Throughout the first half of 2025, financially motivated threat actors have shifted their approach to intrusions, abandoning traditional implant-heavy methods in favor of a more cost-effective strategy.

Rather than deploying sophisticated malware payloads, attackers are leveraging stolen credentials and valid account access to establish persistence within target networks across multiple industries.

The FortiGuard Incident Response team responded to dozens of engagements, revealing a consistent pattern where adversaries gain initial access through compromised credentials, which are either harvested via phishing campaigns, purchased from Initial Access Brokers, or obtained through password reuse and infostealer malware distribution.

Fortinet analysts identified that attackers exploit three primary initial access techniques to compromise networks.

External remote services, particularly VPN infrastructure, serve as the most prevalent entry point, allowing adversaries to authenticate using stolen credentials and progress laterally through victim environments.

Additionally, threat actors exploit public-facing applications using n-day vulnerabilities to deploy legitimate remote management tools such as AnyDesk, Atera, Splashtop, and ScreenConnect.

Compromised credentials purchased from underground markets range from $100 to $20,000 depending on organizational size and geographic location, making this approach economically attractive for threat actors operating across developed and emerging economies.

Lateral Movement and Persistence Tactics

Once inside networks, Fortinet researchers noted that adversaries employ manual, operator-driven lateral movement using built-in tools including Remote Desktop Protocol (RDP), Server Message Block (SMB), and Windows Remote Management (WinRM).

This manual approach enables attackers to blend with legitimate administrator activity, significantly complicating detection efforts.

Adversaries maintain persistence by installing their own instances of remote access tools and leveraging privileged credentials obtained through Mimikatz execution and Zerologon exploitation for elevated account access.

Data exfiltration occurs through direct file transfers via RDP and RMM interface drag-and-drop capabilities, leaving minimal forensic artifacts compared to conventional web-based exfiltration methods.

In observed cases, attackers configured VPN infrastructure without multi-factor authentication, granting unrestricted network access and enabling rapid encryption of hypervisor infrastructure for ransomware deployment.

This low-complexity, high-return methodology allows financially motivated adversaries to operate undetected for extended periods while avoiding the detection signatures commonly associated with malware-centric intrusions.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Stolen Credentials and Valid Account Abuse Fuel the Financially Motivated Attacks appeared first on Cyber Security News.

The explosive growth of artificial intelligence has created an unexpected security threat as cybercriminals exploit ChatGPT’s popularity through counterfeit mobile applications.

Recent security research uncovered sophisticated malicious apps masquerading as legitimate ChatGPT interfaces, designed to harvest sensitive user data and monitor digital activities without consent.

These fraudulent applications have infiltrated third-party app stores, targeting users seeking convenient access to AI-powered chatbots.

The malicious applications employ convincing branding techniques that mirror authentic ChatGPT interfaces, complete with recognizable logos and functional designs.

Once installed, these trojanized apps execute hidden surveillance routines while maintaining the appearance of working AI assistants.

The threat intensifies as millions worldwide download unofficial AI applications from unverified sources, unaware of embedded spyware compromising their devices.

Appknox analysts identified these malicious ChatGPT clones during comprehensive mobile security research examining AI-themed applications across distribution platforms.

The security team discovered that threat actors weaponize brand trust as an attack vector, exploiting widespread ChatGPT familiarity to compromise user devices.

Analysis revealed these counterfeits implement full malware frameworks capable of persistent surveillance and credential theft.

Technical examination showed network communications masked through domain fronting using legitimate cloud infrastructure from Amazon Web Services and Google Cloud.

This sophisticated obfuscation allows malicious traffic to blend with normal communications, evading security detection.

Infection Mechanism and Data Exfiltration

The malware deployment begins with convincing app store listings featuring polished graphics and descriptions promising enhanced ChatGPT functionality.

Upon installation, malicious applications request extensive permissions including SMS access, contact databases, call logs, and account credentials.

These requests appear legitimate, masking true surveillance capabilities. Analysis revealed code obfuscation using the Ijiami packer to encrypt malicious payloads.

Decompiled packages contained folders labeled “secondary-program-dex-jars” housing executables that decrypt after installation—characteristic trojan loader signatures.

The malware maintains persistence through embedded native libraries ensuring background execution continues after users close the interface.

Network logs demonstrated systematic exfiltration targeting one-time passwords, banking verification codes, and address book contents.

Stolen credentials enable attackers to intercept multi-factor authentication and infiltrate corporate systems. Researchers noted these techniques parallel established spyware families including Triout and AndroRAT.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Beware of Malicious ChatGPT Apps That Records Users Action and Steals Sensitive Data appeared first on Cyber Security News.

In mid-2025, researchers discovered a sophisticated campaign orchestrated by the Chinese state-sponsored threat group BRONZE BUTLER (also known as Tick) targeting organizations relying on Motex LANSCOPE Endpoint Manager.

The attackers exploited a previously unknown zero-day vulnerability tracked as CVE-2025-61932, which grants remote adversaries the ability to execute arbitrary commands with SYSTEM privileges.

This marks the group’s continued targeting of Japanese asset management software, following their successful exploitation of SKYSEA Client View in 2016.

JPCERT/CC publicly disclosed the vulnerability on October 22, 2025, prompting urgent action from organizations worldwide.

The campaign reveals a meticulously orchestrated attack chain combining multiple malware families and legitimate tools to establish persistence and exfiltrate sensitive information.

Sophos researchers identified that the attackers leveraged the zero-day to achieve initial access on vulnerable internet-facing LANSCOPE servers, then pivoted to lateral movement within compromised networks.

The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2025-61932 to its Known Exploited Vulnerabilities Catalog the same day the advisory was published, confirming active exploitation in the wild.

Sophos analysts identified the Gokcpdoor malware as the primary command and control mechanism employed throughout this operation.

The 2025 variant represents a significant evolution from earlier versions, discontinuing support for the KCP protocol while implementing advanced multiplexing communication capabilities using third-party libraries for command-and-control communications.

Advanced Persistence Through Malware Multiplexing

Sophos researchers identified two distinct Gokcpdoor variants tailored for specific operational purposes.

The server variant maintains open listening ports specified within its embedded configuration, typically using ports 38000 or 38002, to establish incoming remote access channels.

The client variant, conversely, initiates connections to hard-coded command and control servers, establishing secure communication tunnels that function as persistent backdoors.

To complicate forensic analysis and evade detection, the threat actors deployed the OAED Loader malware, which injects payloads into legitimate executables according to embedded configurations.

On certain compromised hosts, the attackers substituted Gokcpdoor entirely with the Havoc command and control framework, demonstrating operational flexibility.

For data exfiltration and lateral movement, BRONZE BUTLER abused legitimate tools including goddi (Go dump domain info), remote desktop applications, and 7-Zip archiving utility.

The attackers further leveraged cloud storage services including io and LimeWire accessed through web browsers during remote sessions, successfully stealing confidential organizational data.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Threat Actors Exploit LANSCOPE Endpoint Manager Zero-Day Vulnerability to Steal Confidential Data appeared first on Cyber Security News.