A malicious Visual Studio Code extension posing as the popular “Material Icon Theme” has been used to attack Windows and macOS users, turning the add-on into a hidden backdoor.

The fake extension shipped through the marketplace with backdoored files, giving the attackers a direct path into developer workstations once it was installed.

After installation, the extension behaved like a normal icon theme, so most users had no reason to suspect anything was wrong.

Behind the scenes, the package contained two Rust-based implants that were ready to run native code on both operating systems and reach out to a remote command server.

Nextron Systems security researchers identified the implants in version 5.29.1 and traced their execution back to a loader script named extension.js placed in dist/extension/desktop next to the native payloads os.node on Windows and darwin.node on macOS.

This shows how the malicious files mirror the folder tree of the real extension to blend in.

Once the extension is activated in VS Code, extension.js loads the correct Rust implant for the current platform and hands control over to the attacker code.

From that moment, the extension stops being a harmless add-on and becomes a loader for further stages that are fully controlled from outside the victim machine.

Infection mechanism and command chain

This section provides a complete technical breakdown of how the implants talk to their command server and fetch follow-up payloads.

The Rust binaries do not use a fixed URL. Instead, they pull their instructions from data stored in a Solana blockchain wallet address, which acts as a hard-to-block control channel.

A simplified view of the loader logic in extension.js is shown below:-

function activate() {
  const bin = process.platform === "win32" ? "os.node" : "darwin.node";
  const native = require(__dirname + "/desktop/" + bin);
  native.run();
}

The native code reads the wallet data, base64-decodes it, and then contacts a command server to download a large base64 blob, which is an AES-256-CBC-encrypted JavaScript file.

As a backup, the same next stage can also be fetched from a hidden Google Calendar event that stores the payload URL with invisible Unicode tricks. This illustrates the C2 chain from the blockchain wallet to the decrypted script.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Malicious VS Code Extension as Icon Theme Attacking Windows and macOS Users appeared first on Cyber Security News.

Advanced steganography techniques are becoming increasingly central to state-sponsored cyber operations.

Recent analysis has exposed two Chinese technology companies, BIETA and CIII, that allegedly provide sophisticated steganography solutions to support advanced persistent threat campaigns.

These organizations operate as front companies linked to China’s Ministry of State Security, playing a critical role in modernizing the country’s intelligence gathering capabilities.

BIETA, formally known as the Beijing Institute of Electronics Technology and Application, operates from a location adjacent to the MSS headquarters in Beijing.

The company maintains close institutional ties with government agencies and universities, including the University of International Relations, which functions as an MSS subsidiary.

CIII, operating as Beijing Sanxin Times Technology Co., Ltd., presents itself as a state-owned enterprise while reportedly providing forensic and counterintelligence support services.

Both organizations maintain detailed focus on developing advanced hiding techniques for malicious payloads.

Security analysts at Telsy identified that these companies have dedicated substantial resources to steganographic research and development.

Analysis of academic publications reveals that approximately 46 percent of BIETA’s 87 research papers published between 1991 and 2023 specifically address steganography.

The companies have obtained multiple software copyrights for techniques including audiovisual-to-voice conversion systems and JPEG image forensic differentiation methods, both registered in 2017.

Steganography implementation strategies

The steganography implementation strategies employed represent a significant technical shift in APT operations.

Rather than relying solely on traditional encryption, threat actors use Least Significant Bit steganography to conceal .NET payloads within image files.

BIETA’s research extends beyond standard JPEG formats to include MP3 audio and MP4 video files for covert information transmission.

Historical APT groups including APT1, Mirage, Leviathan, and Pirate Panda have all utilized similar techniques to distribute backdoors like TClinet and Stegmap without triggering conventional detection systems.

The technical innovation extends to emerging technologies, with BIETA researchers exploring Generative Adversarial Networks for steganographic applications.

This advancement suggests future APT operations may employ AI-driven methods to generate undetectable carrier files.

Understanding these techniques remains essential for defensive security teams as state-sponsored actors continue refining their ability to hide malicious communications within seemingly innocuous media files, making detection increasingly challenging for traditional security monitoring tools and approaches.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Chinese Front Companies Providing Advanced Steganography Solutions for APT Operations appeared first on Cyber Security News.

A new remote access trojan dubbed KimJongRAT has surfaced, posing a severe threat to Windows users.

This sophisticated malware is believed to be orchestrated by the Kimsuky group, a threat actor with alleged state backing.

The campaign typically begins with a phishing email containing a deceptive archive named National Tax Notice, which lures unsuspecting victims into initiating the infection chain.

Upon opening the malicious archive, users are presented with a shortcut file disguised as a legitimate PDF document.

When executed, this shortcut file triggers a hidden command that decodes a Base64 URL and abuses the legitimate Microsoft HTML Application utility to contact a remote server.

This process stealthily downloads an additional payload known as tax.hta, effectively bypassing standard security checks.

Alyac security analysts identified that this loader script is implemented in VBScript and employs clever evasion techniques.

The malware attempts to evade detection by utilizing legitimate services like Google Drive to host its malicious components.

Once active, the loader retrieves both decoy documents to trick the user and the actual malicious binaries required for the next stage of the attack.

Exfiltration of sensitive data

The primary objective of this campaign is the exfiltration of sensitive personal and financial data.

The malware targets a wide array of information, including system details, browser storage data, and encryption keys.

It specifically hunts for cryptocurrency wallet information and credentials for communication platforms like Telegram and Discord, making it a highly dangerous tool for identity theft and financial fraud.

The most notable aspect of KimJongRAT is its ability to adapt its behavior based on the target environment’s security posture.

The malware executes a specific VBScript command to check the status of Windows Defender before proceeding.

It uses the code snippet Set exec = oShell.Exec(ss) followed by If InStr(output, “STOPPED”) > 0 Then to determine if the security service is active.

If Windows Defender is disabled, the malware downloads a file named v3.log, which executes the primary payload.

Conversely, if security is active, it retrieves an alternative file called pipe.log to circumvent detection.

Regardless of the path taken, the malware establishes persistence by registering itself in the system registry, ensuring it runs automatically to transmit stolen data periodically.

While the List of cryptocurrency wallets hijacked by malware highlights the breadth of targeted applications, it also highlights the specific financial intent behind this tailored threat.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post KimJongRAT Attacking Windows Users via Weaponized .hta Files to Steal Logins appeared first on Cyber Security News.

A sophisticated cyberespionage campaign dubbed “Operation Hanoi Thief” has surfaced, specifically targeting IT professionals and recruitment teams in Vietnam.

Discovered on November 3, 2025, this threat activity employs a complex multi-stage infection chain designed to harvest sensitive browser credentials and history.

The attackers leverage a malicious spear-phishing strategy, distributing a ZIP archive named Le-Xuan-Son_CV.zip, which masquerades as a legitimate job application from a software developer based in Hanoi.

The infection initiates when a victim interacts with a shortcut file, CV.pdf.lnk, contained within the archive. This file triggers a sequence of events utilizing “Living off the Land” (LOLBin) tactics.

Specifically, it abuses the Windows ftp.exe utility with the -s flag to execute a batch script hidden within a pseudo-polyglot file named offsec-certified-professional.png.

This file dual-functions as a harmless image lure and a malicious container, effectively evading traditional detection mechanisms by burying its payload within legitimate image headers.

This command line argument is a critical indicator of the attack’s stealthy nature.

Seqrite security analysts identified that this campaign is likely of Chinese origin, citing overlaps in tactics with previous state-sponsored activities.

The primary objective appears to be intelligence gathering, focusing on the theft of login data and browsing habits from victims in the technology and HR sectors.

By exploiting the trust inherent in recruitment processes, the threat actors successfully bypass initial perimeter security layers.

Technical Analysis of the LOTUSHARVEST Payload

The core of this attack is the execution of the LOTUSHARVEST implant. Once the initial script runs, it abuses DeviceCredentialDeployment.exe to conceal its command-line activities and renames system utilities like certutil.exe to lala.exe to bypass monitoring.

In the infection chain, the script then extracts a base64-encoded blob from the polyglot file, decoding it into a malicious DLL named MsCtfMonitor.dll.

This DLL is side-loaded using a legitimate ctfmon.exe binary copied to the C:\ProgramData directory.

LOTUSHARVEST functions as a robust information stealer, employing anti-analysis checks like IsDebuggerPresent and IsProcessorFeaturePresent to crash if analyzed.

It targets Google Chrome and Microsoft Edge, querying SQLite databases to extract the top 20 visited URLs and decrypting up to five saved credentials using CryptUnprotectData.

Finally, the stolen data is formatted into JSON and exfiltrated via an HTTPS POST request to the attacker-controlled server eol4hkm8mfoeevs.m.pipedream.net/service.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Operation Hanoi Thief Attacking IT Professionals with Pseudo-Polyglot Payload to Hide Malware appeared first on Cyber Security News.