• Microsoft has acknowledged a frustrating new issue affecting users of the “new Outlook” for Windows, where Excel attachments fail to open if their filenames contain non-ASCII characters.

    The technical glitch, tracked under the reference ID EX1189359, triggers a vague error message advising users to “Try opening the file again later,” leaving many confused about the cause of the blockage.​

    The problem targets the modern “new Outlook” client explicitly and does not appear to impact the classic version of the software. According to Microsoft’s service health dashboard, the root cause lies in an encoding error within the request used to open the files.

    When an Excel file attached to an email includes non-standard characters such as accented letters, symbols, or non-English scripts, the application fails to process the filename correctly, resulting in an immediate error.​

    This issue has been ongoing since late November 2025, with initial reports surfacing around November 23. While the scope is limited to specific file naming conventions, the impact is significant for international users or organizations that frequently use non-ASCII characters in document titles.​

    Microsoft’s Response and Fix Status

    As of the latest update on December 1, 2025, Microsoft engineers have successfully developed a fix to address the missing encoding in file-handling requests.

    However, the solution is not yet available to all users. The company is currently in the validation phase, testing the deployment to ensure it resolves the error without introducing secondary issues.​

    Microsoft is also investigating why this encoding error occurred in the first place to prevent similar regressions in future updates. A further status update is expected by the evening of December 1, UTC time.​

    Until the patch is fully rolled out, Microsoft has provided two official workarounds for users who need immediate access to their spreadsheets:

    • Use Outlook on the Web (OWA): The web-based version of Outlook correctly processes these attachments, bypassing the client-side encoding failure.​
    • Download the File Locally: Users can save the attachment to their computer first. Once the file is saved to a local drive, it can be opened directly in Excel without triggering the Outlook previewer error.​

    This incident joins a growing list of pains for the new Outlook client, which has faced scrutiny from power users for feature-parity gaps compared to the classic COM-based application. Admin administrators can track the progress of the fix in the Microsoft 365 admin center under EX1189359.​

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Microsoft Confirms New Outlook Bug Blocking Excel Attachments appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • India’s telecommunications ministry has reportedly asked major mobile device manufacturers to preload a government-backed cybersecurity app named Sanchar Saathi on all new phones within 90 days. According to a report from Reuters, the app cannot be deleted or disabled from users’ devices. Sanchar Saathi, available on the web and via mobile apps for Android and iOS, allows users to report

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A sophisticated Advanced Persistent Threat group known as Bloody Wolf has intensified its cyber espionage operations across Central Asia, targeting government and private sectors.

    Since late June 2025, the group has orchestrated spear-phishing campaigns primarily focusing on organizations within Kyrgyzstan and Uzbekistan.

    By meticulously impersonating state entities such as the Ministry of Justice, the attackers successfully deceive victims into compromising their systems.

    The primary vector involves weaponized PDF documents sent via email, mimicking official correspondence. These documents often bear titles suggesting urgent legal matters or case materials, compelling recipients to interact with embedded links.

    Once clicked, these links initiate a multi-stage infection process designed to bypass traditional security defenses and establish long-term access to the victim’s network.

    Group-IB security analysts identified this surge, noting the group shifted from commercial malware like STRRAT to deploying the legitimate, yet weaponized, NetSupport Remote Administration Tool.

    This strategic pivot allows attackers to blend in with normal administrative traffic, making detection significantly more challenging for corporate security teams.

    The campaigns demonstrate a high level of regional adaptation, including the use of local languages and geo-fencing techniques to restrict payload delivery to targets within specific countries.

    The impact is profound, granting attackers full remote control over infected endpoints. This access facilitates data exfiltration, system inventory surveillance, and lateral movement within critical infrastructure networks.

    Infection Chain

    Bloody Wolf’s technical strategy relies on malicious Java Archive files to execute the payload. Victims interacting with the lure are prompted to update Java, a pretext masking the malicious loader’s execution.

    The JAR files, compiled with Java 8, are unobfuscated but highly effective. In the Uzbekistan campaign, the infrastructure employed geo-fencing, where only requests originating from within the country triggered the download of the malicious JAR, while others were redirected to legitimate government portals.

    Persistence functions code (Source - Group-IB)
    Persistence functions code (Source – Group-IB)

    Once executed, the JAR loader ensures persistence through redundant methods. The malware drops a batch file into the Windows Startup folder and modifies registry keys, executing commands like cmd.exe to ensure the RAT launches upon reboot.

    Fake error message pop-ups (Source - Group-IB)
    Fake error message pop-ups (Source – Group-IB)

    Additionally, it creates a scheduled task using schtasks to guarantee execution. This redundancy ensures that the NetSupport RAT remains active on the system, allowing the attackers to maintain a persistent foothold while displaying fake error messages, to distract the user from the background malicious activity.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post Bloody Wolf Hackers Mimic as Government Agencies to Deploy NetSupport RAT via Weaponized PDF’s appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • South Korean e-commerce giant Coupang has confirmed a massive security incident affecting approximately 33.7 million customers—nearly the company’s entire user base.

    The breach, which exposed names, phone numbers, email addresses, shipping addresses, and order histories, has been traced back to a former employee who exploited unrevoked internal access credentials.

    While the scale of the leak is unprecedented, Coupang has assured customers that sensitive financial data, including credit card numbers and payment information, as well as account passwords, were not compromised.

    The company has stated that affected users do not need to take specific protective actions regarding their accounts but should remain vigilant against potential phishing attempts disguised as official Coupang communications.

    The unauthorized access reportedly began on June 24, 2025, but went undetected for months. Coupang first identified abnormal activity on November 18, initially estimating that only 4,500 accounts were impacted.

    However, a subsequent internal investigation revealed the true extent of the damage, confirming that tens of millions of records had been accessed via an overseas internet connection.

    The breach highlights a critical failure in Coupang’s identity and access management (IAM) protocols. According to Rep. Choi Min-hee, chair of the National Assembly’s Science, ICT, Broadcasting and Communications Committee, the company failed to revoke cryptographic signing keys associated with a former employee upon their departure.

    The suspect, believed to be a former staff member of Chinese nationality who worked on authentication systems, allegedly used these valid signing keys to generate access tokens.

    These tokens allowed the attacker to bypass standard login procedures and access the system remotely. Coupang admitted that while industry standards for key expiration vary, the specific keys used in this attack remained valid long after the employee left the organization.

    The Seoul Metropolitan Police Agency is currently analyzing server logs and collaborating with international agencies to trace the IP address involved. Investigators are also determining if the suspect is linked to anonymous emails sent to Coupang threatening to reveal the security flaws. Notably, these communications did not include a ransom demand.

    The regulatory fallout for Coupang could be historic. Under the Personal Information Protection Act, companies can be fined up to 3 percent of their average annual revenue for such violations.

    Given Coupang’s recent revenue figures, the fine could reach as high as 1 trillion won ($680 million), potentially shattering the previous record penalty of 134.8 billion won set by a prior telecommunications breach.

    Coupang is currently notifying all affected individuals via email and text message, while fully cooperating with the Personal Information Protection Commission and the Korea Internet & Security Agency.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Coupang Data Breach Exposed Personal Data of 33.7 Million Customers appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A threat actor known as ShadyPanda has been linked to a seven-year-long browser extension campaign that has amassed over 4.3 million installations over time. Five of these extensions started off as legitimate programs before malicious changes were introduced in mid-2024, according to a report from Koi Security, attracting 300,000 installs. These extensions have since been taken down. “These

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • “Kill everybody.” Several key bipartisan U.S. lawmakers are warning the U.S. military may have committed war crimes when it launched its first attacks against alleged drug-trafficking boats around Latin America on Sept. 2, according to reporting Friday from Alex Horton and Ellen Nakashima of the Washington Post.  

    Rewind: After the very first U.S. strike, at least two survivors were seen still alive and “clinging to the smoldering wreck” of their destroyed boat, according to the Post’s reporting, which cited seven people with knowledge of the event. Eleven people had been on the boat when the military first hit it with a missile. When a drone feed revealed the two survivors moments later, the Joint Special Operations commander overseeing the strikes at the time—Navy Adm. Frank Bradley—ordered a second strike to kill them, and the “two men were blown apart in the water,” according to the Post

    Defense Secretary Pete Hegseth had delivered a spoken directive to “kill everybody” on the boat, a person with direct knowledge of the operation told the Post. It’s not clear that Hegseth was aware of the survivors; but his subordinates were reportedly keen on following orders since, as the Post reports, Bradley “ordered the second strike to fulfill Hegseth’s directive that everyone must be killed.” (Bradley has since been placed in command of U.S. Special Operations Command, which oversees JSOC.) “If the video of the blast that killed the two survivors on Sept. 2 were made public, people would be horrified, said one person who watched the live feed,” the newspaper reports. 

    If the reporting is true, it would appear the U.S. military violated Section 5.4.7 of the Defense Department’s Law of War Manual (PDF), which states “it is prohibited to order that legitimate offers of surrender will be refused or that detainees, such as unprivileged belligerents, will be summarily executed.” The manual continues, “Moreover, it is also prohibited to conduct hostilities on the basis that there shall be no survivors, or to threaten the adversary with the denial of quarter. This rule is based on both humanitarian and military considerations. This rule also applies during non-international armed conflict.”

    Notable: Hegseth did not dispute the account; but he did call the Post’s reporting “fabricated, inflammatory, and derogatory,” writing Friday on social media, and insisted “Our current operations in the Caribbean are lawful under both U.S. and international law.” 

    New: Both the House and Senate Armed Services Committee leaders announced investigations into the allegations. From the Senate side, “The Committee has directed inquiries to the Department, and we will be conducting vigorous oversight to determine the facts related to these circumstances,” Roger Wicker, R-Miss., and Jack Reed, D-R.I., said in a joint statement, The Hill reported Saturday morning. 

    HASC leaders also vowed “bipartisan action to gather a full accounting of the operation in question,” according to a joint statement from Chairman Mike Rogers, R-Ala., and Adam Smith, D-Wash., Saturday afternoon. “This committee is committed to providing rigorous oversight of the Department of Defense’s military operations in the Caribbean. We take seriously the reports of follow-on strikes on boats alleged to be ferrying narcotics in the SOUTHCOM region,” they said. (And for what it’s worth, “The two committees referred to the Department of Defense by that name, rather than by the ‘Department of War’ rebrand Hegseth and Trump have pushed,” historian Heather Cox Richardson noted Saturday evening.)

    “This rises to the level of a war crime if it's true,” said Sen. Tim Kaine, D-Va., speaking Sunday on “Face the Nation” from CBS News. 

    “Obviously, if that occurred, that would be very serious and I agree that that would be an illegal act,” said Rep. Mike Turner, R-Ohio, speaking Sunday on “Face the Nation” as well. Turner also said the reported events are “completely outside anything that has been discussed with Congress and there is an ongoing investigation.” 

    “We should get to the truth,” said former Air Force Brig. Gen. Don Bacon, R-Neb., speaking Sunday on “This Week” from ABC News. “I don't think he would be foolish enough to make this decision to say, kill everybody, kill the survivors because that's a clear violation of the law of war,” Bacon said. 

    Legal POV: “[T]here can be no conceivable legal justification” for what the Post’s reporting alleges, argues former Pentagon counsel Jack Goldsmith, writing Friday on Substack. 

    President Trump’s reaction: “He said he did not say that. And I believe him 100%,” the president told reporters aboard Air Force One on Sunday. He then added, “I wouldn't have wanted that, not a second strike.” 

    • By the way: The 10th chapter in Hegseth’s book is titled, “More lethality, less lawyers,” Anna Bower of Lawfare noted on social media. “It’s almost as if the signs were there all along,” she added. 

    Latest: Hegseth appeared to be trying to make light of the allegations, posting a meme about the alleged war crime to social media on Sunday evening using an AI-generated image based on the children’s book series, Franklin the turtle. At least two Franklin-based memes were shared by users in response, here and here, emphasizing the legal stakes of Hegseth’s war on drug boats. 

    Additional reading:Trump’s Focus on Drug War Means Big Business for Defense Startups” in the business of selling drones, sensors and AI-based surveillance platforms to the military, the Wall Street Journal reported Saturday. 


    Welcome to this Monday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson and Bradley Peniston. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1969, the U.S. held its first military draft lottery since the Second World War. 

    Ukraine

    Peace-talks update: Ukraine won’t give up land, says the country’s chief negotiator. “As long as Zelensky is president, no one should count on us giving up territory. He will not sign away territory,” Andriy Yermak told The Atlantic’s Simon Shuster by telephone from Kyiv last week. “The constitution prohibits this.”

    Ukraine “is prepared to discuss only where the line should be drawn to demarcate what the warring sides control,” Shuster wrote, quoting Yermak as saying, “All we can realistically talk about right now is really to define the line of contact…And that’s what we need to do.” Read on, here.

    Russia launched Trump’s peace plan with promises of profits. The Wall Street Journal reports. “For the Kremlin, the Miami talks were the culmination of a strategy, hatched before Trump’s inauguration, to bypass the traditional U.S. national security apparatus and convince the administration to view Russia not as a military threat but as a land of bountiful opportunity, according to Western security officials. By dangling multibillion-dollar rare-earth and energy deals, Moscow could reshape the economic map of Europe—while driving a wedge between America and its traditional allies.”

    Putin’s negotiator, Kirill Dmitriev, told Trump envoy Steve Witkoff and son-in-law Jared Kushner that U.S. companies might “tap the roughly $300 billion of Russian central bank assets, frozen in Europe, for U.S.-Russian investment projects and a U.S.-led reconstruction of Ukraine. U.S. and Russian companies could join to exploit the vast mineral wealth in the Arctic.” Read the quintuple(!)-bylined WSJ article, here.

    Rep. Don Bacon: “We saw that Wall Street Journal article yesterday that many people around the president are hoping to make billions of dollars—these are all billionaires in their own right—from…Russia, if they get a favorable agreement with Ukraine. That alarms me tremendously,” the former Air Force one-star told ABC’s “This Week” on Sunday. 

    “Putin’s the invader, he’s the dictator, he’s murdered all his opponents. But I just don’t see that moral clarity coming from the White House,” he continued. “I don’t want to see a foreign policy based on greed. I want to see it based on doing the right thing.”

    Historian reax: “The Trump administration is replacing American democracy with a kleptocracy, a system of corruption in which a network of ruling elites use the institutions of government to steal public assets for their own private gain,” warned Heather Richardson of Boston College, writing Sunday. “It permits virtually unlimited theft while the head of state provides cover for his cronies through pardons and the uneven application of the law. It is the system Russia’s president Vladimir Putin exploits in Russia, and President Donald J. Trump is working to establish it in the United States of America.”

    Additional reading: 

    Around the Defense Department

    Space Force won’t say who got money to start developing orbital interceptors. The amounts are small—under $9.5 million apiece—which exempts them from disclosure requirements, but at least some of them are likely to lead to contracts worth billions of dollars. Several experts said the secrecy that surrounds the wildly ambitious Golden Dome project has several drawbacks. Defense One’s Thomas Novelly reports, here.

    The Navy detected plutonium in the air at a shuttered San Francisco shipyard a year before it told anyone. Pu-239 was detected at an “Action Level” at the former Hunters Point Naval Shipyard in November 2024, but only revealed in October. “On this issue we did not do a good job,” Michael Pound, the Navy’s environmental coordinator overseeing the site’s clean-up, said at a recent community meeting. The Guardian has more, here.

    D.C. Guard shooting

    A National Guardman is “fighting for his life” after the Wednesday shooting that left another dead in Washington, D.C. Air Force Staff Sgt. Andrew Wolfe is hospitalized in critical condition, West Virginia Gov. Patrick Morrisey said Saturday on “Fox & Friends.” 

    Army Spc. Sarah Beckstrom died on Thanksgiving, one day after the attack. Arrested: Rahmanullah Lakanwal, an Afghan national, has been charged with first-degree murder. USA Today has more, here.

    Commentary:A Terrible and Avoidable Tragedy in D.C.,” is how former Homeland Security official Juliette Kayyem described the shooting, writing  the day after in The Atlantic.

    Additional reading: 

    Overseas

    Germany is raising its defenses, following an 1,800-page playbook. WSJ: “The blueprint details how as many as 800,000 German, U.S. and other NATO troops would be ferried eastward toward the front line. It maps the ports, rivers, railways and roads they would travel, and how they would be supplied and protected on the way.”

    The logistics plan is part of an “‘all-of-society’ approach to war,” that marks “a return to a Cold-War mindset, but updated to account for new threats and hurdles—from Germany’s decrepit infrastructure to inadequate legislation and a smaller military—that didn’t exist at the time.” Read on, here

    Additional reading: “Taiwan puts $40 billion toward building a defense dome and buying US weapons,” the Associated Press reported on Wednesday.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • “ShadyPanda,” a sophisticated threat actor responsible for a seven-year campaign that has successfully infected 4.3 million Chrome and Edge users.

    By exploiting the inherent trust in browser marketplaces, ShadyPanda weaponized “Featured” and “Verified” extensions to deploy remote code execution (RCE) backdoors and massive spyware operations without triggering traditional security alarms.

    The investigation reveals that ShadyPanda’s strategy relied on patience rather than immediate exploitation. The group operated legitimate extensions, such as “Clean Master,” for years to build a user base and earn a trusted status from Google and Microsoft.

    Malicious Clean Master
    Malicious Clean Master

    In mid-2024, after building a user base of 300,000, they pushed a silent, malicious update.

    This update transformed the extensions into hourly RCE vehicles. Every infected browser now checks a command-and-control server (api.extensionplay[.]com) each hour, downloading and executing arbitrary JavaScript with full browser privileges.

    This mechanism allows the actor to dynamically switch payloads from surveillance today to potential ransomware or credential theft tomorrow, completely bypassing static analysis.

    4.3 Million Chrome and Edge Users Hacked

    While the RCE operation was surgical, ShadyPanda’s Phase 4 campaign is on an industrial scale. Five active extensions in the Microsoft Edge marketplace, including the popular “WeTab,” are currently being used by over 4 million users.

    Unlike the removed Chrome extensions, these Edge add-ons remain live. They actively collect comprehensive browser fingerprints, search queries, and full URLs, transmitting the data to servers in China, including Baidu and private infrastructure .

    The malware captures mouse clicks with pixel-level precision and exfiltrates browsing history in real-time, effectively turning enterprise and personal browsers into open surveillance devices .

    Based on the Koi Security report, here is a detailed breakdown of the specific data points collected and exfiltrated by the ShadyPanda malware campaigns.

    Data Exfiltration method
    Data Exfiltration Method
    Data CategorySpecific Details CollectedCampaign / SourceExfiltration Method
    Browsing Activity– Complete URL history of every visited site
    – HTTP Referrers (showing navigation origin)
    – Navigation patterns and timestamps
    Phase 3 (Clean Master)
    Phase 4 (WeTab)
    Encrypted AES (Phase 3)
    Real-time transmission (Phase 4)
    User Input & Search– Search queries (Google, Bing, etc.)
    – Real-time keystrokes (capturing typos & corrections)
    – Pre-search intent (profiling before “Enter” is hit)
    Phase 2 (Infinity V+)
    Phase 4 (WeTab)
    Unencrypted HTTP (Phase 2)
    Transmitted to Baidu/WeTab servers (Phase 4)
    Device Fingerprinting– User Agent strings
    – Operating System & Platform
    – Screen resolution & Timezone settings
    – System language
    Phase 3
    Phase 4
    Used to build unique profiles that survive anti-tracking tools
    Behavioral Biometrics– Mouse click coordinates (X/Y positions)
    – Specific page elements clicked
    – Scroll behavior and depth
    – Active time spent on specific pages
    Phase 4 (WeTab)High-frequency logging sent to surveillance servers in China
    Identity & Storage– Persistent UUID4 identifiers (survives browser restarts)
    – Content of localStorage and sessionStorage
    – Browser Cookies (enabling session hijacking)
    Phase 2
    Phase 3
    Phase 4
    – Persistent UUID4 identifiers (survive browser restarts)
    – Content of localStorage and sessionStorage
    – Browser Cookies (enabling session hijacking)

    ShadyPanda’s success highlights a critical flaw in the browser security model: trust is static, but code is dynamic. By passing an initial review and waiting years to weaponize the auto-update pipeline, the actor bypassed the primary defense mechanism of the Chrome and Edge stores.

    The auto-update feature, designed to keep users secure, became the vector that delivered the infection directly behind enterprise firewalls.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post 4.3 Million Chrome and Edge Users Hacked in 7-Year ShadyPanda Malware Campaign appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybercriminals have found a more effective method to compromise Windows computers while evading detection by security software.

    Ivan Spiridonov observed that uploading malicious tools, hackers are now using legitimate Windows programs already installed on target systems, a tactic known as “living off the land” (LOLBins, or Living Off the Land Binaries).​

    Unlike traditional attacks that rely on external tools like Mimikatz or PowerShell Empire, which are easily detected by endpoint detection and response (EDR) solutions.

    Why This Method Works

    This new approach leverages Microsoft-signed programs such as PowerShell, Windows Management Instrumentation (WMI), Certutil, and BitAdmin.

    These tools are trusted by default because system administrators use them every day for legitimate work.

    The appeal is straightforward: security software typically flags suspicious files, but Windows’ built-in tools are signed by Microsoft and allowed by default.

    When attackers use these legitimate programs for malicious purposes, their activity blends seamlessly with normal administrative operations, making detection nearly impossible without sophisticated behavioral analysis.​

    A red team operator discovered this advantage firsthand during a security assessment. After uploading a password-dumping tool to a Windows machine, security staff detected and blocked the attack within 15 minutes.

    But when using only built-in Windows utilities, the same operator-maintained access for three weeks, moved across 15 different systems, and extracted data without triggering a single security alert.​

    Common Living Off the Land Techniques

    Attackers use various native Windows tools for different objectives. PowerShell handles reconnaissance and command execution.

    WMI enables remote system queries and process creation. Scheduled tasks provide persistence without the need for suspicious executables. And Windows services enable long-term access with system-level privileges.​

    Criminals use Certutil to download files, BitAdmin for background transfers, DNS for covert tunneling, and even email applications to exfiltrate sensitive information.​

    Security teams face a nearly impossible challenge: they cannot simply block these tools because their own IT staff depends on them for normal operations.

    Disabling PowerShell would break automation scripts. Removing WMI would damage system management capabilities.

    This creates a fundamental dilemma: allow these tools and accept the risk, or block them and cripple legitimate business functions.​

    Defense requires a fundamental shift away from signature-based detection toward comprehensive logging and behavioral analysis.

    Utility / FeatureMalicious FunctionWhy It Evades Detection
    PowerShellEnables remote command execution on other systems.It is a trusted Microsoft automation tool, so malicious scripts look like normal IT operations .
    WMI (Windows Management Instrumentation)Abused to download malicious payloads from the internet or exfiltrate stolen data.Used for reconnaissance, dumping credentials, and moving laterally across the network.
    Certutil.exeCreates persistent access by setting up jobs that execute attacker code at specific times.It is a legitimate certificate authority utility that is explicitly allowed by most security controls .
    Scheduled TasksUsed to establish persistence and modify system configurations.Malicious tasks are disguised as legitimate system maintenance jobs .
    Windows RegistryMalicious tasks are disguised as legitimate system maintenance jobs.Allows attackers to execute commands without uploading files or using suspicious protocols.

    Security teams need PowerShell script block logging, command-line auditing, WMI activity monitoring, and tools such as Sysmon to track detailed system behavior.​

    Defenders should also implement strict application allow listing policies and monitor unusual process relationships, Ivan Spiridonov added.

    Watch for suspicious network connections from administrative tools, and establish baselines for regular administrative activity.

    These measures can identify when legitimate tools are being abused for malicious purposes, even if individual commands appear normal.​

    As attackers continue evolving their methods, organizations must move beyond blocking known tools and focus instead on detecting suspicious behavior patterns that indicate compromise, regardless of which legitimate application is being misused.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Hackers are Moving to “Living Off the Land” Techniques to Attack Windows Systems Bypassing EDR appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • OpenAI has patched a command injection flaw in its Codex CLI tool that allowed attackers to execute arbitrary commands on developers’ machines simply by getting a malicious configuration file into a project repository.

    The issue, now fixed in Codex CLI version 0.23.0, effectively turned routine use of the codex command into a silent remote‑code‑execution trigger.​

    Codex CLI is OpenAI’s terminal-based coding agent, designed to read, edit, and run code while integrating external tools via the Model Context Protocol (MCP).

    Check Point Research (CPR) discovered that the CLI implicitly trusted project-local configuration, allowing MCP server definitions to be loaded and executed automatically at startup with no user approval.

    This behavior meant ordinary repo files, such as .env and .codex/config.toml, could be transformed into execution primitives.​

    OpenAI Codex CLI Vulnerability

    CPR showed that if a repository contains a .env that sets CODEX_HOME=./.codex, plus a matching ./.codex/config.toml with mcp_servers entries, Codex will resolve its configuration to that folder and immediately run the configured command and arguments whenever codex is launched in that repo.

    There was no secondary validation or re‑approval when those commands changed, so attackers with commit or pull‑request access could plant benign‑looking configs and later swap in malicious payloads.

    In one proof-of-concept, the researchers triggered macOS Calculator as soon as Codex started, illustrating how arbitrary commands fire in the user’s context.

    Because Codex runs with the developer’s privileges, a poisoned repo could silently open reverse shells, exfiltrate SSH keys and cloud tokens, or tamper with source code every time Codex is invoked.

    The attack pathway also lends itself to supply-chain abuse: popular templates, starter repos, or CI pipelines that use Codex could propagate the backdoor to many downstream environments without additional interaction. CPR warns that the flaw effectively collapsed a key security boundary by treating project-controlled files as trusted execution material.​

    CPR privately reported the issue to OpenAI on 7 August 2025, and OpenAI shipped a fix on 20 August 2025 in Codex CLI 0.23.0. The patch blocks .env files from silently redirecting CODEX_HOME into project directories, closing the automatic execution chain demonstrated by the researchers.

    Testing by CPR confirmed the mitigation, and all Codex users are strongly advised to upgrade to version 0.23.0 or later and to treat repository-level MCP configuration as sensitive, review‑required content going forward.​

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post OpenAI Codex CLI Command Injection Vulnerability Let Attackers Execute Arbitrary Commands appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A critical security vulnerability in Microsoft Azure API Management (APIM) Developer Portal enables attackers to register accounts across different tenant instances, even when administrators have explicitly disabled user signup through the portal interface.

    The flaw, which Microsoft has classified as “by design,” remains unpatched as of December 1, 2025, leaving organizations potentially exposed to unauthorized access.​

    The security issue stems from a fundamental design flaw where disabling signup in the Azure Portal UI only hides the registration form visually, while the underlying /signup API endpoint remains fully active and accessible.

    When Basic Authentication is configured for the Developer Portal, the backend API continues to accept registration requests without validating tenant boundaries or verifying that the request originates from an authorized source.​

    Microsoft Azure API Management Flaw

    Attackers exploit this vulnerability by manipulating the Host header in signup requests. The attack requires access to any APIM instance with signup enabled, including one controlled by the attacker, where they can intercept a legitimate signup request, modify the Host header to point to a target organization’s APIM instance, and successfully create an account despite signup being “disabled” on the victim’s portal.​

    The vulnerability enables several critical security risks, including cross-tenant account creation on any APIM instance with Basic Authentication enabled, complete bypass of administrative access controls, and potential exposure of sensitive API documentation and subscription keys. Organizations that believed they had disabled public registration may unknowingly remain vulnerable to this attack vector.​

    APIM instances are vulnerable if Basic Authentication is configured (regardless of UI settings), the Developer Portal is deployed and accessible, and the service runs on Developer, Basic, Standard, or Premium tiers. The vulnerability has been assigned a CVSS score of 6.5, classified as medium-high severity under CWE-284 (Improper Access Control).​

    Finnish security researcher Mihalis Haatainen of Bountyy Oy discovered the vulnerability on September 30, 2025, and immediately reported it to Microsoft Security Response Center (MSRC).

    After submitting two detailed reports in September and November, Microsoft closed both cases, stating the behavior was “by design” and did not constitute a security vulnerability. The researcher subsequently reported the issue to CERT-FI before publicly disclosing it on November 26, 2025.​

    Since Microsoft has not released a patch, organizations must take immediate action to protect their APIM instances. The most critical step is completely removing the Basic Authentication identity provider from the Azure Portal, not merely disabling signup in the UI.

    Organizations should navigate to their APIM instance, access Developer Portal settings under Identities, and delete the “Username and password” identity provider entirely.​

    Additional protective measures include switching exclusively to Azure Active Directory authentication to enforce proper tenant boundaries, auditing all existing Developer Portal user accounts for unauthorized registrations created after signup was supposedly disabled, and implementing continuous monitoring of signup activity and API calls.

    Security teams can use the publicly available Python verification script and Nuclei template released by the researcher to identify vulnerable instances within their organizations.​

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Microsoft Azure API Management Flaw Enables Cross-Tenant Account Creation, Bypassing Admin Restrictions appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶