1010.cx

  • New ShadowCaptcha Attack Exploiting Hundreds of WordPress Sites to Tricks Victims into Executing Malicious Commands

    ·

    , ,

    A sophisticated global cybercrime campaign dubbed “ShadowCaptcha” has emerged as a significant threat to organizations worldwide, leveraging fake Google and Cloudflare CAPTCHA pages to trick victims into executing malicious commands.

    Discovered by researchers at the Israel National Digital Agency in August 2025, this large-scale operation has been active for at least one year, exploiting hundreds of compromised WordPress websites to deliver multi-stage malware payloads.

    The campaign employs a deceptive technique known as ClickFix, where attackers inject malicious JavaScript into compromised WordPress sites that redirect users to attacker-controlled infrastructure hosting fake CAPTCHA verification pages.

    These convincingly designed pages mimic legitimate Cloudflare or Google security checks, prompting unsuspecting users to copy and execute PowerShell commands under the guise of completing a security verification process.

    Retrospective analysis has revealed the campaign’s extensive reach, with over 100 compromised WordPress sites serving as initial infection vectors and hundreds of malware samples spanning multiple families and variants.

    Gov.li analysts identified the campaign’s opportunistic nature, targeting organizations across all sectors regardless of size or industry vertical.

    The attack operates through a sophisticated multi-stage delivery mechanism that combines social engineering with living-off-the-land binaries (LOLBins) to maintain persistence while evading detection.

    Once victims execute the disguised malicious commands, the malware establishes a foothold within targeted systems and proceeds with its primary objectives.

    Multi-Faceted Monetization Strategy

    ShadowCaptcha’s infection mechanism demonstrates remarkable versatility in its monetization approach.

    The malware focuses on three primary revenue streams: credential harvesting and browser data exfiltration for identity theft, deployment of cryptocurrency miners to generate illicit profits from infected systems, and potential ransomware deployment for immediate financial gain.

    Fake captcha (Source – Gov.li)

    This multi-pronged strategy maximizes the attackers’ return on investment while creating sustained unauthorized access to compromised networks.

    The campaign’s ability to adapt its payload based on system characteristics and security posture makes it particularly dangerous, as it can pivot between different attack modes to avoid detection while maintaining persistent access to valuable corporate resources.

    Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

    The post New ShadowCaptcha Attack Exploiting Hundreds of WordPress Sites to Tricks Victims into Executing Malicious Commands appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cephalus Ransomware Exploits RDP for Initial Access in Latest Attack Campaign

    ·

    , , ,

    Cybersecurity researchers at Huntress identified a novel ransomware variant dubbed Cephalus, deployed in two separate incidents targeting organizations lacking robust access controls. This emerging threat, which claims its name from Greek mythology symbolizing inevitable tragedy, leverages exposed Remote Desktop Protocol (RDP) endpoints as its primary initial access vector, exploiting compromised credentials without multi-factor authentication (MFA). […]

    The post Cephalus Ransomware Exploits RDP for Initial Access in Latest Attack Campaign appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The D Brief: ‘Anything I want to do’; 2,234 Guardsmen in DC; USAF’s boom woes; War Department?; And a bit more.

    ·

    President Donald Trump insisted Tuesday he has unlimited power, and that includes the power to send the military to any state or city he chooses, he told reporters at the White House. 

    “I have the right to do anything I want to do. I'm the president of the United States,” Trump said during a televised cabinet meeting that ran for more than three hours Tuesday. (Here’s a transcript, via Roll Call.)

    Trump was reacting to public tension over the Pentagon’s reported plans to send troops into Chicago, which U.S. military officials have been planning for several weeks as a White House response to “crime, homelessness and undocumented immigration” in Illinois’ largest city, according to the Washington Post. If the governor of Illinois requests the Guard troops, the process would likely proceed somewhat quickly. But Democratic Gov. JB Pritzker has been especially vocal about declining Trump’s desired Guard deployment to Chicago, saying at a Monday press conference on the matter, “Do not come, Donald Trump. You are neither wanted nor needed here in Illinois.” 

    Additional context: Trump has “attacked the counterweights to his own authority in government, particularly focusing on Democratic governors and cities governed by Democratic mayors,” the New York Times reminds readers, and points out, “The president has not suggested sending troops to cities with higher crime in states that lean Republican.”

    Also worth noting: “Although high crime rates have persisted for decades in Chicago, violent crime there has dropped since the pandemic, and murders are down by 50 percent since 2021,” the Times reports. And “Over the last year, crime has fallen in nearly every major category tracked by the Chicago Police Department.”

    Trump’s deputy chief of staff Stephen Miller: “The Democrat Party is not a political party. It is a domestic extremist organization,” the president’s top immigration advisor told TV personality Sean Hannity of Fox on Monday. “It is an entity devoted exclusively to the defense of hardened criminals, gangbangers, and illegal, alien killers and terrorists,” he said, and insisted—using patriotic “purity” rhetoric of autocrats and dictators throughout history—the “Democrat Party does not fight for, care about, or represent American citizens.” 

    ICYMI: Every state in the National Guard already has “quick reaction forces,” Randy Manner, a retired Army two-star who has served as acting vice chief of the National Guard Bureau, told ABC News this week. 

    But the new, specialized Guard troops Trump is demanding for each state in an executive order signed Monday? “They're going to be there to police Americans,” Manner said.

    Coverage continues below…

    Welcome to this Wednesday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson with Bradley Peniston. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1776, Revolutionary troops were flanked and defeated by a far larger British force in Brooklyn, but Gen. George Washington saved his army with a retreat to Manhattan.

    Update: National Guard troops sent to the nation’s capital for “out of control” crime are now picking up trash and spreading mulch, NBC4 Washington and the Washington Post reported Tuesday and Wednesday, respectively. 

    “Normally the Park Service does that, but the administration laid off the workers,” Brad Heath of Reuters noted on social media. Additional video confirmed the troops’ activity, which Pentagon officials said two weeks ago would be a possibility. 

    “Today here, we are right outside the waterfront. Had everyone with gloves and trash bags and all the materials they needed, and instructions to head out and pick up the trash,” a Guard soldier said in a video posted to social media over the weekend. 

    “The joint task force had 2,234 members as of Monday morning, including 929 members of the D.C. National Guard and 1,305 members of the Louisiana, Mississippi, Ohio, South Carolina, Tennessee and West Virginia National Guards,” NBC4 reports. 

    Worth noting: “About half of U.S. adults, 53%, say they approve of Trump’s handling of crime…even as statistics show violent crime is down in Washington and across the nation following a coronavirus pandemic-era spike,” the Associated Press reported Wednesday, citing a survey of 1,182 U.S. adults conducted between August 21 and 25. 

    Caveat: “The poll shows there is less public support for federal takeovers of local police departments, suggesting opinions could shift over the coming weeks or months, depending on how aggressively Trump pursues his threats.” Read more, here. 

    Follow-up: Pentagon chief Pete Hegseth said he agrees with Trump that the Defense Department’s name should be changed to the “War Department” because “George Washington started the Department of War because he wanted us to win our wars,” and “It's not just about words; it's about the warrior ethos,” he said during Trump’s three-hour cabinet meeting Tuesday. 

    In case you missed it, Trump said Monday he wants to officially change the name “over the next week or so,” during remarks at the White House. “We're just going to do it,” Trump said when asked if he has considered lawmakers’ opinions on the matter. ABC News has more from Hegseth’s remarks at the cabinet meeting. 

    Balky booms: The refueling boom on the Air Force’s KC-46 tankers has been involved in three accidents that have cost tens of millions of dollars to repair. Two took place in 2022 and another last year, according to investigation reports released by the Air Force on Monday.

    During the most recent of the mishaps described in the reports, a tanker’s boom got stuck in the fuel receptacle of a F-15E, then released with enough recoil to strike the tanker. The boom broke apart, resulting in $14 million in damages. That mishap was primarily caused by the boom operator’s control inputs, investigators found. Defense One’s Audrey Decker has more, here.

    Navy “looking forward” to F/A-XX builder decision. Now that Congress is moving to restore funding for the sixth-generation fighter jet, the service is waiting for Pentagon leaders to pick a company to build it, according to Vice Adm. Daniel Cheever, commander of Naval Air Forces, speaking Tuesday at a CSIS event.

    Background: In March, the Navy was reportedly close to picking a company to build F/A-XX, but an announcement never came, and the service ended up gutting funding for the aircraft in its 2026 budget request, throwing the program into limbo. But Congress is on track to reverse those cuts: Senate appropriators added $1.4 billion to F/A-XX in their draft defense spending bill and House appropriators added $972 million to their version. Decker has more, here.

    Additional reading: 

    Etc.

    Trump-linked “covert operation” in Greenland? Officials in Denmark are reportedly aware that “at least three people with connections to President Donald Trump have been carrying out covert influence operations in Greenland,” the Associated Press reported Wednesday, relaying reporting from Danish public broadcaster DR. 

    BBC: “DR's report on Wednesday gave details of a visit by one American to Greenland's capital Nuuk, saying he was seeking to compile a list of Greenlanders who backed US attempts to take over the island. The aim would be to try to recruit them for a secession movement.” 

    Danish Foreign Minister Lars Lokke Rasmussen has summoned America’s top diplomat in Denmark, Mark Stroh, the U.S. charge d'affaires in Copenhagen, over the matter. “Any attempt to interfere in the internal affairs of the Kingdom [of Denmark] will of course be unacceptable,” Rasmussen told Time magazine.

    “It is important for us to speak out very clearly against the United States,” Rasmussen told reporters Wednesday, according to Reuters. He called the allegations “completely unacceptable,” and added, “If anyone thinks they can influence it by creating a ‘fifth column’ or that type of activity, then it is contrary to the way states cooperate.” 

    Additional reading: 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Anthropic Disrupts AI-Powered Cyberattacks Automating Theft and Extortion Across Critical Sectors

    ·

    Anthropic on Wednesday revealed that it disrupted a sophisticated operation that weaponized its artificial intelligence (AI)-powered chatbot Claude to conduct large-scale theft and extortion of personal data in July 2025. “The actor targeted at least 17 distinct organizations, including in healthcare, the emergency services, and government, and religious institutions,” the company said. “

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New Zip Slip Vulnerability Allows Attackers to Manipulate ZIP Files During Decompression

    ·

    , ,

    A newly observed variant of the Zip Slip vulnerability has emerged, enabling threat actors to exploit path traversal flaws in widely used decompression utilities.

    Exploits leveraging this vulnerability craft malicious archives containing specially constructed file names with relative paths.

    When an unsuspecting user or automated system extracts these archives, files are written outside the intended extraction directory, potentially overwriting critical system or application binaries.

    Early reports indicate that attackers are weaponizing this technique to implant backdoors and escalate privileges on both Windows and Unix targets.

    Unlike traditional archives that restrict file locations to a subfolder, the malicious ZIP files contain entries.

    Upon decompression, these entries bypass inadequate path sanitization and deposit payloads directly into system directories.

    Initial incidents were spotted in internal penetration tests, but more sophisticated campaigns recently attributed to the RomCom APT group have demonstrated live-fire exploitation in enterprise environments.

    ASEC analysts identified that the variant takes advantage of the general purpose bit flag in the ZIP header to encode path separators that evade detection by signature-based scanners.

    In one case, a compromised email attachment delivered a ZIP archive that, when opened with an outdated decompression tool, silently overwrote a legitimate startup script.

    Examination of the archive structure reveals that the filename field beginning at offset 0x1E contains path segments separated by percent-encoded slashes, which are decoded only during file creation.

    ZIP file containing the path to the unzipped file (Source – ASEC)

    Subsequent reverse engineering uncovered that the malicious archive leveraged Python’s zipfile module to insert relative paths directly into the filename field.

    Major vulnerabilities exploited by this technique include:-

    • CVE-2025-8088 – It affects WinRAR prior to version 7.13 and allows bypass of path validation via Alternate Data Stream traversal.
    • CVE-2025-6218 – A remote code execution flaw in WinRAR versions before 7.12 that sidesteps relative path filters when spaces are used.
    • CVE-2022-30333 – It targets RARLAB Unrar before 6.12 to overwrite SSH authorized_keys via "../../example" paths.
    • CVE-2018-20250 – This abuses ACE format extraction in WinRAR pre-5.61 by bypassing UNACEV2.dll filtering logic.

    In addition to simple file overwrite, this variant supports embedding executable scripts and DLLs designed to maintain persistence.

    By writing payloads to startup folders or systemd service directories, attackers ensure execution upon reboot. Detection is complicated by the fact that many decompression utilities do not normalize or validate canonical paths before writing.

    Cybersecurity teams are advised to employ decompression libraries with built-in path traversal checks, enforce extraction within sandboxed environments, and update tools to patched versions released after August 2025 that include strict directory validation routines.

    Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

    The post New Zip Slip Vulnerability Allows Attackers to Manipulate ZIP Files During Decompression appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • ShadowSilk Hits 36 Government Targets in Central Asia and APAC Using Telegram Bots

    ·

    A threat activity cluster known as ShadowSilk has been attributed to a fresh set of attacks targeting government entities within Central Asia and Asia-Pacific (APAC). According to Group-IB, nearly three dozen victims have been identified, with the intrusions mainly geared towards data exfiltration. The hacking group shares toolset and infrastructural overlaps with campaigns undertaken by threat

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Spotify Launches Direct Message Feature for Music Sharing, What are the Risks Associated?

    ·

    ,

    Spotify today rolled out a native direct messaging feature, Messages, for both Free and Premium users aged 16+ in select markets on mobile. 

    This long-awaited addition creates a dedicated in-app space to share tracks, podcasts, and audiobooks, supercharging word-of-mouth recommendations. However, security researchers warn that the new chat API could introduce attack vectors if not rigorously secured.

    Launching August 26, 2025, Messages centralizes in-app sharing. Users tap the share icon in the Now Playing view, select a contact, and send content with text and emoji reactions. 

    Conversations live under the user’s profile menu, and Spotify suggests message recipients based on previous interactions—collaborative playlists, Jams sessions, or Family and Duo plans.

    Under the hood, Messages relies on a RESTful API over HTTPS (TLS 1.3) with JSON Web Tokens (JWT) for session authentication. 

    Spotify enforces industry-standard encryption in transit and at rest, and proactive scanning for harmful or illegal content per its Terms of Use and Platform Rules. 

    Users can accept or reject message requests, block senders, or disable Messages entirely via Settings.

    Messaging Feature

    Messaging Feature

    Potential Exploits

    Security analysts caution that any messaging system introduces threats if not meticulously secured. Key risks include:

    Cross-Site Scripting (XSS), if Spotify’s client fails to sanitize message fields properly, an attacker could inject JavaScript payloads that execute when the recipient views the chat.

    Cross-Site Request Forgery (CSRF), an attacker could send spam or phishing links to the victim’s contacts.

    Malicious code hosted on a phishing page might lure users to grant permissions via OAuth and capture their access tokens. 

    Spotify URIs could be replaced with attacker-controlled deep-link schemes that redirect users to malicious websites or prompt unintended app behavior.

    Mitigation strategies include strict input validation, implementing SameSite=strict cookies, enforcing CSP headers, and rotating refresh tokens on suspicious activity. 

    As Messages continues its global rollout, both Spotify and its user base must balance seamless social sharing with rigorous security hygiene to ensure the chat feature remains a boon for discovery without becoming a vector for compromise.

    Tired of Filling Forms for security & Compliance questionnaires? Automate them in minutes with 1up! Start Your Free Trial Now!

    The post Spotify Launches Direct Message Feature for Music Sharing, What are the Risks Associated? appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • NVIDIA NeMo AI Curator Vulnerability Allows Code Execution and Privilege Escalation

    ·

    , ,

    NVIDIA released a security bulletin for NVIDIA® NeMo Curator addressing a high-severity vulnerability (CVE-2025-23307) that affects all prior versions of the Curator software. The flaw, rooted in improper handling of user-supplied files, allows a maliciously crafted file to be processed by NeMo Curator, leading to code injection and arbitrary code execution. Successful exploitation can result […]

    The post NVIDIA NeMo AI Curator Vulnerability Allows Code Execution and Privilege Escalation appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New BruteForceAI Tool Automatically Detects Login Pages and Executes Smart Brute-Force Attacks

    ·

    , , , ,

    BruteForceAI, an innovative penetration testing framework developed by Mor David, integrates large language models (LLMs) with browser automation to autonomously identify login forms and conduct sophisticated brute-force attacks.

    By combining AI-driven form analysis with evasion techniques and comprehensive logging, BruteForceAI streamlines credential-testing workflows, enabling security teams to uncover weak authentication mechanisms rapidly and efficiently.

    At the core of BruteForceAI lies its two-stage process. In Stage 1, the tool leverages an LLM (via Ollama or Groq) to parse HTML content and pinpoint login form elements and selectors with remarkable accuracy up to 95% in real-world tests.

    The model examines page structures, input fields, and submission endpoints, automatically generating the precise CSS selectors needed for subsequent exploitation.

    Stage 2, the Smart Attack phase, initiates multi-threaded credential testing using the AI-discovered selectors. Users can choose between two modes:

    • Brute-Force Mode: Exhaustively cycles through username/password combinations.
    • Password-Spray Mode: Tests each password against a set of usernames to reduce lockouts.

    Intelligent retry logic incorporates feedback learning and DOM-change detection to validate successful logins, while synchronized delays, jitter, and human-like timing patterns mimic genuine user behavior to evade detection.

    BruteForceAI Tool Features

    BruteForceAI’s advanced feature set elevates standard brute-force tools with comprehensive evasion and operational capabilities:

    Feature CategoryCapabilities
    Multi-Threading1–100+ threads with synchronized delays between attempts
    Evasion TechniquesRandom User-Agent rotation, proxy support, configurable jitter, browser visibility control
    Notifications & LogsReal-time webhook alerts (Discord/Slack/Teams/Telegram), SQLite database logging, verbose output
    Operational ToolsAutomatic update checks, network retry mechanism, database cleanup, colored terminal interface

    Webhook integration ensures immediate notification upon credential success, while comprehensive SQLite logging maintains detailed records of every attempt.

    BruteForceAI also supports output capture to files and offers a suite of database management commands, including clean-up and schema inspection.

    Installation requires Python 3.8+, Playwright browsers, and standard libraries (requests, PyYAML). After cloning the repository from GitHub and running pip install -r requirements.txt, users configure their preferred LLM:

    • Local (Ollama): Pull llama3.2:3b or llama3.2:1b for balanced or speed-optimized analysis.
    • Cloud (Groq): Authenticate with an API key and select from models such as llama-3.3-70b-versatile (recommended) or alternatives like gemma2-9b-it for lightweight tasks.

    To analyze targets:

    textpython main.py analyze --urls targets.txt --llm-provider ollama --llm-model llama3.2:3b

    To execute attacks:

    textpython main.py attack --urls targets.txt --usernames users.txt --passwords passwords.txt --threads 20 --delay 5 --jitter 2

    BruteForceAI is explicitly designed for authorized penetration testing, security research, and educational purposes; misuse against unauthorized systems is illegal and unethical. Organizations should ensure proper scope and permission before deployment. The author disclaims liability for illicit use.

    By automating form detection and enriching brute-force methodology with AI-driven intelligence and evasion, BruteForceAI marks a significant evolution in credential-testing toolsets enabling red teams and security auditors to identify authentication weaknesses with speed and precision.

    Tired of Filling Forms for security & Compliance questionnaires? Automate them in minutes with 1up! Start Your Free Trial Now!

    The post New BruteForceAI Tool Automatically Detects Login Pages and Executes Smart Brute-Force Attacks appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • TAG-144: Actors Attacking Government Entities With New Tactics, Techniques, and Procedures

    ·

    , , ,

    The threat actor known as TAG-144, also referred to as Blind Eagle or APT-C-36, has been linked to five distinct activity clusters operating from May 2024 through July 2025, primarily targeting Colombian government entities at local, municipal, and federal levels. This cyber threat group, active since at least 2018, employs a sophisticated blend of cyber-espionage […]

    The post TAG-144: Actors Attacking Government Entities With New Tactics, Techniques, and Procedures appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶