The attackers impersonate at least 40 companies and disable 145 security products to deploy infostealer malware.
The post Fake LastPass Installers Push Kernel-Level EDR Killer, ‘Rapuncel’ Stealer appeared first on SecurityWeek.
https://www.securityweek.com/fake-lastpass-installers-push-kernel-level-edr-killer-rapuncel-stealer/
US, UK, and Dutch government agencies published a report detailing the malware, and the FBI described the abuse of Telegram for C&C.
The post US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware appeared first on SecurityWeek.
https://www.securityweek.com/us-uk-dutch-agencies-expose-iranian-chosen-brick-surveillance-malware/
It wasn’t that long ago that ClickFix attacks were exotic. Now the technique has become mainstream as attackers reap its simplicity and effectiveness in infecting users of PCs and Macs alike. All that’s required is a compromised website—a painless enough task—a fake CAPTCHA overlay, and the inclusion of a single terminal command. So many visitors get suckered into pasting and running the command that just about every malware pusher has adopted the technique. Even Kremlin-backed hacking groups are joining in.
“Reddit is becoming post after post after post of people getting their computer infected via ClickFix,” independent researcher Kevin Beaumont observed Thursday. “Legit websites everywhere [are] getting hacked to serve the fake captcha prompts.”
More seasoned Internet users—a fair number who read this site—are quick to dismiss the attack. They typically blame the people who fall for the scams and marvel at their gullibility and lack of attention. The reality is that for more casual users, using computers and the Internet has become so difficult—think impossible-to-close interstitials, CAPTCHAs with an endless series of pictures to analyze, and constantly changing interfaces that bury the features they’re looking for—that they have grown desensitized to instructions that seem ridiculous and burdensome.
https://arstechnica.com/security/2026/09/clickfix-attacks-infecting-pcs-and-macs-are-going-viral/
Il 10 ottobre torna la conferenza internazionale dedicata alla cybersecurity e all’ethical hacking. Tra i temi dell’ottava edizione, vulnerabilità negli AI coding assistant, attacchi alle infrastrutture di rete, malware, anonimato e compromissione dei sistemi autonomi L’intelligenza artificiale che sta cambiando anche il lavoro di chi cerca vulnerabilità e sviluppa nuove tecniche di attacco è uno […]
L’articolo No Hat 2026, a Bergamo l’hacking incontra AI, cyber-spionaggio e droni proviene da Securityinfo.it.
https://www.securityinfo.it/2026/09/11/no-hat-2026-a-bergamo-lhacking-incontra-ai-cyber-spionaggio-e-droni/?utm_source=rss&utm_medium=rss&utm_campaign=no-hat-2026-a-bergamo-lhacking-incontra-ai-cyber-spionaggio-e-droni
Hidden desktops are a legitimate Windows capability, often used by specialized software, and occasionally used by malware.
MedusaHVNC is a remote access trojan (RAT) being sold as malware-as-a-service (MaaS). It is promoted through its own website and a Telegram channel. It was found and analyzed by BlackFog, with the analysis finding a hidden virtual network computing (HVNC) module that opens a legitimate browser on a separate hidden Windows desktop,
Since it operates from a hidden desktop, its operation is invisible to the user.
The malware uses a 5-stage infection chain. It starts when the legitimate wscript.exe executes a JScript launcher. The script waits for just over 7.5 seconds and then builds its embedded files under %TEMP%\Nx2981Okkr2\.
Several files are written to disc, including an encrypted payload and a .bat in the Startup folder to maintain persistence.
Windows AutoIT is used to decrypt the payload and start charmap.exe (the Windows character map utility. The loader, now inside charmap.exe, contains two further layers of encryption. “The first applies a 16-byte repeating XOR operation to 1,009,152 bytes from the .data section. The second uses ChaCha20 to decrypt 998,912 bytes of ciphertext with a 32-byte key, a 12-byte nonce, and an initial counter value of 1,” write the researchers.
That installed final payload ‘is an unsigned PE32+ x86-64 console executable containing a .pay section and the family string MedusaHVNC.’ It communicates with the operator’s C2 at a hardcoded address: 51.89.204.28:4444.
The operator can create a browser of choice within the hidden desktop from Chrome, Edge, and Firefox. Legitimate Windows functions, including BitBlt, EnumWindows, and PrintWindow support screen and window capture, while SendInput and SetWindowsHookExW are associated with synthetic input and interaction.
“Clipboard functions, including OpenClipboard, GetClipboardData, and SetClipboardData, provide another way to move information into or out of the session,” comment the researchers.
The hidden desktop allows the attacker to take full advantage of legitimate Windows tools without being observed by the user. The C2 is hardcoded into the malware but is relatively safe from observation. The result is a stealthy and persistent RAT.
The only obvious mitigation is detection of unexpected data exfiltration. Even if the RAT’s operation is out of view in the unknown and hidden desktop, the data must still be exfiltrated from the network. Detection of unexplained data leaving the network is always an indication that something is wrong somewhere.
Related: Google Antigravity in Crosshairs of Security Researchers, Cybercriminals
Related: Threat Actor Infests Hotels With New RAT
Related: New ‘Lobshot’ hVNC Malware Used by Russian Cybercriminals
Related: TrickBot Targets Outlook, Browser Data
https://www.securityweek.com/medusahvnc-malware-uses-hidden-windows-desktops-to-evade-detection/
A recently discovered piece of malware abuses the Microsoft 365 calendar for command-and-control (C&C) communication, Group-IB reports.
Dubbed HollowGraph, the malware is believed to be part of a larger toolkit and is likely linked to Cavern Manticore, an Iran-nexus threat actor that Check Point detailed earlier this month.
The malware’s communication mechanism relies on the Microsoft Graph API and a compromised 365 account in Israel to hide its C&C communication within legitimate traffic.
“Using the Microsoft Graph API, it treats the compromised mailbox’s calendar as a two-way dead-drop: operators plant tasking as calendar events, and the implant exfiltrates stolen files by creating its own events with encrypted data attached,” Group-IB explains.
The payloads are attached to events as files, and the events are dated far in the future (13 May 2050) to avoid alerting the mailbox owner. The malware uses hybrid RSA + AES encryption to secure the payloads.
Additionally, HollowGraph retains a secondary communication channel, performing DNS tunneling to refresh its configuration and Microsoft Entra ID (Azure AD) credentials it uses for authentication.
Group-IB identified 12 HollowGraph victims, including three that were actively communicating with the attackers’ infrastructure. The earliest observed communication occurred on June 3, suggesting that the malware has been deployed in attacks since at least last month.
“The recovered indicators — an Israeli mailbox used for exfiltration and malware samples uploaded from Israel — suggest a focused interest in Israeli entities rather than broad, opportunistic compromise,” the company notes.
HollowGraph never reaches out to an attacker-controlled server for payload delivery. Instead, it relies on two supported commands: ‘send’ to generate calendar appointments with attached files, and ‘get’ to search for appointments planted by the operator and download new instructions.
The malware’s hardcoded configuration, which contains the Microsoft Entra ID tenant ID, client ID and secret, target mailbox address, C&C domain, and two RSA keys, is written to disk as logAzure.txt upon execution.
Based on command format and structure, Group-IB believes that HollowGraph is part of a variant of the Cavern framework, but attributes it to the Iran MOIS-linked OilRig subgroup Lyceum (also known as Hexane and SiameseKitten) with low confidence.
“Based on the evidence currently available, we cannot confidently attribute this activity to any previously identified threat actor. However, our analysis identified several technical similarities with the Iranian-nexus threat actor Lyceum. While these overlaps are noteworthy, they are not sufficiently unique to support a high-confidence attribution,” Group-IB notes.
Related: In Other News: Iran Tracks US Military Phones, CrashStealer macOS Malware, CVD Blueprint
Related: China-Linked APT GopherWhisper Abuses Legitimate Services in Government Attacks
Related: Multiple Jscrambler Packages Impacted by Supply Chain Attack
Related: GigaWiper Combines Multiple Malware for System-Level Sabotage
https://www.securityweek.com/new-hollowgraph-malware-abuses-microsoft-365-calendar-for-cc-communication/
Two recently patched SonicWall appliance zero-days were exploited by threat actors for weeks before patches were released, according to cybersecurity firm Volexity.
SonicWall released a public advisory for the vulnerabilities on July 14, informing customers that CVE-2026-15409 and CVE-2026-15410 had been exploited in the wild.
Remote, unauthenticated attackers can exploit the flaws to hack SMA1000 secure remote access appliances. SonicWall has made available hotfix releases to address the security holes.
Volexity, which assisted the vendor’s investigation into the attacks, attributed the exploitation of the zero-days to a threat actor it tracks as UTA0533.
The security firm believes exploitation started as early as June 22.
The company on Friday shared IoCs and other technical details related to the attacks, but it has not linked UTA0533 to any known threat actor and the group’s motivation remains unclear. However, based on Volexity’s description, the attack appears more consistent with state-sponsored APT activity rather than a profit-driven cybercrime operation.
Once the attackers compromised the targeted SonicWall appliances, they deployed custom malware named KnuckleBall, which injected two other tools into legitimate processes: a tailored Java webshell named OrangeTail, and an open source proxy named Suo5.
“With root access, the threat actor could access stored or cached credentials, capture network traffic, and potentially intercept credentials processed by the appliances,” Volexity said.
The security firm added, “Although UTA0533 demonstrated significant capability in compromising the SonicWall appliances, available evidence suggests the threat actor was less successful moving laterally or gaining access to other systems.”
CISA has added CVE-2026-15409 and CVE-2026-15410 to its KEV catalog, which currently includes 17 flaws affecting SonicWall products.
Related: WP2Shell WordPress Vulnerabilities Exploited in the Wild
Related: Fresh SharePoint Vulnerability Exploited Soon After Disclosure
Related: Splunk, Zoom Patch Critical Vulnerabilities
Related: Nightmare Eclipse Drops ‘LegacyHive’ Windows Zero-Day
https://www.securityweek.com/sonicwall-zero-days-exploited-to-deliver-custom-malware-for-weeks-before-patch/
Il team GReAT di Kaspersky ha documentato nel report di Securelist OkoBot, un framework malevolo composto da oltre venti moduli che colpisce gli utenti di criptovaluta su Windows. La catena di attacco è stata ridisegnata a fine aprile 2025; la telemetria sulle vittime copre il periodo aprile 2025-giugno 2026 e GReAT ne ha identificato gli attacchi a gennaio 2026. La campagna è attiva da oltre un anno ed è tuttora in corso, con centinaia di vittime in più di venticinque Paesi, concentrate in Brasile, Vietnam, Canada, Messico e Turchia. Secondo Dmitry Galov (GReAT), citato nel comunicato di Kaspersky, i vettori osservati indicano gli sviluppatori tra i bersagli primari: un dettaglio che sposta la vicenda dal solo furto di criptovaluta al rischio d’ingresso in ambienti aziendali.
Il primo canale è la tecnica ClickFix, che induce la vittima a incollare ed eseguire comandi apparentemente innocui. Il secondo è più raffinato: un repository GitHub esistito da fine marzo 2025 a giugno dello stesso anno, composto dal solo README.md
con una finta guida d’installazione in stile ufficiale, indicizzato in cima ai risultati dei motori per la query SSMS
. Il pacchetto che prometteva SQL Server Management Studio consegnava in realtà una versione dell’editor audio Audacity con un impianto malevolo incorporato in una libreria. Non è avvelenamento della catena di fornitura, perché non risultano compromessi né un pacchetto legittimo né l’account di un manutentore: è abuso di piattaforma e SEO poisoning. Il perno, tuttavia, è lo stesso già osservato nelle campagne di pacchetti open source avvelenati contro gli sviluppatori, la fiducia implicita negli strumenti di lavoro quotidiani. Cambia il vettore, resta la superficie.
Lo script TookPS
installa SSH sulla macchina della vittima, apre una connessione verso il server SSH controllato dagli attaccanti e inoltra la porta del demone SSH locale. Dopo un ritardo, è un bot SSH automatizzato, operante lato attaccante, a collegarsi alla porta inoltrata per consegnare i payload: il bot non risiede sull’host colpito. È questo bot a costruire la persistenza più interessante per un pubblico enterprise. Apre le porte del firewall per il traffico RDP in ingresso, crea un utente nel gruppo “Remote Desktop Users”, sostituisce la termsrv.dll
legittima con una versione modificata per consentire sessioni RDP concorrenti e crea un’attività pianificata chiamata Apple Sync
che mantiene ogni ora un tunnel SSH inverso sulla porta RDP locale.
Da qui parte l’anello che porta ai plugin. Il bot recupera i moduli via SFTP e li esegue tramite HDUtil
, un launcher protetto con VMProtect, usando il comando target
; l’argomento opzionale nouac
di quel comando esegue il bypass dell’UAC tramite RPC di Windows e un msconfig.exe
auto-elevato, tecnica descritta da Google Project Zero nel 2019. L’ultima consegna è Volume2
, un’utility open source collegata a una protobuf.dll
malevola: la libreria appare legittima ma espone una funzione ProtobufGetVer2
che decritta e avvia l’implant vero, cioè il dispatcher di plugin. Il payload è cifrato con AES-GCM e chiave statica a 256 bit, ma con il tag di autenticazione omesso, quindi senza verifica d’integrità. Il meccanismo è quello del DLL hijacking, utile come indicatore per la detection; tra i verdetti con cui Kaspersky rileva il framework figura infatti anche Trojan.Win32.Dllhijack.*
.
Il dispatcher interroga il server di comando ogni venti secondi; i ricercatori hanno individuato cinque plugin: un wrapper per CMD, uno per PowerShell, un enumeratore d’ambiente, un dropper e un process injector. È il process injector a mettere in campo i quattro implant veri e propri, iniettandoli in processi legittimi: ext_daemon
, SeedHunter
, MC Keylogger
e OkoSpyware
. Il primo si aggancia ai processi dei browser basati su Chromium, non solo Chrome: per Microsoft Edge, ad esempio, viene agganciata la msedge.dll
. Installa estensioni malevole concedendo tutti i permessi richiesti; nell’attacco analizzato l’estensione installata era Rilide
. L’occultamento passa dalle stesse funzioni interne del browser agganciate dal loader: le estensioni malevole finiscono in un array dedicato e, quando quelle funzioni vengono invocate con tali estensioni come parametro, non fanno nulla e restituiscono un valore costante, sopprimendo le notifiche ed escludendole dall’elenco visibile, mentre le altre estensioni continuano a comportarsi normalmente. In fase d’installazione le estensioni vengono inoltre scompattate nella directory non predefinita Local Extension Settings
, con il manifest modificato al volo per iniettare un oggetto custom_args
contenente l’identificativo della macchina infetta (
hwid
) e il browser.
Il MC Keylogger
registra tasti e appunti (testo, immagini e percorsi dei file copiati), traccia i dispositivi USB collegati e cattura uno screenshot ogni cinque minuti. OkoSpyware
confronta le finestre attive con un elenco di oltre cento nomi di eseguibili, tra cui wallet come Exodus e Litecoin QT e gestori di password come KeePassXC e 1Password, e intercetta anche i titoli delle finestre dei browser tramite espressioni regolari (ad esempio le pagine delle estensioni MetaMask o Tonkeeper), avviando la registrazione video con FFmpeg e il logging dei tasti. L’esfiltrazione chiude il ciclo ed è anche anti-forense: uno script TookPS
lanciato da un’attività pianificata riceve dal C2 uno script PowerShell dedicato, invia all’endpoint ir-post.php
tutti i file prodotti da MC Keylogger
e OkoSpyware
, poi li cancella dal sistema e svuota il file di cronologia ConsoleHost_history.txt
.
Il modulo SeedHunter
si inietta nei processi di Trezor Suite, Ledger Wallet e Ledger Live agganciando le funzioni interne del framework Electron delle applicazioni: la finestra fraudolenta nasce quindi dentro l’app legittima. Il modulo interroga il C2 moonsand[.]store
e riceve un flag Wait
: se è true
, avvia scansioni periodiche dei dispositivi USB filtrate per VID e PID e attende che venga collegato un Ledger o un Trezor per mostrare la pagina di phishing; se è false
, la pagina compare subito. Il punto controintuitivo è proprio questo: il dispositivo hardware non viene compromesso, viene aggirato il software companion, ed è l’utente a consegnare la seed phrase digitandola nella schermata falsa. Chi cede quella sequenza perde il controllo dei fondi, perché la frase di recupero vale più della password e non è revocabile.
L’evoluzione documentata da Kaspersky è la prova che il framework è manutenuto attivamente. Già a marzo 2026 il componente Volume2
viene installato direttamente da TookPS
, la vecchia catena HDUtil
verso extl
verso Rilide
risulta abbandonata e sostituita integralmente dal plugin ext_daemon
(funzionalmente identico a extl.exe
, solo meno offuscato e privo di VMProtect), mentre TeviRAT
è stato rimosso perché le sue funzioni sono coperte dal nuovo dispatcher; sempre da marzo 2026 la protobuf.dll
è stata rinominata version.dll
. Sull’attribuzione Kaspersky è netta: non collega la campagna ad alcun attore noto. Segnala però indizi circostanziali che rimandano ad attori di lingua russa, tecnica peraltro diffusa in quell’ambiente: i server della prima fase restituiscono una risposta vuota agli indirizzi IP di Russia e CSI, il codice sorgente delle pagine di phishing di SeedHunter
contiene commenti in russo e l’infostealer Rilide
circola su forum di cybercrime di lingua russa ad accesso su invito. Un’avvertenza sugli indicatori: il post pubblico ne espone solo un sottoinsieme, mentre la lista completa e gli script di decrittazione sono riservati ai clienti del servizio Kaspersky Threat Intelligence Reporting.
Sul piano difensivo gli artefatti non mancano: file come %PROGRAMDATA%hwid.dat
(l’identificativo di macchina che ogni componente verifica all’avvio, terminando se assente o non valido, il che ostacola anche l’analisi fuori dall’host bersaglio), %PROGRAMDATA%HDVideoHDUtil.exe
e %USERPROFILE%.sshgo.bat
, account non autorizzati nel gruppo “Remote Desktop Users”, traffico SSH in uscita da endpoint utente, la sostituzione di termsrv.dll
e l’attività pianificata Apple Sync
, fino allo svuotamento di ConsoleHost_history.txt
come segnale post-esfiltrazione. Il messaggio operativo resta duplice: trattare le workstation degli sviluppatori come asset ad alto rischio e ricordare agli utenti che nessun software legittimo chiede di digitare la seed phrase del wallet hardware su schermo.
https://www.ictsecuritymagazine.com/notizie/okobot-seed-phrase-ledger-trezor/
A new macOS malware named ClickLock Stealer leverages social engineering and process killing to bypass the operating system’s protections and obtain valuable information from victims.
Cybersecurity firm Group-IB came across ClickLock Stealer in early June, and the malware appears to have been around since at least late May. Researchers say it has targeted at least 100 users across 33 countries, more than half in Europe.
The stealer is designed to collect various types of data from compromised systems, including web browsers, cryptocurrency wallets and wallet extensions, and password manager extensions. It can also harvest blockchain addresses from six chains and target the macOS Keychain, FTP credentials, and shell history. The stolen data is added to an archive file and exfiltrated to a Telegram bot.
While Group-IB researchers could not definitively determine how ClickLock Stealer is distributed, they believe threat actors may have used SEO poisoning, social media posts, or compromised websites to lure victims to a ClickFix attack page disguised as a Cloudflare verification.
Users who land on this page are instructed to copy a bash command, paste it into macOS’s Terminal, and execute it. Once the command is run, an orchestrator script file is downloaded and executed, which in turn fetches four other scripts representing a credential stealer, a cryptocurrency stealer, a Keychain stealer, and a backdoor installer.
The backdoor remains on the compromised machine, but the other scripts are removed once they have harvested the targeted data and sent it back to the attacker.
macOS’s design and built-in protections make it harder to deploy malware. However, ClickLock Stealer succeeds primarily through social engineering because the malware is downloaded and executed directly by the victim with their own privileges. Unlike other malware, it does not need exploits or privilege escalation.
To access the targeted data, the malware employs aggressive process-killing loops. The orchestrator component displays a fake macOS dialog to capture the user’s password, killing every visible process so that only the password window is shown on the screen until the victim complies.
“A background loop also starts killing macOS NotificationCenter continuously for approximately ~6 hours, suppressing any Gatekeeper or security warnings that might alert the victim,” Group-IB explained in a blog post describing ClickLock Stealer.
Other components also aggressively terminate applications that the victim may use to analyze or disrupt the attack. The credential stealer component also displays a fake macOS password dialog and keeps it open in a long loop while other applications are terminated, forcing the victim to enter the password.
When the malware queries the macOS Keychain for the Chrome Safe Storage encryption key, which protects passwords and other browser data, the user is prompted to authorize the action. Again, all processes are killed until the user complies and Keychain access is granted.
Related: macOS Weaknesses Chained to Silently Disable Endpoint Security Agents
Related: MacSync macOS Malware Distributed via Signed Swift Application
Related: Apple Patches Dozens of Vulnerabilities Across iOS, macOS, and Safari
https://www.securityweek.com/clicklock-stealer-bypasses-macos-security-with-social-engineering-process-killing/
Microsoft, law enforcement, and several cybersecurity companies have collaborated to take down infrastructure shared by two widely used malware families: Amadey and StealC.
The action, part of the long-running Operation Endgame, involved the use of AI, legal action, and the exploitation of a vulnerability in a malware control panel, and resulted in hundreds of domains and servers being targeted for takedown.
While many cybercrime operations have been disrupted in recent years as part of Operation Endgame, this one stands out because law enforcement and companies targeted what they described as the “cybercrime assembly line”.
Making the rounds since 2018, Amadey is a malware-as-a-service loader that gives threat actors access to systems, enabling them to deliver secondary payloads. StealC is an infostealer that has been around since 2023, helping cybercriminals obtain credentials, cryptocurrency wallets, cookies, and other valuable data.
Amadey and StealC have often been used together — the former has enabled hackers to gain access to systems, while the latter has been used to steal information from the breached systems.
AI-powered analysis of the two malware families revealed that they use the same command-and-control (C&C) infrastructure, making it easier for Microsoft and its partners to conduct takedown activities.
“This operation marked a shift in strategy: instead of focusing solely on individual threats, Europol, law enforcement and judicial authorities, as well as private industry partners disrupted the entire chain that allows cyberattacks to scale,” said Europol.
More than 25 million unique credentials stolen from over 385,000 systems were seized, and 18,000 compromised computers were identified and secured. Europol said crypto assets valued at more than $47 million were identified and flagged to restrict their use.
Researchers also discovered a vulnerability in the StealC C&C panel that enabled uploading a web shell to the server. While this flaw was exploited to collect data in support of the takedown operation, there is evidence that a StealC affiliate also used it to steal other affiliates’ data.
Microsoft, Europol, ESET, Bitsight, IBM X-Force, Proofpoint, and Japan’s Mitsui Bussan Secure Directions (MBSD) have published blog posts describing the action taken against Amadey and StealC.
The announcement comes shortly after law enforcement and cybersecurity companies worked together to take down the SocGholish botnet.
Related: Russian Initial Access Broker Behind FortiBleed Campaign
Related: New ‘Mistic’ RAT Opens Door to Several Ransomware Families
Related: CryptoBandits Malware Doubles as a Backdoor, Abuses Tor
https://www.securityweek.com/microsoft-and-allies-smash-shared-infrastructure-of-amadey-and-stealc-malware/