Since its release in October, Battlefield 6 has become one of the year’s most anticipated game launches. However, cybercriminals have quickly seized on this popularity to distribute malicious software.

Attackers have created fake cracked versions of the game and fraudulent game trainers, spreading them across torrent websites and underground forums to target unsuspecting players and individuals searching for game modifications.

The malicious campaigns impersonate well-known game cracking groups like InsaneRamZes and RUNE, using their legitimate names to gain user trust and credibility. This tactic mirrors common brand impersonation attacks used in other sectors.

The criminals have developed three distinct types of malware, each serving different objectives ranging from stealing browser data and cryptocurrency wallet credentials to establishing persistent remote control over infected systems.

Bitdefender Labs security researchers identified these malware campaigns after analyzing multiple samples.

The investigation revealed that none of the malicious files contain actual Battlefield 6 functionality, and they likely originate from different threat groups based on their varying technical approaches.

The first malware sample operates as a simple but aggressive information stealer disguised as a “Battlefield 6 Trainer Installer.” Users can easily discover it on Google’s second search results page, making it highly accessible to potential victims.

Extracting Sensitive Data

Once executed, the malware scans local directories and browser profiles to extract sensitive data, including crypto wallet information, cookie sessions from browsers like Chrome, Edge, and Firefox, Discord session tokens and credentials, and cryptocurrency wallet extension data from Chrome plugins such as iWallet and Yoroi.

The stolen information travels to server 198.251.84.9 over unencrypted HTTP without any obfuscation attempts.

The second variant, distributed as “Battlefield 6.GOG-InsaneRamZes,” demonstrates significantly more sophistication through advanced evasion tactics.

The malware implements regional execution blocking that stops operation when it detects Russian or CIS country settings, a common self-protection measure used by groups based in those regions.

It employs Windows API hashing to obscure its operations and runs anti-sandbox detection checks using timing analysis to determine system uptime.

Additionally, memory analysis revealed references to development tools like Postman and BitBucket, suggesting the malware targets developer credentials and API keys for further exploitation.

The third sample, disguised as a Battlefield 6 ISO image, delivers a persistent command-and-control agent. The 25MB executable contains compressed data that unpacks and creates a file named “2GreenYellow.dat” in the user directory, then silently executes it using regsvr32.exe.

The installed DLL repeatedly attempts contact with ei-in-f101.1e100.net, appearing to use Google’s infrastructure as a relay or communication disguise. The C2 structure indicates capability for remote command execution or future data theft.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Hackers Exploiting Fake Battlefield 6 Popularity to Deploy Stealers and C2 Agents appeared first on Cyber Security News.

Cybercriminals are successfully targeting Apple users through a sophisticated social engineering scheme that tricks victims into running harmful commands on their computers.

The threat, called FlexibleFerret, is attributed to North Korean operators and represents a continuing evolution of the Contagious Interview campaign that has been active throughout 2025.

The malware primarily spreads through fake job recruitment websites that promise employment opportunities but ultimately deliver credential-stealing backdoors and system access to attackers.

The attack begins innocuously with job seekers visiting realistic-looking hiring assessment websites like evaluza.com and proficiencycert.com.

Victims complete fake job assessments branded with names like “Blockchain Capital Operations Manager Hiring Assessment,” providing personal details and even recording video introductions.

After completing these stages, applicants receive a critical instruction to run a specific Terminal command, which the attackers claim is needed to fix camera or microphone access issues.

Jamf security analysts identified this new variant after discovering in-the-wild detections linked to the script named macpatch.sh.

The researchers found JavaScript files on fraudulent recruitment sites designed to build and execute curl commands that download malicious payloads directly to victims’ computers.

Infection mechanism

The infection mechanism employs a multi-stage delivery process that remains hidden from users. When the initial curl command executes, it downloads a shell script that determines whether the victim’s Mac uses ARM64 or Intel architecture, then fetches the appropriate stage-two payload.

The script creates working directories in temporary locations, establishes persistence through LaunchAgents that automatically launch the malware at login, and displays a convincing fake Chrome application that mimics a legitimate password prompt.

This decoy application captures whatever credentials users enter and sends them to a Dropbox account controlled by the attackers.

The third stage activates when a bundled Golang backdoor runs, establishing communication with a command-and-control server.

This sophisticated component supports multiple operations including system information collection, file upload and download capabilities, command execution, Chrome profile theft, and automated credential harvesting.

The backdoor maintains persistence through LaunchAgent entries and includes error-handling mechanisms that reset the malware if temporary failures occur.

Organizations should educate employees to view unsolicited job assessment requests and Terminal-based fix instructions with extreme suspicion.

Any recruitment communication asking users to execute system commands represents a significant red flag and should be reported immediately to security teams.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Hackers Tricks macOS Users to Execute Command in Terminal to Deliver FlexibleFerret Malware appeared first on Cyber Security News.

A new Malware-as-a-Service (MaaS) threat named “Olymp Loader” appeared in June 2025, aggressively advertised on underground hacker forums like XSS and HackForums.

Advertised by an operator known as “OLYMPO,” this malware is marketed as a sophisticated tool written entirely in Assembly language.

This marketing strategy aims to attract cybercriminals by claiming high performance and resistance to reverse engineering.

The tool functions as a versatile suite, acting as a loader, crypter, and stealer, which significantly lowers the barrier to entry for attackers looking to deploy evasion techniques and complex infection routines.

The malware has quickly gained a reputation for its “Fully UnDetectable” (FUD) status, boasting extremely low detection rates on VirusTotal.

It spreads through social engineering campaigns, often disguised as legitimate software downloads such as PuTTY, Zoom, or Node.js executables hosted on GitHub.

These deceptive vectors trick users into running the malicious code, initiating the infection chain on the victim’s machine.

The use of reputable platforms like GitHub for hosting malicious assets further complicates detection, as network traffic to these sites often appears legitimate to security appliances.

Picus Security’s security analysts identified that Olymp Loader frequently delivers dangerous payloads like LummaC2 and Raccoon Stealer.

They noted the malware’s rapid evolution, specifically its strategic pivot in early August from a botnet architecture to a streamlined dropper model.

This shift demonstrates the developer’s ability to adapt quickly to technical challenges and market demands from the cybercriminal community.

Anti-analysis and Detection Evasion

Following a major restructuring on August 3, 2025, Olymp Loader introduced advanced anti-analysis mechanisms to ensure successful infection.

The malware now embeds encrypted payloads directly into the stub, executing them only after neutralizing local defenses.

A primary component of this evasion strategy is the forcible disabling of Windows Defender. The loader executes specific PowerShell commands to blind real-time monitoring and exclude paths from scanning.

For example, it utilizes the following PowerShell command to achieve this:-

powershell -NoProfile -Command "Set-MpPreference -DisableRealtimeMonitoring $true"

Subsequently, the malware drops executables into the Temp directory and leverages the “Defender Remover” tool.

This process involves using PowerRun.exe to apply registry modifications via files like RemoveDefender.reg and deleting critical system files such as SecurityHealthSystray.exe.

It also targets the WinSxS folder to delete file maps associated with Defender. This aggressive defense nullification ensures that payloads run unhindered by endpoint protection solutions installed on the host.

Tactics continued to shift days later; analysts observed samples from August 10 replacing explicit disabling commands with extensive directory exclusion lists, covering locations like %APPDATA% and %DESKTOP%.

This constant evolution highlights Olymp Loader’s capability to bypass standard security controls effectively and stealthily.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post New Malware-as-a-Service Olymp Loader Advertised on Hacker Forums with It’s Anti-analysis and Detection Features appeared first on Cyber Security News.

The Democratic People’s Republic of Korea (DPRK) has intensified its global cyber operations, systematically violating United Nations Security Council resolutions through large-scale cyberattacks, cryptocurrency theft, and cross-border money laundering schemes.

According to the Multilateral Sanctions Monitoring Team (MSMT) report, North Korean hackers stole at least USD 1.19 billion in cryptocurrency during 2024 and an additional USD 1.65 billion in the first nine months of 2025, bringing the total to approximately USD 2.8 billion.

The DPRK’s cyber capabilities have reached near-superpower levels, with multiple Advanced Persistent Threat (APT) groups executing coordinated attacks across the cryptocurrency industry.

These operations fund the regime’s weapons of mass destruction and ballistic missile programs. The February 2025 breach of Dubai-based Bybit exchange, resulting in the theft of nearly USD 1.5 billion, stands as the largest cryptocurrency theft in history.

Other significant victims include Japan’s DMM Bitcoin and India’s WazirX. SlowMist security analysts identified that DPRK threat actors deploy sophisticated malware through social engineering campaigns disguised as job recruitment processes.

The “Contagious Interview” campaign specifically targets software developers by inviting them to online interviews and instructing them to download malicious software packages.

Upon execution, the BeaverTail malware harvests cryptocurrency wallet credentials and credit card information stored in browsers, while secretly installing the InvisibleFerret backdoor for persistent remote access.

Infection Mechanism and Persistence Tactics

The attack chain demonstrates advanced technical sophistication in establishing foothold within target systems. When victims access fake interview websites, they encounter camera error messages prompting them to download drivers.

Attackers employ the “ClickFix” technique to trick victims into executing malicious commands. On macOS systems, victims download and run a malicious bash script through curl commands, while Windows users receive a ZIP archive containing a VBS script for execution.

The InvisibleFerret backdoor establishes persistent access by embedding itself within legitimate system processes.

This allows attackers to maintain long-term surveillance capabilities and exfiltrate sensitive data without triggering security alerts.

The malware communicates with command-and-control infrastructure using encrypted channels, making network-level detection challenging for security teams.

DPRK IT workers complement these cyber operations by infiltrating companies worldwide through freelance platforms like Upwork, Freelancer, and Fiverr.

These workers use AI-generated synthetic faces and forged documents to bypass identity verification, earning an average monthly salary of USD 10,000 while remitting substantial portions to the regime. The MSMT report confirms IT worker deployments across China, Russia, Laos, and several African nations.

The laundering of stolen cryptocurrency follows a multi-stage process involving token swaps through decentralized exchanges, mixing services like Tornado Cash and Wasabi Wallet, and blockchain bridges before final conversion to fiat currency through over-the-counter brokers.

This systematic approach to sanctions evasion represents an escalating threat to the global financial ecosystem that demands coordinated international response.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post North Korean Hackers Evade UN Sanctions Leveraging Cyber Capabilities, IT Workers and Crypto Activities appeared first on Cyber Security News.