SharkStealer, a Golang-based information stealer, has been observed leveraging the Binance Smart Chain (BSC) Testnet as a covert dead-drop mechanism for command-and-control (C2) communications. By adopting an “EtherHiding” pattern, the malware retrieves encrypted C2 details from smart contracts through Ethereum RPC calls, decrypts the payload in memory, and initiates contact—all while blending in with legitimate […]
Cybercriminals are increasingly exploiting a legitimate Microsoft 365 feature designed for enterprise convenience, turning Exchange Online’s Direct Send into a dangerous vector for phishing campaigns and business email compromise attacks. Security researchers across the industry are sounding the alarm as malicious actors leverage this trusted pathway to bypass authentication checks and deliver convincing internal-looking messages […]
From Detection to Resolution: Why the Gap Persists
A critical vulnerability is identified in an exposed cloud asset. Within hours, five different tools alert you about it: your vulnerability scanner, XDR, CSPM, SIEM, and CMDB each surface the issue in their own way, with different severity levels, metadata, and context.
What’s missing is a system of action. How do you transition from the
Cybersecurity researchers have uncovered a new supply chain attack targeting the NuGet package manager with malicious typosquats of Nethereum, a popular Ethereum .NET integration platform, to steal victims’ cryptocurrency wallet keys.
The package, Netherеum.All, has been found to harbor functionality to decode a command-and-control (C2) endpoint and exfiltrate mnemonic phrases, private keys, and
In September 2025, Texas A&M University System (TAMUS) Cybersecurity, a managed detection and response provider, in collaboration with Elastic Security Labs, uncovered a sophisticated post-exploitation campaign by a Chinese-speaking threat actor. Using this method, the attackers installed a malicious IIS module named TOLLBOOTH, deployed a Godzilla-forked webshell framework, leveraged the GotoHTTP remote monitoring and management […]
Security flaws in Microsoft’s Azure ecosystem enable cybercriminals to create deceptive applications that imitate official services like the “Azure Portal.
Varonis found that Azure’s safeguards, designed to block reserved names for cross-tenant apps, could be bypassed using invisible Unicode characters.
By inserting characters like the Combining Grapheme Joiner (U+034F) between letters such as “Az͏u͏r͏e͏ ͏P͏o͏r͏t͏a͏l”, attackers created apps that appeared legitimate on consent screens.
This trick worked with over 260 such characters, including those in ranges like U+FE00 to U+FE0F. The ploy exploited the fact that many Microsoft apps lack verification badges, leading users to overlook warnings about third-party origins.
Azure applications, essentially software entities that integrate with Azure services, rely on user consent for permissions. Delegated permissions let apps act on a user’s behalf, accessing emails, files, and more, while application permissions grant standalone access.
When abused, these become potent attack vectors for initial access, persistence, and privilege escalation in Microsoft 365 environments.
Phishing Tactics Fuel The Threat
Varonis zeroed in on initial access methods, particularly illicit consent grants and device code phishing. In the former, phishing emails lure victims to fake file links that redirect to a consent page.
Once approved, attackers snag access tokens without needing passwords, granting them the victim’s resource privileges.
Device code phishing takes it further: Attackers generate a verification URI and code for a malicious app, tricking users into entering it on a legitimate-looking site. The attacker then polls for the token, hijacking the session.
These techniques thrive on deception. Consent pages for the spoofed apps displayed convincingly, especially when paired with Azure icons.
Forum discussions reveal users routinely dismissing “unverified” alerts, assuming they’re safe from Microsoft itself.
Prohibited names tested included staples like “Microsoft Teams,” “Power BI,” and “OneDrive SyncEngine,” underscoring the scope of potential impersonations.
Varonis disclosed the issues promptly; Microsoft fixed the initial Unicode bypass in April 2025 and a broader set in October 2025.
No customer action is required, as the updates safeguard tenants automatically. Still, experts urge organizations to monitor app consents rigorously, enforce least-privilege permissions, and educate users on phishing red flags.
This episode reinforces the need for layered defenses in cloud environments. As attackers evolve, so must vigilance lest a seemingly benign app consent unlock the door to chaos.
In a newly uncovered campaign, the threat group known as Bitter—also tracked as APT-Q-37—has leveraged both malicious Office macros and a previously undocumented WinRAR path traversal vulnerability to deliver a C# backdoor and siphon sensitive information. Researchers at Qi’anxin Threat Intelligence Center warn that this dual-pronged attack illustrates the group’s evolving tactics and their focus […]
Monolock ransomware has surfaced in underground forums, with threat actors advertising version 1.0 for sale alongside stolen corporate credentials.
First detected in late September, the malware exploits phishing emails containing malicious Word documents.
Upon opening, the embedded macro downloads the ransomware binary from a compromised server. Victims report file encryption using a mix of AES-256 for file payloads and RSA-2048 for key exchange, rendering data inaccessible without the private key.
Dark Web Informer analysts noted that Monolock’s initial deployments targeted small to mid-sized organizations in healthcare and manufacturing sectors.
The operators demand payment in cryptocurrency, instructing victims to access a Tor-hosted payment portal. This portal automatically verifies the transaction and supplies the decryption key.
Early samples reveal a ransom note that offers a 10 percent discount if paid within 48 hours.
In controlled environments, researchers identified that Monolock terminates processes associated with common backup and security software before encryption begins.
The advice didn’t change for decades: use complex passwords with uppercase, lowercase, numbers, and symbols. The idea is to make passwords harder for hackers to crack via brute force methods. But more recent guidance shows our focus should be on password length, rather than complexity. Length is the more important security factor, and passphrases are the simplest way to get your users to create
Government, financial, and industrial organizations located in Asia, Africa, and Latin America are the target of a new campaign dubbed PassiveNeuron, according to findings from Kaspersky.
The cyber espionage activity was first flagged by the Russian cybersecurity vendor in November 2024, when it disclosed a set of attacks aimed at government entities in Latin America and East Asia in June, using
Alleged Sale of Monolock Ransomware V1.0