Hackers are turning to Evilginx, a powerful adversary-in-the-middle tool, to get around multi-factor authentication and take over cloud accounts.

The framework acts as a reverse proxy between the victim and real single sign-on pages, so the login screen looks and behaves just like the real thing.

To the user, the fake site feels normal, with valid TLS and familiar branding. Attackers start with targeted phishing emails that push victims to carefully crafted fake SSO portals.

These pages copy the layout, scripts, and flows of common identity platforms, including enterprise SSO gateways. Once the user enters credentials and completes MFA, Evilginx quietly captures session cookies and tokens while still passing traffic to the real provider.

This shows the staged relay from the victim to the identity provider. Infoblox security analysts identified recent campaigns where Evilginx was used to mimic legitimate corporate SSO sites and steal tokens for email and collaboration platforms.

They noted that the stolen cookies allow attackers to replay sessions without ever needing passwords or MFA codes again. This shifts the risk from classic credential theft to full session hijack.

The impact is serious for both companies and users. With an active session token, attackers can read mail, reset passwords on linked apps, deploy new MFA methods, and plant backdoor access.

Attack analysis

This can lead to business email compromise, data theft, and long-term stealth access that is hard to trace back to the first phishing click. In contrast, the attack flow shows how stolen cookies unlock downstream services.

One key focus in the complete technical breakdown is how Evilginx evades detection during this process.

The framework forwards all content from the real SSO site, including scripts, styles, and dynamic prompts, which makes traditional visual checks almost useless.

It also uses real certificates on lookalike domains, so browser padlocks still appear green and reassuring.

Under the hood, Evilginx proxies and rewrites headers to keep the session alive while stripping out sensitive cookies for theft.

A simple, high-level phishlet can look like:-

server_name login.example.com;
proxy_pass https://login.real-sso.com;
proxy_set_header Host login.real-sso.com;

By logging cookies at the proxy layer, attackers grab session data before it is protected by the user’s device or corporate tools.

This shows how headers and cookies flow through the proxy, highlighting the points where tokens are intercepted.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Hackers Leverage Evilginx to Undermine MFA Security Mimicking Legitimate SSO Sites appeared first on Cyber Security News.

Cybercriminals targeting Brazilian users have aggressively escalated their tactics, launching a highly sophisticated campaign dubbed “Water Saci.”

This new wave of attacks weaponizes WhatsApp Web, a platform implicitly trusted by millions, to deliver banking trojans and steal sensitive financial data.

By compromising user accounts, the attackers send convincing messages to trusted contacts, creating a rapid, self-propagating infection loop that leverages social engineering to bypass traditional security defenses effectively, impacting countless unsuspecting individuals.

The infection chain typically begins when users receive messages containing malicious attachments, such as ZIP archives, PDF lures disguised as Adobe updates, or direct HTA files following specific naming patterns like A-{random}.hta.

Once a victim opens these files, they execute a complex multi-stage attack sequence involving Visual Basic scripts and MSI installers.

This process stealthily downloads a banking trojan while simultaneously deploying automation scripts designed to hijack the victim’s WhatsApp session for further propagation, ensuring maximum reach.

Trend Micro security analysts identified that this campaign marks a significant shift in malware development, utilizing artificial intelligence to accelerate its capabilities.

The attackers appear to have used Large Language Models (LLMs) to translate and optimize their propagation code, transitioning from PowerShell to a more robust Python-based infrastructure.

Strategic shift

This strategic shift significantly enhances their ability to spread malware across different browsers, including Chrome, Edge, and Firefox, making detection increasingly difficult for standard security protocols and leaving users vulnerable.

A critical component of this technical evolution is the whatsz.py script, which replaces earlier PowerShell variants.

Analysis reveals compelling evidence of AI-assisted coding, such as script headers explicitly stating “Versao Python Convertido de PowerShell”, and comments like “version optimized with errors handling.”

This script relies on component files like chromedriver.exe to automate the infection process, using Selenium to inject the WA-JS library, extract contact lists, and send malicious files in bulk to unsuspecting victims.

The Python code exhibits a sophisticated object-oriented structure with advanced error handling, features typically absent in quick manual ports.

For instance, the main automation class defines clear formatting for various statuses, ensuring reliable execution.

Additionally, the console output includes colorful emojis, a trait rarely seen in standard malware but common in AI-generated codebases.

This advanced automation allows the malware to operate autonomously, pausing and resuming tasks to blend in with normal network traffic while reporting progress to a command-and-control server, ultimately ensuring persistent access.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Water Saci Hackers Leveraging AI Tools to Attack WhatsApp Web Users appeared first on Cyber Security News.

The Android TV community faces a significant security crisis as SmartTube, a popular third-party YouTube client, has been compromised due to exposed signing keys.

Security researchers have identified malicious code embedded within official releases, prompting Google to forcibly disable the application on affected devices.

The incident, which came to light through extensive community analysis, demonstrates how compromised developer credentials can lead to widespread distribution of malware through legitimate channels.

Users first noticed the issue when Google Play Protect flagged SmartTube as dangerous and automatically disabled it on Android TV devices.

System notifications warned that “Your device is at risk,” moving the app to a disabled section where reactivation became impossible.

Security analyst/researcher, Yuriy L (@yuliskov) noted or identified that his digital signature had been exposed, allowing attackers to inject malicious libraries into official builds distributed through GitHub releases and in-app updates.

The developer responded by revoking the compromised signature and announcing plans to migrate to a new signing key, though the damage had already spread across multiple versions.

Forensic analysis of infected APKs revealed a sophisticated implant hidden within native libraries.

The malicious component, identified as libalphasdk.so or libnativesdk.so, loads automatically when the application starts through a broadcast receiver called io.nn.alpha.boot.BootReceiver.

This triggers JNI exports including startSdk1, stopSdk1, getBandwidthDelta1, and getIsRegistered1, which initialize a background surveillance mechanism.

The library collects extensive device fingerprinting data including manufacturer, model, Android SDK version, network operator, connection type, local IP address, and unique identifiers stored in shared preferences under the alphads db namespace.

This information is transmitted using a custom networking stack that leverages Google infrastructure to mask its command-and-control communications.

Infection Mechanism and Persistence Tactics

The malware establishes persistence through multiple layers of deception designed to evade detection. When SmartTube launches, the malicious native library initializes without user interaction, registering timers that execute every second for registration polling and every 60 seconds for bandwidth monitoring.

The library enforces bandwidth limits downloaded from remote configuration, suggesting server-side control over infected devices.

Analysis shows hardcoded references to drive.google.com, www.google.com, and dns.google, indicating the use of Google Drive and DNS-over-HTTPS as covert channels for command-and-control operations.

Configuration files named neunative.txt and sdkdata.txt are fetched from these trusted domains, allowing the malware to blend legitimate Google traffic with malicious activity.

The persistence mechanism remains active as long as the main application runs, with no visible indicators to the user.

Detection proves challenging because the malicious .so files appear alongside legitimate libraries like libcronet.98.0.4758.101.so, libglide-webp.so, and libj2v8.so in the lib folder.

Users can check for infection by examining APK contents for unexpected native libraries, with infected versions including 30.43 through 30.55 while clean versions stop at 30.19.

The developer confirmed his entire development environment required wiping, suggesting the compromise extended beyond simple key theft to potential supply chain infiltration.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post SmartTube YouTube App for Android TV Compromised Following Exposure of Signing Keys appeared first on Cyber Security News.