Search: “work-profile”

GoldFactory Weaponizes Open-Source Vwork App Cloner in Gigabud Banking Malware Attacks

Group-IB says GoldFactory's Gigabud Android trojan uses Vwork, a weaponized Shelter fork, to clone banking apps into isolated Work Profiles and evade bank-side detection.

Group-IB's 'Hook for Gold' investigation found GoldFactory ships Vwork, a modified fork of the open-source Shelter app, alongside its Gigabud Android banking trojan, active since 2022. Vwork abuses Android Work Profile provisioning to clone banking apps into an isolated environment, weakening the link between detected malware signals and fraudulent transactions. Gigabud has targeted victims in Southeast Asia, Latin America, the Middle East, Africa, and beyond via fake airline, tax, and government apps requesting Accessibility and overlay permissions. In Indonesia, telemetry recorded about 1,469 compromised devices and roughly $960,939 in estimated losses between February and July 2026.

GBHackers·updated Sep 11, 12:14 UTC · 4d ago·first Sep 9, 10:49 UTC · 7d agoMalware in the wild 6 sources

Shattering the Dream – When a Job Offer Becomes a Zero-Day Attack

Check Point details an Operation Dream Job wave using trojanized PDF viewers to hit defense, aerospace, and aviation targets since early 2026.

Since early 2026, Check Point Research has tracked a wave of the Operation Dream Job campaign primarily targeting the global defense sector, with emphasis on aerospace and aviation companies. The threat actor distributes modified PDF viewers that execute malicious payloads embedded in specially crafted files, delivered under fake job-offer pretexts. Check Point characterizes the operation as a zero-day attack.

Check Point Research·Aug 11, 17:30 UTC · Aug 11, 2026Threat actor in the wild

Give every teammate and agent the right level of access to your Workers

Cloudflare launches per-Worker granular access controls with four roles, enabling least-privilege access for teammates, AI agents, and CI/CD pipelines.

Cloudflare announced granular authorization for Workers, letting admins scope access to a single Worker instead of the whole account. Four new roles are available: Metadata Read-Only (observability without source code), Content Read-Only (read code without changes), Editor (deploy without delete), and Admin (full control of one Worker). Roles apply at Developer Platform, product, or resource level, can be attached to dashboard users or API tokens, and are available to all customers now, with plans to extend to D1, R2, and KV.

Cloudflare Blog·Sep 15, 13:00 UTC · 21h agoTools

North Korea-linked IT Workers Are Getting Hired Inside Western Companies

Huntress documented five DPRK-linked FAMOUS CHOLLIMA workers hired by Western companies in 2026 using fake identities, proxies and laptop farms.

Huntress published an investigation of five confirmed 2026 cases of North Korea-linked IT workers, tracked as FAMOUS CHOLLIMA, obtaining remote jobs at legitimate companies in IT, sales, marketing and healthcare. The workers use stolen or fabricated identity documents, VPNs and proxy services, and some were caught using PiKVM hardware-level control, travel routers and laptop farms to mask their true location. Detection relied on document forensics, behavioral anomalies and indicators like identical typo artifacts in electricity bills rather than network intrusions.

Security Affairs·Sep 1, 11:08 UTC · 14d agoThreat actor in the wild

Researching Employment Scams

Schneier highlights research into North Korean fake-employment IT-worker scams that embed operatives in remote roles for long-term insider access.

The post discusses research into employment scams in which fabricated remote workers, associated with North Korean IT-worker schemes, embed in organizations for months or years to exfiltrate data or position for financial theft. Researchers used controlled sandbox environments to observe operatives syncing personal accounts and working under false identities. Commenters also note reverse scams targeting desperate job seekers through high-pressure MLM and door-to-door sales schemes.

Schneier on Security·Sep 3, 11:18 UTC · 12d agoPhishing & fraud

PurpleDelta's Fraudulent Employment Operations

Recorded Future details North Korean cluster PurpleDelta using AI-generated personas and ChatGPT assistants to infiltrate companies via fraudulent employment.

Recorded Future profiles PurpleDelta, a North Korean IT worker threat cluster, in a new research report. The group uses AI-generated personas, sophisticated tradecraft, and custom ChatGPT assistants to obtain employment at target organizations and operate covertly. The report includes key indicators of compromise and recommended mitigation strategies for defenders.

Recorded Future·Aug 18, 00:00 UTC · 29d agoThreat actor

How a team of entity maintainers monitors, connects and scores entities in Elastic Security

Elastic Security explains how background 'maintainer' jobs build user, host and service entities from raw logs and drive identity resolution and risk scoring.

Elastic Security Labs describes the internal background jobs, called maintainers, that each own one piece of every user, host and service record in Elastic Security. The maintainers construct entities from raw logs, resolve identities across sources and compute risk scores, and the write-up explains how the team keeps this entity machinery consistent.

Elastic Security Labs·Aug 24, 00:00 UTC · 23d agoTools

North Korean remote workers are broadening their job hunt beyond IT

Huntress links suspected North Korean remote workers to sales, marketing, and healthcare jobs using stolen identities, VPNs, proxies, and KVM hardware.

Huntress investigations identified suspected DPRK remote workers hired beyond IT in sales, marketing, and healthcare/financial organizations, sometimes actually performing the work they were hired for. Fraudulent documents included passports from the same city issued one day apart, ID cards with identical validity dates, and electricity bills built from the same online template with matching typos. A financial-services case found a PiKVM and Guermok USB capture card on a new hire's laptop within hours of delivery, suggesting a laptop farm, and another hire used a police mugshot with the photo digitally swapped. Researchers urge rigorous background checks and identity verification at the interview stage.

Help Net Security·Aug 28, 00:00 UTC · 19d agoPhishing & fraud in the wild

Hackers Frequently Target Healthcare and Finance Orgs

A new Huntress survey indicates threat actors frequently target healthcare organizations and banks because of the highly personal data they hold.

Huntress published survey findings indicating that healthcare organizations and banks are frequent targets for threat actors. The piece attributes this to the highly personal information these sectors handle. The article is framed around cyberattack readiness rather than a specific incident.

Huntress·Sep 1, 14:00 UTC · 14d agoIndustry

Most Fraudulent Hires Receive Credentials Before Detection

HYPR report finds 42% of fraudulent hires pass screening and receive corporate credentials, averaging 5.73 days of unmonitored network access before detection.

A HYPR study of 500 US HR executives found 42% of fraudulent candidates pass pre-hire screening and get hired, with only 3% detected on their hire day and 20% remaining undetected up to three weeks. This gives fraudulent hires an average of 5.73 days of unmonitored corporate network access, and 98% of surveyed executives said they had experienced candidate fraud firsthand. The report follows a September 9 CISA update to its Insider Threat Mitigation Guide warning that malicious actors use AI tools to obtain remote IT jobs, a tactic long used by North Korean actors for data theft and extortion.

Infosecurity Magazine·Sep 15, 15:15 UTC · 19h agoPhishing & fraud

Insights into Suspected DPRK Workers

Huntress details incidents involving suspected DPRK remote workers (Famous Chollima) in partner environments and shares detection indicators.

Huntress analyzed several incidents involving suspected North Korean remote workers, associated with the activity cluster known as Famous Chollima. The report describes indicators defenders can use to detect and prevent DPRK worker infiltration in customer environments. The scheme centers on operatives obtaining remote jobs at Western companies under assumed identities.

Huntress·Aug 26, 04:00 UTC · 21d agoThreat actor in the wild

From Infostealer Log to Marketplace Listing: A Technical Walkthrough of the Credential Theft Pipeline

Cyble walkthrough maps how infostealer logs move from endpoint infection through aggregation and enrichment to dark web credential marketplace sales.

Cyble breaks the credential theft pipeline into stages: infostealer execution harvesting browser credential stores, cookies, session tokens, crypto wallets, and FTP configurations; aggregation of stealer logs via C2 panels into bundled archives; parsing and enrichment against previously leaked datasets; and final listing on dark web marketplaces. Enrichment adds employer and role context that raises prices and enables credential stuffing across reused passwords. The report advises SOC teams to monitor stealer logs and marketplace chatter early rather than waiting for breach alerts.

Cyble·Sep 10, 10:45 UTC · 6d agoMalware1

Secure all your internal vibe-coded applications — in one click

Cloudflare launched Access for Workers, letting admins attach one zero-trust policy to a Worker across all routes, domains, and previews automatically.

Cloudflare announced Access for Workers, a feature that binds an Access (zero-trust) policy directly to a Worker rather than to individual routes. The policy then applies automatically everywhere the Worker runs, including custom domains, workers.dev subdomains, routes, and preview URLs. Cloudflare positions it as one-click protection for internal, quickly built (vibe-coded) applications.

Cloudflare Blog·Aug 14, 13:00 UTC · Aug 14, 2026Tools1

Red Flags That Expose Fake North Korean IT Workers

Researchers outline red flags for spotting North Korean operatives posing as remote IT workers as their tactics improve.

Dark Reading describes indicators that help organizations identify North Korean operatives working undercover as IT workers. Researchers say these operatives are improving their tactics, but detection methods still exist. Catching them early helps employers avoid infiltration, data theft, and damage.

Dark Reading·Aug 26, 19:21 UTC · 20d agoPhishing & fraud

BGP Role model: tracking the adoption of RFC 9234

Cloudflare measured RFC 9234 adoption, finding BGP Role deployment growing but two Tier 1 networks unexpectedly stripping the Only to Customer attribute.

Cloudflare analyzed adoption of RFC 9234, which introduces BGP Roles and the Only to Customer (OTC) attribute allowing routers to reject route leaks on their own. The measurement study assessed who has deployed the mechanism in the global routing table. It found two Tier 1 networks unexpectedly stripping OTC attributes, which could undermine leak protection.

Cloudflare Blog·Aug 18, 15:21 UTC · 28d agoResearch

τ^τ-Bench: An Environment for End-To-End, Realistic Agent Construction

New τ^τ-bench tasks coding agents with building deployable customer-service agents; best config, Claude Opus 5, passes only 23.9% of simulations.

Researchers introduce τ^τ-bench, an end-to-end benchmark where a developer agent must build a complete customer-service agent from real business records, a client with requirements, a production API, an inherited codebase, and cost/model limits, then is scored by deploying it against held-out simulated users. Across 53 tasks in four domains, the strongest configuration, Claude Opus 5 under Claude Code, passes just 23.9% of evaluation simulations versus an 82.2% expert-authored reference ceiling. Failure modes mirror those of human developers: shallow queries instead of deep record comprehension, almost no client communication, and shipping the first architecture that runs rather than experimenting.

Hugging Face daily papers·Sep 3, 20:00 UTC · 12d agoAI research

7th September – Threat Intelligence Report

Check Point weekly bulletin: exploited SonicWall SMA 1000 zero-days (CVE-2026-83548/49), JFrog Artifactory auth bypass, and a 2.8M-patient Baylor Genetics breach.

Check Point's weekly bulletin covers breaches including Thomson Reuters' C-Track platform (court records across 11 US states and Canada), Baylor Genetics (2.8M patients and employees, SSNs included), Hit casinos in Slovenia, and Dropbox (~5,000 accounts via abused Lenovo email verification). SonicWall patched two exploited SMA 1000 zero-days, including CVE-2026-83548, a CVSS 10.0 pre-authentication SSRF, while JFrog fixed exploited authentication bypass CVE-2026-82329 (CVSS 9.8). Malware and actor coverage includes Gambling Goblin, JSCeal, Mirage Kitten's NodeRabbit/PollCat campaign, and DPRK Contagious Interview macOS activity, plus a FalconFlank privilege-escalation PoC against CrowdStrike Falcon.

Check Point Research·Sep 7, 14:54 UTC · 8d agoAdvisory in the wildCVE-2026-83548CVE-2026-83549CVE-2026-823291

Bogus recruiters go after high-value corporate credentials on mobile

Zimperium details browser-in-the-browser recruitment scams stealing corporate credentials on mobile, impersonating Amazon, Apple, Boeing, and Deloitte.

Zimperium reports scammers posing as HR staff use browser-in-the-browser (BitB) phishing via fake interview scheduling flows to steal corporate credentials. The kit pre-qualifies victims by rejecting personal email addresses, then captures credentials that grant OAuth tokens, internal communications, and cloud access enabling lateral movement. Domains impersonating Amazon, Louis Vuitton, Apple, FIFA, Boeing, Deloitte and others were tracked for a year, mostly hosted on AWS and SEDO, with 46 previously unpublished IOCs released.

Help Net Security·Aug 26, 00:00 UTC · 21d agoPhishing & fraud in the wild

Personal Info Possibly Compromised at Japan’s Digital Agency

Japan's Digital Agency says unauthorized access to a network system may have compromised personal data of about 246,000 government employees.

Japan's Digital Agency reported that approximately 246,000 sets of personal information, including names and email addresses of government employees, may have been compromised through unauthorized access to a network system operated by the agency. The agency said no secondary damage, such as misuse of the potentially breached data, has been identified so far.

DataBreaches.net·Sep 11, 16:06 UTC · 4d agoData breach

Engineered Persuasion: Evaluating Personalized Pretexts in LLM-Generated Spear Phishing

A study of 180 US workers found each LLM phishing personalization level raised click-intention odds by 28%, but credibility depends on context fit.

The arXiv paper evaluates how personalized pretexts in LLM-generated spear phishing affect perceived credibility, using 180 US working adults across 1,436 evaluations of emails with four cumulative personalization levels, from workplace context to shared-project details. Convincingness rose 2.40 points per level in sensitivity analysis and click-intention odds increased 28% per level, while non-clickers shifted toward deleting rather than reporting. Qualitative coding showed details matching the recipient's role and routines supported credibility, whereas incorrect, vague, or channel-inappropriate details raised suspicion. The authors argue personalization effectiveness depends on pretext fit, with implications for workplace security training.

arXiv cs.CR·Sep 3, 19:21 UTC · 12d agoResearch

Coding Agents Have Converged: Why the SWE-bench Leaderboard Can No Longer Order Its Top Entries, and What to Measure Instead

Audit of 254 SWE-bench submissions finds top coding-agent entries statistically inseparable, so small leaderboard gaps no longer establish rank.

The paper audits 254 SWE-bench submissions across four splits without running models. On Verified, the top two entries each resolve 396 of 500 instances, and exact paired McNemar tests separate none of the 29 adjacent top-thirty pairs at alpha=0.05. Within-model scaffold score ranges reach 29.8 percentage points, versus an 8.8-point spread among the top thirty. The authors release a five-step audit protocol and recommend reporting comparison-set-specific resolution and model-scaffold provenance.

arXiv cs.AI / cs.LG / cs.CL·Sep 15, 16:29 UTC · 18h agoAI research

Cybersecurity jobs available right now: July 7, 2026

Help Net Security·Aug 7, 10:57 UTC · Aug 7, 2026Vulnerability

Fake Recruiter Scams Target Corporate Credentials on Mobile

RecruitTrap phishing campaigns use mobile-optimized fake recruiter pages to steal corporate credentials from enterprise targets.

RecruitTrap campaigns impersonate recruiters and direct victims to phishing pages optimized for mobile devices. The goal is harvesting corporate credentials from enterprise targets. The mobile-focused design suggests deliberate targeting of smartphone users, where phishing cues are harder to scrutinize.

Infosecurity Magazine·Aug 25, 13:00 UTC · 21d agoPhishing & fraud

Toward an Empirical Probabilistic Risk Manifestation Model of Organizational Cybersecurity in SMEs

Empirical study of 22 SME security assessments builds a probabilistic risk model and shows assessments can be cut 24-45% while retaining most critical findings.

Researchers analyzed 281 validated security findings from 22 real-world SME cybersecurity assessments conducted over two years via a pro bono university clinic. They derived an empirical Risk Manifestation Model linking eight organizational security functions to two exposure conditions, five attack mechanisms, and six outcome categories, using probability propagation to identify dominant risk pathways. The dominant pathway runs from asset exposure to credential compromise to unauthorized access, stable under leave-one-organization-out analysis. Retaining six functions reduces assessment burden by 24% while preserving 97% of critical findings; five functions cut burden 45% while preserving 89% of critical findings.

arXiv cs.CR·Sep 14, 01:15 UTC · 2d agoResearch

Brand Impersonation Takedown: From Whack-a-Mole to Managed Response

Mandiant-tracked group UNC3753 impersonated US professional services firms' brands in 2026; Cyble urges managed takedowns over manual abuse reports.

Cyble describes how Google Mandiant-tracked group UNC3753 targeted US professional services firms between January and May 2026 using brand impersonation, spoofed domains, and fake executive profiles. Manual takedowns fail because phishing pages damage brands within hours while removal takes days. A managed takedown program with continuous monitoring and pre-authorized removal cuts the exposure window from days to hours.

Cyble·Aug 17, 14:32 UTC · 29d agoPhishing & fraud in the wild

BotBase for Operators: A clearer path to joining Cloudflare's directory of bots and agents

Cloudflare launched BotBase for Operators, a dashboard for bot and agent operators to manage directory submissions, track status, and declare content usage.

Cloudflare rolled out BotBase for Operators, giving bot operators a dashboard to manage their listings in Cloudflare's directory of bots and agents. The update adds submission status tracking, submission editing, and a behavior model for declaring how bots use site content. It is aimed at operators of crawlers and automated agents seeking placement in the directory.

Cloudflare Blog·Aug 28, 12:59 UTC · 18d agoAI tools & infra

Stop playing with the CISO role. Fix cybersecurity leadership

Op-ed argues the CISO role is overloaded and advocates elevating a business-first Chief Security Officer above it.

The author contends that business-alignment failures in cybersecurity are structural rather than communication problems, with CISOs expected to act simultaneously as technologists, strategists, risk executives, and board advisers. The piece proposes a distinct Chief Security Officer role focused on enterprise protection, business continuity, and cross-functional decision authority, with the CISO retaining technical cybersecurity responsibility and potentially reporting to the CSO. It argues this model would give executive ownership of business protection while preserving technical depth.

CSO Online·Sep 3, 09:00 UTC · 13d agoIndustry

Cybersecurity jobs available right now: September 8, 2026

Help Net Security's September 8 job roundup lists open cybersecurity roles at AudioCodes, Garmin, Scotiabank, GDIT, Subway and others across seven countries.

The listing includes a CISO role at AudioCodes in Israel, a Combat Systems Cyber Engineer at Johns Hopkins Applied Physics Laboratory, cloud security engineering at Garmin, and an IAM Architect at Scotiabank. Other openings span penetration testing for NATO exercises at Spektrum in Belgium, SOC analyst at Orro Group in Australia, threat hunting at GDIT, and security operations at Subway in the USA. Roles range from CISO and architect to SOC analyst and penetration tester.

Help Net Security·Sep 8, 00:00 UTC · 8d agoIndustry