1010.cx

  • Hackers Using New Matrix Push C2 to Deliver Malware and Phishing Attacks via Web Browser

    ·

    , ,

    A new command-and-control platform called Matrix Push C2 has emerged as a serious threat to web users across all operating systems.

    This browser-based attack framework turns legitimate web browser features into a weapon for delivering malware and phishing attacks.

    Unlike traditional malware that requires file downloads, Matrix Push C2 operates silently through a fileless attack method, making it harder to detect and stop.

    The platform exploits web push notifications, a standard feature in modern browsers, to establish direct communication channels with infected devices.

    Attackers use this connection to deliver fake system alerts, redirect users to malicious websites, monitor victim activity in real time, and even scan for cryptocurrency wallets.

    The beauty of this attack from the cybercriminal’s perspective is that it bypasses many traditional security tools because it appears to come from the browser itself rather than external malware.

    Blackfog security analysts identified the malware’s sophisticated approach to victim targeting and engagement.

    The Matrix Push C2 dashboard provides attackers with detailed analytics showing infected browsers, notification delivery rates, and user interaction data.

    Matrix Push C2 campaign dashboard (Source - Blackfog)
    Matrix Push C2 campaign dashboard (Source – Blackfog)

    With just three test clients, the researchers observed a 100 percent delivery success rate, demonstrating how effective this attack vector could be at scale.

    How the Infection Mechanism Works

    The attack begins with social engineering. Attackers trick users into allowing browser notifications through malicious or compromised websites.

    Once a user subscribes to these notifications, the attacker gains a direct communication line to the victim’s desktop or mobile device.

    From that point forward, the attacker can push out convincing fake error messages and security alerts that look like they come from trusted companies or the operating system itself.

    When users click these deceptive notifications, they are redirected to attacker-controlled websites hosting phishing pages or malware downloads.

    For example, a fake notification might display “Update required! Please update Google Chrome to avoid data loss!” and direct users to download trojanized software.

    The entire attack happens through the browser’s notification system without requiring traditional malware installation.

    Cloudflare-style phishing notification example (Source - Blackfog)
    Cloudflare-style phishing notification example (Source – Blackfog)

    What makes Matrix Push C2 particularly dangerous is its use of brand-themed phishing templates. The platform includes pre-built templates mimicking PayPal, Netflix, Cloudflare, MetaMask, and other trusted services.

    Attackers can customize these templates to match official designs perfectly, exploiting user trust in recognized brands.

    Real-time monitoring capabilities allow attackers to track which notifications were delivered, which users clicked them, and gather valuable device information, creating a complete attack orchestration platform.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post Hackers Using New Matrix Push C2 to Deliver Malware and Phishing Attacks via Web Browser appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Operation DreamJob Attacking Manufacturing Industries Using Job-related WhatsApp Web Message

    ·

    , ,

    In August 2025, a sophisticated cyber attack targeted an Asian subsidiary of a large European manufacturing organization through a deceptive job offer scheme.

    The intrusion campaign, identified as Operation DreamJob, demonstrates how threat actors continue to refine social engineering techniques to compromise high-value targets within the manufacturing sector.

    This attack specifically exploited WhatsApp Web messaging to deliver malicious payloads disguised as legitimate employment opportunities.

    The attack began when a project engineer received a targeted WhatsApp Web message containing what appeared to be a job-related document.

    The message encouraged the recipient to download and extract a ZIP archive, which contained three components: a malicious PDF file, a legitimate open-source document viewer called SumatraPDF.exe, and a malicious DLL file named libmupdf.dll.

    This combination weaponized a trusted application through DLL sideloading, where the legitimate executable unknowingly loaded the malicious library.

    Orange Cyberdefense security analysts investigated the incident and attributed the attack with medium confidence to the North Korean UNC2970 threat cluster.

    Their analysis revealed that the intrusion leveraged sophisticated malware variants, specifically BURNBOOK and MISTPEN, alongside compromised SharePoint and WordPress infrastructure for command and control operations.

    The threat actors maintained persistent access for at least six consecutive hours, conducting hands-on keyboard activities throughout the compromise.

    When the victim opened the PDF document, the SumatraPDF executable sideloaded the malicious libmupdf.dll file, which researchers confirmed as a recent BURNBOOK loader variant.

    This backdoor enabled the attackers to establish initial access and begin reconnaissance activities within the network.

    Advanced Persistence and Lateral Movement Mechanisms

    Following successful infiltration, the threat actors deployed multiple techniques to expand their foothold across the manufacturing network.

    Partial description of the infection chain (Source - Orange Cyberdefense)
    Partial description of the infection chain (Source – Orange Cyberdefense)

    The attackers performed extensive LDAP queries against Active Directory to enumerate users and computers within the domain, gathering intelligence for lateral movement operations.

    They subsequently compromised both backup and administrative accounts using pass-the-hash techniques, which allowed authentication without requiring plaintext passwords.

    This method involved extracting NTLM password hashes and reusing them for network authentication. The attackers then deployed an additional payload called TSVIPsrv.dll, identified as a MISTPEN backdoor variant.

    This malware decrypted and executed wordpad.dll.mui directly in memory, establishing connections to compromised SharePoint servers for command and control communications.

    The final stage involved deploying Release_PvPlugin_x64.dll, which functioned as an information-stealing module designed to exfiltrate sensitive data from infected systems.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post Operation DreamJob Attacking Manufacturing Industries Using Job-related WhatsApp Web Message appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The D Brief: US presses Kyiv; DepSecDef gets oversight of top USAF programs; Report: JAG warned against boat strikes; Coast Guard scuttles swastika change; And a bit more.

    ·

    With President Trump’s Army secretary in Ukraine, the U.S. has threatened to cut intelligence and weapons support to pressure Kyiv into accepting the White House’s latest and reportedly lopsided attempt to stop the Ukrainian effort to expel Russia’s invasion force, Reuters reported in a short update Friday. Officials familiar with the matter said the U.S. delegation wants Ukraine to agree to the new terms by next Thursday, which of course is Thanksgiving here stateside.  

    Why apply such pressure? Kyiv has previously rejected many of the conditions of the Russia-friendly deal. (Here’s a list.) The Wall Street Journal echoes that message with a report Friday teasing for their readers, “The leaked proposal reveals Ukraine would have to cede territory, while Russia would receive incentives.” 

    Read the text of the Trump administration’s 28-point plan via Reuters, which was one of several outlets to get their hands on the draft document Thursday. 

    Analyst reax: There is very little chance this deal goes through because Ukraine is highly unlikely to agree to it, according to Byron Callan of Capital Alpha Partners. Moreover, he argued Thursday, it’s such a bad deal that it will push Ukraine to rely less on Washington and more on Europe, further reducing the chance that Trump can accelerate an end to the conflict.

    Second opinion: If reports of the 28-point text are true, the “plan amount[s] to Ukraine’s full capitulation to Russia’s original war demands,” a half-dozen analysts at the Institute for the Study of War warned atop their latest battlefield assessment. 

    “There are no provisions in the reported peace plan in which Russia makes any concessions, and ISW continues to assess that accepting Russian demands would set conditions for renewed Russian aggression against Ukraine,” the analysts add. 

    Bigger picture: “The Kremlin continues to use a combination of economic incentives and nuclear saber-rattling to extract concessions from the United States to normalize US-Russian relations without making reciprocal concessions to end the war,” ISW writes. 

    View detailed maps of presumed and contested territorial control across eastern Ukraine in ISW’s full report, here. 

    Welcome to this Friday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson and Bradley Peniston. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1986, National Security Council member Oliver North and his secretary Fawn Hall began shredding documents allegedly implicating them in what would later be known as the Iran–Contra affair.

    Around the Defense Department

    Most of the Air Force’s biggest programs will now be overseen by a 4-star under the deputy defense secretary. It’s a stunning turn of events for the service, and one seemingly at odds with Secretary Pete Hegseth’s declaration that the services should have more autonomy in acquisition, not less.

    The news emerged on Tuesday when the White House nominated Air Force Lt. Gen. Dale White to become the first Direct Reporting Portfolio Manager for Critical Major Weapons Systems, which the Air Force says include the Sentinel and Minuteman III intercontinental ballistic missiles, the B-21 bomber, the F-47 fighter jet, and the VC-25B presidential aircraft. If confirmed, White will be promoted to full general and report directly to Deputy Defense Secretary Steve Feinberg.

    Air Force spox: we’re cool with that: “By directing the execution of critical Air Force programs, this DRPM role will help streamline the acquisition process, enabling faster decision-making and expediting the delivery of major systems.”

    Outside reax: “I think the purpose is they want to centralize control of key programs or problem programs,” said Todd Harrison of the American Enterprise Institute. “But it is fundamentally at tension with some of the acquisition reforms that they're pushing, which talk about delegating down, pushing down the decision-making authority to lower levels. This is going in the exact opposite direction.” Defense One’s Thomas Novelly has more, here.

    Developing: Golden Dome is facing setbacks of its own. “President Donald Trump's Golden Dome missile defense initiative is facing significant delays, hampered by the 43-day government shutdown and lack of a clear plan to spend the first $25 billion appropriated for the program this summer, eight sources familiar with the situation told Reuters.” Read that, here.

    Update: Judge orders an end to the National Guard deployment to DC. On Thursday, U.S. District Judge Jia Cobb ruled that “while the president does have authority to protect federal functioning and property, he can’t unilaterally deploy the D.C. National Guard to help with crime control as he sees fit or call in troops from other states.” But Cobb also put her order on hold for 21 days to allow for an appeal. Associated Press: “Dozens of states took sides in Schwalb’s lawsuit, with their support falling along party lines.”

    Reuters adds: “Trial courts have ruled against the troop deployments in every city where local leaders protested their presence, although an appeals court has blocked one of those rulings and allowed troops to remain in Los Angeles.” Read on, here.

    U.S. contractors crossed into northeastern Mexico and put up signs on a beach claiming land for the Defense Department on Monday, CBS 4 News Rio Grande Valley reported this week with a photo of the signs, which were put up close to a SpaceX base outside of Brownsville, Texas. 

    That evening, the Mexican navy removed the signs, noting in a statement that their origin and “placement on national territory were unclear,” according to the Foreign Ministry. “The Ministries of the Navy and Foreign Affairs reaffirm their commitment to work with U.S. authorities and all relevant national agencies to ensure legal certainty at the shared border and strengthen the cooperation that defines the relationship between both countries,” they added. 

    So what happened, and why? Pentagon officials seem to have claimed they thought the border had moved. “Changes in water depth and topography altered the perception of the international boundary's location,” according to a statement from the Pentagon shared with CBS News by the U.S. Embassy in Mexico. “Government of Mexico personnel removed 6 signs based on their perception of the international boundary's location,” the Pentagon said, and added that its contractors will “coordinate with appropriate agencies to avoid confusion in the future.”

    For what it’s worth: This is all happening “exactly where the first battles of the US-Mexico War (1846-48) were fought. In fact, Brownsville was named after Major Jacob Brown, who Mexican soldiers killed during the US invasion of northern Mexico,” said Columbia University history professor Karl Jacoby.

    Developing: The top military lawyer at Southern Command believes U.S. military strikes on alleged drug-smuggling boats near Venezuela are illegal, but “his views were sidelined, according to six sources with knowledge of the legal advice raised legal concerns about boat strikes,” NBC News reported Wednesday. 

    He raised those concerns in August, but: “His opinion was ultimately overruled by more senior government officials, including officials at the Justice Department’s Office of Legal Counsel,” Gordon Lubold, Courtney Kube and Dan De Luce reported for NBC Wednesday evening. 

    Why bring it up? “Since Sept. 2, it says, the administration has killed 82 people in 21 strikes on small vessels it says were transporting drugs bound for the United States,” NBC reports—noting, however, that “Administration officials have not put forward any specific evidence backing up their claims.” Continue reading, here. 

    Related: Virginia Democratic Sen. Tim Kaine warned Thursday the White House “is weighing land strikes in Venezuela and amassing an enormous number of military assets in the region, [and so] it’s long past time for Congress to finally get substantive and complete answers to the questions Democratic and Republican lawmakers have been asking for months” regarding its 21 boat strikes. 

    “The American people have no interest in stumbling into an illegal new war that would place the lives of our servicemembers at risk,” Kaine said in a statement Thursday. 

    Dispatch from Venezuela: “Perhaps it’s the mountain that stands in the way of the American military swarm, or maybe it’s their feeling that there’s so little to be done about it, but caraqueños are, for now, going about their normal business,” Phil Gunson of the International Crisis Group wrote for the New York Times Friday from Caracas. “If the traffic is less snarled than it once was, if the restaurants aren’t as full, it has less to do with the specter of war than with Venezuela’s hyperinflation and a repressive security apparatus. Even down at the coast, the American military menace is treated mostly with typical Venezuelan ribaldry, rather than dread. ‘Have you heard?’ people ask each other, jokingly. ‘The Marines have arrived!’”

    Additional reading: “U.S. Ran a War Game on Ousting Maduro. Venezuela Fell Into Chaos,” the Times reported Thursday, citing an exercise from Trump’s first term. 

    See also, “The Web of Venezuelan Generals Accused of Fueling the Cocaine Trade,” via the Wall Street Journal, reporting Friday. 

    ICYMI: Trump on Thursday said telling U.S. troops to refuse illegal orders is “seditious behavior” punishable by death. We noted that one in Thursday’s newsletter; but if you missed it, the States Newsroom has more. 

    Reaction: Former CIA agent Sen. Elissa Slotkin, D-Mich., and former Army Ranger Rep. Jason Crow, D.-Wisc., responded with a message for their fellow American citizens on Thursday. “This really isn’t about those of us who made the video” Trump reacted to, Slotkin said Thursday. “This is about who we are as Americans and how we’re gonna engage with people who we disagree with. I would hope that people of all backgrounds—Democrat, Republican, independent—would agree that threatening death for people you disagree with is beyond the pale of who we are as Americans.” 

    Crow: “It’s very telling that President Trump and those around him think it’s criminal simply for asking people to follow the law. This moment requires moral clarity,” he said. “Every American, regardless of your background, should unite and reject his calls for political violence.” 

    By the way: On the same day Trump alleged seditious behavior, a Trump-appointed judge warned (PDF), “This Court has grave concerns about the government’s apparent willingness to disregard this Court’s orders, even after previous admonition …” That case involved the illegal deportation of a Venezuelan man to El Salvador; that man is now missing. (h/t Aaron Blake of CNN)

    Trump 2.0

    Coast Guard quickly scuttles new hate-symbol policy. Thursday afternoon: “U.S. Coast Guard will no longer classify swastikas, nooses as hate symbols,” Tara Copp and Michelle Boorstein reported for the Washington Post. “The military service, which falls under the Department of Homeland Security, has drafted a new policy that classifies such items ‘potentially divisive.’”

    The White House and Department of Homeland Security falsely said that the Post’s reporting was inaccurate. “Fake crap,” said DHS spokeswoman Tricia McLaughlin. 

    But WaPo had the receipts, in the form of a November memo and an earlier Coast Guard document.  

    So later on Thursday, the Coast Guard’s acting commandant released a new memo averring that the Nazi emblem and the instrument of lynching were, in fact, symbols of hate. Adm. Kevin Lunday “is up for confirmation to become the Coast Guard’s commandant. His confirmation hearing was Wednesday and he spent Thursday meeting with lawmakers to secure their support,” the Post wrote.

    “We don’t deserve the trust of the nation if we’re unclear about the divisiveness of swastikas,” a U.S. official said, speaking on the condition of anonymity due to a fear of reprisal. Read more, here.

    Reminder: One of the most dangerous recent extremists in the U.S. military was a Coast Guard lieutenant whom the Justice Department at the end of Trump’s first term said planned terrorist attacks on Democrats and Supreme Court justices and was “inspired by racist murderers, stockpiled assault weapons, studied violence, and intended to exact retribution on minorities and those he considered traitors.”

    Meanwhile in Chicago, after Customs and Border Protection agents shot an unarmed woman five times and then arrested her on claims that she rammed them with her car and brandished a gun, prosecutors this week asked to dismiss all criminal charges against her and her co-defendant. 

    “The decision to drop the case was a dramatic reversal, and it comes amid questions about the actions of one of the agents involved in the encounter,” ABC7 Chicago reported after the dismissal Thursday. The injured woman’s lawyer told ABC, “[T]he reason this is dismissed is because the facts in those [Justice Department and DHS] press releases were not true. This case was going to be a winner at trial regardless. These agents are in reports saying things that just are not true. So when you read the next press release, I mean, consider that.”

    It’s also far from the only case where DHS/CBP agents have recently misled the courts. For the first time in Trump’s “Midway Blitz” immigration crackdown, a judge reviewed body cam video from DHS agents in Chicago, and found those agents made numerous allegations that were disproven by their own videos. Aaron Reichlin-Melnick of the American Immigration Council combed through the judge’s response to find at least nine glaring instances of DHS agents misleading the court regarding alleged assault by demonstrators in Chicago. 

    That includes several instances from top agent Gregory Bovino. The Chicago Tribune’s Gregory Pratt has more from the judge’s report Thursday, here.  

    Additional reading: 

    Lastly this week: Former Marine Corps Commandant Robert Neller and futurist Peter Singer teamed up to mark the 250th-birthday years of the U.S. Army and Marine Corps with an encomium to their ability to adapt—and some thoughts on what needs changing now. Watch that on YouTube, here.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Chinese Hackers Exploiting WSUS Remote Code Execution Vulnerability to Deploy ShadowPad Malware

    ·

    , ,

    Chinese-backed attackers have begun weaponizing a critical vulnerability in Microsoft Windows Server Update Services (WSUS) to distribute ShadowPad, a sophisticated backdoor malware linked to multiple state-sponsored groups.

    The attack chain exploits CVE-2025-59287, a remote code execution flaw that grants system-level access to vulnerable servers.

    Since the proof-of-concept code was released publicly in October, threat actors have rapidly adopted this vulnerability to compromise enterprise networks running WSUS infrastructure.

    The attack begins when hackers target Windows Servers with WSUS enabled, leveraging CVE-2025-59287 to gain initial system access.

    Once inside, attackers deploy PowerCat, an open-source PowerShell-based utility that provides direct command shell access to the compromised system.

    This first-stage foothold allows attackers to execute subsequent commands needed for malware deployment.

    ASEC security analysts identified the malware after observing PowerCat execution commands being used in attacks.

    The researchers documented how threat actors then download and install ShadowPad using legitimate Windows utilities like certutil and curl. This technique helps evade detection because these tools are standard components of Windows systems.

    On November 6th, ASEC’s infrastructure detected attackers downloading multiple encoded files before decoding and executing them as the ShadowPad payload.

    Persistence Through DLL Sideloading

    ShadowPad operates through a clever evasion technique called DLL sideloading. Rather than running as a standalone executable, the malware uses a legitimate Windows application (ETDCtrlHelper.exe) that loads a malicious DLL (ETDApix.dll) with the same name.

    When the legitimate program runs, it unknowingly loads the compromised library, which acts as a loader for the actual ShadowPad backdoor operating entirely in memory.

    The core malware functionality is stored in a temporary file containing complete backdoor configuration data.

    The malware establishes persistence by creating services, registry entries, and scheduled tasks with the identifier “Q-X64.” It communicates with command-and-control servers at 163.61.102[.]245 using HTTP and HTTPS protocols while disguising traffic with standard Firefox browser headers.

    The malware can inject itself into multiple system processes, including Windows Mail, Media Player, and svchost services.

    Organizations running WSUS should immediately apply Microsoft’s security update for CVE-2025-59287 and monitor server logs for suspicious PowerShell, certutil, and curl execution patterns to detect potential compromise attempts.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post Chinese Hackers Exploiting WSUS Remote Code Execution Vulnerability to Deploy ShadowPad Malware appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Grafana Patches CVSS 10.0 SCIM Flaw Enabling Impersonation and Privilege Escalation

    ·

    Grafana has released security updates to address a maximum severity security flaw that could allow privilege escalation or user impersonation under certain configurations. The vulnerability, tracked as CVE-2025-41115, carries a CVSS score of 10.0. It resides in the System for Cross-domain Identity Management (SCIM) component that allows automated user provisioning and management. First

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Ransomware Actors Primarily Targeting Retailers This Holiday Season to Deploy Malicious Payloads

    ·

    , ,

    Retailers are facing a sharp rise in targeted ransomware activity as the holiday shopping season begins. Threat groups are timing their attacks to peak sales periods, when downtime is most painful and the pressure to pay is highest.

    This campaign focuses on point-of-sale networks, e‑commerce backends, and supporting IT systems that handle orders, loyalty data, and payment workflows.

    Attackers are using a mix of phishing emails, fake shipping updates, and malicious ads that redirect users to exploit kits.

    Once a victim clicks, the chain moves quickly from initial foothold to full domain compromise. The goal is to deploy file‑encrypting payloads and data exfiltration tools in a single, coordinated run, often within a few hours of initial access.

    Morphisec security analysts identified the malware as part of a multi‑stage toolkit designed for stealthy entry, credential theft, and rapid lateral movement in retail environments.

    Their telemetry shows that threat actors tune the loaders and scripts to blend with typical helpdesk and remote support tools used by store and warehouse staff.

    The impact is severe: encrypted inventory systems, locked payment terminals, and inaccessible online order platforms can halt both in‑store and digital sales.

    Many victims also face data theft, including customer records and internal pricing or promotion plans, which raises the risk of double extortion and regulatory fines.

    This shows the full attack chain from phishing email to ransomware execution in a typical retail network.

    Infection Mechanism and Payload Delivery

    The campaign relies on a lightweight loader that first lands through a malicious attachment or script download.

    This loader injects into trusted processes like explorer.exe or powershell.exe to evade simple process‑based rules.

    It then pulls the main payload from an attacker‑controlled server over HTTPS, using domain names that mimic common cloud and CDN providers.

    Once the payload is staged, the malware harvests credentials from LSASS and cached browser sessions, then uses remote management tools and SMB shares to copy itself across store servers and point‑of‑sale systems.

    To make detection harder, it launches key actions through obfuscated PowerShell commands such as:-

    powershell.exe -w hidden -enc <base64_payload> -ExecutionPolicy Bypass

    The malware moves across store networks, using existing admin paths to reach payment and inventory servers before triggering the final ransomware component.

    This shift toward preemptive defense transforms the security equation, protecting customer data, operational continuity, and the bottom line before threats can take hold.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post Ransomware Actors Primarily Targeting Retailers This Holiday Season to Deploy Malicious Payloads appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Critical Azure Bastion Vulnerability Lets Attackers Bypass Login and Gain Higher Privileges

    ·

    , ,

    Microsoft disclosed a critical authentication bypass vulnerability in Azure Bastion, its managed remote access service, enabling attackers to escalate privileges to administrative levels with a single network request. The vulnerability, designated CVE-2025-49752, affects all Azure Bastion deployments and received an emergency security patch on November 20, 2025. Attribute Details CVE ID CVE-2025-49752 Vulnerability Type Authentication […]

    The post Critical Azure Bastion Vulnerability Lets Attackers Bypass Login and Gain Higher Privileges appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Google Brings AirDrop Compatibility to Android’s Quick Share Using Rust-Hardened Security

    ·

    In a surprise move, Google on Thursday announced that it has updated Quick Share, its peer-to-peer file transfer service, to work with Apple’s equipment AirDrop, allowing users to more easily share files and photos between Android and iPhone devices. The cross-platform sharing feature is currently limited to the Pixel 10 lineup and works with iPhone, iPad, and macOS devices, with plans to expand

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Xillen Stealer: Advanced Features Bypass AI Detection and Steal Password Manager Data

    ·

    , ,

    The Python-based information-stealing tool Xillen Stealer has reached versions 4 and 5, significantly expanding its targeting capabilities and functionality across platforms. Documented initially by Cyfirma in September 2025, this cross-platform infostealer targets sensitive data, including credentials, cryptocurrency wallets, system information, and browser data, while employing sophisticated anti-analysis techniques to evade detection. The latest updates introduce […]

    The post Xillen Stealer: Advanced Features Bypass AI Detection and Steal Password Manager Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • AI-Driven Obfuscated Malicious Apps Bypassing Antivirus Detection to Deliver Malicious Payloads

    ·

    , ,

    Cybersecurity researchers have identified a sophisticated malware campaign leveraging artificial intelligence to enhance obfuscation techniques, enabling malicious applications to circumvent traditional antivirus detection systems. The threat actors behind the campaign are distributing trojanized applications impersonating a prominent Korean delivery service, employing a multi-layered approach to evade security controls and maintain persistent command-and-control (C2) infrastructure. The […]

    The post AI-Driven Obfuscated Malicious Apps Bypassing Antivirus Detection to Deliver Malicious Payloads appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶