Android banking fraud is entering a deceptive phase. Attackers are using malware that copies targeted banking apps into a concealed Android work profile, separating a fraudulent session from warning signs seen on the phone.

The operation begins with Gigabud, an Android remote-access trojan active since 2022. Victims are lured through phishing sites, messaging apps, or social-media posts into sideloading fake airline, tax, or government applications, while fake banking app downloads can turn a brand into a trap.

Group-IB analysts identified Vwork, a modified version of the open-source Shelter app cloner, appearing minutes after Gigabud infections alongside tampered banking applications.

The researchers link the activity to GoldFactory and found compatible samples targeting Brazil, Colombia, Egypt, Indonesia, Laos, Mexico, Morocco, the Philippines, Thailand, Türkiye, and a Gulf Cooperation Council member state.

Group-IB said in a report shared with Cyber Security News (CSN) that from February through July 2026, researchers observed about 1,469 compromised devices and 1,281 potentially compromised logins in Indonesia, with estimated losses of roughly $960,939.

Those figures reflect observed activity rather than the full scope, but show why Android banking trojan campaigns remain a concern.

Hackers Clone Banking Apps Into Hidden Android Work Profiles

Gigabud first asks for Accessibility access, permission to draw over other apps, and battery-saving exemption. If a victim agrees, operators can remotely control the device, list installed apps, place fake login screens over real banking apps, and capture the device lock-screen code.

The next stage is simple but effective. The operator installs Vwork, which creates an isolated work profile and clones a banking app into it. In a confirmed Indonesian case, the cloned app was a fake version of a bank application.

Android keeps applications in separate profiles isolated. That boundary is intended to protect work and personal data, but attackers use it to make the banking session look new.

A security signal tied to malware in the personal profile may not follow the cloned application into the work profile. The operator can then conduct transactions through the clean-looking profile while hiding activity behind a black screen.

The bank may see a new environment rather than the already-flagged personal profile, weakening the connection between device risk and a fraudulent transfer. Similar hidden remote-control Android attacks demonstrate how control features can be concealed from victims.

Vwork reduces visible clues. Its launcher icon is hidden and cloning functions can be controlled by another app. Gigabud includes commands to initialize Vwork, clone an application, and upload the clone list, showing the tools were designed to work together.

Phishing Delivery and Defensive Signals

An early warning is a consumer phone unexpectedly creating an isolated work profile. A banking app installed across profiles, a nearly empty profile, or a second suspicious installation shortly afterward should raise risk.

For users, the advice is simple: install applications only from official stores, reject Accessibility requests from apps that are not genuine accessibility tools, and use a banking second factor that does not depend on SMS. A raw app file sent through a chat is not a legitimate bank distribution channel.

Banks and wallet providers should bind logins to trusted devices, examine unusual session actions, and block high-risk transactions when an unrecognized app has active Accessibility access. Detection should combine signatures with behavior, rather than assuming one malware alert is enough.

This case underlines a broader shift in mobile fraud. Attackers combine social engineering, overlays, remote access, and Android features meant for legitimate separation. banking PIN theft malware shows how overlays and device control can scale financial theft.

The key lesson is that a clean-looking banking session is not always a clean device. Security teams should treat unexpected work-profile creation, cross-profile application duplication, and accessibility abuse as linked warning signs.

That approach can expose the fraud path before a transfer is completed. It also helps teams distinguish ordinary work use from coordinated account takeover before funds leave an account during urgent financial fraud investigations.

Indicators of compromise (IoCs):-

Type	Indicator	Description
SHA-256	b769721621aed0418b193e4a00e51bc772c8383a4149d23a5425b13475e2d501	Gigabud sample
SHA-256	ae6f6eeba2bd4cc948d24610d9447986e52f913f4b5ff960ddea26075ff621ae	Gigabud sample
SHA-256	4fff28eecc0ab6303e4948df77671009dda5b93ed3d1cead527b02d1317426bc	Gigabud sample
SHA-256	112fefc9348fa4acbb82d54d9688c96dd5671bcb2e6288c1f7f384baa8d2fdcf	Gigabud sample
SHA-256	9ca27df7938f12794bab0847434482955ca9adea714a34afd315c7a7be522611	Gigabud sample
SHA-256	1f5d99864564c088a3260e54ad1728a3eadc0b509386cae200993b33673b343c	Gigabud sample
SHA-256	0710ca983741bf6a95db1b6960c1985e45b10f276e5b26f4fae3157db283d1f3	Vwork sample
SHA-256	66499653c0fff78d81db5dc319b9aaa0288dc5d76f555a5eba73660c0ee810eb	Modified banking application sample
SHA-256	61274cf9f49e04e559b267d18617d352c48ba3b1f453773ee9f30e5a4e25dbbc	Modified banking application sample
Android package	net.yy.vwork	Vwork package identifier referenced by Gigabud samples

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Hackers Clone Banking Apps Into Hidden Android Work Profiles to Evade Fraud Detection appeared first on Cyber Security News.

Cybercriminals are using autonomous AI agents to turn compromised cloud systems into fast-moving credential theft platforms.

In one recent case, attackers planned, built, and launched a large-scale campaign in less than six hours, stealing thousands of third-party credentials.

The operation shows how attackers can combine AI coding tools, automated scanning, and cloud resources to work at a speed that previously required a larger team and far more time.

Rather than manually checking systems and fixing errors, the agents handled much of the work themselves. Analysts from Google Cloud identified the activity while tracking the growing use of AI-driven automation in real-world intrusions. 

Google Cloud said in a report shared with Cyber Security News (CSN) that the attackers used an AI coding chatbot, a prompt, and preconfigured instructions to carry out the campaign.

The incident is part of a broader shift in cybercrime. Attackers are increasingly using AI to scan for weaknesses, create phishing content, write malicious code, steal secrets, and maintain access after an initial break-in. This trend makes rapid detection and strong cloud security more important than ever.

Hackers Use Autonomous AI Agents

The financially motivated attackers first compromised an organization’s cloud infrastructure, then used it as the launch point for their operation.

Working from a trusted cloud environment helped their traffic appear more legitimate and made it harder for defenders to quickly separate malicious activity from normal services.

The AI-driven framework used written instruction files as operating playbooks. These instructions guided the agents through vulnerability scanning, credential collection, troubleshooting, and IP address rotation without requiring constant human decisions.

The result was a campaign that harvested credentials at a scale normally associated with much larger criminal groups.

This differs from traditional information stealers, which usually wait for a victim to run malicious software and then collect data from that device.

In this case, the agents actively searched server-side systems, identified weaknesses, and carried out targeted actions against online infrastructure.

The campaign highlights the risks outlined in recent reporting on AI agents breach company networks, where automated agents can map services, locate exposed tokens, and move toward valuable administrative access.

Once valid credentials are collected, criminals can reuse them for cloud access, fraud, espionage, extortion, or additional attacks.

Researchers also found an exposed command-and-control server hosting a separate automated reconnaissance and credential management framework called Recon.

Its dashboard was designed to organize, validate, and manage more than 23,800 stolen secrets in real time, including API keys connected to cloud and AI services.

The source report illustrates how attackers combined compromised cloud resources, AI-generated instructions, automated scanning, and credential harvesting into a single accelerated operation.

Cloud and Developer Systems Face Growing Risk

The attack demonstrates why cloud credentials and developer environments have become high-value targets. A single exposed access token can give attackers a trusted path into cloud services, source code repositories, automation pipelines, and sensitive business data.

The risks are similar to those described in stolen cloud credentials attacks, where valid keys can let intruders enter as approved users.

AI coding environments can create additional openings when developers download unsafe packages, clone altered repositories, or allow tools to process untrusted workspace files.

In related activity, the UNC6780 group used compromised developer accounts to distribute trojanized resources and targeted CI/CD environments for authentication tokens.

The DUSTMAKER credential stealer was also observed hiding files inside common AI coding workspace directories.

It could use malicious configuration files to influence an assistant into running scripts during routine development work, while fake pipeline tasks disguised as AI utilities searched for extra tokens and keys.

Organizations should treat AI tool configurations, developer tokens, and cloud API keys as sensitive credentials.

Security teams should rotate exposed keys quickly, apply least-privilege permissions, protect CI/CD runners, review third-party dependencies, and investigate unexpected automation tasks or workspace configuration changes.

Teams should also monitor cloud activity for unusual API calls, unfamiliar service accounts, unexpected public services, and suspicious outbound scanning.

Guidance from coverage of typosquatted npm package theft shows why dependency checks and secret scanning remain essential for development teams.

The findings do not mean autonomous exploitation is now common across every intrusion. However, they show that AI agents can reduce the delay between compromise and credential theft.

Defenders need controls that can detect abuse at the same pace, especially as attackers continue combining AI automation with familiar methods such as stolen credentials, exposed services, and malicious packages.

Indicators of compromise (IoCs):-

Type	Indicator	Description
Package name	tiktoken_mcp	Trojanized fork of a legitimate MCP server published to PyPI by UNC6780.
Repository name	azure-functions-mcp-extension	Official organizational GitHub repository reportedly targeted for malicious code injection.
Directory	.claude/	Hidden AI coding workspace directory abused by DUSTMAKER.
Directory	.vscode/	Hidden IDE workspace directory abused by DUSTMAKER.
Directory	.cursor/	Hidden AI coding workspace directory abused by DUSTMAKER.
File name	setup.mjs	Script referenced as capable of being executed through malicious workspace configuration.
File name	_index.js	JavaScript loader file containing prompt-injection comments intended to disrupt LLM security analysis.
File name	AGENTS.md	Agentic configuration file exposed on the Recon command-and-control server.
File name	KNOWLEDGE.md	Knowledge file exposed on the Recon command-and-control server.
File name	agentic_vuln_research.md	Vulnerability-research instruction file exposed on the Recon server.
Directory	.openclaw/	Modular framework directory observed on the exposed Recon server.
Directory	memory/	Framework directory observed on the exposed Recon server.
File name	secrets.json	Cline configuration file targeted by ACRSTEALER for potential plaintext API keys.
File name	config.yaml	Continue AI configuration file targeted by ACRSTEALER for API keys and model-routing endpoints.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Hackers Use Autonomous AI Agents to Launch Mass Credential Theft Attacks in Under 6 Hours appeared first on Cyber Security News.

Cybercriminals are widening the reach of information-stealing malware by targeting the local data created by AI coding agents.

The shift puts access tokens, saved connections, prompt histories, and project records at risk on already infected computers. The activity does not point to a newly discovered flaw in Claude, Cursor, or Codex.

Instead, it shows criminals adapting established stealers to collect valuable files stored in predictable local folders, a concern echoed in reporting on Claude session theft involving browser-based account access. Analysts at Gen Digital identified the expanding collection rules after examining recent malware activity.

Gen Digital said in a report shared with Cyber Security News (CSN) that the findings concern locally installed development agents, not a direct compromise of an AI model or agent.

The impact can extend well beyond a single paid account. A stolen archive may give criminals both a reusable way into an account and the context needed to identify sensitive projects, connected services, and people worth targeting with follow-on fraud or phishing.

Hackers Target Claude, Cursor and Codex AI Agents

Over a three-month period, Gen Digital recorded Amatera and Remus detections among tens of thousands of protected Windows users.

Amatera focused on data linked to Cline and Continue, while Remus targeted Claude, Cursor, and OpenCode, indicating that agent data has entered the broader infostealer economy.

CallbackBeaver has also added Cursor and Claude to its collection scope, with more than 5,000 samples seen in a 30-day period.

BeeStealer, STG Stealer, HydraStealer, APEX Stealer, and Otter Stealer illustrate how quickly the technique is spreading, while macOS-focused Djinn Stealer has been associated with Claude, Codex, Gemini, Cline, OpenCode, and Kilo.

Criminals do not necessarily need to rebuild a payload to add a newly popular tool. Many stealers use remotely managed rules that specify folders, file names, databases, extensions, and search limits, so adding another target may amount to a configuration update delivered to machines that are already compromised.

That low barrier matters because a local agent directory can contain far more than settings. Security teams investigating AI agent artifacts should consider authentication files, conversation databases, recent-project data, and connected-service settings as high-value endpoint material, alongside browser profiles and cloud command-line credentials.

Stolen Tokens Expose Work Context

Some agents keep access tokens or refresh tokens locally to avoid requiring a fresh login every session. A stolen access token may let an attacker use an account until it expires, and a refresh token can sometimes extend that window, enabling paid API abuse or resale of working access.

MCP configurations can raise the stakes further. These files may hold endpoints, headers, environment variables, API keys, or other authentication details for external tools, meaning reusable secrets could expose source control, ticketing, databases, cloud resources, or collaboration services connected to the agent.

Prompt histories and transcripts are equally useful to intruders. Developers often use assistants to examine code, analyze logs, and solve incidents, and their chats may reveal source code, internal hostnames, repository names, deployment details, or secrets pasted during troubleshooting.

Related MCP security weaknesses show why connected tools need careful oversight. Organizations should inventory the agents in use, review what they store locally, and use operating-system-protected credential storage where available.

They should keep passwords, private keys, API secrets, and customer data out of prompts, give connected tools only necessary permissions, and favor short-lived, narrowly scoped tokens.

After a suspected stealer infection, responders should work from a clean device to revoke AI sessions, rotate API keys and other connected credentials, review account activity, and determine whether local conversations exposed company information.

Multi-factor authentication remains important, but it may not prevent replay of a token that malware has already copied. Users should also keep endpoints and applications updated and avoid ClickFix or FakeCaptcha instructions, cracked software, and unofficial installers, which are common delivery routes for stealers.

Teams deploying coding agents at scale can apply lessons from AI agent approval flaws by reviewing trusted projects, connections, and access boundaries before they become an attacker’s shortcut. The targeting will likely grow as workplace adoption expands.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Hackers Target Claude, Cursor and Codex AI Agents to Steal Tokens and Prompt Histories appeared first on Cyber Security News.

Hackers are using Google Sheets as an unlikely control channel in a cryptocurrency theft campaign. The operation turns a familiar browser session into a place where malicious code runs, rather than placing a conventional program on a victim’s computer.

The attackers promote a fake report claiming to expose profitable flaws at cryptocurrency swap services. Victims are told to paste JavaScript into Chrome’s address bar or add it to a browser extension, allowing the code to run on the trading site they are visiting.

The campaign began with ClickFix-style lures in October 2025 and adopted Google’s Visualization API in March 2026.

The researchers found messages on Telegram, DarkForums, email, and paste sites, targeting people interested in trading, coding, hacking, and quick financial gains. The result is a wallet-address swap at the moment a user expects to make a deposit.

Cisco Talos said in a report shared with Cyber Security News (CSN) that they identified 49 Bitcoin addresses used by the operation; 24 received a combined 0.159 BTC, valued at about $10,000 in early August 2026, although the actual total may be higher.

Hackers Abuse Google Sheets

This campaign changes the familiar ClickFix formula. Instead of asking a user to open Run or a terminal, the lure asks them to alter their browser. Requests for the next attack stage can therefore look like normal traffic to a trusted Google service.

The first lure described a fabricated API flaw that supposedly delivered around 38 percent higher payouts on SwapZone. A later version claimed a SimpleSwap loyalty feature could provide a 25 percent bonus, then instructed users to install Tampermonkey and paste in a loader script.

That evolution echoes how recent ClickFix delivery campaigns rely on a person to complete the dangerous action.

Here, the loader retrieves hidden, scrambled JavaScript from cells in a publicly published Google Sheet using the Visualization API, joins the code together, and injects it into the active page.

The malicious code behaves like a web skimmer. It watches the transaction page, changes displayed deposit addresses, intercepts web responses that contain wallet data, and replaces copied addresses in the clipboard with an attacker-controlled alternative.

It also adds false bonus information to make a transaction seem more attractive. The extension-based version gives the attackers an added advantage: persistence. Each time the target returns to the selected trading site, the loader can reconstruct and insert the payload again.

The operators also changed their Sheet and hosting setup after takedown efforts, making simple disruption short lived. The danger extends beyond cryptocurrency trading.

A compromised extension, web dependency, or customer-facing application could use similar browser-side tricks to quietly modify forms or information.

The abuse of recognized online services resembles trusted mirror ClickFix abuse, where a credible host can make a harmful page appear less suspicious.

Defending Against Browser-Based Lures

Users should treat any online claim of a secret trading bonus, exploit, or special API access as a warning sign. No website should require visitors to paste code into the address bar, developer console, terminal, or browser extension to unlock a legitimate feature.

This case also reinforces lessons from fake verification page attacks, in which a convincing prompt shifts execution to the victim. Before sending funds, users should compare the address shown on screen with the address copied to the clipboard and verify it through a trusted channel.

Organizations should control browser extensions by role and limit developer-level browser functions where they are not required.

Security teams should investigate unusual requests to Google Docs from browser sessions without normal document activity, especially after an employee visits untrusted forums or links.

Web application owners should test third-party code and remove unexplained, heavily obfuscated JavaScript. The campaign’s methods overlap with browser-based ClickFix techniques, but its public spreadsheet use shows why network trust alone is not enough to judge whether a web request is safe.

Training should focus on behavior, not just blocked domains. Employees and customers need clear guidance that copying code from a document, message, or trading “research” page can hand an attacker control of the browser session, even when the destination appears to be a well-known service.

Indicators of compromise (IoCs):-

Type	Indicator	Description
Domain	docs.google[.]com	Google-hosted documents and Sheets were used for lure hosting and payload retrieval through the Visualization API
Domain	paste[.]sh	Hosted first-stage JavaScript loader scripts used in the campaign
URL	https[:]//paste[.]sh/dQfdExjo#AqjB4BBt]lwLt2NKrlC0x8J9O	Paste site URL promoted for the Tampermonkey-based loader script
Domain	SwapZone[.]io	Cryptocurrency trading site targeted by the initial lure version
Domain	SimpleSwap[.]io	Cryptocurrency trading site targeted by the later Tampermonkey-based lure
File name	API Logic Flaw	Name used for the fraudulent Google Docs lure document
Tool or service	Obfuscator[.]io	JavaScript obfuscation service whose output patterns were observed in payload samples

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Hackers Abuse Google Sheets to Hijack Crypto Wallet Addresses in ClickFix Attacks appeared first on Cyber Security News.

Microsoft has released security updates for CVE-2026-69485, an Important-rated remote code execution vulnerability affecting the Windows Remote Desktop Client.

The flaw could allow an authenticated attacker with low privileges to execute code on an affected server by sending a specially crafted network request.

The vulnerability was disclosed on September 8, 2026, and is tracked as CVE-2026-69485. Microsoft assigned it a CVSS 3.1 base score of 8.8, while the temporal score is 7.7.

The issue has a network attack vector, low attack complexity, requires low privileges, and does not need user interaction. Microsoft said the flaw stems from the Remote Desktop Client using an uninitialized resource.

Uninitialized resources can cause software to use memory, handles, or other system objects before they are properly prepared. In this case, an attacker may trigger the faulty condition through a crafted network request and gain the ability to run code.

Windows Remote Desktop Client Vulnerability

Remote code execution flaws are highly significant because they can give attackers control over vulnerable systems. Successful exploitation could affect the targeted device’s confidentiality, integrity, and availability.

Depending on the permissions available to the compromised account, an attacker could access sensitive data, modify files or system settings, install additional tools, or disrupt services.

According to Microsoft’s advisory, exploitation requires an attacker to first authenticate with low-level access to an affected server. The attacker could then send a specially crafted request to execute code on that server.

The attack does not require a user to click a link, open a file, or approve a prompt, reducing opportunities for defenders to stop it through user awareness controls alone.

Microsoft’s initial assessment states that the vulnerability was not publicly disclosed before the security update and has not been detected in active exploitation.

The company rates exploitation as “Exploitation Less Likely” at the time of publication. However, organizations should treat the finding as a priority because public patch releases can help threat actors study the vulnerability and develop working exploit techniques.

The affected products include Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025, including Server Core installations.

Microsoft also listed several Windows client editions, including Windows 10 versions 1607, 1809, 21H2, and 22H2, along with Windows 11 versions 23H2, 24H2, 25H2, and 26H1 for supported x64 and ARM64 systems.

Administrators should deploy Microsoft’s September security updates as soon as possible.

KB Update	Windows Version
KB5123099	Windows Server 2016 / Windows 10 1607
KB5122876	Windows Server 2019 / Windows 10 1809
KB5122882	Windows Server 2022
KB5122878	Windows 10 21H2 / 22H2
KB5122880	Windows 11 23H2
KB5124008	Windows 11 24H2 / 25H2
KB5124012	Windows 11 26H1
KB5122871	Windows Server 2025

Security teams should also review Remote Desktop exposure, restrict RDP access to trusted networks, enforce least-privilege access, and monitor authentication and Remote Desktop logs for unusual activity. Microsoft credited security researchers yhw and txz for reporting the vulnerability through coordinated disclosure.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Windows Remote Desktop Client Vulnerability Allows Attackers to Execute Remote Code appeared first on Cyber Security News.

A newly published ShieldCrash proof of concept from researcher MSNightmare claims that Microsoft Defender remains vulnerable to an arbitrary file-read flaw, despite Microsoft’s earlier fix for ShieldBreak, tracked as CVE-2026-69414.

The researcher says the issue could let a local attacker make Defender read files with SYSTEM-level privileges on fully updated, supported Windows systems.

According to the MSNightmare, Microsoft addressed several parts of the original ShieldBreak issue but left a specific attack path available. Under certain conditions, that remaining path allegedly recreates the core security impact of the prior vulnerability.

The reported impact is significant because the SYSTEM account has broader permissions than normal users and most administrator accounts. Windows services, security software components, and protected operating system processes often run under SYSTEM.

If an attacker can force a Defender component to access a protected file and expose its contents, they may obtain sensitive data that their existing account should not access.

Windows Defender ShieldCrash 0-Day Flaw

Potentially exposed data could include application configuration files, credential-related material, security product settings, private keys, browser or service secrets, or files belonging to other Windows users.

The exact impact depends on which files the attacker can target, whether they can reliably recover their contents, and what permissions the attacker already has before launching the attack.

The available proof of concept is described as a structure implementation rather than a complete SYSTEM privilege-escalation exploit.

The researcher says it demonstrates arbitrary file reading as SYSTEM after the September 2026 Windows security updates, while noting that a more complete proof of concept could be released later. Reading a file does not mean you can run code or system commands, but it can still weaken Windows security.

The ShieldCrash repository includes C++ project files, a DLL named Warden.dll, resource files, and an EICAR test archive. The EICAR file suggests the research may involve Defender’s malware-detection or file-handling workflow.

However, organizations should avoid running untrusted public proof-of-concept code on production endpoints, especially code that interacts with antivirus services or privileged Windows components.

The GitHub ShieldCrash PoC claims Microsoft’s fix for ShieldBreak (CVE-2026-69414) failed to fully address the underlying issue, allowing arbitrary file reads as SYSTEM on patched Windows systems.

Microsoft has not publicly confirmed the newer bypass, which remains a researcher-reported claim pending independent reproduction or a Microsoft security advisory. The earlier issue is tracked as CVE-2026-69414, while the new bypass has not yet received a separate CVE assignment.

Defenders should monitor endpoints for suspicious local tools that interact with Microsoft Defender scanning paths, unexpected creation or loading of unsigned DLLs, abnormal access attempts involving protected files, and child processes or file operations associated with Defender services.

Security teams should also keep the Microsoft Defender platform and intelligence updates current, apply future Microsoft patches promptly, and restrict untrusted code execution through application control policies.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post New Windows Defender ShieldCrash 0-Day Bypasses Microsoft Patch to Read Files as SYSTEM appeared first on Cyber Security News.

A new U.S. government advisory has raised concerns over large-scale attempts to copy the capabilities of leading artificial intelligence systems.

The activity did not involve conventional malware, but instead focused on harvesting model outputs at a scale that could accelerate rival AI development.

The alleged campaigns relied on huge volumes of automated requests sent through application programming interfaces, cloud services, aggregators, and proxy networks.

CISA said in a report shared with Cyber Security News (CSN) that by collecting responses from advanced AI models, operators could create synthetic datasets designed to teach other systems how to perform similar tasks.

Analysts from the Cybersecurity and Infrastructure Security Agency, alongside the NSA and FBI, said China-based AI companies likely extracted billions of tokens across millions of exchanges from U.S. frontier models since late 2024.

The advisory describes the activity as malicious industrial-scale knowledge distillation rather than routine AI research. The reported impact reaches beyond unauthorized access to a single platform.

CISA warned that extracting reasoning, coding, agentic, and domain-specific capabilities can cut both the cost and time required to develop competitive models, creating economic and national-security concerns for the wider AI ecosystem.

CISA Warns Chinese AI Firms Extract Billions of Tokens

CISA named DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI as companies involved in campaigns targeting variants of Claude, GPT, Gemini, and Grok.

The agency said the operations appeared likely to have occurred with Chinese government awareness, although the advisory did not claim direct government control. Knowledge distillation is normally a legitimate method in which a smaller model learns from a larger one.

The concern arises when companies allegedly obtain restricted outputs from competitors at scale, then use those results to imitate protected capabilities without authorization, as seen in previous reporting on large-scale AI distillation attacks.

DeepSeek allegedly ran organized collection activity from at least late 2024 through mid-2025, seeking reasoning abilities, specialized optimization, legal functions, and writing support for its R1 and V3 models.

CISA said its public training-cost claims did not reflect the full value of data gained through alleged distillation. Moonshot AI was linked to widespread activity from at least mid-2025, including the alleged extraction of Claude Fable 5 data for Kimi-K3 and GPT-4o data for Kimi-K2.

Other reported targets included programming, mathematics, reinforcement-learning, and software-engineering functions. The advisory also said Alibaba used distillation to improve software engineering, customer service, character creation, and training workflows.

Separate reporting had already examined allegations of unauthorized Claude model extraction, illustrating how model-output collection has become a major concern for AI providers.

Proxies and Prompt Attacks

According to CISA, the operations used “transfer stations,” a gray market of API proxies that can mask user metadata and help users bypass geographic restrictions.

These intermediaries can also obscure the organization making requests, making isolated accounts look less connected than they really are.

The advisory described account pools, bulk premium subscriptions, and automated routing systems that could switch among providers when access controls changed.

It also highlighted behavior such as sustained activity around the clock, repeated use from multiple locations, immediate maximum use by new accounts, and coordinated timing across separate pathways.

Some operators allegedly used prompt injection and jailbreak-style requests to force models to disclose hidden chain-of-thought reasoning.

This is distinct from ordinary prompts because the goal is to manipulate a model into exposing protected internal processes, a risk also explored in coverage of prompt injection attack techniques.

CISA urged AI providers to strengthen identity checks, monitor unusual subscription-to-usage ratios, apply rate limits, and log requests for investigation.

Providers should also share infrastructure and behavioral signals with cloud platforms and API aggregators, since a distributed campaign may not be visible from one service alone.

The agencies further recommended targeted response changes for high-confidence malicious requests, such as reducing response fidelity or varying outputs, without alerting suspected operators.

Differential privacy, adversarial testing, stricter API controls, and measures to limit prompt injection can add layers of protection against extraction attempts.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post CISA Warns Chinese AI Firms Extract Billions of Tokens From Claude, GPT, Gemini and Grok appeared first on Cyber Security News.

cPanel has disclosed CVE-2026-67401, a critical SQL injection flaw in EmailTrack that could let authenticated attackers gain root-level control of vulnerable servers.

cPanel disclosed the security issue on September 8, 2026. According to cPanel, an attacker must already possess a valid cPanel account with mail-related privileges to exploit the vulnerability.

While this requirement limits unauthenticated internet-wide exploitation, the potential impact remains severe for shared-hosting providers, managed servers, and organizations with multiple cPanel users.

CVE-2026-67401 is an SQL injection vulnerability in cPanel’s EmailTrack functionality. EmailTrack monitors and reviews email delivery activity, including message routing and delivery information.

A malicious authenticated user can abuse the vulnerable functionality to create arbitrary files on the underlying server. Arbitrary file creation is especially dangerous in a hosting environment because it can let attackers place controlled content in sensitive locations.

Cpanel Vulnerability

cPanel said successful exploitation can result in code execution as the root user. Root access provides unrestricted control over the operating system, allowing attackers to access hosted websites, databases, email accounts, backups, configuration files, and credentials stored on the server.

An attacker with root-level access could also install persistence mechanisms, deploy malware, alter website content, steal customer data, turn off security tools, or use the compromised server to launch further attacks.

In multi-tenant hosting environments, compromising one privileged cPanel account could put other customers hosted on the same server at risk.

Security researcher Ali Mustafa, also known as (nd abe)1526, reported the vulnerability. The vulnerability affects all supported cPanel/WHM versions before the following patched builds:

cPanel/WHM Release	Patched Version
cPanel & WHM 11.110	11.110.0.143
cPanel & WHM 11.134	11.134.0.55
cPanel & WHM 11.136	11.136.0.39
cPanel & WHM 11.138	11.138.0.4
WP2 release	11.138.1.9

Server administrators should verify their installed cPanel/WHM version immediately and upgrade to a patched release. Organizations using managed hosting should also confirm with their provider that the update has been applied across all affected systems.

The primary mitigation is to update cPanel/WHM to the latest available patched version. Administrators should not rely only on restricting public access, because exploitation requires a legitimate authenticated account rather than anonymous access.

Security teams should review cPanel accounts with email-related permissions and remove unnecessary privileges. Enable passwords and multi-factor authentication for accounts that may have been exposed or are no longer required.

Administrators should also investigate for suspicious files, unexpected changes to web directories, modified configuration files, unusual root-level processes, and unexplained outbound network connections. Reviewing cPanel, web-server, authentication, and system logs may help identify exploitation attempts.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post New cPanel Vulnerability Allows Attacker to Gain Full Control of the Server appeared first on Cyber Security News.

Claude Mythos is the first model reported to complete a cyber kill chain without step-by-step human direction. The finding does not describe malware or a confirmed victim breach. It is a controlled test, but shows how quickly autonomous attack capability is advancing.

The concern is speed. The model found weaknesses, entered a defended enterprise network, collected credentials, raised privileges, moved between systems and reached domain administrator control.

Those are stages defenders try to interrupt during an intrusion. GitHub hosts projects and discussions using the Claude Mythos name, but did not identify a malware campaign.

The finding comes from Booz Allen’s assessment of autonomous models. It is a benchmark result, not evidence of a named program independently attacking organizations.

Booz Allen said in a report shared with Cyber Security News (CSN) that it tested 18 U.S. and Chinese models as autonomous attackers against a production-grade enterprise network. Researchers used network and host telemetry to measure actions, rather than accept model claims.

Claude Mythos AI Autonomously Executes Full Cyber Kill Chain

The Cyber Weapon Index gave Claude Mythos an 80 score, combining 74 for vulnerability research and 86 for kill-chain attainment.

It was the only model assessed as reaching the final objective. Researchers said it moved from a stolen employee credential to administrator-level control in every credentialed attempt.

The harder scenario began with no credentials. The report says Claude Mythos penetrated from outside and worked out how to raise its access, instead of following a fixed plan.

The reported autonomous AI agent breach illustrates why this development has drawn attention. The test examined whether models could spot weaknesses in compiled software without source code.

Only frontier Anthropic models identified the previously unseen flaw used in testing, and only Claude Mythos reportedly exploited it. The result is from a defined setting, not proof of universal performance.

Other models showed progress without matching the full outcome. Four reached domain access and control, four achieved lateral movement, and two reached credential access.

All but one penetrated the network autonomously. An attacker need not finish every stage alone to cause disruption or give a human operator a head start.

Defenders face a speed problem

The report argues that risk lies in the entire AI system, not only its model. An attack harness can link a model with tools, memory, feedback and an execution environment.

This helps an agent retain context, recover from errors and connect tasks, as seen in agents breaching company networks.

A model that stops short alone can become more effective with automation, tailored prompts and operational tools. The report found that a harness paired with Claude Sonnet could rival Claude Mythos. A public model score, therefore, can leave serious blind spots.

The likely entry routes are familiar: exposed services, unpatched flaws, stolen credentials and weak access controls.

AI reduces the time and expertise needed to test options, analyze results and adapt. AI agents rebuilding attack tools illustrate how persistence after failure can amplify this advantage. The recommended response is to assume an initial foothold and restrict what happens next.

Organizations should connect vulnerability management, detection, containment and response; enforce least privilege, strong identity checks, segmentation and isolation of high-value systems; and test containment while keeping services running.

Teams should test safeguards in deployed configurations, including tool permissions and autonomy levels. The report recommends continuous measurement of models and surrounding systems, plus controlled access for vetted defenders to reproduce threatening behavior.

This exceeds paper compliance when attack methods change quickly. The headline is not that an AI model has become a criminal actor. A controlled assessment found one system capable of completing a realistic sequence of offensive tasks.

The gap between early access and full compromise may be narrowing, making patching, identity protection and segmentation urgent. Related AI-driven government system breaches show why coordinated automation needs preparation.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Claude Mythos AI Autonomously Executes Full Cyber Kill Chain Without Human Guidance appeared first on Cyber Security News.

A new intrusion campaign shows how quickly a Windows domain can be turned into a launchpad for deeper compromise. The operators used a Sliver command-and-control beacon, account creation, credential theft and remote administration to establish control after gaining an initial foothold.

The activity was staged from an exposed server and aimed at one unnamed US organisation. Its scripts were built for a real Active Directory environment, including a planned rollout across 18 hosts, while the recovered material contained no proof that ransomware was deployed in this specific incident.

Analysts at The Hunter’s Ledger identified the operation as a high-risk post-exploitation toolkit and tracked it as UTA-2026-024.

The research ties the infrastructure to a confirmed ransomware incident, but does not name the people behind this intrusion or conclude that they deployed an encryptor.

The Hunter’s Ledger said in a report shared with Cyber Security News (CSN) that the operators combined ordinary public tools with unusually detailed knowledge of the victim’s network.

The result was a durable access package designed to disable safeguards, steal credentials and keep its control channels available.

Hackers Disable Endpoint Protection

After entering the domain, the operators scripted the creation of an Active Directory account with a non-expiring password and added it directly to Domain Admins.

They also created a local administrator, enabled Remote Desktop Protocol access, and turned off Network Level Authentication, expanding the paths available for later movement.

The scripts stopped and disabled eight services associated with the victim’s endpoint protection product, then checked each service state.

They also collected the SAM, SYSTEM and SECURITY registry hives for offline password cracking, while a separate LSASS memory dump and Mimikatz supplied additional routes to credentials.

A central concern is the campaign’s persistence. Scheduled tasks ran as SYSTEM, used forged author details and included backdated registration dates.

One weekly task downloaded the latest attack chain without saving a fixed payload, a tactic similar to remote scheduled task delivery in EtherRAT attacks.

The team also manipulated the victim’s DNS content filter through its administrative interface. It added the attackers’ domain to an allowlist and placed a matching record in internal DNS, making the domain resolve internally and pass the same security control intended to block it.

This approach mirrors a broader pattern in Windows intrusions, where trusted administrative features become the delivery system after access is obtained.

Recent reporting on fake installer campaigns disabling Defender also showed attackers using installer workflows and scheduled tasks to weaken controls before maintaining access. In both cases, the danger is not a single tool but the sequence of actions surrounding it.

Blockchain C2 Complicates Response

Alongside Sliver, the toolkit used a Node.js implant that obtained its command server from an Ethereum smart contract.

The first domain recorded in that contract was the same one inserted into the victim’s DNS configuration, directly connecting the two seemingly different parts of the operation.

The contract changed domains five times over five months, making simple domain blocks short-lived. Yet the contract itself stayed unchanged and publicly readable, giving defenders a better tracking point.

The related beacon also contacted its main server every 60 seconds with no measured timing variation, a useful signal for network hunting.

The recommended response is to reset credentials across the affected domain, not solely for known accounts; review privileged-group additions and SYSTEM tasks; restore the DNS allowlist; rotate the filter administrator password; and remove planted internal DNS entries.

Teams should also look for RDP enabled with Network Level Authentication disabled and monitor the contract for later C2 changes. Security teams should favor behavior over broad signatures for public tools.

Baseline scheduled tasks, alert on fileless download commands running as SYSTEM and review sudden endpoint-protection service changes.

Readers examining related Windows tradecraft can compare Sliver implant activity targeting Germany and ransomware SYSTEM task abuse, which show how familiar components can be chained into an enterprise-wide incident. The pattern deserves sustained, careful attention.

Indicators of compromise (IoCs):-

Type	Indicator	Description
IPv4 address	193.233.202.17	Primary Sliver command-and-control and staging-server address
IPv4 address	77.110.126.46	Hardcoded third-tier fallback address, designated hunt-only
IPv4 address	146.103.127.44	Historical operator-used address from April 2026, designated monitor-only
Domain	publisherresolution.com	First C2 domain written to the Ethereum resolver contract
Domain	resumeacceptable.com	Historical Ethereum resolver C2 domain
Domain	simultaneouslypower.com	Historical Ethereum resolver C2 domain
Domain	wiselystarting.com	Historical Ethereum resolver C2 domain
Domain	itemrange.com	Most recently recorded Ethereum resolver C2 domain
URL	https://publisherresolution.com	Ethereum resolver contract value
URL	https://resumeacceptable.com	Ethereum resolver contract value
URL	https://simultaneouslypower.com	Ethereum resolver contract value
URL	https://wiselystarting.com	Ethereum resolver contract value
URL	https://itemrange.com	Ethereum resolver contract value
URL	http://193.233.202.17:42718/task_39.ps1	Fileless PowerShell download location used by the persistence task
File name	svcload.exe	Modified PrintSpoofer derivative
File name	ws35.exe	Reverse-shell sample containing the fallback address
File name	ws36.exe	Reverse-shell sample containing the fallback address
File name	ws37.exe	Reverse-shell sample containing the fallback address
File name	ws_3srv.exe	Reverse-shell sample containing the fallback address
File name	task_39.ps1	PowerShell payload retrieved by the scheduled task
File name	slv_beacon_sc.bin	Sliver beacon shellcode payload
Smart contract	0xb3f2897f2bc797e5b9033faef8c81e92b01cb831	Ethereum contract used to resolve the Node.js implant’s C2 location
MSI UpgradeCode	{B3D67F25-0E3A-4B6B-965C-2C7610958983}	Stable installer identifier observed in the MSI package
User-Agent	Chrome/108.0.6602.492	Hardcoded malformed User-Agent associated with the campaign’s request profile

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Hackers Disable Endpoint Protection and Deploy Sliver Across Compromised Windows Domain appeared first on Cyber Security News.

A proof-of-concept zero-click worm dubbed “WeWorm” that it says can spread through WeChat voice calls on both iOS and Android, compromising a target’s WeChat account in seconds without the victim answering the call.

Calif says the bug was reported to Tencent in July and that Tencent has since mitigated the exploit for users, but the research still serves as a stark warning about how mobile messaging apps can become wormable attack surfaces at planetary scale.

WeChat is not a niche target. Tencent says Weixin and WeChat together exceeded 1.4 billion monthly active users as of the end of Q1 2026, while WeChat’s own site describes the platform as serving over 1 billion users with chats and calls across major mobile and desktop platforms.

That sheer reach is what makes Calif’s demonstration so alarming: a memory-corruption flaw in the app’s VoIP stack is not just another messaging bug, but a potential entry point into one of the world’s most deeply embedded communications ecosystems.

According to Calif’s public research listing, WeWorm is described as “the first zero-click worm to spread through WeChat calls across iOS and Android,” and it was published on September 8, 2026, as part of the company’s Android-tagged research work.

Calif frames the finding not as a theoretical edge case but as a live demonstration of how a trusted messaging relationship can be weaponized, with one compromised contact becoming the launch point for attacks against everyone in that person’s social graph.

The company’s demo chain reportedly used three phones to prove cross-platform propagation. A Pixel 10a was used as the initial attacker device, which then called an iPhone 17e and exploited the flaw while the call was still ringing; the compromised iPhone was then used to call another Pixel 10a, which was reportedly taken over in the same way.

In practical terms, that is the textbook definition of a wormable condition in a communications app: the attacker calls the victim, the victim becomes the attacker, and the infection path continues with almost no friction.

What makes the scenario especially dangerous is the “zero-click” aspect. Calif says the victim does not need to answer the call or interact with the phone at all for exploitation to succeed, and even if the person does answer, they hear nothing while the compromise still goes through.

That claim places WeWorm in the most feared class of mobile exploits, where normal user caution offers little protection because there is no malicious link to avoid and no attachment to reject.

Calif also says exploitation yields full control of the victim’s WeChat account, including the ability to read and send messages, place calls, and act on the user’s behalf inside the app.

On its own, account takeover at that level would already be severe for identity abuse, surveillance, fraud, and lateral targeting; chained with additional device-level bugs, Calif says the same access could be extended to full control of the underlying Android or iOS device.

The company specifically links that possibility to its broader AI-assisted exploit research, including Android work such as OEMpocalypse, which it has presented as a path from app-level access to root on several vendor ecosystems.

One condition slightly narrows the attack surface: the attacker must already be on the victim’s friend list. But Calif argues that this is a weak barrier in real-world conditions because once a single trusted contact is compromised, that person’s account can be used to reach additional friends, turning the victim’s social trust network into the worm’s propagation layer.

That is a familiar and troubling pattern in modern communications security, where safety features and trust assumptions designed for convenience can become force multipliers once an adversary gets an initial foothold.

The technical root cause, Calif says, is a memory-corruption bug in WeChat’s VoIP stack, though the company is withholding full exploit details until a later conference presentation.

That restraint matters because memory-corruption flaws in real-time communications code are among the most sensitive bug classes in mobile security, especially when they sit inside call-handling paths that process network data before a user takes any action.

Calif further suggests that this bug is only one example of a broader class of “unconventional attack surfaces” spread across messaging apps, hinting that similar issues may exist in other platforms with rich calling and media features.

WeWorm may be a demo, but its significance is real. Calif has effectively shown that mobile messaging worms are no longer a distant nightmare or a plot device for conference talks; they are a practical research outcome in 2026, built against one of the world’s largest communications platforms and developed at AI speed.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post WeWorm – First 0-Click Worm Spreading Through WeChat Calls Across iOS and Android appeared first on Cyber Security News.

SAP has released its September 2026 Security Patch Day updates, delivering 19 new security notes and one update to a previously issued note.

The patches address vulnerabilities across SAP NetWeaver, SAP Extended Passport Processing, SAP Cloud Application Programming Model, SAP S/4HANA, SAP Integration Suite, SAP Commerce Cloud, and other enterprise products.

The most severe issue is CVE-2026-44756, a critical memory corruption vulnerability in SAP Extended Passport Processing, tracked under SAP Note 3747649. It carries a CVSS score of 10.0, the highest possible severity rating.

The flaw affects multiple SAP kernel and Web Dispatcher versions, including KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, and 9.16 through 9.20.

An unauthenticated remote attacker could potentially exploit the memory corruption flaw to compromise confidentiality, integrity, and availability. Organizations using affected SAP kernel components should treat this update as an emergency patching priority.

Another critical vulnerability, CVE-2026-58240, affects SAP NetWeaver Message Server. SAP Note 3759472 addresses a missing authentication check with a CVSS score of 9.8. The issue affects KERNEL versions 9.16, 9.18, 9.19, and 9.20.

Successful exploitation could allow an attacker without valid credentials to access or interact with exposed services, creating a serious risk to SAP environments.

SAP Security Updates September 2026

SAP also fixed CVE-2026-76969, a critical credential disclosure vulnerability in multitenant applications using the SAP Cloud Application Programming Model library sap/cds-mtxs.

The flaw has a CVSS score of 9.4 and affects versions up to 1.18.3, 2.7.6, 3.9.6, and 4.0.2. Developers and cloud administrators should update affected dependencies quickly, especially where they handle tenant data and application credentials.

A fourth critical issue, CVE-2026-66768, impacts SAP GUI for Java in SAP NetWeaver. The improper access control vulnerability, fixed by SAP Note 3781729, has a CVSS score of 9.0. It affects BC-FES-JAV 8.10 and could allow a low-privileged attacker to gain unauthorized access after user interaction.

The September release also includes high-severity fixes, including CVE-2026-76958, an 8.5-rated XXE flaw in SAP Integration Suite Trading Partner Management that could expose sensitive files, enable server-side requests, or disrupt XML processing.

SAP patched insecure deserialization in SAP NetWeaver Business Client, memory corruption in SAP NetWeaver Application Server for ABAP and ABAP Platform, and CRLF injection in SAP Commerce Cloud Search and Navigation.

The company also released an update for CVE-2026-58243, a high-severity privilege escalation flaw in SAP ABAP Developer Tools originally addressed during the August 2026 Patch Day.

SAP Note	CVE	Vulnerability	Affected product/versions	Priority
3747649	CVE-2026-44756	Memory corruption	SAP Extended Passport (EPP) Processing KRNL64NUC: 7.22, 7.22EXT; KRNL64UC: 7.22, 7.22EXT, 7.53, 8.04; WEBDISP: 9.16, 9.18, 9.19, 9.20; KERNEL: 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.16, 9.18, 9.19, 9.20	Critical
3759472	CVE-2026-58240	Missing authentication check	SAP NetWeaver Message Server KERNEL: 9.16, 9.18, 9.19, 9.20	Critical
3798315	CVE-2026-76969	Credential disclosure in multitenant CAP applications	SAP CAP library sap/cds-mtxs Versions: ≤1.18.3, ≤2.7.6, ≤3.9.6, ≤4.0.2	Critical
3781729	CVE-2026-66768	Improper access control	SAP NetWeaver SAP GUI for Java BC-FES-JAV: 8.10	Critical
3772411	CVE-2026-58243	Privilege escalation — updated August note	SAP ABAP Developer Tools SAP_BASIS: 750, 751, 752, 753, 754, 755, 756, 757, 758, 816, 918, 920	High
3792978	CVE-2026-76958	XML External Entity (XXE)	SAP Integration Suite Cloud Integration – Trading Partner Management V2: 2.9.2; B2B Integration Factory – Cloud Integration – Trading Partner Management: 1.10.0	High
3784138	CVE-2026-76967	Insecure deserialization	SAP NetWeaver Business Client BC-WD-CLT-BUS: 8.00, 8.10	High
3757002	CVE-2026-66767	Memory corruption	SAP NetWeaver AS for ABAP and ABAP Platform KRNL64NUC: 7.22, 7.22EXT; KRNL64UC: 7.22, 7.22EXT, 7.53, 8.04; KERNEL: 7.22, 7.53, 7.54, 7.77, 7.93, 8.04, 9.16, 9.18, 9.19, 9.20	High
3791068	CVE-2026-2332	CRLF injection through Jetty components	SAP Commerce Cloud Search and Navigation COM_CLOUD: 2211, 2211-JDK21	High
3750721	CVE-2026-76968	Information disclosure	SAP Web Dispatcher, Internet Communication Manager, and SAP Content Server KRNL64NUC: 7.22, 7.22EXT; KRNL64UC: 7.22, 7.22EXT, 7.53; WEBDISP: 7.22_EXT, 7.53, 7.54, 7.77, 7.93, 9.16; CONTSERV: 7.53, 7.54; KERNEL: 7.22, 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.19, 9.20	Medium
3756450	CVE-2026-44766	SQL injection	SAP S/4HANA Intercompany Matching and Reconciliation SAPSCORE: 136; S4CORE: 104, 105, 106, 107, 108, 109	Medium
3786489	CVE-2026-76971	Server-Side Request Forgery (SSRF)	SAP Manufacturing Integration and Intelligence XMII: 15.4, 15.5	Medium
3787345	CVE-2026-34477	Security misconfiguration due to Apache Log4j	SAP Commerce Cloud Search and Navigation COM_CLOUD: 2211, 2211-JDK21	Medium
3783189	CVE-2026-76977	Clickjacking	SAPUI5 Frame Options Allowlist SAP_UI: 750, 754, 755, 756, 757, 758, 816; UI_700: 200	Medium
3365276	CVE-2026-76960	Cross-Site Request Forgery (CSRF)	SAP S/4HANA Finance for Advanced Payment Management S4CORE: 105, 106, 107	Medium
3371336	CVE-2026-76961	Cross-Site Request Forgery (CSRF)	SAP S/4HANA Finance for Advanced Payment Management S4CORE: 108	Medium
3365311	CVE-2026-76959	Cross-Site Request Forgery (CSRF)	SAP S/4HANA Finance for Advanced Payment Management UIAPFI70: 800, 900, 901, 902	Medium
3657599	CVE-2026-76962	Missing authorization check	SAP S/4HANA Manage Bank Chains app S4CORE: 107, 108, 109	Medium
3772838	CVE-2026-76963	Missing authorization check	SAP NetWeaver and ABAP Platform SAP_BASIS: 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758	Medium
3736494	CVE-2026-58234	Denial of service	SAP Process Integration SOAP Adapter MESSAGING: 7.50; SAP_XIAF: 7.50	Low

Medium-severity fixes cover SQL injection, server-side request forgery, clickjacking, cross-site request forgery, information disclosure, authorization bypass, and Apache Log4j-related security misconfiguration issues. SAP also patched a low-severity denial-of-service flaw in the SAP Process Integration SOAP Adapter.

SAP administrators should review all relevant security notes in the SAP Support Portal, map them to deployed product versions, test patches under change-control procedures, and apply the fixes as soon as possible.

Internet-facing SAP services, NetWeaver Message Server instances, cloud application dependencies, and systems processing sensitive business data should receive priority attention.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post SAP Security Updates September 2026 – Critical Flaws Patched in SAP NetWeaver, Cloud and Extended Passport appeared first on Cyber Security News.

The U.S. Department of State’s Rewards for Justice program has announced a reward of up to $10 million for information leading to the identification or whereabouts of Amir Yaryab, a senior figure in Iran’s Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC).

U.S. officials allege that Yaryab oversees the command’s Cyber Operations Command, managing cyber units responsible for attacks on critical infrastructure across the U.S., Europe, and the Middle East.

This reward is part of broader efforts to combat malicious cyber activities targeting U.S. critical infrastructure, as outlined under the Computer Fraud and Abuse Act.

U.S. Offers $10 Million Reward

Yaryab is said to lead various components within the IRGC-CEC known as Shahid Hemmat and Shahid Shushtari, both involved in cyber and cyber-enabled information campaigns against multiple sectors, including defense, telecommunications, energy, and finance.

U.S. authorities have linked Yaryab to several IRGC-affiliated groups, including CyberAv3ngers and Dadeh Afzar Arman (DAA), which have been implicated in malware incidents and assaults on civilian infrastructure worldwide.

This recent announcement has intensified scrutiny on the Iranian cyber command, especially as operational technology systems remain vulnerable to internet-based threats. The alert correlates with past warnings about CyberAv3ngers targeting industrial control systems.

A joint advisory issued by CISA, the FBI, NSA, EPA, and international collaborators revealed that IRGC-connected actors began compromising Israeli-made Unitronics Vision Series programmable logic controllers (PLCs) in late 2023. These devices are essential in various sectors, including water treatment, energy, transportation, and healthcare.

Reports indicate that between November 2023 and January 2024, CyberAv3ngers initiated multiple waves of attacks against U.S. based Unitronics PLCs, compromising at least 75 devices, 34 of which were in the U.S. water and wastewater sector.

The attackers primarily targeted internet-exposed devices that used default passwords or lacked password protection. The cyber offensive was not merely a matter of defacement; it involved altering the ladder logic within PLCs, which directly manage the operations of physical devices such as pumps and valves.

Unauthorized changes could disrupt essential functions, and attackers also tampered with device names, software versions, and remote access credentials, complicating recovery efforts.

Moreover, in some incidents, individuals responsible for these attacks replaced human-machine interface (HMI) displays with messages asserting responsibility and threatening Israeli-made equipment. This interference can obstruct plant operators from accessing crucial operational data.

CyberAv3ngers’ activities highlight the significant risks to critical infrastructure posed by weak operational technology security. When attackers compromise PLCs, they can take control of critical industrial processes, leading to potentially disastrous consequences.

In response, organizations operating PLCs and HMIs are urged to mitigate risks by identifying and eliminating devices directly exposed to the public internet. Strong password policies, multifactor authentication, and other security measures should be enforced.

For those using Unitronics Vision Series PLCs, CISA recommends updating engineering workstations and firmware to the latest versions and securing remote access through VPNs and firewalls.

Additionally, maintaining updated asset inventories and monitoring for unusual activities can help prevent such cyber threats. The ongoing activities of CyberAv3ngers underscore the urgent need for robust cybersecurity measures in industrial systems to defend against state-aligned adversaries seeking to disrupt critical services.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post U.S. Offers $10 Million Reward for Iranian IRGC Cyber Chief Linked to Critical Infrastructure Attacks appeared first on Cyber Security News.

Panzer ransomware has entered Italy amid a sharp rise in attacks. The ransomware-as-a-service, or RaaS, operation surfaced on August 5 and listed a kitchen manufacturer in Treviso and a telecommunications engineering firm in Catanzaro among its alleged victims.

The group advertises tools for Windows, Linux, FreeBSD, and VMware ESXi systems. An attack on a virtualization host can disrupt many business applications at once, turning one compromised server into a wider outage.

Panzer posted victims across 11 countries and the campaign arrived as claimed ransomware incidents in Italy reached 212 by September 6, above the 169 recorded during all of 2025.

Researcher Andrea Fortuna said in a report shared with Cyber Security News (CSN) that the Panzer’s victim posts should still be treated carefully.

Doimo Cucine and NTE Italia had not publicly confirmed the incidents when the report was published, but their listing may be a credibility-building tactic.

Panzer Ransomware Targets Italian Manufacturers

Panzer stands out less for a publicly examined encryptor than for the business system surrounding it. Prospective affiliates reportedly apply through Tox, face screening, and receive access to a dashboard for builds, negotiations, payment invoices, leak posts, and team accounts.

The stated split gives affiliates 80 percent of each payment and the platform 20 percent. Operators also claim to monitor new affiliates for signs of researcher or law-enforcement access, showing a controlled recruitment process.

Its ESXi option is particularly serious for manufacturers and telecom providers that run core workloads as virtual machines.

An intruder who reaches a hypervisor could encrypt multiple virtual disks and halt dependent services, rather than affecting a single employee device.

Reporting on VMware vCenter attack techniques illustrates how control of virtualization infrastructure can become a direct path to ransomware deployment.

Panzer also appears to pair encryption with data theft. The group claimed 30 GB of stolen data from Doimo Cucine and 16 GB of sensitive documents from NTE Italia.

Backups may restore systems, but they do not remove the pressure created by a threatened data leak or potential reporting duties. Researchers have not independently confirmed Panzer’s first access method or publicly analysed payload.

Available assessments instead associate the operation, with limited confidence, with password attacks, credential theft, remote-service movement, local data collection, security-tool tampering, and data transfers over alternative protocols.

Possible entry routes include vulnerable internet-facing VPN or gateway devices, exposed Remote Desktop Protocol services, phishing messages with malicious documents, and abused remote-management software.

The focus on exposed access points echoes reporting on RDP and VPN attack routes, where stolen credentials and unpatched perimeter systems open a route into internal networks.

Defending virtualized operations

Italian organizations should begin with remote access. Require phishing-resistant multi-factor authentication for VPN, remote administration, and privileged accounts; remove unnecessary privileges; and rotate credentials immediately when compromise is suspected.

Internet-facing appliances and remote-management tools also need prompt patching and regular exposure reviews.

Segmentation is equally important. Keep domain controllers, backup repositories, vCenter, and ESXi management interfaces away from everyday user networks.

Restrict administrative protocols to monitored management segments, so a compromised workstation cannot easily reach the systems that control an entire virtual estate.

Teams should watch for warning signs before encryption begins: unusual VPN logins, new administrator accounts, unexpected PsExec or WMI activity, unapproved remote-management tools, large archives in user or ProgramData folders, and unfamiliar cloud-transfer utilities.

A new ESXi ransomware campaign underscores why telemetry from hypervisors deserves the same attention as endpoint alerts.

Two commands deserve urgent attention when they appear unexpectedly on a server: vssadmin delete shadows and bcdedit recoveryenabled no.

They can remove recovery options, and responders should isolate the affected host, preserve evidence, and begin incident-response procedures rather than waiting for encryption.

Finally, maintain offline or immutable backups for every platform, including virtual machines, and test restorations routinely.

Monitor large outbound transfers, prepare legal and communications plans for double extortion, and ensure that recovery testing covers the applications and dependencies that keep production and telecom services operating.

Indicators of compromise (IoCs):-

Type	Indicator	Description
Leak site (.onion)	pnzruro7syvwvefx5mpo2fhzi4jftgquynsqf3vy5x3no57yp2iz4nyd.onion	Panzer leak-site address
Tox ID (affiliate recruitment)	8C3D96497A9438794F705C055FC2FD3059F6CF11FF51060EE55ED7F0679CFC7218825BD56CB1	Publicly listed affiliate-recruitment contact

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Panzer Ransomware Targets Italian Manufacturers and Telecom Firms With ESXi-Ready RaaS appeared first on Cyber Security News.

AI-powered customer service bots are being given more responsibility inside businesses, including access to customer profiles, billing data, support inboxes, account changes, and refund tools. The research showed that attackers may not need traditional vulnerability scanners or direct application exploitation.

Instead, they can manipulate the data and messages an AI agent receives, causing it to reveal sensitive information or perform actions as a legitimate customer.

One major risk involves chatbot transcript features. Many support bots let users email a copy of a conversation. An attacker could inject malicious text into a chat session and use the transcript function to create a phishing email that appears to come from a trusted support address.

If a customer receives a message from support@company.com, they may be more likely to trust it than a normal phishing attempt.

Email spoofing flaws can worsen the issue. Some AI agents identify users by reading the visible From header in an incoming email. However, email delivery and authentication systems may validate a different sender field.

An attacker could send an email that passes authentication using an attacker-controlled address, prompting the AI system to associate the message with a victim’s account.

AI Bots Tricked Into Stealing Security Codes

In one attack scenario, an AI customer service agent could receive a request that appears to come from a victim. The bot may then retrieve billing data, profile information, or account details.

If the attacker adds their own address to the CC or reply field, the bot could unintentionally send the confidential response to the attacker.

Security researcher Inti De Ceukelaire warned at Bug Bounty Village during DEF CON 34 that these capabilities can be abused through email tricks, prompt injection, identity confusion, and weak authentication checks.

The research also highlighted risks around multi-factor authentication. Some bots require a one-time passcode before making sensitive changes, such as updating a phone number.

But weak email normalization can sometimes allow attackers to reset rate limits by changing the format of an email address while still pointing to the same mailbox.

For example, different systems may treat comments, aliases, or unusual formatting in an email address differently. One component may recognize the address as belonging to the attacker.

At the same time, another backend service could parse embedded data differently and retrieve a victim’s account. This type of flaw is especially dangerous when raw user input is inserted directly into API requests.

AI agents connected to support inboxes can also expose third-party account codes. An attacker may first send an instruction designed to influence the bot’s behavior.

They could then trigger a legitimate password reset email from another service, such as a social media platform, to the company support inbox.

If the AI agent reads the incoming code and follows the earlier malicious instruction, it could forward or leak the code to attacker-controlled infrastructure.

Human approval does not always stop these attacks. A human operator and an AI agent may process different versions of the same email.

Attackers can use multipart messages, hidden HTML, CSS styling, quoted replies, or specially formatted attachments to present a harmless message to a human while exposing a malicious instruction to the AI system.

Knowledge-base poisoning is another growing concern. Customer service agents often use retrieval-augmented generation to answer questions from company documentation.

If a crawler indexes community comments, user profiles, or untrusted pages on the company domain, attackers may plant false instructions or fake discount codes that the AI treats as trusted internal information.

Organizations deploying AI support agents should strictly separate untrusted customer content from system instructions. They should authenticate users with verified session-bound identity controls, normalize email addresses consistently, validate all tool requests server-side, and prevent bots from sending secrets to unverified recipients.

AI agents should also have limited permissions. A chatbot that can read emails, modify accounts, issue refunds, and access third-party verification codes creates a high-value target. Businesses must treat AI agents as privileged automation systems, not just conversational interfaces.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post AI Customer Service Bots Can Be Tricked Into Stealing Security Codes and Acting as Victims appeared first on Cyber Security News.

BigBear 2.0 is a phishing operation designed to steal proof that a user has already passed multi-factor authentication.

It targets Microsoft 365 accounts through convincing sign-in links, then takes over the logged-in browser session rather than attempting to break the authentication factor.

The operation is a rebranded Evilginx2 phishing framework that targets Microsoft 365 accounts. Victims are drawn in through email links that open a proxy page resembling a Microsoft sign-in page.

It relays their traffic to the genuine service while quietly collecting credentials and the session data returned after sign-in.

CloudSEK analysts identified BigBear 2.0 in June 2026 after gaining access to its administrative panel. The researchers linked the activity to an operator using the alias General Boss and found a network of 42 virtual private server nodes.

CloudSEK said in a report shared with Cyber Security News (CSN) that the panel held 5,137 stolen records tied to 461 organizations and 3,331 unique victim IP addresses across more than 40 countries.

Of those records, 474 represented complete authenticated sessions, alongside 1,032 passwords and 4,148 session cookies. The records illustrate an operation that collects both immediate account access and material that may support persistent access later.

BigBear 2.0 Evilginx2 Phishing Campaign Bypasses Microsoft 365 MFA

BigBear 2.0 uses an adversary-in-the-middle setup, meaning it sits between the victim and the real Microsoft login service.

It captures the email address and password, lets Microsoft validate the request, and waits for the victim to complete their normal approval or code challenge.

When sign-in succeeds, Microsoft sends an authenticated session cookie to the browser. Because the proxy handled the exchange, it can copy that cookie before forwarding the response.

The attacker can replay it in another browser and enter email, Teams, SharePoint, OneDrive, and connected single sign-on applications as the victim. Microsoft 365 session hijacking campaigns have reported the same account-takeover risk.

This is not a weakness in a one-time password, SMS code, or push notification by itself. These methods confirm the user during the live session, but the proxy steals the resulting proof. BigBear used country-matched residential proxies and scripts that pushed users away from security-key authentication.

The campaign particularly affected IT services and managed service providers, a concern because one compromised provider can offer attackers a route into customer environments.

At least five affiliates were linked to the panel. Phishing kits targeting organizations show this service-based model is spreading.

Containing identity compromise

Organizations should treat a suspected stolen cookie as an identity incident, not merely a password problem. Reset affected passwords, revoke active sessions and refresh tokens, and force a new sign-in for impacted accounts.

Teams should examine mailbox forwarding rules, OAuth consent grants, unfamiliar application access, and sign-in activity for evidence that a hijacked session was used after authentication. This review should begin as soon as suspicious activity is reported.

The most useful long-term control is phishing-resistant authentication, especially FIDO2 or WebAuthn security keys and passkeys where properly deployed.

These methods bind a login cryptographically to the genuine site, making a lookalike proxy far less useful. Passkey attack techniques nevertheless deserve ongoing attention.

Administrators should require compliant devices through Conditional Access, shorten session lifetimes where appropriate, and watch for unusual residential IP ranges or new browser sessions.

Email filtering should inspect links that imitate sign-in pages even when they use valid certificates. Teams can monitor for the distinctive headers and cookies listed below, because infrastructure can be reassigned.

For users, a familiar Microsoft page and successful MFA prompt do not always prove that a browser is connected directly to Microsoft.

Verify unexpected sign-in requests through a trusted bookmark or known application, not an email link. This concern is reinforced by Evilginx session-cookie attacks, which also depend on real-time relaying rather than stolen passwords alone.

The campaign combined cookie theft, geographic proxy matching, and affiliate access. MFA must be paired with phishing-resistant methods, session controls, and rapid token revocation.

Indicators of compromise (IoCs):-

Type	Indicator	Description
IP address	38[.]60[.]250[.]157	BigBear 2.0 VPS node
IP address	95[.]179[.]233[.]79	BigBear 2.0 VPS node
IP address	80[.]240[.]27[.]55	BigBear 2.0 VPS node
IP address	65[.]20[.]103[.]58	BigBear 2.0 VPS node
IP address	38[.]54[.]124[.]88	BigBear 2.0 VPS node
IP address	208[.]85[.]20[.]79	BigBear 2.0 VPS node
IP address	95[.]179[.]169[.]154	BigBear 2.0 VPS node
IP address	107[.]191[.]46[.]14	BigBear 2.0 VPS node
IP address	130[.]94[.]82[.]180	BigBear 2.0 VPS node
IP address	38[.]54[.]124[.]58	BigBear 2.0 VPS node
IP address	208[.]85[.]18[.]18	BigBear 2.0 VPS node
IP address	45[.]32[.]147[.]239	BigBear 2.0 VPS node
IP address	208[.]76[.]222[.]214	BigBear 2.0 VPS node
IP address	130[.]94[.]82[.]230	BigBear 2.0 VPS node
IP address	65[.]20[.]102[.]80	BigBear 2.0 VPS node
IP address	70[.]34[.]208[.]46	Historical BigBear 2.0 VPS node
IP address	130[.]94[.]113[.]184	Historical BigBear 2.0 VPS node
IP address	78[.]141[.]193[.]59	Historical BigBear 2.0 VPS node
IP address	64[.]176[.]72[.]180	Historical BigBear 2.0 VPS node
IP address	136[.]244[.]114[.]85	Historical BigBear 2.0 VPS node
IP address	70[.]34[.]244[.]122	Historical BigBear 2.0 VPS node
IP address	199[.]247[.]10[.]14	Historical BigBear 2.0 VPS node
IP address	152[.]39[.]137[.]60	Historical BigBear 2.0 VPS node
IP address	91[.]245[.]235[.]208	Historical BigBear 2.0 VPS node
IP address	45[.]32[.]64[.]165	Historical BigBear 2.0 VPS node
Domain	konceptenterprises[.]com	Phishing domain
Domain	ccpipharma[.]com	Phishing domain
Domain	annastudios-paros[.]com	Phishing domain
Domain	dnsforward[.]com	Phishing domain
Domain	hotelmidtownsurat[.]com	Phishing domain
Domain	dataclust[.]com	Phishing domain
Domain	cifutura[.]com	Phishing domain
Domain	hoaivt[.]com	Phishing domain
Domain	dronalms[.]com	Phishing domain
Domain	virextec[.]com	Phishing domain
Domain	offtic[.]com	Phishing domain
Domain	rootreseller[.]com	Phishing domain
Domain	management[.]michaelmarcotte[.]com	Phishing domain
Domain	kgsscans[.]com	Phishing domain
Domain	soil-management[.]com	Phishing domain
Domain	daengrentacar[.]com	Historical phishing domain
Domain	arrmmy[.]com	Historical phishing domain
Domain	captelind[.]com	Historical phishing domain
Domain	planisteradmin[.]com	Historical phishing domain
Domain	hnospascualfadon[.]com	Historical phishing domain
Domain	haliotisbar[.]com	Historical phishing domain
Domain	knowncontractor[.]com	Historical phishing domain
Domain	valtteri[.]net	Historical phishing domain
URL	management[.]daengrentacar[.]com/meetings	Observed live Microsoft 365 phishing page
Filename	cookie.js	File attachment used in the credential-processing workflow
Telegram bot	@comeandget_bot	Primary administrator command-and-control bot, revoked
Telegram bot token	8629902848[:]AAGEFRukqwu9QaMSDNNuVRYF3juTcg4ehO4	Defanged token for revoked primary administrator bot
Telegram bot	@botterxyz_bot	Affiliate credential-exfiltration bot
Telegram bot token	8625043408[:]AAH6G8X0aW0QhoLEB1uJiYQ5-2aLSJzg8VE	Defanged affiliate bot token
Telegram bot	@PackingitonG_bot	Affiliate credential-exfiltration bot
Telegram bot token	8783369414[:]AAGENRhb7By-0-cQFgrnOw1AW4NbOeUutVE	Defanged affiliate bot token
Telegram bot	@donplayer_bot	Affiliate credential-exfiltration bot
Telegram bot token	8807072847[:]AAEYbUaFcbeAgxTZ2Zl8pFbpjRPM9jXvvzE	Defanged affiliate bot token
Telegram bot	@bolywan_bot	Affiliate credential-exfiltration bot
Telegram bot token	8462028468[:]AAEQt7oq0c3nTHzApQtHk3RdZ7ifnkYd1XM	Defanged affiliate bot token
Telegram bot	@rdsxtdytguyg75d_bot	Affiliate credential-exfiltration bot
Telegram bot token	8794520788[:]AAERSVBlWMpzHc21CCP_-9tL_pjqH9-WuFI	Defanged affiliate bot token
HTTP header	x-evg-token	Evilginx-related application header
HTTP header	x-evg-server	Evilginx-related application header
HTTP header	x-evg-session	Evilginx-related application header
Cookie	evginx_session	Evilginx-related session cookie
Cookie	evginx_token	Evilginx-related token cookie
Cookie	evginx_admin	Evilginx-related administrator cookie
Cookie	bigbear_session	BigBear 2.0 session cookie
Cookie	bigbear_token	BigBear 2.0 token cookie

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post BigBear 2.0 Evilginx2 Phishing Campaign Bypasses Microsoft 365 MFA With Session Cookie Theft appeared first on Cyber Security News.

Kimsuky has been observed using an AI agent to produce convincing phishing decoys at scale, then hiding malware inside Windows shortcut files. The latest activity shows how ordinary-looking documents can become the first step in compromise.

The campaign begins with spear-phishing messages carrying ZIP archives. Inside is a malicious LNK shortcut disguised as a document, often with a browser-style icon and false details. When opened, it displays a decoy while silently launching PowerShell to fetch additional code.

The 13 samples examined were collected between August 11 and 19, 2026, and used financial and corporate lures. That wider range raises the risk for corporate staff who routinely receive paperwork and financial notices.

Genians researchers identified the activity as a continuation of the Kimsuky-linked Operation GitPower cluster. 

Genians said in a report shared with Cyber Security News (CSN) that the campaign retains GitHub-based command infrastructure while adding evasion and varied decoy formats.

Kimsuky Hackers Use OpenCode AI Agent

The most notable change is evidence of opencode in the Creator and Producer metadata of several PDF lures.

Four documents carried the same August 16 creation timestamp, while their Author field remained set to “anonymous,” supporting the assessment that they were produced automatically rather than assembled one at a time.

The documents were not uniformly polished. Some contained unreplaced placeholder text for payment dates, grace periods, and financial values, a sign that drafts were pushed into use without careful review.

Other PDFs showed HeadlessChrome and Skia/PDF metadata, suggesting a separate workflow that generated HTML content and rendered it into cleaner-looking PDFs.

That combination gives attackers speed without abandoning familiar social engineering. Analysts found 29 retrieved decoy files but only 11 unique documents by MD5, with duplicated content redistributed under randomized names.

Readers can see the earlier context in Kimsuky local LLM phishing lures, where AI-made files were already used to make shortcut-borne attacks appear routine.

Such artifacts can disappear as operators refine their process, so defenders should not use document quality or metadata alone as the test for whether an attachment is safe.

LNK Loaders Hide GitHub-Based Payloads

Every analyzed LNK file launched PowerShell, concealing an encrypted loader in arguments stretching roughly 5,800 to 9,500 characters.

About 300 leading spaces helped keep the command out of sight in the shortcut properties window, while excess padding inflated file sizes to frustrate simple inspection and some automated checks.

After decoding the hidden content, the loader downloads a decoy and a follow-on script from GitHub Raw Content using a hardcoded personal access token.

It then creates randomly named PowerShell files in AppData or Temp, starts PowerShell through conhost.exe --headless, and registers hidden scheduled tasks that impersonate BitLocker, MATLAB, or .NET components.

One Visa-themed variant also pulled code from Pastebin, giving the operators a second delivery route if GitHub access is blocked. The approach builds on North Korea GitHub C2 attacks, where trusted developer platforms were used to blend malicious traffic into ordinary web activity.

Newer variants check for virtual-machine and analysis tools, look for the username “Bruno,” and delete PowerShell command history when they detect a likely research environment.

They also use error documents in some incomplete builds, but the persistence and payload retrieval stages can still run. Comparable LNK PowerShell loader techniques show why opening a file that merely looks like a PDF is not a reliable safety check.

Organizations should quarantine unsolicited ZIP attachments containing LNK files, especially when their icons and descriptions do not match their real type.

Security teams should correlate LNK launches with long command lines, hidden PowerShell, newly created scripts, scheduled-task registration, GitHub Raw requests carrying unusual tokens, and Pastebin access.

This behavior-first approach is more durable than relying on a single domain blocklist or decoy document review, and aligns with lessons from malicious shortcut file campaigns.

Indicators of compromise (IoCs):-

Type	Indicator	Description
MD5	10780939962b54addc9d31f57d80edfc	Malicious sample hash
MD5	1523a2fcc901965ab4568d9fe829e4af	Malicious sample hash
MD5	500e0bc0d7579fb338912770964076fe	Malicious sample hash
MD5	685bfc6b2c29fbc16cfad908894add55	Malicious sample hash
MD5	7a53089053b1381742856a5cf2b95f8b	Malicious sample hash
MD5	8db2f20b719dcb7029d6296505622093	Malicious sample hash
MD5	900e832c10d851bbdef3fb191a15db0e	Malicious sample hash
MD5	a2015665a3e18bf0ef86e3931245c7e6	Malicious sample hash
MD5	bb88940e915b11f6330b7446f6037f5b	Malicious sample hash
MD5	ce5932b88f879f26006df81f2fa7667e	Malicious sample hash
MD5	d0894d4626aae0f96d6b84ca3bb71a36	Malicious sample hash
MD5	e50f2ae7fb03675a1ef58b1cf9cda6d1	Malicious sample hash
MD5	f648bdd3c2cd902e239149de86d43e8f	Malicious sample hash
GitHub account	github[.]com/sven5500	GitHub account linked to campaign infrastructure
GitHub account	github[.]com/montry111	GitHub account linked to campaign infrastructure
GitHub account	github[.]com/jamjack2026	GitHub account linked to campaign infrastructure
GitHub account	github[.]com/urusa4400	GitHub account linked to campaign infrastructure
GitHub account	github[.]com/jamestony88	GitHub account linked to campaign infrastructure
GitHub account	github[.]com/baras6600P	GitHub account linked to campaign infrastructure
GitHub account	github[.]com/choemiyang	GitHub account linked to campaign infrastructure
GitHub account	github[.]com/jeni534	GitHub account linked to campaign infrastructure
URL	pastebin[.]com/raw/gybpx38s	Pastebin-based second-stage payload delivery URL
Email	baras6600@proton[.]me	Campaign-associated email address
Email	choemiyang@hotmail[.]com	Campaign-associated email address
Email	dustinharrise91@outlook[.]com	Campaign-associated email address
Email	jackal3300@proton[.]me	Campaign-associated email address
Email	jametony8@outlook[.]com	Campaign-associated email address
Email	jamjack2026@proton[.]me	Campaign-associated email address
Email	montry111@proton[.]me	Campaign-associated email address
Email	sven5500@proton[.]me	Campaign-associated email address
Email	taini7700@outlook[.]com	Campaign-associated email address
Email	urusa4400@proton[.]m	Campaign-associated email address, recorded exactly as listed in the source

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Kimsuky Hackers Use OpenCode AI Agent to Mass-Produce Phishing Decoys in LNK Attacks appeared first on Cyber Security News.

South Korean automotive and media organizations have been hit by a quiet Linux intrusion toolkit built for long-term access.

The malware hides inside software that manages web traffic, allowing attackers to watch users, steal information, and change pages delivered through compromised servers.

The operation appears designed for patience rather than disruption. Attackers likely entered through a groupware portal or mail server, used the edge server as a bridge into internal systems.

That pattern echoes the risks described in stealthy Linux server intrusions, where hidden access can remain active without drawing attention.

Analysts at Rapid7 identified the toolkit and assessed its link to DPRK-aligned advanced persistent threats with medium confidence.

Rapid7 said in a report shared with Cyber Security News (CSN) that the activity likely dates to early 2025, although the precise initial entry point and any exploited vulnerability have not been confirmed.

The affected organizations had ports 80, 443 and 25 exposed, with a groupware login service on port 443 and mail services on port 25.

These systems sit at the network edge, making their compromise serious: an intruder can collect credentials, move deeper inside, and potentially target visitors passing through that server.

DPRK-Linked Hackers Deploy Ted Backdoor

The central component, called ted backdoor, is a modified build of HAProxy 2.8.12, software commonly used to direct website traffic.

Instead of acting like a separate malicious program, it is compiled into the legitimate load balancer and uses its built-in features to inspect decrypted web requests while normal traffic continues to flow.

That placement gives the operators unusual control. The implant can capture session cookies and selected request details, run commands, upload or download files, and inject a malicious script into pages served to chosen visitors.

Its hidden command channel uses a request for a picture-like path, while its code also reduces HAProxy connection counters to make activity harder to spot. Researchers found an SSH keylogger as well as altered versions of crond, agetty, atd, sshd and polkitd.

The stager checks the operating system and whether HAProxy or cron is present before replacing the cron service, copying timestamps from a legitimate SSH binary, and removing chosen words from logs.

This reflects the same concern raised by Linux backdoors stealing SSH credentials: trusted system components can become the attacker’s hiding place.

CurlRAT supplies the remote-control layer. It polls attacker infrastructure for tasks, can execute commands, send system details, install added payloads, and open reverse or interactive shells with elevated privileges. A watchdog monitors HAProxy and reports whether the service starts, stops, reloads, or restarts.

Long-Term Espionage Risks and Defenses

Rapid7 said the combination of credential theft, web-session collection, selective page changes, and traffic redirection points to long-term espionage.

The targeting of South Korean media and automotive firms also fits a regional intelligence-gathering pattern. Readers following Kimsuky espionage activity in Korea will recognize why exposed groupware and stolen credentials remain valuable footholds.

The operators used basic XOR encryption and a substitution method to protect configurations and communications. Their command-and-control domains imitate image delivery services, including one that resembles a popular Korean web platform’s static-content naming style.

Rapid7 also noted overlap in timing and delivery concepts with other DPRK activity, but said more evidence is needed for a firmer attribution. Defenders should review edge systems that handle web traffic, encryption, mail, or runtime modules.

They should compare deployed HAProxy and Linux service binaries against known versions, inspect unexpected shared libraries and cron changes, and rotate credentials that may have passed through affected servers. Independent network monitoring matters because logs on a compromised device may have been altered.

Teams should also investigate unusual requests to image-like paths, unexpected outbound connections from load balancers, and web responses that change only for particular visitors.

Regular patching of groupware and mail servers reduces likely entry opportunities. As shown by recent Asia-focused Linux espionage, post-compromise tools can turn a single exposed server into a durable route across an organization.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
SHA-256	5db1b6d52faf60b4f32d6fd0c7c938e4d05d29a14c32ded4a9668357c08b6a91	CurlRAT stager
SHA-256	09739441ed4599bac2f8159028f772f71e4b25c8badfff95574e56d7384f3dbe	CurlRAT stager variant
SHA-256	fea1bc36632c71e5a839803469ef60ac47595d36b2c50934ac109ade6df06e61	CurlRAT stager variant
SHA-256	83f7d565b0465546027052b597af46eae3a199e7a91fcc2ab936341147349130	CurlRAT
SHA-256	7007a78d50a993cb174c685eba96eb442c9507e38fd9d8e5dffc712f613ec110	CurlRAT
SHA-256	6cf1b5e92a9c0756f597a5ddefb38eba32961c52efac7ab2a0aa52c639a8fc53	CurlRAT
SHA-256	ed72f4cd8d467b5c5d95ae6aeca4aaeea14d79565d379c1ca5871a714727be16	CurlRAT
SHA-256	feeea9d0bf6ae7396d28271baa51ae50df5169ce5d32a516865856f91abc50b3	CurlRAT
SHA-256	d53c760c23b4405eb04ad0f20ead375440344b3bdf1fb7854ed12e40d155eabe	Trojanized cronie binary
SHA-256	2f02b09d61d432134e994ad671258f523bbf289ae6091fd4eae192c60bd51b6f	Trojanized agetty binary
SHA-256	8f30b57928934ae67478d0e690c91d046e35a638da098d02922a4a88a0fdb66c	Trojanized atd binary
SHA-256	a1d8af3a6acb731f07f72040eccb3450c1c83d40e29f736c2a63d35388660be4	Trojanized polkitd binary
SHA-256	12810854c8b2c391b23e2e18b013e873d0369b0637aa3cf993136c07188ba3b8	CurlRAT sample
SHA-256	009a1e2d7a582a24e50cf2ffc2a005482c8e38f22bf5ed416053855f8d054e1e	CurlRAT sample
SHA-256	4bb923eb040aa13ca8fd409c31ee4729c60ddff32e350efe1c5a4a9168a065f5	SSH keylogger
SHA-256	94630b96f628c96a6bff7904b40ffc9ad67c86f8a4ff6080c3b524831c93f402	Ted backdoor
SHA-256	72e70936f0dbe459142a1d867617c35f8d0cce5d18c6a49e1090a2a5adc8e558	Modified HAProxy build containing ted backdoor
SHA-256	a8bfab4de81a1acb04aacdf757346946b0f5e30f0c9f402004016d0e425119c7	Ted backdoor sample
Domain	img.monderhouse.space	CurlRAT command-and-control infrastructure
Domain	img.smartnords.site	Command-and-control infrastructure
Domain	img.darklights.store	Backup CurlRAT configuration host
Domain	img.responsive.pstatic.autos	Command-and-control infrastructure masquerading as static content
Domain	img.socialteams.store	Command-and-control infrastructure
Domain	img.worksongo.store	Command-and-control infrastructure

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post DPRK-Linked Hackers Deploy Ted Backdoor and CurlRAT Against South Korean Firms appeared first on Cyber Security News.

Roundcube Webmail has released security updates for its 1.6 LTS and 1.7 branches, fixing 12 vulnerabilities that could expose users and servers to cross-site scripting, email header injection, cross-user data access, remote-content bypasses, and server-side request forgery attacks.

The new releases, Roundcube 1.6.19 and 1.7.4, address flaws in how the open-source webmail platform processes email content, HTML, Cascading Style Sheets, attachment metadata, contact groups, and remote URLs. Administrators running production deployments of Roundcube 1.6.x or 1.7.x are urged to update as soon as possible.

One of the most serious issues fixed is a zero-click stored cross-site scripting vulnerability involving the injection of TNEF MIME tags into attachment URLs.

TNEF, or Transport Neutral Encapsulation Format, is commonly associated with Microsoft Outlook attachments. An attacker could potentially send a specially crafted email that triggers malicious script execution when the victim views the message, without requiring the user to click a link or open an attachment.

The updates also fix another XSS issue in Roundcube’s HTML editor when handling text/enriched email content. Cross-site scripting weaknesses can allow attackers to execute JavaScript in a victim’s webmail session, creating opportunities to steal session tokens, alter mailbox settings, read messages, or perform actions as the logged-in user.

Several fixes address email header injection risks. These bugs affected the subject field, recipient display name, and an identity’s organization field.

Header injection vulnerabilities can be abused to manipulate email metadata or insert unexpected mail headers if malicious input is not correctly sanitized.

Roundcube also patched a cross-user access issue in SQL-based address books. The flaw involved adding or removing members from contact groups.

It could allow one user to modify another user’s group associations under certain conditions. This type of issue can compromise contact privacy and the integrity of address book data in shared or hosted Roundcube environments.

Remote-content protections received multiple fixes, addressing CSS declaration smuggling, HTML body background property injection, CSS-escape bypasses in FuncIRI attributes, and SVG SMIL source animation techniques that could bypass remote-content blocking.

Roundcube Webmail Patches 12 Security Flaws

The updates further fix an is_local_url() validation bypass involving fully qualified domain names with a trailing dot in stylesheet URLs. Attackers could exploit differences in URL parsing to make an external resource appear local and bypass intended restrictions.

A server-side request forgery bypass was also resolved in the Roundcube CSS proxy. The weakness involved hexadecimal IPv6-mapped IPv4 addresses, which could potentially help an attacker bypass address validation and force the server to request internal or restricted network resources.

Roundcube said full technical details are available in the release notes for versions 1.6.19 and 1.7.4. The project strongly recommends that all organizations operating affected Roundcube installations apply the updates promptly.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Roundcube Webmail Patches 12 Security Flaws, Including Zero-Click XSS and SSRF Bypass appeared first on Cyber Security News.

A counterfeit Minecraft optimisation mod is installing Myth Stealer, malware that can steal browser passwords, cookies and data. Its malicious file looks useful because features work as advertised, giving players little reason to suspect a hidden threat.

The campaign exploits users seeking performance improvements from unofficial add-ons. Once installed, the fake mod starts a multi-stage infection chain that leads to a remote tool that lets its operator collect data and broadly control a Windows device.

Analyst devmihaylov identified the malware while examining samples obtained from a buyer of the commodity stealer.

devmihaylov said in a report shared with Cyber Security News (CSN) that the files initially received zero detections from VirusTotal, showing how lightly distributed threats can evade reputation-based checks.

Minecraft players remain frequent targets for malware distributors. Coverage of fake Minecraft Fabric mods showed how a harmless-looking game download can become the first step in account theft and compromise. The threat pairs a decoy with a loader designed to blend into a gaming setup.

Fake Minecraft Mod

The Java archive presents itself as a companion to a legitimate optimisation project and includes 12 working modules that change game performance settings.

A hidden thirteenth component waits briefly, gathers system information, then retrieves and starts the next stage in the background. That approach matters because victims may see the expected optimisation behavior and conclude the download is safe.

The loader uses a large executable built around a standard runtime and brings a private Java environment, letting the payload run even where Java is not otherwise installed.

Before launching the final stage, the program displays a polished administrator-rights request resembling a normal Windows prompt.

Accepting it can give the malware greater access and helps its installation. It also contains retry logic intended to cope with security software interrupting the process.

The final component is heavily disguised to slow investigation. Its code uses reserved Windows-style names, encrypted text and obstacles that can break basic extraction tools.

This concealment, combined with an apparently genuine mod, makes a quick visual check of a download an unreliable safeguard.

Credential theft and remote control

Myth Stealer targets data stored by Chromium-based browsers and Firefox, including saved usernames, passwords, browsing records and active session cookies.

Stolen cookies can be especially damaging because they may let an attacker reuse an already authenticated web session. Readers can see why browser passwords and cookies remain valuable targets in similar data-theft operations.

The malware also collects system details, chat content, clipboard data and files, can capture screenshots or webcam material.

Its remote-control features include running commands, downloading or deleting files, managing processes and setting itself to start again after a reboot.

Researchers also found functions that could disrupt a victim. These include changing display settings, interfering with the mouse or keyboard, showing misleading full-screen messages and attempting to restrict access to security tools.

They can complicate recovery and pressure users to follow an attacker’s instructions. The operation used web-based reporting channels to receive stolen information, a technique documented in coverage of Discord webhook abuse across other malware campaigns.

Although the analysed command infrastructure was no longer responding when reported, inactive servers do not erase the risk to systems already infected.

Players should obtain mods only from trusted project pages, confirm the developer and file integrity, and avoid downloads promoted through chat links, videos or unofficial file-sharing pages.

This echoes guidance from reporting on trojanized Minecraft mod downloads, where social engineering is central to reaching players.

Anyone who installed a suspicious mod should remove it, run a full security scan and change passwords from a clean device.

They should also sign out of important accounts to invalidate sessions, review browser extensions and look for unfamiliar programs that start automatically. An unexpected administrator prompt during mod installation is a serious warning sign.

Indicators of compromise (IoCs):-

Type	Indicator	Description
SHA-256	2003869ed68eaa053f63bf6a5093050f52d520da877c017a4f62658000bba2a3	MythStealer.jar stage-one dropper
SHA-256	38789d9ac5f8cad13f510bc9d0e47809777bef913f329a9f526a11d33aeca09d	DiscordNitroGenerator.exe stage-two container
SHA-256	bd4eb81a12526daa040ceccc14135006dfd9792e7c21ec5fab9c2cb0400f6718	client.jar, Myth Stealer 3.2-FIX payload
File name	MythStealer.jar	Counterfeit Minecraft mod and stage-one dropper
File name	DiscordNitroGenerator.exe	Stage-two Node.js-based container
File path	%APPDATA%\Microsoft\Windows\javaw.exe	Dropped stage-two executable
File path	%TEMP%\webcam-<timestamp>.jpg	Webcam-capture output
File name	sqlitejdbc.dll	Native library loaded from the temporary directory
File name	jnidispatch.dll	Native library loaded from the temporary directory
URL	hxxp[://]ip-api[.]com/json/?fields=query,countryCode	Host geolocation lookup
URL	hxxps[://]www[.]dropbox[.]com/scl/fi/tvvsyk7x5kkbdfyuw7zh7/DiscordNitroGenerator	Second-stage download location
IP address	146[.]19[.]191[.]11	Command-and-control infrastructure
URL path	hxxp[://]146[.]19[.]191[.]11/s	Command server-list endpoint
URL path	hxxp[://]146[.]19[.]191[.]11/t	Telemetry endpoint
URL path	hxxp[://]146[.]19[.]191[.]11/l	Upload endpoint
URL	hxxp[://]146[.]19[.]191[.]11/api/injection	Discord injection-script endpoint
Domain	ays[.]gamepazarin[.]com	Backup command-and-control domain
URL	hxxps[://]canary[.]discord[.]com/api/webhooks/1545915606111625276/LwbwHWZBbQTP	Stage-one reporting webhook
URL	hxxps[://]discord[.]com/api/webhooks/1476291391826034944/xXOpsSG_GM0Hvf74rKbqw	Embedded exfiltration webhook
URL	hxxps[://]discord[.]com/api/webhooks/1476291402403942472/Let5i1nhtIG1cScI3vJmp	Embedded exfiltration webhook
URL	hxxps[://]discord[.]com/api/webhooks/1476291404757078189/NI-dMuvT_02i7Ee-HgX3v	Embedded exfiltration webhook
URL	hxxps[://]discord[.]com/api/webhooks/1476291406283935865/GIRbMQaDzYFV1qH95IxAo	Embedded exfiltration webhook
URL	hxxps[://]discord[.]com/api/webhooks/1476291406795509872/Qxjec0dl9zszu2giJYC3R	Embedded exfiltration webhook
Registry value	HKCU\...\Policies\System\DisableTaskMgr	Disables Windows Task Manager
Registry path	HKCU\Control Panel\Cursors	Used for cursor replacement
Registry path	HKCU\Software\Microsoft\ColorFiltering	Used for screen-colour inversion
Product identifier	mythkg-exe 2.21	Launcher product name and version
Build identifier	myth-gee9ute7hb	Build identifier embedded in payload
C2 keys	rawr, owo, uwu	Obfuscated server-list configuration keys

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Fake Minecraft Mod Deploys Myth Stealer RAT to Steal Browser Credentials and Cookies appeared first on Cyber Security News.