Posts on Security, Cloud, DevOps, Citrix, VMware and others.
Words and views are my own and do not reflect on my companies views.
Disclaimer: some of the links on this site are affiliate links, if you click on them and make a purchase, I make a commission.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog, following active exploitation in the wild.
The vulnerabilities are listed below -
CVE-2026-111357 (CVSS score: 8.8) - A missing authentication for a critical function vulnerability that could allow a local authenticated attacker to escalate their privileges.
CVE-2026-118527 (CVSS score: 4.3) - A generation of predictable numbers or identifiers vulnerability that could allow a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.
It's worth noting that the security bugs are part of an exploit chain that was first documented by Volexity earlier this month as weaponized in conjunction with an authentication bypass flaw (CVE-2026-104935, CVSS score: 8.6) by a previously undocumented threat actor dubbed UTA0576. CVE-2026-104935 was added to the KEV catalog on October 13, 2026.
"This exploit chain combined an authentication bypass, a remote code execution (RCE), and a privilege escalation vulnerability to achieve unauthenticated root-level code execution," Volexity noted.
Unlike other attacks that typically exploit such flaws to deploy web shells or malware, UTA0576 has been observed leveraging the flaws to extract credentials and limited Active Directory metadata; conduct host reconnaissance; and search for administrator passwords and BitLocker recovery keys.
At the time of public disclosure, Ivanti said it was in the process of developing fixes for the privilege escalation vulnerability employed in the exploit chain. Patches for both CVE-2026-111357 and CVE-2026-118527 are now available in the following versions of ICS -
25.1.1.2 and prior (Fixed in 25.1.1.3)
22.8R2.5 and prior (Fixed in 22.8R2.6)
"At the time of discovery of exploitation, Ivanti had a fix developed for CVE-2026-104935 which was already in QA for supported versions, and we made the decision to not delay getting a fix to customers that resolved the primary exploitation path when the LPE was discovered," Ivanti explained.
"Because of this, our focus was initially centered on the disclosure of CVE-2026-104935 and providing protection for our customers as quickly as possible."
The company also noted that it discovered a portion of this vulnerability as part of its product security program and patched it in the July release 25.1.3.0, adding it had been working to backport the fix to other supported versions when exploitation activity occurred.
The latest release addresses all vulnerabilities which were chained and exploited in the wild. Federal Civilian Executive Branch (FCEB) agencies are required to apply the fixes for CVE-2026-111357 by November 2, 2026, and CVE-2026-118527 by November 13, 2026.
from The Hacker News https://ift.tt/aKSRJHl
via IFTTT
Threat actors are launching about 8,226 network-layer distributed denial-of-service (DDoS) attacks per hour, Cloudflare revealed Thursday.
The web infrastructure and security company said it autonomously mitigated 18.2 million network-layer (L3) DDoS attacks and 14.4 trillion HTTP DDoS requests in the third quarter of 2026. That amounts to 197,400 attacks per day, or one attack every 0.44 seconds.
In comparison, a total of 13.2 million and 10.0 million L3 DDoS attacks were recorded in Q2 and Q1 2026, respectively. The increase has been linked to DDoS-for-hire booter or stresser services that are responsible for hundreds of thousands of attacks.
"Short-burst, low-bandwidth attacks lasting under 10 minutes and 1 Gbps surged by 208%," the Cloudforce One threat intelligence team said in its quarterly DDoS Threat Report shared with The Hacker News.
An interesting trend is the decline of hyper-volumetric attacks exceeding 1 Tbps by 69% from the previous quarter – going from 805 attacks in Q2 to 251 in Q3 – likely as a result of law enforcement actions against AISURU, KimWolf, JackSkid, and Mossad earlier this March.
Still, the threat remains far from completely neutralized, given the emergence of new variants like Dysphoria and Evooo1Bot, Cloudflare warned.
Another notable shift is the decline in Connectionless Lightweight Directory Access Protocol (CLDAP) floods, while DNS amplification jumped 215% to account for 3.43% of all network-layer attacks.
The most targeted industries include media, production, and publishing; information technology and services; gambling and casinos; computer software; and telecommunications providers.
The U.S., China, Indonesia, the U.K., and Türkiye emerged as the most attacked countries during the time period, with Canada and Israel entering the top 10 ranking, fueled by attacks targeting Canada's retail, telecommunications, and marketing sectors.
from The Hacker News https://ift.tt/j3Tz1Vs
via IFTTT
On October 29, 2026, Cursor reported that a tampered copy of Claude Code extension (anthropic.claude-code, versions 2.1.313 and 2.1.312) was available and served in the Cursor extension marketplace for a few hours to attempt a supply-chain attack on Cursor users. Cursor reports that it was live from about 2:27 AM to 1:35 PM Pacific Daylight Time (PDT). We have confirmed that the malicious packages found on Cursor marketplace were never published nor distributed from Microsoft Visual Studio Marketplace and from npm @antropic-ai/claude-code, which were not affected by this incident. Anthropic confirmed to Microsoft that their systems were not compromised and they did not develop the malicious package posted in Cursor marketplace. At this time, all evidence suggests that the incident is limited to Cursor marketplace.
Microsoft Threat Intelligence analyzed the injected JavaScript embedded in the malicious extension package. The injected loader runs when the extension module loads and attempts to add an attacker-controlled Secure Shell (SSH) key, enable the local SSH service, establish reverse SSH forwarding, configure persistence, and report host details. Successful remote access depends on host privileges, SSH configuration, and the attacker’s server configuration; however, the loader may still write keys and persistence artifacts even when tunnel access fails.
Organizations should identify systems that installed or automatically updated to this version from the Cursor marketplace, preserve evidence, remove confirmed malicious artifacts, review endpoint and network telemetry, and rotate credentials or revoke sessions when investigation indicates exposure. Microsoft customers can use the detections and hunting guidance in this post after the listed coverage and query validation gates are complete.
Attack chain overview
A malicious artifact associated with the Cursor Marketplace incident included a JavaScript function that executed before the extension’s expected code. When the module loads, this function can use Node.js APIs to collect host information, modify files, and execute operating-system commands. The following sections describe capabilities and attempted actions based on our analysis of the injected code.
Attack chain
The loader first collects host reconnaissance. It then attempts to install an SSH key, enable SSH, create a reverse tunnel, and configure persistence. A delayed callback subsequently attempts to send host details. The following sequence reflects code execution order; it does not prove that every step succeeded on every host.
Module loading and reconnaissance collection. The injected function executes before normal extension initialization and collects host and user information.
SSH access preparation. The loader appends an embedded public key and attempts to enable the local SSH service.
Reverse forwarding. An embedded tunnel identity authenticates an outbound connection that requests forwarding to the workstation’s SSH port.
Platform-specific persistence. Scripts and startup configuration are written to relaunch the connection.
Host reconnaissance reporting. After the access and persistence setup attempts, a delayed callback attempts to transmit the previously collected host details and selected environment-variable names.
Figure 1. Attack chain reconstructed from the injected code.
The loader uses embedded components and built-in system tools to establish persistent access without downloading another executable. It suppresses command output and silently catches errors to conceal failures and malicious activity, while the extension continues functioning normally to avoid alerting users.
Host reconnaissance collection
The loader collects the hostname, username, operating system, architecture, home directory, working directory, and global Git email. It also looks for environment-variable names containing terms such as KEY, TOKEN, SECRET, PASS, AWS, or GCP, keeping up to forty matches.
The callback sends matching environment-variable names, not values. This reveals potentially sensitive configuration categories but does not demonstrate theft of the secrets stored in those variables.
Collection occurs during module loading. The collected details are retained for the delayed reporting callback described after the persistence stage.
SSH authorization and tunnel identities
The loader uses two SSH identities with distinct roles. One public key authorizes access to the workstation’s user account, while a separate private key authenticates the outbound connection to the tunnel server. First, the loader checks the user’s authorized_keys file for the comment svc-telemetry. If the marker is missing, it appends an embedded Ed25519 public key. That creates an authorization entry for whoever holds the corresponding private key, subject to the local SSH server’s configuration.
Next, it decodes a separate private key for the outbound connection. The initial copy is written to a hidden temporary file named .stk_ followed by ten hexadecimal characters derived from the hostname and home directory. SSH receives that file through its -i option and connects using the remote account tunnel.
The public-key material is redacted but the format is similar to the following:
The tunneling SSH process is launched with the command line containing the following arguments:
-N -R '*:0:localhost:22'
It requests a listening port on the remote SSH server and forwards connections through the tunnel to port 22 on the victim’s loopback interface. The remote port value 0 asks the server to allocate a port; it does not change the local target from port 22. The -N option tells SSH not to run a command on the tunnel server.
This design starts with an outbound connection from the workstation rather than waiting for a direct inbound connection to it. The loader disables ordinary host-key checking, bypasses the normal known-hosts file, sets keepalives, and avoids interactive prompts. On Unix-like systems it prefers autossh, falling back to ssh; on Windows it uses a hidden PowerShell loop. The loops wait sixty seconds after SSH exits before retrying.
Figure 2. Terminal-style SSH command configuring an outbound reverse tunnel from a server-assigned remote port to the workstation’s local SSH service on port 22. Host-key verification is disabled, and the identity-file path is redacted.
A running SSH process does not necessarily mean the attacker gained access. Both the attacker’s server and the victim’s workstation must allow the connection, and server settings determine whether the tunnel is publicly reachable. Cursor reports that errors and administrator-permission requirements blocked SSH access on most macOS and Windows hosts. However, the malware could still attempt to plant its SSH key, establish persistence, and report host information.
Platform-specific startup persistence
The loader writes platform-specific scripts and startup configuration outside the extension directory. The following table summarizes these mechanisms and their associated artifacts. The code attempts to configure persistence, but the presence of an artifact alone does not establish that the startup mechanism ran successfully.
On Unix-like systems, the .smt script reconstructs the persistent .smtk identity when it runs, then starts its own SSH retry loop. On Windows, the loader writes the identity and batch script directly.
The startup objects use names such as SysMon and com.apple.sysmond, which resemble monitoring components. Behind these names, their configured actions invoke the generated scripts that maintain reverse SSH forwarding.
Mitigation and protection guidance
Immediate actions
Run advanced hunting queries below to identify affected systems and investigate systems where users installed or automatically updated anthropic.claude-code version 2.1.313 and 2.1.312 through the Cursor Extension Marketplace. Review extension-installation records and correlate endpoint, network, file, process, and authentication telemetry with the published indicators. Preserve the extension package, modified SSH authorization files, generated keys and scripts, and startup configuration before cleanup. Isolate devices with evidence of loader execution or backdoor installation.
Remediation actions
After evidence collection, check the affected user’s ~/.ssh/authorized_keys on macOS and Linux for the attacker-controlled key labeled svc-telemetry. On Windows, check both %USERPROFILE%\.ssh\authorized_keys and C:\ProgramData\ssh\administrators_authorized_keys, where present. Confirm the key against the fingerprint in Indicators of Compromise before removing the exact unauthorized entry. Preserve unrelated SSH keys and legitimate remote-development configuration. A missing marker alone should not replace review of the installation, process, network, and persistence evidence.
Remove the trojanized extension and confirmed malicious persistence after evidence collection. Inspect each startup object’s configured action before removal; names alone are not sufficient to distinguish malicious objects from legitimate monitoring software.
macOS: Unload and remove the malicious user LaunchAgent at ~/Library/LaunchAgents/com.apple.sysmond.plist and remove its associated ~/.config/.smt script and ~/.config/.smtk identity.
Linux: Remove the malicious user-crontab @reboot entry referencing ~/.config/.smt, preserving unrelated entries, and remove the associated script and ~/.config/.smtk identity.
Windows: Remove the malicious SysMon scheduled task, the Startup-folder sysmon.cmd fallback, and associated %USERPROFILE%\.config\smt.cmd and %USERPROFILE%\.config\smtk files.
All applicable platforms: Stop confirmed malicious SSH and retry processes and remove their temporary .stk_ identity files after collection.
Cursor published platform-specific checks and remediation scripts in its security notice. Review the scripts and execution requirements before use, then verify that no listed artifacts remain. Cleanup does not replace investigation of device activity during the exposure window.
Removing or updating the extension does not remove artifacts written outside its installation directory. Remove confirmed unauthorized SSH keys, tunnel identities, scripts, and startup entries separately. Cursor’s reported server takedown does not remove artifacts already present on a device.
Follow-up Investigation and recovery
Review telemetry after the extension loaded for SSH key acceptance, tunnel processes, local SSH sessions, command execution, and file activity. Rotate credentials and revoke sessions from a known-clean device when telemetry indicates credential access or when device trust cannot be restored. Rebuild the device when required by the investigation and verify that the tunnel and startup artifacts do not return after login or restart.
To reduce the risk of malicious extensions and extension-based supply chain attacks, organizations using Cursor should apply the relevant controls in Cursor’s security-hardening guidance, including restricting extensions to approved publishers and configuring an extension installation cooldown to delay installation of newly published versions. These measures can help limit exposure to malicious releases.
Microsoft Defender XDR detections
Microsoft Defender XDR customers can refer to the list of applicable detections below. Microsoft Defender XDR coordinates detection, prevention, investigation, and response across endpoints, identities, email, and apps to provide integrated protection against attacks like the threat discussed in this blog.
Customers with provisioned access can also use Microsoft Security Copilot in Microsoft Defender to investigate and respond to incidents, hunt for threats, and protect their organization with relevant threat intelligence.
Tactic
Observed activity
Microsoft Defender coverage
Execution
Execution of suspicious shell scripts to support backdoor activity.
Microsoft Defender for Endpoint – Suspicious activity originating from a code editor
Microsoft Defender Antivirus – Trojan:MacOS/SmtShellMal.A – Trojan:JS/CredTheft.MS!MTB
Persistence
Addition of SSH authorized keys or loading of macOS LaunchAgents to maintain unauthorized access and Scheduled Task on windows.
Microsoft Defender for Endpoint – Suspicious addition of an SSH key – Suspicious launchctl tool activity – Suspicious scheduled task
Defense Evasion
Use of a macOS launch configuration that impersonates a legitimate Apple system service.
Microsoft Defender for Endpoint – Suspicious Plist modifications
Microsoft Defender Antivirus – Trojan:MacOS/MalPlistSysmond.A
Command and Control
Use of SSH reverse tunnels to enable backdoor access to a compromised device.
Microsoft Defender for Endpoint – Suspicious SSH tunneling activity
Microsoft Defender Antivirus – HackTool:MacOS/RevAnthShell.A
Threat intelligence reports
Microsoft customers can use the following reports in Microsoft products to get the most up-to-date information about the threat actor, malicious activity, and techniques discussed in this blog. These reports provide intelligence, protection information, and recommended actions to prevent, mitigate, or respond to associated threats found in customer environments.
The following queries use the Microsoft Defender XDR advanced hunting schema and the time range selected in the portal. A result is an investigative lead, not proof of compromise.
Connections to the reported infrastructure
Find network events involving the reported IP address during the last 30 days, including the process responsible for each connection.
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemoteIP == "134.209.82.225"
or RemoteUrl has "134.209.82.225"
| project Timestamp,
DeviceName,
InitiatingProcessFileName,
InitiatingProcessCommandLine,
RemoteIP,
RemotePort,
RemoteUrl
Reported malicious file and persistence artifacts
Find file events matching the reported SHA-256 hash, artifact filenames, or filename prefix during the last 30 days. Filename matches are hunting leads and require investigation.
DeviceFileEvents
| where Timestamp > ago(30d)
| where SHA256 == "ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15"
or FileName in~ (
".smt",
".smtk",
"smt.cmd",
"smtk",
"sysmon.cmd",
"com.apple.sysmond.plist"
)
or FileName startswith ".stk_"
| project Timestamp,
DeviceName,
ActionType,
FolderPath,
FileName,
SHA256,
InitiatingProcessFileName,
InitiatingProcessCommandLine
SHA-256 values might not be populated for every file event. The filename and prefix conditions provide additional hunting leads.
Possible Windows scheduled-task persistence
Find scheduled-task creation events whose additional fields contain both reported terms, SysMon and smt, during the last 30 days.
DeviceEvents
| where Timestamp > ago(30d)
| where ActionType == "ScheduledTaskCreated"
| where AdditionalFields has "SysMon"
and AdditionalFields has "smt"
| project Timestamp,
DeviceName,
AccountName,
AdditionalFields,
InitiatingProcessFileName,
InitiatingProcessCommandLine
DeviceEvents
| where ActionType == "PlistPropertyModified"
| where FolderPath has "com.apple.sysmond.plist"
MITRE ATT&CK techniques
The following mappings describe behaviors implemented or attempted by the analyzed loader, not confirmed execution on every affected host. They do not establish attribution to a particular threat actor.
Attempts a Windows startup task requesting SYSTEM execution.
Indicators of compromise (IOCs)
The following indicators are associated with the publicly analyzed JavaScript sample. The remote address is defanged. Contextual strings and paths require behavioral correlation and should not be treated as conclusive evidence of compromise on their own.
Indicator
Type
Description
134.209.82[.]225
IP address
Configured remote SSH and HTTP destination
hxxp://134[.]209[.]82[.]225:8099/beacon
URL
Reconnaissance endpoint; correlate with the configured address
svc-telemetry
Key comment
Installed authorization-key marker; verify the key material
To hear stories and insights from the Microsoft Threat Intelligence community about the ever-evolving threat landscape, listen to the Microsoft Threat Intelligence podcast.
Review our documentation to learn more about our real-time protection capabilities and see how to enable them within your organization.
Ahmad Umar Agha, a Syrian Electronic Army hacker known online as "Th3Pr0," has been sentenced by a U.S. federal court to 42 months in prison for his role in a hacking conspiracy that targeted Western news outlets.
The conspiracy was organized and led by members of former Syrian President Bashar al-Assad's inner circle, including the commander of Syria's General Intelligence Directorate, the U.S. Justice Department said on October 29.
The pro-Assad Syrian Electronic Army began its attacks in 2011. Its members sent phishing emails to steal employees' passwords, then used those passwords to deface websites, redirect web traffic, and hijack social media accounts, according to a 2014 FBI affidavit.
On April 23, 2013, the group hijacked the Associated Press's Twitter account and posted a false report that President Barack Obama had been injured in two explosions at the White House.
Twitter's message confirming a password reset for that account was sent to a Gmail account used primarily by Agha, the affidavit says.
The Justice Department said Agha carried out that hack, which caused a temporary $136 billion drop in the value of stocks in the Dow Jones Industrial Average. Agha later told Business Insider that a big drop in the Dow "was our goal of that hack attack" and that "it was a big victory for us."
Agha was first charged in June 2014 in a complaint that remained secret until March 2016. That month, the FBI added him and co-defendant Firas Dardar to its Cyber's Most Wanted list with a $100,000 reward. A federal grand jury indicted both men in May 2018.
Court Watch reported in December 2025 that Agha was in U.S. custody and had appeared in federal court the month before.
Three earlier public documents in the case do not describe Syrian officials organizing or leading the group: the 2014 FBI affidavit, the Justice Department's March 2016 announcement of the charges, and its May 2018 announcement of the indictment.
In the 2016 announcement, the department said the group acted "in support of" the Syrian government.
An early study of the group, published by the OpenNet Initiative, found no credible evidence directly linking the attackers to the Syrian government beyond the unspoken support any such group would need to operate on Syrian networks.
In announcing the sentence, the department also said the conspiracy collected intelligence for Assad's government, which fell in December 2024. "Agha deployed his hacking skills in the service of Assad's regime to silence reporting on the regime's atrocities, intimidate its opponents, and incite U.S. servicemembers to refuse their orders," said John A. Eisenberg, Assistant Attorney General for National Security.
In all, Agha hacked about 47 Western media outlets, businesses, non-profit groups, and U.S. and allied government bodies, the department said.
He got into the company that hosted the U.S. Marine Corps recruiting website and redirected its visitors to an image urging Marines to refuse their orders and fight alongside the Syrian Army. About 3,500 potential visitors saw that image instead of recruiting material.
He also twice tried to take over the White House's social media accounts by stealing White House staff email passwords. Once, he got into staff email but failed to trick other staff into giving him access.
The FBI affidavit describes the group breaking into a White House staff member's personal email account in July 2013 and says no official White House account was compromised.
Many victims spent large sums on cleanup and security upgrades, according to court filings cited by the department. One company that supplies online publishers with content, ads, and links lost about $35,000 a day for about six months. A global non-profit group lost $480,000, including about $250,000 on new network monitoring tools, and had to retrain more than 800 staff members.
Dardar remains a fugitive, the department said. He was also charged in a separate case with Peter Romar, a Syrian national then living in Germany. Romar was extradited to the U.S. and pleaded guilty in 2016.
from The Hacker News https://ift.tt/thyidkN
via IFTTT
Cybersecurity researchers have disclosed details of a software supply chain attack campaign in which the official Claude Code extension was compromised to install a persistent SSH backdoor on infected hosts.
According to OpenSourceMalware, details of the extension are as follows -
"The package identifies itself as anthropic.claude-code version 2.1.313, but its main JavaScript bundle contains a malicious 66-line loader inserted before the legitimate extension code," Jenn Gile, co-founder of OpenSourceMalware, said in a statement shared with The Hacker News.
As of October 30, 2026, the malicious version has been removed, and Anthropic has published 2.1.314. It's currently not known how the compromise happened.
The extension is designed to activate after VS Code startup and when its webview opens, then proceeds to add an attacker-controlled key to the user's "~/.ssh/authorized_keys" file. The key is labeled "svc-telemetry" in an attempt to make it appear harmless.
Subsequently, it attempts to make the victim reachable through SSH across Windows, Linux, and macOS, establishes a reverse tunnel to "134.209.82[.]225," installs platform-specific persistence in the form of a scheduled task, crontab, and LaunchAgent, and transmits host reconnaissance data to "134.209.82[.]225:8099/beacon" on port 8099 over an unencrypted HTTP request.
"Turning on the local SSH service requires admin rights, which the malicious extension does not have on most macOS and Windows hosts," AI coding platform Cursor said in its own analysis of the incident.
"On those hosts the step fails and the attacker could not have logged in through the tunnel. The extension still adds the attacker's SSH key, installs persistence, and sends host details to the attacker. Follow the remediation steps below regardless."
The collected data includes -
Public IP address from api.ipify[.]org
Hostname and local username
Operating system and CPU architecture
Home directory and current working directory
Global Git email from git config --global user.email
Names of up to 40 environment variables containing KEY, TOKEN, SECRET, PASS, AWS, or GCP
"Environment-variable values are not placed directly in the initial beacon," security researcher Paul McCarty said. "Their names can still reveal which cloud providers, CI systems, and credential types are configured. More importantly, successful SSH access would allow the operator to inspect the account directly."
No other follow-on payloads have been observed. That said, the establishment of a reverse tunnel provides a pathway to the victim's SSH service, allowing the operator to issue commands or transfer files.
"It was pulled very quickly, but anyone who has their Claude Code instance set to auto-update could have consumed the malware," Gile said.
Cursor has revealed that the incident has affected at most 5,000 users who installed the malicious version between about 2:27 a.m. PT and 1:35 p.m. PT on October 29, 2026, and that it will be reaching out to them directly.
Users who have installed the compromised extension during the window are advised to isolate the hosts, remove the unauthorized SSH key and persistence mechanisms, and rotate credentials and sessions.
The disclosure comes a little over a week after an unknown attacker replaced the release binaries of five already-published versions of OVHcloud's official CLI ("ovh/ovhcloud-cli") with a secret-stealing malware after uploading them through a GitHub account of a legitimate OVH contributor ("HassenBF") hijacked in March 2026 as part of the GlassWorm operation.
from The Hacker News https://ift.tt/5ZzLwhq
via IFTTT
Drupal has warned that threat actors are exploiting a "highly critical" security flaw in its Commerce Core component.
The vulnerability, tracked as CVE-2026-118539 (CVSS score: N/A), is a case of missing authorization affecting Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13.
"This module enables you to sell goods and services to customers through an included shopping cart and checkout form or through decoupled applications via APIs," Drupal said in an advisory.
"The module doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor."
The open-source content-management framework acknowledged that the vulnerability is being "actively exploited in the wild," but provided no specifics about the nature of the activity or the extent of the campaign.
Users are being recommended to update to the latest version -
Version 3.x - Upgrade to Commerce Core 3.3.13
Earlier versions - Upgrade to Commerce Core 8.x-2.41
Drupal has credited researchers Dan Puccetti (dpuccetti), Marcus Johansson (marcus_johansson), and Robert Snyder (rsnyd) with reporting the flaw.
The development comes as two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), and collectively referred to as PHP2Shell, are witnessing active exploitation attempts in the wild.
As of October 25, the percentage of organizations significantly affected by PHP2Shell has declined to 52.1%, according to data from Google-owned Wiz.
The cloud security company said it has so far observed two types of activities, including attempts using the PHP2Shell exploit mechanism that match public proof-of-concept (PoC) exploits.
The other category refers to "PHP2Shell-branded tools unrelated to the vulnerabilities that instead relied on session poisoning and a separate local file inclusion (LFI) vulnerability in the application," Wiz researchers Yaara Shriki, Shahar Dorfman, Alma Blachsan, and Yaron Samuel said.
"Our observations show that triggering memory exhaustion alone is not enough to complete the exploit chain. Differences in PHP builds, memory limits and worker behavior can prevent subsequent stages from working. The challenge for opportunistic attackers is turning currently available public PoCs into similarly reliable operational tooling or developing it on their own."
from The Hacker News https://ift.tt/oA5D38V
via IFTTT
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Cisco and GitLab software to its Known Exploited Vulnerabilities (KEV), citing evidence of active exploitation.
The vulnerabilities are listed below -
CVE-2026-97229 (CVSS score: 10.0) - An integer overflow or wraparound vulnerability in GitLab Community Edition and Enterprise Edition that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration due to insufficient regular expression validation.
CVE-2026-76418 (CVSS score: 8.6) - An unchecked return value to NULL pointer dereference vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial-of-service (DoS) condition.
The development comes after Cisco said it became aware of active exploitation of this vulnerability earlier this month. It has not publicly identified the attackers, the number of targeted organizations, or the actions taken by attackers after gaining initial access.
As for CVE-2026-97229, its addition relates to a security incident disclosed by Alpine Linux in which an unknown threat actor unsuccessfully attempted to exploit the flaw targeting its instance on October 20 and 21, 2026.
Specifically, the attacker probed an unpatched GitLab instance by sending crafted CI configurations, causing the GitLab worker processes to crash eight times. In four of those crashes, the exploit failed at the next step.
The threat actor also downloaded Alpine Linux's GitLab container image. Subsequent attempts by the attacker to get back in on October 25 and 26 were blocked.
"The attack came close to working," the maintainers of the security-focused Linux distribution said. "We have found no evidence that it succeeded, but we cannot rule it out, so we treated the instance as compromised and rebuilt it from scratch. Our checks show that the aports repository, packages, and the October 21 releases were not tampered with."
In light of active exploitation, Federal Civilian Executive Branch (FCEB) agencies are recommended to apply the fixes by November 1, 2026.
from The Hacker News https://ift.tt/bHEa0OB
via IFTTT
Cryptocurrency giant Binance said on Thursday that a "security incident" on its platform has impacted about $6.3 billion worth of assets.
The world's biggest cryptocurrency exchange said nearly $3 billion of those assets have been frozen on-chain so far.
Tether and Circle said they have frozen more than 1.567 billion USDT and 800 million related to the incident, respectively. The Arbitrum Security Council is said to have executed a transaction to freeze about $30.5 million from the Binance Exploit.
"Initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions," Binance said in an update.
The company said there is no evidence of a wallet private key leak, adding it will cover all losses from the Secure Asset Fund for Users (SAFU) fund and its own funds.
Out of an abundance of caution, Binance has also taken the following steps -
Temporarily suspended deposits and withdrawals while security checks are completed
Revoked the affected address authorization;
Engaged law enforcement and blockchain intelligence partners to trace and recover funds
"We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice," Binance said.
The development makes it the biggest cryptocurrency heist recorded to date, surpassing the theft of about $1.5 billion from Bybit in February 2025. The incident was subsequently attributed to North Korea.
"Our current estimate on the amount stolen is approximately $5.912 billion at time of theft, nearly 4x the amount stolen in the next largest crypto heist," blockchain intelligence firm Chainalysis said in an X post.
(This is a developing story. Please check back for more details.)
from The Hacker News https://ift.tt/lWQZFCE
via IFTTT
Some attacks take real skill. Others just need someone to leave a door open. This week has both. Exposed passwords, old bugs still getting exploited, and trusted software doing things it shouldn't.
There's a strange mix of clever tricks and careless mistakes. Hackers are borrowing trust from familiar apps, websites, and AI tools. Some are using AI to speed things up. Others are leaving their own attack files exposed. Not exactly careful work.
Different stories, familiar weak spots. Here's what showed up this week.
The threats change every week. Subscribe, and we’ll alert you when each new ThreatsDay Bulletin is out.
WordPress security company Wordefence said it's not aware of any WordPress site compromised through PHP2Shell (CVE-2026-109618 and CVE-2026-109619) as of October 28, 2026. "We continue to see PHP2Shell-related requests across the more than 5 million sites we protect," it said. "Those requests show ongoing scanning and exploitation attempts; they do not show whether an attempt succeeded. Our site-cleaning and incident response teams have not handled a WordPress compromise attributed to these vulnerabilities."
Hudson Rock's investigation into the FortiBleed credential harvesting campaign has uncovered 975 newly identified domains and 40,573 exposed secrets, including 37,076 local-user records and 1,576 Active Directory LDAP bind records. The data comes from newly obtained 1,703 FortiGate source files associated with 1,689 host identifiers. "The configuration material dates to around February 2026, earlier than the likely May/June material examined in the first investigation," Hudson Rock said. The latest discovery has been codenamed FortiBleed 2.0.
Threat actors have used domain shadowing to place illegal gambling content beneath legitimate school and government domains in two unrelated operations. "In both cases, an unauthorized party appears to have gained access to DNS administration and created records that the original domain owners may not have noticed," Infoblox said. "Because the resulting hostnames sat within established institutional namespaces, they provided especially useful infrastructure for search-engine optimization (SEO) and traffic acquisition." One cluster, linked to a threat actor called Hidden Hawk, has been found to add individual CNAME records that mapped institutional hostnames to gambling pages hosted largely on Cloudflare Pages. The second campaign exploiting an Indian government domain "delegated entire subzones to third-party authoritative nameservers and used a wildcard, allowing many hostnames to be managed outside the victim's DNS environment." Put differently, the unauthorized DNS access creates new institutional hostnames, which resolve to infrastructure serving illegal gambling doorway pages. The pages also leverage the established reputation of school and government namespaces to ensure that the malicious URLs show up prominently in search engine results.
Bank of America is reminding customers not to share banking credentials with AI agents. In an email blast to customers titled "Protecting your finances in the AI World," the financial institution urged customers to never share their username and password with another person or an outside service, "including an AI-enabled tool or agent that offers to act on your behalf."
Google has announced that an upcoming Android release will no longer be able to directly write to contacts with the WRITE_CONTACTS permission. "Instead, you can use the standard contact intents (ACTION_INSERT, ACTION_EDIT, and ACTION_INSERT_OR_EDIT)," Google said. "Currently, if your app needs to save even one contact, you might be requesting WRITE_CONTACTS. But that permission grants broad access, allowing an app to make widespread changes to contacts across the device in the background, even without user interaction. Most apps don’t need such broad permission."
A scan of 7.25 million public repositories on Gitee, China's largest indigenous Git hosting platform, has uncovered 26,400 unique verified-live credentials, including an active organization-admin credential for a major enterprise AI platform and thousands of live cloud provider access keys, independent security researcher Ben Zimmermann said.
Fortinet has released a "coordinated set of security updates for FortiOS, FortiManager, and FortiAnalyzer" to address critical and high-severity flaws that were flagged using an AI-assisted vulnerability discovery approach. Details of the issues are being kept under wraps until November 10, 2026. With Fortinet devices becoming a favorite target for attackers, it's essential that users move quickly to apply the fixes.
Details have emerged about a now-patched flaw in Microsoft Authenticator (CVE-2026-80097 aka AuthMask) that could be exploited by installing and running a malicious application on an affected Android device and convincing the user to complete an authentication flow in the app by claiming to be a trusted app and getting the corresponding tokens. The flaw could be exploited to take over work accounts without requiring additional permissions. "Successful exploitation could allow the attacker to obtain authentication tokens and access resources as the affected user," Microsoft said. According to Enclave, "an unprivileged Android app with zero permissions could impersonate any installed Microsoft first-party app and have the Microsoft Authenticator broker hand it that app's tokens. The setup is a device with Authenticator installed and one work account signed into it."
Attackers are disguising themselves as AI agents to steal credentials. Cequence said it has tracked a single actor running AI agent impersonation at scale by posing as about 32 different AI bots, including ChatGPT, Claude, and Perplexity, while searching for passwords, API keys, and cloud credentials. "The malicious scanner runs from a major cloud provider and rotates through about 32 AI bot identities, spanning crawlers and assistants from OpenAI, Anthropic, Meta, Perplexity, and others," Will Glazier said. "It ignores web pages and requests files that commonly store secrets, including .env configuration files, cloud credential files, private SSH keys, and server environment data, working from a list of roughly 90 file paths. Each address sends a short burst of 50 to 190 requests in about eight seconds and then moves on. The scanner works through targets one at a time, around the clock, and first sends random nonsense paths to find websites that answer every request, a common scanning technique. It hit organizations in financial services, retail, telecommunications, energy, and software, and stayed active from at least late September through late October."
The U.S. Embassy in Fiji has revealed that hackers linked to China broke into a regional organization based in Suva between July and August 2026. "Hackers with links to China maintained access to the organization's network over several days," it said. The embassy did not name the threat actor. Nor did it disclose what data the attackers may have accessed.
Attackers have been breaking into enterprise networks via camera management software, according to new research from security firm Huntress, which observed multiple incidents in September and October 2026 and traced them back to a compromised application. Source code artifacts point to a Korean company selling analog and IP cameras and digital and network video recorders. The activity abuses the legitimate "WpcMon.exe" binary to sideload DLLs that establish outbound connections to a remote server. "This activity demonstrates how attackers can blend malicious code with trusted Windows components to evade detection," Huntress said.
In a major operational security blunder, an unknown threat actor stole 68 GB from a Philippine government agency, maintained a detailed log of the transfer, then left that log open on the internet at 13.163.205[.]35:80. "The copy finished in under 24 minutes on September 6, 2026," Hunt.io said. "The transfer log records 27 SQL Server backups whose filenames correspond to the case-management systems of a Philippine overseas-employment and migrant-worker administration. Beside the log sat the operator's toolkit, a rebranded GodPotato build, a PowerShell stager, two payloads and a full Impacket environment."
Canadian AI company Cohere has claimed that it caught Alibaba's Qwen3.8-Flash-Next model unsuccessfully attempting to send data to China from its evaluation sandbox as part of a prompt instructing the LLM to detect malicious file download and execution by monitoring for curl processes downloading bash scripts to /tmp followed by bash execution. "Asked to write a defensive detection rule, Qwen3.8-Flash-Next ignored instructions and inventoried the machine it was running on and then tried to upload a probe file to an Alibaba Cloud storage bucket in Beijing," Cohere said. "We cannot answer whether this is deliberate or a leftover glitch from training." Cohere has also released a dataset containing the model trace and corresponding raw token IDs in connection with the behavior. "The exact output is not guaranteed all the time, and many trials may be required to reproduce the behavior," Cohere said, adding "there are similarly unexpected URLs that the model also tends to output, most containing aliyunc." However, the findings have also led to social media chatter that the company is resorting to geopolitical fearmongering and that they are an attempt to clamp down on open-weights models.
The U.S. National Institute of Standards and Technology (NIST) has released guidelines that detail the timelines for transitioning away from quantum-vulnerable algorithms to quantum-resistant standards. "The report describes different use cases and says why one migration might take longer than another," said NIST mathematician Dustin Moody, who heads the PQC standardization project. "We understand there's not one strategy that fits all use cases, and we want to help people handle their migration while staying abreast of what's changing."
SOCRadar has uncovered the live workspace (i.e., open directory) of a threat actor tied to the n0n ransomware group, which exposed the operation's full workflow as of September 2026. The directory at 185.157.161[.]148 includes an AI coding agent configured with about 150 models to produce hundreds of attack scripts, with more than $7,216 in usage costs. "Entry points included a credential stuffing campaign against 305 FortiGate SSL-VPN devices, exposed AWS keys, weak RDP/WinRM credentials, and compromised hosting management portals," SOCRadar said. At least 23 organizations across 14 countries are said to have been identified in the workspace, including a U.S. sports retailer, a cloud provider, a teachers’ union, a Venezuelan ISP, an Argentine ministry and a pharmaceutical subsidiary.
The Swedish government has barred employees from accessing browser-based versions of ChatGPT or Claude on their work computers over security concerns relating to the processing of sensitive data. "Officials were concerned that entering sensitive information into these models without an agreement setting out how to protect and secure the data could lead to it being fed into the model and stored for training," Euro News reported.
JFrog and SafeDep have uncovered a campaign in which threat actors hijacked third-party 42 GitHub repositories across 11 owners to deploy payload blobs large enough "to evade the GitHub search and API paths normally used to find this kind of compromise." JFrog said, "The repositories contain execution hooks for AI coding assistants and IDEs, plus 12.9 to 13.7 MB polymorphic wrappers that all decode to the same hidden CI-publisher payload." The activity is assessed to be related to a Miasma-family npm worm propagated under various packages ending with "testmetest." According to SafeDep, the worm "shares code with Miasma 'Phantom Gyp' from June 2026 and adds the token-revocation wiper from Mini Shai-Hulud. The malicious versions steal credentials, spread to other packages and repositories, and install a wiper that deletes the home directory when the victim revokes the stolen GitHub token." Unsuspecting developers who installed the packages had their data stolen and repositories compromised with malicious code to produce further malicious testmetest releases and run shellpanel workflows targeting cPanel systems through CVE-2026-41940, overlapping with a prior campaign detailed by Socket in July 2026.
A new Android malware operation called MR ROBOT is targeting customers of Indian banks and transforming banking fraud into a subscription business, with cybercriminals renting customized banking trojans to steal OTPs, card details, UPI PINs and credentials while secretly forwarding calls to bypass security checks. "It is not a single-actor campaign but a rented crimeware platform: a master operator leases access to affiliates, who use a Telegram bot ('APK Shield) and a web control panel (v7.0) to build personalized banking trojans on demand and distribute them through fake Play-Store-style pages and messaging-app lures," CloudSEK said. The kit impersonates around 36 lure apps, including banks, utility providers, and government services. One affiliate is estimated to have intercepted 5407 text messages from 153 infected devices.
Threat actors are abusing legitimate mobile device management (MDM) platforms, like Hexnode and Rippling, by using social engineering to enroll devices or install management agents, per Huntress. "Once established, MDM provides a trusted, privileged path for malicious activity, such as deploying rogue RMM tools and maintaining remote access," it said.
Threat actors are exploiting CVE-2026-42589 (CVSS score: 9.8), a critical remote code execution flaw in Gotenberg, to deliver a Go-based reverse shell called "cache_base." The flaw was patched in May 2026. According to VulnCheck, the activity originated from a residential Japanese IP address in early October 2026. "The execution flow is straightforward: acquire a lock, collect host information, connect to C2, register the victim, and open a shell," VulnCheck said. Over the past 30 days, the vulnerability has recorded 1,358 exploitation events from 128 unique source IP addresses.
Discord has announced it will allow search engines to index discussions in Discoverable Servers and make them accessible on the web to users outside the platform without an account or invitation, starting mid-December 2026. "Discussions in Discoverable Servers will soon be easier to find when you search the web, so you can find the answer you're looking for and step straight into the conversation on Discord," it said. The changes apply only to Discoverable Servers and do not extend to private servers and direct messages.
The Gentlemen ransomware operation has claimed more than 800 victims across multiple regions and sectors, with most attacks targeting organizations in the U.S. and Europe. "The group supports multiple platforms, with ransomware variants targeting Windows, Linux, NAS, and BSD systems, allowing its affiliates to target a broad range of enterprise environments," Acronis said. "The group's operations include the use of EDR-killing tools. In a recent incident, a custom dropper was observed deploying vulnerable Safetica ProcessMonitorDriver [CVE-2025-70795] and Lenovo BootRepair.sys drivers to terminate security processes."
Pillar Security has disclosed an arbitrary-code-execution vulnerability in Unsloth's core model-loading path (CVE-2026-93348, CVSS score: 8.6). It has been fixed in unsloth_zoo 2026.8.14. "An attacker-controlled model configuration could cause Python code to execute during loading," researcher Ariel Fogel said. "The affected code ran inside the model-loading process, with access to whatever that process could read, modify, or authenticate to. In an AI development environment, that can include proprietary datasets, model artifacts, Hugging Face tokens, and cloud credentials. Exploitation required an affected loading path to process an attacker-controlled configuration."
XBOW said it identified an unauthenticated, critical-severity remote code execution bug in a public web application belonging to the U.S. Election Assistance Commission (EAC). "The vulnerable application was a resource/logistics calculator, not a voting machine or voter registration system," XBOW researcher Ariel Walter Garcia said. "The flaw allowed an unauthenticated attacker to execute code as root inside the backend container, with access to locally protected resources and outbound network connectivity, a privileged foothold reachable via a crafted unauthenticated web request."
A new remote access trojan called DarkCore comes with a dedicated browser that could let attackers access Gmail, WhatsApp, and MediaFire accounts using stolen sessions, while giving the impression that the activity is originating from the victim's own IP address. DarkCore was first advertised on cybercrime forums in August 2026. "The seller describes a browser that reuses those sessions to access work mailboxes, instant messaging apps, cloud storage and other services through the infected machine's IP address," BlackFog said. "The purpose is to make the access look like legitimate activity from the user."
Cisco Talos has disclosed details of a new AI-integrated command-and-control (C2) framework called NIK C2. The implant features surveillance, theft, lateral movement, and evasion capabilities, including credential dumping, RDP session hijacking, process hollowing, and a C2-driven screen lock ransomware module. "NIK C2 contains a Windows implant, using which, an actor can dump credentials, stream the victim's keystrokes to collect the targeted victim's sensitive data, and instruct an integrated AI model to analyze the harvested data, all within the compromised session," Talos said. "In this framework, the actor has abused the OpenAI Chat Completions application programming interface (API), which is an HTTP endpoint that enables ChatGPT-style conversations programmatically. In addition to the features that enable theft, an actor can also deploy desktop screen-locking ransomware via the NIK C2 implant onto the victim machine, leading to a ransom demand in Bitcoin or USDT cryptocurrencies." Three different versions of the malware have been identified to date since August 12, 2026. Talos said NIK C2 alters adversary tradecraft by collapsing collection and exploitation into a single continuous session.
A phishing email using a FedEx tax invoice lure and containing a ZIP archive with a PDF has been observed triggering a multi-stage infection process to deliver a previously undocumented variant of the Sirius Backdoor. "The PDF abuses /OpenAction and /Launch objects to trigger an embedded Base64-encoded PowerShell command upon opening," Trellix said. "Execution relies on social engineering to trick the user into approving the PDF reader's security confirmation prompt. The PowerShell stager decrypts and reflectively loads a .NET assembly in memory. This loader performs process hollowing into legitimate Windows processes such as msbuild.exe, svchost.exe, etc., allowing the malware to operate under trusted process contexts." The final payload is SIRIUS, a Microsoft Visual C++ based backdoor with extended remote access capabilities.
A new analysis from Flare has revealed that threat actors are building a mixed AI toolkit, combining commercial models with local, open-weight, and jailbroken alternatives, as well as leaning on stolen AI credentials to shift costs to victims. "Where AI can help is with understanding systems, writing tools and troubleshooting. The threat actor still needs access, decisions and a way to obtain payment," Flare said. "If AI helps an affiliate write a working data-export script without hiring a specialist, the affiliate may avoid that specialist’s fee and the wait for their help. AI makes expertise cheaper to obtain only when the cost of using and checking its work is lower than the cost of the specialist help it replaces."
A recently observed cyber-extortion actor named ScarlettGroup is publicly advertising alleged data compromises and uses negotiation deadlines and threatened disclosures to pressure targeted organizations. The group's dark web site listing includes victims from technology, education, government, and entertainment sectors. "ScarlettGroup demonstrates characteristics associated with financially motivated data-extortion operations, including public victim claims, deadline-based pressure, and underground forum activity," Foresiet said. "Its dedicated leak-site infrastructure and structured disclosure mechanism indicate an organized approach to promoting alleged compromises and exerting reputational pressure."
Following its disruption in June 2026 as part of Operation Endgame, StealC has returned four months later as Stadia. "This time it's not a stealer: it's a full remote access trojan," Varonis said. "The RAT's features include hidden desktop control, a live command shell, a file explorer, a process manager and an in-memory loader, with StealC's stealer welded on as one module among six. The actor behind Stadia is working hard to win back original StealC customers: every former StealC customer is offered a free month on the top ($900) tier." The development comes as Moonlock Lab revealed that the Icarus macOS stealer has similarly evolved from a smash-and-grab crypto and data stealer to a malware with remote-access capabilities. The new iteration is called ICMacOS. "The stealer is actively advertised on cybercrime forums by a Russian-speaking actor operating under the handle GlowComa, with feature updates regularly announced via Telegram," SOCRadar said. "GlowComa promotes ICMacOS alongside Icarus ClickFix, a companion panel designed to deliver payloads using malicious copy-and-paste terminal commands. The infection chain relies on initial dropper scripts to detect the host architecture and harvest administrator passwords using fake system dialogs before delivering the primary payload." Another macOS-focused stealer is Aokigahara, which goes beyond browsers, VPN clients, cryptocurrency wallets, FTP/SFTP clients, password managers, and email applications to also target AI applications and development tools. "The stealer collects authentication files, session data, and configuration files associated with Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, and other tools," Check Point said. "Stolen AI credentials could offer opportunities for monetization. Usable credentials or session tokens could enable unauthorized access to paid AI services or the resale of compromised accounts."
That's the week's mess. Some attacks were clever, some were painfully simple, and a few attackers made life easier for the people investigating them. The common problem? Too much trust in things nobody was watching closely.
AI is adding new tricks, but the old ones aren't going anywhere. Stolen credentials, weak access controls, and forgotten bugs still get plenty of work done. New tools, familiar mistakes.
The useful part is knowing where those mistakes keep showing up. That's usually where the next problem starts.
from The Hacker News https://ift.tt/IxEDcW7
via IFTTT
Threat actors are delivering malicious loaders and cryptocurrency miners under the guise of artificial intelligence (AI) desktop applications for Anthropic Claude and OpenAI ChatGPT as part of a campaign dubbed Yoba.
The activity involves creating fake GitHub projects that claim to be desktop applications like GPT-5.6 Sol, GPT-6 Astra, and Claude Opus, only to deliver a malware family called YobaLoader.
"The malware is placed next to legitimate, signed executables from OpenAI and Anthropic so it can be loaded indirectly, a technique commonly known as DLL sideloading, which is often used to bypass security protections," Check Point Research said in an analysis.
To add to the project's credibility, the attackers set up GitHub.io pages to describe the capabilities of the software. Although the GitHub projects' popularity is not manipulated using techniques like ghost networks, signs point to the use of SEO poisoning tactics to ensure that links to them are surfaced on top of search results on Google.
Some of the identified GitHub pages links are below -
github[.]com/gpt-5-6/sol-free-desktop
gpt-5-6.github[.]io
github[.]com/gpt-5-6/gpt-5-6.github.io
github[.]com/gpt-6-astra/gpt-6-astra.github.io
gpt-6-astra[.]github[.]io
github[.]com/opus-5-0/opus-5-0.github[.]io
opus-5-0[.]github[.]io
"Each repository uses a different email address (edwardcarlsonmkym[@]outlook[.]com, daxschneiderdjuu[@]outlook[.]com, and rioprestonlfyx[@]outlook[.]com), and the uploader appears to operate in UTC+4, UTC-4, and UTC+3 respectively," Check Point said. "This inconsistency likely reflects a deliberate attempt to obscure the threat actor's true operational time zone."
Hosted within these repositories are ZIP archives that, among other files, contain two specific components -
Setup.exe, a legitimate signed OpenAI Codex or Claude executable
winmm.dll, a malicious DLL that's sideloaded by the executable
The DLL is a dropper codenamed YobaDropper, which implements checksum value checks by hashing the basename of its host executable and if it matches a hard-coded value "0xE6C2F326." In other words, the check requires it to be launched under "Setup.exe," and fails if the DLL is executed on its own inside a sandboxed environment.
Additional anti-analysis techniques and pre-checks include 200,000 iterations of "Sleep(5500)," which amounts to 12.73 days, and skipping machines whose keyboard layout corresponds to that of Russia, Belarus, Tajikistan, Armenia, Azerbaijan, Georgia, Kazakhstan, Kyrgyzstan, Turkmenistan, and Uzbekistan.
Another language ID excluded from the infection process is Tatar. Notably missing from the list is Ukraine, which used to be historically included in such checks.
YobaDropper, for its part, triggers a DLL sideloading chain of its own comprising "wmpdmc.exe" and "ampdui.dll," copying the former from its "system32" folder and placing it in a new directory named "WMProcess" created under "ProgramData."
The dropper then extracts and decrypts an embedded payload, and drops it into the same folder as "wmpdui.dll." It also establishes persistence by means of a scheduled task that launches the legitimate executable to load the malicious payload.
The second DLL is YobaLoader. It implements the same anti-sandbox technique as YobaDropper, requiring the malware to be run only by "wmpdmc.exe" by checking the hash against a hard-coded value ("0x552751E3"). The loader is responsible for three main tasks -
Downloads an image from a Telegram channel ("t[.]me/yoba_fanclub").
Uses the last 50 bytes as a seed to generate a domain based on three lists of dictionary words and an integer value in the range 0–999 using a domain generation algorithm (DGA). The end result is domain in the format "adjective-noun-verb-digit.dedyn[.]io."
Queries Google's DNS-over-HTTPS (DoH) API to obtain a Base64-encoded command from a DNS TXT record by passing the constructed domain as input.
Decrypts the response to obtain the link to fetch the next-stage payload ("files.catbox[.]moe/z5zpy9.dat").
"By relying on a DoH service and common file-hosting platforms, the actor aims to bypass passive DNS monitoring and some gateway-based security protections, making their command-and-control traffic harder to distinguish from regular user activity," Check Point said.
The downloaded payload is then injected into "svchost.exe," resulting in the execution of an XMRig cryptocurrency miner.
Evidence indicates that the first GitHub repository was created around July 2026, although the malicious releases were not uploaded until the end of August. What's more, early versions of YobaLoader have been found to only exclude Russia from infection, while also incorporating extensive anti-debugging and anti-VM checks, which have since been removed in newer versions.
"The Yoba campaign shows how attackers can use trusted platforms and the current interest in AI tools to distribute malware in a way that looks believable and harmless at first glance," Check Point said. "By packaging their code together with well-known software names and hosting it on GitHub, they lower the chances that users or basic security checks will immediately flag the files as suspicious."
from The Hacker News https://ift.tt/OxWYSce
via IFTTT
