42
30
30
42
57
30
30
57
57
45
35
57
45
30
35
57
30
30
30
60
30
57
60
57
30
60
57
57
35
30
35
The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions
Elastic details KREMLIN, a Brazilian banking malware whose malicious Chrome/Edge extension forges Chromium integrity checks to steal sessions.
Elastic Security Labs tracked operation REF9334 and its KREMLIN toolkit, a Brazilian banking malware campaign impersonating twelve banks across seven campaigns since May 2025. The infection chain uses multi-stage obfuscated JavaScript loaders with sandbox checks (file and process counting), scheduled-task persistence, and an Ethereum smart contract acting as a dead-drop resolver for C2 and payload URLs, abusing Archive.org for hosting. The malicious browser extension bypasses Chromium integrity mechanisms by manipulating Secure Preferences and regenerating required HMACs and App-Bound encrypted hashes. Threat Command disrupted over 1,500 infections by registering the kill-switch canary domain.
58
Security Affairs newsletter Round 594 by Pierluigi Paganini – INTERNATIONAL EDITION
Weekly Security Affairs newsletter aggregates top stories including Cisco FMC exploitation, Qilin ransomware, Chrome zero-days, and Berlin leak.
Pierluigi Paganini's Security Affairs newsletter Round 594 (International Edition) rounds up the week's security headlines. Topics include attackers exploiting a critical Cisco FMC flaw to deploy Qilin ransomware, SonicWall mass exploitation linked to a UK council attack, multiple CISA KEV additions, Chrome zero-days used by four nation-state actors, a $320 million Liquid Network theft, and a Berlin ransomware data leak. It also covers AI security items such as agent sandbox failures and distillation campaigns by Chinese AI firms.
8
GuardBreaker: Derailing AI-assisted malware analysis with a code comment
ESET names 'GuardBreaker': UAC-0099 embeds a nuclear-weapon question in VBScript comments to trip LLM scanner guardrails during analysis of its MATCHBOIL loader.
ESET researchers observed the Russia-aligned group UAC-0099 inserting a decoy prompt injection into a VBScript used to install its MATCHBOIL loader in an attack against a Ukrainian target, aiming to make LLM-based code scanners refuse and stop inspecting the file. The comment triggers safety guardrails with a request about building a nuclear weapons but has no runtime effect. Similar LLM-thwarting tricks have appeared in malicious PyPI and npm packages reported by Socket and StepSecurity. ESET recommends multi-model cross-validation of AI-assisted analysis and treating missing LLM output as requiring further checks.
65
Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure
Unit 42 exposes CL-CRI-1171, a pay-per-install network spreading malware like Insomnia RAT via YouTube channels and SEO poisoning for over two years.
Palo Alto Networks Unit 42 details CL-CRI-1171, a cybercrime cluster operating a pay-per-install (PPI) marketplace that has delivered multiple malware families for at least two years. The group used at least eleven YouTube gaming channels with hundreds of thousands of followers, plus SEO poisoning promoting trojanized software such as a Bluetooth driver and WinDirStat, infecting gamers and corporate endpoints including critical infrastructure and government entities. A single shared loader delivered payloads including Insomnia RAT, ARKTunnel, Docro Hijacker, GCleaner and Socks5Systemz between July 2025 and April 2026, with more than 10,000 distinct loader samples and over 200 rotating C2 domains identified. YouTube terminated the malicious channels after Unit 42 notified the platform.
47
ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager
Cisco Talos details ClearFake WebDAV chains delivering Amatera stealer to a Ukrainian government organization, with cryptocurrency and credential theft payloads.
Cisco Talos investigated DLL executions named 'verification.google' via WebDAV UNC paths at a Ukrainian government organization, tracking the actor as UAT-10820 and assessing with moderate confidence the activity is Russian and opportunistic rather than targeted. The infection chain uses ClearFake JavaScript injected via a Cloudflare Worker, EtherHiding storage on BNB Smart Chain contracts, and a ClickFix fake Google CAPTCHA prompt to deliver Amatera stealer. Secondary payloads differ by C2: one loader deploys ZigCryptoStealer with a Go reverse TCP proxy and a vulnerable driver that kills EDR, while the other installs an unauthorized NetSupport Manager with a Russia-based C2. Similar Amatera chains were separately documented by Malwarebytes and Blackpoint Cyber, but with no shared infrastructure.
55
7th September – Threat Intelligence Report
Check Point weekly bulletin: exploited SonicWall SMA 1000 zero-days (CVE-2026-83548/49), JFrog Artifactory auth bypass, and a 2.8M-patient Baylor Genetics breach.
Check Point's weekly bulletin covers breaches including Thomson Reuters' C-Track platform (court records across 11 US states and Canada), Baylor Genetics (2.8M patients and employees, SSNs included), Hit casinos in Slovenia, and Dropbox (~5,000 accounts via abused Lenovo email verification). SonicWall patched two exploited SMA 1000 zero-days, including CVE-2026-83548, a CVSS 10.0 pre-authentication SSRF, while JFrog fixed exploited authentication bypass CVE-2026-82329 (CVSS 9.8). Malware and actor coverage includes Gambling Goblin, JSCeal, Mirage Kitten's NodeRabbit/PollCat campaign, and DPRK Contagious Interview macOS activity, plus a FalconFlank privilege-escalation PoC against CrowdStrike Falcon.
70
JSCeal Malware Can Bypass Google Authentication Using Stolen Session Cookies
Check Point details JSCeal, a V8-compiled JavaScript stealer that replays stolen cookies to bypass Google authentication, spread via crypto malvertising.
Check Point Research's new report analyzes JSCeal, a compiled V8 JavaScript malware obfuscated with javascript-obfuscator using RC4-protected strings, control-flow flattening, and proxy functions. Delivered through fake TradingView installers on malvertising sites overlapping the WEEVILPROXY/MeadowLocust and SourTrade campaigns, it harvests cookies, passwords and OAuth tokens from Chromium browsers, records keystrokes and screenshots, and can replay stolen Google session cookies to bypass authentication. It also installs a local proxy with service-specific handlers for Binance, Bybit, and Ledger to intercept and modify cryptocurrency-related traffic.
45
30
30