ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “cipher”

6 stories in the last 30d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllIndustry 3Malware 3Research 2Threat actor 2AI research 2AI safety & security 2Tools 1Vulnerability 1
SeverityAllcritical 0high 2medium 6low 0info 8

SloppyRAT: A New Tool For Ransomware Attacks

Zscaler details SloppyRAT, a new DLL backdoor delivered via ClickFix lures that stages CastleLoader and CastleRAT ahead of ransomware attacks.

Zscaler ThreatLabz analyzed SloppyRAT, a DLL-based backdoor distributed via ClickFix lures that abuses finger.exe over TCP port 79 to download a batch script. The malware copies curl.exe to download IronPython 3.4.2 from GitHub and executes zlib-compressed Base64-encoded Python to deploy CastleLoader and CastleRAT, then reflectively loads SloppyRAT in memory. It hinders analysis using XOR stack-string obfuscation, a modified affine cipher with modulus 127, and 13 runtime-decrypted code blocks, while communicating with C2 over a reverse SOCKS channel.

Zscaler ThreatLabzupdated · 5d agofirst · 6d agoMalware in the wild 3 sources

HP Easy Start for macOS: CVE-2026-12554 / CVE-2026-12555 / CVE-2026-12556

Cipher Security Labs disclosed three high-severity macOS privilege vulnerabilities in HP Easy Start, fixed in version 2.16.7.260722.

HP Easy Start for macOS contains three high-severity vulnerabilities, CVE-2026-12554, CVE-2026-12555, and CVE-2026-12556, that break the product's macOS privilege boundaries. The issues were researched by Cipher Security Labs and coordinated with HP under advisory HPSBPI04124. Fixes are available in HP Easy Start 2.16.7.260722 and later versions.

Full Disclosure · 12d agoVulnerabilityCVE-2026-12554CVE-2026-12555CVE-2026-12556

Zero-Click Grok Chat History Theft: Adversa AI Demonstrates Cryptographic Context Injection

Adversa AI's Cryptographic Context Injection bypasses AI guardrails using AES-encrypted payloads, enabling zero-click theft of Grok users' full chat histories.

Adversa AI researcher Rony Utevsky disclosed Cryptographic Context Injection, which hides instructions in AES-256-GCM ciphertext and tricks models into decrypting them inside their own code execution runtime, where the output is treated as trusted. Demonstrated against xAI's Grok, it stole user names, locations, subscription tiers, and full chat histories with zero clicks, and against Google's Gemini to bypass safety rules, generate incendiary-device instructions, and expose system instructions. Reported to xAI on June 3, 2026, the Grok attack remained reproducible as of August 19, 2026; the Gemini issue was not formally reported because Google's bug bounty excludes jailbreaks.

Security Affairs · 24d agoAI safety & security

New Cryptographic Context Injection Attack Could Let Web Pages Steal Grok Chat Data

Adversa AI demonstrated 'Cryptographic Context Injection' making xAI's Grok leak chat history and session data to attacker-controlled servers via encrypted web payloads.

Adversa AI disclosed a technique where a web page carries an encrypted JSON object (PBKDF2 and AES-256-GCM) that Grok's code-execution runtime decrypts, letting attacker instructions bypass content classifiers and reach the model's context. The decrypted instructions direct Grok to embed the user's name, approximate location, subscription tier and ongoing conversation into a URL it fetches, exfiltrating the data without confirmation. Testing targeted grok.com running Grok 4.5 Fast on August 19, 2026, with a reported 40% success rate over 20 attempts since June; no CVE, patch, or in-the-wild exploitation is reported. A related demonstration reproduced Gemini 3 Flash system instructions via a fabricated Python traceback, while GPT-5 failed to parse the payload and Claude Sonnet 4.5 flagged it as prompt injection.

The Hacker News · 27d agoAI safety & security

North Korea-linked Hackers Hide a Backdoor Inside HAProxy

Rapid7 reports North Korea-linked hackers implanted a backdoor compiled into HAProxy at South Korean automotive and media firms, enabling covert C2 and credential theft.

Rapid7 documented a previously undocumented Linux toolkit hitting South Korean automotive and media organizations, centered on a backdoor compiled directly into victims' HAProxy 2.8.12. The 'ted backdoor' uses HAProxy's native filter API to intercept HTTP traffic, receive C2 commands hidden in requests to a fake image path, and erase all traces from logs and counters; the toolkit also trojanizes crond, agetty, atd, sshd, and polkitd, adds an SSH keylogger, and runs curlRAT with virtualization checks. It can inject scripts or replace page content for selected victims, turning the load balancer into a watering hole. Attribution sits at medium confidence toward North Korean state actors, with overlaps to APT37-linked infrastructure and a concurrent Lazarus campaign; the campaign's command domains have since gone dark.

Security Affairs · 8d agoThreat actor in the wild

FrostyGoop’s Zoom-In: A Closer Look into the Malware Artifacts, Behaviors and Network Communications

Unit 42 dissects FrostyGoop OT malware, which sent Modbus TCP commands to disrupt heating for 600+ apartment buildings in Ukraine.

Palo Alto Unit 42 analyzed new FrostyGoop/BUSTLEBERM samples, the ninth known ICS-centric malware, first used against a Ukrainian municipal energy company by sending Modbus TCP commands to ENCO control devices. The attack caused a two-day heating outage affecting over 600 apartment buildings during sub-zero temperatures. The Go-compiled malware accepts Modbus register operations and timing parameters via command-line arguments or a JSON configuration file, uses an obscure open-source Modbus library, and checks the Windows BeingDebugged flag to evade debuggers. Unit 42 telemetry recorded over 1 million Modbus TCP devices exposed to the internet between September and October 2024.

Palo Alto Unit 42 · 28d agoMalware in the wild