ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “casino”

381 items

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllRansomware 117Phishing & fraud 57Malware 49Vulnerability 40Data breach 28Threat actor 26Policy & legal 26Exploit / PoC 17Industry 14Research 4Advisory 3
SeverityAllcritical 115high 141medium 56low 68info 1

Hackers Are Hiding Espionage Infrastructure Inside Ordinary-Looking Casino Websites

Infoblox links China-aligned APT PeckBirdy C2 infrastructure hidden in casino and adult websites targeting Asian government, finance, IT, and education sectors.

Infoblox researchers report that China-aligned APT groups have used casino and adult websites as cover for PeckBirdy, a JavaScript command-and-control framework active since 2023. The sites embed C2 servers, register service workers for persistence, and serve fake browser-update prompts delivering backdoors capable of running commands, stealing credentials, and providing remote access. Targeted sectors across Asia include education, IT, banking, financial services, and government. Just over 3% of Infoblox enterprise customers resolved at least one PeckBirdy C2 domain, with detection coverage on VirusTotal ranging from 13 detections to none.

Cyber Security News · 1d agoThreat actor 2 sources

China-Aligned Hackers Hide PeckBirdy Malware C2 Inside Casino and Adult Websites

Infoblox found China-aligned actors hiding PeckBirdy malware C2 inside fake Chinese-language casino and adult websites, evading security scans via service workers and WebSockets.

Infoblox reported that China-aligned actors behind the PeckBirdy JScript C2 framework conceal command-and-control inside low-quality Chinese-language casino and adult websites, extending Trend Micro's earlier findings that tied the framework to backdoors including MKDOOR and HOLODONUT. One decoy, vip311[.]cc, embedded JavaScript linked to cache-mcp[.]com and registered a service worker connecting to mcp-source[.]online over WebSocket; at publication mcp-source[.]online had zero VirusTotal detections, showing how the layered design evades conventional scanning. The campaign has been active since at least 2023, and just over 3% of Infoblox enterprise customers resolved at least one PeckBirdy C2 domain, with education, IT, banking and government among observed sectors.

GBHackersupdated · 1d agofirst · 1d agoThreat actor in the wild 2 sources

Low-quality casino sites conceal highly dangerous threat actors

Infoblox reveals China-aligned APT groups hiding PeckBirdy malware C2 domains inside roughly 1.7 million Chinese-language illegal casino websites.

An Infoblox report says it tracks about 1.7 million Chinese-language casino sites enabling illegal gambling, some of which double as command-and-control infrastructure. China-aligned APT groups have hidden PeckBirdy framework C2 domains inside these low-quality casino sites since 2023, injecting scripts that display fake software update pages to deliver malware. Over 3 percent of Infoblox enterprise customers resolved at least one PeckBirdy C2 domain, and some sites rely on US cloud providers via 'infrastructure laundering.' Infoblox urges defenders not to dismiss casino-domain alerts as mere employee browsing violations.

The Register · Security · 1d agoThreat actor in the wild1

Slovenian casinos reopen after cyberattack knocked gaming systems offline

Slovenian gaming group Hit reopened six casinos after a cyberattack forced closures for roughly three days.

Hit, one of Slovenia's largest gambling and tourism groups, detected a cyberattack early last week that forced six of its casinos to close for about three days. Some gaming functions and the loyalty system remain unavailable, with guests initially limited to slot machines. The company has not disclosed whether data was stolen, how attackers got in, or whether a ransom was demanded; Slovenian police confirmed they are investigating.

The Record · 17d agoData breach

Hacked Thai College Website Abused to Redirect Google Searchers to Illegal Online Casinonew

ADEX uncovered a hacked Thai college domain serving casino pages through real Google search redirects, part of a global campaign compromising government and education sites.

Anti-fraud platform ADEX found a casino-themed page planted on the compromised km.chpc.ac.th domain in Thailand's educational .ac.th zone, which Google indexed and ranked first to redirect users to illegal online gambling. The scheme achieved full ad cloaking without deploying any cloaking code by chaining a genuine Google results page and a third-party redirect. The same domain-borrowing tactic is tracked globally: Thailand reports roughly 30 million gambling URLs across about 1,000 public-sector sites, Indonesia blocked 683 government and education sites, and Netcraft found an underground market selling access to more than 15,000 compromised .gov, .edu and ccTLD domains. ADEX argues Google's site reputation abuse policy does not cover institutions that are hijacked without their knowledge.

Cyber Security News · 29m agoPhishing & fraud in the wild

Google Play Early Access Abused to Push Thousands of Deceptive Android Apps

Bitdefender found abuse of Google Play's review-free Early Access program to push thousands of deceptive casino and reward apps promoted with AI deepfake ads.

Bitdefender reports threat actors are abusing Google Play's Early Access program, which blocks public reviews and ratings, to distribute thousands of deceptive casino, reward, and utility apps. A GTA imitator, 'Vice Streets: Open World,' surpassed 1 million downloads before disappearing, with apps promoted via AI celebrity deepfake ads on TikTok and Facebook and monetized through endless ad serving and payouts that never arrive. The report coincides with disclosures on Android malware families Hagaseca, Mantax Otax, StreamRat, and GoldFactory's Gigabud banking trojan with its Vwork companion app used for cloned-app financial fraud.

The Hacker Newsupdated · 6d agofirst · 6d agoPhishing & fraud in the wild 7 sources