A new wave of Formbook malware attacks has appeared, using weaponized ZIP archives and multiple script layers to bypass security controls.

The attacks begin with phishing emails containing ZIP files that hold VBS scripts disguised as payment confirmation documents.

These scripts trigger a chain of events that downloads and installs the malware on victim systems. The multi-stage approach makes detection harder for both security tools and analysts.

The attack starts when victims receive emails with attached ZIP archives. Inside these archives sits a VBS file with names like “Payment_confirmation_copy_30K__20251211093749.vbs” that looks like a business document.

When opened, this VBS script starts a carefully planned infection process. The malware uses multiple scripting languages, including VBS, PowerShell, and eventually executable files, to reach its final goal of installing Formbook on the target machine.

Internet Storm Center security researchers identified this campaign and found that only 17 out of 65 antivirus programs detected the initial VBS file.

The low detection rate shows how effective the obfuscation techniques are. The malware writers designed each stage to avoid common security checks and make analysis more difficult for security teams.

Multi-Stage Infection Mechanism

The VBS script uses several tricks to hide its true purpose. First, it creates a delay loop that waits 9 seconds before doing anything harmful.

This simple trick helps avoid detection by sandbox systems that look for immediate suspicious actions:-

Dim Hump
Hump = DateAdd("s", 9, Now())
Do Until (Now() > Hump)
    Wscript.Sleep 100
    Frozen = Frozen + 1
Loop

The script then builds a PowerShell command by joining many small text pieces together. The word “PowerShell” itself is hidden using number codes instead of plain text. After creating the PowerShell script, the VBS file runs it using a Shell.Application object.

This PowerShell script downloads another payload from Google Drive and saves it to the user’s AppData folder. The final step launches msiexec.exe and injects the Formbook malware into it.

The malware then connects to its command server at 216.250.252.227 on port 7719 to receive instructions.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Formbook Malware Delivered Using Weaponized Zip Files and Multiple Scripts appeared first on Cyber Security News.

Phishing attacks continue to be one of the most persistent threats targeting organizations worldwide.

Cybercriminals are constantly improving their methods to steal sensitive information, and a recently discovered phishing kit demonstrates just how advanced these operations have become.

This particular framework was designed to impersonate the Italian IT and web services provider Aruba S.p.A., a company that serves over 5.4 million customers across Italy’s digital infrastructure.

By targeting such a widely trusted service provider, attackers could gain access to critical business assets, including hosted websites, domain controls, and email systems.

The phishing campaign begins with spear-phishing emails that create urgency by warning victims about expiring services or failed payments.

These messages contain links to fake login pages that closely mimic the official Aruba.it webmail portal.

What makes this attack particularly clever is the use of pre-filled login URLs that automatically populate the victim’s email address in the login form.

This small detail adds a layer of authenticity that makes targets less suspicious and more likely to enter their passwords.

Group-IB security researchers identified this sophisticated phishing framework through their ongoing monitoring of underground criminal ecosystems.

The kit represents more than just a fake webpage. It functions as a complete, automated platform built for efficiency and stealth, employing multiple techniques to evade detection and maximize credential theft.

Unlike basic phishing attempts, this system uses CAPTCHA filtering to block security scanners and Telegram bots to send stolen data to attackers instantly.

Multi-Stage Credential Harvesting Process

The attack unfolds through four carefully designed stages that systematically extract credentials and financial information.

First, victims encounter a CAPTCHA challenge that serves as an anti-bot filter, ensuring only human targets proceed to the actual phishing pages.

After passing this check, victims land on a convincing replica of the Aruba login page, where they enter their username and password, which are sent to the attacker immediately.

The process continues with a fake payment page requesting credit card details for a small fee, typically around €4.37, presented as a service renewal charge.

Once card information is submitted, victims are presented with a fraudulent 3D Secure verification page that captures the one-time password sent by their bank.

This final piece of information gives attackers everything needed to authorize real-time fraudulent transactions.

Throughout this process, all stolen data is exfiltrated to Telegram chats that serve as exfiltration channels, providing attackers with instant notifications.

After completing the stages, victims are redirected to the legitimate Aruba website, remaining unaware that their information was compromised.

This operation highlights the growing trend of phishing-as-a-service, where pre-built kits dramatically lower technical barriers and enable widespread credential theft at an industrial scale.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post A Multi-Stage Phishing Kit Using Telegram to Harvest Credentials and Bypass Automated Detection appeared first on Cyber Security News.

A new advisory from the Cybersecurity and Infrastructure Security Agency reveals that Akira ransomware has become one of the most active threats targeting businesses worldwide.

Since March 2023, this ransomware group has impacted more than 250 organizations across North America, Europe, and Australia, amassing approximately $244.17 million in ransom proceeds as of late September 2025.

The threat actors behind Akira have connections to the defunct Conti ransomware group. Akira ransomware primarily targets small and medium-sized businesses across multiple sectors.

The group shows a strong preference for manufacturing, educational institutions, information technology, healthcare, and financial services sectors.

The threat actors gain initial access through virtual private network services without multi-factor authentication configured, exploiting known vulnerabilities in Cisco products.

CISA security analysts identified that Akira threat actors have continuously evolved their attack methods throughout 2024 and 2025.

The ransomware initially appeared as a Windows-specific C++ variant that encrypted files with the .akira extension.

By April 2023, the group deployed a Linux variant targeting VMware ESXi virtual machines. In August 2023, they introduced the Megazord encryptor, a Rust-based tool that appends a .powerranges extension to encrypted files.

In June 2025, Akira threat actors successfully encrypted Nutanix AHV virtual machine disk files by exploiting CVE-2024-40766, a SonicWall vulnerability.

The ransomware employs a sophisticated hybrid encryption scheme that combines a ChaCha20 stream cipher with an RSA public-key cryptosystem for fast, secure key exchange.

Double Extortion and Persistence Tactics

Akira operates using a double-extortion model that combines data encryption with threats to leak sensitive information.

After gaining initial access, the threat actors establish persistence by creating new domain accounts and using credential-scraping tools such as Mimikatz and LaZagne to harvest passwords.

They leverage legitimate remote access tools such as AnyDesk and LogMeIn to maintain access while blending in with regular administrator activity.

For data exfiltration, the group uses tools such as FileZilla, WinSCP, and RClone to transfer stolen data to cloud storage services before encrypting it.

To inhibit system recovery, the Akira encryptor uses PowerShell commands to delete Volume Shadow Copy Service copies on Windows systems.

The ransom note appears as fn.txt or akira_readme.txt and provides victims with instructions to contact the threat actors through a .onion URL accessible via the Tor network, with payments demanded in Bitcoin.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Akira Ransomware Targets Over 250 Organizations, Extracts $42 Million in Ransom Payments – New CISA Report appeared first on Cyber Security News.

Lumma Stealer has emerged as a serious threat in the cybercrime world, targeting users through fake software updates and cracked applications.

This information-stealing malware targets the collection on login details, payment card information, and cryptocurrency wallet data from infected systems.

The malware spreads primarily through phishing emails, malicious advertisements, and compromised websites that trick users into downloading what appears to be legitimate software.

What makes Lumma Stealer particularly dangerous is its ability to steal data from multiple web browsers, including Chrome, Firefox, Edge, and Brave.

The malware targets saved passwords, autofill information, browsing history, and cookies that contain session tokens.

Once it gains access to a system, it quickly scans for cryptocurrency wallet extensions and email clients to maximize the value of stolen information.

Trend Micro security researchers identified that the malware uses browser fingerprinting to collect detailed device information and establish covert communication channels with its command-and-control servers.

The collected data is packaged and sent to remote servers controlled by attackers, who then sell this information on dark web markets or use it directly for financial fraud.

Victims often remain unaware of the infection until they notice unauthorized transactions or account compromises.

The malware operates silently in the background, making detection challenging for average users who lack advanced security tools.

Organizations and individuals face significant risks from Lumma Stealer infections, including identity theft, financial losses, and compromised business accounts.

The malware continues to evolve with new variants appearing regularly, making it a persistent threat in the current security environment.

Browser Fingerprinting Technique

Lumma Stealer employs browser fingerprinting as both a data collection method and a communication security measure.

The malware gathers specific browser attributes such as screen resolution, installed fonts, time zone settings, and language preferences to create a unique device profile.

This fingerprint helps attackers track infected machines and ensures that communication with command-and-control servers appears as regular web traffic.

The fingerprinting process also allows Lumma Stealer to identify the most valuable targets by analyzing installed browser extensions and stored credentials.

The malware checks for security software and virtual machine indicators to avoid detection in analysis environments, increasing its survival rate on real user systems.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Lumma Stealer Uses Browser Fingerprinting to Collect Data and for Stealthy C&C Server Communications appeared first on Cyber Security News.

Cybercriminals have launched a new phishing campaign that tricks users by impersonating legitimate spam-filter notifications from their own company.

These fake emails claim that your organization recently upgraded its Secure Message system and that some pending messages failed to reach your inbox.

The message urges you to click the “Move to Inbox” button to retrieve the supposedly held emails. What appears to be a helpful system notification is actually a dangerous trap designed to steal your email login details.

The phishing email looks surprisingly convincing, displaying generic message titles and delivery reports that seem routine and harmless.

It even includes an unsubscribe link to make it appear more legitimate. However, both the main button and the unsubscribe link redirect victims through a compromised cbssports[.]com redirect before landing on the actual phishing site hosted on mdbgo[.]io.

The attackers encode your email address as a base64 string in the URL, allowing the fake login page to display your domain automatically, making the scam look even more personalized and trustworthy.

Following initial warnings from Unit42 researchers about this campaign, Malwarebytes security analysts identified that the attack has become more advanced and continues to change rapidly.

The fake login page is not just a simple credential harvester but uses heavily obfuscated code to hide its true purpose.

Websocket-Based Credential Harvesting

The technical setup behind this phishing attack sets it apart from traditional methods. Instead of simply collecting your username and password after you click submit, this campaign uses websocket technology to steal your information instantly.

A websocket creates a continuous connection between your browser and the attacker’s server, similar to keeping a phone line open without hanging up.

This allows data to flow in both directions immediately, without refreshing the page.

When you type your email and password into the fake login form, attackers receive your credentials in real time as you enter each character.

This gives them the ability to access your email account, cloud storage, and other connected services within seconds.

The websocket connection also lets attackers send you additional prompts asking for two-factor authentication codes, making it possible to bypass even accounts protected with extra security layers.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Beware of Phishing Emails as Spam Filter Alerts Steal Your Email Logins in a Blink appeared first on Cyber Security News.