Posts on Security, Cloud, DevOps, Citrix, VMware and others.
Words and views are my own and do not reflect on my companies views.
Disclaimer: some of the links on this site are affiliate links, if you click on them and make a purchase, I make a commission.
Drupal has warned that threat actors are exploiting a "highly critical" security flaw in its Commerce Core component.
The vulnerability, tracked as CVE-2026-118539 (CVSS score: N/A), is a case of missing authorization affecting Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13.
"This module enables you to sell goods and services to customers through an included shopping cart and checkout form or through decoupled applications via APIs," Drupal said in an advisory.
"The module doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor."
The open-source content-management framework acknowledged that the vulnerability is being "actively exploited in the wild," but provided no specifics about the nature of the activity or the extent of the campaign.
Users are being recommended to update to the latest version -
Version 3.x - Upgrade to Commerce Core 3.3.13
Earlier versions - Upgrade to Commerce Core 8.x-2.41
Drupal has credited researchers Dan Puccetti (dpuccetti), Marcus Johansson (marcus_johansson), and Robert Snyder (rsnyd) with reporting the flaw.
The development comes as two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), and collectively referred to as PHP2Shell, are witnessing active exploitation attempts in the wild.
As of October 25, the percentage of organizations significantly affected by PHP2Shell has declined to 52.1%, according to data from Google-owned Wiz.
The cloud security company said it has so far observed two types of activities, including attempts using the PHP2Shell exploit mechanism that match public proof-of-concept (PoC) exploits.
The other category refers to "PHP2Shell-branded tools unrelated to the vulnerabilities that instead relied on session poisoning and a separate local file inclusion (LFI) vulnerability in the application," Wiz researchers Yaara Shriki, Shahar Dorfman, Alma Blachsan, and Yaron Samuel said.
"Our observations show that triggering memory exhaustion alone is not enough to complete the exploit chain. Differences in PHP builds, memory limits and worker behavior can prevent subsequent stages from working. The challenge for opportunistic attackers is turning currently available public PoCs into similarly reliable operational tooling or developing it on their own."
from The Hacker News https://ift.tt/oA5D38V
via IFTTT
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Cisco and GitLab software to its Known Exploited Vulnerabilities (KEV), citing evidence of active exploitation.
The vulnerabilities are listed below -
CVE-2026-97229 (CVSS score: 10.0) - An integer overflow or wraparound vulnerability in GitLab Community Edition and Enterprise Edition that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration due to insufficient regular expression validation.
CVE-2026-76418 (CVSS score: 8.6) - An unchecked return value to NULL pointer dereference vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial-of-service (DoS) condition.
The development comes after Cisco said it became aware of active exploitation of this vulnerability earlier this month. It has not publicly identified the attackers, the number of targeted organizations, or the actions taken by attackers after gaining initial access.
As for CVE-2026-97229, its addition relates to a security incident disclosed by Alpine Linux in which an unknown threat actor unsuccessfully attempted to exploit the flaw targeting its instance on October 20 and 21, 2026.
Specifically, the attacker probed an unpatched GitLab instance by sending crafted CI configurations, causing the GitLab worker processes to crash eight times. In four of those crashes, the exploit failed at the next step.
The threat actor also downloaded Alpine Linux's GitLab container image. Subsequent attempts by the attacker to get back in on October 25 and 26 were blocked.
"The attack came close to working," the maintainers of the security-focused Linux distribution said. "We have found no evidence that it succeeded, but we cannot rule it out, so we treated the instance as compromised and rebuilt it from scratch. Our checks show that the aports repository, packages, and the October 21 releases were not tampered with."
In light of active exploitation, Federal Civilian Executive Branch (FCEB) agencies are recommended to apply the fixes by November 1, 2026.
from The Hacker News https://ift.tt/bHEa0OB
via IFTTT
Cryptocurrency giant Binance said on Thursday that a "security incident" on its platform has impacted about $6.3 billion worth of assets.
The world's biggest cryptocurrency exchange said nearly $3 billion of those assets have been frozen on-chain so far.
Tether and Circle said they have frozen more than 1.567 billion USDT and 800 million related to the incident, respectively. The Arbitrum Security Council is said to have executed a transaction to freeze about $30.5 million from the Binance Exploit.
"Initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions," Binance said in an update.
The company said there is no evidence of a wallet private key leak, adding it will cover all losses from the Secure Asset Fund for Users (SAFU) fund and its own funds.
Out of an abundance of caution, Binance has also taken the following steps -
Temporarily suspended deposits and withdrawals while security checks are completed
Revoked the affected address authorization;
Engaged law enforcement and blockchain intelligence partners to trace and recover funds
"We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice," Binance said.
The development makes it the biggest cryptocurrency heist recorded to date, surpassing the theft of about $1.5 billion from Bybit in February 2025. The incident was subsequently attributed to North Korea.
"Our current estimate on the amount stolen is approximately $5.912 billion at time of theft, nearly 4x the amount stolen in the next largest crypto heist," blockchain intelligence firm Chainalysis said in an X post.
(This is a developing story. Please check back for more details.)
from The Hacker News https://ift.tt/lWQZFCE
via IFTTT
Some attacks take real skill. Others just need someone to leave a door open. This week has both. Exposed passwords, old bugs still getting exploited, and trusted software doing things it shouldn't.
There's a strange mix of clever tricks and careless mistakes. Hackers are borrowing trust from familiar apps, websites, and AI tools. Some are using AI to speed things up. Others are leaving their own attack files exposed. Not exactly careful work.
Different stories, familiar weak spots. Here's what showed up this week.
The threats change every week. Subscribe, and we’ll alert you when each new ThreatsDay Bulletin is out.
WordPress security company Wordefence said it's not aware of any WordPress site compromised through PHP2Shell (CVE-2026-109618 and CVE-2026-109619) as of October 28, 2026. "We continue to see PHP2Shell-related requests across the more than 5 million sites we protect," it said. "Those requests show ongoing scanning and exploitation attempts; they do not show whether an attempt succeeded. Our site-cleaning and incident response teams have not handled a WordPress compromise attributed to these vulnerabilities."
Hudson Rock's investigation into the FortiBleed credential harvesting campaign has uncovered 975 newly identified domains and 40,573 exposed secrets, including 37,076 local-user records and 1,576 Active Directory LDAP bind records. The data comes from newly obtained 1,703 FortiGate source files associated with 1,689 host identifiers. "The configuration material dates to around February 2026, earlier than the likely May/June material examined in the first investigation," Hudson Rock said. The latest discovery has been codenamed FortiBleed 2.0.
Threat actors have used domain shadowing to place illegal gambling content beneath legitimate school and government domains in two unrelated operations. "In both cases, an unauthorized party appears to have gained access to DNS administration and created records that the original domain owners may not have noticed," Infoblox said. "Because the resulting hostnames sat within established institutional namespaces, they provided especially useful infrastructure for search-engine optimization (SEO) and traffic acquisition." One cluster, linked to a threat actor called Hidden Hawk, has been found to add individual CNAME records that mapped institutional hostnames to gambling pages hosted largely on Cloudflare Pages. The second campaign exploiting an Indian government domain "delegated entire subzones to third-party authoritative nameservers and used a wildcard, allowing many hostnames to be managed outside the victim's DNS environment." Put differently, the unauthorized DNS access creates new institutional hostnames, which resolve to infrastructure serving illegal gambling doorway pages. The pages also leverage the established reputation of school and government namespaces to ensure that the malicious URLs show up prominently in search engine results.
Bank of America is reminding customers not to share banking credentials with AI agents. In an email blast to customers titled "Protecting your finances in the AI World," the financial institution urged customers to never share their username and password with another person or an outside service, "including an AI-enabled tool or agent that offers to act on your behalf."
Google has announced that an upcoming Android release will no longer be able to directly write to contacts with the WRITE_CONTACTS permission. "Instead, you can use the standard contact intents (ACTION_INSERT, ACTION_EDIT, and ACTION_INSERT_OR_EDIT)," Google said. "Currently, if your app needs to save even one contact, you might be requesting WRITE_CONTACTS. But that permission grants broad access, allowing an app to make widespread changes to contacts across the device in the background, even without user interaction. Most apps don’t need such broad permission."
A scan of 7.25 million public repositories on Gitee, China's largest indigenous Git hosting platform, has uncovered 26,400 unique verified-live credentials, including an active organization-admin credential for a major enterprise AI platform and thousands of live cloud provider access keys, independent security researcher Ben Zimmermann said.
Fortinet has released a "coordinated set of security updates for FortiOS, FortiManager, and FortiAnalyzer" to address critical and high-severity flaws that were flagged using an AI-assisted vulnerability discovery approach. Details of the issues are being kept under wraps until November 10, 2026. With Fortinet devices becoming a favorite target for attackers, it's essential that users move quickly to apply the fixes.
Details have emerged about a now-patched flaw in Microsoft Authenticator (CVE-2026-80097 aka AuthMask) that could be exploited by installing and running a malicious application on an affected Android device and convincing the user to complete an authentication flow in the app by claiming to be a trusted app and getting the corresponding tokens. The flaw could be exploited to take over work accounts without requiring additional permissions. "Successful exploitation could allow the attacker to obtain authentication tokens and access resources as the affected user," Microsoft said. According to Enclave, "an unprivileged Android app with zero permissions could impersonate any installed Microsoft first-party app and have the Microsoft Authenticator broker hand it that app's tokens. The setup is a device with Authenticator installed and one work account signed into it."
Attackers are disguising themselves as AI agents to steal credentials. Cequence said it has tracked a single actor running AI agent impersonation at scale by posing as about 32 different AI bots, including ChatGPT, Claude, and Perplexity, while searching for passwords, API keys, and cloud credentials. "The malicious scanner runs from a major cloud provider and rotates through about 32 AI bot identities, spanning crawlers and assistants from OpenAI, Anthropic, Meta, Perplexity, and others," Will Glazier said. "It ignores web pages and requests files that commonly store secrets, including .env configuration files, cloud credential files, private SSH keys, and server environment data, working from a list of roughly 90 file paths. Each address sends a short burst of 50 to 190 requests in about eight seconds and then moves on. The scanner works through targets one at a time, around the clock, and first sends random nonsense paths to find websites that answer every request, a common scanning technique. It hit organizations in financial services, retail, telecommunications, energy, and software, and stayed active from at least late September through late October."
The U.S. Embassy in Fiji has revealed that hackers linked to China broke into a regional organization based in Suva between July and August 2026. "Hackers with links to China maintained access to the organization's network over several days," it said. The embassy did not name the threat actor. Nor did it disclose what data the attackers may have accessed.
Attackers have been breaking into enterprise networks via camera management software, according to new research from security firm Huntress, which observed multiple incidents in September and October 2026 and traced them back to a compromised application. Source code artifacts point to a Korean company selling analog and IP cameras and digital and network video recorders. The activity abuses the legitimate "WpcMon.exe" binary to sideload DLLs that establish outbound connections to a remote server. "This activity demonstrates how attackers can blend malicious code with trusted Windows components to evade detection," Huntress said.
In a major operational security blunder, an unknown threat actor stole 68 GB from a Philippine government agency, maintained a detailed log of the transfer, then left that log open on the internet at 13.163.205[.]35:80. "The copy finished in under 24 minutes on September 6, 2026," Hunt.io said. "The transfer log records 27 SQL Server backups whose filenames correspond to the case-management systems of a Philippine overseas-employment and migrant-worker administration. Beside the log sat the operator's toolkit, a rebranded GodPotato build, a PowerShell stager, two payloads and a full Impacket environment."
Canadian AI company Cohere has claimed that it caught Alibaba's Qwen3.8-Flash-Next model unsuccessfully attempting to send data to China from its evaluation sandbox as part of a prompt instructing the LLM to detect malicious file download and execution by monitoring for curl processes downloading bash scripts to /tmp followed by bash execution. "Asked to write a defensive detection rule, Qwen3.8-Flash-Next ignored instructions and inventoried the machine it was running on and then tried to upload a probe file to an Alibaba Cloud storage bucket in Beijing," Cohere said. "We cannot answer whether this is deliberate or a leftover glitch from training." Cohere has also released a dataset containing the model trace and corresponding raw token IDs in connection with the behavior. "The exact output is not guaranteed all the time, and many trials may be required to reproduce the behavior," Cohere said, adding "there are similarly unexpected URLs that the model also tends to output, most containing aliyunc." However, the findings have also led to social media chatter that the company is resorting to geopolitical fearmongering and that they are an attempt to clamp down on open-weights models.
The U.S. National Institute of Standards and Technology (NIST) has released guidelines that detail the timelines for transitioning away from quantum-vulnerable algorithms to quantum-resistant standards. "The report describes different use cases and says why one migration might take longer than another," said NIST mathematician Dustin Moody, who heads the PQC standardization project. "We understand there's not one strategy that fits all use cases, and we want to help people handle their migration while staying abreast of what's changing."
SOCRadar has uncovered the live workspace (i.e., open directory) of a threat actor tied to the n0n ransomware group, which exposed the operation's full workflow as of September 2026. The directory at 185.157.161[.]148 includes an AI coding agent configured with about 150 models to produce hundreds of attack scripts, with more than $7,216 in usage costs. "Entry points included a credential stuffing campaign against 305 FortiGate SSL-VPN devices, exposed AWS keys, weak RDP/WinRM credentials, and compromised hosting management portals," SOCRadar said. At least 23 organizations across 14 countries are said to have been identified in the workspace, including a U.S. sports retailer, a cloud provider, a teachers’ union, a Venezuelan ISP, an Argentine ministry and a pharmaceutical subsidiary.
The Swedish government has barred employees from accessing browser-based versions of ChatGPT or Claude on their work computers over security concerns relating to the processing of sensitive data. "Officials were concerned that entering sensitive information into these models without an agreement setting out how to protect and secure the data could lead to it being fed into the model and stored for training," Euro News reported.
JFrog and SafeDep have uncovered a campaign in which threat actors hijacked third-party 42 GitHub repositories across 11 owners to deploy payload blobs large enough "to evade the GitHub search and API paths normally used to find this kind of compromise." JFrog said, "The repositories contain execution hooks for AI coding assistants and IDEs, plus 12.9 to 13.7 MB polymorphic wrappers that all decode to the same hidden CI-publisher payload." The activity is assessed to be related to a Miasma-family npm worm propagated under various packages ending with "testmetest." According to SafeDep, the worm "shares code with Miasma 'Phantom Gyp' from June 2026 and adds the token-revocation wiper from Mini Shai-Hulud. The malicious versions steal credentials, spread to other packages and repositories, and install a wiper that deletes the home directory when the victim revokes the stolen GitHub token." Unsuspecting developers who installed the packages had their data stolen and repositories compromised with malicious code to produce further malicious testmetest releases and run shellpanel workflows targeting cPanel systems through CVE-2026-41940, overlapping with a prior campaign detailed by Socket in July 2026.
A new Android malware operation called MR ROBOT is targeting customers of Indian banks and transforming banking fraud into a subscription business, with cybercriminals renting customized banking trojans to steal OTPs, card details, UPI PINs and credentials while secretly forwarding calls to bypass security checks. "It is not a single-actor campaign but a rented crimeware platform: a master operator leases access to affiliates, who use a Telegram bot ('APK Shield) and a web control panel (v7.0) to build personalized banking trojans on demand and distribute them through fake Play-Store-style pages and messaging-app lures," CloudSEK said. The kit impersonates around 36 lure apps, including banks, utility providers, and government services. One affiliate is estimated to have intercepted 5407 text messages from 153 infected devices.
Threat actors are abusing legitimate mobile device management (MDM) platforms, like Hexnode and Rippling, by using social engineering to enroll devices or install management agents, per Huntress. "Once established, MDM provides a trusted, privileged path for malicious activity, such as deploying rogue RMM tools and maintaining remote access," it said.
Threat actors are exploiting CVE-2026-42589 (CVSS score: 9.8), a critical remote code execution flaw in Gotenberg, to deliver a Go-based reverse shell called "cache_base." The flaw was patched in May 2026. According to VulnCheck, the activity originated from a residential Japanese IP address in early October 2026. "The execution flow is straightforward: acquire a lock, collect host information, connect to C2, register the victim, and open a shell," VulnCheck said. Over the past 30 days, the vulnerability has recorded 1,358 exploitation events from 128 unique source IP addresses.
Discord has announced it will allow search engines to index discussions in Discoverable Servers and make them accessible on the web to users outside the platform without an account or invitation, starting mid-December 2026. "Discussions in Discoverable Servers will soon be easier to find when you search the web, so you can find the answer you're looking for and step straight into the conversation on Discord," it said. The changes apply only to Discoverable Servers and do not extend to private servers and direct messages.
The Gentlemen ransomware operation has claimed more than 800 victims across multiple regions and sectors, with most attacks targeting organizations in the U.S. and Europe. "The group supports multiple platforms, with ransomware variants targeting Windows, Linux, NAS, and BSD systems, allowing its affiliates to target a broad range of enterprise environments," Acronis said. "The group's operations include the use of EDR-killing tools. In a recent incident, a custom dropper was observed deploying vulnerable Safetica ProcessMonitorDriver [CVE-2025-70795] and Lenovo BootRepair.sys drivers to terminate security processes."
Pillar Security has disclosed an arbitrary-code-execution vulnerability in Unsloth's core model-loading path (CVE-2026-93348, CVSS score: 8.6). It has been fixed in unsloth_zoo 2026.8.14. "An attacker-controlled model configuration could cause Python code to execute during loading," researcher Ariel Fogel said. "The affected code ran inside the model-loading process, with access to whatever that process could read, modify, or authenticate to. In an AI development environment, that can include proprietary datasets, model artifacts, Hugging Face tokens, and cloud credentials. Exploitation required an affected loading path to process an attacker-controlled configuration."
XBOW said it identified an unauthenticated, critical-severity remote code execution bug in a public web application belonging to the U.S. Election Assistance Commission (EAC). "The vulnerable application was a resource/logistics calculator, not a voting machine or voter registration system," XBOW researcher Ariel Walter Garcia said. "The flaw allowed an unauthenticated attacker to execute code as root inside the backend container, with access to locally protected resources and outbound network connectivity, a privileged foothold reachable via a crafted unauthenticated web request."
A new remote access trojan called DarkCore comes with a dedicated browser that could let attackers access Gmail, WhatsApp, and MediaFire accounts using stolen sessions, while giving the impression that the activity is originating from the victim's own IP address. DarkCore was first advertised on cybercrime forums in August 2026. "The seller describes a browser that reuses those sessions to access work mailboxes, instant messaging apps, cloud storage and other services through the infected machine's IP address," BlackFog said. "The purpose is to make the access look like legitimate activity from the user."
Cisco Talos has disclosed details of a new AI-integrated command-and-control (C2) framework called NIK C2. The implant features surveillance, theft, lateral movement, and evasion capabilities, including credential dumping, RDP session hijacking, process hollowing, and a C2-driven screen lock ransomware module. "NIK C2 contains a Windows implant, using which, an actor can dump credentials, stream the victim's keystrokes to collect the targeted victim's sensitive data, and instruct an integrated AI model to analyze the harvested data, all within the compromised session," Talos said. "In this framework, the actor has abused the OpenAI Chat Completions application programming interface (API), which is an HTTP endpoint that enables ChatGPT-style conversations programmatically. In addition to the features that enable theft, an actor can also deploy desktop screen-locking ransomware via the NIK C2 implant onto the victim machine, leading to a ransom demand in Bitcoin or USDT cryptocurrencies." Three different versions of the malware have been identified to date since August 12, 2026. Talos said NIK C2 alters adversary tradecraft by collapsing collection and exploitation into a single continuous session.
A phishing email using a FedEx tax invoice lure and containing a ZIP archive with a PDF has been observed triggering a multi-stage infection process to deliver a previously undocumented variant of the Sirius Backdoor. "The PDF abuses /OpenAction and /Launch objects to trigger an embedded Base64-encoded PowerShell command upon opening," Trellix said. "Execution relies on social engineering to trick the user into approving the PDF reader's security confirmation prompt. The PowerShell stager decrypts and reflectively loads a .NET assembly in memory. This loader performs process hollowing into legitimate Windows processes such as msbuild.exe, svchost.exe, etc., allowing the malware to operate under trusted process contexts." The final payload is SIRIUS, a Microsoft Visual C++ based backdoor with extended remote access capabilities.
A new analysis from Flare has revealed that threat actors are building a mixed AI toolkit, combining commercial models with local, open-weight, and jailbroken alternatives, as well as leaning on stolen AI credentials to shift costs to victims. "Where AI can help is with understanding systems, writing tools and troubleshooting. The threat actor still needs access, decisions and a way to obtain payment," Flare said. "If AI helps an affiliate write a working data-export script without hiring a specialist, the affiliate may avoid that specialist’s fee and the wait for their help. AI makes expertise cheaper to obtain only when the cost of using and checking its work is lower than the cost of the specialist help it replaces."
A recently observed cyber-extortion actor named ScarlettGroup is publicly advertising alleged data compromises and uses negotiation deadlines and threatened disclosures to pressure targeted organizations. The group's dark web site listing includes victims from technology, education, government, and entertainment sectors. "ScarlettGroup demonstrates characteristics associated with financially motivated data-extortion operations, including public victim claims, deadline-based pressure, and underground forum activity," Foresiet said. "Its dedicated leak-site infrastructure and structured disclosure mechanism indicate an organized approach to promoting alleged compromises and exerting reputational pressure."
Following its disruption in June 2026 as part of Operation Endgame, StealC has returned four months later as Stadia. "This time it's not a stealer: it's a full remote access trojan," Varonis said. "The RAT's features include hidden desktop control, a live command shell, a file explorer, a process manager and an in-memory loader, with StealC's stealer welded on as one module among six. The actor behind Stadia is working hard to win back original StealC customers: every former StealC customer is offered a free month on the top ($900) tier." The development comes as Moonlock Lab revealed that the Icarus macOS stealer has similarly evolved from a smash-and-grab crypto and data stealer to a malware with remote-access capabilities. The new iteration is called ICMacOS. "The stealer is actively advertised on cybercrime forums by a Russian-speaking actor operating under the handle GlowComa, with feature updates regularly announced via Telegram," SOCRadar said. "GlowComa promotes ICMacOS alongside Icarus ClickFix, a companion panel designed to deliver payloads using malicious copy-and-paste terminal commands. The infection chain relies on initial dropper scripts to detect the host architecture and harvest administrator passwords using fake system dialogs before delivering the primary payload." Another macOS-focused stealer is Aokigahara, which goes beyond browsers, VPN clients, cryptocurrency wallets, FTP/SFTP clients, password managers, and email applications to also target AI applications and development tools. "The stealer collects authentication files, session data, and configuration files associated with Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, and other tools," Check Point said. "Stolen AI credentials could offer opportunities for monetization. Usable credentials or session tokens could enable unauthorized access to paid AI services or the resale of compromised accounts."
That's the week's mess. Some attacks were clever, some were painfully simple, and a few attackers made life easier for the people investigating them. The common problem? Too much trust in things nobody was watching closely.
AI is adding new tricks, but the old ones aren't going anywhere. Stolen credentials, weak access controls, and forgotten bugs still get plenty of work done. New tools, familiar mistakes.
The useful part is knowing where those mistakes keep showing up. That's usually where the next problem starts.
from The Hacker News https://ift.tt/IxEDcW7
via IFTTT
Threat actors are delivering malicious loaders and cryptocurrency miners under the guise of artificial intelligence (AI) desktop applications for Anthropic Claude and OpenAI ChatGPT as part of a campaign dubbed Yoba.
The activity involves creating fake GitHub projects that claim to be desktop applications like GPT-5.6 Sol, GPT-6 Astra, and Claude Opus, only to deliver a malware family called YobaLoader.
"The malware is placed next to legitimate, signed executables from OpenAI and Anthropic so it can be loaded indirectly, a technique commonly known as DLL sideloading, which is often used to bypass security protections," Check Point Research said in an analysis.
To add to the project's credibility, the attackers set up GitHub.io pages to describe the capabilities of the software. Although the GitHub projects' popularity is not manipulated using techniques like ghost networks, signs point to the use of SEO poisoning tactics to ensure that links to them are surfaced on top of search results on Google.
Some of the identified GitHub pages links are below -
github[.]com/gpt-5-6/sol-free-desktop
gpt-5-6.github[.]io
github[.]com/gpt-5-6/gpt-5-6.github.io
github[.]com/gpt-6-astra/gpt-6-astra.github.io
gpt-6-astra[.]github[.]io
github[.]com/opus-5-0/opus-5-0.github[.]io
opus-5-0[.]github[.]io
"Each repository uses a different email address (edwardcarlsonmkym[@]outlook[.]com, daxschneiderdjuu[@]outlook[.]com, and rioprestonlfyx[@]outlook[.]com), and the uploader appears to operate in UTC+4, UTC-4, and UTC+3 respectively," Check Point said. "This inconsistency likely reflects a deliberate attempt to obscure the threat actor's true operational time zone."
Hosted within these repositories are ZIP archives that, among other files, contain two specific components -
Setup.exe, a legitimate signed OpenAI Codex or Claude executable
winmm.dll, a malicious DLL that's sideloaded by the executable
The DLL is a dropper codenamed YobaDropper, which implements checksum value checks by hashing the basename of its host executable and if it matches a hard-coded value "0xE6C2F326." In other words, the check requires it to be launched under "Setup.exe," and fails if the DLL is executed on its own inside a sandboxed environment.
Additional anti-analysis techniques and pre-checks include 200,000 iterations of "Sleep(5500)," which amounts to 12.73 days, and skipping machines whose keyboard layout corresponds to that of Russia, Belarus, Tajikistan, Armenia, Azerbaijan, Georgia, Kazakhstan, Kyrgyzstan, Turkmenistan, and Uzbekistan.
Another language ID excluded from the infection process is Tatar. Notably missing from the list is Ukraine, which used to be historically included in such checks.
YobaDropper, for its part, triggers a DLL sideloading chain of its own comprising "wmpdmc.exe" and "ampdui.dll," copying the former from its "system32" folder and placing it in a new directory named "WMProcess" created under "ProgramData."
The dropper then extracts and decrypts an embedded payload, and drops it into the same folder as "wmpdui.dll." It also establishes persistence by means of a scheduled task that launches the legitimate executable to load the malicious payload.
The second DLL is YobaLoader. It implements the same anti-sandbox technique as YobaDropper, requiring the malware to be run only by "wmpdmc.exe" by checking the hash against a hard-coded value ("0x552751E3"). The loader is responsible for three main tasks -
Downloads an image from a Telegram channel ("t[.]me/yoba_fanclub").
Uses the last 50 bytes as a seed to generate a domain based on three lists of dictionary words and an integer value in the range 0–999 using a domain generation algorithm (DGA). The end result is domain in the format "adjective-noun-verb-digit.dedyn[.]io."
Queries Google's DNS-over-HTTPS (DoH) API to obtain a Base64-encoded command from a DNS TXT record by passing the constructed domain as input.
Decrypts the response to obtain the link to fetch the next-stage payload ("files.catbox[.]moe/z5zpy9.dat").
"By relying on a DoH service and common file-hosting platforms, the actor aims to bypass passive DNS monitoring and some gateway-based security protections, making their command-and-control traffic harder to distinguish from regular user activity," Check Point said.
The downloaded payload is then injected into "svchost.exe," resulting in the execution of an XMRig cryptocurrency miner.
Evidence indicates that the first GitHub repository was created around July 2026, although the malicious releases were not uploaded until the end of August. What's more, early versions of YobaLoader have been found to only exclude Russia from infection, while also incorporating extensive anti-debugging and anti-VM checks, which have since been removed in newer versions.
"The Yoba campaign shows how attackers can use trusted platforms and the current interest in AI tools to distribute malware in a way that looks believable and harmless at first glance," Check Point said. "By packaging their code together with well-known software names and hosting it on GitHub, they lower the chances that users or basic security checks will immediately flag the files as suspicious."
from The Hacker News https://ift.tt/OxWYSce
via IFTTT
Google on Wednesday took the wraps off Gemini 4 Carbon, its latest frontier model with state-of-the-art cybersecurity and long-horizon capabilities.
"It shows significant gains across coding and agentic tasks as well as across key capabilities critical for cybersecurity defense, landing a firm lead in SEC-bench Pro (88.2%) for finding vulnerabilities, ExploitGym (54.8%) for exploitation, and CWE-bench (71.0%) for patching," Koray Kavukcuoglu, senior vice president of Google DeepMind and chief AI architect at Google, said.
On the Artificial Analysis Intelligence Index benchmark, Carbon leads with a score of 59, surpassing Anthropic's Claude Opus 5.5 (58), OpenAI GPT-6 Astra (57), GPT-6.1 Sol (55).
One of the core focus areas is cybersecurity, where the latest iteration reportedly delivers significant performance improvements across the board, including vulnerability detection, validation, and remediation. Carbon is also twice as likely to generate secure code versus Argon.
Google also emphasized that Carbon attempts to respond to complex or high-pressure tasks by seeking human input in the face of ambiguity rather than "guessing or forcing a path forward," as well as resisting every evaluated attack attempt at indirect prompt injection.
The debut of Gemini 4 Carbon comes less than a week after the tech giant unveiled Gemini 4 Argon. The release plan is similar to that of its predecessor, with the rollout currently limited to a subset of cyber defenders before expanding access to other trusted partners as part of its Fairwind Program.
Google also said it's actively engaged in the U.S. government's voluntary process for pre-release model testing.
The development comes as OpenAI released GPT-6.1 Terra, which it described as a fast, efficient model that "excels at communication and computer-based tasks."
"GPT‑6.1 Terra meets the Critical threshold in cybersecurity under our Preparedness Framework, and maintains the protections developed for GPT‑6 Astra," OpenAI said.
"GPT-6.1 Terra brings with it the alignment improvements of the GPT-6 series. According to our evaluations, GPT-6.1 Terra is more likely to stay within scope and honestly disclose limitations and potential blockers to the user compared to GPT-5.6 Terra. In our prompt-injection tests, GPT-6.1 Terra also showed strong resistance to malicious instructions designed to divert it from the user's task."
Earlier this week, rival Anthropic also disclosed that an unreleased, internal research model uncovered critical vulnerabilities in some of the world's most widely used software.
This included a one-click remote code execution in Google Chrome, a one-click exploit chain in Apple Safari that could be used to access a user's browsing history, cookies, and other sensitive data, an Android lock screen bypass, and a denial-of-service (DoS) flaw in the Windows HTTP.sys driver (CVE-2026-33096, CVSS score: 7.5). All the identified issues have been fixed by Google, Apple, and Microsoft.
"These attack chains demonstrate the model's ability to create sophisticated, multi-step exploits in both open-source and proprietary software," Anthropic said.
"These skills have historically been the domain of few specialist teams with expertise in these targets. Now, it’s something models can do with little human involvement, and then prove by producing a working exploit that anyone can run and verify."
from The Hacker News https://ift.tt/pjOtVoC
via IFTTT
GitHub has announced that it's introducing a new package firewall as a preview to block installation of suspicious npm packages during installation time.
"The firewall inspects both metadata requests and package downloads for signs of malicious activity, acting as an install-time policy gate," GitHub said.
The feature, which currently supports only npm packages, is available in public preview for all GitHub Enterprise Cloud customers, including data-resident GitHub Enterprise Cloud.
According to the Microsoft subsidiary, the firewall is placed between endpoints or internal registries and the upstream package repositories so as to deter malware attacks that compromise systems when packages are installed.
This behavior can expose users to severe security risks, especially when artificial intelligence (AI) agents and CI runners automatically install dependencies to complete a task or build without their explicit permission.
The idea is that endpoints like coding agents and CI/CD hosts use the firewall for their requests instead of directly pointing to the public package registries. The firewall then checks package downloads against policy controls such as minimum package age and malware advisories, and blocks downloads that do not meet those policies.
To use the firewall, administrators are required to configure policy controls, such as the ones listed below -
Block known malware by checking against the GitHub Advisory Database for active malware advisories
Block packages based on the severity of vulnerabilities by checking the GitHub Advisory Database for flaws that affect the requested package version. The control defaults to "Critical only" as the severity level that blocks an installation, although users can choose "High or higher," "Medium or higher," or "Any severity."
Block attestation downgrades by comparing attestations for the requested package version with those of earlier versions and stop the download if the requested version does not have an SLSA attestation.
Block newly-introduced install scripts by checking whether the package recently added scripts that run using preinstall or postinstall hooks, which can be abused to steal sensitive data.
Block packages based on a cooldown period that prevents versions that are newer than the configured minimum age from being installed. The value can range from 1 to 365 days. The default value is 1 day. Users can disable it by setting it to 0.
Users who need access to a package that gets blocked erroneously by the firewall can submit an exception request, which can then be approved by enterprise administrators and security managers.
The development comes as Rust 1.100, which is scheduled for release on November 12, 2026, readies to add support for a configurable minimum publish age, allowing security scanners and maintainers time to flag and block malicious crate releases before they can be installed or used by users.
The value, defined via the "global-min-publish-age" option in "cargo/config.toml," allows users to specify a minimum publication age in days or weeks. If left unspecified, a seven-day waiting period is applied by default to skip releases published within that window.
Over the past year, similar waiting periods have been implemented across open-source ecosystems, including npm, Python, Microsoft Visual Studio Code, Ruby, Bun, pnpm, and Yarn, as a way to bolster software supply chain security by reducing the chance that a newly published, unreviewed version is immediately pulled into a build.
Cooldown periods help add friction and slow down attacks in which a bad actor publishes a poisoned version of a popular package after seizing control of a maintainer account, thereby preventing rapid spread through manual or automated installations.
"The tradeoff is that legitimate fixes have to wait, too, unless developers make an exception," Socket said. "Malicious code also doesn't magically become harmless with age. A release that escapes detection can simply outlast the cooldown. The value is in buying researchers, maintainers, and registries time to act before the next dependency update carries an attack further."
from The Hacker News https://ift.tt/n1iMqNy
via IFTTT
Cisco Talos observed a new AI-integrated command-and-control (C2) framework in the wild called “NIK C2.”
NIK C2 contains a Windows implant, using which, an actor can dump credentials, stream the victim's keystrokes to collect the targeted victim’s sensitive data, and instruct an integrated AI model to analyze the harvested data, all within the compromised session.
In this framework, the actor has abused the OpenAI Chat Completions application programming interface (API), which is a HTTP endpoint that enables ChatGPT-style conversations programmatically.
In addition to the features that enable theft, an actor can also deploy desktop screen-locking ransomware via the NIK C2 implant onto the victim machine, leading to a ransom demand in Bitcoin or USDT cryptocurrencies.
NIK C2 reshapes adversary tradecraft by collapsing collection and exploitation into a single continuous session, effectively erasing the offline processing delays that historically granted defenders critical detection windows.
Such AI-enabled adversarial frameworks require defenders to move beyond traditional detection and embrace continuous behavioral vigilance as the new baseline.
NIK C2 implant: AI-integrated remote access tool
The NIK C2 implant is a Go-based, 64-bit Windows remote access tool that grants persistent control over compromised hosts using a resilient dual-channel C2 architecture. It communicates over TLS-secured WebSockets on port 443 alongside an HTTP fallback polling loop every 250 milliseconds, protecting all traffic with AES-256-GCM encryption derived from a hardcoded seed. To survive takedowns, the implant routes traffic across three prioritized C2 tiers, which are runtime-updated URLs, an embedded encrypted server list, and a hardcoded fallback address. Beyond standard operations, the implant features surveillance, theft, lateral movement, and evasion capabilities, including credential dumping, RDP session hijacking, process hollowing, and a C2-driven screen lock ransomware module.
Notably, the NIK C2 implant embeds a fully integrated OpenAI API client via its ai_generate command, allowing operators to route arbitrary prompts to the OpenAI Chat Completions API directly through the infected host. The NIK C2 implant manages API key resolution, request assembly, and response parsing locally, returning the encrypted generative AI results to the actor's C2.
The observed NIK C2 implant samples in the wild contains an embedded build path (/opt/nik_panel/data/build_52b79724a1fc4b8f/main.go), which identifies the project as "nik_panel" and indicates that the implant was cross compiled for Windows from a Linux development environment. Furthermore, the embedded eight-byte hex token matching the build identifier highlights that the threat actor's infrastructure actively tracking and versioning the implants.
Talos observed that the NIK C2 implant development trajectory spans at least three distinct versions. All binaries observed in the wild were compiled with Go 1.23.4 (which was released in December 2024), placing the entire sample set compiled no earlier than late 2024. The actor has Zeroed PE TimeDateStamp fields and near-epoch filesystem timestamps (manifesting as Nov 29, 1979) are applied consistently across all samples.
We developed a timeline based on the initial sighting dates of NIK C2 implant variants in OSINT.
Figure 2. NIK C2 implant evolution timeline.
The pace of capability addition across the three versions indicates a technically proficient team with prior malware operations experience is actively expanding NIK C2 towards a full-service adversarial framework.
Active NIK C2 server seen in the wild
During our research, we observed that a threat actor hosted the NIK C2 framework on a server at IP address “87.120.196[.]120”, resolving the domain “total-sitevv[.]lol”. The C2 server hosted an SSL/TLS certificate (serial number 7d16381a9de823943b5a0987dbd0f26edf22052b and jarm:"28d28d28d00000000042d42d0000001f361a1bf80ed39a1e352adeb016a07b" ) with the Common Name (CN) set to nik-panel. This CN value matches strings embedded within the implant binary. Observing the NIK C2 infrastructure active in the wild allowed us to assess with moderate confidence that NIK C2 is not merely a proof of concept, but a fully functional, AI-integrated C2 framework.
Figure 3. NIK C2 was observed in the wild during the research period.
NIK C2 implant integrates OpenAI’s API
AI integration is one of the most architecturally distinct features of NIK C2 implant. It constructs a fully formed HTTP request to OpenAI’s production inference endpoint, transmits it from the victim machine IP address, parses the JSON response, and returns the AI-generated text to the actor’s panel. The entire operation from receiving the actor prompt to returning the large language model (LLM) reply is executed synchronously with a 60-second timeout.
The implant begins by extracting three fields from the command payload received from the C2. The first field, identified by the key prompt, is the text the actor wants to send to the AI model. If the prompt string has zero length, the handler immediately constructs an error response and returns without making any outbound network call. The second field, identified by the key api_key is the OpenAI API key to use for authentication. The third field, identified by the key model, specifies which OpenAI model to use.
Figure 4. Snippet of NIK C2 implant AI handler module.
After extracting the three parameters, the implant checks whether the actor supplied an API key. If not, it calls the operating system's environment variable reader with the string OPENAI_API_KEY and uses the victim’s API key. This fallback is not a backup mechanism for API key resolution. It is a deliberate design with significant operational implications. If the victim has configured an OpenAI account on their machine, that account's API key will be used to fund the actor's AI inference. OpenAI's billing system will charge the victim's payment method, and OpenAI's access logs will show the victim's API key as the one that made the requests, allowing no trace attributable to the threat actor.
If the actor does not specify a model name, the implant falls back to a five-character default string stored in the binary data section. Decoding the five-character value showed gpt-4 confirming that GPT4 is the default when no model is specified. The actor can override this by passing any valid OpenAI model identifier in the command payload, allowing selection of newer models as they become available without requiring a binary update.
The implant builds the OpenAI API request body by constructing a map with four fields. The first field uses the key model and contains the resolved model name. The second field uses key messages and contains a two-element array of message maps. The third field uses the key temperature and contains a floating-point value read from a constant in the binary data section. The fourth field uses the key max_tokensand contains an integer value also read from binary.
The message array is constructed in the order that the OpenAI Chat Completions API expects. The system message is first followed by the user message. The system message map has the role system and a content string that is exactly 68 bytes long hardcoded in the binary. This 68-byte string is the implant's behavioral instruction to the AI. It defines the model's operational role and response style for the duration of the session. The user message map has the role userand contains the actor's prompt text verbiage. The complete map structure is then serialized to JSON. The JSON message is sent to the URL https:// api.openai.com/v1/chat/completions, the OpenAI Chat Completions endpoint, through an HTTP POST request.
Figure 5. Snippet of NIK C2 implant AI handler module.
When the HTTP response arrives with a 200 status code, the handler uses Golang's JSON decoder to parse the response body directly into a generic map structure without defining a typed schema. It then navigates the decoded map by string key lookups in the sequence that the OpenAI Chat Completions API response structure defines. The outermost map is queried for the key choices which in a successful response contains an array. The implant checks that this array is non-empty, then accesses its element keys messageand content. The string value at key contentis the AI model-generated text response.
After successfully extracting the AI-generated content, the handler assembles a result map with four entries. The key status is set to a constant string that reads as generated. The key code is set to the AI model's response text, so that the actor receives the full content of the model’s replies. The key modelis set to the resolved model name that was used for the request, confirming which model produced the output. The key usageis set to the raw usage object from the OpenAI response, which contains the prompt token count, completion token count, and total token count. This usage data allows the actor to track how many tokens are consumed per request. The completed result map is ultimately transmitted to the C2 server over WebSocket or through the HTTP fallback C2 address.
Figure 6. AI model response is encapsulated in JSON message and will be sent to C2.
Dual execution modes of NIK C2 implant
Upon execution, the implant inspects its command-line arguments to determine its execution path. The argumentwatchdog activates supervisory monitoring to relaunch the core process if terminated, the copywatchdog tracks file copy operations, and the absence of either defaults execution to primary agent mode.
In primary mode, it uses a named mutex to enforce single-instance execution, logs a messagereading [NIK] Starting, generates a 32-byte cryptographic session key if uninitialized, decodes its obfuscated C2 address, and sets its masquerade name to “svchost.exe” or “simvol.exe”.
After initial setup, the binary records its process ID (PID) in the victim's temporary application folder and executes its persistence and evasion routines. These routines include copying to %appdata%/Roaming/Microsoft/Network with modified access controls, configuring Windows autostart registry entries, and masquerading its process. Finally, it starts the local proxy server, initiates the WebSocket communication loop in a separate goroutine, and enters a continuous heartbeat polling loop on the main thread.
Implant’s C2 command surface overview
The implant command dispatcher module facilitates over 52 commands that are directed by the C2 panel. The dispatcher module uses byte-level string matching to map the associated modules that are launched as concurrent goroutines, allowing multiple operations to run in parallel.
The following table shows the NIK C2 implant’s command categories:
Extracts all saved WiFi SSIDs and plaintext passwords via Windows wireless
configuration tooling.
Surveillance
Keylogger
Real-time live stream per keystroke to actor panel, plus accumulated buffer
dump on demand.
Surveillance
Screen Capture
Full-screen screenshot and continuous screen stream.
Surveillance
Camera & Audio
Camera snapshot and stream, microphone recording, live audio feed.
Surveillance
Clipboard Monitor
Real-time clipboard content interception and replacement.
Remote Control
HVNC
Hidden Virtual Network Computing — full desktop control invisible to the victim.
Lateral Movement
SOCKS5/HTTP Proxy
Embedded proxy routing actor traffic through victim into internal network.
Lateral Movement
Reverse Proxy Tunnel
Bidirectional TCP relay tunneled over C2 WebSocket for LAN pivoting.
Lateral Movement
RDP Operations
RDP session interaction for lateral movement to other Windows hosts.
Persistence
Autostart &
Masquerade
Registry Run key persistence, process name masquerading, COM hijacking.
Persistence
Self-Heal Watchdog
External watchdog subprocess monitors and relaunches agent on termination.
Evasion
Defense Bypass
AMSI patch, debugger detection, stealth mode, UAC bypass, process hollowing.
AI
AI Generate
Live OpenAI API inference routed through victim machine with actor prompts.
Destructive
Boot Ransomware
Master Boot Record raw backup via PowerShell disk read and Screen-locking ransomware via LOLbin, registry persistence, crypto payment demand.
Destructive
Bootkit Preparation
UEFI vs. BIOS detection, Secure Boot query, bootkit binary staging.
Implant deploys screen-locking ransomware
The ransomware module of the implant operates as a multi-stage attack controller that the actor runs in sequence to prepare, deploy, and retract a screen-locking ransomware payload.
At first, it executes PowerShell to execute a raw disk copy command that reads directly from the physical drive device path (“\\.\PhysicalDrive0”) and writes the first sector, which is Master Boot Record (MBR), to a file named “mbr_backup.bin” in the Windows temporary directory.
Next, the module constructs a complete self-contained HTML lock screen code entirely at runtime from a hardcoded format string, parameterized with actor supplied Bitcoin and USDT wallet addresses, prices, contact email, timer duration, and custom text from the C2 command message, allowing the actor to fully customize the ransom demands.
Figure 8. Screenlocker HTML code is hardcoded in NIK C2 implant binary.
After generating the HTML code, the binary writes it to the file “lock_screen.html”in the system temporary directory. It then generates a Windows batch script that calls mshta.exe with the path to the HTML file, followed by an infinite loop construct with a five-second timeout between iterations, ensuring that if the user somehow closes the window it reopens within five seconds. This batch file is written to the temp directory as “lock_start.bat”.
The implant then runs a reg add command that writes a registry Run key named “SystemLock” under the current user's autostart path, pointing to a cmd /c invocation of the batch file, so the lock screen is executed on every user's logon. Additionally, a background goroutine is spawned that continuously monitors and relaunches the lock screen process. Finally, the module sends a confirmation response to C2 with the path of the deployed HTML file and the timer value.
The design of this ransomware module is notable for several reasons. It does not encrypt any files, which means it leaves no forensic trail of file modification timestamps or encryption markers. It relies entirely on a screen lock, which is considerably faster to deploy than a file encryption ransomware. The persistence via registry Run key and a self-healing loop ensures the screen lock survives user attempts to dismiss it and survives a system restart.
Figure 9. Desktop lockscreen page of the ransomware deployed by the NIK C2 implant.
Implant’s bootkit preparation feature
The bootkit preparation module of the implant is designed to survey the victim machine's boot firmware environment and then stage a bootkit payload file.
It executes bcdedit /enum, the Windows Boot Configuration Data editor, with the output flag that enumerates all boot entries while hiding the console window. The implant reads the full output and searches for three specific substrings in sequence including EFI,Windows Boot Manager, and Windows Legacy OS Loader. If any of these are found, the boot type is classified as UEFI. The binary also searches for ntldr, the legacy Windows NT loader used by BIOS-mode systems as a fallback. Based on which string was matched, the boot type is recorded as either "UEFI" or "BIOS" as a string of the appropriate length. Separately, the binary runs a PowerShell command invoking Confirm-SecureBootUEFI, which is a built-in PowerShell command that returns to the current Secure Boot state. The output is searched for the string True to detect an enabled Secure Boot and for False to detect an explicitly disabled Secure Boot. If neither is present, the value is recorded as unknown. The result is sent back to the C2, a map containing the boot type classification and the Secure Boot status string.
Then the implant writes a 16-byte placeholder file named “bootkit.bin” to the system temporary directory. The bytes written spell out "NIK_BOOTKIT_PREP" in ASCII, which serves as a staging marker rather than an actual bootkit binary. This placeholder confirms that the target path is writable by the current process, establishes the file location that subsequent operations will reference, and can be overwritten by the actual bootkit binary delivered through the implant's file-upload or file-write command handlers. The path to the staged file is returned to the C2 in response.
Implant’s theft functionality
When the actor issues the theft category commands from the C2, the implant executes the associated goroutines to collect the targeted data into a result map space in the victim machine memory:
WiFi password theft (wifi_steal)
The implant executes netshcommands directly via Go’s exec.Command function by passing arguments as discrete tokens rather than through a shell string. Harvested results are formatted under specific labels: plaintext Wi-Fi passwords appear under Key Content:, saved network names are cataloged under WiFi Profiles:(with missing entries flagged using the per-entry format[%s] not found), and execution failures or absent interfaces return standardized error strings such as [WiFi] no wireless adapter or access deniedand No WiFi profiles found.
netsh wlan show profiles
netsh wlan show profile name="
The implant stages targeted browser database files into an archive alongside the Local State file, which contains the AES master key protected by Data Protection Application Programming Interface (DPAPI). The implant imports and executes the CryptUnprotectDataWindows API to unwrap the AES key and decrypt the databases locally. Otherwise, it exfiltrates the raw encrypted databases to the C2 server for offline extraction.
Targeted browser database files are shown in the table:
Browsers
Targeted files
Chrome
Login Data, Cookies, Web Data, Local State, Bookmarks
Edge
Login Data, Cookies, Web Data, Local State
Brave
Login Data, Cookies,leveldb file
Opera
Login Data from folder Opera Software\Opera Stable\
The implant extracts Discord tokens and session cookies from the levelDB store on the victim machine. The extracted outputs are labelled as === Discord Tokens === and DISCORD TOKENS. The browser session cookies (Discord_Cookies) are extracted from the copied Cookies database.
Victim’s desktop-based wallets are collected directly from the wallet storage paths. Browser extension wallets are extracted from chromium LevelDB stored by extension ID.
Desktop based wallet storage paths targeted are listed below:
/AppData/Roaming/Exodus/exodus.wallet
/AppData/Roaming/Electrum/wallets
/AppData/Local/Electrum/data/wallets
/AppData/Roaming/Ethereum/keystore
/AppData/Local/LedgerLive
wallet.dat (Bitcoin Core)
/AppData/Roaming/atomic (Atomic Wallet)
Electrum\wallets
Browser extension wallets targeted:
Wallet
Extension ID
MetaMask (Chrome/Brave)
nkbihfbeogaeaoehlefnkodbefgpgknn
MetaMask (Edge)
nkbihfbeogaeaoehlefnkodbefgpgknn
Coinbase Wallet
hnbohgpbmfldddohgoiefkeifpjficbk
Phantom (Chrome)
lnbcamaoebkogjmdnaofbeemigaalhlp
Brave Wallet
odbfpeeihodbihlmhbnhakoadhilfibh
Seed phrase, private key file, and system reconnaissance
The implant performs two regular expression patterns to search on the entire filesystem of the victim machine. These two regular expressions are designed to scan file names for sensitive cryptographic assets and credentials, functioning as case-insensitive patterns ?i. The first expression targets cryptocurrency recovery materials and wallet backups by matching keywords like "seed," "mnemonic," or "wallet" paired with common plain-text and data file extensions (.txt, .md, .csv, .dat), while the second seeks out asymmetric private keys and general secrets using terms like "private," "privkey," or "secret" paired with both text files and standard cryptographic key containers (.key, .pem). Because both patterns use unanchored, greedy matching (.*) without start (^) or end ($) boundary anchors, they capture any file where these sensitive terms precede the target extensions. Matched data are collected under the label of seed candidates and archived into “browserdata.zip”.
The implant also performs victim machine reconnaissance by executing the following commands and uses chcp 65001 prefix to force the output in UTF-8 format.
After all collection paths are complete, the implant assembles all collected data into a single document that looks like a formatted report with clearly labeled sections for each data category such as === CRYPTO ===, === WIFI ===, === BROWSER ===.
Keylogger: Keystrokes livestreamed to C2
The keylogger module of the implant uses a persistent background goroutine that polls all 256 Windows virtual key codes, detecting keypresses via dynamically resolved API calls, and transmits the captured input. When a compromised victim presses a valid key on the keyboard, it is simultaneously streamed live as an AES-256-GCM encrypted JSON payload over WebSocket to C2 and also appends to an in-memory buffer capped at 10,000 entries and halved when full to prevent memory leaks. On an actor's dump command, this buffer is concatenated into a single string and returned to C2 via WebSocket or HTTP fallback, ensuring complete data transfer even during network interruptions.
Stolen data exfiltration to C2
Once the archive is assembled, the entire result map is handed to the result transmission routine of the implant. That routine constructs a new JSON object containing five specific fields. It includes the command identifier echoed back from the original command. It also contains the agent's persistent identifier, formatted as ag_<16 hex chars>. The type field is set to the string quick_steal_response. Finally, the data field holds the complete result map.
Once constructed, this object is forwarded to the encryption routine. The routine serializes the object into JSON. It then generates 12 fresh random bytes to serve as a nonce. Next, it encrypts the serialized JSON using AES-256-GCM with a static key derived from a hardcoded seed. It concatenates the nonce, the ciphertext, and the 16-byte authentication tag and Base64-encodes the entire payload. The encrypted payload is placed in a wrapper object under the "e" key alongside the plain-text agent ID, and the wrapper is JSON marshaled into the final payload.
This encrypted payload is then delivered through an available transmission path. The sending routine first checks whether the WebSocket connection is live. If it is, the payload is written directly into a WebSocket text frame on the existing connection, reaching the actor's panel with minimal latency. If the WebSocket is not currently connected, the routine falls back to an HTTP POST request to the endpoint path /api/c2/result on the C2 server, using the same encrypted body format. This dual-path design ensures stolen data is delivered even during WebSocket interruptions, as the HTTP channel remains functional independently of the WebSocket state.
Implant’s C2 protocol
The implant C2 architecture is designed for two independent, simultaneously operating communication channels. The primary channel is a persistent WebSocket connection over TLS. The secondary channel is an HTTP polling loop that posts to a fixed API endpoint at regular intervals.
With the primary channel, the connection begins with a TCP dial to the C2 server address with an eight-second timeout. If the port is not explicitly present in the configured address, port 443 is appended automatically. Once the TCP socket is established, it is wrapped in a TLS session using a custom certificate configuration that pins to a specific certificate rather than validating against the system's certificate authority store. This prevents standard TLS interception proxies from observing traffic.
Immediately after a successful WebSocket handshake but before any command is received, the implant transmits a full system registration message. The implant collects victim data such as the machine hostname, the local LAN IP address, the Windows username from the environment, a user security identifier, the local reverse-proxy port number that was assigned when the embedded proxy server was started, and the detected upstream proxy configuration derived from the Windows registry proxy settings. All of this is assembled into a JSON object and encrypted and sent to the C2.
Figure 10. Snippet of NIK C2 IMPLANT’s C2 communication handler function.
The HTTP polling channel runs independently. Every approximately 250 milliseconds, the agent collects a fresh snapshot of victim state hostname, watchdog status, local IP, username, current timestamp, and system uptime encrypts it in the same wire format and posts it to the /api/c2/update endpoint on the C2 server.
Below table shows the C2 endpoints that the implant communicates:
Endpoint
Purpose
/api/c2/update
Reconnaissance beacon – victim system info
/api/c2/result
Command output exfiltration
/api/c2/screen
Screenshot upload
/api/c2/file_chunk
File exfiltration
/api/c2/rproxy_up
Reverse proxy upstream data
/api/c2/ws
Websocket – actor command channel
Every message on both channels, in both directions, uses the same symmetric encryption scheme. A hardcoded seed value stored in obfuscated form in the binary data section is decoded at startup and produces a 32-byte AES key.
The C2 server then responds with an encrypted payload, whose inner map contains a command array identical in structure to those delivered over WebSocket. Commands received through HTTP are dispatched through the same logic. If the HTTP POST fails, the agent rotates to the next server address before retrying.
Figure 11. Snippet of NIK C2 implant’s C2 communication handler function.
The result transmission to the C2 is performed by the implant when a command handler completes its operation, the result is packaged into a response envelope containing the original command's identifier, the implant's own identifier, a type string formed by appending _response to the command name, the result data payload, and a top-level type marker of "result". This object is encrypted and delivered through either directly over the WebSocket connection if it is active, or via an HTTP POST to /api/c2/result.
Implant’s defense evasion and anti-analysis techniques
The NIK C2 implant deploys a layered set of defense evasion measures that activate immediately at startup and operate across the full compromise session. On launch, It hides its console window via API ShowWindow, renames the binary to “csrss.exe” in the Windows temp directory to impersonate a legitimate system process, disables Windows Recent Documents telemetry through a registry write action, and applies a critical-process flag via API NtSetInformationProcesswith the parameter value0x1Dfor ProcessBreakOnTermination that causes a Blue Screen of Death if any attempt is made to terminate the process through Task Manager or taskkill actions.
Figure 12. Snippet of NIK C2 implant’s evasion handler module.
Alongside these, two anti-debug checks IsDebuggerPresent and CheckRemoteDebuggerPresent run silently and call os.Exit(0) on detection, leaving no exception record or crash evidence. When directed by the C2, the implant can also escalate privileges without a UAC prompt using the fodhelper.exe COM hijack, which writes the implant path into HKCU\Software\Classes\ms-settings\Shell\Open\command, triggers elevation, and cleans the registry key within two seconds.
The implant bypasses the Antimalware Scan Interface (AMSI) by executing a hardcoded, embedded PowerShell script that patches memory inside “System.Management.Automation.dll”. Specifically, it overwrites the AmsiInitFailed field with a six-byte stub (MOV EAX, E_INVALIDARG; RET), forcing initialization to report failure and disabling content inspection for the remaining of the PowerShell session.
The emergence of NIK C2, an AI-enabled command-and-control framework, underscores a critical shift in modern malware design: the transition from static intrusion toolsets to dynamic, modular implants that adapt on demand. By embedding a live AI pipeline directly into the C2 loop, the compromised host is no longer a passive foothold but an autonomous operational asset. Operators can dynamically generate context-aware lure material, execute localized deception, synthesize operational intelligence, and craft targeted payloads directly on the compromised hosts — all while lowering the technical barrier which was traditionally required for such sophisticated tradecraft.
Coverage
The following ClamAV signature detects and blocks this threat:
Win.Trojan.GoDiscorder-10060526-0
Indicators of compromise (IOCs)
IOCs for this research can be found at our GitHub repository here.
from Cisco Talos Blog https://ift.tt/27SWLbv
via IFTTT
