In recent weeks, cybersecurity investigators have uncovered a novel campaign in which hackers leverage seemingly benign potentially unwanted program (PUP) advertisements to deliver stealthy Windows malware.

The lure typically begins with ads promoting free PDF tools or desktop assistants that redirect victims to spoofed download sites.

Once users click through, a scheduled task silently retrieves a JavaScript loader from a temporary directory and executes it via Microsoft HTML Application Host (MSHTA).

This sequence installs a decoy application—ManualFinder—designed to appear legitimate while establishing footholds in target environments.

The decoy’s innocuous functionality masks a far more insidious objective. When run, ManualFinder requests no user interaction beyond the initial installation, quietly opening ports and relaying commands to remote infrastructure.

Expel analysts identified that the JavaScript loader reaches out to domains such as mka3e8.com and 5b7crp.com, previously associated with residential proxy services, indicating a broader scheme to conscript infected machines into proxy networks.

While initial infections have been linked to OneStart Browser installs, researchers observed that AppSuite-PDF and PDFEditor installers follow identical patterns, each signed by dubious code-signing certificates from entities like “GLINT SOFTWARE SDN. BHD.”

Expel researchers identified that the malware campaign’s impact extends beyond proxying. In certain environments, PDFEditor installations prompt users to consent to residential proxy use in exchange for free editing capabilities, effectively monetizing unsuspecting endpoints.

Other instances show the decoy apps modifying browser profiles and harvesting stored cookies, suggesting secondary data-exfiltration objectives.

By the time defenders detect unusual MSHTA invocations or node.exe processes running hidden JavaScript, the adversary has often already established persistence and network outposts.

In total, investigators have cataloged over 70 unique JavaScript variants, all reaching out to the same malicious domains.

Code snippets embedded in scheduled-task definitions reveal how persistence is maintained:-

schtasks /Create /TN "ManualFinderTask" /TR "mshta.exe \"C:\Users\<user>\AppData\Local\Temp\<guid>.js\"" /SC DAILY /ST 03:00  

The loader then executes:-

cmd[.]exe /d /s /c "msiexec /qn /i \"C:\Users\<user>\AppData\Local\TEMP\ManualFinder-v2.0.196.msi\""  

Infection Mechanism

Delving deeper into the infection mechanism, the campaign exploits Windows scripting hosts and MSI installer features to achieve near-undetectable deployment.

The sequence begins when the scheduled task runs under the context of the SYSTEM-level svchost service, launching node.exe with a randomized JavaScript filename (e.g., 9b9797f4-274c-fbb9-81ae-3b4f33b7010a.js).

This script downloads the ManualFinder MSI from the attacker’s server and installs it with quiet flags (/qn /n) to suppress any user interface.

Because msiexec runs under cmd[.]exe with disabled autorun (/d) and custom quote handling (/s), traditional EDR alerts tied to user applications are often bypassed.

Once installed, the malware registers its own service and scheduled tasks to re-execute the JavaScript loader at regular intervals, ensuring re-infection even after removal attempts.

This illustrates the MSHTA invocation code that enables this stealthy execution.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post Hackers Using PUP Advertisements to Silently Drop Windows Malware appeared first on Cyber Security News.

In recent months, cybersecurity researchers have observed a surge in targeted campaigns by a sophisticated Chinese APT group leveraging commercial proxy and VPN services to mask their attack infrastructure.

The emergence of this tactic coincides with a broader shift toward commoditized anonymization platforms that blend threat actor traffic with legitimate user activity.

Initial compromise vectors have included spear-phishing emails containing malicious Office documents and waterhole attacks that redirect unsuspecting victims to payload-hosting domains.

Once a foothold is established, the threat actor deploys a lightweight Trojan proxy agent designed to imitate standard HTTPS traffic.

This agent uses the Trojan protocol to bypass network filtering and the Great Firewall of China, encapsulating command-and-control communications within seemingly innocuous TLS packets.

SPUR analysts noted the frequent use of a wildcard SSL certificate (*.appletls[.]com, SHA1: a26c0e8b1491eda727fd88b629ce886666387ef5) on non-standard ports within the 4000–4099 range, enabling rapid attribution of over 1,000 malicious IP addresses scattered across multiple global data centers.

The impact of these campaigns has been significant. High-value targets in South Korea and Taiwan reported persistent intrusions spanning weeks, during which exfiltration of proprietary documents and intellectual property occurred undetected.

SPUR researchers identified that victim networks lacked adequate TLS inspection, allowing the Trojan proxy’s traffic to slip past conventional intrusion detection systems.

Post-compromise lateral movement often leveraged Sysinternals PsExec and custom PowerShell scripts to automate credential harvesting and facilitate remote execution.

In one illustrative case, a finance company in Taipei experienced a stealthy breach that persisted for 45 days.

Adversaries systematically mapped the corporate network before initiating exfiltration via a chain of proxy hops through WgetCloud, a commercial VPN provider headquartered in Shenzhen.

By funneling stolen data through over a dozen VPN exit nodes, the attackers effectively obfuscated their origin and hampered forensic investigations.

Infection Mechanism: Trojan Proxy Deployment

The initial payload arrives as a Microsoft Word document exploiting CVE-2025-1234, a zero-day RCE vulnerability in the Equation Editor. Upon document open, a macro drops trojan.exe into %APPDATA%\Microsoft\Windows and registers a scheduled task named “WinDefenderUpdate” for persistence.

The executable is a statically linked Go binary embedding the Trojan protocol client library.

# Dropping Trojan proxy binary
$payload = [IO.File]::ReadAllBytes("$env:TEMP\macro.bin")
[IO.File]::WriteAllBytes("$env:APPDATA\Microsoft\Windows\trojan.exe", $payload)

# Registering persistence
schtasks /Create /SC MINUTE /MO 15 /TN "WinDefenderUpdate" /TR "`"$env:APPDATA\Microsoft\Windows\trojan.exe`" --config config.json"

Upon execution, trojan.exe reads config.json, which contains a Base64-encoded subscription URL from WgetCloud.

The proxy agent negotiates a TLS handshake using SNI “mf429xciejryees2cusm.appletls.com” and routes C2 traffic through the VPN provider’s exit nodes.

By embedding its communications within legitimate proxy VPN tunnels, the malware achieves robust detection evasion and complicates attribution efforts.

Continuous monitoring for anomalous scheduled tasks and unusual TLS certificates remains critical to uncovering these advanced intrusions.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post Chinese APT Hackers Using Proxy and VPN Service to Anonymize Infrastructure appeared first on Cyber Security News.

In recent months, security teams have observed the emergence of a highly versatile Android backdoor, Android.Backdoor.916.origin, masquerading as a legitimate antivirus application.

Distributed via private messaging services under the guise of “GuardCB,” its icon closely mimics the emblem of the Central Bank of the Russian Federation against a shield background.

Although the interface displays only Russian language prompts, this malware has been deployed in targeted campaigns against Russian business executives, extracting sensitive corporate communications and personal data.

Upon installation, the counterfeit antivirus simulates system scans, randomly “detecting” between one and three fictitious threats, with detection rates increasing the longer a device remains unscanned, though never exceeding 30 percent.

This deceptive behavior lulls victims into believing the application provides genuine protection.

Beneath this veneer, the backdoor silently requests a prolonged list of permissions—geolocation, audio recording, SMS and contacts access, camera control, background execution, device administrator rights, and Accessibility Service privileges.

Dr.Web researchers noted that once these permissions are granted, the malware initiates multiple persistent services that self-monitor every minute, reconnecting to its command-and-control (C2) infrastructure whenever necessary.

Through separate C2 ports, operators can harvest call logs, SMS traffic, contact lists, and geolocation data; stream microphone audio, camera video, or device screen captures; siphon stored images; and even execute arbitrary shell commands.

The trojan’s ability to toggle self-defense routines via the Accessibility Service enables it to thwart removal attempts by overlaying fake system interfaces or disabling uninstall options.

The sophistication of Android.Backdoor.916.origin is underscored by its dynamic configuration, which can incorporate up to fifteen different hosting providers, although only a subset is active in current campaigns.

Domain registrar notifications have prompted some takedowns, but the mule-like resilience of the C2 network continues to frustrate defenders.

Dr.Web antivirus for Android successfully detects and removes known variants, yet the tailored nature of these attacks underscores the necessity for heightened vigilance among executive circles.

Infection Mechanism and Persistence

Android.Backdoor.916.origin employs an infection mechanism tailored to social engineering and sideloading rather than exploitation of software vulnerabilities.

Victims receive a malicious APK file disguised as “GuardCB.apk” through encrypted messenger threads. Once executed, the app’s manifest registers background services and the Accessibility Service, as illustrated in the snippet below:-

<service android: name=".CoreService"
         android: permission="android.permission.BIND_ACCESSIBILITY_SERVICE">
    <intent-filter>
        <action android:name="android.accessibilityservice.AccessibilityService" />
    </intent-filter>
    <meta-data
        android:name="android.accessibilityservice"
        android: resource="@xml/accessibility_service_config" />
</service>

By abusing the Accessibility API, the malware gains keystroke logging and in-app data interception capabilities, ensuring enduring presence even after force-stop or device reboot sequences.

Continuous health checks and automatic service restarts guarantee that the backdoor remains active, silently harvesting data until manually removed.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post New Android Spyware Disguised as an Antivirus Attacking Business Executives appeared first on Cyber Security News.

In late June 2025, a significant operational dump from North Korea’s Kimsuky APT group surfaced on a dark-web forum, exposing virtual machine images, VPS infrastructure, customized malware and thousands of stolen credentials.

This leak offers an unprecedented window into the group’s espionage toolkit, revealing how Kimsuky conducts phishing campaigns, maintains persistence and evades detection within critical networks across South Korea, the U.S., Japan and Europe.

Within hours of its posting, Foresiet analysts identified a wealth of artifacts—including browser histories, rootkit modules and stale GPKI certificates—that promise years of insight into DPRK cyber operations.

Foresiet researchers noted that the first dataset originated from the operator’s personal Deepin Linux virtual machine, complete with HGFS integration that preserved the host’s C:\ drive contents.

A desktop screenshot captures the attacker’s environment, showing custom proxy and user-agent extensions loaded in Chrome and Brave browsers.

The same VM dump revealed nearly 20,000 browser history records, exposing email addresses used for spear-phishing and links to internal backdoor documentation, such as a Chinese-language user guide for a custom implant.

The second dataset derived from a public-facing VPS hosted on vps.bz, where detailed auth.log files and SSL certificates were recovered.

These logs traced live spear-phishing operations against South Korea’s Defense Counterintelligence Command (dcc.mil.kr), the Supreme Prosecutor’s Office (spo.go.kr) and other high-value targets.

Among the most concerning finds were thousands of stolen South Korean Government Public Key Infrastructure (GPKI) certificates and their cracking tool, written in Java, enabling Kimsuky to impersonate officials and sign fraudulent documents without detection.

Kimsuky’s implant suite includes the Tomcat Kernel Rootkit, a loadable Linux module that hooks network functions for stealthy reverse shells, and a personalized Cobalt Strike beacon.

The beacon, last updated in June 2024, is embedded with custom C2 profiles and partially integrated with the kernel rootkit.

It uses HTTP over port 8172, posting to /submit.php with a spoofed IE9 user-agent string.

This bespoke build demonstrates that Kimsuky is merging open-source frameworks with proprietary code to evade conventional detection.

Persistence Tactics

One of the most sophisticated persistence mechanisms uncovered is the Tomcat Kernel Rootkit.

After initial installation via a crafted installer script, the rootkit registers itself in the kernel’s module list and patches key functions in inet_sock_create and tcp_v4_connect to enable port knocking and SSL reverse shells.

A simplified excerpt from its init routine illustrates how it hooks the system call table:-

static int __init rootkit_init(void) {
    write_cr0(read_cr0() & (~0x10000));
    original_syscall = syscall_table[__NR_kill];
    syscall_table[__NR_kill] = (unsigned long)hooked_kill;
    write_cr0(read_cr0() | 0x10000);
    return 0;
}

This kernel-level implant allows the operator to remain undetected by user-space monitoring tools, forcing defenders to deploy specialized host-based detection rules.

By combining encrypted C2 traffic with port-knock authorization, the module ensures that only pre-authenticated connections can trigger the backdoor, effectively masking its presence within normal network flows.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post Kimsuky APT Data Leak – GPKI Certificates, Rootkits and Cobalt Strike Personal Uncovered appeared first on Cyber Security News.

A sophisticated Android malware campaign has resurfaced, exploiting deceptive websites that perfectly mimic legitimate Google Play Store application pages to distribute the notorious SpyNote Remote Access Trojan (RAT).

This malicious operation targets unsuspecting users by creating static HTML clones of popular Android application install pages, complete with copied CSS styling and JavaScript functionality designed to trick victims into downloading malicious APK files directly from compromised servers.

The SpyNote malware represents a formidable threat in the mobile security landscape, functioning as a highly intrusive Android RAT with extensive surveillance capabilities.

Once installed, the malware can remotely control device cameras and microphones, manage phone calls, execute arbitrary commands, and perform sophisticated keylogging operations that specifically target application credentials.

The main concern is that it uses Android’s Accessibility Services to steal two-factor codes and trick users with fake screens.

Domaintools researchers identified this persistent campaign as a continuation of previous SpyNote activity, noting significant tactical evolution in the threat actor’s approach.

The malicious infrastructure predominantly utilizes two IP addresses – 154.90.58[.]26 and 199.247.6[.]61 – with domains registered through NameSilo LLC and XinNet Technology Corporation.

The fake websites consistently include specific JavaScript libraries and employ nginx servers hosted on Lightnode Limited and Vultr Holdings LLC infrastructure.

Advanced Infection Mechanism and Payload Delivery

The infection process begins when users encounter convincing Google Play Store mimics that trigger malicious downloads through a carefully crafted JavaScript function.

The core malicious functionality relies on a download() function that creates hidden iframes and sets their source to JavaScript URIs, effectively initiating APK downloads without users leaving the current page.

The malware employs a sophisticated multi-stage deployment process utilizing dynamic payload techniques and DEX Element Injection.

The initial dropper APK (Chrome.apk with hash 48aa5f908fa612dcb38acf4005de72b9379f50c7e1bc43a4e64ce274bb7566) reads encrypted assets, generates decryption keys from its AndroidManifest file, and decrypts the second-stage SpyNote payload.

The dropper extracts the package name “rogcysibz.wbnyvkrn.sstjjs” to retrieve the 16-byte AES key “62646632363164386461323836333631” for payload decryption.

The malware demonstrates advanced anti-analysis capabilities through control flow obfuscation and identifier obfuscation, using random variations of characters like ‘o’, ‘O’, and ‘0’ for all function names.

This technique significantly complicates static analysis, while the dynamic loading mechanism ensures the primary malicious functions remain concealed until runtime execution, effectively bypassing traditional security detection methods.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post Beware of Website Mimicking Google Play Store Pages to Deliver Android Malware appeared first on Cyber Security News.