A critical vulnerability in Axis Communications’ Autodesk Revit plugin has exposed Azure Storage Account credentials, creating significant security risks for customers and potentially enabling supply chain attacks targeting the architecture and engineering industry.

The vulnerability stems from hardcoded credentials embedded within signed Dynamic Link Libraries (DLLs) distributed to customers through the plugin’s Microsoft Installer (MSI) package.

The security flaw was discovered in July 2024 when Trend Micro’s VirusTotal rules detected Azure Shared Access Signature (SAS) tokens within a digitally signed DLL named “AzureBlobRestAPI.dll”.

The affected component was issued to AEC Advanced Engineering Computation Aktiebolag, an Autodesk partner specializing in AutoCAD and Revit platform consulting.

This discovery initiated a months-long remediation process involving multiple vulnerability reports and patches.

The exposed credentials provided unauthorized read and write access to three Azure storage accounts belonging to Axis Communications, a Swedish multinational company specializing in network video solutions and surveillance technology.

These accounts contained critical assets including MSI installers for the Axis Plugin for Autodesk Revit and Revit Family Architecture (RFA) files used by customers for building information modeling projects.

The vulnerability’s impact was amplified by the potential for attackers to replace legitimate files with malicious versions, effectively weaponizing the trusted distribution mechanism.

Trend Micro analysts identified additional security concerns beyond the credential exposure. Through their Zero Day Initiative (ZDI) research, they discovered multiple remote code execution vulnerabilities in Autodesk Revit that could be triggered by importing malicious RFA files.

This combination of vulnerabilities created a dangerous attack vector where threat actors could potentially compromise the storage accounts, upload crafted RFA files, and achieve mass compromise of Axis Communications customers using Autodesk Revit software.

The discovery highlights broader supply chain security risks within the architectural and engineering software ecosystem.

The plugin’s design flaws demonstrate how trusted third-party integrations can become attack vectors when proper security controls are not implemented.

Technical Analysis of the Vulnerability

The vulnerability’s technical foundation lies in poor credential management practices within the plugin’s architecture.

Researchers found cleartext Azure SAS tokens and shared access key pairs for two Azure storage accounts named “axisfiles” and “axiscontentfiles” embedded within a private method called “internalSetEnvironment” of the class “AzureBlobRestAPI.DataTypes.Classes.Global”.

The credentials granted extensive privileges including full read, write, delete, list, add, create, update, process, and execute permissions across the storage accounts.

This level of access far exceeded the principle of least privilege, enabling attackers to not only access existing content but also modify distribution mechanisms and upload malicious files.

When Axis Communications initially attempted to remediate the issue with version 25.3.710, they implemented code obfuscation using tools like Eazfuscator.

However, this approach proved inadequate as the obfuscated credentials could be easily de-obfuscated using publicly available tools such as de4dot.

The obfuscation merely provided security through obscurity rather than addressing the fundamental design flaw of embedding credentials in client-side code.

The vulnerability’s persistence was further complicated by the storage accounts containing historical versions of the plugin installers.

Even after implementing read-only SAS tokens in version 25.3.711, researchers discovered that attackers could still access previous plugin versions containing the overly permissive credentials, effectively bypassing the remediation efforts until all historical versions were properly secured.

Axis Communications has confirmed that the vulnerabilities have been fully patched in the current version 25.3.718, with all previously reported issues resolved.

The company has also taken proactive steps to notify affected partners and customers, emphasizing that the Autodesk Revit plugin is provided only to select partners and is generally not accessible for public use.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Axis Communications Vulnerability Exposes Azure Storage Account Credentials appeared first on Cyber Security News.

The cybersecurity landscape witnessed a concerning development as threat actors discovered a novel attack vector targeting Microsoft Edge’s Internet Explorer mode functionality.

This sophisticated campaign emerged in August 2025, exploiting the inherent security weaknesses of legacy browser technology to compromise unsuspecting users’ devices.

The attack represents a significant evolution in threat actor tactics, demonstrating their ability to weaponize seemingly benign compatibility features.

The attack methodology combines social engineering with zero-day exploits targeting Internet Explorer’s Chakra JavaScript engine. Cybercriminals initially direct victims to carefully crafted spoofed websites that appear legitimate, creating a false sense of security.

Once victims arrive at these malicious sites, attackers deploy a strategic flyout notification requesting users to reload the page in Internet Explorer mode, effectively transitioning them from Edge’s secure Chromium-based environment to IE’s vulnerable legacy framework.

This transition proves critical as Internet Explorer lacks the robust security architecture and defense-in-depth mitigations present in modern browsers.

The legacy environment exposes users to risks that contemporary Chromium-based browsers are specifically engineered to prevent, creating an ideal exploitation opportunity for malicious actors.

Microsoft Edge security analysts identified the threat after receiving credible intelligence about active exploitation campaigns.

The research team discovered that attackers were systematically targeting the compatibility feature designed to support legacy business applications, older security camera interfaces, and government portals that still rely on outdated technologies like ActiveX and Flash.

Chakra Engine Exploitation and Privilege Escalation

The attack’s technical sophistication lies in its multi-stage exploitation process targeting the Chakra JavaScript engine.

After successfully convincing victims to switch to Internet Explorer mode, attackers deploy unpatched zero-day exploits specifically crafted for IE’s JavaScript execution environment.

The Chakra engine, despite Microsoft’s previous hardening efforts, remains vulnerable to memory corruption attacks that enable remote code execution.

Following successful code execution within the browser context, threat actors implement a second exploit designed for privilege escalation.

This secondary payload allows attackers to break out of the browser’s sandboxed environment, gaining elevated system privileges and full device control.

The dual-exploit approach ensures comprehensive system compromise, enabling malware installation, lateral movement within corporate networks, and sensitive data exfiltration.

Microsoft responded by restricting IE mode access, removing high-risk entry points including toolbar buttons and context menus while maintaining enterprise policy support for legitimate business needs.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Hackers Leveraging Microsoft Edge Internet Explorer Mode to Gain Access to Users’ Devices appeared first on Cyber Security News.

North Korean state-sponsored threat actors have intensified their supply chain attacks against software developers through a sophisticated campaign dubbed “Contagious Interview,” deploying 338 malicious npm packages that have accumulated over 50,000 downloads.

The operation represents a dramatic escalation in the weaponization of the npm registry, targeting Web3, cryptocurrency, and blockchain developers through elaborate social engineering schemes disguised as legitimate job recruitment processes.

The campaign operates on a multi-stage attack framework that begins with reconnaissance on professional platforms like LinkedIn.

Threat actors pose as recruiters or hiring managers, screening potential victims for technical expertise and financial opportunity.

They specifically target developers working with cryptocurrency wallets, blockchain infrastructure, and Web3 applications, seeking to compromise systems likely to contain valuable credentials, private keys, and monetizable secrets.

Socket.dev analysts identified the malware following reports from victims who received fraudulent job opportunities that included coding assignments containing malicious dependencies.

The researchers discovered that threat actors have evolved their tooling from direct BeaverTail malware droppers to more sophisticated HexEval, XORIndex, and encrypted loaders that execute during package installation or import processes.

The malicious packages employ typosquatting techniques targeting everyday dependencies that developers install routinely, particularly in Node.js environments.

Examples include variations of popular packages such as epxreso/epxresso/epxressoo (Express), dotevn (dotenv), and boby_parser (body-parser).

This strategy exploits the deadline pressure common in technical interviews where candidates execute “npm install” commands without thorough scrutiny.

Advanced Encryption and Persistence Mechanisms

The latest wave introduces encrypted loaders that demonstrate a significant evolution in the attackers’ technical capabilities.

These loaders utilize Node.js crypto functions with hardcoded AES-256-CBC encryption keys and initialization vectors, storing encrypted payloads in seemingly innocuous files like LICENSE documents.

The malware reconstructs obfuscated BeaverTail malware in memory before typically fetching the InvisibleFerret backdoor for persistent system access.

The encrypted loader implementation splits decryption logic across multiple files within the same package.

Analysis of the redux-saga-sentinel package reveals how the loader imports Node crypto in lib/utils/smtp-connection/parse.js while storing the encrypted payload in the LICENSE file.

During runtime, the loader decrypts the hex ciphertext to recover stage-two JavaScript code, which maintains obfuscation to evade static analysis detection.

This technique enables in-memory execution while avoiding disk-based artifacts that traditional security tools might detect.

The recovered payload establishes command and control communication over HTTP/HTTPS protocols, often using legitimate hosting platforms like Vercel to blend into normal developer traffic patterns, making detection significantly more challenging for security teams monitoring network communications.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post North Korean Hackers Attacking Developers with 338 Malicious npm Packages appeared first on Cyber Security News.