1010.cx

  • Iran-Nexus Hackers Abuses Omani Mailbox to Target Global Governments

    ·

    , ,

    A sophisticated spear-phishing campaign orchestrated by Iranian-aligned operators has been identified targeting diplomatic missions worldwide through a compromised Ministry of Foreign Affairs of Oman mailbox.

    The attack, discovered in August 2025, represents a continuation of tactics associated with the Homeland Justice group connected to Iran’s Ministry of Intelligence and Security (MOIS).

    The campaign leveraged social engineering techniques to distribute malicious Microsoft Word documents masquerading as urgent diplomatic communications.

    Attackers sent emails from a compromised @fm.gov.om address, routing traffic through a NordVPN exit node in Jordan (212.32.83.11) to obscure their true origin.

    Recipients across 270 email addresses spanning embassies, consulates, and international organizations in multiple regions received documents with subjects referencing “The Future of the region after the Iran-Israel war and the role of Arab countries in the Middle East”.

    The Iran-Nexus Spear phishing Campaign attack path (Source – Dreamgroup)

    Dreamgroup analysts identified that the campaign extended far beyond initial assessments, with 104 unique compromised addresses utilized to mask the operation’s true scope.

    The malware embedded within attached Word documents employed sophisticated encoding techniques, converting numerical sequences into ASCII characters through VBA macro code execution.

    Attack Mechanism

    The technical sophistication of the attack becomes apparent when examining its execution mechanism.

    The malicious documents contained VBA macros hidden within “This Document” and “UserForm1” modules, implementing a multi-stage payload delivery system.

    Campaign VBA Macro Execution Chain (Source – Dreamgroup)

    The primary decoder function, designated as “dddd,” systematically processes encoded strings by reading three-digit segments and converting them to ASCII characters using the formula Chr (Val (Mid (str, counter, 3))).

    A particularly noteworthy evasion technique involves the “laylay” function, which creates artificial delays through four nested loops executing 105 iterations each.

    This anti-analysis routine significantly hampers dynamic analysis tools and automated sandbox detection systems.

    The malware writes its payload to C:\Users\Public\Documents\ManagerProc[.]log, disguising the executable as a harmless log file before execution via the Shell command with vbHide parameters.

    Upon successful deployment, the sysProcUpdate executable establishes persistence by copying itself to C:\ProgramData\sysProcUpdate[.]exe and modifying Windows registry DNS parameters.

    The malware collects system metadata including username, computer name, and administrative privileges, transmitting this information via encrypted HTTPS POST requests to the command-and-control server at screenai.online/Home/.

    Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

    The post Iran-Nexus Hackers Abuses Omani Mailbox to Target Global Governments appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • How IOC Feeds Streamline Incident Response and Threat Hunting for Best SOC Teams 

    ·

    , ,

    When you’re in a SOC, speed is everything. The earlier you detect and confirm an intrusion, the faster you can contain it, and the less damage it does to your organization.

    But raw indicators of compromise (IOCs) like hashes, IPs, or domains often fall short on their own.

    They raise a flag, but without context, analysts are left asking: What does this really mean? 

    Enriched IOC Feeds close that gap by adding the missing context and turning isolated data points into actionable intelligence. 

    The Limitations of Raw IOCs 

    While IOCs are important for detection, relying on them in their raw form creates major hurdles for SOC teams: 

    • Ambiguity: A single hash might correspond to multiple files, making it difficult to confirm what’s actually in play. 
    • Short lifespan: Domains and IPs often rotate quickly, leaving static indicators outdated by the time they’re spotted. 
    • Lack of behavior context: Raw data doesn’t explain how the threat behaves, moves laterally, or persists inside a network. 
    • Noise and false positives: Without enrichment, analysts spend hours chasing leads that turn out to be irrelevant. 

    How Enriched IOC Feeds Solve These Challenges 

    This is where ANY.RUN’s Threat Intelligence Feeds stand out. Instead of providing static data, they deliver up-to-date indicators enriched with context from real-world malware activity and sandbox sessions.

    That transforms a raw IOC into a ready-to-use lead for both incident response and proactive hunting. 
     

    ANY.RUN’s TI Feeds extracting actionable IOCs from unique sources

    For example, ANY.RUN’s Feed automatically extracts the malware’s configuration and network traffic, exposing C2 servers, registry changes, persistence mechanisms, and more.

    All of this intelligence is linked into a single execution chain, so analysts see the full picture of TTPs instead of chasing isolated IOCs. 

    Take a look at this sandbox session 

    ANY.RUN extracts contents of malware configs revealing valuable indicators 

    This saves hours of manual work: instead of stitching together scattered evidence, analysts can immediately pivot from an IOC in the feed to a complete sandbox session showing how the attack unfolds step by step. 

    Equip your SOC to stay ahead of threats -> Try TI Feeds 

    Key Advantages of Enriched IOC Feeds for SOC Teams 

    For SOC teams, the difference between keeping pace with threats and falling behind often comes down to the quality of intelligence at hand.

    Raw IOCs raise alerts, but without context they force analysts to spend hours validating what matters and what doesn’t.  

    Benefits of ANY.RUN’s TI Feeds for teams 

    Enriched IOC Feeds change that by providing the missing behavioral detail and scale SOC teams need to respond effectively. 

    • Accelerated threat hunting: Continuously updated IOCs, enriched with sandbox context, help analysts move beyond isolated alerts and quickly uncover related activity across the environment. 
    • Proactive defense: Instead of reacting to yesterday’s attacks, SOCs can track how threats evolve in real time and take preventive measures before they strike. 
    • Smarter triage and faster response: With behavioral context tied to each IOC, analysts immediately see how a threat operates, allowing them to prioritize critical incidents and cut MTTR. 
    • Reduced noise and false positives: Context-rich feeds minimize wasted effort by helping SOCs focus only on relevant, high-confidence indicators. 

    A Trusted Source of Large-Scale Intelligence 

    The strength of any feed depends on the quality of its data.  

    ANY.RUN’s Threat Intelligence Feeds are built on a foundation of over 50 million threats in the database, with more than 16,000 new samples added every day.

    The data is contributed by a global community of 500,000 analysts and 15,000 companies, ensuring it reflects the realities of active attacks across industries.

    Feeds are refreshed every two hours, giving SOC teams a view of campaigns as they unfold, not after the fact. 

    This constant stream of current, real-world intelligence gives analysts the clarity they need to tune defenses, validate alerts, and hunt for threats with confidence. 

    Accelerate Response and Threat Hunting with IOC Feeds 

    Keeping your SIEM, XDR, and TIP up to date with filtered malicious IPs, domains, and URLs is the difference between chasing noise and catching real threats.

    Enriched IOC Feeds give SOC teams the context and coverage they need to respond faster, hunt smarter, and defend more effectively. 

    Request full access of TI Feeds and see how enriched indicators can transform your response and hunting workflows. 

    The post How IOC Feeds Streamline Incident Response and Threat Hunting for Best SOC Teams  appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Lazarus Group Expands Malware Arsenal With PondRAT, ThemeForestRAT, and RemotePE

    ·

    The North Korea-linked threat actor known as the Lazarus Group has been attributed to a social engineering campaign that distributes three different pieces of cross-platform malware called PondRAT, ThemeForestRAT, and RemotePE. The attack, observed by NCC Group’s Fox-IT in 2024, targeted an organization in the decentralized finance (DeFi) sector, ultimately leading to the compromise of an

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Ukrainian Networks Launch Massive Brute-Force and Password-Spraying Campaigns Targeting SSL VPN and RDP Systems

    ·

    , ,

    A sophisticated network of Ukrainian-based autonomous systems has emerged as a significant cybersecurity threat, orchestrating large-scale brute-force and password-spraying attacks against SSL VPN and RDP infrastructure.

    Between June and July 2025, these malicious networks launched hundreds of thousands of coordinated attacks over periods lasting up to three days, targeting critical enterprise remote access systems.

    The campaign involves a complex web of interconnected networks, primarily centered around three Ukrainian autonomous systems: FDN3 (AS211736), VAIZ-AS (AS61432), and ERISHENNYA-ASN (AS210950), along with a Seychelles-based network TK-NET (AS210848).

    These networks were strategically allocated in August 2021 and have since engaged in systematic infrastructure manipulation, frequently exchanging IPv4 prefixes to evade blocklisting efforts and maintain operational continuity.

    Intrinsec researchers identified this threat infrastructure through extensive monitoring of honeypot networks, revealing attack patterns that peaked at over 1.3 million individual attempts during a three-day period in July 2025.

    The attackers demonstrated sophisticated coordination, with multiple IP addresses simultaneously launching identical attack patterns against exposed VPN endpoints and Remote Desktop Protocol services.

    The criminal infrastructure operates through partnerships with established bulletproof hosting providers, most notably IP Volume Inc. (AS202425), a Seychelles-based front company created by Ecatel’s operators.

    This arrangement provides the Ukrainian networks with both anonymity and resilience, allowing them to maintain operations despite law enforcement attention and industry blocklisting efforts.

    Network Infrastructure and Attack Mechanics

    The technical architecture of these attacks reveals careful planning and resource allocation. The primary attack vector utilizes coordinated IP ranges, with prefix 88.210.63.0/24 serving as a focal point for the most intensive campaigns.

    Layout summarizing the links shared between the above-mentioned entities (Source – Intrinsec)

    Analysis of attack logs shows precisely synchronized activation patterns, with individual IP addresses generating between 108,000 and 113,000 attack attempts each during peak operations.

    The attackers employ password spraying techniques rather than traditional brute-force methods, attempting common passwords across large volumes of accounts to avoid account lockout mechanisms.

    This approach proves particularly effective against organizations with weak password policies or inadequate rate limiting on authentication endpoints.

    The campaigns specifically target Fortinet, Palo Alto, and Cisco VPN appliances, aiming to establish high-privilege initial access points that can bypass traditional endpoint detection and response solutions.

    Network traffic analysis reveals that the infrastructure maintains persistent command-and-control communications through Amadey malware panels hosted across the same autonomous systems.

    Several C2 servers remain active, including 185.156.72.96 with 126 active bot connections and 185.156.72.97 maintaining 122 compromised endpoints, indicating successful post-exploitation activities beyond the initial access attempts.

    Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

    The post Ukrainian Networks Launch Massive Brute-Force and Password-Spraying Campaigns Targeting SSL VPN and RDP Systems appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The D Brief: SecDef’s guidance; Israel kills Yemeni PM; Venezuela’s defiance; China’s exoskeletons; And a bit more.

    ·

    Defending America’s borders, not deterring China, tops the list of priorities Defense Secretary Pete Hegseth sent to senior Pentagon leaders and combatant commanders just a few weeks ago, according to a memo obtained by Defense One’s Meghann Myers. 

    China has long been seen inside the Pentagon as the military’s “pacing challenge,” cutting into U.S. efforts to influence friends and allies across the Indo-Pacific, Africa and Latin America. But before mentioning China, the first priorities in Hegseth’s new guidance are to “seal our borders, repel invasion, counter narcotics and trafficking, and support the Department of Homeland Security mission to deport illegal aliens.” This focus reflects “the President’s determination to restore our neglected position in the Western Hemisphere,” Hegseth wrote in the document distributed August 7. 

    Why it matters: The language is a departure from not just the last president’s National Defense Strategy, but the president’s own first-term strategy, both of which placed deterring China as their first priority. And it’s a shift in rhetoric that has borne out in action, as Trump has ordered the militarization of the southern border while deploying Marines and National Guardsmen to Los Angeles to dispel protests of Immigration and Customs Enforcement raids, Myers writes.

    “I am concerned that DOD has become the ‘easy button’ for everything,” said Glen VanHerck, a retired Air Force general and former head of U.S. Northern Command. “That, long-term, is not good for our nation, to have DOD in our streets. We need to resource those agencies, spelled out in law to enforce our laws, and to conduct crisis response, in our homeland.” Continue reading, here. 

    Troops in the USA

    Between 5,000 and 10,000 people on Monday protested Trump’s desire to send the National Guard to Chicago. “The march was one of roughly 1,000 ‘Workers over Billionaires’ protests across the country on the U.S. Labor Day holiday,” Reuters reports from Illinois’ largest city. “But Chicago's demonstration had a decidedly more pointed tone as residents bristled against Trump's promise to target Chicago next in a deployment similar to those under way in Los Angeles and Washington D.C., two other Democrat-run cities.”

    Context: “Homicide rates in the nation's third-largest city have plunged in recent years, according to city crime data. And though a 2025 University of Chicago survey reported roughly half of Chicagoans feel unsafe in their neighborhoods at night, many protesters said on Monday that they felt largely safe in the city.”

    Related reading: “Why Is the National Guard in D.C.? Even They Don’t Know,” Ashley Parker and Nancy Youssef wrote last week for The Atlantic.

    Also: Tennessee, Texas, Ohio, and Missouri are GOP-led states whose cities have higher rates of violent crime than D.C. “Yet no Republican governor has asked for federal intervention,” David Chen reported Monday in an analysis piece for the New York Times. 

    Cities include: Kansas City, St. Louis, and Springfield in Missouri; Birmingham, Ala.; Cleveland, Dayton, and Toledo, Ohio; Tulsa, Okla.; Tennessee’s Memphis and Nashville; Houston; Little Rock in Arkansas; Utah’s Salt Lake City; and Shreveport, La. “All have crime rates comparable to Washington’s, according to F.B.I. statistics.”

    Notable: “Republican governors did not want to answer why they were willing to send their National Guard troops to Washington while not inviting the same attention to their cities,” Chen reports. 

    Expert reax: “They’re not doing it to improve public safety. It’s designed to humiliate political opponents,” said Jeffrey Butts of the Research and Evaluation Center at the John Jay College of Criminal Justice in New York. 

    Dive deeper: The Associated Press on Friday reported a similar observation based on the latest crime statistics, which are presented in two separate charts, here. 

    Just in: Trump’s use of National Guard and Marines in Los Angeles violated the Posse Comitatus Act, a federal judge said Tuesday in a 52-page opinion. “The evidence at trial established that Defendants systematically used armed soldiers (whose identity was often obscured by protective armor) and military vehicles to set up protective perimeters and traffic blockades, engage in crowd control, and otherwise demonstrate a military presence in and around Los Angeles. In short, Defendants violated the Posse Comitatus Act,” District Judge Charles Breyer wrote in an opinion released publicly on Tuesday morning. The “defendants instigated a months-long deployment of the National Guard and Marines to Los Angeles for the purpose of establishing a military presence there and enforcing federal law. Such conduct is a serious violation of the Posse Comitatus Act,” he said. 

    “Congress spoke clearly in 1878 when it passed the Posse Comitatus Act, prohibiting the use of the U.S. military to execute domestic law,” Breyer writes. “Nearly 140 years later, [the] Defendants—President Trump, Secretary of Defense Hegseth, and the Department of Defense—deployed the National Guard and Marines to Los Angeles, ostensibly to quell a rebellion and ensure that federal immigration law was enforced. There were indeed protests in LosAngeles, and some individuals engaged in violence. Yet there was no rebellion, nor was civilian law enforcement unable to respond to the protests and enforce the law.”

    Caveat: Breyer’s order blocks use of those troops for law enforcement tasks; but that part of his decision is put on hold until Sept. 12, likely “to avoid provoking either a less-sympathetic Ninth Circuit panel or the justices,” national security law professor Steve Vladeck writes. If his decision is upheld, it would mean Guard and Marine forces cannot participate in “arrests, apprehensions, searches, seizures, security patrols, traffic control, crowd control, riot control, evidence collection, interrogation, or acting as informants,” Breyer said. “Los Angeles was the first US city where President Trump and Secretary Hegseth deployed troops, but not the last,” he added. CNN has a bit more.

    Developing: Trump is expected to make a “defense-related” announcement around 2 p.m. ET Tuesday afternoon, following several days of speculation about his reportedly worsening health, Fox’s Jacqui Heinrich wrote on social media. Catch it live at DVIDS, here. 

    Will Trump move forward with his promise to rename the Department of Defense to the Department of War? It’s unclear just yet, but the president said on August 25 he wanted to officially change the name “over the next week or so.” 

    Coverage continues below…

    Welcome to this Tuesday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson with Bradley Peniston. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1958, a U.S. Air Force RC-130 was shot down over Armenia after it strayed into Soviet airspace during a surveillance mission, killing all 17 crew members.

    Venezuela’s dictator says his troops are ready for whatever the U.S. Navy is up to off his country’s coast, the Associated Press reported Monday from Caracas. 

    Nearby: “Seven U.S. warships, along with one nuclear-powered fast attack submarine, are either in the region or are expected to be there soon, bringing along more than 4,500 sailors and marines,” Reuters reported Friday. “The U.S. military has also been flying P-8 spy planes in the region [over international waters] to gather intelligence.” 

    Why: President Trump’s deputy chief of staff Stephen Miller told reporters Friday the U.S. troops are in the vicinity to “combat and dismantle drug trafficking organizations, criminal cartels and these foreign terrorist organizations in our hemisphere.” However, “most of the seaborne drug trade travels to the United States via the Pacific, not the Atlantic, where the U.S. forces are, and much of what arrives via the Caribbean comes on clandestine flights,” Reuters notes. 

    “In the face of this maximum military pressure, we have declared maximum preparedness for the defense of Venezuela,” Nicolás Maduro said Monday, calling the U.S. deployments “an extravagant, unjustifiable, immoral and absolutely criminal and bloody threat.”

    Expert reax: The U.S. presence near Venezuela is “too big to be just about drugs. [And] It's too small to be about an invasion,” one specialist from the Center for Strategic and International Studies in Washington said. His guess? The ships appear to be a show of force for now. Read on, here. 

    Additional reading: “Mystery surrounds $1.2 billion Army contract to build huge detention tent camp in Texas desert,” AP reported last week as well. 

    The Space Force is increasingly going commercial for space domain awareness. “We've gone and looked at many of our acquisition programs that were on the more traditional route, and said, ‘Is there anything that we can do on the requirements side that's causing us not to go to commercial? Can we take advantage of this?” said Maj. Gen. Stephen Purdy, who is the military deputy, acting assistant Air Force secretary, and the service’s acquisition executive for space. He spoke at the National Defense Industrial Association’s emerging technology conference on Thursday, Defense One’s Lauren C. Williams reports, here.

    More reading:

    Asia

    Iron Man in the Himalayas? China’s PLA embraces exoskeletons. Six years ago, the Chinese military hosted a “Super Warrior” contest in which 50-plus prototypes from 25 developers competed in categories such as lightweight mobility, heavy-load marching, and munitions handling. That led earlier this year to the PLA’s "intelligent logistics devices” exercise on the far-western Karakoram Plateau of the Xinjiang Military District, part of a push to move such gear from demonstrations to deployment, BluePath Labs’ Tye Graham and New America’s Peter W. Singer report in the latest installment of The China Intelligence column.

    More reading:

    • China to unveil US ship-killing weapons at military parade—Telegraph
    • Japan looks to build drone ‘shield’ in record $60 billion defense budget request—Japan Times

    Middle East

    Trump, others still want to depopulate and redevelop Gaza, the Washington Post reports off a 38-page prospectus for a “Riviera of the Middle East” to be built on the rubble. The plan envisions paying Palestinians to leave with a share in the new venture, a move the prospectus says would save $23,000 per person. Read on, here.

    Israeli strike kills Yemeni prime minister, 11 other leaders. The Saturday strike on the capital of Sanaa, the first such attack to kill senior officials, killed the prime minister of the Houthi-run government and several other ministers. On Monday, thousands attended a funeral in the capital’s largest mosque. Mohammed Miftah, now de facto head of the Iran-aligned Houthi government, vowed revenge. Reuters reports, here.

    Related reading:

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Researchers Warn of MystRodX Backdoor Using DNS and ICMP Triggers for Stealthy Control

    ·

    Cybersecurity researchers have disclosed a stealthy new backdoor called MystRodX that comes with a variety of features to capture sensitive data from compromised systems. “MystRodX is a typical backdoor implemented in C++, supporting features like file management, port forwarding, reverse shell, and socket management,” QiAnXin XLab said in a report published last week. “Compared to typical

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Jaguar Land Rover Confirms Cybersecurity Incident Impacts Global IT Systems

    ·

    , ,

    Luxury automaker Jaguar Land Rover (JLR) has been forced to halt production at its Halewood plant and shut down its global IT infrastructure following a significant cybersecurity incident.

    The breach, which was first reported on Monday, September 1, has led to a widespread operational crisis, with the company taking immediate action to mitigate the attack’s impact.

    Workers at the Merseyside facility were instructed to stay home as the crisis unfolded. Production staff reported receiving emails as early as 4:30 AM on Monday, telling them not to come in for their shifts.

    Another shift that was already on-site at the Halewood plant was sent home, bringing manufacturing to an abrupt standstill.

    In a message sent to its workforce, JLR confirmed the nature of the disruption. “JLR has been impacted by a cyber incident,” the communication stated. “We took immediate action to mitigate its impact by proactively shutting down our systems.”

    The shutdown, initially impacting Monday’s production, has now been extended. An email from Halewood management on Tuesday morning confirmed that the halt would continue into Wednesday, indicating the severity of the “global IT system issue” the company is confronting.

    While the disruption to manufacturing and retail activities has been described as “severe,” the company has moved to reassure its customers. “At this stage there is no evidence any customer data has been stolen,” the company’s statement read by ECHO. This remains a critical point as the investigation into the breach continues.

    JLR’s immediate priority is to restore its digital backbone. “We are now working at pace to restart our global applications in a controlled manner,” the company explained.

    The process of bringing complex, interconnected systems back online after a cybersecurity event is often a meticulous and time-consuming task, aimed at ensuring the threat has been fully neutralized before resuming normal operations.

    For now, the assembly lines at Halewood remain silent, and thousands of employees are awaiting further instruction. The incident underscores the increasing vulnerability of the global automotive industry to digital threats and highlights the profound operational and financial consequences that can follow a sophisticated cyberattack.

    The full extent of the disruption and the timeline for a complete recovery are yet to be determined as JLR’s technical teams work around the clock to resolve the crisis.

    Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.

    The post Jaguar Land Rover Confirms Cybersecurity Incident Impacts Global IT Systems appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New WhatsApp Scam Alert Tricks Users to Get Complete Access to Your WhatsApp Chats

    ·

    , ,

    A newly discovered WhatsApp scam has begun circulating on messaging platforms, exploiting the popular device linking feature to seize full control of user accounts.

    The attack unfolds when recipients receive what appears to be a harmless message from a known contact, typically stating “Hi, I accidentally found your photo!” accompanied by a shortened URL.

    Once clicked, the URL redirects victims to a counterfeit Facebook login portal, meticulously designed to mirror the legitimate interface and harvest credentials.

    Early reports indicate the scam first emerged in Central Europe before rapidly spreading across multiple regions, leveraging social engineering techniques to appear authentic.

    Upon entering their Facebook credentials on the fake page, victims unwittingly grant attackers access to the WhatsApp linking mechanism.

    The malware then chains into WhatsApp’s desktop and web sessions by generating a valid QR code link using the compromised account’s session tokens.

    Within minutes, malicious actors can view and export conversation histories, media files, and contact lists. Financial fraud, identity theft, and further targeted attacks are potential downstream consequences once control is fully established.

    Phishing message (Source – X)

    Gen Threat Labs analysts identified the malware after correlating unusual authentication requests with reports of unauthorized linkages to WhatsApp Business accounts.

    Their research revealed that the scam’s backend infrastructure uses stealthy server clusters to relay session tokens, evading detection by conventional network monitoring tools.

    The threat actors also employ ephemeral subdomains, rotating nearly hourly to frustrate takedown efforts and to avoid IP-based blacklisting.

    In addition to credential harvesting and session hijacking, the scam incorporates subtle persistence features.

    A lightweight JavaScript payload injected into the fake page entices unsuspecting users to install a browser extension purportedly to “enhance privacy.”

    In reality, this extension runs in the background, refreshing stolen session tokens and occasionally prompting users to reauthenticate, thereby maintaining continuous access.

    Should users attempt to revoke permissions on Facebook, the malicious script intercepts the revocation flow and prompts a misleading error message, further trapping victims in a loop.

    Infection Mechanism

    The infection mechanism hinges on a classic credential phishing strategy augmented by session token reuse. Once a user submits login details on the spoofed page, the server-side component immediately spins up a headless WhatsApp Web session using Puppeteer automation.

    This headless session generates a valid QR code that is forwarded to the attacker’s console, effectively linking the victim’s mobile account to the attacker’s instance without any notification to the user.

    To maximize stealth, the attackers throttle the automation scripts to mimic human-like browsing patterns, complete with randomized mouse movements and typing delays.

    This approach bypasses heuristics that flag rapid, repetitive login attempts, allowing the threat actors to remain under the radar while extracting valuable conversational data.

    Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

    The post New WhatsApp Scam Alert Tricks Users to Get Complete Access to Your WhatsApp Chats appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • ESPHome Vulnerability Allows Unauthorized Access to Smart Devices

    ·

    , , ,

    A critical authentication bypass flaw in ESPHome’s ESP-IDF web server component allows unauthorized users on the same local network to access and control smart devices without any valid credentials. Discovered and reported by security researcher jesserockz, the vulnerability (CVE-2025-57808) undermines Basic Authentication by accepting empty or partially correct Authorization headers. Users of ESPHome version 2025.8.0 […]

    The post ESPHome Vulnerability Allows Unauthorized Access to Smart Devices appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Palo Alto Networks Confirms Data Breach via Compromised Salesforce Instances

    ·

    , ,

    Cybersecurity vendor Palo Alto Networks disclosed that its Salesforce environment was breached through a compromised Salesloft Drift integration, marking the latest in a series of supply chain attacks targeting customer relationship management platforms. According to a statement from Palo Alto Networks, Salesloft’s Drift application—used by hundreds of organizations to streamline sales engagement—suffered an intrusion that […]

    The post Palo Alto Networks Confirms Data Breach via Compromised Salesforce Instances appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶