The UK’s National Cyber Security Centre (NCSC) has issued an alert over a new ‘zero-click’ threat campaign being waged by Russian state-backed hackers.

The advisory, published in collaboration with international partners, warned ‘beehive’ attacks by the ‘Laundry Bear’ threat group aim to steal email correspondence at organizations operating across a range of critical sectors.

This includes organizations in the defense, education, energy, and technology industries, as well as law enforcement and government agencies.

Attacks against these organizations all have a common theme, according to the NCSC, mainly the use of Zimbra Collaboration Suite (ZCS) software. Targeting focuses specifically on those using vulnerable versions of the software, the advisory noted.

Rather than requiring users to click a link or open a file, zero-click attacks mean users only have to view a malicious email to be compromised.

The NCSC urged organisations that use ZCS to follow mitigation advice, patch immediately, and “improve network monitoring capabilities”.

Crucially, analysis of the campaign found these techniques could be adapted to exploit vulnerabilities in other email software applications used by Western organizations.

“This phishing campaign demonstrates how hostile actors will ruthlessly adapt techniques and exploit vulnerable technology in pursuit of their aims to steal sensitive information from Western organizations,” said NCSC chief operating officer (COO) Beth Hopkins.

Ukrainian organizations used in testing

According to the NCSC, the techniques used by Laundry Bear were “extensively trialled” on Ukrainian victims before use against other Western nations. The security agency noted this is part of a growing trend among Russian threat groups.

Notably, technical analysis of the campaign also highlighted the use of AI in development of a “simple codebase” used during operations.

Zero-click attacks have surged in frequency over the last 12 months, research shows, with threat actors accelerating efforts to capitalize on vulnerabilities.

Analysis from Rapid7 found that vulnerability exploitation has now surpassed social engineering as the “largest initial access vector”, accounting for more than one-third (38%) of all attacks.

More than 50% of all exploited vulnerabilities involved zero-click attacks, rather than network-facing vulnerabilities, the study noted, highlighting evolving techniques by threat actors.

“These types of vulnerabilities require no authentication and no user interaction, giving attackers rapid pathways into exposed systems and edge infrastructure,” Rapid7 noted.

Dray Agha, senior manager of security operations at Huntress, said these types of exploits are a “worst-case scenario for defenders” as potential victims are only required to view malicious emails.

“Simply viewing the email in a vulnerable client triggers the compromise,” he explained. “This completely bypasses traditional employee security training and gives state-backed hackers a silent, invisible backdoor into sensitive communications without the victim ever making a mistake.”

Agha said the rise of these techniques mean organizations need to place a greater focus on regular patching to avoid falling prey.

“This is why defense-in-depth is advised, as where the human security layer is porous, the technical defensive layer can step in,” he said.

“Organizations shouldn’t just rely on their staff acting as a ‘human firewall’. Rapid software patching, coupled with layered technical defenses, is the only reliable safety net against modern state-sponsored threats.”

FOLLOW US ON SOCIAL MEDIA

Criminals are posing as Interpol cyber crime investigators to target small businesses across Europe, Asia, the Middle East, and North America.

According to new research from Bitdefender, the phishing messages claim to contain evidence that the recipients are carrying out suspicious activity, pressuring them into opening a password-protected archive.

"Based on information that has come to our attention, there may be activities involving accounts, systems or services associated with your organization that warrant further examination. We have obtained information and video material that may assist in your assessment of the matter," the emails read.

"We recommend conducting an internal review to determine whether any unauthorized, suspicious or potentially fraudulent activities have occurred. Prompt attention to such matters may help mitigate potential financial operational, reputational or regulatory risks."

Upon opening the link, recipients are directed to a Proton Drive-hosted file that delivers a ransomware payload hidden within multiple archive layers. Once executed, researchers said the malware seeks to encrypt files across available drives and presents victims with a ransom message.

The campaign is targeting organizations across multiple industries, including food and agriculture, legal services, pharmaceuticals, media, technology, and finance.

The ransomware is relatively simple, according to Bitdefender researchers. The code contains hardcoded values, including the password used during encryption and decryption, and lacks many of the features typically associated with large ransomware operations.

Interestingly, victims are instructed to contact the attackers through a Tox chat channel to negotiate a ransom, rather than through the more usual dedicated negotiation portal or victim site.

This, researchers noted, is another indication that this is likely a custom-built operation, perhaps assembled using publicly available code and tools rather than the work of an established ransomware group.

What small businesses need to know

Javvad Malik, Lead CISO advisor at KnowBe4, said that impersonating Interpol – or law enforcement in general – is specifically designed to trigger a “rapid emotional response” and dupe victims into ignoring red flags.

"What is interesting about this campaign is that it targets small business,” he said. “These are often understaffed and have no security or even IT expertise on hand, so it's not difficult to see why people would easily fall victim to these kinds of attacks."

Bitdefender has warned small businesses to be on the alert, urging them to verify all unsolicited correspondence by reaching out through official channels to confirm whether the communication is legitimate.

"One of the biggest red flags in this campaign is the delivery method itself," researchers said. "While the attackers impersonate Interpol, legitimate law enforcement agencies don't send unsolicited emails containing Proton Drive links to password-protected files and ask organizations to review alleged evidence of wrongdoing."

They should treat password-protected archives with caution, especially when the password is included in the email. Showing file extensions on Windows devices will make it easier to spot executables masquerading as videos or documents, and multi-factor authentication (MFA) should be used wherever possible.

Elsewhere, the company urged small businesses to ensure staff are trained to help spot tell-tale signs that communications are fraudulent.

"Small businesses are often viewed as easier targets than large enterprises," the researchers warned.

"Many operate without dedicated IT teams or cybersecurity staff. Security responsibilities are often shared among employees who already wear multiple hats, and limited budgets can make it difficult to invest in advanced security measures or ongoing training."

FOLLOW US ON SOCIAL MEDIA

Opera has started to block ClickFix-style attacks in the browser by blocking malicious clipboard copy-and-paste techniques.

ClickFix pairs social engineering with a malicious code injection attack by fooling users into clicking a link, such as a fake CAPTCHA or similar familiar popup, starting a string of events that could compromise the device.

Opera cited a report by Huntress showing that ClickFix-style social engineering attacks make up 53% of all malware loader activity worldwide, underlining the scale of the threats faced by web users.

Last year, Proofpoint warned that state-sponsored hackers were turning to ClickFix techniques to target governments in particular.

To help battle that, Opera has introduced Paste Protect, a browser-native feature designed to prevent such attacks by stopping malicious code from being copied onto the clipboard, and notifying users when that happens.

"This means that if you’re accessing a website that is trying to copy something potentially harmful into your clipboard (or luring you into doing so), Opera will detect it, prevent it, and let you know about it," the company said in a blog post.

Opera said it is the first major browser to add this level of protection, though Microsoft Defender does notify users of ClickFix landing pages and there are extensions that do a similar job.

"Opera had already been protecting users from paste hijacking for half a decade — it made sense to expand that protection to address one of the most increasingly serious online threats," said Mohamed Salah, Senior Director of Product at Opera.

"Paste Protect gives your browser a robust early warning system that can alert less experienced users while still enabling more control for more tech-savvy users or developers."

The rise of ClickFix

ClickFix attacks work by fooling a user into clicking a box on a malicious popup, often by pretending to be a CAPTCHA or a "verify you're a human" box. That lets the dodgy website copy to the clipboard and open another window.

"When this prompt appears, the website has already 'copied' something to your clipboard, and now it instructs you to open the Windows Run dialog box (Win+R), then use 'Ctrl + V' to paste the malicious code, and then click 'OK'," the blog post noted. "This would execute the code and compromise your device, and the data on it."

Instead, Opera's Paste Protect examines the content being copied, and if concerned, blocks the code from being copied to the clipboard and notifies the user. They can then close the window without interacting.

"ClickFix attacks succeed because they turn the user into the weapon," said Pawel Kurzelewski, Head of Security at Opera.

"The clipboard is the last point before a malicious command is run, so that's where we built our defense. With Paste Protect, we're stopping these attacks at the exact moment they would normally succeed."

The Paste Protect system does mean that the Opera browser is scanning everything copied to the clipboard for potential threats or harmful commands. When those are spotted, the system displays a red warning icon.

Websites can be individually approved to circumvent these warnings if safe, and users can still check to see if a mistake has been made.

FOLLOW US ON SOCIAL MEDIA

Network Rail is fighting off millions of cyber attacks every month, according to new research, as experts warn of a rising tide of threats facing public services.

Freedom of information (FoI) requests show the organization blocked over 7.1 million malicious emails between December 2025 and March this year.

Of the 7,129,314 email attacks blocked by Network Rail, 331,352 were phishing emails, 1,412 were malware-laden emails, 2,066,392 were spam emails, and 4,730,158 were edge blocked emails.

This all adds up to an average of more than 800,000 attacks per day, including around 37,000 phishing attempts.

“With so many people in the UK depending on public transport for their daily lives, a successful cyber attack could cause significant disruption, such as potentially stopping people from getting to work," warned Simon Edwards, CEO of SE Labs.

"Therefore, it’s vital that our public sector organizations have a dedicated cyber strategy put in place and ensure rigorous testing to identify any security holes and keep hackers at bay.”

Just last week, two members of the hacking group known as Scattered Spider pleaded guilty over their involvement in an attack on Transport for London (TfL) systems.

The attack forced all 28,000 employees to attend a TfL office for a password reset and led to a reported £29 million in losses and recovery costs.

"As we've seen from the recent Scattered Spider convictions, hacking groups have the transport network firmly in their sights. A single successful cyber attack on the rail network could drive Britain to a halt, operationally and economically," said Graeme Stewart, head of public sector at Check Point.

"The transport network is also a treasure trove of personal and financial data, something unscrupulous criminals are eager to get their hands on. That’s why it's vital that our roads, rail and aviation systems are fully protected with the latest cyber defenses to keep hackers locked out."

What happened with the Network Rail cyber attack?

In 2024, Network Rail suffered a cyber attack on its WiFi systems that saw commuters who logged in at affected stations receive information pertaining to terrorist attacks in Europe, as well as a message stating “we love you Europe”.

The attack is believed to have taken place through a third-party service provider, Telent, which managed Network Rail's WiFi services.

More recently, train operator LNER said a cyber attack had led to unauthorized access to files managed by an unnamed third-party supplier.

Travel networks, particularly rail services, are among the top targets for cyber criminals and state-sponsored groups due to the critical role they play in the British economy, according to research conducted last year.

The UK's Department for Science, Innovation and Technology (DSIT) released a report from KPMG that concluded a major attack on the rail network could cost £1.8 billion for a one-week period of disruption.

The direct financial cost to Network Rail would, it concluded, cost around £123 million, with the cost to passengers due to delays adding up to about £281.3 million.

Notably, the impact on Gross Value Added (GVA) could be as much as £1.397 billion, representing approximately 2.8% of the UK’s weekly GDP and 0.05% of annual GDP.

FOLLOW US ON SOCIAL MEDIA

Europol has taken down the criminal networks behind the SocGholish, Amadey, and StealC malware strains as part of an operation involving Microsoft and a host of security firms.

The latest move in Operation Endgame, the action saw 326 servers and 142 domains neutralized, as well as 27 million compromised data sets recovered. More than €41 million in criminal crypto assets were seized, the agency revealed.

"By taking down these tools simultaneously, the collaboration between law enforcement and private parties has increased friction for cyber criminals, making it harder for attacks to succeed, spread, or recover," said Europol.

"This operation marked a shift in strategy: instead of focusing solely on individual threats, Europol, law enforcement and judicial authorities, as well as private industry partners disrupted the entire chain that allows cyber attacks to scale."

In the first two weeks of May alone, more than 140,000 PCs globally were infected with one of the three cybercrime as a service malware strains, which were used as a tool for the initial infection of targeted systems.

SocGholish, a so-called dropper/loader, helped criminals gain access to computer systems by distributing fake browser updates via compromised websites. This works by hacking websites built with WordPress and infecting them with malware for digital extortion.

The malware strain is linked to the Russian cyber criminal group Evil Corp, the group behind the Zeus and Dridex malware and associated with several large‑scale ransomware and money laundering operations.

StealC, a stealer with dropper function, was spread in a variety of ways, and is designed to extract sensitive information such as passwords, stored access data, and digital identities from compromised computers for data trading and fraudulent use.

Meanwhile, the Amadey dropper/loader is spread mostly through phishing campaigns, introducing extra malware into compromised systems and retrieving sensitive data.

RICO legislation used in Amadey, StealIC takedowns

Amadey and StealC were targeted by Microsoft’s Digital Crimes Unit (DCU) as a pair, thanks to their interconnected roles – although they were developed by separate cyber criminals, they relied on the same infrastructure.

Both were shut down through a mix of court orders, domain seizures, registrations, and provider notifications.

This action involved a broader use of the Racketeer Influenced and Corrupt Organizations Act (RICO), a US law designed to target organized crime.

Steven Masada, assistant general counsel in Microsoft’s Digital Crimes Unit, said investigators relied on AI tools, particularly Copilot, as part of the operation, using the technology to analyze malware strains.

"That helped surface key details, uncover hidden data, and test findings in a fraction of the time, turning what would have taken hours or days into minutes and enabling the team to spot connections faster," he said.

"Those insights allowed the legal team to treat both malware families as part of a single conspiracy. Instead of going after each tool separately, as we have done in the past, we used RICO to charge multiple complicit enablers involved across the operation."

The action against SocGholis involved cleaning infected WordPress sites and notifying victims, urging them to update their platforms and strengthen login credentials.

WordPress users are being encouraged to change their login credentials, enable multi‑factor authentication, delete any unknown additional WordPress accounts and keep their WordPress site up to date in the future.

FOLLOW US ON SOCIAL MEDIA

Security firms are warning that self-replicating malware known as Miasma has spread to 73 Microsoft GitHub repos across environments, including Microsoft Azure and Durable Task.

Miasma is a new and improved variant of Mini Shai-Hulud from the threat group TeamPCP, and, according to Cloudsmith, initially struck the @redhat-cloud-services npm namespace by compromising a Red Hat employee’s GitHub account.

"By pushing unreviewed orphan commits to internal repos, the threat actors injected a minimal workflow that requested GitHub’s OIDC tokens. This registry poisoning workflow in early June executed an obfuscated payload that published 32 malicious package versions to the npm registry," said the firm.

"Crucially, because it used legitimate OIDC tokens, the malicious releases carried valid SLSA provenance attestations. To standard registry scanners, the malicious updates were entirely indistinguishable from legitimate, routine code updates."

It's not known how many times the affected tools have been downloaded, but Microsoft said it's notified a 'small number' of customers who may have done so.

Under the hood of Miasma malware

What's special about the Miasma worm, said Cloudsmith, is that it doesn't exploit any software vulnerability in GitHub or npm, but instead exploits the underlying trust model of the modern engineering ecosystem.

Compromised developer credentials led to a legitimate GitHub OIDC token being requested, followed by a malicious build being published with valid SLSA provenance.

This ultimately led to conventional scanners seeing it as a routine trusted update.

On top of this, because Miasma generates a uniquely encrypted payload for each individual infection, traditional hash-based IOCs are functionally useless for broad detection, as the file signature changes with every single package version.

"While previous iterations of the Mini Shai-Hulud malware have focused purely on local secret scraping, the Miasma worm appears to have advanced data collectors specifically engineered for cloud identities in GCP and Azure," the researchers said.

"It attempts to harvest every cloud identity the infected developer machine and CI/CD runners have access to, proving a clear intent from the threat actors to leverage access away from the codebase and directly into live cloud environments."

How to protect your organization

If your company operates within the Azure or Red Hat ecosystems, Cloudsmith said to assume secrets exposure and rotate.

Miasma specifically hunts for developer credentials, meaning that everything on a compromised machine or CI/CD pipeline may have been been leaked.

"Developers are high-value targets because they sit at the intersection of source code, cloud infrastructure, AI platforms and production systems. Compromising a trusted package or development workflow can give attackers access that is far harder to obtain through traditional intrusion methods," commented Ilkka Turunen, field CTO at Sonatype.

With this incident having reached users of platforms such as Claude and Gemini, Turunen noted it shows how "interconnected modern software ecosystems have become" and should serve as a warning.

"An attack that begins with a seemingly insignificant open source package can quickly cascade across organizations, platforms and users," Turunen commented. "Organizations need to treat the software supply chain as part of their security perimeter. The attackers already do.”

FOLLOW US ON SOCIAL MEDIA

A fake Claude AI website is spreading a trojanized 'Claude‑Pro' Windows installer that secretly distributes a newly-identified backdoor.

The domain mimics the official site for Anthropic’s Claude AI tool, and visitors who download the ZIP archive are sent a copy of Claude that appears to install and runs as expected.

However, researchers at Malwarebytes found it deploys a PlugX-like malware chain, dubbed Beagle, that gives attackers remote access to the system.

The ZIP contains an MSI installer that installs to a path designed to mimic a legitimate Anthropic installation, complete with a reference to Squirrel, the update framework that real Electron-based applications like Claude use.

A tell-tale giveaway for developers is that this contains a misspelling: ‘Cluade’.

While the legitimate application runs in the foreground, the VBScript quietly copies three files from the SquirrelTemp directory into the Windows Startup folder.

"This is a textbook DLL sideloading attack, a technique catalogued by MITRE as T1574.002. NOVUpdate.exe is a legitimately signed G DATA antivirus updater. When it executes, it attempts to load a library called avk.dll from its own directory," researchers explained..

"Normally, this would be a genuine G DATA component, but here the attacker has substituted a malicious version. Signed sideloading hosts like this can complicate detection because the parent executable may appear benign to endpoint security tools.

Victims are kept in the dark, because after deploying the payload files, the VBScript writes a small batch file called ~del.vbs.bat that waits two seconds, then deletes both the original VBScript and the batch file itself.

"This means the dropper is gone from disk by the time a user or analyst goes looking for it. The only artifacts that persist are the sideloading files in the Startup folder and the running NOVUpdate.exe process," Malwarebytes said.

"The script also wraps the entire malicious payload section in an On Error Resume Next statement, silently swallowing any errors so that failures in the deployment do not produce visible error dialogs that might alert the victim."

What is DLL sideloading?

DLL sideloading is a technique favored by PlugX, a malware family that Sophos has been tracking for 14 years.

As the firm points out, PlugX has multiple variants and has been associated with several threat actor groups, meaning that attribution isn't clear-cut.

On top of this, ShadowPad, another backdoor employing DLL sideloading, has a number of code overlaps with PlugX, to the extent that it could be considered an evolution of it.

"Most of the techniques described here are relatively well known and have been seen before, from spoofing a legitimate installer website to side loading using a signed executable. Interestingly enough what is unusual is that it also installs a working copy of Claude which is rather large," said Max Gannon, cyber intelligence team manager at Cofense.

"The installation and usage of a program that is resource intensive can also help to disguise other ongoing background activity. The use of a legitimate program, cleanup utilities, running in memory, and persistence mechanisms all indicate that the threat actors distributing this malware intend it for long term persistence and use."

FOLLOW US ON SOCIAL MEDIA

North Korean hackers are targeting software developers in a new malware campaign that uses a fake interview process to steal cryptocurrency.

The campaign targets developers, especially those in the finance and technology industries, with profiles on freelance websites such as Upwork or Fiverr. It offers well-paid job opportunities and targets specific, high-value individuals.

It uses typosquatting or compromised legitimate npm repositories that victims are persuaded to inadvertently download and execute.

Researchers at the Sophos Counter Threat Unit have attributed the campaign to Nickel Alley, a threat group operating on behalf of the North Korean government.

"The group notoriously targets professionals in the technology sector by advertising fake job opportunities, deceiving prospective candidates through a fake job interview process, and ultimately delivering malware," the company said in an advisory.

As part of its attacks, Nickel Alley often creates a fake LinkedIn company page to build credibility, with a coordinating GitHub account for malware delivery.

The website homepage is generic and advertises 'tech talent' and managed service solutions. However, different domains are included on the LinkedIn company page and the GitHub account – which researchers noted shows inconsistency and lack of attention to detail.

Nickel Alley ramping up operations

The advisory from Sophos comes after a June 2025 X post warned of a campaign involving targeted emails promoting job opportunities at the fake Astra Byte Sync company.

The threat actors hadn't actually built the website at the time the emails were sent, meaning that the site simply displayed the hosting provider’s default page.

Over the last year, the group has used the popular ClickFix tactic to deliver PyLangGhost RAT malware via fake job skills assessment tasks.

This involved the attacker-controlled web interface presenting an error informing the victim that they must run a command locally to fix the issue – a command that instead initiated a series of actions leading to PyLangGhost RAT.

It previously used a GoLang-based version known as GoLangGhost RAT.

Meanwhile, in October, Sophos analysts uncovered a targeted attack where the threat actors convinced a victim to download, or clone, the content of a GitHub repository and execute the code locally using the 'npm install' and 'npm start' commands.

The GitHub account masquerades as a software development company specializing in full stack web development and blockchain solutions, and contains links to an 'official' company website and a fake LinkedIn company page.

While the main aim of these attacks appears to be cryptocurrency theft, Sophos said the threat group has also made it clear that it plans to use initial access for further supply chain compromise or corporate espionage.

"Additionally, the threat group has strategically selected follow-on payloads based on profiling victims’ system. Software developers, especially those in the finance and technology industries, are at elevated risk due to Nickel Alley’s targeting profile," Sophos warned.

"Organizations should monitor command execution and network traffic that spawns from Node.js processes, as it may indicate malware retrieval. As a general security practice, organizations should encourage employees to report suspicious unsolicited social media or email-based recruitment contact."

FOLLOW US ON SOCIAL MEDIA

Attackers have compromised the npm account of Axios and published malicious versions to spread remote access trojans (RATs) to millions of developers.

Axios is a JavaScript HTTP client and is one of the most popular packages on npm, with more than 100 million weekly downloads. It manages requests between clients, such as browsers or Node.js apps, and servers.

On Monday, two malicious updates, axios@1.14.1 and axios@0.30.3, were published, apparently through the compromise of the npm account of axios’ primary maintainer Jason Saayman.

The updates were identified almost immediately by several security firms and remained live for around two or three hours. The malicious versions introduce a dependency that executes during installation and deploys a cross‑platform remote access trojan (RAT) targeting macOS, Windows, and Linux.

The malware communicates with a command and control (C2) server to retrieve platform‑specific second‑stage payloads, researchers noted. After execution, it deletes itself and replaces its own package.json with a clean version to evade forensic detection.

According to StepSecurity, the malicious dependency was staged 18 hours in advance, with separate payloads pre-built for all three operating systems. Both release branches were poisoned within 39 minutes of each other.

StepSecurity added that within two seconds of npm install, the malware was already calling home to the attacker's server before npm had even finished resolving dependencies -– making this one of the most operationally-sophisticated supply chain attacks ever documented against a top-10 npm package.

Because there were no git tags, any manual audit of the GitHub repo would have failed to show anything was wrong.

Axios npm incident highlights supply chain dangers

Ilkka Turunen, field CTO at Sonatype, said the latest npm-related incident highlights the growing dangers faced by developers globally, with threat actors ramping up attacks.

“Attackers have figured out they don’t need to compromise the code people trust if they can compromise the trust around it," Turunen said.

"In this case, the malicious capability was introduced through a staged dependency and designed to erase its own tracks, which made the attack harder to spot and slower to understand. That’s not just malware — it shows a more deliberate and mature playbook."

Anyone who installed either version before the takedown should assume their system is compromised and is advised to immediately quarantine hosts, implement their full incident response playbook, and rotate all exposed secrets.

It's not known who is responsible for the compromise, although many researchers are throwing suspicion on a North Korean actor known as UNC1069 that focuses on stealing cryptocurrency via centralized exchanges (CEX), software developers at financial institutions, tech firms, and venture capital funds.

The supply chain attack marks the latest in a string of attempts to exploit trust in open source ecosystems, according to Upwind security researcher Avital Harel.

"The build pipeline is becoming the new frontline. Attackers know that if they can compromise the systems that build and distribute software, they can inherit trust at scale," Harel commented.

"Organizations should be looking much more closely at CI/CD systems, package dependencies, and developer environments, because that’s increasingly where attackers are placing their bets."

FOLLOW US ON SOCIAL MEDIA

Security experts have warned that the cyber attack on Stryker signals a step change in politically-motivated attacks, with a particular focus on destruction rather than extortion.

Operations at the medical technology firm have been severely impacted in a cyber attack claimed by Iranian-linked threat group, Handala. The group claims to have wiped thousands of systems across the company’s global operations and stolen around 50 terabytes of data.

“In this operation, over 200,000 systems, servers, and mobile devices have been wiped and 50 terabytes of critical data have been extracted,” the group claimed in a statement online.

Stryker develops a range of products, including surgical equipment, neurotechnology, and orthopedic implants, with offices in 79 countries and over 50,000 employees worldwide.

The impact of the attack has been felt globally, with reports suggesting operations in Ireland have been severely disrupted.

Stryker employs around 4,000 employees in Cork, which the company describes as its “biggest innovation and manufacturing hub outside the US”.

"Nobody can work,” a source told the Irish Mirror. “The entire company has been brought to a standstill”

Stryker confirms attack

Stryker has confirmed it is dealing with “global network disruption” across its Microsoft environment, which is believed to be the entry point for the group.

One employee told BleepingComputer that staff have been ordered to remove work-related applications from personal devices, in particular the company portal for mobile device management software Microsoft Intune and Microsoft Teams.

Targeting of Microsoft products is a common tactic for Handala, which has been active since at least December 2023.

A 2024 threat intelligence report from Cisco Talos and Splunk’s Threat Research Team specifically highlighted the group’s activities on this front, typically using “wiper” malware to destroy company data.

“The Handala Hacking Team is notable for employing a wide range of sophisticated tactics and techniques, including data theft, phishing extortion, website defacement, and destructive attacks leveraging custom wiper malware that targets Windows and Linux environments,” the duo said in a blog post.

“The target matters”

Stryker noted in its statement that there’s “no indication of ransomware” involved in the attack. However, this aspect of the attack provides an insight into the underlying motivations, according to Huntress CISO Chris Henderson.

In this instance, the attack is “destructive, not ransomware” and is a politically-motivated attack aimed solely at causing widespread disruption.

“The target matters. Stryker manufactures critical medical devices used in operating rooms and ICUs worldwide,” Henderson said.

“When a supplier of this scale goes offline, it doesn't just impact their employees; it creates ripple effects across hospitals, surgical centers, and healthcare providers who depend on their equipment and support infrastructure.”

Skip Sorrells, Field CTO-CISO at Claroty, echoed Henderson’s comments, noting that even prior to the Iran conflict hacktivist activities have been ramping up globally.

Security agencies including CISA and the UK's National Cyber Security Centre (NCSC) have issued repeated warnings over the rise of hacktivist groups over the last two years.

In particular, pro-Russian hacktivist groups identified by the NCSC were found to be targeting local government agencies and critical infrastructure. Critical sectors like healthcare are now firmly in the crosshairs, according to Sorrells.

“Attacks like this unfortunately aren’t surprising,” he said. “Even before the latest geopolitical tensions, hacktivist activity targeting healthcare and other critical infrastructure had been steadily increasing, and that trend makes organizations like medical device manufacturers and hospitals more likely to be caught in the crossfire.”

FOLLOW US ON SOCIAL MEDIA

Malware targeting Asus routers has built a botnet of 14,000 devices to spread malicious traffic, according to researchers at Lumen's Black Lotus Labs.

Dubbed "KadNap", the malware was first spotted in August 2025, with 60% of the infected devices located in the US, with others spotted in the UK, across Europe, and Australia, among others. Alongside Asus routers, the malware is also targeting edge networking devices.

KadNap slips by existing network protections using the Kademlia distributed hash table (DHT) designed for peer-to-peer networks like BitTorrent to hide its own originating IP address.

"Infected devices use the DHT protocol to locate and connect with a command-and-control (C2) server, while defenders cannot easily find and add those C2s to threat lists," the researchers at Black Lotus Labs said in a blog post.

“In short, the innovative use of the DHT protocol allows the malware to establish robust communication channels that are difficult to disrupt by hiding in the noise of legitimate peer-to-peer traffic."

Access to that network is then sold via a proxy service called "Doppelganger" to be used for criminal activity, researchers added.

"KadNap’s bots are sold through Doppelganger, a service whose users leverage these hijacked devices for a range of malicious purposes, including brute-force attacks and highly targeted exploitation campaigns," researchers said.

"As a result, every IP address associated with this botnet represents a significant, persistent risk to organizations and individuals alike."

ITPro contacted Asus for comment, but did not receive a response by time of publication.

Spotting KadNap

This particular botnet-building malware was spotted last summer by a Lumen algorithm that searches out dodgy networks as they pop up, with the company noticing 10,000 Asus devices all communicating with one set of servers.

Once the malicious file was on the router or other IoT or edge hardware, it would download a shell script and start the process of adding the kit to the botnet.

To hide, KadNap makes use of a legitimate distributed hash table known as Kademlia, which was designed to make it easier to find information across peers.

"To better understand this system, think of Kademlia like using a chain of friends to find someone’s phone number: each friend does not know the whole number but knows someone who can get you closer to the answer," the researchers explained.

"Passing your request along this chain, you quickly put together the whole phone number. Likewise, Kademlia nodes forward queries to others that are 'closer' to the target, enabling fast and efficient searches without knowing the whole network."

KadNap uses a custom version of the DHT to hide the IP address of the criminal's command and control server. That allows a newly infected router to find and connect to previously infected nodes to share additional payloads and build a bot network.

"The KadNap botnet stands out among others that support anonymous proxies in its use of a peer-to-peer network for decentralized control," the researchers said. "Their intention is clear: avoid detection and make it difficult for defenders to protect against."

What can enterprises do?

Lumen said its own customers have been protected from these attacks since last August, and that it would share indicators of compromise (IoC) publicly so others could be protected as well.

Beyond that, the lab advised security professionals working on network defense to keep watch for attacks on weak credentials or suspicious logins, even if they seem to come from safe IP addresses.

Additional advice includes protecting cloud assets from communicating with bots and make use of Web Application Firewalls.

Regarding KadNap specifically, it's worth checking if devices aren't connecting to public BitTorrent trackers.

For users of small office or home office (SOHO) routers, Lumen advice includes:

• Ensuring routers are patched, updated, and rebooted regularly
• Bolstering password security
• Replacing outdated or unsupported devices

FOLLOW US ON SOCIAL MEDIA

While much emphasis has been placed on the rise of youth cyber crime over the last two years, new research shows hacker activity peaks much later.

Orange Cyberdefense looked at the numbers and found that it's actually thirty- and forty-somethings that are the greatest threat.

The company’s intelligence team analyzed 418 publicly announced law enforcement activities between 2021 and mid-2025 and found that offenders’ activities peaked between the ages of 35 and 44. This age group, they said, accounted for 37% of cyber crime cases.

Put together, the combined age groups of 25-to-44 make up well over half (58%) of analyzed cyber crime cases.

Only one-in-five (21%) incidents were the work of 18-to-24-year-olds. Despite the bad press they get in movies and the news, 12-to-17s were behind fewer than 5% of cases.

“The surge in cyber offences committed by teenagers in recent years may be creating a false impression of the age of today's cyber criminals," said Charl van der Walt, head of security research at Orange Cyberdefense.

"The sensationalist interpretation of cyber crime's youthfulness makes for a good headline, but these findings appear to tell a different story."

Differing motives

One big difference between the kids and their elders is the underlying motivation behind attacks, researchers noted. As you might expect, younger hackers are frequently experimenting while the older cohort is in it primarily for financial gain.

Among 18-24-year-olds, cyber criminal activity is highly diverse, though there's a focus on hacking (30%) in particular, followed by selling stolen data and DDoS attacks (10% each).

Things start to change among offenders aged between 25 and 34, who tend to focus on more profitable activities such as selling stolen data (21%), cyber extortion (14%) and malware deployment (12%).

This trend continues among 35-to-44 year olds, where cyber extortion (22%) is the crime of choice, followed by malware (19%) and cyber espionage (13%), hacking (10%), and money laundering (7%).

"While younger, less experienced hackers engage in highly diverse – and often noticed and reported – actions, they may be less likely to engage in calculated, profit seeking activity," said van der Walt.

"Instead, cyber crime careers appear to peak much later into adulthood, accompanied by vastly more sophisticated and intentional techniques.”

Some of those teen-related activities are very high profile indeed. Late last year, for example, a 15-year-old was outed by security researcher Brian Krebs as a member of Scattered LAPSUS$ Hunters – the group responsible for the Jaguar Land Rover (JLR) and M&S cyber attacks.

Two teenagers, meanwhile, are set to face charges for the 2024 hack of Transport for London (TfL), while another pair have been arrested for the data breach of the Kido chain of children's nurseries.

FOLLOW US ON SOCIAL MEDIA

Cyber criminals are using “modular malware components” to create custom campaigns and speed up attacks, according to new research from HP.

Findings from HP Wolf Security's latest Threat Insights Report show hackers are combining off-the-shelf malware components, usually purchased via cyber crime forums, to wage attacks against enterprises globally.

Researchers at the firm noted that while early-stage lures and final payloads typically change, attackers are “reusing the same intermediate scripts and installers”.

This means that threat actors are able to build, customize, and scale campaigns with little effort and at a rapid pace – and it’s a trend that’s gaining traction. HP said it has observed multiple unrelated groups using the same basic building blocks in several campaigns.

The emergence of this ‘flat-pack’ malware trend aligns closely with the increased use of AI among threat actors, according to HP. Findings from the Threat Insights Report show attackers are also using AI to automate malware delivery as part of a focus on ‘vibe-hacking’ techniques.

In one example cited by the company, threat actors used AI to create a fake invoice PDF which triggered a silent download from a compromised site. Thereafter, this redirected unsuspecting users to trusted platforms such as Booking.com to curb their suspicions.

Alex Holland, principal threat researcher at HP Security Lab, said the increased use of AI in malware operations, combined with the focus on ‘flat-pack’ components, shows threat actors are prioritizing faster attacks and cheaper costs.

“It’s the classic project management triangle - speed, quality, and cost,” he said. “You often sacrifice one of them. What we’re seeing is many attackers are optimizing for speed and cost, not quality.”

“They are not using AI to raise the bar; they’re using it to move faster and reduce effort.”

Holland further warned that although these campaigns are often basic in nature, the “uncomfortable reality is they still work”.

AI malware is taking off

The HP research comes in the wake of repeated warnings over the use of AI to build and fine-tune malware. As ITPro reported last month, research from Zscaler shows hackers are leveraging the technology to create more potent malware strains.

Google also warned that threat actors were found abusing its Gemini AI models to build malware in early February.

The use of AI in this instance also goes beyond building malware, however, with the technology also used during the early research and development stages.

Analysis from Trend Micro in September 2025 warned that hackers were ‘vibe coding’ malware by using AI to dissect publicly available threat intelligence reports.

This, Trend Micro noted, allowed threat actors to essentially reverse engineer malware strains based on technical blogs from industry stakeholders, create “partial malicious” code, and even mimic other group’s TTPs.

Ian Pratt, global head of security for personal systems at HP, said the firm’s research highlights the significant risks now posed by threat actors using AI.

“When attackers can generate and repackage malware in minutes, detection-based defences can’t keep up,” he said. “Instead of trying to spot every variant, organizations need to reduce exposure.”

Reducing exposure in this sense can be as simple as “containing high-risk activities” such as warning staff not to open untrusted attachments or clicking unknown links - typical advice given by most enterprises yet often still the source of breaches.

Separate analysis from the firm showed 14% of email threats identified by HP Sure Click bypassed one or more email gateway scanners, underlining the increasing success rates of threat actors.

FOLLOW US ON SOCIAL MEDIA

Attack surfaces are expanding at a rapid pace thanks to enterprise AI adoption, according to research from Zscaler, and it’s placing huge strain on cybersecurity teams.

Findings from Zscaler ThreatLabz’ 2026 AI Security Report show enterprises now face a confluence of threats. The rise of ‘shadow AI’ combined with machine-speed intrusions and the use of AI among threat actors means time-to-compromise is plunging.

Deepen Desai, former CSO at Zscaler and head of security research at the ThreatLabz division, told ITPro the first of these issues is a natural byproduct of the industry’s rapid pivot to AI over the last three and a half years.

Employees have been experimenting with exciting new tools for some time now, often without considering the potential security risks associated with unauthorized AI solutions.

This creates a huge blind spot for enterprise security teams and creates the risk of disastrous data leakage. Research from Gartner in November 2025 projected up to 40% of enterprises globally will experience a shadow AI-related breach by 2030, underlining the growing risks associated with this trend.

This is an issue that can be remedied by robust internal guardrails, however. It's the use of AI by threat actors that has alarm bells ringing for Desai and counterparts across the industry.

Hackers have already been observed using the technology to fine-tune phishing and vishing attacks, for example, but in recent months they’ve begun flocking to these tools to build and refine malware.

“It all started with phishing and vishing and their standard initial access attacks, where their goal is just to compromise a credential or an identity,” he told ITPro.

“But soon we also started noticing malware created using AI, and we are able to tell that because when we reverse those payloads, we're able to see the comments that a lot of these AI coding tools will add, which is very, very typical.”

Desai highlighted one recent incident observed by Zscaler in which AI-powered malware was connected to a Google Sheets document to support the attacker when executing commands.

“The malware that was deployed in this victim's environment would connect to a Google Sheet, which had two columns in it,” he explained.

“One column where the attacker is entering commands that this malware needs to execute on the victim environment, and the second column where the malware will update the results of what came out when it ran these commands.”

“Whether it was for data exfiltration, whether it is for downloading a new payload or giving that context for the attacker to perform future commands, it was literally being updated every few minutes,” Desai added.

Concerns about AI-powered malware have been gaining momentum over the last 18 months, with security experts warning hackers are increasingly relying on the technology to build potent new strains.

Research from TrendMicro in September 2025 found threat actors are “vibe coding” malware based on dissected threat intelligence reports, allowing them to reverse engineer particular strains and speed up attacks.

Similarly, just last week Google warned hackers have been abusing its Gemini AI models to build malware.

Speedier attacks are raising concerns

The use of AI in these instances is helping to speed up attacks, Desai told ITPro, posing huge challenges for security teams. Combine this with the fact that many of the AI systems used by enterprises are highly susceptible to compromise, and teams now face overlapping security considerations.

Analysis from the company found many enterprise AI systems “break almost immediately” when tested under adversarial conditions. The median time to first critical failure, for example, was just 16 minutes, and 90% of systems were compromised in under 90 minutes.

“They are able to move fast now because of the same efficiencies that we’re seeing on the production side,” Desai told ITPro, adding that security teams will likely find themselves fighting off AI-powered attacks with their own internal tools in the near future.

“You have to use AI to fight AI driven attacks,” he said. “You need to apply AI at all stages of the attack to detect phishing, to detect malware, to detect exfiltration, to detect command and control activity.”

FOLLOW US ON SOCIAL MEDIA

State-backed threat actors from CRINK nations have come to rely on large language models (LLMs) as “essential tools” for researching and targeting victims, according to a new report.

The latest AI Threat Tracker report from Google Threat Intelligence Group (GTIG), produced in collaboration with Google DeepMind, details the numerous ways threat groups are already using AI to plan and carry out attacks.

Advanced persistent threat (APT) groups were tracked using Google’s own Gemini family of models to conduct targeted research on potential victims, probe vulnerabilities, and create tailored code and scripts.

For example, the China-based APT Temp.HEX was found using Gemini to file information on individual targets in Pakistan.

The as-yet-unattributed APT UNC6148 also used Gemini to seek out sensitive information tied to victims, such as email addresses and account details, as the first step in a targeted phishing campaign on Ukraine and the wider defense sector.

In response, Google disabled the assets associated with both groups. Other incidents saw attackers use public AI models to more directly fuel attack campaigns.

Iranian-backed groups such as APT42 were observed using Gemini and other AI models to research potential victims, then craft convincing phishing emails based on target biographies.

That same group was observed using Gemini to translate local languages as well as regional references and phrases.

North Korea-backed groups seized headlines throughout 2024 and 2025, as hackers infiltrated IT departments of major organizations including KnowBe4 with fake addresses and identities.

In the report, the North Korean-backed group UNC2970 was found using Gemini to plan attacks on cybersecurity defense companies and map job specifications.

AI-enhanced malware is gathering steam

The report also noted the growing risk presented by malware that uses AI to achieve novel capabilities such as preventing network detection.

HONESTCUE malware, for example, has been found to use API calls to Gemini to generate ‘stage two’ code. This is used to download and execute additional malware directly in the memory of target systems using CSharpCodeProvider, a legitimate .NET class for executing C# code.

Because the Gemini-produced code executes the secondary malware directly in memory, HONESTCUE infects target systems without leaving telltale artifacts on the victim’s disk.

Though the malware hasn’t been linked to specific attack campaigns to date, GTIG researchers said they believe its developer is a single threat actor or small group testing the waters for future attacks. This is backed up by evidence HONESTCUE has been tested on Discord.

Another example can be found in COINBAIT, a phishing kit created by the APT UNC5356 that shows signs of having been created using the vibe coding platform Lovable.

GTIG has previously warned that while AI malware is still nascent, it’s developing quickly. In the latest report, authors noted that while no “paradigm shift” has yet been unlocked by APTs, their exploration of malicious AI is ongoing and the technology will play a growing role in every stage of the attack lifecycle.

On the other hand, researchers discovered that threat actors are passing off jailbroken public AI models as handmade offensive tools.

For example ‘Xantharox’, a dark web toolkit advertised as tailor-made offensive AI toolset, is actually powered by open source AI tools such as Crush and Hexstrike AI via model context protocol (MCP), as well as public AI models like Gemini.

Threat actors are stealing API keys to enable this hidden activity, with GTIG warning organizations with cloud and AI resources are at risk. Users on platforms such as One API and New API, often those in countries with regional AI censorship, are also targeted for API key harvesting.

Model extraction puts AI developers at risk

Researchers also observed instances of APTs performing ‘model extraction’, in which attackers use legitimate access to frontier models such as Gemini to help train new AI and machine learning (ML) models.

Generally, attackers use an approach known as knowledge distillation (KD) in which a ‘student’ AI model is trained on the answers to specific questions based on the exemplar answers of the pre-existing AI model.

This can result in models with advanced capabilities such as frontier reasoning but none of the guardrails present in public AI models like Gemini. In the future, threat actors could then use

GTIG tracked over 100,000 prompts intended to expose and replicate Gemini’s reasoning capabilities in non-English languages, which were automatically counteracted by Google’s systems.

“Google’s latest AI Threat Tracker marks a specific turning point: we are no longer just worried about bad prompts, but the industrial-scale extraction of the models themselves,” wrote Jamie Collier, lead advisor in Europe at Google Threat Intelligence Group, in a LinkedIn post marking the launch of the report.

Google DeepMind and GTIG blocked attempts at model extraction throughout 2025, noting that the attacks were launched by private companies and researchers around the world rather than APTs.

Distilling secondary models from Gemini is a violation of Google’s terms of service and is considered theft of intellectual property (IP). The hyperscaler recommended organizations that provide AI models as a service should closely observe API access for signs of model extraction.

FOLLOW US ON SOCIAL MEDIA

The Cybersecurity and Infrastructure Security Agency (CISA) is warning that China-sponsored threat actors are using Brickstorm malware to achieve long-term persistence in critical infrastructure networks.

Brickstorm is a custom Executable and Linkable Format (ELF) Go-based backdoor that allows attackers to maintain stealthy access and provide capabilities for initiation, persistence, and secure command and control (C2).

It initiates by running checks, and maintains persistence by using a self-watching function, automatically reinstalling or restarting if disrupted.

For C2, Brickstorm uses multiple layers of encryption - HTTPS, WebSockets and nested Transport Layer Security (TLS) - to hide its communications with the cyber actors’ C2 server.

CISA warned it also uses DNS-over-HTTPS (DoH) and mimics web server functionality to blend its communications with legitimate traffic.

For remote system control, it gives cyber actors interactive shell access on the system and allows them to browse, upload, download, create, delete, and manipulate files.

Meanwhile, some samples act as a SOCKS proxy, facilitating lateral movement and allowing cyber actors to compromise additional systems.

Jon Baker, VP of threat-informed defense at AttackIQ, warned Brickstorm "excels at remaining undetected within networks"..

"The malware runs continuous health checks on itself, allowing it to reinstall and restart if tampered with, ensuring its continued operation," Baker explained. "All of this comes together to create a stealthy and resilient malware that can spread across networks and remotely take over entire systems."

Brickstorm malware used to target government, IT sectors

CISA warned China-linked threat actors are using the malware strain to target VMware vSphere platforms, mainly in the government and IT sectors. Once compromised, they can use their access to the vCenter management console to steal cloned virtual machine (VM) snapshots for credential extraction and create hidden, rogue VMs.

CISA said it had analyzed eight Brickstorm samples obtained from victim organizations, including one where it conducted an incident response engagement.

In this case, the agency said PRC state-sponsored cyber actors gained long-term persistent access to the organization’s internal network in April 2024 and uploaded Brickstorm malware to an internal VMware vCenter server.

They also gained access to two domain controllers and an Active Directory Federation Services (ADFS) server, successfully compromised the ADFS server and exported cryptographic keys. They used Brickstorm for persistent access to at least 3 September this year.

Gabrielle Hempel, security operations strategist at Exabeam, said a key concern with Brickstorm malware is that it’s “targeting control planes and not just endpoints”, making it a potent weapon in the hands of hackers.

"You’re seeing vSphere, vCenter, and authentication infrastructure being targeted, and this is strategic: once an adversary owns your hypervisor layer, your traditional EDR, NDR, and many SIEM tools become blind to this because the attacker is no longer living in normal host or network telemetry,” Hempel commented.

The US National Security Agency (NSA) is urging organizations — particularly those within critical infrastructure, government services and facilities, and IT — to use the indicators of compromise (IOCs) and detection signatures outlined in the report to detect Brickstorm backdoor activity and promptly report any compromise.

MORE FROM ITPRO

• Shai-Hulud malware is back with a vengeance and has hit more than 19,000 GitHub repositories
• Malware as a Service explained
• The most prominent infostealers and how businesses can protect against them

As malware continues to evolve, infostealers are increasingly providing adversaries with the credentials they need to perform devastating cyber-attacks.

You don’t have to look far to find examples, with intrusions at Schneider Electric and Telefonica were also perpetrated using credentials stolen via infostealers.

Attacks using infostealers often precede other breaches such as ransomware. 54% of ransomware victims’ credentials first appeared in infostealer dumps, according to Verizon’s 2025 Data Breach Investigations report.

In September, cybersecurity researchers at Proofpoint issued a warning over a significant rise in the use of Stealerium malware used to harvest sensitive data from victims worldwide. The infostealer can exfiltrate a wide range of data, from browser credentials and crypto wallets to Wi-Fi profiles and VPN configurations.

Apart from Stealerium, what are the most prominent infostealers of 2025 – and how can leaders protect their businesses as new strains continue to evolve?

Lumma Stealer

Perhaps the most famous infostealer and certainly the most active is Lumma Stealer. Attacks involving Lumma Stealer still account for four times more than prominent stealer Rhadamanthys and eight times more than Vidar, says Spence Hutchinson, staff threat intelligence researcher at eSentire TRU.

Lumma, which is attributed to a malware author called Shamel, is found for sale on Russian-speaking crime forums and has been distributed since at least July 2024 via GitHub networks such as the Stargazers Ghost Network.

Microsoft Threat Intelligence has noted that Lumma Stealer uses multi-vector delivery methods for attacks.

“Its operators demonstrate resourcefulness and proficiency in impersonation tactics,” the researchers wrote in May.

“The Lumma Stealer distribution infrastructure is flexible and adaptable. Operators continually refine their techniques, rotating malicious domains, exploiting ad networks, and leveraging legitimate cloud services to evade detection and maintain operational continuity.

In May, Lumma Stealer was disrupted by a joint US-EU-Japanese law enforcement action that took down infrastructure used to host deployments. After that, the software re-emerged with added stealthy malware processes to avoid detection.

The malware now includes capabilities such as AMSI bypass, process hollowing, code flow obfuscation, encrypted command and control communications, persistence via registry modifications, and DLL sideloading, Daniel dos Santos, senior director, head of research at Forescout tells IT Pro.

Rhadamanthys

First seen in 2022, Rhadamanthys is a complex, multi-modular malware sold on the underground market. The malware is thought to have been created by experienced developers, and has been used in ClickFix campaigns in 2025.

Its latest release, v0.9.2, comes with “significant updates that may impact detection”, according to an October report by Check Point Research.

In November, Europol severely disrupted Rhadamanthys operations – alongside those of the VenomRAT remote access Trojan and Elysium botnet – in a new stage of Operation Endgame.

RisePro

Also available as a malware as as a service (MaaS) offering, RisePro targets Windows operating systems. “It deploys a number of defence evasion techniques to remain undetected, including obfuscating command and control activity to exfiltrate data,” warns Calum Baird, digital forensics and incident response consultant at Systal Technology Solutions.

Kaspersky tracked it as a highly significant driver of infostealer attacks, with its share of total infections rising from 1.4% in 2023 to 23% in 2024.

Vidar

The Vidar infostealer targets personal information and cryptocurrency wallet details stored on devices. In 2022, Check Point Research tracked it as a strain used to target Zoom users and in 2023, attackers were using the malware in a Google Ads malvertising campaign.

It utilizes an “interesting method” for command and control, using social media platforms such as Telegram and Mastodon as infrastructure, according to Baird.

“Vidar samples have also been found to contain null bytes, inflating size in an attempt to evade antivirus detection,” he adds.

StealC

StealC infostealer has been sold since 2023, with version 2 released in March 2025. Additions to the new version include a command and control protocol encrypted with RC4 and updated payload delivery options via MSI packages and PowerShell, says dos Santos.

This update has made StealC “more evasive and adaptable” than previous versions, increasing the threat it poses, Baird adds.

 Gremlin Stealer

One of the biggest threats to watch is Gremlin Stealer, a known variant of Sharp Stealer, according to Anna Chung, principal researcher EMEA, Unit 42 at Palo Alto Networks. “It exfiltrates data from its victims and uploads this information to its dedicated web server for publication, which is part of the purchasable malware infrastructure.”

The malware can bypass modern browser defenses such as Chrome's cookie protection to steal browser data including cookies, passwords, credit cards and autofill forms from Chromium and Gecko-based clients.

But it doesn’t just stop at browsers: Gremlin targets FTP and VPN credentials, Discord tokens, Telegram session data, and popular cryptocurrency wallets, alongside general system information, screenshots and clipboard data.

DarkCloud Stealer

DarkCloud Stealer is primarily distributed through email phishing campaigns, often using obfuscated archive files to evade initial detection, says Chung. Once executed, it can steal a wide range of sensitive data, including host and user details, screenshots, contacts, stored credentials such as usernames and passwords, credit card details, email client credentials and FTP client access data.

“In recent months, we’ve seen the DarkCloud infostealer specifically targeting government organizations, which is concerning given the range of data they possess,” says Chung.

Infostealers in the future

Infostealers are stepping up their game with obfuscation, making them harder to detect and analyze. David Sancho, senior threat researcher at Trend Micro, predicts that infostealers will evolve to use more intelligent methods for collecting data, enabling them to identify which information on a victim’s computer is “most monetizable”.

On the attacker backends, AI-enhanced programs are likely to play “a growing role in analysing the vast amounts of data collected”, Sancho adds. “These systems could sift through stolen information to identify high-value assets, such as domain credentials from large enterprises, rather than less valuable data from personal devices.”

Responding to the threat

Infostealers are a growing threat to all firms but once you are aware of how they operate, steps can be taken to help mitigate them.

It’s important to note that infostealers are “simply a type of malware payload”, and the methods they use to infiltrate corporate networks are “varied and don’t follow a consistent pattern”, says Sancho.

Entry points include phishing emails or compromised websites offering “seemingly harmless” software downloads, he says. While keeping antivirus software up to date can help defend against these threats, the most effective protection is implementing multi-factor authentication (MFA), Sancho advises. “MFA ensures that even if attackers obtain valid credentials, they still require a second form of verification, typically a mobile device, to access corporate systems.”

Sancho also recommends using an external encrypted credentials repository, “so that the infostealer will not find any memorized passwords on the browser”.

Entry points include phishing emails or compromised websites offering “seemingly harmless” software downloads, he says. While keeping antivirus software up to date can help defend against these threats, the most effective protection is implementing multi-factor authentication (MFA), Sancho advises. “MFA ensures that even if attackers obtain valid credentials, they still require a second form of verification, typically a mobile device, to access corporate systems.”

Sancho also recommends using an external encrypted credentials repository, “so that the infostealer will not find any memorized passwords on the browser”.

At the same time, experts recommend conducting regular phishing and security awareness training exercises. “Especially those that train against browser-based attacks, including current social engineering tactics,” says Hutchinson.

One helpful action is to disable some of the common commands used to carry out ClickFix-style attacks – which often lead to Lumma Stealer or other infostealers being downloaded, says Hutchinson.

As part of this, he advises removing the “Run” prompt from the Start Menu using Windows Group Policy Objects and disabling Wscript, using AppLocker or Windows Defender GPO. “Disabling Run for all users is probably the main way to prevent ClickFix – since it tricks the user in to opening up run and pasting in a command copied to their clipboard.”

The Scattered Lapsus$ Hunters threat group appears to be targeting Zendesk users in a new phishing campaign, according to analysis from ReliaQuest.

The security firm said it has spotted Zendesk-related infrastructure, including more than 40 typosquatted domains and URLs impersonating the company, created over the last six months.

These domains aim to mimic organizations’ Zendesk environments and host phishing pages, researchers warned.

"These domains, such as znedesk[.]com or vpn-zendesk[.]com, are clearly designed to mimic legitimate Zendesk environments. Some host phishing pages, like fake single sign-on (SSO) portals that appear before Zendesk authentication," said ReliaQuest.

"It’s a classic tactic probably aimed at stealing credentials from unsuspecting users. We also identified Zendesk-related impersonating domains that contained multiple different organizations’ names or brands within the URL, making it even more likely that unsuspecting users would trust and click on these links."

The domains shared several registry details: registration through NiceNic, US and UK registrant contact information, and Cloudflare-masked nameservers.

"These elements are reminiscent of the recent Scattered Lapsus$ Hunters campaign that targeted customer relationship management platform Salesforce in August 2025," ReliaQuest said.

"The domains we uncovered while investigating the August campaign shared similarities with the Zendesk domains: formatting, registry characteristics, and the use of deceptive SSO portals."

Be wary of fraudulent Zendesk tickets

Meanwhile, ReliaQuest said it has observed fraudulent tickets being submitted to legitimate Zendesk portals operated by organizations using the software for customer service.

Pretexts include urgent system administration requests or fake password reset inquiries, and the aim is to infect support and help-desk personnel with remote access trojans (RATs) and other forms of malware.

In September, Scattered Lapsus$ Hunters targeted the communication platform Discord, accessing its Zendesk-based support system and exfiltrating a large number of names, email addresses, billing information, IP addresses, and government-issued IDs.

A message posted on a Telegram channel associated with the group in November claimed: "Wait for 2026, we are running 3-4 campaigns atm."

Another read: "all the IR (incident response) people should be at work watching their logs during the upcoming holidays till January 2026 bcuz #ShinyHuntazz is coming to collect your customer databases."

ReliaQuest said organizations should handle customer support platforms with the same level of security as their own core infrastructure.

"ReliaQuest anticipates that SLSH, or copycat threat actors, will likely continue abusing Zendesk and similar customer support platforms — typically monitored less rigorously than inbound email traffic — to access downstream customers' sensitive data and credentials," said the firm.

"These platforms now warrant equivalent security controls to core infrastructure, particularly since SLSH operates multiple, concurrent attack paths, i.e. external phishing domains coupled with internal ticket injection."

MORE FROM ITPRO

• If you're not taking insider threats seriously, then the CrowdStrike incident should be a big wake up call
• Scattered Spider: Who are the alleged hackers behind the M&S cyber attack?
• Hackers behind Jaguar Land Rover announce their 'retirement' – should we believe them?

The Shai-Hulud worm is back and once again infecting npm packages – and the scale of the attack is even greater than a September 2025 campaign which affected 180 repositories before containment.

Attackers involved in the campaign have been exploiting compromised package maintainer accounts to publish trojanized versions of legitimate npm packages that appear to originate from the official source.

Once downloaded, the malware scans for credentials and CI/CD secrets, which are then published to the user's own repositories. It also inserts the malicious payload into all of the users’ available npm packages, spreading the infection.

This time round, the malware has affected more than 19,000 GitHub repositories and compromised around 700 npm packages, including core libraries from Zapier and the Ethereum Name Service (ENS) ecosystem, along with PostHog and Postman.

According to Wiz Threat Research, the attack is accelerating at around 1,000 new repos every 30 minutes.

"This campaign continues the trend of npm supply-chain compromises referencing Shai-Hulud naming and tradecraft, though it may involve different actors," said Wiz.

New Shai-Hulud campaign shakes up tactics

This campaign adds a couple of new features, according to researchers, including execution using install lifecycle scripts and new payload files setup_bun.js and bun_environment.js.

Meanwhile, if the malware fails to authenticate or establish persistence, it attempts to destroy the victim’s entire home directory, deleting every writable file owned by the current user under their home folder.

Wiz said it's observed multiple environments where the affected packages were downloaded before their removal from npm, suggesting active exposure.

While GitHub is currently removing attacker-created repositories associated with this campaign, the threat actors continue to create new repositories as part of their ongoing activities.

Garrett Calpouzos, principal security researcher at Sonatype, said a peculiar aspect of the campaign is that it appears to be confusing AI analysis tools, largely due to the size and structure of the file.

“It’s so large that it exceeds a normal context window and the models can’t keep track of everything they're reading," he noted.

"I’ve asked both ChatGPT and Gemini to analyze it and I get different answers each time. Looking at their reasoning, they’re searching for obvious malware patterns – like calls to suspicious domains – and not finding any, so they incorrectly conclude it’s just a legitimate session or token management library."

What developers need to know

Developers should cross-reference all installed packages against the compromised list, said Aikido, and uninstall any compromised package versions immediately.

Enterprises are also advised to check GitHub accounts for unauthorized repos with "Shai Hulud: The Second Coming" in the description.

Credential rotation is another key tactic here for defenders, according to Wiz, with devs advised to check GitHub, npm, cloud, and CI/CD secrets used on any machine that installed these packages.

Elsewhere, enterprises should disable npm postinstall scripts in CI environments, enforce MFA on all GitHub and npm accounts, and stop auto-updates until verified clean.

"The timing is notable, given npm’s recent announcement that it will revoke classic tokens on December 9 after the wave of supply chain attacks," commented Charlie Eriksen, a malware researcher at Aikido.

"With many users still not migrated to trusted publishing, the attacker seized the moment for one more hit before npm’s deadline."

MORE FROM ITPRO

• Malware-free attacks: The threat to businesses
• Malware as a Service explained: What it is and why businesses should take note
• What is polymorphic malware?

The UK, US, and Australia have imposed sanctions on a Russian cyber crime group offering so-called 'bulletproof' hosting services for hackers worldwide.

Media Land provides online infrastructure to support ransomware and phishing operations, and is believed to have played a key role in a spate of devastating cyber attacks in recent years.

Ransomware victims of the outfit include UK critical national infrastructure organizations and it's also been used for malware and phishing campaigns targeting UK taxpayers.

In the US, Media Land infrastructure has been used in distributed denial of service (DDoS) attacks against companies and critical infrastructure. Meanwhile, in Australia, the group has helped criminals to carry out attacks against financial institutions, businesses, their customers, and critical infrastructure.

"Cyber criminals think that they can act in the shadows, targeting hard working British people and ruining livelihoods with impunity," said UK foreign secretary Yvette Cooper.

"But they are mistaken – together with our allies, we are exposing their dark networks and going after those responsible."

The measures target Media Land’s ringleader, Alexander Volosovik, also known as Yalishanda, who has been active since at least 2010 and is known to have worked with some of the most notorious cyber criminal groups, including Evil Corp, LockBit, and Black Basta.

Also sanctioned is Kirill Zatolokin, a Media Land employee responsible for collecting payment from customers and coordinating with other cyber actors, as well as Yulia Pankova, who has helped Volosovik with legal issues and handled his finances.

Sanctions target Media Land sister outfits

The sanctions also target ML Cloud, a Media Land sister company whose technical infrastructure is often used in conjunction with Media Land, including in ransomware and DDoS attacks.

Hypercore, a UK company registered and utilized by Aeza Group, has also been targeted in the international campaign.

The sanctions block access to any assets held in the sanctioning countries, and bar businesses and individuals there from engaging with the listed entities or people. Financial institutions that violate these restrictions can face penalties themselves.

"These sanctions don’t just impose costs on criminals, they dismantle the infrastructure that enables cyber crime," said Australian deputy prime minister Richard Marles.

"By disrupting these networks, we make it harder for others to launch attacks and it strengthens Australia’s resilience against future threats."

Will the sanctions work?

The move marks the latest in a string of actions by governments to crack down on cyber crime-related hosting services.

In July this year, the US Treasury announced plans to impose sanctions on Azea Group, another bulletproof hosting service for its activities. US officials revealed the group has been selling access to specialized services and infrastructure used in a series of ransomware and infostealer malware campaigns.

While this fresh crackdown has been welcomed by security industry stakeholders, John Binns, partner and head of the sanctions practice at BCL Solicitors, said these typically have a limited effect.

"The evidential threshold for designation under the regulations is significantly lower than any in the criminal process, and the real-world impact on sophisticated actors operating primarily in hostile jurisdictions can be modest," he said.

"While sanctions are undoubtedly a valuable addition to the law-enforcement toolkit against transnational cyber crime, they deliver a form of administrative rather than criminal justice and are best viewed as potentially complementing - rather than supplanting - efforts to secure arrests, prosecutions, and asset forfeiture through the courts."

MORE FROM ITPRO

• Russia is targeting unpatched vulnerabilities – what can tech leaders do to shore up defenses?
• Are we in a cyber awareness crisis?
• Enterprises need to acknowledge the importance of basic cyber hygiene

In the latest stage of its Operation Endgame campaign, Europol has seriously disrupted the Rhadamanthys infostealer, VenomRAT, and Elysium botnet malware operations.

More than 1,000 servers used by the groups to infect hundreds of thousands of victims worldwide with malware were last week taken down.

Law enforcement searched one location in Germany, one in Greece, and nine in the Netherlands, seizing 20 domains. One arrest, related to the VenomRAT tool, has been made in Greece.

"The dismantled malware infrastructure consisted of hundreds of thousands of infected computers containing several million stolen credentials. Many of the victims were not aware of the infection of their systems," Europol said.

"The main suspect behind the infostealer had access to over 100,000 crypto wallets belonging to these victims, potentially worth millions of euros."

These hadn't yet been used to steal assets, Europol said. However, it's recommended checking politie.nl/checkyourhack and haveibeenpwned.com to find out whether computers have been hacked and learn what to do.

The Rhadamanthys infostealer harvests browser-resident data, including credentials, browser data, autofill information, and cryptocurrency wallet artifacts from browsers, password managers, and crypto wallets.

According to Proofpoint, it costs between $300 and $500 a month, with options for a higher price point for customized uses. The firm said it appears that the threat actor behind Rhadamanthys was not only facilitating information stealer operations but also stealing sensitive data from Rhadamanthys affiliates.

"In addition to the infrastructure disruption, it’s likely that this operation will also negatively affect the criminals’ reputation, leading affiliates to mistrust them," the firm pointed out.

According to the Shadowserver Foundation, which assisted in the operation, Rhadamanthys has grown to become one of the leading infostealers since Operation Endgame 2.0 disrupted the infostealer landscape earlier this year.

"It is important to note that Rhadamanthys may have been used to drop additional malware on infected systems, so other malware infections may also be active on these systems and require further local remediation efforts," the Shadowserver Foundation warned.

"These victim systems may also have been used in historic or recent intrusions and ransomware incidents."

VenomRAT, which first appeared in 2020, generally arrives through malicious email attachments or links, also using fake antivirus pages.

It gives its operators remote desktop-style control, allowing the theft of files, browser data, cryptocurrency wallets, credit card details, account passwords, and authentication cookies.

While it's mainly been used to target Latin American organizations, it has also claimed victims in North America and Western Europe.

The Elysium botnet meanwhile, carries out data theft, payload delivery and other tasks.

Operation Endgame, launched in 2024, has now led to total seizures of more than €21 million. This latest action follows an Operation Endgame raid in May that saw 300 servers taken down and 650 domains seized, along with €3.5 million.

MORE FROM ITPRO

• Botnets are being sold on the dark web for as little as $99
• What is polymorphic malware?
• Everything you need to know about Malware as a Service

Security experts have issued a warning to developers after ten malicious npm packages have been found to deliver infostealer malware across Windows, Linux, and macOS systems.

Analysis by researchers at Socket's Threat Research Team shows the malware distributed as part of the campaign uses four layers of obfuscation to hide payloads, displays a fake CAPTCHA to appear legitimate, and fingerprints victims by IP address.

It downloads a 24MB PyInstaller-packaged information stealer that harvests credentials from system keyrings, browsers, and authentication services across Windows, Linux, and macOS.

"This malware demonstrates multiple advanced techniques rarely seen together in npm supply chain attacks," said the researchers.

The ten packages were published on July 4, researchers noted, and have remained live for over four months, clocking up more than 9,900 downloads between them.

Researchers have asked the npm registry to remove them to prevent future victims from falling prey.

How the malicious npm packages work

The packages were registered under typosquatted names to mimic legitimate libraries. These include:

• typescriptjs, mimicking TypeScript
• deezcord.js, and dezcord.js, mimicking discord.js
• etherdjs, ethesjs, ethetsjs, mimicking ethers.js
• nodemonjs, mimicking nodemon
• react-router-dom.js, mimicking react-router-dom
• zustand.js, mimicking zustand

Once installed, the malware serves a fake CAPTCHA prompt. It detects the victim's operating system and launches the obfuscated payload in a new terminal window, meaning the malware runs independently of the npm install process.

"Developers who glance at their terminal during installation see a new window briefly appear, which the malware immediately clears to avoid suspicion," the researchers said.

It uses four distinct layers of obfuscation. A “Self-Decoding Eval Wrapper” wraps the entire payload in an immediately-invoked function expression that reconstructs and evaluates itself, preventing cursory inspection of the code.

The second layer uses XOR cipher with a dynamically generated key based on hashing the decoder function itself, making automated decryption difficult without executing the code.

In the third layer, the payload string is URL-encoded, requiring URI decoding before XOR decryption: a barrier to static analysis tools that do not implement full JavaScript evaluation.

Finally, in the fourth layer, the decoded code uses switch-case state machines with hexadecimal and octal arithmetic to obscure program flow.

Thereafter, it sends the victim's geolocation and system fingerprint information to the attacker's command and control (C2) server, allowing downloads and automatically launching a platform-specific data extractor binary.

"This cross-platform approach ensures developers on any operating system receive a fully functional information stealer tailored to their platform's credential storage mechanisms," researchers said.

"Windows developers have their Credential Manager harvested, macOS developers have their Keychain extracted, and Linux developers have their SecretService keyrings compromised."

How to stay safe

According to Socket, researchers should immediately audit their dependencies for the ten malicious packages and assume that any system where they've been installed is fully compromised.

Similarly, they should reset all credentials stored in system keyrings and password managers, revoke authentication tokens for all services including OAuth, JWT, and API keys, enable multi-factor authentication on all accounts if not already enabled, and rotate SSH keys while reviewing authorized keys on all systems.

Access logs should be audited for unusual activity on connected services, and teams should check for lateral movement from compromised systems to production infrastructure.

Browser history should be reviewed for potential credential theft from saved passwords, and monitoring should be established for unauthorized access to repositories, cloud services, and internal systems.

Finally, VPN and firewall logs should be reviewed for connections to 195[.]133[.]79[.]43, and any additional persistence mechanisms that may have been installed should be identified and removed.

Malicious npm packages keep causing chaos

The use of malicious npm packages has quickly become a key tactic for threat actors targeting developers across a range of industries, with a host of major campaigns uncovered this year alone.

Javvad Malik, lead CISO Advisor at KnowBe4, said the frequency of these campaigns underlines the need for developers to remain vigilant when downloading packages from popular ecosystems such as npm and PyPi.

"Malicious npm packages exploit the pressures developers operate under to bring functionality features to production as quickly as possible. Much like apps on mobile phones, people will often skip over or ignore the permissions that are being asked for in exchange for quick access to the app," he said.

"Teams should lock down by default, not just npm packages, but all third party extensions and agents. Builds should be run in isolated environments and developer credentials should be treated with the same level as production admin credentials."

MORE FROM ITPRO

• Malicious URLs overtake email attachments as the biggest malware threat
• Malware as a Service explained
• A malicious MCP server is silently stealing user emails

Security agencies are warning that hackers are exploiting vulnerabilities in Cisco Adaptive Security Appliance (ASA) 5500-X Series devices to install malware, execute commands, and steal data.

The first vulnerability, tracked as CVE-2025-20333, allows authenticated attackers to execute arbitrary code on devices using ASA and Firewall Threat Defense (FTD) software.

Meanwhile, a second vulnerability (CVE-2025-20362) allows them to access restricted URL endpoints without authentication.

"In May 2025, Cisco was engaged by multiple government agencies that provide incident response services to government organizations to support the investigation of attacks that were targeting certain Cisco Adaptive Security Appliance (ASA) 5500-X Series devices that were running Cisco Secure Firewall ASA Software with VPN web services enabled," the networking giant said in a customer advisory.

"Attackers were observed to have exploited multiple zero-day vulnerabilities and employed advanced evasion techniques such as disabling logging, intercepting CLI commands, and intentionally crashing devices to prevent diagnostic analysis."

CISA, NCSC respond to Cisco ASA flaws

According to the US Cybersecurity and Infrastructure Security Agency (CISA), the campaign is 'widespread' and connected with “ArcaneDoor” activity identified early last year

This threat campaign targeted perimeter network devices from several vendors, including Cisco, to deliver malware strains such as Line Runner and Line Dancer.

"CISA is directing agencies to account for all Cisco ASA and Firepower devices, collect forensics and assess compromise via CISA-provided procedures and tools, disconnect end-of-support devices, and upgrade devices that will remain in service," the agency said.

The UK's National Cyber Security Centre (NCSC) has also issued guidance in the wake of the exploitation. The cybersecurity agency noted that some Cisco ASA 5500-X series models will be out of support from September 2025 and August 2026.

With this in mind, enterprises using these models should take immediate action to mitigate potential risks.

“It is critical for organizations to take note of the recommended actions highlighted by Cisco today, particularly on detection and remediation,” said NCSC chief technology officer Ollie Whitehouse.

“We strongly encourage network defenders to follow vendor best practices and engage with the NCSC’s malware analysis report to assist with their investigations.

“End-of-life technology presents a significant risk for organisations. Systems and devices should be promptly migrated to modern versions to address vulnerabilities and strengthen resilience.”

New malware strains are a potent threat

New RayInitiator and Line Viper malware strains believed to be used in attacks represent a “significant evolution” on Line Dancer and Line Runner, the NCSC warned, particularly in terms of sophistication and their ability to evade detection.

CISA has now issued a directive ordering federal agencies - which have already been targeted - to identify, analyze, and mitigate potential compromises immediately.

"CISA is directing agencies to account for all Cisco ASA and Firepower devices, collect forensics and assess compromise via CISA-provided procedures and tools, disconnect end-of-support devices, and upgrade devices that will remain in service," it said.

"These actions are directed to address the immediate risk, assess compromise, and inform analysis of the ongoing threat actor campaign.”

MORE FROM ITPRO

• Cisco polishes its platform but the network is still king
• 96% of businesses have low cyber-readiness, claims Cisco
• Cisco promises AI training for a million Americans

Small and medium-sized businesses (SMBs) across Europe and North, West, and Central Africa are being targeted by malware masquerading as legitimate tools.

According to Kaspersky, cyber criminals are disguising malware and potentially unwanted applications (PUAs) as trusted tools such as ChatGPT, Microsoft Office applications ,and Google Drive.

Between January and April this year, Austria, Italy, and Germany were among the hardest hit countries in Europe, with the campaign accelerating at pace.

Austria accounted for 40% of all detected cases in which PUAs and malware mimicked legitimate brands, followed by Italy at 25%, Germany at 11%, and Spain (10%). Meanwhile, in Africa, Morocco topped the list, with 41% of all detected PUAs.

The most common threats affecting SMBs in Europe included backdoors (24%), Trojans (17%), and not-a-virus:Downloaders (16%). All of these are designed to infiltrate networks without raising suspicion, Kaspersky noted.

In Africa, not-a-virus: Downloaders dominated (55%), followed by DangerousObjects (14%) and Trojans (13%).

“Small businesses face enterprise-level threats, often with startup-level budgets," said Marc Rivero, lead security researcher at the Global Research and Analysis Team (GreAT) at Kaspersky. “The key is knowing where to focus their limited resources for maximum protection."

Kaspersky said these growing threats highlight the need for more robust employee awareness training. Enabling staff to spot the telltale signs of cyber criminal activity is crucial to preventing disaster.

The company also advised enforcing strong authentication and authorization with strict password policies and multi-factor authentication (MFA), regularly updating software and patching vulnerabilities.

Meanwhile, organizations should carry out regular training sessions, focusing on safe email practices, secure password management, recognizing phishing attempts, and the proper handling of sensitive data.

All software should come from official sources – not via search engines – and be installed centrally by the IT team to prevent hidden threats. Similarly, clear access rules should be set for emails, shared folders, and online services, with user activity monitored and access revoked promptly when employees leave the company.

"The best defense against sophisticated malware isn't the most expensive tool - it's understanding how attackers think and closing the doors they're looking for,” said Rivero.

MORE FROM ITPRO

• Warning issued as Pakistan-based malware group hits millions globally
• The best malware removal tools 2025
• What is Malware as a Service and why should businesses take note?

Cybersecurity researchers have issued a warning over a significant rise in the use of Stealerium malware.

Analysis from Proofpoint shows the malware strain is being used to harvest sensitive data from victims worldwide.

Pitched as being available 'for educational purposes', the infostealer can exfiltrate a wide range of data, from browser credentials and crypto wallets to Wi-Fi profiles and VPN configurations.

This is achieved through multiple channels such as SMTP, Discord, Telegram, GoFile, and Zulip, researchers noted.

In some cases, it's being used for sextortion, capturing screenshots and webcam images when pornography-related content is detected in open browser tabs.

Proofpoint said Stealerium has flown under the radar for some time now, but researchers have observed a huge spike in activity between May and August this year, including campaigns linked to threat actors TA2536 and TA2715.

"Both of these actors recently favored Snake Keylogger (also known as VIP Recovery), so the use of Stealerium was notable," researchers said in a blog post detailing the campaigns.

"Proofpoint researchers identified additional campaigns through August 2025 that employed a variety of persuasive lures and delivery mechanisms. While most campaigns are not attributed to tracked threat actors, the initial TA2715 activity marked the first observed use of Stealerium in Proofpoint threat data in over a year."

How hackers are using Stealerium malware

Recent campaigns have used a wide range of social engineering techniques, researchers noted, including payment notices, legal threats, travel bookings, and adult-themed content.

These are often with compressed executables such as JavaScript, VBScript, ISO, or IMG attachments.

The team also spotted multiple campaigns leveraging travel, hospitality, and even wedding-themed lures. The subject lines generally convey urgency or financial importance, including 'Payment Due', 'Court Summons' and Donation Invoice.

In one instance, Proofpoint identified a TA2715 campaign impersonating a Canadian charitable organization with a 'request for quote' lure. The messages contained a compressed executable attachment that, when executed, downloaded and installed Stealerium.

Upon execution, Stealerium issues a series of 'netsh wlan' commands to enumerate saved Wi-Fi profiles and nearby wireless networks.

Several campaigns also leveraged PowerShell to add Windows Defender exclusions and used scheduled tasks for persistence and evasion.

Meanwhile, the malware has a particular feature that focuses on pornography-related data. Researchers said it is able to detect adult content-related browser tabs and takes a desktop screenshot as well as a webcam image capture.

This, researchers said, is likely to be used later for sextortion.

"While this feature is not novel among cyber crime malware, it is not often observed," the researchers said.

The company advised organizations to monitor for activity involving 'netsh wlan', suspicious use of PowerShell defender exclusions, and headless Chrome executions which are consistent with post-infection behaviors.

Similarly, they should keep an eye out for large amounts of data leaving networks, particularly to services and URLs that aren't permitted for use in the organization, or prevent outbound traffic to these services altogether.

MORE FROM ITPRO

• Hackers are using AI to dissect threat intel reports and ‘vibe code’ malware
• Everything you need to know about Malware as a Service
• Malicious URLs overtake email attachments as the biggest malware threat

Threat intelligence reports play a crucial role in helping enterprises keep tabs on emerging threats. These blog posts detail the tactics, techniques, and procedures (TTPs) of a threat group or dissect the makeup of a particular malware strain.

New research, however, shows they could also be doing more harm than good. According to research from Trend Micro, hackers are now using AI to analyze these reports and use them to refine their tactics.

The study showed large language models (LLMs) can translate technical blogs into “partial malicious code” in a dark twist on the “vibe coding” trend.

This not only allows threat actors to speed up attacks or reverse engineer malware strains, it also helps them mimic other group’s TTPs, creating challenges with the attribution of attacks.

Speaking to ITPro, Robert McArdle, Director of Forward Threat Research at Trend Micro, said the company’s findings highlight the latest example of cyber criminals jumping on the vibe coding bandwagon to wreak havoc.

“We already know that cyber criminals are using vibe coding,” McArdle said. “We’ve seen that in their discussions on criminal forums. We’ve seen existing malware that very much looks like it was vibe coded.”

“It got us thinking, what if you can actually clone an analysis by a researcher to try to re-implement the malware from what they've described?”

McArdle told ITPro the company decided to test this by using AI tools to dissect its own blog posts, which showed some initial promise.

“What came back was quite good,” he said. “It wasn’t the final product. It did need a little bit of tweaking to get it to work, but it certainly took a lot of work out of the way.”

This ‘lightening of the load’ is a key concern, McArdle noted. While AI tools are unlocking productivity gains for workers on the right side of the law, they’re proving equally powerful for criminals.

Worse still, these tools are helping lower the barrier to entry for up-and-coming cyber criminals and accelerating processes for those with a higher level of technical know-how.

“AI lets you jump from your current level of proficiency up to the next level faster,” he told ITPro. “So if you’re a complete novice and you know very little about code, you can vibe code a reasonably okay malware.”

“If you're already skilled and you go to an in-depth analysis of something even more advanced, then it certainly helps you get up to speed on that faster and go from those examples and have some sort of working code," McArdle continued. “So in each case it levels up the skill set of the attacker.”

Time to tone down the technical details?

Faced with this, McArdle said Trend Micro’s view on threat intelligence reports is that industry providers should consider toning down the technical details.

The company itself has taken this on board and McArdle said a key factor in releasing this research was to raise awareness and let industry counterparts know what’s going on.

“We often release these [threat intelligence reports] to raise awareness, to let people know that you know something is going on,” he said.

“Within those, it's the level of detail that you put in the post that’s the difference. We need to let people know this new attack is happening. Here's the main details you need to know to defend yourself. Here's the bigger world context, and so on,” McArdle added.

“But we probably don't always need to go down to the low-level code of ‘this is exactly how this was implemented, from start to finish’.”

“The more and more you go to that level, the more an AI is capable of reconstructing an approximation of the malware from it,” he said.

MORE FROM ITPRO

• Security researchers have just identified what could be the first ‘AI-powered’ ransomware strain
• The rise of GhostGPT – Why cybercriminals are turning to generative AI
• Microsoft quietly launched an AI agent that can detect and reverse engineer malware

Microsoft has launched an autonomous agent for detecting malware – and it’s already completed a first-of-a-kind detection of an active hacking group.

Project Ire is an AI agent capable of reverse engineering software files to investigate whether they’re malicious and analyze their origins, even if they don’t match any previously-cataloged threats.

Powered by a combination of large language models (LLMs) and specialized cybersecurity analysis tools, the agent is intended to automate malware classification to ease cybersecurity analyst burnout.

In recent tests, Project Ire was exposed to known samples from a database hackers have used for living off the land attacks, alongside harmless Windows drivers.

The agent correctly flagged 90% of all files, with only a two percent false positive rate, confirming the malicious nature of files such as a kernel-level rootkit by identifying suspicious features like process termination and a web-connected command and control structure.

Microsoft researchers described its ability to blindly reverse engineer files as “the gold standard in malware classification”.

They added that Project Ire is the first reverse engineer at Microsoft to build a strong enough case against a specific advanced persistent threat (APT) malware strain to justify its automatic blocking in Windows Defender.

In a broader test, researchers exposed Project Ire to 4,000 files that were unclassified by Microsoft’s automated systems and would normally have to be reviewed by highly-skilled reverse engineers.

Project Ire achieved a precision score of 0.89, meaning 90% of the files it marked as malicious were indeed threats, alongside an overall recall score of 0.26 meaning it discovered around 25% of all the malware in the sample.

Microsoft noted the tool achieved these results autonomously, with none of the files it was exposed to having been present in its training data, adding that other autonomous tools made by Microsoft were unable to classify the files at all.

Project Ire was created as a joint project between Microsoft Research, Microsoft Defender Research, and Microsoft Discovery & Quantum.

Project Ire could shake up AI malware classification

Malware classification is a painstaking process, in which experts pore over hundreds or thousands of files to determine whether a given piece of software has a malicious purpose.

In the past it’s been nearly impossible to automate, as AI tools can’t easily reverse engineer files without their context. They also lack the ability to definitively validate whether a file is malicious, as specific features within software could have both malicious and benign purposes.

Microsoft has attempted to overcome these limitations through Project Ire by equipping it with multi-level reasoning capabilities and the ability to call open source tools, documentation, and decompilers via API calls.

Every time Project Ire analyzes a file, the agent first runs triage to classify it, note its structure, and capture any other details that could point to its purpose or origin.

It then reverse engineers the file’s control flow graph, a graphic representation of a program’s execution paths, using the open source frameworks angr and Ghidra.

Project Ire can then call specific tools via an API to investigate specific functions within the file, adding each finding to an auditable chain of evidence that human analysts can check afterward to validate the LLM’s findings.

It is capable of periodically cross-checking its own claims using a built-in ‘validator’ tool, which uses expert statements from human malware reverse engineers who helped build Project Ire as context for making a final call for whether the file is malicious or benign.

This is then summarized in a final report for analyst oversight.

MORE FROM ITPRO

• Why ‘malware as a service’ is becoming a serious problem
• Developers face a torrent of malware threats as malicious open source packages surge 188%
• The best malware removal tools for your business in 2025

There's been a sharp rise in the number of phishing and URL-based attacks over the last year, with malicious URLs now being used four-times as often as attachments in email threats.

Malicious links are embedded in messages, buttons, and even within attachments like PDFs or Word documents to entice clicks that initiate credential phishing or malware downloads.

According to a new report from Proofpoint, researchers observed around 3.7 billion URL-based threats over a six month period, highlighting the growing scale of the problem.

Only 8.3 million of these threats were intended to deliver malware, however, with the most frequently-observed payloads in URL-based campaigns being remote monitoring and management (RMM) tools and remote access software (RAS).

These attacks are getting increasingly difficult for users to identify, Proofpoint noted, with cyber criminals now using advanced social engineering techniques and AI-generated content to create their malicious URLs.

Not only are they impersonating trusted brands, but also abusing legitimate services, tricking users with fake error prompts and bypassing traditional security by embedding threats in QR codes and SMS messages.

"URL-based phishing threats are no longer confined to the inbox, they can be carried out anywhere and are often extremely difficult for people to identify,” said Selena Larson, senior threat intelligence analyst at Proofpoint.

New techniques are paying off for hackers

Some of the URL-based credential phishing campaigns with the highest volumes in the past 12 months have been facilitated by off-the-shelf 'phish kits' like CoGUI and Darcula.

CoGUI is primarily used by Chinese-speaking threat actors, according to Proofpoint. These high-volume campaigns typically include message counts ranging from the hundreds of thousands to tens of millions at a time, and are mainly used to steal personal details such as credit card numbers.

Meanwhile, ClickFix malware campaigns - a phishing technique that lures users into running malicious code by displaying fake error messages or CAPTCHA screens - are up by nearly 400% year-over-year.

Malware operators are exploiting the urge to resolve a perceived technical issue, helping them spread remote access trojans (RATs), infostealers and loaders.

QR code and smishing threats are rising

Proofpoint also identified more than 4.2 million QR code phishing threats in the first half of 2025 alone. In these cases, the main aim of attackers is credential phishing, with 3.7 billion URL-based attacks aimed at stealing logins.

With phishing lures that impersonate trusted brands and use off-the-shelf tools such as CoGUI and Darcula phish kits, Proofpoint said even low-skilled actors can deploy highly convincing campaigns that bypass multi-factor authentication (MFA) and lead to full account takeover.

The number of smishing campaigns rocketed by 2,534%, as attackers shift their focus to mobile devices - at least 55% of suspected SMS-based phishing messages analyzed by the firm contained malicious URLs, often mimicking government communications or delivery services.

“From QR codes in emails and fake CAPTCHA pages to mobile-first smishing scams, attackers are weaponizing trusted platforms and familiar experiences to exploit human psychology," said Larson.

"Defending against these threats requires multi-layered, AI-powered detection and a human-centric security strategy.”

MORE FROM ITPRO

• Why ‘malware as a service’ is becoming a serious problem
• Developers face a torrent of malware threats as malicious open source packages surge 188%
• The best malware removal kits for small businesses

Researchers at cybersecurity firm CloudSEK have issued a warning about a Pakistan-based malware syndicate carrying out infostealer attacks on millions of victims worldwide.

The group commands a sprawling network of operators, affiliates, and infrastructure, according to CloudSEK, adding up to a multi-million-dollar cyber crime business.

With many operators sharing the same family surname, researchers even suggested the group could be a multi-generational, family-run cyber crime outfit.

Their roles appear to be divided between primary operators - network management and finances - affiliates, generating traffic via warez sites, and financial facilitators handling payouts and settlements.

The group lures its victims in through Search Engine Optimization (SEO) poisoning and spam posted on legitimate online forums. Alongside this, the operators also ran paid ads through legitimate traffic services to drive even more users to malicious domains.

Blending malicious activity with normal web marketing traffic also made detection and takedown more difficult.

Links to cracked versions of high-demand software — such as Adobe After Effects and Internet Download Manager (IDM) — also led users to malicious WordPress sites.

“This investigation shows that cyber crime today is no longer a dark-web-only phenomenon," said Nivya Ravi, director of products at CloudSEK.

"It’s hiding in plain sight, using SEO, legitimate payment processors and publicly accessible forums, to operate with alarming efficiency."

The WordPress sites distributed commodity infostealers, including Lumma Stealer, Meta Stealer, and, more recently, AMOS, all of which were concealed inside password-protected archives to evade detection.

Once installed, the malware exfiltrated credentials, browser data, cryptocurrency wallets, and other sensitive information — data that was later monetized through resale and secondary fraud.

A sprawling malware network

The CloudSEK research revealed that the network involved 5,239 registered affiliates operating 3,883 malware distribution sites. Its lifetime revenue is estimated to be at least $4.67 million - although it may well be more, thanks to undocumented 'off-ledger' settlements.

Between May and October 2020 alone, the network paid out $130,560 to affiliates at an average Effective Cost Per Install (eCPI) of $0.0693. Payments were made via Payoneer in two-thirds of cases, with Bitcoin accounting for almost all the rest.

CloudSEK believes that the network may have hit 10 million victims worldwide.

"This is not a small-time hacking group — it’s an industrial-scale cybercrime enterprise that has been operating for years, infecting millions of devices across the globe," said Ravi.

"By hijacking the demand for pirated software, they have turned unsuspecting users into a steady revenue stream."

The group launched a big campaign ahead of India’s Independence Day this month, with coordinated attacks targeting the government, finance and defense sectors and including phishing, fake websites, data breaches, and scams.

CloudSEK recommends a multi-pronged disruption strategy combining domain takedowns targeting the 383 long-haul sites, as well as a financial ban in collaboration with Payoneer and other payment processors.

Similarly, the company urged for search engine de-indexing of warez sites hosting malware and user education campaigns warning about cracked software risks.

"The scale and sophistication of this network underscore the urgent need for coordinated, cross-border action to dismantle such operations before they cause irreversible damage to individuals, businesses, and critical infrastructure,” said Ravi.

MORE FROM ITPRO

• Why ‘malware as a service’ is becoming a serious problem
• Devs face a torrent of malware threats as malicious open source packages surge 188%
• The best malware removal tools for businesses in 2025

Advanced attack capabilities are becoming accessible to almost anyone as adversaries offer platforms that can be used by cybercriminals with little expertise. A prime example of this is malware as a service (MaaS), an out-of-the-box solution similar to software as a service (SaaS) that allows even low skilled criminals to access tools to carry out sophisticated cyberattacks.

Over the last year, MaaS has been growing in popularity. Research shows there was a distinct surge in separate malware campaigns delivering the same payload in 2024, suggesting hackers are increasingly procuring tools from MaaS platforms.

Recent Darktrace research found the MaaS model was responsible for 57% of all cyber threats detected in the second half of 2024, up 17% from the first half of the year. Meanwhile, a report from WatchGuard reported an “astronomical surge” in malware threats in the third quarter of 2024, surpassing 420,000 – a 300% increase on the previous quarter’s figures and the largest quarterly rise it has ever observed.

So, what exactly is MaaS, why is it so popular with adversaries and what can businesses do to protect themselves against this growing threat?

MaaS – a subscription-based model

Much like SaaS, MaaS offers a subscription-based model. This sees technically skilled developers rent out malware to other cyber criminals, who use it for malicious purposes.

MaaS offers advanced capabilities to those lacking the technical expertise to develop the tools themselves, says Boris Cipot, senior security engineer at Black Duck. “This accessibility has driven rapid growth in the MaaS market, and it continues to expand at a significant pace.”

Because attackers no longer need to develop their own malware, the barriers to entry are much lower, says Nathaniel Jones, VP, security and AI strategy at Darktrace. “Criminals can operate attacks almost like a legitimate business, processing payments and creating subscription-based or one-off payment models.”

Like legitimate services, tools on offer also receive regular updates, incorporating plugins that exploit newly-discovered vulnerabilities.

MaaS offerings are extensive and can be “highly sophisticated and structured”, says Ian Porteous, regional director of security engineering and UK&I at Check Point Software. “Many include marketplace portals on the dark web, user-friendly interfaces for managing malware campaigns – and even technical support services.”

Another benefit of MaaS to cybercriminals is the anonymity it provides, with attackers able to use the malicious tools within the platform without revealing their identity or even operating under a specific name or group.

“Payments are often made via cryptocurrency, and with profit sharing, bonuses, promotions and other partner or associate benefits further confusing the financial transaction flows,” explains Rob Vann, CSO at Cyberfort.

It is also available relatively cheaply, depending on the package. Basic malware kits can typically be rented for around £80 ($108) to £400 ($543) per month, with more complex packages costing thousands. “Despite crackdowns, MaaS persists due to anonymized transactions on dark web marketplaces and evolving tactics that exploit weaker defences in vulnerable industries,” says Kevin Curran, IEEE senior member and professor of cybersecurity at Ulster university.

AI-enhanced MaaS

The growth of MaaS is a concern on its own. But experts warn malware kits are getting better at what they do due to technology such as AI. This is enabling attackers to create “adaptive malware that can evade traditional security measures”, says Matt Riley, data protection and information security officer at Sharp UK and Europe.

For example, AI tools could generate payloads designed to fool antivirus and machine learning-based detection models, disguising true intent by masquerading as legitimate code, says Vann.

Porteous points to OpenAI’s February 2025 report. “This highlights how North Korean-affiliated actors have used ChatGPT to research cyber intrusion techniques, develop PowerShell scripts for automation, and debug code for remote desktop protocol attacks. Given these findings, it is highly likely that MaaS operators are leveraging AI in similar ways.”

One of the most immediate impacts of AI on cyber crime is its ability to generate more convincing phishing attacks, says Porteous. “Generative AI can create highly personalized phishing emails that lack the grammatical errors and other red flags that security professionals have traditionally relied on to detect scams. MaaS platforms can integrate AI-powered tools to automate and scale these phishing campaigns with unprecedented efficiency.”

In the future, AI could be used for marketing and sales, too. Although there is no real evidence of this yet, there are indications that marketplaces are starting to utilize AI to drive interactions between the most lucrative vendors and partners, says Vann. “We expect to see the use of AI to build and leverage strong MaaS platforms, establish reputations for payments, and select partner relationships, special offers and other promotions to continue to drive financial performance in this area of cybercrime.”

What should businesses do about MaaS?

MaaS is being used more widely than ever before and it’s easy to see why. With this in mind, businesses should ensure they are in a solid position to defend against attacks utilising the criminal model.

It starts with good cyber hygiene. Make sure you do the basics well, says Vann. “Ensure that you aren’t the softest target, enforce multi factor authentication (MFA) and make sure security tooling is up to date and functioning correctly.”

Meanwhile, train employees with real world examples of deepfakes, AI-crafted phishing emails and other advanced techniques, he advises.

Layered cybersecurity strategies are “crucial”, adds Curran. “Advanced endpoint protection with AI is key to stopping smart malware. If a system does become compromised, network segmentation can limit the spread.”

Email filtering solutions should be in place and a zero trust security model will ensure no user or device is automatically trusted, say Curran. Investing in cyber threat intelligence and “a solid incident response plan” will help organizations to detect and mitigate threats faster, Curran adds.

At the same time, Curran emphasizes the importance of regularly backing up critical data offline. “This will ensure a swift and seamless recovery when – not if – an organization is attacked. This can even avoid the need to pay a ransom when critical systems are required back online quickly.”

Regularly updating and patching software to close vulnerabilities is “another vital step”, says Riley. “Cybercriminals often exploit outdated systems, and without these updates, even the most sophisticated defences can be bypassed.”

The number of open source malware packages is rising fast, and security researchers are warning software developers to remain vigilant.

Software supply chain security firm Sonatype reports that it uncovered 16,279 malicious open source packages across major ecosystems, including npm and PyPI, over the last quarter.

Overall, the total volume of malware logged by the firm has surged by 188% compared with the same quarter last year.

"Attackers are no longer simply experimenting with open source. The numbers are telling us that threat actors have identified data as the most profitable target, and developers as the easiest way in," said Brian Fox, CTO and co-founder of Sonatype.

“Developers and security teams must be vigilant, as threats increasingly hide in plain sight within everyday tools and dependencies.”

The main threat vector was data exfiltration, accounting for 55% of all malicious packages discovered. In the second quarter alone, Sonatype found more than 4,400 packages were specifically designed to steal sensitive data, including secrets, personally identifiable information (PII), passwords, access tokens, and API keys.

There was also a big rise in malware focused on data corruption, which now accounts for 3% of all malicious packages, twice as many as last year.

Meanwhile, cryptomining malware accounted for 5% of all packages in the second quarter, slightly down from the previous quarter. Sonatype attributed this to a shift among attackers from resource exploitation to credential theft and long-term infiltration.

Many of the packages used advanced techniques for exfiltrating sensitive data, including exfiltrating .git-credentials, AWS secrets, and environment variables; targeting developer systems to harvest credentials used in CI/CD pipelines; and using time-delayed payloads and encrypted transmissions to avoid detection.

"We continue to see a large volume of malware targeting environment variables, config files, and other common places used by CI/CD tools and cloud services to store sensitive information," said Sonatype principal security researcher Garrett Calpouzos.

"Once attackers collect these credentials, they can attempt unauthorized access to cloud accounts, APIs, databases, and internal systems, opening the door to broader compromise and exploitation."

Open source ecosystem threats are growing

The notorious Lazarus Group, an Advanced Persistent Threat (APT) associated with the North Korean regime, was behind 107 packages, accounting for more than 30,050 known downloads.

Earlier this year, SecurityScorecard revealed that the group's latest campaign, dubbed Operation Marstech Mayhem, was based on an advanced implant named Marstech1 and designed to compromise software developers and cryptocurrency wallets through manipulated open source repositories.

By embedding its malware inside NPM packages, researchers said it made it almost impossible for developers to detect without thorough vetting.

Similarly, Fortinet warned last year it had identified thousands of malicious packages distributed across open source repositories.

The packages included lightweight code designed to evade detection, scripts that execute malware upon installation and packages lacking repository URLs, making them harder to trace.

MORE FROM ITPRO

• Malware-free attacks surged in 2024 as attackers drop malicious software for legitimate tools
• A ‘significant increase’ in infostealer malware attacks left 3.9 billion credentials exposed to cyber criminals last year
• Why ‘malware as a service’ is becoming a serious problem

OpenAI has taken down a host of ChatGPT accounts linked to state-sponsored threat actors as it continues to tackle malicious use of its AI tools.

The ten banned accounts, which have links to groups in China, Russia, and Iran, were used to support cyber crime campaigns, the company revealed late last week.

"By using AI as a force multiplier for our expert investigative teams, in the three months since our last report we’ve been able to detect, disrupt, and expose abusive activity including social engineering, cyber espionage, deceptive employment schemes, covert influence operations and scams," OpenAI said in a blog post detailing the takedown.

Four of the campaigns appear to have originated in China, generating posts in English, Chinese, and Urdu that were then posted on social media sites including TikTok, X, Reddit, and Facebook.

Topics included Taiwan, specifically targeting Reversed Front, a video and board game that depicts resistance against the Chinese Communist Party, along with posts on Pakistani activist Mahrang Baloch, who has publicly criticized China’s investments in Balochistan and the closure of the US Agency for International Development (USAID).

Meanwhile, a group of ChatGPT accounts apparently operated by a Russian-speaking threat actor were banned. OpenAI said these were being used to develop and refine malware strains aimed at targeting Windows devices.

Threat actors also used the chatbot to debug code in multiple languages and to set up their command-and-control infrastructure.

Other China-linked accounts - dubbed Uncle Spam - were used to create social media posts on US politics, particularly tariffs.

"We banned ChatGPT accounts that were generating short recruitment-style messages in English, Spanish, Swahili, Kinyarwanda, German, and Haitian Creole.” the company said. “These messages offered recipients high salaries for trivial tasks — such as liking social media posts —and encouraged them to recruit others."

Sam Rubin, SVP of Unit 42 at Palo Alto Networks, said the report aligned with what its own cybersecurity specialists have been seeing in recent months.

Threat actors are increasingly flocking to AI tools to support and ramp up operations and activities, he noted.

"Attacker use of LLMs is accelerating, and as these models become more advanced, we can expect attacks to increase in speed, scale, and sophistication. It’s no surprise that threat actors — from profit-driven cybercriminals to state-sponsored groups like those aligned with China — are embracing LLMs,” Rubin commented.

“They lower the barrier to entry and dramatically improve the believability of malicious content. In one model we tested, 51 out of 123 malicious prompts slipped past safety filters — a 41% failure rate that makes it clear today’s guardrails aren’t holding the line."

MORE FROM ITPRO

• AI-enabled cyber attacks exacerbated by digital divide in UK
• Agentic AI could be a blessing and a curse for cybersecurity
• Executives think AI can supercharge cybersecurity teams – analysts aren’t convinced

Hundreds of servers have been taken down as part of an international law enforcement operation against ransomware groups.

Coordinated by Europol and Eurojust, the action saw key infrastructure dismantled over the last week, with 300 servers taken down, 650 domains neutralized, and nearly two dozen international arrest warrants issued.

In a statement confirming the campaign, Europol revealed more than €3.5 million in cryptocurrency was seized.

This brings the total amount netted during Operation Endgame - an ongoing, international operation against ransomware services and infrastructure - up to more than €21.2 million.

The operation focused on initial access malware, and neutralized the Bumblebee, Lactrodectus, Qakbot, Hijackloader, DanaBot, Trickbot, and Warmcookie malware strains.

Arrest warrants were issued against 20 individuals believed to be providing or operating initial access services to ransomware operators.

This latest phase of Operation Endgame follows on from the largest-ever international action against botnets in May 2024. That targeted the new malware variants and successor groups that had re-emerged after previous takedowns.

"This new phase demonstrates law enforcement’s ability to adapt and strike again, even as cyber criminals retool and reorganize," said Europol executive director Catherine De Bolle.

"By disrupting the services criminals rely on to deploy ransomware, we are breaking the kill chain at its source."

Europol has now put out a public appeal to track down suspects who are believed to have provided or operated the ransomware tools.

DanaBot ransomware criminals snared

Meanwhile, also as part of Operation Endgame, the US Department of Justice has indicted a series of people associated with two of the ransomware groups.

Russian national Rustam Rafailevich Gallyamov, 48, is charged with leading the cyber crime group that developed and deployed the Qakbot malware.

From 2019 onward, it's alleged, Gallyamov used the Qakbot malware to infect thousands of computers around the world as part of a botnet.

Once in, he's said to have provided access to co-conspirators who infected the computers with ransomware, including Prolock, Dopplepaymer, Egregor, REvil, Conti, Name Locker, Black Basta, and Cactus.

In exchange, he allegedly received part of the ransoms received from victims.

Similarly, another 16 people have been indicted for developing and deploying the DanaBot malware, which infected more than 300,000 computers around the world for fraud and ransomware, and which caused at least $50 million in damage.

"The enforcement actions announced today, made possible by enduring law enforcement and industry partnerships across the globe, disrupted a significant cyber threat group, who were profiting from the theft of victim data and the targeting of sensitive networks," said special agent in charge Kenneth DeChellis of the Department of Defense Cyber Field Office.

"The DanaBot malware was a clear threat to the Department of Defense and our partners. DCIS will vigorously defend our infrastructure, personnel, and intellectual property."

MORE FROM ITPRO

• What is polymorphic malware?
• Why ‘malware as a service’ is becoming a serious problem
• Malware-free attacks: The threat to businesses

Polymorphic malware is one of the most sophisticated threats in cybersecurity today, with the ability to constantly change its appearance unlike traditional malware that remains static in its code structure.

Polymorphic malware is defined by its ability to alter its code or structure every time it executes while still performing the same malicious action. It typically uses tactics like dynamic encryption, code obfuscation, and randomized decryption stubs to ensure that each version of itself looks unique.

This ability to ‘mutate’, altering its own code without losing its malicious core function, allows polymorphic malware to slip past signature-based detection tools undetected, making it a nightmare for legacy antivirus systems and a challenge even for seasoned security teams.

“The clue is in the name,” explains Rob Pocock, technology director at Red Helix. “Traditional antivirus solutions rely heavily on signature-based detection – they look for known patterns. Polymorphic malware constantly changes its code to avoid detection, so signature-based tools simply can’t keep up.”

Most consumer-grade antivirus software uses signature-based detection, which identifies malware by comparing it against a database of known code patterns. But when the malware keeps changing its appearance, this approach breaks down.

Alex Hinchliffe, a principal threat researcher at Unit 42, tells ITPro that polymorphic malware can modify its code with every replication. “Each time a malicious program is compiled, it yields a new unique fingerprint or hash. Add free compression or packing tools, and you get even more variation.”

Polymorphic malware is evolving fast

Polymorphic malware has moved far beyond manual code tweaking. Today, threat groups use automated toolkits to churn out thousands of variants at scale. Some even use AI to determine the best mutating times and methods.

As Pocock explains: “We’re seeing a sharp rise in the accessibility and sophistication of polymorphic malware. Even low-skilled attackers can use malware kits with built-in mutation engines. AI is also being used to morph the code intelligently — maximizing stealth.”

Axel Maisonneuve, technical education contributor at BSV Association, adds that these threats now commonly use memory injection, fileless execution, and "living-off-the-land" binaries (LOLBins), such as PowerShell and WMI. These techniques allow malware to blend in with normal system operations, reducing the chance of detection.

Aditya Sood, VP of security engineering at Aryaka, notes a similar trend. “Polymorphic malware has evolved to avoid detection using AI-driven engines, fileless techniques, and LOLBins. It’s increasingly delivered through phishing and embedded in trusted cloud services.”

No sector is immune – but some are more attractive

While polymorphic malware threatens every organization, attackers often focus on sectors with greater rewards or weaker defences.

"Virtually any organization could be a target," Pocock says, "but those handling sensitive or valuable data – like finance, healthcare, and government – tend to be hit more frequently."

Maisonneuve agrees, saying, “Hospitals, government agencies, banks, and critical infrastructure providers are especially at risk. They have valuable data and often complex or outdated systems. Even educational institutions are frequent targets due to underfunded cybersecurity and broad access needs.”

The threat isn't limited to major players. Any business that stores data or relies on digital operations can be a victim. With polymorphic malware being used by advanced threat actors and amateurs, a wide net is cast. No business is immune from these types of attacks.

Real-world examples of polymorphic malware

Several high-profile malware campaigns have used polymorphism to devastating effect. One of the earliest examples was the Storm Worm, which emerged in 2007. More recently, malware like Emotet, TrickBot, CryptoWall, and Ryuk ransomware have demonstrated the power of polymorphic techniques.

“Storm Worm was among the first to use large-scale automated polymorphism,” notes Sood. “CryptoWall changed payloads dynamically. And Emotet evolved into a polymorphic botnet, constantly morphing to avoid detection.”

Maisonneuve emphasizes that polymorphism was key to the success of these campaigns. “Emotet and TrickBot used polymorphic loaders and encryption stubs to slip past security tools. Ryuk was often dropped via these polymorphic channels, showing how effective these techniques are.”

One newer example is BlackMamba, a polymorphic malware created using generative AI. This underscores how AI can now be used offensively to engineer malware that adapts faster than human defenders can keep up.

Defending against polymorphic malware

A defense strategy based solely on signature detection is no longer enough. Experts unanimously agree that effective protection comes from layering multiple tools and practices together.

“Businesses need a multi-pronged, defence-in-depth approach,” said Oliver Fay, EMEA threat research lead at Accenture. “This includes technical hardening through strong patch management and layered controls, and human resilience through user training.”

“Defenders must rely on dynamic analysis – like sandboxing or behavior monitoring – to catch it in the act,” says Maisonneuve. These methods observe what a program does rather than how it looks, which is key for spotting ever-changing threats.

Key recommendations from cybersecurity experts include:

• Use behavior-based detection. Rather than looking for a specific signature, these tools focus on what a program does — such as deleting backups or injecting into system processes — which are strong indicators of malicious intent.
• Adopt a zero trust model. Strict access controls and constant verification of users and devices reduce the chance of lateral movement after an initial breach.
• Invest in email and network protection. Most attacks still begin with phishing. Techniques like DMARC enforcement, sandboxing, and network segmentation can limit the scope of an attack.
• Prioritize patching and updates. Unpatched systems are an open invitation to attackers. Automate updates whenever possible.
• Train your staff. Simulate phishing, teach file hygiene, and ensure users recognize signs of compromise.

Sood also emphasizes the role of incident response. “Automation and well-rehearsed plans are critical. Security teams must be ready to detect, investigate, and contain threats quickly.”

AI and machine learning are also proving especially effective in this fight. “These technologies can detect command-and-control activity, analyze process behavior, and scale response efforts dramatically,” said Hinchliffe. “They’re turning what used to be weeks of detection into real-time prevention.”

Polymorphic malware isn't science fiction, but a daily reality. Attackers constantly evolve their tools to bypass traditional defenses, and static signature-based systems aren't enough anymore. As Maisonneuve succinctly tells ITPro: “The mouse is constantly changing shape. If your defenses don’t adapt, you’re playing a losing game.”

Businesses must rethink their approach: shift from reactive to proactive, from static scans to dynamic monitoring, and from single-layer tools to integrated defense systems. And with attackers increasingly using automation and AI, defenders must follow suit.

Ultimately, protecting against polymorphic malware means moving beyond what malware looks like and focusing on what it does. That shift – supported by the right tools, processes, and people – is the only way to stay ahead of this fast-moving threat.

Security experts have issued an alert over a new social engineering campaign using Zoom’s remote control features to take over victim devices.

In a report from Trail of Bits, researchers attributed the campaign to a cyber criminal group known as ‘Elusive Comet’, which attempted to target the company’s CEO on social media.

The campaign in question centers around abusing the video conferencing software’s remote control feature, which allows participants to take control of another users’ computer.

In a blog post detailing the CEO’s exchange with the group, the firm said the attack started with an invitation to appear on ‘Bloomberg Crypto’ as part of an interview.

These invitations were sent via social media or email, using phony email addresses mimicking official Bloomberg accounts belonging to journalists. Notably, invitations were sent via Calendly links, the company said, which are intended to lure the victim under the guise of authenticity.

“Two separate Twitter accounts approached our CEO with invitations to participate in a “Bloomberg Crypto” series—a scenario that immediately raised red flags,” the firm said in a blog post.

“The attackers refused to communicate via email and directed scheduling through Calendly pages that clearly weren’t official Bloomberg properties. These operational anomalies, rather than technical indicators, revealed the attack for what it was.”

Trail of Bits identified a number of accounts linked to the campaign and warned organizations to update monitoring systems to include these new indicators.

These included:

• X: @KOanhHa
• X: @EditorStacy
• Email: bloombergconferences[@]gmail.com
• Zoom URL: https://us06web[.]zoom[.]us/j/84525670750
• Calendly URL: calendly[.]com/bloombergseries
• Calendly URL: calendly[.]com/cryptobloomberg

Zoom attack relies on user trust

Trail of Bits warned that with the campaign relying on a feature in a legitimate service, it could pose a serious risk to unwitting users.

Upon entering a call with the threat actors, they change display names to ‘Zoom’ to make the request “appear as a system notification”. If granted access, the attacker can assume control of the victim’s device to install malware, exfiltrate data, or steal cryptocurrency.

“What makes this attack particularly dangerous is the permission dialog’s similarity to other harmless Zoom notifications,” the firm said. “Users habituated to clicking “Approve” on Zoom prompts may grant complete control of their computer without realizing the implications.”

Max Gannon, Intelligence Manager at Cofense, echoed Trail of Bits’ comments on the campaign, noting that the use of legitimate software by cyber criminals has become a serious problem for enterprises.

“The malicious use of legitimate software is a growing trend we've continued to see in 2025,” he said.

“In this case, threat actors are leveraging legitimate Zoom and Calendly links to bypass security controls. As trusted domains, their use in this attack makes it more difficult to detect and block."

Analysis from Mimecast earlier this year highlighted the growing threat posed by cyber criminals using legitimate services in attack chains. In its most recent threat intelligence report, the firm flagged more than 5 billion threats in the second half of 2024 alone, with ‘living off trusted services’ (LOTS) attacks a key cause for concern.

Also known as malware-free attacks, this approach is useful in helping cyber criminals circumvent authentication practices at target organizations, the study noted.

MORE FROM ITPRO

• Infostealer malware: What’s the threat to businesses?
• Forget MFA fatigue, attackers are exploiting ‘click tolerance’ to trick users into infecting themselves with malware
• Zoom-themed cyber attacks fuel rapid malware growth

A North Korean state-sponsored hacker group has been targeting crypto developers through coding challenges as part of a fake recruitment process.

Posing as recruiters on LinkedIn, the Slow Pisces group asks developers to participate in compromised Python and JavaScript projects, infecting their systems using custom malware and leveraging GitHub repositories.

Analysis from Unit 42, Palo Alto Networks’ threat intelligence wing, shows the group mainly used projects in Python or JavaScript - probably depending on whether the target applied for a front-end or back-end development role. There were also a couple of Java-based repositories, researchers found.

The hackers are using two newly discovered malware strains, RN Loader and RN Stealer, along with new evasion techniques including YAML deserialization and EJS escapeFunction.

RN Loader sends basic information about the victim's device and operating system over HTTPS to the group's C2 server, while RN Stealer is an infostealer that exfiltrates data and compressed data.

Distribution of the malware is tightly controlled, going only to carefully validated targets based on factors such as their IP address, their location, time and HTTP headers.

"We have observed Slow Pisces impersonating several organizations with these lures, primarily in the cryptocurrency sector," said Unit 42.

"Slow Pisces presented targets with so-called coding challenges as projects from GitHub repositories. The repositories contained code adapted from open source projects, including applications for viewing and analyzing stock market data, statistics from European soccer leagues, weather data, and cryptocurrency prices."

Everything you need to know about the Slow Pisces group

Slow Pisces - also known as Jade Sleet, TraderTraitor and Pukchong - has been linked to a number of high-profile cryptocurrency thefts, having reportedly stolen over $1 billion from the cryptocurrency sector in 2023.

Their methods included fake trading applications, malware distributed via the Node Package Manager (NPM), and supply chain compromises.

In December 2024, the FBI attributed the theft of $308 million from a Japan-based cryptocurrency company to the group, and it was also allegedly involved in the theft of $1.5 billion from a Dubai cryptocurrency exchange.

Unit 42 said it shared its findings with GitHub and LinkedIn, both of which have removed the malicious accounts and repositories.

"Based on public reports of cryptocurrency heists, this campaign appears highly successful and likely to persist in 2025," said Unit 42.

"The most effective mitigation remains strict segregation of corporate and personal devices. This helps prevent the compromise of corporate systems from targeted social engineering campaigns."

North Korean hackers are on a roll

This is just the latest in a series of North Korean campaigns based around fake recruitment. More usually, the technique is for the criminals to pose as job applicants.

Research shows they've been infiltrating organizations in both the US and Europe to raise money for the North Korean regime, steal proprietary data, install malware on corporate systems, and demand ransom payments.

The rise of fake IT workers has prompted security agencies to issue several warnings over the growing risks faced by enterprises. Some victims have been vocal about the issue, including cybersecurity training firm KnowBe4, which revealed last year it had been duped by a threat actor posing as an IT worker.

Similarly, the techniques highlighted by Unit 42 are by no means novel. Threat groups such as Alluring Pisces and Contagious Interview have also exploited LinkedIn to target jobseekers.

Recent analysis from Bitdefender shows the social networking platform has become a prime hunting ground for cyber criminals, with a host of groups leveraging the platform to dupe unsuspecting users.

MORE FROM ITPRO

• Google warns that fake North Korean IT workers have expanded to Europe
• A developer crippled company networks with malicious code and a ‘kill switch’ after being sacked
• Want developers to build secure software? You need to ditch these two programming languages

While inflation is rising around the world, some things are getting cheaper - and one is the cost of launching a phishing attack.

Phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.

This means that even criminals with minimal tech skills can easily steal personal information, carry out identity theft and access bank accounts. Meanwhile, malware infections can lead to the complete loss of device control, enabling cyber criminals to steal files, encrypt sensitive data, or launch ransomware attacks.

"Phishing kits are a force multiplier for cyber crime. They put powerful attack tools into the hands of people who may not have the skills to build them on their own," said Adrianus Warmenhoven, a cybersecurity expert at NordVPN.

"With features like drag-and-drop website builders, email templates, and even contact lists, these kits enable even the least technical attackers to carry out professional-looking scams."

Phishing as a Service is booming

Meanwhile, subscription-based Phishing as a Service (PhaaS) is also on the rise, with these services handling everything from hosting to victim targeting.

“Phishing kits and PhaaS platforms lower the barrier to entry, so we’re seeing a surge in the number and variety of attacks. That means consumers need to be more alert than ever," said Warmenhoven.

The research team found that last year's most commonly impersonated brands in phishing attacks were Google, Facebook, and Microsoft - and that fake URLs imitating these popular platforms are a primary method for cyber criminals to harvest credentials.

Nearly 85,000 fake Google URLs were discovered last year.

Similarly, .exe, .zip, .php, .dll and .pdf were the riskiest extensions when downloading files. Video hosting, entertainment and sports, meanwhile, were the domain categories with the most malware.

According to research from Barracuda Networks, the first quarter of this year showed a massive spike in phishing, with more than a million attacks detected by the firm's systems in January and February.

Tycoon 2FA was the most prominent - and sophisticated - platform, accounting for 89% of incidents in January 2025. Next came EvilProxy, with a share of 8%, followed by a new contender, Sneaky 2FA, with a 3% share of attacks.

To stay safe, Warmenhoven recommended constantly checking suspicious links for misspellings or inconsistencies before clicking, avoiding free video hosting sites, and enabling multi-factor authentication.

"Be cautious of unsolicited emails, especially those offering deals or urgent requests. Always verify the legitimacy of files before downloading and use anti-malware tools to scan them," he said.

"Protect your privacy using tracker blockers to block personal data collection, and ensure your devices are regularly updated to close security vulnerabilities."

MORE FROM ITPRO

• A new phishing campaign is exploiting Microsoft’s legacy ADFS identity solution to steal credentials and bypass MFA
• Why ‘malware as a service’ is becoming a serious problem
• Hackers are using this new phishing technique to bypass MFA

Europol has detained several people believed to be involved in a botnet operation as part of a follow-up to a major takedown last year.

Following the Operation Endgame investigation, major malware droppers including IcedID, SystemBC, Pikabot, Smokeloader and Bumblebee, were shut down last year.

According to Europol, analysis of the contents of a seized database enabled it to identify customers of the SmokeLoader pay-per-install botnet, operated by an individual known as ‘Superstar’.

The law enforcement agency has now made arrests, carried out house searches, and conducted arrest warrants or ‘knock and talks’.

"Superstar used his botnet to run a pay-per-install service, enabling customers to gain access to victims’ machines. Customers used the service to deploy malware for their own criminal activities," Europol said.

"Investigations revealed that botnet access was purchased for a range of purposes, including keylogging, webcam access, ransomware deployment, cryptomining and more. Law enforcement tracked down the customers as they were registered in a database seized during Operation Endgame."

The malware had infected millions of computers around the world, according to the FBI. SystemBC facilitated anonymous communication between an infected system and a command-and-control servers.

Meanwhile, Bumblebee was distributed mainly via phishing campaigns or compromised websites, and was designed to enable the delivery and execution of further payloads on compromised systems.

SmokeLoader was mainly used as a downloader to install additional malicious software onto the systems it infected. Similarly, IcedID - also known as BokBot - had been further developed to carry out a range of crimes as well as the theft of financial data.

Europol hails success of largest botnet takedown

As part of last year's operation - the largest ever against a botnet - more than 100 servers were shut down or disrupted and over 2,000 internet domains tied to the hacking activities were seized.

But while last May's activities were focused on the high-level players who were using ransomware, for example, this latest set of raids is designed to mop up the customers of Cybercrime as a Service providers.

Law enforcement agencies in several countries were able to link online personas and their usernames to actual individuals.

"When called in for questioning, several suspects chose to cooperate with the authorities by facilitating the examination of digital evidence stored on their personal devices," Europol said.

"Several suspects resold the services purchased from SmokeLoader at a markup, thus adding an additional layer of interest to the investigation."

Europol said it’s not quite finished yet, either. The law enforcement agency is still investigating possible leads, revealing it has more suspects in the crosshairs.

MORE FROM ITPRO

• Botnets are being sold on the dark web for as little as $99
• Cobalt Strike abusers have been dealt a hammer blow
• The Zservers takedown is another big win for law enforcement

A new version of the Neptune RAT malware has emerged, security researchers have warned, and is spreading on GitHub, Telegram, and even YouTube.

The remote access trojan is 'an extremely serious threat' being offered on the ransomware-as-a-service model, according to researchers at Cyfirma.

Affecting Windows devices, it hijacks Chromium-based browsers including Chrome, Brave, and Opera using a Chromium.dll attack that decrypts stored login data and installs itself as a scheduled Windows task.

It includes a crypto clipper and a password stealer with the ability to exfiltrate the credentials of more than 270 different applications, along with ransomware capabilities and live desktop monitoring.

Advanced anti-analysis techniques and persistence methods, such as modifying the Windows Registry and adding tasks to the Task Scheduler, mean it can maintain its presence on the victim’s system for extended periods of time.

"The analysis of the latest version of Neptune RAT reveals a sophisticated and highly dangerous piece of malware designed for persistent, covert operations on Windows systems," Cyfirma researchers said.

"Its ability to generate direct PowerShell commands (using irm and iex) enables seamless delivery and execution, effectively bypassing traditional security measures. It also has the capability to destroy Windows OS and features advanced password-grabbing functionalities."

Neptune RAT lowers the bar for cyber criminals

The new version has been made available without the source code, making analysis more challenging. Notably, it's being offered via an unusual model, with the developer claiming that while it's free to use, there's a more advanced version behind a paywall.

Chris Hauk, consumer privacy advocate at Pixel Privacy, said the emergence of the new Neptune RAT variant shows the “try it before you buy it era of malware has arrived”.

“Neptune RAT is available as a download from GitHub, making it available to a wider variety of internet users than usual," he said.

"As antivirus and anti-malware apps have not yet been able to detect and remove Neptune RAT, internet users will need to stay alert and practice safe computing by not clicking on links or opening attachments that are shared by unknown users."

Paul Bischoff, consumer privacy advocate at Comparitech, echoed Hauk’s comments, noting that the accessibility of the variant will have wide-reaching implications for consumers and enterprises alike and lower the barrier of entry for cyber criminals.

"The maker of Neptune RAT is giving their malware out for free, so it's not just one hacker group we need to worry about," he said.

"Anyone could use it to launch attacks through email, text, ads, or download links. Once the malware has infected a system, it is extremely destructive, dangerous, and hard to remove."

Given its anti-detection features, the new Neptune RAT version is hard to avoid, Cyfirma researchers said, adding that this poses a “significant risk to both individuals and organizations”.

"Continuous monitoring, robust endpoint protection, and proactive threat detection strategies are crucial to mitigating the impact of this malware."

MORE FROM ITPRO

• Small businesses face continued security threats as trojan attacks surge
• Why ‘malware as a service’ is becoming a serious problem
• Malware-free attacks surged in 2024 as attackers drop malicious software for legitimate tools

Organizations are at risk of falling prey to a common network vulnerability that allows threat actors to evade detection and spread malware with impunity, law enforcement agencies have warned.

‘Fast flux’ is a domain-based technique used to hide communications sent by malware to its command and control (C2) infrastructure – the malicious servers that send out updates and new directions to malware on infected devices.

It works by repeatedly changing the DNS records for the C2 infrastructure so that no one domain is easily identifiable by the victim’s cybersecurity team.

Constantly shifting IP addresses also means that even if one is flagged as malicious and blocked, the malware can easily contact the C2 again through any number of other addresses.

To make matters harder for cybersecurity teams, the commands sent to the malware are often relayed via botnets, a swarm of infected devices. This further muddies the water when it comes to tracing signals, giving the hackers behind the C2 an extra layer of anonymity.

A more intensive method known as ‘double flux’ sees threat actors also swap out the DNS name servers used to store records for their malicious site, as an additional protection against being discovered by law enforcement.

Fast flux allows threat groups to cycle out IP addresses as many as several hundred times in a day, severely limiting the capability of security teams to pin down their malicious communications.

‘Fast flux’ techniques are being used to devastating effect

The use of fast flux techniques have been observed in Hive ransomware activity, by other ransomware groups as well as state-sponsored entities such as the Russian advanced persistent threat (APT) group, Aqua Blizzard.

The methods were laid out in an advisory issued by the Cybersecurity and Infrastructure Security Agency (CISA) alongside the National Security Agency (NSA) and Federal Bureau of Investigation (FBI).

Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), Canadian Centre for Cyber Security (CCCS), and New Zealand’s National Cyber Security Centre (NCSC-NZ) also issues the joint warning.

The combined law enforcement agencies noted that fast flux is also used to prevent authorities from disabling social engineering websites and to keep hacking forums online.

Fighting fast flux

To mitigate the threat posed by these techniques, security experts urged all organizations to adopt protective domain name system (PDNS) services, which come with features such as DNS sinkholing.

This allows security teams to intercept and block malicious DNS requests, thereby stemming the flow of attacks and flagging infected.

PDNS services also offer advanced monitoring, filtering, and analysis. It is available via a range of providers, as well as free of charge to select services in the UK via the National Cyber Security Centre (NCSC).

“Fast flux is an ongoing, serious threat to national security, and this guidance shares important insight we’ve gathered about the threat,” said Dave Luber, NSA Cybersecurity Director.

“It is imperative cybersecurity providers, especially Protective DNS providers, follow these guidelines to safeguard critical infrastructure and sensitive information.”

In addition to their advice for all organizations, the combined agencies provided cybersecurity service providers (CSPs) and internet service providers (ISPs) with a number of techniques known to produce good results against fast flux.

This included greater reliance on intelligence feeds to flag malicious domains, better use of anomaly detection to detect domains with unusually diverse IP addresses or geolocation data, and to create advanced algorithms that can match anomalous behavior with fast flux methodology.

MORE FROM ITPRO

• CISA breached a federal agency as part of its red team program — and nobody noticed for five months
• Why CISA is extending cyber support to ‘resource poor’ organizations
• CISA issues warning over Medusa ransomware after 300 victims from critical sectors impacted

Infostealers have been around for some time but recently they’ve been making headlines. This targeted malware, created to compromise the systems of victims and exfiltrate sensitive information, is on the rise and poses an active threat to all businesses.

A recent report found that infostealers exposed billions of credentials in 2024, with KELA Cyber Threat Intelligence measuring 4.3 million machines infected with the malware around the world.

Infostealers were used in headline-grabbing attacks in the past year such as the Snowflake data breach and sometimes come as a precursor to ransomware attacks.

So how big is the threat posed by infostealers and what needs to be done to protect against them?

Infostealers at work

Infostealers are malicious programs designed to extract sensitive data, such as passwords, session cookies and authentication tokens. Their goal is clear: to gain access to accounts, platforms or corporate networks, says Axel Maisonneuve, technical education contributor at BSV Association.

He calls infostealers “highly effective” due to their “small size, speed and ability to operate stealthily” – which means they often go undetected.

Infostealers typically arrive via phishing emails, compromised URLs, infected downloads, or flaws in software operating systems, Kevin Curran, IEEE senior member and professor of cybersecurity at Ulster University explains.

“Once on the device, the malware looks for certain kinds of information, including browser passwords, autofill data such as credit card numbers and addresses, cryptocurrency wallet data, system data and session cookies for accounts currently logged in. After collecting the information, the malware sends the data to an attacker-controlled server, or makes it available for download.”

Once extracted, the stolen data is often packaged up and sold on an auto shop – a dark web marketplace that specializes in the sale of digital products – for a relatively small price.

However, particularly valuable stolen data can be sold for several hundred dollars, says Robert Fitzsimons, lead threat intelligence engineer at Searchlight Cyber. “Similarly, information can be disseminated on platforms including Telegram and dark web hacker forums to be used by other threat actors such as ransomware groups during the reconnaissance phase of further attacks.”

Infostealers are now widely accessible thanks to the rise of the malware as a service (MaaS) model, says Maisonneuve. “Platforms such as Raccoon Stealer and Redline are available via subscription in underground forums, while advanced persistent threat (APT) groups use them for large-scale espionage.”

Infostealer examples

One of the most well-known examples of an infostealer is Emotet, which initially started as a banking Trojan but evolved into a powerful infostealing tool. “Emotet’s capabilities have enabled large-scale ransomware operations, making it infamous in the cybersecurity landscape,” says Dray Agha, senior manager of security operations at Huntress.

Another emerging example is Lumma Stealer, a more recent malware variant. “Lumma Stealer is notable for its ability to capture information related to multi-factor authentication (MFA), undermining critical layers of security and leaving victims exposed to further attacks,” Agha explains.

An increasing number of infostealer campaigns are leveraging fake CAPTCHA pages to deliver Lumma Stealer malware, says Stefan Tenase, cyber intelligence expert at CSIS. “While thinking they are solving a CAPTCHA to prove they are human, victims are duped into pasting malicious PowerShell code into their systems, showcasing how simple yet effective social engineering tactics can be.”

John Flatley, consulting solutions architect at Barracuda describes how the firm recently observed a phishing campaign delivering a sophisticated infostealer capable of collecting extensive data, including browser session cookies, saved credit card details, cryptocurrency wallet extensions and PDF files. “The attack started with a phishing email and unfolded in stages to finally reveal the obfuscated infostealer malware.

“Once deployed, the infostealer exfiltrated the sensitive information to attacker-controlled email accounts for selling onwards, or for financial theft or lateral movement within an organization.”

Prashant Kumar, X-Labs security researcher at Forcepoint describes how the firm’s research teams have seen increased activity from a new infostealer targeting businesses called VIPKeyLogger, which circulates through phishing campaigns as an attachment. “Opening the attachment leads to a sequence of events that ultimately ends up with data exfiltration such as recording keystrokes and collecting information including clipboard data, screenshots and browser history.”

Another campaign circulated in the holiday season was the Rhadamanthys stealer, which masquerades as travel industry emails, says Kumar. “Clicking the documents triggers a chain of downloads and obfuscated scripts to steal user credentials and cryptocurrency wallet data.”

Protecting your business from infostealers

The threat from infostealers is growing, but thankfully, there are tools and techniques to avoid being hit.

Defending against infostealers requires a comprehensive approach to cybersecurity, emphasizing preventative measures and advanced tools, says Agha. One critical part of this is security awareness training, which helps employees recognize and avoid common attack methods such as phishing attempts and malicious links, he says.

It's also important to use antivirus and anti-malware solutions with real-time scanning capabilities, says Curran. “These act to detect and block malware, including spyware and keyloggers.”

Trusted password managers are “essential for generating and securely storing strong, unique passwords”, he says. However, he warns that storing passwords directly in browsers can make them vulnerable to infostealer attacks.

Once they're inside your organization, infostealers can be difficult to spot. With this in mind, Fitzsimons advises monitoring dark web forums for stolen data logs related to your company. “This means you can more easily identify the compromised device, where the infostealer is installed and when it was infected. You can then take quick action to contain its spread within your network.”

Keeping software and systems up to date is also important to avoid being impacted by infostealers, says Agha. “Regular updates and patching help close the vulnerabilities attackers often exploit to deploy malware. Additionally, implementing strong authentication practices, such as MFA, adds an extra layer of security. Even if login credentials are compromised, MFA can prevent unauthorized access to critical systems.”

The FBI has issued an alert over the rise of fake file converter tools online after observing a spate of scams and ransomware attacks.

According to the FBI Denver Field Office, cyber criminals are creating free online document converter tools to load malware onto victims’ computers, leading in some cases to identity theft or ransom demands.

Threat actors are exploiting a range of file converter or downloader tools, officials warned, including one website claiming to convert one type of file to another, such as a .doc file to a .pdf file.

The tool may also claim to combine files, such as joining multiple .jpg files into one .pdf file, or to be an MP3 or MP4 downloading tool.

These converters and downloading tools will do the job they claim, but leave the resulting file holding hidden malware that gives criminals access to the victim’s computer.

These tools can also scrape the submitted files for personal identifying information, such as social security numbers, dates of birth, phone numbers, banking information, cryptocurrency information such as seed phrases or wallet addresses, email addresses, and passwords.

"The best way to thwart these fraudsters is to educate people so they don’t fall victim to these fraudsters in the first place," said FBI Denver special agent in charge Mark Michalek.

"If you or someone you know has been affected by this scheme, we encourage you to make a report and take actions to protect your assets. Every day, we are working to hold these scammers accountable and provide victims with the resources they need."

How to spot fake file converter tools

Malwarebytes has identified some of these suspect file converters, which include Imageconvertors.com, convertitoremp3.it, convertisseurs-pdf.com and convertscloud.com.

There are several techniques used by the cyber criminals, according to Malwarebytes.

"They encourage you to download a tool on your device to do the conversion. This is the actual malware. You might be recommended to install a browser extension that you can use going forward. These extensions are often browser hijackers and adware," it said.

"In the most sophisticated scenario, the so-called converted file contains malware code that downloads and install an information stealer and everyone who opens it will get their device infected."

A suspect file converter tool is believed to have been behind the hack of major US local newspaper publisher Lee Enterprises last month, claimed by the Qilin ransomware operation.

The attack affected a number of the company's business operations, including product distribution, billing, collections, and vendor payments.

Lee Enterprises said it wasn't clear whether any sensitive data or personally identifiable information was compromised during the breach.

MORE FROM ITPRO

• Forget MFA fatigue, attackers are exploiting ‘click tolerance’ to trick users into infecting themselves with malware
• Malware-free attacks surged in 2024
• Why ‘malware as a service’ is becoming a serious problem

Threat actors are exploiting users’ familiarity with verification tests to trick them into loading malware onto their systems, new research has warned.

A report from HP Wolf Security highlighted multiple threat campaigns where hackers took advantage of the fact users are forced to jump through a growing number of hoops to prove they are a legitimate user.

The report describes this trend as ‘click tolerance’, where the prevalence of authentication protocols has led to users being accustomed to follow steps given to them.

In the cases observed by HP, the attackers used fake CAPTCHAs to redirect users to attacker-controlled sites which prompted them into completing a number of fake authentication steps.

As users progress through these steps, the website copies malicious code to their clipboard and subsequently prompts the victim to press a number of shortcuts that open a ‘run’ dialog and execute the code directly on their system.

Speaking to ITPro , Ian Pratt, global head of security at HP, said attacks like this are not necessarily new but this campaign stood out as it actually gets the victim to infect themselves, which helps the attackers bypass traditional security products.

“It’s certainly not the first time it’s been done but it’s been done really well and it’s being done at a scale we haven’t seen before,” he noted.

“It’s a really good way of bypassing a lot of security products because effectively the user typed it into the run box. It’s not like they downloaded a script. There was no file that the antivirus could look at and make a decision about. They just hit CTRL + V and it ran.”

What happens after you click

Much like previous social engineering tactics that relied on MFA fatigue to steal user’s one time passcodes (OTPS), this campaign illustrates how additional security protections also breeds new types of complacency attackers can exploit.

Pratt said this campaign relies on the idea that users are used to completing tedious authentication measures and often can’t distinguish between legitimate procedures and malicious ones.

“People are being trained that sometimes a screen is going to appear and then you’re going to have to click through it. Maybe you’ll be logging in, maybe it's just but people do it without thinking now and attackers are exploiting that with these fake CAPTCHAs.”

He argued that this has laid bare an obvious shortcoming in employee security training, noting that it’s important phishing training and other security awareness programs put more emphasis on what users do after they fall for the initial deception in the attack chain.

“I think that the most important part of phishing training is going forwards… what they should be adding to what they’re doing is that it’s actually what happens after you click that’s most important,” he explained.

“After you clicked on that thing, was it what you expected, was the content correct. Did anything seem off at that point? The most important thing you can do is report it because we’re seeing a lot of effort being put into the lures but not necessarily a lot of effort being put into the thing that you can get taken to, often it will be completely irrelevant content or a command shell flashes up on your screen.

“Anything suspicious like that, that’s the best opportunity of spotting that something’s gone wrong and then to disconnect your laptop from the network and go and call someone. That’s the big one.”

MORE FROM ITPRO

• Malware-free attacks surged in 2024 as attackers drop malicious software for legitimate tools
• Why 'malware as a service' is becoming a serious problem for enterprises
• Hunter-killer malware is on the rise, and security experts are seriously concerned

Researchers have warned that billions of credentials exposed to cyber criminals were sourced from infostealer logs last year – and it's created a ticking time bomb for enterprises as hackers begin cracking systems.

KELA Cyber Threat Intelligence’s State of Cybercrime 2024 report singled out infostealers as a persistent threat that usually serve as “precursors to advanced attacks, including ransomware and espionage”.

The firm said it observed more than 4.3 million machines around the world that had been infected with infostealer malware, such as Lumma stealer or RedLine, in 2024.

It estimated that this would account for more than 330 million credentials compromised using infostealers, which it said was slightly higher than the figures from 2023.

KELA warned that these credentials could be leveraged in future attacks that could balloon into “massive extortion campaigns”, citing the string of attacks leveraging compromised Snowflake credentials throughout 2024 that impacted at least 165 different companies.

In addition to the 330 million credentials KELA identified, the report said it also observed 3.9 billion credentials shared in the form of credential lists. These credential lists, commonly referred to as url:login:pass (ULP) files by threat actors, are compilations of data obtained during attacks.

These could be credentials harvested from a diverse range of sources, such as third-party breaches or phishing, but the report claimed that most ULP files are sourced from infostealer logs.

Lumma remains the most popular infostealer malware strain according to KELA, and was responsible for 40.48% of the infected machines in its data lake.

Other top offenders were StealC (20.29%, and Redline (16.43%), which KELA noted had been disrupted in October 2024 as part of Operation Magnus.

India, Brazil, and Indonesia were the top three most affected nations accounting for 20.12% of bots infected by infostealer malware in 2024.

KELA also highlighted the sensitive services most commonly targeted using these compromised credentials with the most frequently attacked being business cloud solutions (22.02%), CMS (21.19%), email (13.85%), and user authentication systems (11.5%).

How to protect yourself against infostealer threats

According to Huntress’ 2025 Cyber Threat Report, infostealers accounted for nearly a quarter (24%) of all cyber incidents in 2024, making it the most common threat category of the year.

Speaking to ITPro, Jaron Bradley, director of Jamf Threat Labs at Jamf, said infostealers campaigns are on the rise with evidence suggesting they are a particularly effective tactic used by threat actors.

“There has been a significant increase in Infostealer campaigns, and they have proven highly effective, even on macOS. These stealers are designed to target specific locations on the user's hard drive, seeking critical files such as usernames, passwords, browser session data, cryptocurrency wallets, documents, and more.”

Bradley added that the initial stages of infostealer campaigns require actions from the victim, so by improving overall security awareness businesses can mitigate some of the threat they pose to their organization.

“Users should be cautious about opening software sent by strangers, particularly if it comes with unusual instructions, such as right-clicking or adjusting settings,” he explained.

“For these infostealers to fully succeed, they also require the victim's login password, which is typically obtained by simply prompting the user with a popup window. Users should always question why an application would need their login credentials before willingly providing them.”

As well as investing in improving company-wide security awareness, KELA suggested a number of additional counter measures businesses can take to protect themselves.

These include deploying enhanced endpoint detection and response (EDR) solutions that use behavior-based analysis rather than solely signature-based methods to detect and isolate infostealer activity in real time.

Improved email security is also essential in preventing phishing attempts, which are the primary delivery method for infostealers, the report added.

Finally, network segmentation is another important defense layer used to limit lateral movement once the attacker is inside your perimeter and stop them from accessing critical systems and sensitive data.

MORE FROM ITPRO

• Nearly a million devices were infected in a huge GitHub malvertising campaign
• Cobalt Strike abusers have been dealt a hammer blow
• Java developers are facing serious productivity issues

There was a distinct surge in separate malware campaigns delivering the same payload last year, research shows, suggesting hackers are increasingly procuring tools from ‘malware as a service’ platforms.

The malware as a service model is becoming the dominant mode of cyber attacks as the cyber crime space continues to mature into a lucrative ecosystem for hackers for hire.

New research from Darktrace found the malware as a service (MaaS) model was responsible for 57% of all cyber threats detected in the second half of 2024, up 17% from the first half of the year.

A report from WatchGuard also warned it observed an “astronomical surge” in total malware threats in the third quarter of 2024, surpassing 420,000.

Total malware threats refers to the number of unique attempts detected on WatchGuard-protected endpoints with any duplicates - those with the same hash are not counted.

WatchGuard noted this represented a 300% increase on the previous quarter’s figures, which is the largest quarterly rise it has ever observed.

The report stated that one might conclude this surge was driven by an overall increase in new threats, but WatchGuard found that there was actually an “uncharacteristic decline in new threats”.

It noted that the results of its telemetry indicate there has been a “flood of homogenous spam-like malware arriving on endpoints, likely separate malware campaigns with the same payload”.

The report further stated that there are often numerous duplicate malware families from quarter to quarter, but this time there was only one: Glupteba.

WatchGuard described Glupteba as a multi-faceted malware with various capabilities, such as acting as a botnet, stealing information, mining cryptocurrency, and loading other malware onto the system.

Malware as a service rise propped up by phishing attacks

Phishing remains the dominant initial access vector used in these attacks, with Darktrace recording over 30.4 million phishing emails targeting its customers between December 2023 and 2024.

Just under two-fifths (38%) of these emails were targeted spear phishing attacks tailored for ‘high value individuals’.

Darktrace noted 32% of the detected phishing emails contained AI generated text that displayed some form of ‘linguistic complexity’ such as increased text volume, punctuation, and sentence length.

The sophistication of these techniques has blossomed, the report added, stating that 70% of the emails containing AI-enhanced phishing content passed the popular DMARC authentication system, which is used to verify the legitimacy of incoming emails.

Moreover, 55% of all the emails had successfully found their way through all of the target organization’s existing layers before being detected.

Attacks leveraging QR codes, or qishing, have become a growing trend in today’s threat landscape, exploiting the often-weaker security of mobile devices, and Darktrace detected just under a million (940,000) malicious QR codes in the emails it analyzed.

Legitimate service attacks are another key focus

The report also noted threat actors were often seen abusing legitimate services to lend authenticity to their scams. The researchers observed hackers exploiting a number of trusted services such as Microsoft Sharepoint, Zoom Docs, QuickBooks, HelloSign, and Adobe to disguise their sender address.

In addition, trusted service providers were also appropriated as parts of the threat actor’s attack infrastructure, Darktrace noted.

“Threat actors were frequently observed using redirects via legitimate services like Google to deliver malicious payloads, effectively evading detection,” the report said.

“Additionally,Darktrace noted instances where attackers hijacked email accounts, including Amazon Simple Email Service (SES) accounts, belonging to legitimate third parties, such as business partners and trusted vendors.”

ITPro learned that living off trusted services (LoTS) attacks are becoming an increasingly important part of the threat actors arsenal as general security awareness among their targets grows.

A recent report from security firm Mimecast explained that while these tactics often make their attacks more complex, it helps attackers get around increased authentication checks on corporate accounts.

It added that major cloud providers whose services are often abused in these attacks, namely Google and Microsoft, have begun taking steps to root out the malicious use of their platforms in such attacks.

As a result, threat actors have been observed migrating to slightly smaller trusted services providers that they can use to lend authenticity to their attacks.

MORE FROM ITPRO

• What is hackbot as a service and are malicious LLMs a risk?
• The ‘BlackLock’ group has become one of the most prolific operators in the cyber crime industry
• Open source malware surged by 156% in 2024

The BlackLock ransomware group has become one of the most prolific operators in the Ransomware as a Service (RaaS) ecosystem, with experts warning it could accelerate its growth over the next year.

Also known as El Dorado, BlackLock was ranked as the seventh most active ransomware group based on the number of posts on its data leak site by the end of 2024, marking a 1,425% growth from Q3.

Security firm ReliaQuest recently published research on the group and its rise to prominence, detailing its TTPs and why the operation has seen so much success in recent years.

The group was among the top three most active collectives on the RAMP forum, whose community listed BlackLock among the top ransomware operators in terms of their reputation on the site.

Reliaquest noted that BlackLock’s rise has been both “swift and strategic” and predicted that if the group’s activity continues at this pace it will go on to become the most active ransomware group in 2025.

The group is known to use double extortion tactics whereby they encrypt data while also stealing sensitive information, hoping to exert more pressure on victims with the potential threat of exposing the stolen information.

Its ransomware is custom-built to target Windows, VMWare ESXi, and Linux environments, although Reliquest noted that the Linux variant is less mature than its Windows counterpart.

Why BlackLock stands out from the crowd

The report identifies a number of ways in which BlackLock has set itself apart in what is a highly competitive digital extortion landscape, firstly with what it describes as an unusual leak site that uses a combination of unique tricks aimed at preventing researchers from downloading stolen data.

The site is “packed” with a number of features that Reliaquest speculates are intended to prevent targeted organizations from assessing the scope of their breaches.

“This, in turn, ramps up pressure on the organizations to quickly pay ransoms, often before they can fully evaluate the situation,” researchers said.

“These features also highlight BlackLock’s technical sophistication, reinforcing its reputation as a polished, professional operation.”

BlackLock’s use of custom-built malware is another indicator of their sophistication, Reliaquest added, which it said is a hallmark of top-tier groups such as Qlin or Play.

Competing groups like Bl00dy, Dragonforce, and RA World rely on externally developed ransomware builders such as leaked versions of Babuk or LockBit, the report notes, whereas BlackLock develops its own bespoke malware.

“While leaked ransomware builders are easy to use, they come with a major drawback: Security researchers can access and dissect the code, find weaknesses, and develop defenses against them. In contrast, BlackLock’s custom malware keeps researchers in the dark — at least until its source code is leaked.”

Reliaquest also reported the group has been actively recruiting affiliates known as ‘traffers’ to support the earlier stages of their attacks, whereas it has been far more discreet when looking to bring higher-level developers on board.

BlackLock targets need to be wary

The report identified potential indicators for BlackLock’s next major targets, citing forum activity that would suggest the group plans on exploiting Microsoft Entra Connect in an upcoming campaign.

A user known to represent BlackLock was found sharing security research on how attackers could abuse Entra Connect’s synchronization mechanism to manipulate user attributes and compromise on-prem environments.

“For organizations managing multiple domains under one tenant, this tactic creates a significant risk of privilege escalation and the potential for a major breach. While the blog describes the attack hypothetically, its feasibility and potential impact make it a serious concern.,” Reliaquest warned.

As a result, organizations should reassess the security of their infrastructure now, Reliaquest urged, stating that in particular, they should look to harden their rules around sensitive attributes, monitor and restrict key registrations, and enforce conditional access policies.

MORE FROM ITPRO

• Life after LockBit: A fragmented landscape and wayward affiliates will still cause chaos for enterprises
• 8Base ransomware members snared in global police crackdown
• Cisco dispels Kraken data breach claims, insists stolen data came from old attack

Hackers are using an uncensored chatbot dubbed GhostGPT to help write malware, highlighting how AI can be twisted to "illegal activities".

That's according to Abnormal Security, which laid out details of GhostGPT in a blog post, saying the chatbot lacks the guardrails of standard AI tools such as ChatGPT, making it a helpful tool for cyber criminals.

It's not the first hackbot-as-a-service, however. WormGPT arrived in 2023 offering a similar chatbot subscription service for writing phishing emails and business email compromise attacks.

That, Abnormal Security noted, was followed by WolfGPT and EscapeGPT, suggesting GhostGPT is a sign malicious actors see value in AI helping them commit cyber crime.

The security company explained that GhostGPT was specifically designed for cyber crime purposes and that enterprises should be wary of its potential looking ahead.

"It likely uses a wrapper to connect to a jailbroken version of ChatGPT or an open source large language model (LLM), effectively removing any ethical safeguards," the blogpost explained.

"By eliminating the ethical and safety restrictions typically built into AI models, GhostGPT can provide direct, unfiltered answers to sensitive or harmful queries that would be blocked or flagged by traditional AI systems."

What can GhostGPT do?

Abnormal shared a screenshot of an advertisement for the GhostGPT service that claimed the chatbot was fast and easy-to-use, offered uncensored responses, and had a strict no-logs policy, saying "protecting our users' privacy is our top priority."

Abnormal noted that GhostGPT was marketed for coding, malware creation, and exploit development, but could also be used to write material for business email compromise (BEC) scams. The advertisement noted its various features make GhostGPT "a valuable tool for cybersecurity and various other applications."

"While its promotional materials mention "cybersecurity" as a possible use, this claim is hard to believe, given its availability on cyber crime forums and its focus on BEC scams," the Abnormal post added.

"Such disclaimers seem like a weak attempt to dodge legal accountability — nothing new in the cybercrime world."

Indeed, Abnormal's researchers asked GhostGPT to write a phishing email; it outputted a template that could be used to trick victims.

Easy access for all hackers

GhostGPT is accessible as a Telegram bot, making it easy for attackers to make use of without having technical skills or taking the time to set up their own systems, Abnormal noted.

"Because it’s available as a Telegram bot, there is no need to jailbreak ChatGPT or set up an open source model," the blog post noted. " Users can pay a fee, gain immediate access, and focus directly on executing their attacks."

A report in DarkReading noted that prices for GhostGPT were relatively cheap, too: $50 for a week, $150 for a month, and $300 for three months.

Fresh challenge for security

By lowering the barrier of entry to would-be hackers, such chatbots make it easier for cyber criminals without extensive skills to attack anyone — potentially sparking a real challenge for personal and organizational security.

Chatbots also make it faster and easier to launch cyber crime campaigns by enabling threat actors to create more effective malware, realistic-looking phishing emails, and so on.

"With its ability to deliver insights without limitations, GhostGPT serves as a powerful tool for those seeking to exploit AI for malicious purposes," Abnormal said.

Because cyber criminals are shifting to AI, so too must security professionals, says Abnormal, as tools like GhostGPT will make it easier to slip phishing emails and malware past traditional filters.

The US Justice Department and FBI have revealed a joint operation with international partners was able to delete malware injected by Chinese threat actors to thousands of devices around the world.

Announced on 14 January, the months-long operation was conducted in collaboration with French law enforcement in which the PlugX malware was removed from more than 4,200 computers worldwide.

According to court documents, the group behind the attack, referred to alternatively as Twill Typhoon or Mustang Panda, has been active from around 2014 and was paid by the PRC to develop a specific version of the PlugX malware for the intrusion campaign.

In the affidavit, the FBI stated that the malware was used by the attackers to exfiltrate files and other information held on the computers of government agencies and private enterprises in the US, ostensibly for espionage purposes.

Foreign entities were also targeted, the FBI noted, with notable targets including European shipping companies in 2024 and a number of European governments between 2021 and 2023.

The joint operation was able to remove the malware from the target devices in this instance after a French law enforcement agency gained access to a command-and-control (C2) server that could send commands to infected devices.

French law enforcement identified the malware’s infrastructure included a native ‘self-delete’ functionality which they were able to leverage once they had control of the C2 server.

Once triggered, the mechanism deleted all the files created by the PlugX malware on the target device and all PlugX registry keys used to automatically run the PlugX malware when the system is booted, as well as removing the PlugX application once it is stopped running.

What is PlugX?

The PlugX malware family has been observed in attacks from as early as 2008. It has been leveraged by multiple threat actors but researchers have typically associated its use with espionage-focused groups linked to China, including Mustang Panda.

Chris Jones, incident response analyst at Check Point Software, described PlugX as a modular malware with a variety of capabilities, all suited for espionage objectives.

“PlugX is a powerful remote access Trojan (RAT) often used in targeted cyber-espionage campaigns. Its modular design allows attackers to tailor its capabilities to their specific needs, enabling activities like data theft, keylogging, file manipulation, and executing commands on infected systems,” he explained.

“It is typically spread through spear-phishing campaigns, exploiting vulnerabilities, or using malicious attachments to gain access.”

He added that efforts to neutralize the threat posed from malicious tools like PlugX usually revolve around targeting the infrastructure the malware relies on for execution, much like this most recent operation carried out by US and French law enforcement.

"Law enforcement agencies seizing servers used to facilitate PlugX operations are adding to efforts like the 2019 seizure of servers linked to the Imminent Monitor RAT. These coordinated actions demonstrate an ongoing commitment to dismantling cybercriminal infrastructure and protecting users from sophisticated malware and privacy threats."

Matthew G. Olsen, assistant attorney general of the Justice Department’s National Security Division, said such operations rely on security agencies working together, praising the efforts of the French government in this instance.

“This operation, like other recent technical operations against Chinese and Russian hacking groups like Volt Typhoon, Flax Typhoon, and APT28, has depended on strong partnerships to successfully counter malicious cyber activity. I commend partners in the French government and private sector for spearheading this international operation to defend global cybersecurity.”

The growth of open source malware has continued apace in 2024, according to new research, with cyber criminals taking advantage of the proliferation of open source software.

A report from software supply chain management firm Sonatype found there was a 156% increase in malicious packages identified on open source repositories over the past year.

Sonatype has identified 778,529 malicious open source packages since it began tracking them in 2019, which it noted was an increase of 70,000 since its annual report was published in October.

Open source malware are malicious packages that disguise themselves as legitimate open source software (OSS) to infiltrate software supply chains.

The three distinct characteristics of open source malware listed in the report were their intentional insertion into open source repositories for malicious purposes, their specific targeting of developers, and ability to evade conventional detection methods.

Sonatype said this approach is able to circumvent traditional security measures and poses a unique threat to enterprises.

“This unique distribution method — compromised open source repositories — exploits gaps in dependency management tooling and development build pipelines, bypassing conventional security mechanisms in order to attack software developers directly,” the report warned.

Npm accounts for over 98% of malicious open source packages

Sonatype noted that software repositories like npm and PyPI process trillions of open source package requests each year, featuring a publishing model that is designed to ensure speed of delivery with the aim of helping foster agile development and innovation.

The unintended consequence of this model is that it makes it far easier for hackers to smuggle their malicious packages onto the platforms unnoticed.

For example, the report noted that npm, the world’s largest JavaScript package registry, was disproportionately impacted by the plague of malicious packages.

Overall, npm accounted for 98.5% of the malicious packages identified by Sonatype over the course of 2024; whereas PyPI, the official package repository for Python, represented just 1% of open source malware Sonatype detected.

In total, Sonatype found over 540,000 malicious components hosted on npm, dwarfing the roughly 5,000 malicious assets identified on PyPI.

Sonatype said the ease of publishing on npm, which allows devs to publish packages with minimal verification, means they can “upload malicious components quickly and at scale”.

The report added that npm has been a victim of surges of spam packages in recent years.

A significant proportion of this spam looks to simply monetize a high volume of downloads using protocols like Tea.xyz, whereas others are seeking to embed malware into projects for more nefarious purposes.

Finally, the sheer scale of demand on the npm platform, which will have received an expected 4.5 trillion requests in 2024 – up 70% compared to 2023 – makes it an ideal target for threat actors looking to maximize their impact.

Speaking to ITPro, Steve Sandford, partner and head of digital forensics & incident response at CyXcel, outlined why npm is drawing the attention of cyber criminals over other popular open source repositories, and what businesses should be doing to mitigate the threat.

“The rise of open source malware is a growing concern as open source software becomes more integral to enterprise IT. NPM is a popular target due to its dominance and high download volume, with minimal verification processes allowing malicious actors to introduce compromised packages easily,” he explained.

“In contrast, PyPI has a smaller user base. As technology evolves and uses increase, the threat of malware will likely grow. To mitigate these threats, enterprises should implement automated scanning tools, maintain an updated inventory of open source components, ensure regular updates and patching, conduct security assessments, train employees, and develop an incident response plan.”

Over 15 billion unvetted shadow downloads in 2024

But the report added that it discovered a large number of malicious packages that were bypassing repository managers altogether, and were being directly downloaded onto dev machines or shared build infrastructures.

Referred to as shadow downloads, Sonatype defines this trend as open source components taken from a public repository but bypassing the artifact repository manager.

“This practice introduces unvetted and unobservable dependencies into projects, bypassing established governance, review, and security processes," Sonatype explained

“While precise numbers vary by organization, recent insights indicate a surprising percentage in production environments originated from shadow downloads, escaping security review entirely.”

Sonatype warned that shadow downloads, which saw a 15.6 billion increase in downloads between December 2023 and November 2024, undermine software supply chain vulnerabilities in several ways.

Firstly the lack of visibility of shadow downloads means they often go unnoticed, making it far more difficult to manage updates.

Secondly, they expose systems to unvetted components, increasing the likelihood of introducing malicious packages, such as those associated with dependency confusion or typosquatting, Sonatype added.

Finally, bypassing repository managers means organizations no longer have the ability to enforce policies, such as release integrity checks or vulnerability scans, on the components.

A joint operation of global law enforcement agencies has dismantled the operations of two prominent strains of infostealer malware.

Operation Magnus, was a collaboration between Dutch National Police, the FBI, and agencies from Australia, Belgium, Portugal, and the UK, targeting the infrastructure underpinning the RedLine and Meta infostealers.

RedLine and Meta steal data including login credentials, as well as addresses, phone numbers, cryptocurrency wallets, and email addresses stored in web forms.

The tools can also be used by threat actors to bypass multi-factor authentication (MFA) through the theft of authentication cookies and other system information.

“After retrieving the personal data, the infostealers sold the information to other criminals through criminal marketplaces. The criminals who purchased the personal data used it to steal money, cryptocurrency and to carry out follow-on hacking activities,” according to a statement from the European Union Agency for Criminal Justice Cooperation.

The statement added that investigations into the two malware operations began after victims came forward and a security company notified authorities about possible servers in the Netherlands linked to the campaign.

The authorities later discovered that over 1,200 servers in dozens of countries were running the malware.

On 28 October, the coalition of international agencies seized three servers in the Netherlands, two domains, and took two people into custody in Belgium.

Law enforcement also retrieved a database of clients from RedLine and Meta, which they state will be used in future investigations into criminals attempting to leverage the stolen data in future attacks.

History shows cybercriminals will always find a way

In conjunction with the disruption efforts, the US Justice Department unsealed charges against Maxim Rudometov, one of the developers and administrators of RedLine.

Rudometov could face a maximum penalty of 35 years, according to the Attorney’s Office for the Western District of Texas, if convicted, facing charges of access device fraud, conspiracy to commit computer intrusion, and money laundering.

This follows a number of operations carried out by law enforcement agencies aimed at disrupting the operations of high profile cyber crime groups around the world.

In December 2023, US authorities seized the leak site of ALPHV/BlackCat, one of the most prolific ransomware collectives of recent years, which was hailed as a significant blow to the operation.

Yet just two months later in February 2024, CISA issued an updated advisory warning of a new version of the group’s ransomware locker, which had been observed targeting healthcare organizations in the US.

Since then, in September 2024 researchers reported a new ransomware encryptor dubbed ‘Cicada3301’ appeared to be a more advanced iteration of the encryptor used by BlackCat, indicating the group’s impact on the cyber crime industry will be harder to stamp out.

In February 2024, a joint operation took control of the infrastructure used by the prominent ransomware collective LockBit, including its primary administration environment, leak site, platform source code, and a vast amount of intelligence about the group’s activities gleaned from the seized systems.

Days after the breach, security experts told ITPro they expected LockBit affiliates to quickly find a new ransomware operator to work with, and the ransomware industry was far from being brought to its knees.

LockBit re-emerged in September 2024, claiming responsibility for a cyber attack on Canada’s largest school board in Toronto, but analysts said this was likely a fabrication in an attempt to rebuild the group’s waning reputation.

On 5 July 2024, a joint operation led by Europol shut down almost 600 servers used to conduct malicious attacks leveraging the Cobalt Strike threat simulation tool.

Despite the significant disruption caused by the operations, security pros warned it would not put an end to the malicious use of Cobalt Strike by threat actors.

Although the operation was a ‘big win’ for law enforcement, they noted there were plenty of opportunities for threat actors to continue using the tool for malicious purposes.