ADMIN.FOUNDATION

  • From HealthKick to GOVERSHELL: The Evolution of UTA0388’s Espionage Malware

    ·

    A China-aligned threat actor codenamed UTA0388 has been attributed to a series of spear-phishing campaigns targeting North America, Asia, and Europe that are designed to deliver a Go-based implant known as GOVERSHELL. “The initially observed campaigns were tailored to the targets, and the messages purported to be sent by senior researchers and analysts from legitimate-sounding, completely

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Data-Leak Sites Hit an All-Time High With New Scattered Spider RaaS and LockBit 5.0

    ·

    , ,

    The ransomware landscape witnessed unprecedented upheaval in Q3 2025 as cyberthreat actors ushered in a new era of aggression and sophistication.

    The quarter marked a pivotal moment with the emergence of Scattered Spider’s inaugural ransomware-as-a-service offering, ShinySp1d3r RaaS, representing the first major English-led ransomware operation to challenge traditional Russian-speaking dominance in the ecosystem.

    Simultaneously, the notorious LockBit collective announced its resurrection with LockBit 5.0, declaring critical infrastructure as legitimate targets in a brazen departure from conventional operational boundaries.

    LockBit announces return and critical infrastructure targeting (Source – Reliaquest)

    The cybersecurity community confronted a staggering surge in active data-leak sites, reaching an all-time high of 81 distinct platforms in Q3 2025, surpassing previous records and fragmenting the threat landscape into unpredictable attack patterns.

    This proliferation reflects a fundamental shift as smaller, emerging groups filled the operational void left by previously dominant ransomware operations, expanding their reach into sectors and regions historically considered low-risk targets.

    ReliaQuest analysts identified this quarter as a watershed moment that reshaped ransomware operations fundamentally.

    The convergence of English-speaking cybercriminals entering the RaaS market, combined with LockBit’s aggressive stance toward critical infrastructure, signals an escalation that positions organizations across all industries at heightened risk.

    The formation of strategic alliances between major ransomware groups, including LockBit, DragonForce, and Qilin, further amplifies the threat potential through shared resources, techniques, and infrastructure.

    The geographic expansion of ransomware activities demonstrated this fragmentation vividly, with Thailand experiencing a 69% surge in data-leak site appearances, driven primarily by the newly emerged Devman2 group.

    This expansion into developing digital economies highlights how cybercriminals exploit security gaps in rapidly modernizing infrastructure, moving beyond traditional Western targets to capitalize on regions with limited cybersecurity measures and enforcement capabilities.

    The ShinySp1d3r RaaS: Technical Architecture and Social Engineering Integration

    Scattered Spider’s development of ShinySp1d3r RaaS represents a sophisticated fusion of the group’s renowned social engineering capabilities with advanced encryption mechanisms.

    The service architecture combines traditional ransomware deployment with enhanced data exfiltration protocols, creating a dual-threat model that maximizes victim pressure through both operational disruption and information leverage.

    The technical implementation leverages Scattered Spider’s established attack vectors, particularly their exploitation of weak help-desk verification processes for password and multi-factor authentication resets.

    The group’s methodology involves comprehensive reconnaissance phases where attackers gather detailed organizational intelligence through open-source intelligence gathering and social media profiling before initiating contact with target help-desk personnel.

    ReliaQuest researchers noted that ShinySp1d3r RaaS incorporates advanced persistence mechanisms that maintain network access even after initial remediation attempts.

    The malware establishes multiple communication channels with command and control infrastructure, utilizing encrypted tunneling protocols to evade detection by conventional network monitoring solutions.

    The encryption algorithm employs a hybrid approach, combining symmetric key encryption for file processing speed with asymmetric cryptography for secure key management.

    The ransom note structure, as revealed in Telegram communications, demonstrates professional presentation designed to maximize psychological pressure while providing clear payment instructions.

    The note includes unique victim identifiers, specific bitcoin wallet addresses generated per victim, and escalating payment schedules that increase financial pressure over time.

    Technical analysis indicates the malware performs selective encryption, targeting critical file extensions while preserving system functionality necessary for ransom payment processing.

    Scattered Spider hints at RaaS development on Telegram (Source – Reliaquest)

    The service’s differentiation lies in its integration with existing breach-and-leak operations, particularly through collaboration with ShinyHunters, enabling comprehensive data theft before encryption deployment.

    This approach allows operators to maintain leverage even if victims recover encrypted data through backups, as the threat of data exposure remains viable for extended extortion campaigns.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post Data-Leak Sites Hit an All-Time High With New Scattered Spider RaaS and LockBit 5.0 appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Chaos Emerges as Faster, Smarter, and More Dangerous Ransomware

    ·

    , ,

    In recent weeks, security teams worldwide have grappled with a new ransomware strain that has shattered expectations for speed and sophistication.

    First detected in late September 2025, this variant encrypts critical data within seconds of execution, leaving little time for intervention.

    Organizations across manufacturing, healthcare, and finance sectors have reported system-wide outages as attackers deploy large-scale campaigns that weaponize remote desktop protocol (RDP) exploits and phishing-laden spear-phishing emails.

    Initial forensic analysis indicates the malware propagates via a custom loader that leverages unsecured RDP sessions and hides within packed DLL modules, enabling rapid lateral movement across networks.

    As the ransomware spread, forensic investigators noted unusual callbacks to command-and-control servers hosted on bullet-proof infrastructures.

    These C2 domains appear to utilize fast-flux DNS rotation, complicating takedown efforts. Encrypted communications use ChaCha20 streams tethered to unique session tokens, ensuring each attack instance remains isolated.

    Victims report payload sizes under 100 KB—remarkably small for contemporary ransomware—suggesting extreme code optimization.

    Early incident response teams struggled to decrypt locked volumes before data destruction routines triggered, wiping backup snapshots and volume shadow copies across Windows hosts.

    Fortinet researchers identified this strain after observing a cluster of high-severity alerts triggered by anomalous DLL loads and abnormal file renaming patterns on customer networks.

    Investigators from Fortinet’s FortiGuard Labs found the malware’s polymorphic engine reintroduces minor code alterations upon each compilation, thwarting signature-based detection in antivirus products.

    Dynamic analysis revealed that the encryption routine forks a child process that drops a loader stub into memory, then patches in-shell encryption code to prioritize speed over obfuscation.

    Within hours of discovery, threat intelligence teams confirmed the emergence of new ransom notes demanding payouts in Monero, with amounts tailored per victim based on automated asset valuations.

    Chaos-C++ ransom note (Source – Fortinet)

    Cryptographic keys are generated using a hybrid RSA-EC scheme, blending 3072-bit RSA for key exchange with elliptic-curve ChaCha20 for file encryption.

    The result is rapid file locking coupled with near-unbreakable key exchange.

    Infection Mechanism: In-Memory Execution and Loader Hand-Off

    A deeper look at this strain’s infection mechanism reveals a two-stage in-memory execution chain designed for stealth and speed.

    The initial dropper masquerades as a legitimate MSI installer and uses Windows Management Instrumentation (WMI) to invoke the secondary payload directly in kernel memory.

    Upon execution, the following code snippet illustrates how the loader allocates memory, writes the decryption stub, and transfers execution:-

    LPVOID exec_mem = VirtualAlloc(NULL, shellcodeSize, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
RtlCopyMemory(exec_mem, encryptedShellcode, shellcodeSize);
DWORD oldProtect;
VirtualProtect(exec_mem, shellcodeSize, PAGE_EXECUTE_READ, &oldProtect);
((void(*)())exec_mem)();

    This technique bypasses disk writes entirely, leaving minimal artifacts on the host filesystem. Once the loader is active, it resolves API addresses at runtime rather than relying on imports, further evading static analysis.

    After decrypting its main module, the ransomware immediately scans local drives and network shares for files matching predefined extensions, spawning parallel threads to maximize multicore encryption throughput.

    By orchestrating these operations fully in memory, the malware undermines traditional endpoint-based detection tools and accelerates encryption speeds to under 30 seconds for 10 GB of data on modern CPUs.

    This in-memory hand-off also grants the malware robust persistence: the loader injects a tiny stub into the LSASS process and registers a scheduled task that triggers the payload at system startup.

    Combined with registry run-keys and WMI event subscriptions, victims face significant challenges during remediation, often requiring full system rebuilds to guarantee eradication.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post Chaos Emerges as Faster, Smarter, and More Dangerous Ransomware appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The D Brief: Ceasefire near in Gaza?; Troops arrive in Chicago; Shipbuilding advice; Deportation stats; And a bit more.

    ·

    ‘Stop trying to control every step’ of shipbuilding, senator tells Navy. Tim Sheehy, R-Mont., a freshman senator and former SEAL, thinks the sea service needs to abandon its decades-old practice of being extremely hands-on during the construction of its ever-more-complicated warships. 

    An average naval officer is not a shipbuilding expert. They're just not,” Sheehy said Wednesday at a CSIS maritime-security event. “It takes decades to build that institutional knowledge of not just naval architecture, but also knowledge of the industrial base, to effectively build the ship and build it fast and build it right. And the Navy lost that institutional knowledge decades ago.” And, he said, if the Navy can shift its focus from requirements—and change orders—to outcomes, the rest of the Pentagon may follow.

    Spread the repair workload. For his part, Senate Armed Services Committee ranking member Tim Kaine, D-Va., said the Navy should look to share maintenance and repair work with allies and partners. “We have to be 100 percent better. And that is not incremental, that is, again, expanding your capacity through creative work with allies and bringing the private sector—and the innovative part of the private sector, not just the incumbent part of the private sector—bringing them in a much more robust way,” Kaine said at the same event. Defense One’s Lauren C. Williams has more, here.

    Lawmakers call for more defense biotech research as China pursues breakthroughs. As the Trump administration slashes scientific research funding, Sen. Todd Young, R-Ind., and his colleagues are hoping to impress upon the executive branch the necessity of biotech as a national-security priority. “One general category in which the Chinese, in particular, are out-classing us, is in bio-manufacturing, industrial applications of biotech – new materials, for example – and new life-saving compounds that could be a great utility to warfighters,” Young said at a Wednesday event hosted by the With Honor Institute.

    See 49 recommendations for how the U.S. can invest in and use biotech in defense from an April report by Young’s National Security Commission on Emerging Biotechnology. Defense One’s Meghann Myers reports, here.

    Welcome to this Thursday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson and Bradley Peniston. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1969, Illinois Gov. Richard Ogilvie ordered more than 2,500 Chicago-area National Guard troops to assist police after protests spread during the trial of the “Chicago Eight,” who were charged with fomenting unrest during the previous year’s Democratic convention. 

    Around the Defense Department

    Sinking speedboats in the Caribbean won’t stop drugs from getting to the United States, writes the New York Times in an illustrated (and animated) explainer. The Trump administration has said that it is attacking boats—four in the past month—and killing all on board because they are smuggling drugs from Venezuela. “But Mr. Trump’s focus on Venezuela is at odds with reality: The vast majority of cocaine is produced and smuggled elsewhere in Latin America, according to data from the United States, Colombia and the United Nations. And Venezuela does not supply fentanyl at all, experts say.” The Times has maps, charts, and stats, here.

    Related reading: 

    Update: Trump’s Pentagon has opened nearly 300 investigations into critics of the slain far-right activist Charlie Kirk, the Washington Post reported Wednesday. The probes span service members, civilian workers and contractors, but they’ve resulted in just “a smattering of disciplinary action” so far. 

    Additional reading: 

    Trump’s militarization of American cities

    National Guard members from Texas were seen Thursday morning at an ICE facility in Chicago, the local Sun-Times newspaper reports. At least three vans with about 45 Texan National Guard troops arrived at the Broadview ICE facility late Wednesday. The troops can be seen in a video posted to social media Thursday morning. An estimated 200 Texas soldiers are in the Chicago area. 

    Later today, U.S. District Judge April Perry is set to hear arguments over Illinois Attorney General Kwame Raoul’s request for a temporary restraining order to block the deployment of both Illinois and Texas Guard members to Chicago. “The troops, along with about 300 from Illinois, had arrived Tuesday at a U.S. Army Reserve Center in Elwood, 55 miles (89 kilometers) southwest of Chicago. All 500 troops are under the Northern Command and have been activated for 60 days,” the Associated Press reports. 

    Update: Clergy and faith leaders have joined protests at the ICE facility in Broadview. “Three say they’ve been shot with pepper balls, sometimes while praying,” the Religion News Service reported Tuesday.  

    More dissent from Democratic lawmakers: “This is the fourth time that Trump has taken the extreme and dangerous move to send the military into an American city without the consent of state and local authorities,” Rep. John Garamendi of California said in a statement Wednesday. “The Founders made clear the distinction between presidents and kings. Presidents do not get personal militaries, dictators do,” he said. “Fearful of kings and occupying military forces, our Founders thought hard about how to ensure military forces were responsive to lawful, civilian control and not inappropriately used against their fellow citizens…These actions are unacceptable and contrary to the democratic values our nation was founded upon.” 

    Mapped: See how militarism is spreading across U.S. cities targeted by Trump in this map from the Associated Press, published Wednesday. 

    Trump held a roundtable discussion with mostly far-right influencers Wednesday to signal aggressive new measures targeting anti-fascism protesters. Attorney General Pam Bondi attended, and told the president in front of cameras Wednesday, “Just like we did with cartels, we are going to take the same approach, President Trump, with antifa—destroy the entire organization from top to bottom. We are going to take them apart.”

    Critical reax: “Cartels have actual leadership structures, central funding, command and control, and more,” Aaron Reichlin-Melnick of the American Immigration Council pointed out on social media. “‘Antifa’ is mostly a philosophy. That the Attorney General doesn't know the difference is quite the thing to admit!”

    • By the way: Eight of the 12 “influencers” invited to Trump’s antifa roundtable have direct financial ties to Talking Point USA, the far-right activist organization founded by Charlie Kirk, researcher Jared Holt pointed out online Thursday. 

    Trump called protesters “paid anarchists,” and claimed, “They're like insurrectionists. They're terrible people, but you really wonder why. Why are they doing it? What are they gaining? Other than they're obviously paid. They're paid a lot of money.” He also told his audience at the roundtable, “You'll be finding it out very soon, you should see what we have on these people. These are bad people. These are people that want to destroy our country. We're not going to let it happen.”

    The White House on Wednesday also released a screed targeting the city of Portland, Oregon, which it claimed has been turned “into a wasteland of firebombs, beatings, and brazen attacks on federal officers and property” because of “an Antifa-led hellfire.” 

    “Premeditated anarchy” is what Trump called protests in Portland. “That’s why, as President Donald J. Trump mobilizes federal resources to safeguard lives and property,” the White House said in its Portland flier. 

    See for yourself: Here’s on-the-ground video from protests in Portland on Tuesday.

    Deportation-nation update: The U.S. conducted at least 1,464 immigration enforcement flights last month, including removals to 48 countries, according to open-source observers at ICE Flight Monitor from Human Rights First. That represents “the highest monthly total to date, averaging 49 flights per day.” 

    During such flights, “individuals are nearly always restrained by handcuffs, waist chains and leg irons, including during any layovers and fuel stops,” HRF writes, noting, “The harsh conditions during enforcement flights raise serious human rights concerns.”

    Additional reading: 

    Israel

    Developing: Israel and Hamas appear to be close to forging some kind of ceasefire in Gaza. “Israel said a truce would take effect on Friday and start a 72-hour window to exchange hostages and prisoners,” the New York Times reports almost exactly two years after the conflict erupted with a brutal surprise attack by Hamas militants. Trump said he’s considering traveling to the region sometime this weekend, too.

    Caveats: This “initial agreement addresses only a few of the 20 points in a plan Mr. Trump proposed last month, and some of the most difficult issues between Israel and Hamas appeared to have been left to a future phase of negotiations. Those include who would rule postwar Gaza and whether, to what degree and how Hamas would lay down its weapons.”

    And lastly: A Scottish maritime museum somehow ended up in Israel’s video models of alleged Hamas infrastructure, Israel’s progressive +972 Mag reported Wednesday. 

    The gist: As Israel’s military responded to the Hamas attack two years ago, its three-dimensional illustrations posted to social media “coalesced into a distinct and consistent visual style. They usually begin with satellite imagery, followed by transitions into 3D visualizations that then often present an X-ray wireframe view of an interior or underground scene, intercut with real drone footage of airstrikes or bombings.” 

    However, after reviewing 43 animations produced by the Israeli army since October 7, 2023, “many contain serious spatial inaccuracies or prefabricated assets—sourced not from classified intelligence but rather from commercial libraries, content creators, and cultural institutions.” And one of those inaccuracies included “scans from a boat-building workshop in Scotland” that had been “uploaded to the internet by the Scottish Maritime Museum under an unrestricted Creative Commons license.” Those files were used by Israel to illustrate alleged “Hamas bunkers or Iranian weapons facilities.”

    So far, more than 50 third-party assets lifted from unrelated artists and institutions have been identified, and those “were replicated hundreds of times across animations of sites ranging from Gaza to Iran,” reporter Oren Ziv writes. Story, here. 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New ClayRat Spyware Targets Android Users via Fake WhatsApp and TikTok Apps

    ·

    A rapidly evolving Android spyware campaign called ClayRat has targeted users in Russia using a mix of Telegram channels and lookalike phishing websites by impersonating popular apps like WhatsApp, Google Photos, TikTok, and YouTube as lures to install them. “Once active, the spyware can exfiltrate SMS messages, call logs, notifications, and device information; taking photos with the front

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • DHS tells hundreds of staffers: accept reassignment to border security, immigration—or face termination

    ·

    Hundreds of Department of Homeland Security employees have been marked for reassignment to agencies focused on Trump-era border-security and deportation work, and could be dismissed if they don’t comply, according to multiple people familiar with the matter and a copy of one notice viewed by Nextgov/FCW.

    In recent weeks, the employees have been directed to transfer from various DHS agencies (including Cybersecurity and Infrastructure Security Agency, the Federal Emergency Management Agency, Transportation Security Administration and the U.S. Coast Guard) to other ones (including Immigration and Customs Enforcement, the Federal Protective Service, and Customs and Border Protection). 

    The people spoke on the condition of anonymity because they weren’t authorized to publicly communicate their knowledge of the shifts. 

    The notice seen by Nextgov/FCW gave the employee it addressed just one week to accept the Management-Directed Reassignment, or MDR, or face possible termination. They are then given 60 days to move, with some flexibility on deadlines in certain circumstances.

    “If you do not respond, the Department of Homeland Security will consider your non-response as a declination of the directed reassignment,” it reads. “If you choose to decline this reassignment or accept but fail to report for duty, you may be subject to removal” from federal service, it says. Bloomberg News first reported details of the reassignments.

    The MDRs have targeted people in CISA’s Cybersecurity Division, including its Capacity Building subdivision that focuses on improving and centralizing the cybersecurity posture of federal agencies, one of the people said. The Stakeholder Engagement Division, which oversees the agency’s national and international partnership work, was also affected, the person added.

    Another person said hundreds of FEMA staffers, including human resources and personnel security workers, were moved to positions in ICE throughout hurricane season, the peak of which occurs from around August to October. Many of those employees are still there, that person added.

    The moves align with broader White House immigration-policy priorities. The Trump administration has steered tens of billions of dollars toward immigration and border-security agencies as part of a renewed push to expand detention capacity, accelerate deportations and fortify barriers along the U.S. southern border. 

    Many, but not all, of the reassignments direct staff to ICE, CBP, and FPS, two people said.

    The shifts could slow responses to cyber threats that have targeted the federal government. 

    CISA personnel are addressing a Cisco vulnerability — recently exploited by a hacking group potentially linked to China — that predominantly affects government networks. And over the summer, a hacker stole employee data from both the Federal Emergency Management Agency and CBP, Nextgov/FCW first reported.

    Cybersecurity has been historically a bipartisan darling of Washington, but CISA, the nation’s core civilian cyberdefense agency, has been criticized by Donald Trump ever since it declared the 2020 election "the most secure in American history." Top officials in the second Trump administration have aimed to “refocus” its mission amid GOP accusations that the agency engaged in censorship of Americans’ free speech. Those claims stem from CISA’s earlier collaboration with social media platforms to remove false information online concerning the COVID-19 pandemic, elections and other divisive subjects around 2020.

    Across DHS, there is widespread uncertainty and fear among some employees about the financial and legal consequences of accepting or refusing the reassignments, including potential loss of severance pay, penalties or restrictions on future government work, the people familiar said. 

    DHS staff who have taken offers to leave the government are largely barred from interacting with people still inside the agency, and risk fines and jail time if they are caught doing so, another person said, describing their experience trying to seek help on completing a task by asking a former employee for assistance.

    The reassignments appear to be used as a strategy to encourage voluntary departures without direct firings, the person added. When they applied for their current position, for example, this person indicated that they were unwilling to relocate, and the reassignment they received completely circumvented that constraint.

    “DHS routinely aligns personnel to meet mission priorities while ensuring continuity across all core mission areas,” DHS Assistant Secretary Tricia McLaughlin said in a statement. “Any notion that DHS is unprepared to handle threats to our nation because of these realignments is ludicrous, especially given the abject failure at the hands of CISA in the last administration.”

    “CISA was adrift and was focused on censorship, branding, and electioneering instead of defending America’s critical infrastructure. Today, CISA is focused squarely on executing its statutory mission: serving as the national coordinator for securing and protecting the nation’s critical infrastructure and is delivering timely, actionable cyber threat intelligence, supporting federal, state and local partners, and defending against both nation-state and criminal cyber threats,” she added.

    Editor's note: This story has been updated to include comment from DHS.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft Azure Experiences Global Outage Disrupting Cloud Services Worldwide

    ·

    , , , ,

    Microsoft Azure suffered a significant service interruption that left many customers unable to reach cloud resources. The incident began at roughly 07:40 UTC, when Azure Front Door, the platform’s native content delivery network (CDN), lost about 30 percent of its capacity, as reported by CSN. Azure Front Door is designed to act as a secure, […]

    The post Microsoft Azure Experiences Global Outage Disrupting Cloud Services Worldwide appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • SonicWall Confirms Breach Exposing All Customer Firewall Configuration Backups

    ·

    , , ,

    SonicWall, together with leading incident response firm Mandiant, has completed a thorough review of a recent cloud backup security incident. The investigation confirmed that an unknown party gained access to all firewall configuration backup files for customers using the MySonicWall cloud backup feature. These files contain encoded configuration settings and encrypted credentials. Although the credentials […]

    The post SonicWall Confirms Breach Exposing All Customer Firewall Configuration Backups appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • SquareX Shows AI Browsers Fall Prey to OAuth Attacks, Malware Downloads and Malicious Link Distribution

    ·

    Palo Alto, California, October 9th, 2025, CyberNewsWire

    As AI Browsers rapidly gain adoption across enterprises, SquareX has released critical security research exposing major vulnerabilities that could allow attackers to exploit AI Browsers to exfiltrate sensitive data, distribute malware and gain unauthorized access to enterprise SaaS apps.

    The timing of this disclosure is particularly significant as major companies including OpenAI, Microsoft, Google and The Browser Company have announced or released their own AI browsers.

    With Chrome and Edge alone representing 70% of the browser market share, it is very likely that the majority of consumer browsers in the future will be AI Browsers. Thus, it is critical for organizations to prepare for these security risks associated with this fundamental change.

    “Just like any AI Agent, AI Browsers are trained to complete tasks, not to be security aware. This makes it trivial for attackers to trick browsers like Comet into performing malicious tasks, by convincing them that it is a necessary part of the workflow they are completing,” warns Vivek Ramachandran, Founder of SquareX, “With two major consumer browsers publicly announcing their entry to the AI Browser race, it is inevitable that AI Browsers will be the primary way we interact with the internet in the future. Without the right browser-native solution that can implement guardrails on these AI Browsers that take into account agentic identity and agentic DLP, millions of users will be at risk.”

    In the technical blog, SquareX discloses a few ways Comet was exploited, illustrating each with case studies. In one example, in completing a research task, Comet fell prey to an OAuth attack, providing attackers with full access to the victim’s email and Google Drive.

    This allowed attackers to exfiltrate every file stored on the victim’s account, including those shared by colleagues and customers.

    In another, the AI browser was completing tasks in the user’s inbox – a common use case advertised by Comet itself – when it ended up distributing a malicious link to the victim’s colleague through a calendar invite.

    Other examples include tricking Comet into downloading known malwares and emailing sensitive files to attackers. 

    Unfortunately, existing solutions like EDRs and SASE/SSE have limited visibility into browsers. Today, there is no way to differentiate between activities performed by a user or Comet, as both network requests originate from the same browser.

    Thus, it is critical that enterprises have a browser-native solution that can differentiate between agentic and user identities, allowing them to apply differentiated guardrails on the data and actions that the AI browser can access or perform.

    In a commentary on SquareX’s research, Stephen Bennett, Group CISO at Domino’s Pizza Enterprises Ltd., says “Browsers have always been our universal gateway to the internet.

    AI browsers are the next logical step where instead of simply displaying information, the browser acts autonomously on our behalf. The trade off? Where we were once firmly in the driving seat, AI browsers will push us to be passengers.”

    With the increasing integration of agentic AI into browsers, AI agents may soon dominate browsing activity over human users.

    This shift necessitates a collaboration between enterprises, browser developers, and cybersecurity companies to create robust security frameworks and protective measures to prevent attackers from exploiting AI Browsers.

    SquareX’s findings provide a crucial warning about the dangers of relying on traditional solutions to solve modern threats, and hopes to serve as an encouragement for an urgent industry-wide cooperation.

    About SquareX

    SquareX‘s browser extension turns any browser on any device into an enterprise-grade secure browser, including AI Browsers.

    SquareX’s industry-first Browser Detection and Response (BDR) solution empowers organizations to proactively defend against browser-native threats including rogue AI agents, Last Mile Reassembly Attacks, malicious extensions and identity attacks.

    Unlike dedicated enterprise browsers, SquareX seamlessly integrates with users’ existing consumer browsers, delivering security without compromising user experience.

    More information about SquareX’s research-led innovation is available at www.sqrx.com.

    Contact

    Head of PR

    Junice Liew

    SquareX

    junice@sqrx.com

    The post SquareX Shows AI Browsers Fall Prey to OAuth Attacks, Malware Downloads and Malicious Link Distribution appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • KFC Venezuela Alleged Data Breach – 1 Million Customer Records Exposed

    ·

    , ,

    A threat actor has allegedly breached KFC Venezuela, offering a database containing the personal and order information of over one million customers for sale on a dark web forum.

    The data, advertised on October 8, 2025, includes a vast amount of sensitive customer details, posing a significant risk of fraud and identity theft to those affected.

    The database is being sold as a single 405 MB CSV file containing exactly 1,067,291 rows of data, indicating a large-scale compromise of the fast-food giant’s Venezuelan operations.

    Extent of the Compromised Data

    The breach exposes a wide array of personally identifiable information (PII) and transactional data. According to the threat actor’s post, the leaked database includes customers’ full names, phone numbers, email addresses, and complete delivery addresses.

    The financial details exposed are also extensive, containing payment methods, exchange rates associated with transactions, and details of ordered items with their corresponding quantities and prices.

    This combination of personal and financial information creates a high-risk scenario for targeted phishing campaigns, financial fraud, and other malicious activities directed at the victims.

    The data set also contains operational information, such as order creation and update timestamps, sales channels, and internal store details.

    The threat actor advertised the sale on a hacking forum, providing a detailed list of the data fields included in the compromised database.

    To prove the authenticity of the data, the seller included a sample of the records, showing customer names, contact information, and specific order details.

    The post listed numerous data fields, including cliente_fullname, cliente_phone, cliente_email, and cliente_direccion. Also included were order-specific identifiers like orden_id, store information, and aggregator IDs, suggesting a deep compromise of the company’s order management or customer relationship management (CRM) systems.

    KFC Venezuela Data Breach
    KFC Venezuela Data Breach

    The actor is inviting interested parties to make contact for pricing, indicating that the data is available for purchase to other malicious actors.

    The exposure of such detailed customer information places over one million individuals at immediate risk. Malicious actors can use the leaked data to orchestrate sophisticated scams, using order histories and personal details to make their fraudulent attempts appear legitimate.

    Customers of KFC Venezuela are advised to be extremely cautious of unsolicited emails, text messages, or phone calls claiming to be from the company or other service providers.

    It is recommended that individuals who may be affected monitor their financial accounts for any suspicious activity. As of now, KFC Venezuela has not issued a public statement regarding the alleged breach.

    The incident underscores the critical need for robust cybersecurity measures to protect customer data in an increasingly targeted digital environment.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

      The post KFC Venezuela Alleged Data Breach – 1 Million Customer Records Exposed appeared first on Cyber Security News.

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶