Authentication coercion represents a sophisticated and evolving threat targeting Windows and Active Directory environments across organizations globally.

This attack method exploits the fundamental communication mechanisms embedded within every Windows operating system, manipulating machines into automatically transmitting sensitive credentials to attacker-controlled infrastructure.

The emergence of this threat vector reflects a significant shift in how threat actors adapt their strategies to bypass increasingly sophisticated defense mechanisms.

The attack’s sophistication lies in its ability to leverage legitimate Windows functionality against itself. Attackers establish malicious listeners designed to appear as trusted resources within an organization’s network.

When a compromised or targeted machine attempts to connect to what it believes is a legitimate server, it automatically sends hashed credentials to the attacker.

This process occurs through Remote Procedure Call (RPC) functions, which serve as the backbone for inter-process communication across Windows and Active Directory infrastructure.

The attack requires no special permissions, making it accessible to threat actors operating with minimal technical expertise once proof-of-concept tools become available.

Recent threat intelligence indicates this attack method poses significant risks due to its widespread exploitation capabilities.

Palo Alto Networks security analysts identified authentication coercion techniques being weaponized through rare and lesser-known RPC protocols, allowing attackers to evade traditional detection mechanisms.

The security researchers noted this represents a concerning trend where threat actors deliberately misuse obscure RPC functions to avoid triggering conventional monitoring alerts.

The technical mechanics of authentication coercion center on RPC message protocols and their parameter handling.

Remote Procedure Call functions are designed for both local and remote system communication, with many accepting Universal Naming Convention (UNC) paths as parameters.

When attackers craft malicious RPC requests containing attacker-controlled UNC paths, the targeted machine’s automatic authentication behavior becomes weaponized.

For instance, the ElfrOpenBELW function within the MS-EVEN EventLog Remoting Protocol can be exploited in this manner, though this particular interface rarely appears in normal organizational network traffic.

Authentication coercion mechanisms

A detailed analysis of authentication coercion mechanisms reveals multiple exploitation vectors through different protocols.

The MS-RPRN Print System Remote Protocol, MS-EFSR Encrypting File System Remote Protocol, MS-DFSNM Distributed File System Namespace Management Protocol, and MS-FSRVP File Server Remote VSS Protocol all present exploitable opnums that threat actors leverage.

Well-documented tools including PrinterBug, PrintNightmare, PetitPotam, DFSCoerce, and ShadowCoerce demonstrate how readily available exploit frameworks simplify execution of these attacks.

The impact of successful authentication coercion extends far beyond simple credential theft. Organizations face complete domain compromise scenarios where attackers steal NTLM hashes of critical infrastructure including Domain Controllers and Certificate Authority servers.

These credentials enable lateral movement, privilege escalation through DCSync attacks, and establishment of persistent access mechanisms.

In documented incidents, threat actors have executed NTLM relay attacks leveraging stolen machine account hashes against certificate authorities, creating pathways for long-term persistence and sensitive data exfiltration.

Organizations must implement robust detection strategies focusing on anomalous RPC traffic patterns, including unusual source-destination combinations, suspicious UNC path parameters, and calls targeting rarely-used interfaces.

Critical preventive measures include enforcing SMB signing across domains, disabling unused RPC services on critical assets, implementing Extended Protection for Authentication, and utilizing Windows RPC filters through netsh utilities.

Modern endpoint detection and response platforms provide behavioral analysis capabilities essential for identifying these subtle attack patterns before successful credential harvesting occurs.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Authentication Coercion Attack Tricks Windows Machines into Revealing Credentials to Attack-controlled Servers appeared first on Cyber Security News.

A newly identified Android remote access trojan (RAT) dubbed KomeX has surfaced on underground hacker forums, generating widespread concern within the cybersecurity community.

Marketed by a threat actor under the alias “Gendirector,” KomeX is built atop the infamous BTMOB RAT codebase and presents a formidable arsenal of spying and device control features.

Recognized for its sophistication, KomeX is designed to compromise Android devices en masse, making it an enticing tool for cybercriminals seeking to monetize mobile infections.

The malware’s distribution tactics rely heavily on malicious Android apps pushed via unofficial marketplace sources and phishing campaigns.

Victims are typically enticed to install tampered applications or unwittingly click on convincing social engineering lures.

What sets KomeX apart is its aggressive approach to obtaining device permissions almost immediately after installation, drastically expanding its reach and resilience once embedded in a target system.

KrakenLabs security analysts were instrumental in identifying and dissecting KomeX after its forum debut.

Their analysis revealed the trojan’s ability to bypass Google Play Protect, stripping Android devices of a fundamental protective barrier against malware.

Among its notable capabilities are high-fidelity live screen streaming, stealth audio and video capture via camera and microphone, instant access to SMS interception and manipulation, live geolocation tracking, remote control of all major apps, and full filesystem access layered with a covert keylogger.

The RAT is sold with tiered pricing: short-term access, lifetime updates, or full source code for criminal syndicates seeking custom modifications.

Infection Mechanism

Technically, KomeX maximizes its control by automatically requesting and securing invasive permissions through its AndroidManifest.xml configuration:-

<uses-permission android:name="android.permission.SYSTEM_ALERT_WINDOW"/>
<uses-permission android:name="android.permission.READ_SMS"/>
<uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED"/>

Upon installation, KomeX abuses accessibility features to silently grant these permissions, enabling deep integration and persistent access.

To resist removal, KomeX employs a fake uninstall module — simulating app deletion but secretly continuing operations in the background.

Its infection lifecycle includes initial delivery, privilege escalation, secret data exfiltration, and durable anti-removal tactics, showcasing a complete, professional malware engineering approach.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post New KomeX Android RAT Advertised on Hacker Forums with Multiple Subscription Options appeared first on Cyber Security News.

A large-scale phishing campaign has emerged, exploiting Meta’s Business Suite to compromise credentials across thousands of small and medium-sized businesses worldwide.

Check Point security researchers identified approximately 40,000 phishing emails distributed to more than 5,000 customers, primarily targeting industries including automotive, education, real estate, hospitality, and finance across the U.S., Europe, Canada, and Australia.

The sophisticated attack leverages legitimate Meta infrastructure, making detection substantially more difficult than traditional phishing attempts.

The campaign demonstrates a troubling evolution in threat tactics. Rather than relying on spoofed domains and fake infrastructure, attackers have weaponized Meta’s native Business invitation feature to establish credibility.

This approach exploits user trust in established platforms and circumvents conventional email security filters that typically flag suspicious sender addresses.

By originating from the legitimate facebookmail.com domain, these messages appear authentic and indistinguishable from genuine Meta notifications.

Check Point security analysts identified the campaign after observing repetitive patterns in email subjects and structure consistent with template-driven mass distribution.

New Phishing Attack

The attackers created fraudulent Facebook Business pages adorned with official Meta branding and logos, then deployed these fake pages to send Business Portfolio invitations containing embedded malicious links.

Recipients were redirected to credential harvesting pages hosted on domains such as vercel.app, where sensitive information was extracted and intercepted.

The infection mechanism relies on social engineering and domain trust exploitation. Emails utilized urgent language such as “Action Required,” “You’re Invited to Join the Free Advertising Credit Program,” and “Account Verification Required,” compelling users to click embedded links.

The messages perfectly mimicked legitimate Meta notifications, including proper formatting and branding elements.

Once victims clicked the links, they were redirected to phishing websites designed specifically to capture login credentials and other sensitive account information.

Organizations should implement multi-factor authentication to prevent unauthorized access even when credentials are compromised.

Additionally, employees must receive training emphasizing credential verification and cautious link evaluation, regardless of sender legitimacy.

Advanced email security solutions incorporating behavioral analysis and artificial intelligence-driven detection provide enhanced protection against this evolving threat landscape.

Direct navigation to official Meta accounts rather than clicking email links represents another crucial defensive measure against these sophisticated credential theft attempts.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post New Phishing Attack Targeting Meta Business Suite Users to Steal Login Credentials appeared first on Cyber Security News.