A malicious Visual Studio Code extension posing as the popular “Material Icon Theme” has been used to attack Windows and macOS users, turning the add-on into a hidden backdoor.

The fake extension shipped through the marketplace with backdoored files, giving the attackers a direct path into developer workstations once it was installed.

After installation, the extension behaved like a normal icon theme, so most users had no reason to suspect anything was wrong.

Behind the scenes, the package contained two Rust-based implants that were ready to run native code on both operating systems and reach out to a remote command server.

Nextron Systems security researchers identified the implants in version 5.29.1 and traced their execution back to a loader script named extension.js placed in dist/extension/desktop next to the native payloads os.node on Windows and darwin.node on macOS.

This shows how the malicious files mirror the folder tree of the real extension to blend in.

Once the extension is activated in VS Code, extension.js loads the correct Rust implant for the current platform and hands control over to the attacker code.

From that moment, the extension stops being a harmless add-on and becomes a loader for further stages that are fully controlled from outside the victim machine.

Infection mechanism and command chain

This section provides a complete technical breakdown of how the implants talk to their command server and fetch follow-up payloads.

The Rust binaries do not use a fixed URL. Instead, they pull their instructions from data stored in a Solana blockchain wallet address, which acts as a hard-to-block control channel.

A simplified view of the loader logic in extension.js is shown below:-

function activate() {
  const bin = process.platform === "win32" ? "os.node" : "darwin.node";
  const native = require(__dirname + "/desktop/" + bin);
  native.run();
}

The native code reads the wallet data, base64-decodes it, and then contacts a command server to download a large base64 blob, which is an AES-256-CBC-encrypted JavaScript file.

As a backup, the same next stage can also be fetched from a hidden Google Calendar event that stores the payload URL with invisible Unicode tricks. This illustrates the C2 chain from the blockchain wallet to the decrypted script.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Malicious VS Code Extension as Icon Theme Attacking Windows and macOS Users appeared first on Cyber Security News.

Advanced steganography techniques are becoming increasingly central to state-sponsored cyber operations.

Recent analysis has exposed two Chinese technology companies, BIETA and CIII, that allegedly provide sophisticated steganography solutions to support advanced persistent threat campaigns.

These organizations operate as front companies linked to China’s Ministry of State Security, playing a critical role in modernizing the country’s intelligence gathering capabilities.

BIETA, formally known as the Beijing Institute of Electronics Technology and Application, operates from a location adjacent to the MSS headquarters in Beijing.

The company maintains close institutional ties with government agencies and universities, including the University of International Relations, which functions as an MSS subsidiary.

CIII, operating as Beijing Sanxin Times Technology Co., Ltd., presents itself as a state-owned enterprise while reportedly providing forensic and counterintelligence support services.

Both organizations maintain detailed focus on developing advanced hiding techniques for malicious payloads.

Security analysts at Telsy identified that these companies have dedicated substantial resources to steganographic research and development.

Analysis of academic publications reveals that approximately 46 percent of BIETA’s 87 research papers published between 1991 and 2023 specifically address steganography.

The companies have obtained multiple software copyrights for techniques including audiovisual-to-voice conversion systems and JPEG image forensic differentiation methods, both registered in 2017.

Steganography implementation strategies

The steganography implementation strategies employed represent a significant technical shift in APT operations.

Rather than relying solely on traditional encryption, threat actors use Least Significant Bit steganography to conceal .NET payloads within image files.

BIETA’s research extends beyond standard JPEG formats to include MP3 audio and MP4 video files for covert information transmission.

Historical APT groups including APT1, Mirage, Leviathan, and Pirate Panda have all utilized similar techniques to distribute backdoors like TClinet and Stegmap without triggering conventional detection systems.

The technical innovation extends to emerging technologies, with BIETA researchers exploring Generative Adversarial Networks for steganographic applications.

This advancement suggests future APT operations may employ AI-driven methods to generate undetectable carrier files.

Understanding these techniques remains essential for defensive security teams as state-sponsored actors continue refining their ability to hide malicious communications within seemingly innocuous media files, making detection increasingly challenging for traditional security monitoring tools and approaches.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Chinese Front Companies Providing Advanced Steganography Solutions for APT Operations appeared first on Cyber Security News.

A new remote access trojan dubbed KimJongRAT has surfaced, posing a severe threat to Windows users.

This sophisticated malware is believed to be orchestrated by the Kimsuky group, a threat actor with alleged state backing.

The campaign typically begins with a phishing email containing a deceptive archive named National Tax Notice, which lures unsuspecting victims into initiating the infection chain.

Upon opening the malicious archive, users are presented with a shortcut file disguised as a legitimate PDF document.

When executed, this shortcut file triggers a hidden command that decodes a Base64 URL and abuses the legitimate Microsoft HTML Application utility to contact a remote server.

This process stealthily downloads an additional payload known as tax.hta, effectively bypassing standard security checks.

Alyac security analysts identified that this loader script is implemented in VBScript and employs clever evasion techniques.

The malware attempts to evade detection by utilizing legitimate services like Google Drive to host its malicious components.

Once active, the loader retrieves both decoy documents to trick the user and the actual malicious binaries required for the next stage of the attack.

Exfiltration of sensitive data

The primary objective of this campaign is the exfiltration of sensitive personal and financial data.

The malware targets a wide array of information, including system details, browser storage data, and encryption keys.

It specifically hunts for cryptocurrency wallet information and credentials for communication platforms like Telegram and Discord, making it a highly dangerous tool for identity theft and financial fraud.

The most notable aspect of KimJongRAT is its ability to adapt its behavior based on the target environment’s security posture.

The malware executes a specific VBScript command to check the status of Windows Defender before proceeding.

It uses the code snippet Set exec = oShell.Exec(ss) followed by If InStr(output, “STOPPED”) > 0 Then to determine if the security service is active.

If Windows Defender is disabled, the malware downloads a file named v3.log, which executes the primary payload.

Conversely, if security is active, it retrieves an alternative file called pipe.log to circumvent detection.

Regardless of the path taken, the malware establishes persistence by registering itself in the system registry, ensuring it runs automatically to transmit stolen data periodically.

While the List of cryptocurrency wallets hijacked by malware highlights the breadth of targeted applications, it also highlights the specific financial intent behind this tailored threat.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post KimJongRAT Attacking Windows Users via Weaponized .hta Files to Steal Logins appeared first on Cyber Security News.

A sophisticated cyberespionage campaign dubbed “Operation Hanoi Thief” has surfaced, specifically targeting IT professionals and recruitment teams in Vietnam.

Discovered on November 3, 2025, this threat activity employs a complex multi-stage infection chain designed to harvest sensitive browser credentials and history.

The attackers leverage a malicious spear-phishing strategy, distributing a ZIP archive named Le-Xuan-Son_CV.zip, which masquerades as a legitimate job application from a software developer based in Hanoi.

The infection initiates when a victim interacts with a shortcut file, CV.pdf.lnk, contained within the archive. This file triggers a sequence of events utilizing “Living off the Land” (LOLBin) tactics.

Specifically, it abuses the Windows ftp.exe utility with the -s flag to execute a batch script hidden within a pseudo-polyglot file named offsec-certified-professional.png.

This file dual-functions as a harmless image lure and a malicious container, effectively evading traditional detection mechanisms by burying its payload within legitimate image headers.

This command line argument is a critical indicator of the attack’s stealthy nature.

Seqrite security analysts identified that this campaign is likely of Chinese origin, citing overlaps in tactics with previous state-sponsored activities.

The primary objective appears to be intelligence gathering, focusing on the theft of login data and browsing habits from victims in the technology and HR sectors.

By exploiting the trust inherent in recruitment processes, the threat actors successfully bypass initial perimeter security layers.

Technical Analysis of the LOTUSHARVEST Payload

The core of this attack is the execution of the LOTUSHARVEST implant. Once the initial script runs, it abuses DeviceCredentialDeployment.exe to conceal its command-line activities and renames system utilities like certutil.exe to lala.exe to bypass monitoring.

In the infection chain, the script then extracts a base64-encoded blob from the polyglot file, decoding it into a malicious DLL named MsCtfMonitor.dll.

This DLL is side-loaded using a legitimate ctfmon.exe binary copied to the C:\ProgramData directory.

LOTUSHARVEST functions as a robust information stealer, employing anti-analysis checks like IsDebuggerPresent and IsProcessorFeaturePresent to crash if analyzed.

It targets Google Chrome and Microsoft Edge, querying SQLite databases to extract the top 20 visited URLs and decrypting up to five saved credentials using CryptUnprotectData.

Finally, the stolen data is formatted into JSON and exfiltrated via an HTTPS POST request to the attacker-controlled server eol4hkm8mfoeevs.m.pipedream.net/service.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Operation Hanoi Thief Attacking IT Professionals with Pseudo-Polyglot Payload to Hide Malware appeared first on Cyber Security News.

With the holiday shopping season kicking into high gear, a massive cybersecurity threat has emerged, putting online shoppers at significant risk.

A coordinated campaign has been discovered, involving the registration of over 2,000 fake holiday-themed online stores.

These malicious sites are designed to lure unsuspecting consumers with the promise of steep discounts, only to steal their payment information and personal data.

The scale of this operation is vast, with two distinct clusters of fraudulent storefronts identified, both employing sophisticated tactics to appear legitimate and deceive shoppers.

The first cluster primarily consists of typosquatted domains mimicking Amazon, while the second spans a wide array of “.shop” domains impersonating well-known brands such as Apple, Samsung, and Ray-Ban.

These fake stores are not isolated incidents but part of a large-scale, automated campaign. The threat actors behind this operation have timed their attack to coincide with peak shopping periods like Black Friday and Cyber Monday, when consumers are actively hunting for bargains and may be less cautious about unfamiliar websites.

CloudSEK security researchers noted the coordinated nature of these scams, identifying the use of identical phishing kits, recurring website templates, and shared infrastructure across the network of fake stores.

This level of coordination suggests a well-organized and resourced operation. The impact on consumers is severe, ranging from direct financial losses to the long-term risks of identity theft.

Furthermore, these scams erode trust in legitimate online retailers and the e-commerce ecosystem as a whole.

Infection and Deception Tactics

The modus operandi of these fake stores is both simple and effective. They leverage a combination of social engineering and technical evasion to trick users and avoid detection.

The sites are designed to look like professional e-commerce platforms, complete with holiday-themed banners, countdown timers creating a false sense of urgency, and fake “trust badges” to build credibility.

Fabricated “recent purchase” pop-ups are also used to create social proof and pressure visitors into making a purchase.

When a user attempts to buy a product, they are redirected to a shell checkout page designed to harvest their billing and payment details.

These shell websites often use unflagged domains to process transactions, allowing the attackers to bypass fraud detection systems.

Fake & Impersonating Domains:-

The investigation also revealed that a shared Content Delivery Network (CDN), cdn.cloud360.top, was used to serve assets to over 750 of the fake stores, further highlighting the centralized nature of the campaign.

A recurring JavaScript file, identified by its unique SHA-256 hash, was also found across numerous malicious .shop domains, controlling the fraudulent checkout process.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Hackers Registered 2,000+ Fake Holiday-Themed Online Stores to Steal User Payments appeared first on Cyber Security News.

A newly discovered Windows malware packer named TangleCrypt has emerged as a serious threat in ransomware attacks, specifically designed to evade endpoint detection and response (EDR) solutions.

The packer was first observed during a September 2025 ransomware incident involving Qilin ransomware, where threat actors deployed it alongside the ABYSSWORKER driver to disable security tools before encrypting victim systems.

TangleCrypt works by hiding malicious payloads through multiple layers of encoding, compression, and encryption. The original executable is stored within PE resources using base64 encoding, LZ78 compression, and XOR encryption.

This multi-layer approach makes it difficult for traditional security tools to detect the actual malware hidden inside the packed executable.

WithSecure Labs security researchers identified the malware during an incident response investigation, recovering artifacts including two executables packed with TangleCrypt and VMProtect, along with a kernel driver masquerading as a CrowdStrike Falcon Sensor driver.

The payload embedded in these executables was identified as STONESTOP, an EDR-killer tool that uses the ABYSSWORKER driver to terminate security processes running on the system forcibly.

The packer employs string encryption and dynamic import resolving to hinder both static and dynamic analysis.

Although malware authors commonly use these techniques, the TangleCrypt implementation lacks advanced anti-analysis mechanisms, making manual unpacking relatively straightforward for experienced analysts.

Payload Execution Mechanism

TangleCrypt supports two distinct methods for launching its payload, determined by a configuration string appended to the embedded executable.

The first method, identified by the string “exex64_amd64_block_”, decrypts and executes the payload within the same process memory.

The second method, marked with “exex64_amd64__riin”, creates a suspended child process and writes the decrypted payload into it before resuming execution.

When executed, the loader first decrypts a small resource entry containing a numeric key, such as “175438”. This key is then used to XOR-decrypt the larger payload stored in the PE resources.

The decryption process follows a specific sequence where a base64-encoded string is decoded, then LZ78 decompressed, decoded again from base64, and finally XOR-decrypted to reveal the original executable.

Upon successful unpacking, the STONESTOP payload checks for administrative privileges and registers the ABYSSWORKER driver if elevated rights are present.

The driver then terminates processes matching a predefined list of security product names, effectively blinding the system’s defenses before ransomware deployment begins.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post TangleCrypt Windows Packer with Ransomware Payloads Evades EDR Using ABYSSWORKER Driver appeared first on Cyber Security News.