ADMIN.FOUNDATION

  • Hackers Abuse GitHub Pages to Spread Stealer Malware to macOS Users

    ·

    , , , ,

    A sophisticated malware campaign is targeting Mac users through fraudulent GitHub repositories that masquerade as legitimate software downloads, with threat actors exploiting search engine optimization tactics to deliver malicious links directly to unsuspecting victims. The LastPass Threat Intelligence, Mitigation, and Escalation team has identified an ongoing widespread infostealer operation that specifically targets macOS users through […]

    The post Hackers Abuse GitHub Pages to Spread Stealer Malware to macOS Users appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • MalTerminal: New GPT-4-Powered Malware That Writes Its Own Ransomware

    ·

    , , ,

    A groundbreaking discovery in cybersecurity research has revealed the emergence of ‘MalTerminal’, potentially the earliest known example of Large Language Model (LLM)-enabled malware that leverages OpenAI’s GPT-4 API to dynamically generate ransomware code and reverse shells at runtime. This discovery represents a significant evolution in malware sophistication, presenting unprecedented challenges for traditional detection methods.  SentinelLABS researchers […]

    The post MalTerminal: New GPT-4-Powered Malware That Writes Its Own Ransomware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Hackers Deploy New EDR-Freeze Tool to Disable Security Software

    ·

    , , ,

    A security researcher has released a new tool that can temporarily disable endpoint detection and response (EDR) systems and antivirus software without requiring vulnerable drivers, marking a significant evolution in attack techniques targeting security solutions. Advanced Evasion Through Windows Components The tool, dubbed EDR-Freeze and developed by researcher TwoSevenOneT, exploits Windows Error Reporting functionality to suspend security […]

    The post Hackers Deploy New EDR-Freeze Tool to Disable Security Software appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Lockheed’s Skunk Works unveils work on a potential CCA competitor

    ·

    Lockheed Martin aims to fly a stealthy, autonomous, multipurpose drone by 2027, the company announced Sunday.

    Dubbed Vectis, the “category five” drone is intended for surveillance, air-to-air combat and airstrike missions, said OJ Sanchez, vice president and general manager of Lockheed’s secretive Skunk Works research arm.

    “We're in progress now on the Vectis prototype,” Sanchez told reporters ahead of the Air & Space Force Association’s defense conference near Washington, D.C. “Parts are ordered, the team is in work, and we intend to fly in the next two years.”

    Sanchez said that Vectis is not being designed to win any specific contract, but suggested that it might compete against General Atomics and Anduril in the Air Force’s collaborative combat aircraft, or CCA, program.

    “Should the U.S. Air Force find that they need a highly survivable platform with the flexibility that Vectis enables for increment two, I think it'll be a great candidate,” Sanchez said. “We respect their process as they go through and see what's needed.”

    Sanchez said Vectis will be smaller than an F-16 and larger than its Common Multi-Mission Truck missile, a proposed family of vehicles, at least one of which appears to be about eight feet long. He did not disclose what type of engine would be in the drone nor its anticipated price tag.

    He said Vectis would connect with fifth-generation and next-generation aircraft: Lockheed’s F-22 and F-35, but also other aircraft. 

    “This isn't about connecting Lockheed Martin systems with Lockheed Martin systems,” Sanchez said. “We can connect the Vectis system with any other platform or anybody or anything in the battle space.”

    Sanchez said the Vectis drone will require a runway for operations, but is being designed to work well in the Air Force’s Agile Combat Employment scheme of quick and lean bases. He said maintenance will be simplified by “simplicity of design” and “durable, reliable materials.”

    The drone’s range is “compatible with Indo-Pacific, European and Central Command theaters,” a Lockheed press release said.

    The Air Force asked for $111 million for the CCA program in its 2026 budget documents; the reconciliation bill adds $678 million over five years.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity Newsletter Weekly – Shai Halud Attack, Ivanti Exploits, FinWise, BMW Data Leak, and More

    ·

    , ,

    This week in cybersecurity, researchers exposed hidden alliances between ransomware groups, the rise of AI-powered phishing platforms, and large-scale vulnerabilities affecting telecom and enterprise systems.

    Major data breaches at financial services and luxury brands highlighted insider threats and supply chain risks, while arrests of Scattered Spider hackers signaled rare law enforcement wins.

    From botnets hijacking VPS servers to disinformation networks expanding globally, the threat landscape shows how cybercrime, espionage, and propaganda increasingly intersect, demanding stronger defenses and smarter detection strategies.

    Stay updated with the latest critical vulnerabilities, exploits, and supply chain threats impacting software, infrastructure, and end-users.

    Vulnerabilities

    Jenkins Security Updates Patch Multiple Flaws

    Jenkins has released urgent patches for four vulnerabilities affecting its weekly releases up to 2.527 and LTS up to 2.516.2. The most severe, CVE-2025-5115, is an HTTP/2 denial-of-service issue in the bundled Jetty component, rated high severity. Additional flaws include permission-check omissions and a log message injection bug.

    Administrators are strongly advised to upgrade to weekly 2.528 or LTS 2.516.3 or disable HTTP/2 where immediate upgrades aren’t feasible. Read More

    Pixie Dust Wi-Fi Attack Targets WPS

    The Pixie Dust attack re-emerges as a significant threat to Wi-Fi security, exploiting weak randomization in the WPS (Wi-Fi Protected Setup) protocol. Attackers can recover router WPS PINs offline, bypass WPA2 safeguards, and obtain the network’s pre-shared key without brute forcing.

    Researchers emphasize disabling WPS or updating firmware as the only reliable defense. Organizations should audit wireless infrastructure immediately. Read More

    Greenshot Vulnerability Exposes Sensitive Data

    Researchers discovered a flaw in Greenshot, the popular screenshot tool, that could expose sensitive information. The vulnerability stems from unsafe file handling and could allow attackers to access or leak captured screenshots. A patch has been released, and users are urged to upgrade promptly. Read More

    Chaos Mesh Vulnerabilities Impact Kubernetes Workloads

    Multiple vulnerabilities have been identified in Chaos Mesh, the chaos engineering tool for Kubernetes testing. Flaws could allow attackers to escalate privileges, inject malicious configurations, or disrupt cluster stability. Organizations using Chaos Mesh must apply the latest security updates.

    🔗 Read More

    Kubernetes C Client Vulnerability Exposes Clusters

    The Kubernetes C Client library vulnerability exposes clusters to potential privilege escalation and unauthorized API access. Attackers could exploit misconfigurations or API flaws to gain deeper control over workloads. Upgrading to patched versions and tightening API access controls is advised. Read More

    Linux Kernel KSMBD Subsystem Vulnerability

    A critical flaw in the KSMBD subsystem of the Linux kernel allows attackers to execute code remotely in certain configurations. This vulnerability poses a high risk for file-sharing services relying on SMB. Admins should apply kernel patches as soon as possible. Read More

    Shai Halud Supply Chain Attack Uncovered

    A new software supply-chain attack named Shai Halud has been observed abusing CI/CD pipelines and developer tools. Malicious dependencies were injected into trusted builds, potentially impacting downstream software users. Organizations are urged to implement strict code-signing and package validation practices. Read More

    0-Click Linux Kernel KSMBD RCE Exploit

    Researchers have demonstrated a 0-click RCE exploit in the Linux kernel’s KSMBD subsystem, allowing remote code execution without user interaction. This development raises the severity of ongoing kernel threats, highlighting the urgency of patching affected systems immediately. Read More

    Spring Framework and Microsoft 900+ XSS Vulnerabilities

    Two major updates reveal widespread exposure:

    • Spring Framework patches multiple flaws, including input validation weaknesses that could lead to system compromise.
    • Microsoft confirms over 900 XSS vulnerabilities across its ecosystem, stressing the scale of insecure coding practices.

    Both cases underscore the growing challenge of secure software development at scale. Read More

    Theats

    Hidden Connections Between Ransomware Groups

    Recent research shows that ransomware operations like Conti, LockBit, and Evil Corp are no longer isolated competitors but participants in a flexible underground marketplace. After the Conti takedown, affiliates regrouped under new banners, leading to overlaps in infrastructure and code reuse. Analysts identified shared SSL certificates, passive DNS footprints, and identical encryption routines across Black Basta and QakBot, showing how code and infrastructure circulate freely. This evolution means defenders must focus less on brand names and more on shared TTPs and hidden infrastructure patterns. Read More

    AI-Powered Phishing Platforms on the Rise

    Phishing has entered a new era with the adoption of AI-driven platforms capable of generating convincing lures at scale. Attackers increasingly automate email writing, domain registration, and credential phishing kits, making campaigns harder to detect. These platforms drastically lower the barrier for novice cybercriminals while amplifying the reach of veteran actors. Security teams are now challenged to identify behavioral anomalies rather than relying on syntactic cues. Read More

    Russian Groups Gamaredon and Turla Join Forces

    Two of Russia’s most notorious cyber-espionage groups, Gamaredon and Turla, have shown signs of collaboration. While Gamaredon specializes in initial compromise across Ukrainian targets, Turla is known for stealthy persistence and espionage capabilities. By combining tools and infrastructure, these groups present a growing strategic risk for governmental and defense organizations. Read More

    Hackers Exploiting Ivanti Endpoint Manager Mobile

    Threat actors are abusing multiple vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM), targeting enterprise networks with remote exploitation. These flaws allow attackers to gain initial footholds into corporate infrastructure, often chaining with other exploits for lateral movement. Nation-state groups and ransomware affiliates have already begun weaponizing these vulnerabilities in the wild. Read More

    Weaponized ScreenConnect App

    In another software abuse trend, attackers are turning legitimate tools like ConnectWise’s ScreenConnect app into weapons. By deploying trojanized installers, hackers establish remote access footholds disguised as IT management activity. This “living-off-the-land” technique allows evasion of traditional defenses and grants persistent control of victim networks. Read More

    Belsen Malware Campaign Linked

    Researchers uncovered connections between a new malware strain dubbed Belsen and previously active intrusion sets. Analysis indicates shared C2 infrastructure and loader techniques overlapping with known financially motivated threat groups. This discovery highlights the trend of rebranded payloads leveraging old foundations for renewed attacks. Read More

    SystemBC Botnet Hits 1,500 VPS Servers

    The notorious SystemBC botnet continues to expand its footprint, recently compromising over 1,500 VPS servers. Known for serving as a proxy for ransomware affiliates, SystemBC enhances anonymity by tunneling malicious traffic. The surge shows ongoing demand for infrastructure capable of concealing command-and-control operations behind layers of obfuscation. Read More

    New Malware Loader “CountLoader”

    A fresh loader called CountLoader has surfaced in underground markets, featuring modular design and advanced evasion tactics. Its ability to deliver diverse payloads—ranging from banking trojans to ransomware—makes it a high-value tool for cybercriminal groups. Analysts note that its dynamic configuration updates make blocking efforts difficult.
    Read More

    Phishing Attack Targets Facebook Users

    Social media users face renewed phishing threats as adversaries launch campaigns to steal Facebook login credentials. The attacks employ deceptive login pages and multi-step phishing kits designed to evade detection. Given the centrality of social media accounts for identity theft, the scale of these attacks poses a broad consumer security challenge. Read More

    Russian Disinformation Network Expands

    Beyond malware, Russia-linked CopyCop has expanded its fake news infrastructure by adding 200 new websites. The campaign seeks to amplify disinformation globally, blurring the lines between targeted psychological operations and cyber-enabled propaganda. Coordinated amplification on these sites makes detection and takedown a persistent challenge for defenders. Read More

    Data Breaches

    FinWise Insider Breach Exposes 689K Records

    American First Finance confirmed a major insider incident after a terminated employee exploited residual access to its production database. The breach compromised nearly 700,000 sensitive records, including Social Security numbers and financial data, which were exfiltrated using direct SQL queries and SSH tunnels. Investigators found the attacker took advantage of an archived service account with lingering privileges, bypassing standard RBAC and MFA safeguards. The company has since moved toward just-in-time access and user behavior analytics, alongside offering affected customers 24 months of identity protection. Read More

    Tiffany & Co. Confirms Data Breach

    Luxury jeweler Tiffany & Co. disclosed a data breach that exposed sensitive employee and customer information following unauthorized access to internal systems. Although the company did not release specifics on the volume, the breach has raised concerns over the protection of VIP clientele data. The incident adds to a growing list of attacks aimed at brands handling high-net-worth individuals. Read More

    Gucci, Balenciaga, and Alexander McQueen Leak Linked to BMW Breach

    A massive breach has reportedly tied together data leaks affecting iconic fashion houses Gucci, Balenciaga, and Alexander McQueen, allegedly connected to a wider compromise involving BMW’s systems. The intrusion exposed internal documents, customer records, and operational data, raising alarms about cross-industry supply chain vulnerabilities. The fashion and automotive sectors, both attractive to cybercriminals, now appear increasingly linked through shared risk factors. Read More

    UK Arrests Two Scattered Spider Hackers

    British law enforcement arrested two alleged members of the Scattered Spider group, which has been tied to high-profile intrusions, including MGM Resorts. The arrests mark a significant disruption to the group’s operations, known for SIM swap attacks, phishing campaigns, and corporate intrusions. While arrests disrupt some activity, experts note that the group’s wide affiliate network means residual risk is expected to continue. Read More

    Great Firewall of China Data Leak

    An unprecedented leak exposed sensitive datasets tied to China’s Great Firewall infrastructure, revealing operational insights into surveillance operations and censorship controls. The compromised data, reportedly accessible on cybercriminal forums, included internal schema, employee records, and technical configurations. This incident underscores the rising risks posed when state or nation-level security tools themselves become the targets of hackers. Read More

    Follow Us on Google News, LinkedIn, X to Get Daily Cyber Security Updates and Contact Us to Feature Your Stories.

    The post Cybersecurity Newsletter Weekly – Shai Halud Attack, Ivanti Exploits, FinWise, BMW Data Leak, and More appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • DPRK Hackers Use ClickFix to Deliver BeaverTail Malware in Crypto Job Scams

    ·

    Threat actors with ties to the Democratic People’s Republic of Korea (aka DPRK or North Korea) have been observed leveraging ClickFix-style lures to deliver a known malware called BeaverTail and InvisibleFerret. “The threat actor used ClickFix lures to target marketing and trader roles in cryptocurrency and retail sector organizations rather than targeting software development roles,” GitLab

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New EDR-Freeze Tool That Puts EDRs and Antivirus Into A Coma State

    ·

    , ,

    A new proof-of-concept tool named EDR-Freeze has been developed, capable of placing Endpoint Detection and Response (EDR) and antivirus solutions into a suspended “coma” state.

    According to Zero Salarium, the technique leverages a built-in Windows function, offering a stealthier alternative to the increasingly popular Bring Your Own Vulnerable Driver (BYOVD) attacks used by threat actors to disable security software.

    Unlike BYOVD methods, which require introducing a vulnerable driver onto a target system, EDR-Freeze exploits legitimate components of the Windows operating system.

    This approach avoids the need to install third-party drivers, reducing the risk of system instability and detection. The entire process is executed from user-mode code, making it a subtle and effective way to temporarily neutralize security monitoring.

    The MiniDumpWriteDump Exploit

    The core of the EDR-Freeze technique lies in the manipulation of the MiniDumpWriteDump function. This function, part of the Windows DbgHelp library, is designed to create a minidump, a snapshot of a process’s memory for debugging purposes.

    To ensure a consistent and uncorrupted snapshot, the function suspends all threads within the target process while the dump is created.

    Ordinarily, this suspension is brief. However, the developer of EDR-Freeze devised a method to prolong this suspended state indefinitely.

    EDR-Freeze Tool
    EDR-Freeze Tool

    The primary challenges were twofold: extending the very short execution time of the MiniDumpWriteDump function and bypassing the Protected Process Light (PPL) security feature that shields EDR and antivirus processes from tampering.

    To overcome PPL protection, the technique utilizes WerFaultSecure.exe, a component of the Windows Error Reporting (WER) service. WerFaultSecure.exe can run with WinTCB level protection, one of the highest privilege levels, allowing it to interact with protected processes.

    By crafting the correct parameters, WerFaultSecure.exe can be instructed to initiate the MiniDumpWriteDump function on any target process, including protected EDR and antivirus agents.

    The final piece of the puzzle is a race-condition attack that turns a momentary suspension into a prolonged freeze. The attack unfolds in a rapid, precise sequence:

    1. WerFaultSecure.exe is launched with parameters directing it to create a memory dump of the target EDR or antivirus process.
    2. The EDR-Freeze tool continuously monitors the target process.
    3. The moment the target process enters a suspended state (as MiniDumpWriteDump begins its work), the EDR-Freeze tool immediately suspends the WerFaultSecure.exe process itself.

    Because WerFaultSecure.exe is now suspended, it can never complete the memory dump operation and, crucially, can never resume the threads of the target EDR process.

    The result is that the security software is left in a permanent state of suspension, effectively blinded, until the WerFaultSecure.exe process is terminated, Zero Salarium said.

    EDR-Freeze Tool Killing Process

    The developer has released the EDR-Freeze tool to demonstrate this technique. It takes two simple parameters: the Process ID (PID) of the target to be frozen and the duration of the suspension in milliseconds.

    This allows an attacker to disable security tools, perform malicious actions, and then allow the security software to resume normal operations as if nothing had happened.

    A test on Windows 11 24H2 successfully suspended the MsMpEng.exe process of Windows Defender.

    EDR-Freeze Tool Kills EDR and Antivirus
    EDR-Freeze Tool Kills EDR and Antivirus

    For defenders, detecting this technique involves monitoring for unusual executions of WerFaultSecure.exe.

    If the program is observed targeting the PIDs of sensitive processes like lsass.exe or EDR agents, it should be treated as a high-priority security alert requiring immediate investigation.

    Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.

    The post New EDR-Freeze Tool That Puts EDRs and Antivirus Into A Coma State appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New Botnet Exploits Simple DNS Flaws That Leads to Massive Cyber Attack

    ·

    , , , ,

    Cybersecurity researchers have uncovered a sophisticated Russian botnet operation that leveraged DNS misconfigurations and compromised MikroTik routers to deliver malware through massive spam campaigns. The discovery reveals how threat actors exploited simple DNS errors to bypass email security protections and distribute malicious payloads on a global scale. The investigation began in November 2024 when researchers […]

    The post New Botnet Exploits Simple DNS Flaws That Leads to Massive Cyber Attack appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Heathrow and Other European Airports Hit by Cyberattack, Several Flights Delayed

    ·

    , ,

    A major cyberattack on a popular aviation software provider has caused significant disruptions at key European airports, including London’s Heathrow, Brussels, and Berlin, resulting in hundreds of flight delays and cancellations on Saturday.

    The attack disabled electronic check-in and baggage drop systems, forcing airport staff to revert to manual processing and leaving thousands of passengers stranded in long queues.

    The disruption stemmed from a “cyber-related disruption” that targeted Collins Aerospace, a subsidiary of RTX (formerly Raytheon Technologies), reports BBC.

    The company’s Muse software, which allows multiple airlines to share common check-in desks, boarding gates, and baggage systems, was rendered inoperable.

    In response, airports were forced to disconnect from the affected systems and handle passenger processing manually, resulting in significant operational slowdowns.

    Brussels Airport reported the attack occurred on Friday night, leading to a “large impact on the flight schedule” with numerous delays and cancellations. Berlin’s Brandenburg Airport also confirmed longer waiting times, while Dublin and Cork airports in Ireland experienced a “minor impact,” with some airlines resorting to manual check-ins.

    The technical failure translated into chaos for travelers. At Heathrow’s Terminal 4, passengers reported waiting in queues for over two hours as airline staff manually tagged luggage and processed check-ins over the phone.

    One passenger, Lucy Spencer, told the BBC that mobile boarding passes failed to work at the gate, forcing travelers back to the check-in counters where hundreds were already queuing.

    RTX confirmed the cyberattack on its Collins Aerospace software at “select airports” and stated the impact was limited to “electronic customer check-in and baggage drop”.

    The company highlighted that the disruption could be mitigated with manual check-in procedures and that its teams were “actively working to resolve the issue and restore full functionality”.

    In the meantime, affected airports like Heathrow deployed extra staff to assist passengers and advised travelers to check their flight status with their respective airlines before heading to the airport.

    According to flight tracking service FlightAware, hundreds of flights were delayed across the affected airports throughout Saturday, with Brussels Airport alone confirming 10 cancellations and 17 flights delayed by more than an hour.

    Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.

    The post Heathrow and Other European Airports Hit by Cyberattack, Several Flights Delayed appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • First-ever AI-powered ‘MalTerminal’ Malware Uses OpenAI GPT-4 to Generate Ransomware Code

    ·

    , ,

    AI-powered malware, known as ‘MalTerminal’, uses OpenAI’s GPT-4 model to dynamically generate malicious code, including ransomware and reverse shells, marking a significant shift in how threats are developed and deployed.

    This discovery follows the recent analysis of PromptLock, another AI-driven malware, indicating a clear trend toward adversaries weaponizing large language models (LLMs).

    This discovery was part of the “LLM-Enabled Malware In the Wild” research presented by SentinelLABS at the LABScon 2025 security conference.

    The findings highlight how adversaries are beginning to integrate LLMs directly into their malicious payloads, creating challenges for traditional security detection methods.

    PromptLock: An Academic Proof-of-Concept

    In August 2025, security firm ESET discovered PromptLock, which was initially declared the first-known AI-powered ransomware. It was later revealed to be a proof-of-concept created by researchers at New York University to demonstrate the potential dangers of such threats.

    Unlike MalTerminal, which relies on a cloud-based API, PromptLock is written in Golang and uses the Ollama API to run an LLM locally on the victim’s machine.

    Based on predefined prompts, PromptLock generates malicious Lua scripts in real-time, making it compatible across Windows, Linux, and macOS.

    Promptlock
    Promptlock

    The malware is designed to identify the type of infected system, such as a personal computer, server, or industrial controller, and then autonomously decide whether to exfiltrate or encrypt data using the SPECK 128-bit encryption algorithm.

    MalTerminal Uncovered

    While PromptLock was a research project, SentinelLABS researchers found LLM-enabled malware in the wild. Instead of searching for known malicious code, they focused on artifacts unique to LLM integration.

    The team wrote YARA rules to scan for hardcoded API keys and common prompt structures embedded within binaries. This API key hunting methodology successfully identified a cluster of suspicious Python scripts and a compiled Windows executable named MalTerminal.exe.

    Analysis revealed the malware uses a deprecated OpenAI API endpoint, suggesting it was created before November 2023 and making it the earliest known sample of its kind.

    MalTerminal functions as a malware generator. Upon execution, the tool prompts its operator to choose between creating ‘Ransomware’ or a ‘Reverse Shell’. It then sends a request to the GPT-4 API to generate the corresponding malicious Python code at runtime.

    This approach means the malicious logic is never stored within the initial binary, allowing it to bypass static analysis and signature-based detection tools.

    The research also uncovered related scripts, including early versions (TestMal2.py) and even a defensive tool named ‘FalconShield’, which appears to be an experimental malware scanner created by the same author.

    The emergence of malware like MalTerminal and PromptLock signifies a new challenge for cybersecurity defenders. The ability to generate unique malicious code for each execution makes detection and analysis significantly more difficult.

    However, this new class of malware also has inherent weaknesses. Its dependency on external APIs, local models, and hardcoded prompts creates a new attack surface for defenders.

    If an API key is revoked or a model is blocked, the malware is rendered inoperable. While LLM-enabled malware is still considered experimental, these examples serve as a critical warning that threat actors are actively innovating, forcing defenders to adapt their strategies to focus on detecting malicious API usage and anomalous prompt activity.

    Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.

    The post First-ever AI-powered ‘MalTerminal’ Malware Uses OpenAI GPT-4 to Generate Ransomware Code appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶