takeover and surveillance. The findings fit a broader rise in AI-themed malware delivery.

In another case, a weaponized ChatGPT download site used sponsored results and fake download choices to target both Mac and Windows users. Familiar branding lowers suspicion when people are looking for new tools or quick fixes.

Users should avoid sponsored links when downloading software and go to a vendor’s official website by typing the address or using a trusted bookmark.

They should never paste a command from a web page, chat, ad, or support message into Terminal unless they fully understand it and have independently verified its source.

Security teams should block the listed infrastructure, investigate unexpected command-line activity launched from browsers, and check Macs for unfamiliar launch items and permission requests.

Resetting passwords alone may not be enough after an infection; affected users should revoke active sessions, rotate exposed keys, and have the device examined for persistence.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Hackers Use Fake Claude and ChatGPT Installers to Infect Mac Users With Password-Stealing Malware appeared first on Cyber Security News.

Android banking fraud is entering a deceptive phase. Attackers are using malware that copies targeted banking apps into a concealed Android work profile, separating a fraudulent session from warning signs seen on the phone.

The operation begins with Gigabud, an Android remote-access trojan active since 2022. Victims are lured through phishing sites, messaging apps, or social-media posts into sideloading fake airline, tax, or government applications, while fake banking app downloads can turn a brand into a trap.

Group-IB analysts identified Vwork, a modified version of the open-source Shelter app cloner, appearing minutes after Gigabud infections alongside tampered banking applications.

The researchers link the activity to GoldFactory and found compatible samples targeting Brazil, Colombia, Egypt, Indonesia, Laos, Mexico, Morocco, the Philippines, Thailand, Türkiye, and a Gulf Cooperation Council member state.

Group-IB said in a report shared with Cyber Security News (CSN) that from February through July 2026, researchers observed about 1,469 compromised devices and 1,281 potentially compromised logins in Indonesia, with estimated losses of roughly $960,939.

Those figures reflect observed activity rather than the full scope, but show why Android banking trojan campaigns remain a concern.

Hackers Clone Banking Apps Into Hidden Android Work Profiles

Gigabud first asks for Accessibility access, permission to draw over other apps, and battery-saving exemption. If a victim agrees, operators can remotely control the device, list installed apps, place fake login screens over real banking apps, and capture the device lock-screen code.

The next stage is simple but effective. The operator installs Vwork, which creates an isolated work profile and clones a banking app into it. In a confirmed Indonesian case, the cloned app was a fake version of a bank application.

Android keeps applications in separate profiles isolated. That boundary is intended to protect work and personal data, but attackers use it to make the banking session look new.

A security signal tied to malware in the personal profile may not follow the cloned application into the work profile. The operator can then conduct transactions through the clean-looking profile while hiding activity behind a black screen.

The bank may see a new environment rather than the already-flagged personal profile, weakening the connection between device risk and a fraudulent transfer. Similar hidden remote-control Android attacks demonstrate how control features can be concealed from victims.

Vwork reduces visible clues. Its launcher icon is hidden and cloning functions can be controlled by another app. Gigabud includes commands to initialize Vwork, clone an application, and upload the clone list, showing the tools were designed to work together.

Phishing Delivery and Defensive Signals

An early warning is a consumer phone unexpectedly creating an isolated work profile. A banking app installed across profiles, a nearly empty profile, or a second suspicious installation shortly afterward should raise risk.

For users, the advice is simple: install applications only from official stores, reject Accessibility requests from apps that are not genuine accessibility tools, and use a banking second factor that does not depend on SMS. A raw app file sent through a chat is not a legitimate bank distribution channel.

Banks and wallet providers should bind logins to trusted devices, examine unusual session actions, and block high-risk transactions when an unrecognized app has active Accessibility access. Detection should combine signatures with behavior, rather than assuming one malware alert is enough.

This case underlines a broader shift in mobile fraud. Attackers combine social engineering, overlays, remote access, and Android features meant for legitimate separation. banking PIN theft malware shows how overlays and device control can scale financial theft.

The key lesson is that a clean-looking banking session is not always a clean device. Security teams should treat unexpected work-profile creation, cross-profile application duplication, and accessibility abuse as linked warning signs.

That approach can expose the fraud path before a transfer is completed. It also helps teams distinguish ordinary work use from coordinated account takeover before funds leave an account during urgent financial fraud investigations.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Hackers Clone Banking Apps Into Hidden Android Work Profiles to Evade Fraud Detection appeared first on Cyber Security News.

Cybercriminals are using autonomous AI agents to turn compromised cloud systems into fast-moving credential theft platforms.

In one recent case, attackers planned, built, and launched a large-scale campaign in less than six hours, stealing thousands of third-party credentials.

The operation shows how attackers can combine AI coding tools, automated scanning, and cloud resources to work at a speed that previously required a larger team and far more time.

Rather than manually checking systems and fixing errors, the agents handled much of the work themselves. Analysts from Google Cloud identified the activity while tracking the growing use of AI-driven automation in real-world intrusions. 

Google Cloud said in a report shared with Cyber Security News (CSN) that the attackers used an AI coding chatbot, a prompt, and preconfigured instructions to carry out the campaign.

The incident is part of a broader shift in cybercrime. Attackers are increasingly using AI to scan for weaknesses, create phishing content, write malicious code, steal secrets, and maintain access after an initial break-in. This trend makes rapid detection and strong cloud security more important than ever.

Hackers Use Autonomous AI Agents

The financially motivated attackers first compromised an organization’s cloud infrastructure, then used it as the launch point for their operation.

Working from a trusted cloud environment helped their traffic appear more legitimate and made it harder for defenders to quickly separate malicious activity from normal services.

The AI-driven framework used written instruction files as operating playbooks. These instructions guided the agents through vulnerability scanning, credential collection, troubleshooting, and IP address rotation without requiring constant human decisions.

The result was a campaign that harvested credentials at a scale normally associated with much larger criminal groups.

This differs from traditional information stealers, which usually wait for a victim to run malicious software and then collect data from that device.

In this case, the agents actively searched server-side systems, identified weaknesses, and carried out targeted actions against online infrastructure.

The campaign highlights the risks outlined in recent reporting on AI agents breach company networks, where automated agents can map services, locate exposed tokens, and move toward valuable administrative access.

Once valid credentials are collected, criminals can reuse them for cloud access, fraud, espionage, extortion, or additional attacks.

Researchers also found an exposed command-and-control server hosting a separate automated reconnaissance and credential management framework called Recon.

Its dashboard was designed to organize, validate, and manage more than 23,800 stolen secrets in real time, including API keys connected to cloud and AI services.

The source report illustrates how attackers combined compromised cloud resources, AI-generated instructions, automated scanning, and credential harvesting into a single accelerated operation.

Cloud and Developer Systems Face Growing Risk

The attack demonstrates why cloud credentials and developer environments have become high-value targets. A single exposed access token can give attackers a trusted path into cloud services, source code repositories, automation pipelines, and sensitive business data.

The risks are similar to those described in stolen cloud credentials attacks, where valid keys can let intruders enter as approved users.

AI coding environments can create additional openings when developers download unsafe packages, clone altered repositories, or allow tools to process untrusted workspace files.

In related activity, the UNC6780 group used compromised developer accounts to distribute trojanized resources and targeted CI/CD environments for authentication tokens.

The DUSTMAKER credential stealer was also observed hiding files inside common AI coding workspace directories.

It could use malicious configuration files to influence an assistant into running scripts during routine development work, while fake pipeline tasks disguised as AI utilities searched for extra tokens and keys.

Organizations should treat AI tool configurations, developer tokens, and cloud API keys as sensitive credentials.

Security teams should rotate exposed keys quickly, apply least-privilege permissions, protect CI/CD runners, review third-party dependencies, and investigate unexpected automation tasks or workspace configuration changes.

Teams should also monitor cloud activity for unusual API calls, unfamiliar service accounts, unexpected public services, and suspicious outbound scanning.

Guidance from coverage of typosquatted npm package theft shows why dependency checks and secret scanning remain essential for development teams.

The findings do not mean autonomous exploitation is now common across every intrusion. However, they show that AI agents can reduce the delay between compromise and credential theft.

Defenders need controls that can detect abuse at the same pace, especially as attackers continue combining AI automation with familiar methods such as stolen credentials, exposed services, and malicious packages.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Hackers Use Autonomous AI Agents to Launch Mass Credential Theft Attacks in Under 6 Hours appeared first on Cyber Security News.

Cybercriminals are widening the reach of information-stealing malware by targeting the local data created by AI coding agents.

The shift puts access tokens, saved connections, prompt histories, and project records at risk on already infected computers. The activity does not point to a newly discovered flaw in Claude, Cursor, or Codex.

Instead, it shows criminals adapting established stealers to collect valuable files stored in predictable local folders, a concern echoed in reporting on Claude session theft involving browser-based account access. Analysts at Gen Digital identified the expanding collection rules after examining recent malware activity.

Gen Digital said in a report shared with Cyber Security News (CSN) that the findings concern locally installed development agents, not a direct compromise of an AI model or agent.

The impact can extend well beyond a single paid account. A stolen archive may give criminals both a reusable way into an account and the context needed to identify sensitive projects, connected services, and people worth targeting with follow-on fraud or phishing.

Hackers Target Claude, Cursor and Codex AI Agents

Over a three-month period, Gen Digital recorded Amatera and Remus detections among tens of thousands of protected Windows users.

Amatera focused on data linked to Cline and Continue, while Remus targeted Claude, Cursor, and OpenCode, indicating that agent data has entered the broader infostealer economy.

CallbackBeaver has also added Cursor and Claude to its collection scope, with more than 5,000 samples seen in a 30-day period.

BeeStealer, STG Stealer, HydraStealer, APEX Stealer, and Otter Stealer illustrate how quickly the technique is spreading, while macOS-focused Djinn Stealer has been associated with Claude, Codex, Gemini, Cline, OpenCode, and Kilo.

Criminals do not necessarily need to rebuild a payload to add a newly popular tool. Many stealers use remotely managed rules that specify folders, file names, databases, extensions, and search limits, so adding another target may amount to a configuration update delivered to machines that are already compromised.

That low barrier matters because a local agent directory can contain far more than settings. Security teams investigating AI agent artifacts should consider authentication files, conversation databases, recent-project data, and connected-service settings as high-value endpoint material, alongside browser profiles and cloud command-line credentials.

Stolen Tokens Expose Work Context

Some agents keep access tokens or refresh tokens locally to avoid requiring a fresh login every session. A stolen access token may let an attacker use an account until it expires, and a refresh token can sometimes extend that window, enabling paid API abuse or resale of working access.

MCP configurations can raise the stakes further. These files may hold endpoints, headers, environment variables, API keys, or other authentication details for external tools, meaning reusable secrets could expose source control, ticketing, databases, cloud resources, or collaboration services connected to the agent.

Prompt histories and transcripts are equally useful to intruders. Developers often use assistants to examine code, analyze logs, and solve incidents, and their chats may reveal source code, internal hostnames, repository names, deployment details, or secrets pasted during troubleshooting.

Related MCP security weaknesses show why connected tools need careful oversight. Organizations should inventory the agents in use, review what they store locally, and use operating-system-protected credential storage where available.

They should keep passwords, private keys, API secrets, and customer data out of prompts, give connected tools only necessary permissions, and favor short-lived, narrowly scoped tokens.

After a suspected stealer infection, responders should work from a clean device to revoke AI sessions, rotate API keys and other connected credentials, review account activity, and determine whether local conversations exposed company information.

Multi-factor authentication remains important, but it may not prevent replay of a token that malware has already copied. Users should also keep endpoints and applications updated and avoid ClickFix or FakeCaptcha instructions, cracked software, and unofficial installers, which are common delivery routes for stealers.

Teams deploying coding agents at scale can apply lessons from AI agent approval flaws by reviewing trusted projects, connections, and access boundaries before they become an attacker’s shortcut. The targeting will likely grow as workplace adoption expands.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Hackers Target Claude, Cursor and Codex AI Agents to Steal Tokens and Prompt Histories appeared first on Cyber Security News.

Hackers are using Google Sheets as an unlikely control channel in a cryptocurrency theft campaign. The operation turns a familiar browser session into a place where malicious code runs, rather than placing a conventional program on a victim’s computer.

The attackers promote a fake report claiming to expose profitable flaws at cryptocurrency swap services. Victims are told to paste JavaScript into Chrome’s address bar or add it to a browser extension, allowing the code to run on the trading site they are visiting.

The campaign began with ClickFix-style lures in October 2025 and adopted Google’s Visualization API in March 2026.

The researchers found messages on Telegram, DarkForums, email, and paste sites, targeting people interested in trading, coding, hacking, and quick financial gains. The result is a wallet-address swap at the moment a user expects to make a deposit.

Cisco Talos said in a report shared with Cyber Security News (CSN) that they identified 49 Bitcoin addresses used by the operation; 24 received a combined 0.159 BTC, valued at about $10,000 in early August 2026, although the actual total may be higher.

Hackers Abuse Google Sheets

This campaign changes the familiar ClickFix formula. Instead of asking a user to open Run or a terminal, the lure asks them to alter their browser. Requests for the next attack stage can therefore look like normal traffic to a trusted Google service.

The first lure described a fabricated API flaw that supposedly delivered around 38 percent higher payouts on SwapZone. A later version claimed a SimpleSwap loyalty feature could provide a 25 percent bonus, then instructed users to install Tampermonkey and paste in a loader script.

That evolution echoes how recent ClickFix delivery campaigns rely on a person to complete the dangerous action.

Here, the loader retrieves hidden, scrambled JavaScript from cells in a publicly published Google Sheet using the Visualization API, joins the code together, and injects it into the active page.

The malicious code behaves like a web skimmer. It watches the transaction page, changes displayed deposit addresses, intercepts web responses that contain wallet data, and replaces copied addresses in the clipboard with an attacker-controlled alternative.

It also adds false bonus information to make a transaction seem more attractive. The extension-based version gives the attackers an added advantage: persistence. Each time the target returns to the selected trading site, the loader can reconstruct and insert the payload again.

The operators also changed their Sheet and hosting setup after takedown efforts, making simple disruption short lived. The danger extends beyond cryptocurrency trading.

A compromised extension, web dependency, or customer-facing application could use similar browser-side tricks to quietly modify forms or information.

The abuse of recognized online services resembles trusted mirror ClickFix abuse, where a credible host can make a harmful page appear less suspicious.

Defending Against Browser-Based Lures

Users should treat any online claim of a secret trading bonus, exploit, or special API access as a warning sign. No website should require visitors to paste code into the address bar, developer console, terminal, or browser extension to unlock a legitimate feature.

This case also reinforces lessons from fake verification page attacks, in which a convincing prompt shifts execution to the victim. Before sending funds, users should compare the address shown on screen with the address copied to the clipboard and verify it through a trusted channel.

Organizations should control browser extensions by role and limit developer-level browser functions where they are not required.

Security teams should investigate unusual requests to Google Docs from browser sessions without normal document activity, especially after an employee visits untrusted forums or links.

Web application owners should test third-party code and remove unexplained, heavily obfuscated JavaScript. The campaign’s methods overlap with browser-based ClickFix techniques, but its public spreadsheet use shows why network trust alone is not enough to judge whether a web request is safe.

Training should focus on behavior, not just blocked domains. Employees and customers need clear guidance that copying code from a document, message, or trading “research” page can hand an attacker control of the browser session, even when the destination appears to be a well-known service.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Hackers Abuse Google Sheets to Hijack Crypto Wallet Addresses in ClickFix Attacks appeared first on Cyber Security News.

A new U.S. government advisory has raised concerns over large-scale attempts to copy the capabilities of leading artificial intelligence systems.

The activity did not involve conventional malware, but instead focused on harvesting model outputs at a scale that could accelerate rival AI development.

The alleged campaigns relied on huge volumes of automated requests sent through application programming interfaces, cloud services, aggregators, and proxy networks.

CISA said in a report shared with Cyber Security News (CSN) that by collecting responses from advanced AI models, operators could create synthetic datasets designed to teach other systems how to perform similar tasks.

Analysts from the Cybersecurity and Infrastructure Security Agency, alongside the NSA and FBI, said China-based AI companies likely extracted billions of tokens across millions of exchanges from U.S. frontier models since late 2024.

The advisory describes the activity as malicious industrial-scale knowledge distillation rather than routine AI research. The reported impact reaches beyond unauthorized access to a single platform.

CISA warned that extracting reasoning, coding, agentic, and domain-specific capabilities can cut both the cost and time required to develop competitive models, creating economic and national-security concerns for the wider AI ecosystem.

CISA Warns Chinese AI Firms Extract Billions of Tokens

CISA named DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI as companies involved in campaigns targeting variants of Claude, GPT, Gemini, and Grok.

The agency said the operations appeared likely to have occurred with Chinese government awareness, although the advisory did not claim direct government control. Knowledge distillation is normally a legitimate method in which a smaller model learns from a larger one.

The concern arises when companies allegedly obtain restricted outputs from competitors at scale, then use those results to imitate protected capabilities without authorization, as seen in previous reporting on large-scale AI distillation attacks.

DeepSeek allegedly ran organized collection activity from at least late 2024 through mid-2025, seeking reasoning abilities, specialized optimization, legal functions, and writing support for its R1 and V3 models.

CISA said its public training-cost claims did not reflect the full value of data gained through alleged distillation. Moonshot AI was linked to widespread activity from at least mid-2025, including the alleged extraction of Claude Fable 5 data for Kimi-K3 and GPT-4o data for Kimi-K2.

Other reported targets included programming, mathematics, reinforcement-learning, and software-engineering functions. The advisory also said Alibaba used distillation to improve software engineering, customer service, character creation, and training workflows.

Separate reporting had already examined allegations of unauthorized Claude model extraction, illustrating how model-output collection has become a major concern for AI providers.

Proxies and Prompt Attacks

According to CISA, the operations used “transfer stations,” a gray market of API proxies that can mask user metadata and help users bypass geographic restrictions.

These intermediaries can also obscure the organization making requests, making isolated accounts look less connected than they really are.

The advisory described account pools, bulk premium subscriptions, and automated routing systems that could switch among providers when access controls changed.

It also highlighted behavior such as sustained activity around the clock, repeated use from multiple locations, immediate maximum use by new accounts, and coordinated timing across separate pathways.

Some operators allegedly used prompt injection and jailbreak-style requests to force models to disclose hidden chain-of-thought reasoning.

This is distinct from ordinary prompts because the goal is to manipulate a model into exposing protected internal processes, a risk also explored in coverage of prompt injection attack techniques.

CISA urged AI providers to strengthen identity checks, monitor unusual subscription-to-usage ratios, apply rate limits, and log requests for investigation.

Providers should also share infrastructure and behavioral signals with cloud platforms and API aggregators, since a distributed campaign may not be visible from one service alone.

The agencies further recommended targeted response changes for high-confidence malicious requests, such as reducing response fidelity or varying outputs, without alerting suspected operators.

Differential privacy, adversarial testing, stricter API controls, and measures to limit prompt injection can add layers of protection against extraction attempts.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post CISA Warns Chinese AI Firms Extract Billions of Tokens From Claude, GPT, Gemini and Grok appeared first on Cyber Security News.

In our previous blog, we explored a series of disclosures from the leak persona Nightmare-Eclipse that focused heavily on Microsoft's ecosystem, including Windows Defender, Cloud Files, and core operating system functionality.

• Cisco Talos began an investigation after observing a DLL named "verification.google" executing from WebDAV at a Ukrainian government organization. We assess with moderate confidence that the attacks are not targeted at a particular organization, but are a part of a cryptocurrency and credentials-stealing operation using the Amatera stealer as the primary payload. 
• Pivoting around the similar WebDAV behavior led to a second loader named "pf.ch" and allowed us to reconstruct its earlier delivery stages. The chain uses a Cloudflare Worker to inject JavaScript code stored on BNB Smart Chain and a ClickFix prompt impersonating Google CAPTCHA, leading to download and execution of Amatera stealer. The chain is likely very similar to what has caused the WebDAV-based execution at the Ukraininan government organization.  
• The two Amatera builds were tasked with different secondary payloads by their respective command-and-control (C2) infrastructure: the "pf.ch" loader was instructed to deploy a NativeAOT loader running ZigCryptoStealer and a Go-based reverse proxy, while the "verification.google" loader was instructed to install an unauthorized instance of NetSupport Manager. 
• The NetSupport Manager installation contained configuration with the C2 server using an IP address based in Russia. With moderate confidence, we assess that "verification.google" branch attack was conducted by a Russian threat actor.  

 In April 2026, Cisco Talos identified an unusual WebDAV DLL execution in endpoint telemetry from a Ukrainian government organization. The remote file was named "verification.google" and was launched through the 32-bit version of "rundll32.exe". This initial finding led us to two similar delivery chains, two different DLL loaders and two ACR/Amatera stealer payloads. Talos tracks the actor behind the observed "verification.google" activity as UAT-10820. 

Following the initial investigation, we decided to hunt for similar WebDAV and ordinal-execution patterns in an attempt to recover the full infection chain. Using VirusTotal, we were able to identify a full chain from a second DLL loader named "pf.ch".  

These two examples are a part of a wider set of recent campaigns delivering Amatera through different infection chains. In July 2026, Malwarebytes documented fake game and software downloads that used RenPy Loader, MSBuild and EtherHiding before delivering Amatera. Blackpoint Cyber described another fake-verification chain that used a signed Microsoft App-V script, configuration stored in Google Calendar and a payload concealed in a PNG image. Apart from the main payload malware family, we found no common infrastructure or other evidence linking those activities to the chains described in this post. 

Initial finding in endpoint telemetry 

The initial event that started the investigation was recorded in April 2026 and it showed an execution of a DLL file through a WebDAV UNC path together with startup of the Windows WebClient service. Apart from the initial command line, we had details of the checksum of the executed DLL but it was not clear what started the execution chain. It was time for hunting in open source intelligence repositories and Talos analytical platform. We wanted to find a similar execution with the similar loader and the payload family and ideally recover the whole infection chain which would likely point to how "verification.google" execution was triggered. This lead us to the "pf.ch" loader and the chain we discovered.  

Hunting reveals a second WebDAV delivery chain 

The "pf.ch" sample uses the same combination of WebDAV, a disguised DLL filename and ordinal execution through "rundll32.exe". We were also able to recover the full ClickFake related sequence leading to this loader. Figure 1 shows both chains, with dashed elements marking stages that were not directly recovered. With low to medium confidence, we assess that the two delivery chains are identical. 

The discovered "pf.ch" loader chain was initiated by ClearFake Javascript injected into the content of a compromised site by a malicious Cloudflare worker.  

The C2 server returned configuration instructing the stealer to download a DLL side-loading package in which a signed Chrome component sideloads a malicious NativeAOT DLL, "secur32.dll". The DLL loads ZigCryptoStealer and uses a vulnerable driver to terminate EDR software. A separate x86 shellcode loader with a Go reverse TCP proxy is also downloaded as a secondary payload by the Amatera configuration sent by the C2 server.  

The secondary payload of the "verification.google" branch as instructed by its own C2, is a PowerShell script which attempts to install a sample of NetSupport Manager remote access tool. 

ClearFake retrieves browser code from BNB Smart Chain 

The "pf.ch" branch begins likely on a compromised website. A Cloudflare Worker injects a malicious JavaScript which queries BNB Smart Chain testnet contract 0x886d310Ac23e05EA705e24E513D19f53793832A9 through "bsc-testnet-rpc[.]publicnode[.]com".  

BNB Smart Chain is a public, Ethereum-compatible blockchain hosting transactions and smart contracts. The actor uses the contract as remotely changeable storage for encoded JavaScript, a technique known as EtherHiding. Based on the operating system of the victim’s machine, the JavaScript code retrieves the next stage from the blockchain, which acts as a bulletproof hosting provider for the malicious code. Potent Pages previously documented unauthorized Cloudflare Workers querying the same first stage contract. 

The initial Javascript code contains routines to check for local and headless browser environments, identifies the operating system, and queries a second contract based on the result of the operation. If the victim is running Windows, it retrieves code from 0x46790e2Ac7F3CA5a7D1bfCe312d11E91d23383Ff and if the victim is running macOS, it uses 0x68DcE15C1002a2689E19D33A3aE509DD1fEb11A5. The response is Base64 decoded and evaluated as JavaScript. 

The Windows browser stage creates a victim identifier, stores it in the cjs_id cookie and asks a tracking contract whether the goal for that identifier has already been reached. If the browser is not headless and the target is Windows, the script overlays a fake Google CAPTCHA-style checkbox onto the compromised page, instructing the victim to open the Windows Run dialog, paste the clipboard contents, and press Enter. 

​ The copied command opens a WebDAV path on a randomized subdomain of "leaguejazire[.]com", places the victim identifier in the path, and executes "pf.ch" through ordinal #1. 

Censys documented the same Windows and macOS contracts in a blockchain-backed ClickFix chain, although the downstream payloads in that reporting differ from those analyzed here. 

The macOS browser stage uses the same headless-browser checks, victim tracking, and fake verification design, but its execution chain is different. It instructs the victim to open Terminal and paste a command that uses curl with a macOS user-agent string. The request goes to a subdomain of "riyazinikokar[.]xyz". Since the subject of our initial research was a customer running Windows, we have not further pursued the macOS side of the "pf.ch" branch.  

WebDAV launches disguised DLLs 

Both observed variants retrieve a 32-bit DLL over WebDAV using a file extension name that does not indicate it is a standard DLL file. Both use the 32-bit "rundll32.exe" process and invoke a function by calling the function ordinal #1. The corresponding first exports are moor in "pf.ch" and CfgInspectModuleData in "verification.google". 

Different initial loaders 

Although the WebDAV execution pattern is the same the two initial loaders use different code and protection methods. 

"pf.ch" uses exception-driven control flow 

The "pf.ch" loader is a packed 32-bit DLL whose only named export is moor with import table containing only AddVectoredExceptionHandler and __mb_cur_max functions.  

The packed code uses vectored exception handling, XOR loops, API hashing, and control-flow patterns, which makes the static analysis of the code more difficult. After the initialization, one of its threads is waiting for an event named hit. Once the event is triggered, it copies an embedded blob into memory and transfers control to it using Windows fibers. The next stage decoder uses XOR and LZNT1 to decode the final Amatera payload. 

The unpacked PE file, an Amatera sample, is also 32-bit, has no import table, and resolves APIs by walking loaded module export tables. The sample uses 32-to-64-bit transitions to execute system calls, possibly in an attempt to evade EDR hooks.  

The sample contains the build label 4.1.5-alpha and string GETWELLV2. Amatera is known to use the Steam community profiles as C2 dead drop resolvers, and the GETWELL2 string was observed in some previous samples as a name of a Steam community profile used to retrieve the IP address of the C2 server. Once C2 server address is resolved, the main configuration is downloaded.  

The Amatera payload was recovered only as a memory-resident artifact and was not observed to be written to disk. Its hash is nonetheless included in the indicator of compromise (IOC) list below, as memory derived hashes remain applicable to memory scanning. 

"verification.google" uses DLL hollowing in "dbghelp.dll" 

The "verification.google" variant does not immediately unpack its payload. It first prepares the state and then passes execution through a callback. The callback is registered using the dynamically resolved function TpAllocWork, an undocumented native NT internal function in "ntdll.dll". The callback is later executed asynchronously by Windows. The callback function implements most of the malicious unpacking functionality in a large control flow flattening loop. 

The loader resolves functions by hash, derives execution state from the environment and implements direct WoW64 syscall stubs. The stubs decode syscall numbers at runtime and call the WoW64 transition pointer instead of the corresponding exported "ntdll.dll" functions. 

The loader reconstructs its next stage from data in the .rdata section. It first maps a clean image of the legitimate "dbghelp.dll" in memory and then overwrites the beginning of its code section with the unpacked next stage. Finally, it restores executable protection before transferring control to the overwritten code section of the "dbghelp.dll".  

This module overwriting (stomping) technique is also known as DLL hollowing or module overloading. VMRay’s technical overview of DLL hollowing describes the same core sequence: loading a legitimate DLL, overwriting its mapped code with malicious content, and executing from that overwritten region. G DATA documented module stomping in a HijackLoader chain that delivered ACRStealer, using different DLLs, "evr.dll", and "rasapi32.dll" rather than the "dbghelp.dll" observed in our case. 

Amatera C2 configurations 

"pf.ch" loaded Amatera resolves its C2 through a Telegraph page 

Before starting its Amatera C2 session, the Amatera sample used in "pf.ch" branch constructs the dead drop C2 URL "https[:]//telegra[.]ph/Functions-04-03". At the time of analysis, the page looked like a short Rust programming tutorial titled “Functions.” with an altered code example containing the string r.]MTQ1LjI0OS4xMDkuMTQ3)0(. 

​ The raw HTML places the same value inside a println statement.  

Decoding MTQ1LjI0OS4xMDkuMTQ3 produces “145.249.109[.]147” as its C2 address.  

After resolving the address, the payload generates WoW64 transition gates, opens an Auxiliary Function Driver (AFD) socket and connects directly to "145.249.109[.]147" on TCP port 443.  

After connecting to the C2 server, Amatera connects to the GetEndpoints URL on the server. The response supplies randomized URI paths for different C2 functions. The stealer then uses the configuration path, together with an embedded build identifier, to retrieve its information collection rules.  

In the "pf.ch" build, a TLS-decoded HTTP buffer we were able to analyse contained a nonzero session identifier and an opaque 73-byte body whose framing is consistent with the ECDH and ChaCha20-Poly1305 protocol documented for recent Amatera versions.  

After removal of the transport and application encryption layers, the configuration is first Base64 decoded and then XOR decoded with the key 852149723\x00, before parsing it as a JSON object.  

Apart from the rules for stealing data the received configuration also contained the instructions to load secondary payloads in a ld (load) json array.  

The ld field is an array of secondary loader tasks supplied by the Amatera controller. Within each entry, u is the download URL, tf selects the payload type and tr selects file-based (1) or fileless (2) execution. The loader supports executables, DLLs, command scripts, PowerShell, raw shellcode and MSI packages, which is described by the field tf. The p value determines task order, with lower positive values processed first. 

"verification.google" loaded Amatera configuration 

The "verification.google" Amatera build stores its bootstrap controller as an encrypted string. At runtime, it decrypts the fixed address "45.150.34[.]2" and connects to it directly on TCP port 443, while presenting "github[.]com" as the TLS server name and HTTP Host value. Unlike the "pf.ch" build, it does not use a public dead-drop resolver to obtain its initial C2 address. After connecting, it sends the GetEndpoints command to obtain working endpoints used for subsequent communication.  

As in the "pf.ch" Amatera payload the first accessed C2 URL is GetEndpoints. This branch’s configuration contains over 400 entries across its browser, extension, messaging, wallet, and other-application collection lists, plus four file collection rules.  

The application rules in the configuration blob extend the initial browser related information collection to Telegram, Signal, WhatsApp, and other messaging data. They also cover over 100 desktop wallet locations and credential data from password managers, authenticators, FTP clients, mail clients, VPN software, and remote-access tools. Representative targets include KeePass, Bitwarden, 1Password, RoboForm, NordPass, WinAuth, Authy, FileZilla, AnyDesk, NordVPN and AzireVPN. 

Four file grabber rules cover the Desktop, Downloads, Documents and Windows Recent-items directory. Across those rules, more than 100 unique filename and extension patterns look for private keys, wallet backups, API and OAuth material, two-factor authentication data, password databases and certificate files such as .kdbx, .p12, .pfx and .pem. Most of the collection rules are focused on stealing cryptocurrency related data and credentials.  

Amatera secondary payloads 

Further on, we focus on the secondary loader tasks, which may point to a more advanced threat actor, based on the installed secondary payload type. 

The "pf.ch" Amatera build received two secondary tasks. One deployed a NativeAOT loader and ZigCryptoStealer, while the other ran a Go reverse TCP proxy from memory. The "verification.google" build received a PowerShell task that installed NetSupport Manager.  

NativeAOT chain runs ZigCryptoStealer 

The "jquery.min.js" entry has priority 1, so Amatera processes it first. Its tf: 1 and tr: 1 values select the file-based executable handler. The server response does not have to be a PE file but it can also be an archive file. When this handler receives an archive, the loader extracts it to a temporary directory, enumerates the resulting *.exe file and launches the selected executable. The most recently observed response was a ZIP archive, SHA-256 279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92.  

The archive included the file "platform_experience_helper.exe", a legitimate Google Chrome component. The executable imports GetUserNameExW from "Secur32.dll", which is a malicious DLL file in the archive which gets sideloaded by the Chrome component.  

The side-loaded "Secur32.dll" is a NET NativeAOT loader which decrypts and loads 2 PE files. The first file is a user mode payload and the second a vulnerable driver used to ter. The NativeAOT DLL starts “C:\Windows\"explorer.exe" in a suspended state, manually maps the PE’s headers and sections into the child, changes its initial thread context to the new entry point, and resumes it.  

The payload is a cryptocurrency stealer written in Zig language — ZigCryptoStealer. It polls the clipboard, recognizes several cryptocurrency address formats and can replace matching values with addresses embedded in the payload.  

The payload makes a separate JSON-RPC eth_call through "bsc[.]rpc[.]blxrbdn[.]com" to BNB Smart Chain contract 0x7CC3cFC1Ac007B8c6566fD2C7419b15a75473468. This is a second use of EtherHiding in the infection chain, this time by the final payload rather than the browser delivery framework. VMRay has previously documented ZigCryptoStealer variants using BNB Smart Chain contracts as a dead drop for C2 configuration.  

ZigCryptoStealer disguises the request as a routine query for an ERC-20 token balance. It supplies a randomly generated cryptocurrency address, but the smart contract ignores it and instead returns text stored by the operator. The operator can change this text using the contract's setData(string) function. During our analysis, the contract returned "lb[.]propertyfind[.]cc", which ZigCryptoStealer then used as its C2 domain. 

The contract was deployed on March 16, 2026. The same wallet that deployed it made 39 successful setData calls through July 26. These calls provide a public history of the C2 values supplied to the malware with six domains active during July: 

Talos used Cisco Umbrella to observe DNS activity for all six domains while they were active. The two most recent values also had the broadest query distribution. Umbrella data includes DNS quaries from 38 countries for "static[.]quorashift[.]cc" and 98 for "lb[.]propertyfind[.]cc". Queries for the current value came most often from the United States, Indonesia, Brazil, India, and Egypt.  

Passive DNS shows that all six domains resolved through shared Cloudflare addresses.  

The second decrypted PE is a signed Windows driver whose version information contains the names MOCOMSYS & DCRC and DCRCV_U Driver (for SCM). Its original filename is "DCRCVDrv.sys", and it exposes the device \Device\DCRCVDRV_U.  

The NativeAOT loader enumerates running processes, hashes their names, and compares the hashes with an internal target list of EDR software and other security tools. For every matched process name, it sends the process identifier to the driver with IOCTL 0x2205c0. The driver’s handler accepts the four-byte PID, obtains a process handle and calls ZwTerminateProcess. We found no caller authorization check in that IOCTL branch. This gives the loader a kernel-mode process-termination primitive, a BYOVD driver. 

​

Go payload turns the host into a reverse TCP proxy 

The URL for the second secondary payload of the "pf.ch" branch yielded a binary shellcode blob with SHA-256 643ef35536ff9273fb84b8504467b1a5645cd3ffd5476d64b99244b02131b205. 

The 32-bit shellcode walks the process environment block (PEB) to find "ntdll.dll" and resolves LdrLoadDll, NtAllocateVirtualMemory, NtProtectVirtualMemory and NtFreeVirtualMemory . It then decrypts and decompresses the final payload stored in the shellcode using XOR to decrypt and LZNT1 to decompress the compressed proxy payload. 

The unpacked file has SHA-256 1819827e17f31e72d456158b6b9c90af25a65945f6f05d04a060da9f24179b25. 

The payload is a Golang 32-bit Windows executable with main package “github.com/acr/proxy-panel/cmd/bot”. It includes HashiCorp Yamux network multiplexing library with C2 hardcoded “wss://"update[.]dubbedmuch[.]cc"/”. 

The proxy reads the Windows MachineGuid and hostname, then sends them over WebSocket Secure (wss) protocol. After the C2 server accepts the client, the program creates a Yamux server session, multiplexing outgoing communications over the same connection. Each logical stream supplies a source and destination address. The client connects to the requested destination and relays bytes in both directions. 

PowerShell in the "verification.google" branch installs NetSupport Manager 

The secondary payload in this branch is "https://kr[.]cedar2glanz[.]ru/jewel[.]js". The tf value 4 of the single secondary payload loader instruction (ld) identifies the payload as PowerShell. The tr value 2 selects the execution path that retrieves the URL with PowerShell DownloadString and runs it through Invoke-Expression (IEX). Proofpoint’s Amatera analysis documents the same ld, tf and tr semantics in more details.  

The next PowerShell stage dynamically resolves native functions and runs an environment check before installing the payload containing the following steps: 

• It queries the C: volume serial and compares it with the hard-coded value 4E014A2F. The original expression returns true when this value matches, allowing execution to continue early and skipping the remaining checks.  
• It calculates system uptime from Win32_OperatingSystem.LastBootUpTime. An uptime below 10 minutes returns false, causing the script to exit. 
• It measures a native 500 ms NtDelayExecution call with GetTickCount64. If fewer than 400 ms appear to elapse, the gate returns false, which can identify an environment that accelerates or skips delays. 
• It checks the processor count. Fewer than three processors unexpectedly returns true and allows execution to continue early rather than rejecting the low-resource system. 
• It queries total physical memory. A reported value below 3.2GiB returns false. 
• It queries Win32_VideoController and selects the largest reported AdapterRAM value. A reported maximum below 384 MiB returns false. 
• It checks display-device friendly names and manufacturers against 36 strings associated with virtual graphics, remote displays, cloud platforms and generic virtual adapters. A match returns false. 

After the environment checks, the script derives an installation path by hashing MachineGuid|zdozwoqx3c. It also starts two background Powershell runspaces that request many legitimate URLs, including GitHub API, npm, Docker Hub, PyPI, NuGet, and PowerShell Gallery. The requests seem to generate decoy traffic to hide the malicious download within plausible developer activity. 

The script downloads "https://phys[.]stunned-amniotic[.]com/hub[.]log". Although the logs at the targeted system in Ukraine contained no evidence of accessing this URL we were able to download the file that was likely intended to be downloaded and executed by the Amatera stealer payload.  

The response at the time of analysis was a ZIP file with SHA256 bd36f4c15fe0acb6748da5ed12e45dcc37d412385812c078d1e4f04730e9f69b. Finally, the PowerShell validates ZIP entry paths, extracts the archive in the %APPDATA% directory, and starts "hypersnap.exe" executable without a visible window and creates a scheduled task triggered at user logon. 

The ZIP contains legitimate NetSupport Manager software 

The launched "hypersnap.exe" is a renamed, signed NetSupport Manager 12.44 "client32.exe". The "client32.exe" stub calls the export _NSMClient32@8 in signed "PCICL32.DLL", the main NetSupport client runtime containing the main functionality of the remote access platform.  

The actor-controlled "client32.ini" NetSupport Manager configuration enables silent operation, hides the system-tray interface, disables visible chat, message, disconnect, replay and help controls and configures "paternal-angrily[.]com:443" as the NetSupport HTTP Gateway. 

The client connects to the gateway, which acts as a proxy between the threat actor and the NetSupport Manager client installation at the victim system. The NetSupport client was configured to poll the gateway every 60 seconds. At the time of the analysis the domain resolved to the IP address "212.118.56[.]166", based in Russia.  

The NetSupport deployment used a license issued as KAKAN, with serial number NSM789508. The exact license file has appeared in numerous malicious NetSupport packages, including activity publicly tracked as EVALUSION and IClickFix. We therefore treat it as an indicator of shared deployment lineage rather than a unique threat actor identifier. 

NetSupport adds an operator driven capability after Amatera’s automated collection. Amatera steals configured credentials, session data, cryptocurrency material, and selected files. An unauthorized NetSupport client can then provide screen and input control, file transfer, inventory, process and service management and remote command or PowerShell execution. This could let an operator inspect data outside Amatera’s predefined rules, act on sessions from the original endpoint, or deploy additional tooling.  

Coverage 

The following ClamAV signatures detect and block this threat: 

• Win.Backdoor.BadDav-10060502-0
• Win.Backdoor.GoProxShell-10060503-0
• Win.Malware.AmateraStomper-10060507-0
• Win.Backdoor.BadNetSup-10060508-0
• Js.Downloader.ClickFix-10060510-0

Indicators of compromise (IOCs) 

The IOCs for this threat are also available at our GitHub repository here. 

Claude Mythos is the first model reported to complete a cyber kill chain without step-by-step human direction. The finding does not describe malware or a confirmed victim breach. It is a controlled test, but shows how quickly autonomous attack capability is advancing.

The concern is speed. The model found weaknesses, entered a defended enterprise network, collected credentials, raised privileges, moved between systems and reached domain administrator control.

Those are stages defenders try to interrupt during an intrusion. GitHub hosts projects and discussions using the Claude Mythos name, but did not identify a malware campaign.

The finding comes from Booz Allen’s assessment of autonomous models. It is a benchmark result, not evidence of a named program independently attacking organizations.

Booz Allen said in a report shared with Cyber Security News (CSN) that it tested 18 U.S. and Chinese models as autonomous attackers against a production-grade enterprise network. Researchers used network and host telemetry to measure actions, rather than accept model claims.

Claude Mythos AI Autonomously Executes Full Cyber Kill Chain

The Cyber Weapon Index gave Claude Mythos an 80 score, combining 74 for vulnerability research and 86 for kill-chain attainment.

It was the only model assessed as reaching the final objective. Researchers said it moved from a stolen employee credential to administrator-level control in every credentialed attempt.

The harder scenario began with no credentials. The report says Claude Mythos penetrated from outside and worked out how to raise its access, instead of following a fixed plan.

The reported autonomous AI agent breach illustrates why this development has drawn attention. The test examined whether models could spot weaknesses in compiled software without source code.

Only frontier Anthropic models identified the previously unseen flaw used in testing, and only Claude Mythos reportedly exploited it. The result is from a defined setting, not proof of universal performance.

Other models showed progress without matching the full outcome. Four reached domain access and control, four achieved lateral movement, and two reached credential access.

All but one penetrated the network autonomously. An attacker need not finish every stage alone to cause disruption or give a human operator a head start.

Defenders face a speed problem

The report argues that risk lies in the entire AI system, not only its model. An attack harness can link a model with tools, memory, feedback and an execution environment.

This helps an agent retain context, recover from errors and connect tasks, as seen in agents breaching company networks.

A model that stops short alone can become more effective with automation, tailored prompts and operational tools. The report found that a harness paired with Claude Sonnet could rival Claude Mythos. A public model score, therefore, can leave serious blind spots.

The likely entry routes are familiar: exposed services, unpatched flaws, stolen credentials and weak access controls.

AI reduces the time and expertise needed to test options, analyze results and adapt. AI agents rebuilding attack tools illustrate how persistence after failure can amplify this advantage. The recommended response is to assume an initial foothold and restrict what happens next.

Organizations should connect vulnerability management, detection, containment and response; enforce least privilege, strong identity checks, segmentation and isolation of high-value systems; and test containment while keeping services running.

Teams should test safeguards in deployed configurations, including tool permissions and autonomy levels. The report recommends continuous measurement of models and surrounding systems, plus controlled access for vetted defenders to reproduce threatening behavior.

This exceeds paper compliance when attack methods change quickly. The headline is not that an AI model has become a criminal actor. A controlled assessment found one system capable of completing a realistic sequence of offensive tasks.

The gap between early access and full compromise may be narrowing, making patching, identity protection and segmentation urgent. Related AI-driven government system breaches show why coordinated automation needs preparation.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Claude Mythos AI Autonomously Executes Full Cyber Kill Chain Without Human Guidance appeared first on Cyber Security News.

A new intrusion campaign shows how quickly a Windows domain can be turned into a launchpad for deeper compromise. The operators used a Sliver command-and-control beacon, account creation, credential theft and remote administration to establish control after gaining an initial foothold.

The activity was staged from an exposed server and aimed at one unnamed US organisation. Its scripts were built for a real Active Directory environment, including a planned rollout across 18 hosts, while the recovered material contained no proof that ransomware was deployed in this specific incident.

Analysts at The Hunter’s Ledger identified the operation as a high-risk post-exploitation toolkit and tracked it as UTA-2026-024.

The research ties the infrastructure to a confirmed ransomware incident, but does not name the people behind this intrusion or conclude that they deployed an encryptor.

The Hunter’s Ledger said in a report shared with Cyber Security News (CSN) that the operators combined ordinary public tools with unusually detailed knowledge of the victim’s network.

The result was a durable access package designed to disable safeguards, steal credentials and keep its control channels available.

Hackers Disable Endpoint Protection

After entering the domain, the operators scripted the creation of an Active Directory account with a non-expiring password and added it directly to Domain Admins.

They also created a local administrator, enabled Remote Desktop Protocol access, and turned off Network Level Authentication, expanding the paths available for later movement.

The scripts stopped and disabled eight services associated with the victim’s endpoint protection product, then checked each service state.

They also collected the SAM, SYSTEM and SECURITY registry hives for offline password cracking, while a separate LSASS memory dump and Mimikatz supplied additional routes to credentials.

A central concern is the campaign’s persistence. Scheduled tasks ran as SYSTEM, used forged author details and included backdated registration dates.

One weekly task downloaded the latest attack chain without saving a fixed payload, a tactic similar to remote scheduled task delivery in EtherRAT attacks.

The team also manipulated the victim’s DNS content filter through its administrative interface. It added the attackers’ domain to an allowlist and placed a matching record in internal DNS, making the domain resolve internally and pass the same security control intended to block it.

This approach mirrors a broader pattern in Windows intrusions, where trusted administrative features become the delivery system after access is obtained.

Recent reporting on fake installer campaigns disabling Defender also showed attackers using installer workflows and scheduled tasks to weaken controls before maintaining access. In both cases, the danger is not a single tool but the sequence of actions surrounding it.

Blockchain C2 Complicates Response

Alongside Sliver, the toolkit used a Node.js implant that obtained its command server from an Ethereum smart contract.

The first domain recorded in that contract was the same one inserted into the victim’s DNS configuration, directly connecting the two seemingly different parts of the operation.

The contract changed domains five times over five months, making simple domain blocks short-lived. Yet the contract itself stayed unchanged and publicly readable, giving defenders a better tracking point.

The related beacon also contacted its main server every 60 seconds with no measured timing variation, a useful signal for network hunting.

The recommended response is to reset credentials across the affected domain, not solely for known accounts; review privileged-group additions and SYSTEM tasks; restore the DNS allowlist; rotate the filter administrator password; and remove planted internal DNS entries.

Teams should also look for RDP enabled with Network Level Authentication disabled and monitor the contract for later C2 changes. Security teams should favor behavior over broad signatures for public tools.

Baseline scheduled tasks, alert on fileless download commands running as SYSTEM and review sudden endpoint-protection service changes.

Readers examining related Windows tradecraft can compare Sliver implant activity targeting Germany and ransomware SYSTEM task abuse, which show how familiar components can be chained into an enterprise-wide incident. The pattern deserves sustained, careful attention.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Hackers Disable Endpoint Protection and Deploy Sliver Across Compromised Windows Domain appeared first on Cyber Security News.

Panzer ransomware has entered Italy amid a sharp rise in attacks. The ransomware-as-a-service, or RaaS, operation surfaced on August 5 and listed a kitchen manufacturer in Treviso and a telecommunications engineering firm in Catanzaro among its alleged victims.

The group advertises tools for Windows, Linux, FreeBSD, and VMware ESXi systems. An attack on a virtualization host can disrupt many business applications at once, turning one compromised server into a wider outage.

Panzer posted victims across 11 countries and the campaign arrived as claimed ransomware incidents in Italy reached 212 by September 6, above the 169 recorded during all of 2025.

Researcher Andrea Fortuna said in a report shared with Cyber Security News (CSN) that the Panzer’s victim posts should still be treated carefully.

Doimo Cucine and NTE Italia had not publicly confirmed the incidents when the report was published, but their listing may be a credibility-building tactic.

Panzer Ransomware Targets Italian Manufacturers

Panzer stands out less for a publicly examined encryptor than for the business system surrounding it. Prospective affiliates reportedly apply through Tox, face screening, and receive access to a dashboard for builds, negotiations, payment invoices, leak posts, and team accounts.

The stated split gives affiliates 80 percent of each payment and the platform 20 percent. Operators also claim to monitor new affiliates for signs of researcher or law-enforcement access, showing a controlled recruitment process.

Its ESXi option is particularly serious for manufacturers and telecom providers that run core workloads as virtual machines.

An intruder who reaches a hypervisor could encrypt multiple virtual disks and halt dependent services, rather than affecting a single employee device.

Reporting on VMware vCenter attack techniques illustrates how control of virtualization infrastructure can become a direct path to ransomware deployment.

Panzer also appears to pair encryption with data theft. The group claimed 30 GB of stolen data from Doimo Cucine and 16 GB of sensitive documents from NTE Italia.

Backups may restore systems, but they do not remove the pressure created by a threatened data leak or potential reporting duties. Researchers have not independently confirmed Panzer’s first access method or publicly analysed payload.

Available assessments instead associate the operation, with limited confidence, with password attacks, credential theft, remote-service movement, local data collection, security-tool tampering, and data transfers over alternative protocols.

Possible entry routes include vulnerable internet-facing VPN or gateway devices, exposed Remote Desktop Protocol services, phishing messages with malicious documents, and abused remote-management software.

The focus on exposed access points echoes reporting on RDP and VPN attack routes, where stolen credentials and unpatched perimeter systems open a route into internal networks.

Defending virtualized operations

Italian organizations should begin with remote access. Require phishing-resistant multi-factor authentication for VPN, remote administration, and privileged accounts; remove unnecessary privileges; and rotate credentials immediately when compromise is suspected.

Internet-facing appliances and remote-management tools also need prompt patching and regular exposure reviews.

Segmentation is equally important. Keep domain controllers, backup repositories, vCenter, and ESXi management interfaces away from everyday user networks.

Restrict administrative protocols to monitored management segments, so a compromised workstation cannot easily reach the systems that control an entire virtual estate.

Teams should watch for warning signs before encryption begins: unusual VPN logins, new administrator accounts, unexpected PsExec or WMI activity, unapproved remote-management tools, large archives in user or ProgramData folders, and unfamiliar cloud-transfer utilities.

A new ESXi ransomware campaign underscores why telemetry from hypervisors deserves the same attention as endpoint alerts.

Two commands deserve urgent attention when they appear unexpectedly on a server: vssadmin delete shadows and bcdedit recoveryenabled no.

They can remove recovery options, and responders should isolate the affected host, preserve evidence, and begin incident-response procedures rather than waiting for encryption.

Finally, maintain offline or immutable backups for every platform, including virtual machines, and test restorations routinely.

Monitor large outbound transfers, prepare legal and communications plans for double extortion, and ensure that recovery testing covers the applications and dependencies that keep production and telecom services operating.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Panzer Ransomware Targets Italian Manufacturers and Telecom Firms With ESXi-Ready RaaS appeared first on Cyber Security News.

BigBear 2.0 is a phishing operation designed to steal proof that a user has already passed multi-factor authentication.

It targets Microsoft 365 accounts through convincing sign-in links, then takes over the logged-in browser session rather than attempting to break the authentication factor.

The operation is a rebranded Evilginx2 phishing framework that targets Microsoft 365 accounts. Victims are drawn in through email links that open a proxy page resembling a Microsoft sign-in page.

It relays their traffic to the genuine service while quietly collecting credentials and the session data returned after sign-in.

CloudSEK analysts identified BigBear 2.0 in June 2026 after gaining access to its administrative panel. The researchers linked the activity to an operator using the alias General Boss and found a network of 42 virtual private server nodes.

CloudSEK said in a report shared with Cyber Security News (CSN) that the panel held 5,137 stolen records tied to 461 organizations and 3,331 unique victim IP addresses across more than 40 countries.

Of those records, 474 represented complete authenticated sessions, alongside 1,032 passwords and 4,148 session cookies. The records illustrate an operation that collects both immediate account access and material that may support persistent access later.

BigBear 2.0 Evilginx2 Phishing Campaign Bypasses Microsoft 365 MFA

BigBear 2.0 uses an adversary-in-the-middle setup, meaning it sits between the victim and the real Microsoft login service.

It captures the email address and password, lets Microsoft validate the request, and waits for the victim to complete their normal approval or code challenge.

When sign-in succeeds, Microsoft sends an authenticated session cookie to the browser. Because the proxy handled the exchange, it can copy that cookie before forwarding the response.

The attacker can replay it in another browser and enter email, Teams, SharePoint, OneDrive, and connected single sign-on applications as the victim. Microsoft 365 session hijacking campaigns have reported the same account-takeover risk.

This is not a weakness in a one-time password, SMS code, or push notification by itself. These methods confirm the user during the live session, but the proxy steals the resulting proof. BigBear used country-matched residential proxies and scripts that pushed users away from security-key authentication.

The campaign particularly affected IT services and managed service providers, a concern because one compromised provider can offer attackers a route into customer environments.

At least five affiliates were linked to the panel. Phishing kits targeting organizations show this service-based model is spreading.

Containing identity compromise

Organizations should treat a suspected stolen cookie as an identity incident, not merely a password problem. Reset affected passwords, revoke active sessions and refresh tokens, and force a new sign-in for impacted accounts.

Teams should examine mailbox forwarding rules, OAuth consent grants, unfamiliar application access, and sign-in activity for evidence that a hijacked session was used after authentication. This review should begin as soon as suspicious activity is reported.

The most useful long-term control is phishing-resistant authentication, especially FIDO2 or WebAuthn security keys and passkeys where properly deployed.

These methods bind a login cryptographically to the genuine site, making a lookalike proxy far less useful. Passkey attack techniques nevertheless deserve ongoing attention.

Administrators should require compliant devices through Conditional Access, shorten session lifetimes where appropriate, and watch for unusual residential IP ranges or new browser sessions.

Email filtering should inspect links that imitate sign-in pages even when they use valid certificates. Teams can monitor for the distinctive headers and cookies listed below, because infrastructure can be reassigned.

For users, a familiar Microsoft page and successful MFA prompt do not always prove that a browser is connected directly to Microsoft.

Verify unexpected sign-in requests through a trusted bookmark or known application, not an email link. This concern is reinforced by Evilginx session-cookie attacks, which also depend on real-time relaying rather than stolen passwords alone.

The campaign combined cookie theft, geographic proxy matching, and affiliate access. MFA must be paired with phishing-resistant methods, session controls, and rapid token revocation.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post BigBear 2.0 Evilginx2 Phishing Campaign Bypasses Microsoft 365 MFA With Session Cookie Theft appeared first on Cyber Security News.

Kimsuky has been observed using an AI agent to produce convincing phishing decoys at scale, then hiding malware inside Windows shortcut files. The latest activity shows how ordinary-looking documents can become the first step in compromise.

The campaign begins with spear-phishing messages carrying ZIP archives. Inside is a malicious LNK shortcut disguised as a document, often with a browser-style icon and false details. When opened, it displays a decoy while silently launching PowerShell to fetch additional code.

The 13 samples examined were collected between August 11 and 19, 2026, and used financial and corporate lures. That wider range raises the risk for corporate staff who routinely receive paperwork and financial notices.

Genians researchers identified the activity as a continuation of the Kimsuky-linked Operation GitPower cluster. 

Genians said in a report shared with Cyber Security News (CSN) that the campaign retains GitHub-based command infrastructure while adding evasion and varied decoy formats.

Kimsuky Hackers Use OpenCode AI Agent

The most notable change is evidence of opencode in the Creator and Producer metadata of several PDF lures.

Four documents carried the same August 16 creation timestamp, while their Author field remained set to “anonymous,” supporting the assessment that they were produced automatically rather than assembled one at a time.

The documents were not uniformly polished. Some contained unreplaced placeholder text for payment dates, grace periods, and financial values, a sign that drafts were pushed into use without careful review.

Other PDFs showed HeadlessChrome and Skia/PDF metadata, suggesting a separate workflow that generated HTML content and rendered it into cleaner-looking PDFs.

That combination gives attackers speed without abandoning familiar social engineering. Analysts found 29 retrieved decoy files but only 11 unique documents by MD5, with duplicated content redistributed under randomized names.

Readers can see the earlier context in Kimsuky local LLM phishing lures, where AI-made files were already used to make shortcut-borne attacks appear routine.

Such artifacts can disappear as operators refine their process, so defenders should not use document quality or metadata alone as the test for whether an attachment is safe.

LNK Loaders Hide GitHub-Based Payloads

Every analyzed LNK file launched PowerShell, concealing an encrypted loader in arguments stretching roughly 5,800 to 9,500 characters.

About 300 leading spaces helped keep the command out of sight in the shortcut properties window, while excess padding inflated file sizes to frustrate simple inspection and some automated checks.

After decoding the hidden content, the loader downloads a decoy and a follow-on script from GitHub Raw Content using a hardcoded personal access token.

It then creates randomly named PowerShell files in AppData or Temp, starts PowerShell through conhost.exe --headless, and registers hidden scheduled tasks that impersonate BitLocker, MATLAB, or .NET components.

One Visa-themed variant also pulled code from Pastebin, giving the operators a second delivery route if GitHub access is blocked. The approach builds on North Korea GitHub C2 attacks, where trusted developer platforms were used to blend malicious traffic into ordinary web activity.

Newer variants check for virtual-machine and analysis tools, look for the username “Bruno,” and delete PowerShell command history when they detect a likely research environment.

They also use error documents in some incomplete builds, but the persistence and payload retrieval stages can still run. Comparable LNK PowerShell loader techniques show why opening a file that merely looks like a PDF is not a reliable safety check.

Organizations should quarantine unsolicited ZIP attachments containing LNK files, especially when their icons and descriptions do not match their real type.

Security teams should correlate LNK launches with long command lines, hidden PowerShell, newly created scripts, scheduled-task registration, GitHub Raw requests carrying unusual tokens, and Pastebin access.

This behavior-first approach is more durable than relying on a single domain blocklist or decoy document review, and aligns with lessons from malicious shortcut file campaigns.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Kimsuky Hackers Use OpenCode AI Agent to Mass-Produce Phishing Decoys in LNK Attacks appeared first on Cyber Security News.

South Korean automotive and media organizations have been hit by a quiet Linux intrusion toolkit built for long-term access.

The malware hides inside software that manages web traffic, allowing attackers to watch users, steal information, and change pages delivered through compromised servers.

The operation appears designed for patience rather than disruption. Attackers likely entered through a groupware portal or mail server, used the edge server as a bridge into internal systems.

That pattern echoes the risks described in stealthy Linux server intrusions, where hidden access can remain active without drawing attention.

Analysts at Rapid7 identified the toolkit and assessed its link to DPRK-aligned advanced persistent threats with medium confidence.

Rapid7 said in a report shared with Cyber Security News (CSN) that the activity likely dates to early 2025, although the precise initial entry point and any exploited vulnerability have not been confirmed.

The affected organizations had ports 80, 443 and 25 exposed, with a groupware login service on port 443 and mail services on port 25.

These systems sit at the network edge, making their compromise serious: an intruder can collect credentials, move deeper inside, and potentially target visitors passing through that server.

DPRK-Linked Hackers Deploy Ted Backdoor

The central component, called ted backdoor, is a modified build of HAProxy 2.8.12, software commonly used to direct website traffic.

Instead of acting like a separate malicious program, it is compiled into the legitimate load balancer and uses its built-in features to inspect decrypted web requests while normal traffic continues to flow.

That placement gives the operators unusual control. The implant can capture session cookies and selected request details, run commands, upload or download files, and inject a malicious script into pages served to chosen visitors.

Its hidden command channel uses a request for a picture-like path, while its code also reduces HAProxy connection counters to make activity harder to spot. Researchers found an SSH keylogger as well as altered versions of crond, agetty, atd, sshd and polkitd.

The stager checks the operating system and whether HAProxy or cron is present before replacing the cron service, copying timestamps from a legitimate SSH binary, and removing chosen words from logs.

This reflects the same concern raised by Linux backdoors stealing SSH credentials: trusted system components can become the attacker’s hiding place.

CurlRAT supplies the remote-control layer. It polls attacker infrastructure for tasks, can execute commands, send system details, install added payloads, and open reverse or interactive shells with elevated privileges. A watchdog monitors HAProxy and reports whether the service starts, stops, reloads, or restarts.

Long-Term Espionage Risks and Defenses

Rapid7 said the combination of credential theft, web-session collection, selective page changes, and traffic redirection points to long-term espionage.

The targeting of South Korean media and automotive firms also fits a regional intelligence-gathering pattern. Readers following Kimsuky espionage activity in Korea will recognize why exposed groupware and stolen credentials remain valuable footholds.

The operators used basic XOR encryption and a substitution method to protect configurations and communications. Their command-and-control domains imitate image delivery services, including one that resembles a popular Korean web platform’s static-content naming style.

Rapid7 also noted overlap in timing and delivery concepts with other DPRK activity, but said more evidence is needed for a firmer attribution. Defenders should review edge systems that handle web traffic, encryption, mail, or runtime modules.

They should compare deployed HAProxy and Linux service binaries against known versions, inspect unexpected shared libraries and cron changes, and rotate credentials that may have passed through affected servers. Independent network monitoring matters because logs on a compromised device may have been altered.

Teams should also investigate unusual requests to image-like paths, unexpected outbound connections from load balancers, and web responses that change only for particular visitors.

Regular patching of groupware and mail servers reduces likely entry opportunities. As shown by recent Asia-focused Linux espionage, post-compromise tools can turn a single exposed server into a durable route across an organization.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post DPRK-Linked Hackers Deploy Ted Backdoor and CurlRAT Against South Korean Firms appeared first on Cyber Security News.

A counterfeit Minecraft optimisation mod is installing Myth Stealer, malware that can steal browser passwords, cookies and data. Its malicious file looks useful because features work as advertised, giving players little reason to suspect a hidden threat.

The campaign exploits users seeking performance improvements from unofficial add-ons. Once installed, the fake mod starts a multi-stage infection chain that leads to a remote tool that lets its operator collect data and broadly control a Windows device.

Analyst devmihaylov identified the malware while examining samples obtained from a buyer of the commodity stealer.

devmihaylov said in a report shared with Cyber Security News (CSN) that the files initially received zero detections from VirusTotal, showing how lightly distributed threats can evade reputation-based checks.

Minecraft players remain frequent targets for malware distributors. Coverage of fake Minecraft Fabric mods showed how a harmless-looking game download can become the first step in account theft and compromise. The threat pairs a decoy with a loader designed to blend into a gaming setup.

Fake Minecraft Mod

The Java archive presents itself as a companion to a legitimate optimisation project and includes 12 working modules that change game performance settings.

A hidden thirteenth component waits briefly, gathers system information, then retrieves and starts the next stage in the background. That approach matters because victims may see the expected optimisation behavior and conclude the download is safe.

The loader uses a large executable built around a standard runtime and brings a private Java environment, letting the payload run even where Java is not otherwise installed.

Before launching the final stage, the program displays a polished administrator-rights request resembling a normal Windows prompt.

Accepting it can give the malware greater access and helps its installation. It also contains retry logic intended to cope with security software interrupting the process.

The final component is heavily disguised to slow investigation. Its code uses reserved Windows-style names, encrypted text and obstacles that can break basic extraction tools.

This concealment, combined with an apparently genuine mod, makes a quick visual check of a download an unreliable safeguard.

Credential theft and remote control

Myth Stealer targets data stored by Chromium-based browsers and Firefox, including saved usernames, passwords, browsing records and active session cookies.

Stolen cookies can be especially damaging because they may let an attacker reuse an already authenticated web session. Readers can see why browser passwords and cookies remain valuable targets in similar data-theft operations.

The malware also collects system details, chat content, clipboard data and files, can capture screenshots or webcam material.

Its remote-control features include running commands, downloading or deleting files, managing processes and setting itself to start again after a reboot.

Researchers also found functions that could disrupt a victim. These include changing display settings, interfering with the mouse or keyboard, showing misleading full-screen messages and attempting to restrict access to security tools.

They can complicate recovery and pressure users to follow an attacker’s instructions. The operation used web-based reporting channels to receive stolen information, a technique documented in coverage of Discord webhook abuse across other malware campaigns.

Although the analysed command infrastructure was no longer responding when reported, inactive servers do not erase the risk to systems already infected.

Players should obtain mods only from trusted project pages, confirm the developer and file integrity, and avoid downloads promoted through chat links, videos or unofficial file-sharing pages.

This echoes guidance from reporting on trojanized Minecraft mod downloads, where social engineering is central to reaching players.

Anyone who installed a suspicious mod should remove it, run a full security scan and change passwords from a clean device.

They should also sign out of important accounts to invalidate sessions, review browser extensions and look for unfamiliar programs that start automatically. An unexpected administrator prompt during mod installation is a serious warning sign.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Fake Minecraft Mod Deploys Myth Stealer RAT to Steal Browser Credentials and Cookies appeared first on Cyber Security News.

PEEP, a malicious Chrome extension posing as Smart Bookmarks, can steal active login sessions and turn an already compromised Windows computer into a remote backdoor.

The finding shows how a browser add-on can become far more dangerous than a simple data thief when it gains a path to the operating system.

The toolkit does not appear to provide its own way into a device. Instead, attackers need prior code execution or administrative access, then silently place it in Chrome or Edge profiles.

Its installers can alter browser settings so the extension launches without the usual store checks, approval prompts, or visible warnings.

Analysts at SOCRadar identified the operation as PEEP, a Chromium-based post-compromise toolkit derived from the open-source RedExt project.

SOCRadar said in a report shared with Cyber Security News (CSN) that the researchers found a primary build disguised as Smart Bookmarks, version 1.3.0, along with a related testing variant and an exposed development repository.

The scale of confirmed victim impact remains unclear. A server status snapshot recorded 34 agent entries, 10 active sessions, and 507 data records, but test identifiers mean those figures cannot prove the number of infected devices.

Still, the design creates a serious risk because stolen session cookies may let an intruder enter accounts without needing a password again.

Malicious Chrome Extension

Once active, PEEP runs inside the browser and asks for broad access to tabs, cookies, history, bookmarks, downloads, browser settings, scripting, and every website.

It gathers browsing history, open-tab details, session cookies, form data, clipboard contents, screenshots, and local or session storage, creating a broad view of a victim’s online activity.

The session-theft capability is especially concerning because a valid cookie proves that a user has already signed in.

As explained in this guide to stolen browser cookie risks, an attacker who obtains that token may be able to reuse an active session and sidestep a later password or MFA prompt until the session is revoked.

PEEP also accepts commands to open pages, inject JavaScript, change proxy settings, and capture page content. It contacts its command server at regular intervals using unencrypted HTTP, allowing the operator to send tasks and receive collected data.

That behavior resembles other malicious browser add-on campaigns that abuse extensions to monitor sensitive activity.

The native-messaging bridge is what changes the threat from browser monitoring into host control. The browser extension can call a companion Windows program, enabling shell commands, file operations, and discovery of running processes and services under the current user account.

Persistence Raises Cleanup Challenge

PEEP uses several methods to remain in place after installation. Its scripts can forge Chrome Secure Preferences integrity values, use enterprise force-install policies, or sideload the extension.

It can also exploit a ScriptCache fallback, leaving apparently harmless source files while Chrome reloads a previously compiled malicious service worker.

That layered approach means removing the visible extension alone may not be enough. Security teams should identify the listed extension IDs, remove the associated native-messaging host and local artifacts, and review browser policies and registry entries.

The finding follows earlier cases in which a native messaging host backdoor turned Chrome into a route for device-level control.

Organizations should block the identified infrastructure, restrict traffic to the exposed services, and investigate browser processes or PowerShell activity that modifies Secure Preferences files.

Strict extension allow-lists, disabled developer mode, restrictions on external sideloading, and approval of only trusted native-messaging hosts can reduce the chance of a similar installation succeeding.

Defenders should also treat a suspected PEEP infection as both an endpoint and identity incident. Remove the malware, end active sessions, rotate affected credentials, and examine account activity for misuse.

Phishing-resistant MFA and browser protections for stored credentials add useful friction, while the recent Chrome extension supply chain attacks show why every installed add-on deserves careful ongoing review.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Malicious Chrome Extension Can Steal Login Sessions and Turn PCs Into Remote Backdoors appeared first on Cyber Security News.

A financially motivated threat group known as Toy Ghouls has begun using two custom Windows backdoors that communicate through popular messaging and broker services.

The tools give attackers a discreet way to run commands, collect system details, and maintain control over compromised devices.

The campaign marks a change for the group, which had previously relied heavily on public tools and leaked ransomware builders.

Its move to custom malware suggests a broader effort to stay inside victim networks longer while making activity harder for security teams to spot.

Analysts at Securelist identified the malware in early July 2026 and linked it to Toy Ghouls, also tracked as Bearlyfy, Laboo.boo, and Feral Wolf. The group has targeted Russian organizations since 2025 and has previously been associated with its own GenieLocker ransomware.

The new backdoors are called mqtt-bird-agent 0.1.0 and matrix-bird-agent 0.1.0. They are delivered after attackers gain access to an organization, showing how a small initial breach can develop into a persistent and serious compromise.

Kaspersky said in a report shared with Cyber Security News (CSN) that the tools provide full control over an infected Windows device.

Hackers Use Popular Messaging Services

Toy Ghouls uses Windows Remote Management, or WinRM, to place the backdoors and their configuration files on already compromised systems.

The attackers use Evil-WinRM and WinRM-fs, tools that can help move files and run remote commands across Windows environments.

WinRM is widely used for legitimate administration, which can make malicious use difficult to identify without close monitoring.

Organizations have faced similar risks from Windows Remote Management abuse, where attackers use valid access and remote sessions to move deeper into a network. The HiveMQ version uses the public broker.hivemq.com MQTT service as its command-and-control channel.

It reports whether a device is online, sends information such as processor usage and free memory, and retrieves instructions that are then run through a hidden PowerShell process.

Using a broker service allows attackers to blend malicious traffic with normal internet activity. The approach resembles an earlier MQTT command channel used by WailingCrab, demonstrating why familiar cloud and messaging infrastructure can complicate network investigations.

The second version uses an attacker-controlled Element server based on the Matrix protocol. It sends device status messages to a designated room, receives commands from an account called panel-bot, and executes those instructions through the Windows command line.

Both variants can run interactively or install themselves as Windows services, allowing them to start again after a reboot. This persistence method makes the infection more dangerous because an attacker may regain access even after the original remote session has ended.

Persistence and Defensive Response

The malware stores its settings in a config.toml file before protecting sensitive fields with encryption tied to the infected computer.

On the Element variant, the file is deleted after first use and the information is moved into the Windows registry, reducing the number of obvious artifacts left on disk.

Security teams should review WinRM access, limit it to approved management systems, and investigate unusual remote PowerShell activity.

They should also watch for unexpected services named cplsupport or wtas, suspicious configuration files in ProgramData folders, and outbound traffic involving the listed messaging infrastructure.

Administrators should treat remote-management credentials as high-value assets and enforce strong authentication for privileged accounts.

Recent incidents involving the Teams and Quick Assist campaign show how social engineering and trusted Windows tools can be combined to create a path toward wider network access.

The discovery also reinforces the value of checking for quiet backdoor behavior, rather than looking only for known ransomware activity.

A recent Windows backdoor investigation similarly highlighted how attackers can minimize visible network signals while waiting for instructions.

Toy Ghouls’ use of MQTT and Element does not mean the services themselves are malicious. Instead, the case shows how threat actors can misuse legitimate or common technology to hide command traffic, gather system data, and keep control of compromised Windows systems for longer periods.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Hackers Use Popular Messaging Services to Control New Windows Backdoors appeared first on Cyber Security News.

NodeStealer has returned with a more invasive toolkit. The Python-based information stealer can now record keystrokes, watch copied text, and capture victims’ screens, turning an account-stealing infection into continuous surveillance.

The change raises the stakes for people whose browsers hold work, banking, or social-media access. First tracked in 2023, NodeStealer initially focused on sensitive browser data and Facebook accounts.

It later widened its interest to Facebook Ads Manager accounts and payment-card information. The latest activity mainly affected victims in Asia and North America, with financial services the leading sector, but the campaign crossed several industries.

Netskope researchers identified the upgraded variant in August 2026 and said it adds spyware functions alongside the earlier theft features.

Netskope said in a report shared with Cyber Security News (CSN) that the researchers also found signs that some new code may have been produced with AI assistance.

The report does not identify a confirmed initial delivery method, so organizations should avoid assuming a single infection route.

What is clear is the malware’s objective after execution: collect enough credentials, session data, personal details, and screen content to support fraud, impersonation, or follow-on account takeover.

NodeStealer Can Now Record Everything Victims Type

The most worrying addition is a keylogger that uses Python’s pynput library to monitor keyboard input.

It saves captured text in a temporary file, sends it to the primary Telegram command-and-control channel every 120 seconds, and then clears the file’s contents. The logging is designed to continue indefinitely.

That can expose passwords, search terms, customer data, private messages, and other information that users enter manually. Clipboard monitoring fills a similar gap by collecting plain text copied and pasted into the device.

Readers following Snake Keylogger’s capture techniques will recognize how this combination gives criminals visibility beyond saved browser credentials.

NodeStealer also takes a screenshot when it runs and another before its screenshot function finishes, transmitting both images through Telegram.

A screen capture can reveal data that may never reach the clipboard or keyboard, including dashboards, recovery codes, open documents, and active conversations.

The separation of stolen material across two Telegram bots may also make disruption harder. One bot receives an archive of browser credentials, passwords, and cookie databases, while the other receives Facebook-specific data.

This approach resembles other Telegram bot driven malware operations that abuse legitimate messaging infrastructure for attacker communications.

Facebook Data Theft Expands

The newest samples query more than 20 Facebook Graph API endpoints, up from two in previous versions.

Rather than only checking an account, the malware seeks a detailed picture of the person managing it, covering identity details, contacts, interests, posts, pages, advertising assets, business records, integrations, and login-related data. For companies that run advertising campaigns, the impact can extend beyond one employee’s profile.

Access to business and Ads Manager information could help attackers run unauthorized ads, steal budgets, target colleagues, or make convincing social-engineering approaches. The risk mirrors Facebook advertising account theft reported in other malware campaigns.

Analysts noted an apparent AI-assisted element in the new functions: repeated, similarly structured calls marked with decorative emoji labels, a pattern absent from earlier NodeStealer code.

That observation is not proof of a particular tool or author, but it suggests attackers may be accelerating routine feature development.

The malware is also distributed as compiled Python bytecode with altered header fields, apparently intended to obscure its compilation timeline and possibly interfere with automated analysis.

Security teams should ensure that inspection workflows examine Python bytecode even when its metadata looks incomplete or misleading.

Defenders should treat unusual Python-based files, unexpected browser-data access, persistent keystroke collection, and Telegram-bound archives as high-priority signals.

Reduce exposure by limiting administrator access, keeping browsers and endpoint protections updated, reviewing active sessions, and warning staff not to run untrusted attachments or downloads. Recent phishing-delivered VIP Keylogger campaigns show why these basics still matter.

People responsible for Facebook business accounts should use strong multi-factor authentication, review connected apps, and watch for unfamiliar advertising changes.

Since cookies and session data can be valuable to attackers, prompt session revocation and credential resets are important after a suspected infection.

These steps cannot undo stolen screenshots, but they can limit further account abuse and reduce the chance of costly misuse.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post NodeStealer Can Now Record Everything Victims Type and Steal Their Screenshots appeared first on Cyber Security News.