30
30
30
30
30
30
30
30
45
30
30
India’s STPI serves TerminalFix-style attack via fake Cloudflare check
India's STPI government website serves a spoofed Cloudflare verification page that preloads malicious commands into visitors' clipboards for execution in Windows Terminal, matching TerminalFix-style attacks.
A malicious external JavaScript on the ananta.stpi[.]in subdomain of India's Software Technology Parks of India displays a fake Cloudflare 'Verify you are human' prompt and silently writes a URL into the visitor's clipboard, instructing the user to paste and execute it in Windows Terminal. Researcher Vibhum Dubey reported the behavior to STPI and CERT-In; the script loads from the recently registered cdn[.]quickdelivr[.]com and assigns each visitor a unique session identifier. The malicious script remained embedded after the overlay briefly disappeared, and the destination URL was flagged as malicious by 17 VirusTotal engines. No attribution has been established, though the pattern matches Microsoft's TerminalFix, a variant of ClickFix.
48
30
30
30
30
30
45
30
A Cautionary Tale About Data Breach Claims, Verification and Carhartt
Troy Hunt cautions that claimed Carhartt breach data requires verification, warning that criminals' breach claims are not always accurate.
Troy Hunt published a cautionary tale about data breach claims, verification, and apparel brand Carhartt. He argues that claimed breaches from cybercriminals should not be taken at face value and may stem from errors by the criminals themselves. The piece underscores the need to verify breach data before treating it as authentic, in the vein of Have I Been Pwned's validation practices.
30
30
30
45
30
30
30
ApateWeb: An Evasive Large-Scale Scareware and PUP Delivery Campaign
Unit 42 uncovers ApateWeb, a campaign using over 130,000 domains and multilayered redirects to deliver scareware, adware and PUPs to millions of users.
Unit 42 discovered ApateWeb, a large-scale campaign using a network of more than 130,000 domains to deliver scareware, potentially unwanted programs, adware including a rogue browser and browser extensions, and scam pages. The campaign uses a three-layer structure with deceptive emails as the entry point, centralized victim tracking via UUIDs, intermediate adware or anti-bot redirections, and evasion tactics such as cloaking, bot detection error pages, and wildcard DNS abuse. Activity spiked since August 2022, with several hundred attacker-controlled sites remaining in Tranco's top 1 million rankings and millions of monthly hits; Unit 42 blocked an estimated 3.5 million sessions across 74,711 devices in November 2023.
55
30
30
30
30
30
30
30
30
30
30
30
30
30