ADMIN.FOUNDATION

  • Top 10 Best Fraud Prevention Companies in 2025

    ·

    , ,

    Fraud prevention has become one of the most important priorities for enterprises, financial institutions, and digital-first businesses in 2025. With rising cyber threats, account takeovers, synthetic identities, financial crimes, phishing, and social engineering attacks, the need for advanced fraud detection and prevention tools is at an all-time high. The top fraud prevention companies are integrating […]

    The post Top 10 Best Fraud Prevention Companies in 2025 appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Hackers Exploit WordPress Sites to Power Next-Gen ClickFix Phishing Attacks

    ·

    Cybersecurity researchers are calling attention to a nefarious campaign targeting WordPress sites to make malicious JavaScript injections that are designed to redirect users to sketchy sites. “Site visitors get injected content that was drive-by malware like fake Cloudflare verification,” Sucuri researcher Puja Srivastava said in an analysis published last week. The website security company

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The D Brief: Senators doubt Asia policy; Jail Illinois leaders, says POTUS; Civil-military ‘crisis’; DHS cuts intel staff; And a bit more.

    ·

    Skeptical senators grill White House pick to lead Indo-Pacific policy. Led by Sen. Roger Wicker, R-Miss., a bipartisan slice of the Senate Armed Services Committee took turns on Tuesday expressing concerns about the Trump administration’s inward shift in national-security focus and its alienation of key allies and partners in the Asia-Pacific region.

    Wicker: “The Chinese Communist Party, along with the nuclear-armed Russia and North Korea, pose a significant threat to the United States. The scale and scope of that threat put a premium on our alliances. In light of that, I'm disappointed with some of the decisions the department has made with respect to our allies in Japan, South Korea, Australia, and Taiwan. A few of these choices have left me scratching my head.” 

    Sen. Mark Kelly, D-Ariz.: “There are some rumors, I guess, circulating that the new national defense strategy is going to shift priority away from the PRC and away from the Indo-Pacific, and instead focus on the Western Hemisphere. We'll see what happens when that comes out,” Kelly said. “If that's true…this shift is alarming, because most of what is briefed to this committee focuses on ‘how are we going to deter China’.”

    The senators spoke during the confirmation hearing for John Noh, the Trump administration’s pick to be assistant defense secretary for Indo-Pacific security affairs. Noh, who is currently ASD for East Asia, responded that China is “an enormous concern of mine.” But he waffled when Wicker asked about the Trump administration’s decision to cancel $400 million in military aid to Taiwan, and cited President Donald Trump’s stance that the island’s government should up its defense spending to about 10 percent of its GDP. 

    Wicker worried that “DOD may be using the Ukraine playbook with Taiwan by taking defense items procured with presidential drawdown authority and returning it to the defense stockpile” which misaligns with “congressional intent, and would require Taiwan to purchase these items that have already been authorized as PDA.” Defense One’s Lauren C. Williams has more from the hearing, here.

    The U.S. military in Syria says it killed a militant planner in an unspecified strike Thursday last week. The militant’s name was Muhammad ’Abd-al-Wahhab al-Ahmad, and U.S. Central Command officials claim he was an “attack planner” with Ansar al-Islam, an al-Qaeda affiliated terrorist group. Tiny bit more, here. 

    Additional reading: “Hegseth announces ‘barracks task force’ during speech to new recruits,” The Hill reported Tuesday.

    Welcome to this Wednesday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson and Bradley Peniston. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1918, U.S. Army Cpl. Alvin York killed 28 German soldiers and captured 132 others, which eventually won him the Medal of Honor.

    Militarizing America’s streets

    President Trump said Wednesday morning he thinks Chicago’s mayor and the state’s governor should be jailed. Writing on social media, Trump said Wednesday shortly after 8 a.m. ET, “Chicago Mayor should be in jail for failing to protect Ice Officers! Governor Pritzker also!

    Reuters notes: “Neither Chicago Mayor Brandon Johnson nor Illinois Governor JB Pritzker has been accused of criminal wrongdoing,” though “Johnson signed an executive order on Monday creating an ‘ICE Free Zone’ that prohibits federal immigration agents from using city property in their operations.”

    Governor JB Pritzker wrote in reply: “Trump is now calling for the arrest of elected representatives checking his power. What else is left on the path to full-blown authoritarianism?”

    Chicago’s Mayor Johnson responded: “This is not the first time Trump has tried to have a Black man unjustly arrested. I'm not going anywhere.”

    By the way: 58% of Americans “think the president should send armed troops only to face external threats,” according to new polling published Wednesday by Reuters/Ipsos. That includes 51% of Republicans and 72% of Democrats. But when asked if the president should be able to send troops even if a governor objects, there’s a sharp split with 70% of Republicans saying yes but just 13% of Democrats saying they feel similarly.

    “I think it’s a bad precedent,” North Carolina Republican Sen. Thom Tillis said Tuesday of President Trump’s order to deploy out-of-state National Guard troops to Chicago. “I worry about someday a Democrat president sending troops or National Guard from New York, California, Oregon, Washington state to North Carolina.”

    “I don’t see how you can argue that this comports with any sort of conservative view of states’ rights,” he added. 

    Tillis wasn’t the only Republican dissenting this week. “This is not the role of our military,” Sen. Lisa Murkowski, R-Alaska, said Tuesday as well. “It’s one thing if governors ask and they say, ‘Hey, I need help.’ That’s the way we’ve handled it before,” she said. “I am very apprehensive about the use of our military for policing and more the politicization that we’re seeing within the military…We’re seeing these orders, we’re seeing a directive that is unprecedented and it should make us all concerned,” Murkowski said. 

    “I think [Trump is] just poking his finger in [Portland’s] eye,” one anonymous senator told The Hill. “I don’t know it’s the best way to solve the issue, but it looks like in Portland, the place is on fire, but that could be isolated reports,” said the Republican, who requested anonymity. 

    But that’s largely where the Republican dissent ends for sending Texas soldiers to Illinois without the consent of the latter’s governor. Read more at The Hill.

    The six senators from Illinois, Oregon, and California warned Tuesday that Trump is “moving us closer to authoritarianism” with his troop deployments against governors’ wishes. “Whether in Los Angeles, Chicago, or Portland, the Trump Administration continues fabricating claims of chaos and crime on American streets to justify his false assertions that there is a ‘need’ to deploy troops into our cities—all while literally defunding our police by cutting funding that helps local law enforcement,” Democratic Sens. Tammy Duckworth and Dick Durbin of Illinois, Jeff Merkley and Ron Wyden of Oregon, and California’s Alex Padilla and Adam Schiff.

    “None of our states asked for this. None of our states need this. And none of our National Guard Troops—who are our friends and neighbors—signed up to intimidate their fellow Americans in their own communities or to be used as political pawns by a vindictive President,” the senators said, and called for Trump to “immediately reverse course and end these un-American deployments.” 

    Army veteran Tammy Duckworth: “We know deploying the military is not about protecting [Homeland Security] officials, because these same officials are escalating their tactics every day to provoke a manufactured crisis to justify sending in the military,” the retired lieutenant colonel said on the senate floor Tuesday. “We know it’s not about crime, because Trump literally defunded the police by slashing $800 million in public safety programs. This is about Trump’s desire to crush dissent and erode our constitutional rights.”

    “The President wants to use our military as his personal police force that goes into American cities, detains civilians on our bases and intimidates people who disagree with him,” Duckworth said. “Who wins in that scenario? Not the American people. Not our servicemembers. Only Donald Trump, along with our enemies who will exploit our distraction.” 

    Senate Majority Leader John Thune: “If there are federal personnel who are being threatened, then I think the president has a right to protect them,” the Republican from South Dakota said Monday, calling Trump’s decision to send out-of-state troops to Illinois “a justifiable use of executive branch authority.” 

    Commentary: “The greatest crisis of American civil-military relations in modern history is now under way,” argues Tom Nichols, former Naval War College professor, writing in the Atlantic on Tuesday. “Despite the firing of several top officers—and Trump’s threat to fire more—the U.S. armed forces are still led by generals and admirals whose oath is to the Constitution, not the commander in chief. But for how long?” he asked while emphasizing, “I write these words with great trepidation.” 

    Nichols reminds us that Trump has already “declared war on Chicago; called Portland, Oregon, a ‘war zone’; and referred to his political opponents as ‘the enemy from within.’ Trump clearly wants to use military power to exert more control over the American people, and soon, top U.S.-military commanders may have to decide whether they will refuse such orders from the commander in chief.” 

    “The Democrats are too timid, and the Republicans are too compromised. Only by standing together can the senior military officials warn Trump away from leading America into a full-blown civil-military confrontation,” Nichols writes. Read the rest (gift link), here. 

    Additional reading: “Chicago journalists, protesters sue Trump administration, alleging ‘extreme brutality,’” Politico reported Tuesday. 

    Shutdown shenanigans

    Republican leaders in Congress are at odds over emergency legislation to pay troops during the government shutdown, Politico reported Tuesday afternoon. The tensions pit Speaker Mike Johnson, who is in favor of the legislation, against Senate Majority Leader John Thune, who told reporters, “Honestly, you don’t need that.”

    Update: Trump is threatening mass layoffs during the ongoing shutdown, but that may be illegal, the New York Times reported Tuesday. What’s more, “Budget experts said that the White House had also incorrectly presented layoffs as a fiscal necessity, something no other president in the modern era has done. Not even during the longest federal stoppage on record—a five-week closure in Mr. Trump’s first term—did the government shed workers so that it could finance the few operations that are allowed to continue.”

    In still more confusing messaging from the White House, on Tuesday, the Trump admin said furloughed feds were not guaranteed back pay. On Wednesday, it sent notices saying they were, Eric Katz of Government Executive reports. 

    Additional reading: 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • APT Hackers Exploit ChatGPT to Create Sophisticated Malware and Phishing Emails

    ·

    ,

    A China-aligned advanced persistent threat (APT) group is actively leveraging OpenAI’s ChatGPT platform to develop malware and craft sophisticated spear-phishing emails for its global campaigns.

    Security firm Volexity tracks the actor as UTA0388 and has analyzed its operations since June 2025, concluding with high confidence that the group uses Large Language Models (LLMs) to automate and enhance its attacks against targets in North America, Asia, and Europe.

    Volexity first detected UTA0388 conducting highly tailored spear-phishing campaigns that impersonated senior researchers from fabricated but legitimate-sounding organizations. The initial goal was to socially engineer targets into clicking links leading to malicious archives.

    Over three months, the threat actor expanded its operations, sending emails in English, Chinese, Japanese, French, and German. UTA0388’s tactics evolved to include “rapport-building phishing,” where they first engage a target in a benign conversation before sending a malicious link.

    GOVERSHELL Malware

    The payload is delivered via a ZIP or RAR archive containing a legitimate executable and a malicious Dynamic Link Library (DLL).

    When the user runs the executable, a technique called DLL search order hijacking is used to load the malicious payload, a backdoor Volexity has named GOVERSHELL.

    Researchers have identified five distinct variants of GOVERSHELL, which provides attackers with remote command execution capabilities and uses scheduled tasks for persistence, indicating active and ongoing development.

    The malware variants show significant rewrites in their communication protocols and capabilities, shifting from C++ to Golang and employing different encryption methods.

    The assessment of LLM usage stems from an aggregation of evidence rather than a single data point, a finding later corroborated by an OpenAI report. A key indicator is the “hallucinations” and nonsensical details present in the phishing campaigns.

    UTA0388’s emails often contained fabricated entities, such as the “Copenhagen Governance Institute,” and used fake phone numbers with suspicious sequential patterns. The group also exhibited a consistent lack of coherence.

    For instance, a single email would sometimes contain three different personas across the sender name, email address, and signature block. Volexity observed emails sent to English-speaking targets with a Mandarin subject line and a German body, suggesting context-unaware automation.

    The targeting itself showed signs of automation without human review, as phishing emails were sent to non-existent addresses like first.last@<domain> scraped from public web pages.

    In some cases, archives contained superfluous “Easter eggs,” including pornographic images and audio recordings of Buddhist chants, which serve no operational purpose and would likely be avoided by a human operator trying to remain undetected.

    Volexity assesses with high confidence that UTA0388 operates in the interest of the Chinese state, based on its targeting profile focused on Asian geopolitical issues and technical artifacts, such as developer paths containing Simplified Chinese characters found within a GOVERSHELL sample.

    The constant and non-iterative rewriting of the malware’s network stack further supports the hypothesis of LLM assistance in code generation.

    While it is difficult to measure the ultimate success of these AI-powered campaigns, the ability to generate a high volume of tailored phishing content, even with its flaws, presents a significant threat.

    The activity demonstrates how threat actors are integrating AI to scale their operations, create more convincing lures, and accelerate malware development.

    The continued evolution of the GOVERSHELL backdoor suggests that UTA0388 remains an active and persistent threat, adapting its tradecraft for future campaigns.

    OpenAI has implemented a ban on ChatGPT accounts that were linked to hackers from China and North Korea who were attempting to use the platform for the development of malware.

    Cyber Awareness Month Offer: Upskill With 100+ Premium Cybersecurity Courses From EHA's Diamond Membership: Join Today

    The post APT Hackers Exploit ChatGPT to Create Sophisticated Malware and Phishing Emails appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Top 10 Best Digital Footprint Monitoring Tools for Organizations in 2025

    ·

    , ,

    In today’s hyperconnected business environment, organizations are under constant threat from cybercriminals who exploit digital footprints, shadow IT, cloud misconfigurations, and external exposures. Digital footprint monitoring has become one of the most critical aspects of a cybersecurity strategy in 2025. Organizations not only need to defend their internal networks but also proactively monitor external attack […]

    The post Top 10 Best Digital Footprint Monitoring Tools for Organizations in 2025 appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Chinese Hackers Weaponize Open-Source Nezha Tool in New Attack Wave

    ·

    Threat actors with suspected ties to China have turned a legitimate open-source monitoring tool called Nezha into an attack weapon, using it to deliver a known malware called Gh0st RAT to targets. The activity, observed by cybersecurity company Huntress in August 2025, is characterized by the use of an unusual technique called log poisoning (aka log injection) to plant a web shell on a web

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New Fully Undetectable FUD Android RAT Hosted on GitHub

    ·

    , ,

    A sophisticated Android remote access trojan (RAT) has emerged on GitHub, presenting significant security concerns for mobile device users worldwide.

    The malware, publicly available under the repository “Android-RAT” by user Huckel789, claims to offer fully undetectable (FUD) capabilities that can bypass modern security measures and antivirus detection systems.

    This malicious software represents a concerning evolution in mobile malware distribution, leveraging legitimate platforms to host and distribute dangerous payloads.

    The RAT operates through a web-based interface requiring no PC installation, making it accessible to threat actors with varying technical expertise.

    Its distribution method exploits GitHub’s trusted platform status, potentially bypassing security filters that typically block malicious downloads from suspicious domains.

    The malware’s comprehensive feature set includes keylogging capabilities, credential hijacking, ransomware functionality, and sophisticated social engineering tools designed to deceive users into granting necessary permissions.

    Security researcher Huckel789 identified this particular strain as employing advanced stealth techniques specifically engineered to evade detection by popular antivirus solutions and VirusTotal scans.

    The malware incorporates anti-emulator and virtual machine detection mechanisms, ensuring it operates exclusively on genuine Android devices while remaining dormant in security analysis environments.

    This selective activation approach significantly complicates traditional malware analysis workflows used by security professionals.

    The Android RAT demonstrates remarkable persistence capabilities, surviving ultra battery optimization modes and various power management restrictions commonly found in Chinese ROM implementations like MIUI.

    Its resource-efficient design enables continuous background operation while consuming minimal system resources, making detection through performance monitoring extremely difficult.

    Advanced Evasion and Communication Architecture

    The malware’s communication infrastructure represents a sophisticated approach to command and control operations.

    Unlike conventional RATs that employ simple base64 encoding for server communications, this variant implements AES-128-CBC encryption with PKCS padding to secure all data transmissions between infected devices and command servers.

    The encryption implementation ensures that network traffic analysis cannot easily reveal malicious communications, while advanced obfuscation techniques protect the embedded server IP addresses from discovery through static code analysis.

    The RAT’s “Freeze Mode” functionality demonstrates particular innovation in stealth operations, limiting data transmission to 1-3MB over 24-hour periods while maintaining responsiveness to operator commands.

    This approach minimizes network signatures that could trigger security monitoring systems while ensuring reliable remote access capabilities.

    The malware can inject its payload into legitimate applications through a sophisticated dropper module, making initial infection vectors extremely difficult to identify through conventional security scanning mechanisms.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post New Fully Undetectable FUD Android RAT Hosted on GitHub appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New Phishing Kit Automates ClickFix Attacks to Evade Security Defenses

    ·

    , , ,

    Cybercriminals are increasingly automating one of the most insidious social engineering exploits—forcing victims to manually execute malware under the guise of browser verification. The newly discovered IUAM ClickFix Generator commoditizes the ClickFix technique into an easy-to-use phishing kit, lowering the barrier for threat actors of all skill levels and enabling widespread deployment of information stealers […]

    The post New Phishing Kit Automates ClickFix Attacks to Evade Security Defenses appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Google Unveils CodeMender – An AI Agent That Automatically Fixes Vulnerable Code

    ·

    , , , ,

    Google has introduced CodeMender, an AI-powered agent designed to automatically detect and patch security flaws in software. Announced on 6 October 2025 by Raluca Ada Popa and Four Flynn, CodeMender represents a major step toward leveraging artificial intelligence for proactive code security. CodeMender builds on Google’s earlier AI research in vulnerability discovery, such as Big Sleep […]

    The post Google Unveils CodeMender – An AI Agent That Automatically Fixes Vulnerable Code appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • TamperedChef Malware as PDF Editor Harvest Browser Credentials and Allows Backdoor Access

    ·

    , ,

    In recent weeks, security teams have observed a surge in malvertising campaigns distributing what appears to be a fully functional PDF editor.

    Dubbed TamperedChef, this malware masquerades as a legitimate application—AppSuite PDF Editor—leveraging convincing advertisements to lure European organizations and individuals into downloading the installer.

    Once executed, the installer exhibits expected functionalities for nearly two months, during which victims remain unaware of its true nature.

    During installation, users encounter a professional end-user license agreement dialogue consistent with mainstream software offerings.

    This dialog, displayed in multiple languages, reinforces the illusion of legitimacy and bypasses automated sandbox detonations.

    EULA dialog displayed by the MSI installer (Source – Withsecure Labs)

    Clicking Accept and Install allows the MSI package to proceed without requiring administrative privileges, making it particularly effective in corporate environments with restricted user rights.

    WithSecure Labs analysts identified TamperedChef following a sudden spike in credential-theft incidents within enterprise environments.

    Telemetry data revealed that, upon activation, the malware’s hidden payload initiates the systematic harvesting of browser-stored usernames and passwords.

    This exfiltration occurs silently, with stolen credentials transmitted to attacker-controlled infrastructure, paving the way for backdoor access and further lateral movement.

    Once the malicious payload embedded within pdfeditor.js activates, the application transitions from a benign editor to a stealthy credential harvester.

    Utilityaddon.node’s exported functions (Source – Withsecure Labs)

    The attack is orchestrated using a custom NodeJS module—Utilityaddon.node—which interacts with native Windows APIs to manipulate registry entries and scheduled tasks for persistence.

    By inserting autorun registry keys under the current user hive, the malware ensures execution at each logon without elevating privileges.

    Infection Mechanism

    The infection begins when a user clicks a malicious advertisement and downloads the AppSuite PDF Editor installer from vault.appsuites.ai.

    This installer, created with the Nullsoft Scriptable Install System (NSIS), unpacks the Electron-based application under the user’s profile directory.

    The primary executable, PDF Editor.exe, launches a Chromium-based interface that loads additional JavaScript modules from remote servers.

    Before any PDF editing functionality is available, the installer sets persistence via an autorun registry entry named PDFEditorAutoUp that points to the installed application.

    At runtime, the obfuscated pdfeditor.js script checks for command-line switches, notably --cm, which triggers malicious routines:-

    if (app.commandLine.hasSwitch('cm')) {
  utilityAddon.setupTasks(globals.scheduledTaskName);
  startCredentialHarvest();
}

    By using command-line flags, the threat actors can toggle between benign and malicious behaviors, complicating detection.

    ‘–cm’ command line argument present in S3-Forge (Source – Withsecure Labs)

    Once the script executes startCredentialHarvest(), it scans local browser storage for credentials and dispatches them over HTTPS to attacker-controlled endpoints, while the visible PDF editor interface remains functional to avoid arousing suspicion.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post TamperedChef Malware as PDF Editor Harvest Browser Credentials and Allows Backdoor Access appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶