Four Kenyan filmmakers became victims of sophisticated surveillance when FlexiSPY spyware was covertly installed on their devices while in police custody, according to forensic analysis conducted by the University of Toronto’s Citizen Lab.

The incident occurred on or around May 21, 2025, after authorities seized the devices during arrests connected to allegations surrounding the BBC documentary “Blood Parliament.”

The filmmakers—MarkDenver Karubiu, Bryan Adagala, Nicholas Wambugu, and Christopher Wamae—were arrested on May 2 at a Nairobi studio on charges of publishing false information.

Though released without charges the following day, their electronic devices remained in police custody until July 10, providing a window for the unauthorized spyware installation.

CPJ analysts noted that the FlexiSPY installation represents a significant breach of journalistic privacy and security.

The commercially available surveillance tool grants operators comprehensive access to victims’ digital communications, including real-time monitoring of messages, emails, and social media activities.

Senior researcher John Scott-Railton emphasized that the spyware provides “silent, secret access to all sorts of private business and information about their journalism.”

FlexiSPY markets itself as a monitoring solution for parents and employers, advertising capabilities that extend far beyond basic surveillance.

The software can record phone calls, track device locations and website visits, capture passwords, download photos and videos, and even activate device microphones for environmental listening.

This comprehensive surveillance capability makes it particularly concerning when deployed against journalists and media professionals.

Advanced Persistence and Monitoring Capabilities

The FlexiSPY spyware demonstrates sophisticated persistence mechanisms designed to maintain long-term access to compromised devices.

Once installed, the malware operates stealthily in the background, continuously transmitting data to remote servers while avoiding detection by standard security measures.

The software’s architecture allows it to survive device reboots and resist removal attempts through hidden system-level integration.

The spyware’s monitoring capabilities extend to encrypted messaging platforms, potentially compromising secure communications that journalists rely upon for source protection.

By intercepting data before encryption occurs at the application level, FlexiSPY can capture sensitive information that would otherwise remain protected.

This functionality poses particular risks for investigative journalists who depend on confidential communications with sources and colleagues.

The incident highlights growing concerns about state surveillance of media professionals and the weaponization of commercial spyware against press freedom advocates worldwide.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post Kenyan Filmmakers Installed With FlexiSPY Spyware That Monitors Messages and Social Media appeared first on Cyber Security News.

A previously unknown advanced persistent threat (APT) group has unleashed a new fileless malware framework, dubbed EggStreme, in a highly targeted espionage campaign against strategic organizations.

Emerging in early 2024, EggStreme exploits the legitimate Windows Mail executable (WinMail[.]exe) to sideload a malicious library, allowing attackers to achieve in-memory code execution without writing decrypted payloads to disk.

This technique evades traditional file-based defenses and has set off alarms among security teams operating in sensitive sectors.

The attack chain begins when a logon script delivered via an exposed SMB share executes WinMail[.]exe from the user’s AppData directory.

Instead of loading the genuine .NET runtime library, the binary inadvertently loads mscorsvc[.]dll, which contains the first stage loader.

Once loaded, this DLL establishes a reverse shell by invoking cmd[.]exe and creating read/write pipes to a command-and-control (C2) server.

Lateral movement and persistence are then orchestrated through hijacked Windows services that run with elevated privileges.

Bitdefender analysts noted that the EggStreme framework is composed of multiple tightly integrated components, each responsible for a distinct phase of the operation.

The EggStremeLoader, registered as a service, reads an encrypted payload file (ielowutil[.]exe[.]mui) and extracts two more layers: a reflective loader and the core backdoor agent.

By leveraging reflective injection into trusted processes like winlogon.exe or explorer.exe, the adversary ensures continuous execution in memory.

This multi-stage approach, with each layer decrypted and injected only when needed, makes detection exceedingly difficult.

In its final form, the EggStremeAgent establishes a gRPC-based communication channel secured by mutual TLS, authenticating with certificates issued by a shared malicious certificate authority.

Once the backdoor is in memory, its 58 commands enable remote fingerprinting, file manipulation, registry operations, process injection, and sophisticated lateral movement such as RPC scans and WMIC-based remote process creation.

Infection Mechanism and DLL Sideloading

EggStreme’s initial infection leverages a subtle but powerful code snippet to hijack the search order for Windows libraries.

By placing a malicious DLL alongside WinMail.exe, the malware forces the legitimate binary to load attacker-controlled code. A representative snippet is shown below:-

// Pseudo-code illustrating DLL sideloading
HANDLE hModule = LoadLibraryA("mscorsvc[.]dll");
if (hModule) {
    FARPROC pFunc = GetProcAddress(hModule, "CorBindToRuntime");
    if (pFunc) {
        pFunc();
    }
}

When WinMail.exe calls LoadLibraryA("mscorsvc[.]dll"), the Windows loader searches the local directory first, finding the malicious DLL instead of the system version.

The loader decrypts its payload using an RC4 key ("Cookies"), checks for an on-disk configuration at %APPDATA%\Microsoft\Windows\Cookies\Cookies[.]dat, and updates its in-memory C2 list accordingly.

The initial handshake comprises a 32-byte RC4-encrypted key exchange, ensuring integrity before the shell is created.

Persistence is achieved through two complementary approaches. In some instances, the attackers alter the ServiceDLL registry value under HKLM\SYSTEM\CurrentControlSet\Services\<ServiceName>\Parameters to point to a malicious DLL.

In others, they replace service binaries and grant SeDebugPrivilege, allowing the malicious payload to run under the context of a trusted Windows service.

Both methods ensure that EggStreme components are reloaded on every reboot, maintaining a resilient foothold.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post New EggStreme Malware With Fileless Capabilities Leverages DLL Sideloading to Execute Payloads appeared first on Cyber Security News.

In early May 2025, cybersecurity researchers began tracking a novel Remote Access Trojan (RAT) targeting Chinese-speaking users via phishing sites hosted on GitHub Pages.

Masked as legitimate installers for popular applications, the initial ZIP archives contained malicious executables engineered to bypass sandbox and virtual machine defenses.

Once executed, the first-stage shellcode performs time stability analysis using QueryPerformanceCounter and examines hardware configurations—disk space and CPU cores—to identify analysis environments and terminate if suspicions arise.

This meticulous evasion strategy ensures that kkRAT rarely triggers alerts during automated detonation.

Over the next stages, kkRAT deploys advanced anti-analysis techniques, dynamically resolving Windows API functions through single-byte XOR obfuscation and decrypting subsequent shellcodes with simple XOR transforms.

In the second stage, the malware unloads and disables network adapters to sever AV/EDR communications, enumerates processes associated with Chinese security vendors, and employs a vulnerable driver (RTCore64.sys) to remove registered callbacks from kernel-mode defenses.

Zscaler analysts noted that kkRAT even alters registry values for 360 Total Security to disable network checks and schedules tasks under SYSTEM privileges to repeatedly kill protection processes upon user logon.

By the third stage, kkRAT retrieves a heavily obfuscated shellcode named 2025.bin from hardcoded URLs, decodes Base64-encoded instructions in output.log, and selects download URLs based on the victim process’s filename.

The extracted archives contain legitimate executables sideloaded with malicious DLLs that decrypt the final payload—kkRAT itself—using a six-byte XOR key at offset 0xD3000.

Zscaler researchers identified this seamless use of sideloading to deploy multiple RAT variants, including ValleyRAT and FatalRAT, but the newly discovered kkRAT blended features from both Ghost RAT and Big Bad Wolf.

In its operation, kkRAT establishes a TCP connection to its command-and-control server, compresses data via zlib, and applies an additional XOR-based encryption layer.

A sample Python snippet used to decrypt captured traffic demonstrates this two-phase process:-

import zlib
def decrypt_packet(data, key):
    compressed = bytes(b ^ key for b in data)
    return zlib.decompress(compressed)

Infection Mechanism

Upon execution of the sideloaded DLL, kkRAT reads its encrypted configuration—C2 IP, port, version, and group identifier—and constructs a REGISTRATIONINFO struct containing detailed device fingerprints such as OS version, CPU frequency, memory size, installed antivirus signatures, and the presence of messaging applications.

This thorough profile allows attackers to prioritize high-value targets. Uniquely, kkRAT inspects the clipboard for cryptocurrency wallet addresses (Bitcoin, Ethereum, Tether) and replaces them with attacker-controlled addresses via the 0x4D command, a tactic designed to hijack transactions silently.

Once persistence is established through startup folder shortcuts or registry run keys, kkRAT remains resident, awaiting further instructions to load plugins—ranging from remote desktop management to process termination—and relay network traffic through Go-based SOCKS5 proxies.

Through its layered encryption, sophisticated anti-analysis checks, and financial theft capabilities, kkRAT represents a significant evolution in commodity RAT toolkits, underscoring the persistent threat of supply-chain style malware delivery.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post kkRAT Employs Network Communication Protocol to Steal Clipboard Contents appeared first on Cyber Security News.

In recent months, cybersecurity researchers have observed a surge in malicious domain registrations linked to an emerging e-crime group known as PoisonSeed.

First identified in April 2025, this actor has focused its efforts on impersonating legitimate cloud-based email platforms, most notably SendGrid, to harvest enterprise credentials.

By embedding fake Cloudflare CAPTCHA interstitials and Ray ID data into their phishing infrastructure, PoisonSeed has managed to evade cursory detections and lure unsuspecting targets into surrendering login information.

Domaintools analysts noted that between June and September 2025, PoisonSeed registered over twenty domains that closely mimic SendGrid’s login portals.

These domains were often hosted on IP ranges assigned to the Global-Data System IT Corporation (AS42624) and registered through NiceNIC International Group Co., a registrar that has attracted scrutiny for its lax verification processes.

Researchers identified subtle misspellings and additional path structures—such as “sgportalexecutive[.]com” and “internal-sendgrid[.]com”—designed to exploit both user trust and automated screening tools.

The impact of PoisonSeed’s campaign extends beyond simple credential theft. Once enterprise credentials are compromised, the actor deploys lateral movement techniques within corporate environments to expand access.

This progression can lead to data exfiltration, fraudulent fund transfers, and even ransomware deployment.

In one unreported incident, PoisonSeed leveraged harvested credentials to send internal phishing invitations to high-value targets, ultimately siphoning sensitive financial data.

Despite the sophistication of these campaigns, detection evasion remains a core focus for PoisonSeed.

By integrating fake JavaScript-based CAPTCHA logic and dynamically generated Ray IDs, the group ensures that each interstitial appears unique.

Moreover, their use of co-hosting on legitimate-looking domains adds an additional layer of stealth, delaying incident response teams from isolating the malicious infrastructure.

Infection Mechanism and Detection Evasion

A closer examination of PoisonSeed’s infection mechanism reveals a multi-stage process that capitalizes on human trust and automated filtering weaknesses.

In the initial phase, victims receive an email purporting to originate from SendGrid, complete with legitimate-looking headers and tracking links.

When the target clicks the link, they are redirected to a CAPTCHA challenge page that appears authentic.

PoisonSeed embeds counterfeit session tokens to maintain the illusion of authenticity. Following validation, users are presented with a second form requesting their SendGrid credentials.

At this juncture, the actor captures the submitted data before forwarding the victim to the legitimate SendGrid login page, minimizing suspicion.

The use of chained redirects and script obfuscation ensures that traditional URL blocklists and signature-based defenses struggle to keep pace with the rapidly changing domain infrastructure.

By continuously rotating domain names and leveraging compromised hosting environments, PoisonSeed maintains a resilient phishing operation that demands advanced threat intelligence and proactive monitoring to counter effectively.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post PoisonSeed Threat Actor Registering New Domains in Attempt to Compromise Enterprise Credentials appeared first on Cyber Security News.