The cybersecurity landscape has been shaken by the emergence of Trinity of Chaos, a sophisticated ransomware collective that has launched a data leak site containing sensitive information from 39 major corporations.

This formidable alliance, presumably comprising members from the notorious Lapsus$, Scattered Spider, and ShinyHunters groups, represents a significant evolution in cybercriminal organization and operational capability.

The group has strategically positioned itself as a hybrid threat actor, combining traditional ransomware tactics with data extortion methodologies to maximize their impact and financial returns.

The Trinity of Chaos collective has demonstrated remarkable operational sophistication by establishing a dedicated Data Leak Site (DLS) on the TOR network, following the established playbook of modern ransomware groups.

Rather than announcing new attacks, the group has chosen to reveal previously undisclosed successful breaches, sharing samples of stolen data to validate their claims and pressure victims into compliance.

This approach suggests a calculated strategy designed to maintain operational security while maximizing leverage over their targets through the threat of public data exposure.

Following the group’s previous exploitation of Salesforce instances, they have issued ultimatums to affected companies, threatening massive data releases if negotiation demands are not met.

Resecurity analysts identified the group’s polished marketing approach, with the collective describing themselves as specialists in “high-value corporate data acquisition and strategic breach operations” spanning multiple industries including automotive, financial, insurance, technological, and telecommunications sectors worldwide.

The threat actors have indicated that their operations began as early as 2019, suggesting extensive experience and a well-established operational infrastructure.

The scope of the Trinity of Chaos breach is unprecedented, with victims spanning Fortune 100 companies across diverse industries.

Major technology giants Google and Cisco feature prominently among the compromised entities, alongside household names such as Toyota Motor Corporation, FedEx, Disney/Hulu, Home Depot, Marriott, McDonald’s, and numerous other high-profile organizations.

The group has set October 10 as a negotiation deadline for most victims, employing psychological pressure tactics similar to traditional ransomware operations while threatening regulatory reporting that could result in criminal negligence charges against non-compliant organizations.

Exploitation of Salesforce Infrastructure Through Advanced Social Engineering

The Trinity of Chaos collective has demonstrated sophisticated attack methodologies centered around the exploitation of Salesforce instances through compromised Salesloft Drift AI chat integration.

The majority of leaked data samples notably lack passwords but contain substantial amounts of personally identifiable information (PII), strongly indicating that the stolen records originate from targeted Salesforce environments.

The attack vectors employed by the group involve vishing attacks combined with the theft of OAuth tokens specifically designed for Salesloft’s Drift AI chat integration, representing a highly targeted approach to cloud platform exploitation.

This exploitation technique has proven so effective that it prompted the Federal Bureau of Investigation to issue a flash warning containing technical indicators that organizations should monitor to detect potential infiltration of their Salesforce environments.

The group’s ability to maintain persistent access within victim networks for extended periods, as demonstrated in the Vietnam Airlines case where attackers remained undetected for nearly three years, highlights the sophistication of their operational security measures.

The stolen data encompasses sensitive customer information, internal communications, loyalty program details, and comprehensive activity histories, providing the threat actors with extensive intelligence for future operations and social engineering campaigns.

The Trinity of Chaos collective claims to possess over 1.5 billion records spanning 760 companies, with detailed breakdowns including 254 million account records, 579 million contact entries, and 458 million case files.

This massive dataset originates from previous campaigns including UNC6395 and UNC6040 activities, demonstrating the group’s systematic approach to data aggregation and monetization across multiple attack campaigns.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post New Hacker Alliance Trinity of Chaos Leaked 39 Companies Data Including Google, CISCO and Others appeared first on Cyber Security News.

Shuyal Stealer has rapidly ascended as one of the most versatile credential theft tools observed in recent months.

First detected in early August 2025, its modular architecture allows it to target an expansive range of web browsers, including Chromium-based, Gecko-based, and legacy engines alike.

Initial indicators of compromise emerged as anomalous network traffic from compromised hosts, where users reported unexplained browser crashes followed by surges in outbound connections to unfamiliar command-and-control (C2) servers.

Point Wild researchers noted that within days of its emergence, Shuyal Stealer had already compromised hundreds of endpoints across multiple industry sectors, including finance, healthcare, and manufacturing.

The malware’s attack vectors are rooted in traditional social engineering techniques, primarily masquerading as software updates or utility installers.

Delivered through phishing emails or malicious advertisements, the installer payload employs a self-extracting archive that unpacks and executes a legitimate system binary alongside an obfuscated DLL loader.

This side-loading mechanism allows Shuyal Stealer to evade common application whitelist solutions.

As the loader executes, it injects the core stealer module into running browser processes, granting it full access to stored cookies, saved passwords, and form-autofill data.

Point Wild analysts identified the use of encrypted strings and API hashing to conceal calls to key Windows functions such as LoadLibrary and GetProcAddress, complicating static analysis by security researchers.

Upon successful injection, Shuyal Stealer begins its payload routines, harvesting credentials from browser SQLite databases and memory.

It supports 19 different browsers, including Chrome, Edge, Firefox, Opera, Vivaldi, Brave, and several lesser-known forks popular in certain regions.

The stealer can also extract banking session tokens and two-factor authentication approvals stored in local cache.

Once collected, data is compressed using a custom ZIP implementation and encrypted with AES-256 in CBC mode before exfiltration.

Traffic analysis shows the malware batching stolen credentials into 512 KB chunks, which are sent over HTTPS to a dynamically generated subdomain for each victim, complicating takedown efforts.

Infection and Loader Mechanism

Shuyal Stealer’s infection mechanism hinges on DLL side-loading and unhooked API calls to maintain stealth.

After decompressing the archive, the loader writes a benign system executable (for example, svchost.exe) into the Windows directory and drops an accompanying malicious DLL in the same location.

The executable is then launched with a crafted registry entry under HKCU\Software\Microsoft\Windows\CurrentVersion\Run, ensuring persistence across reboots.

Once the legitimate executable loads, Windows automatically resolves and loads the malicious DLL due to its naming convention match.

Within the DLL’s DllMain, the loader invokes a staged unpacker:-

// Simplified unpack routine
void UnpackAndInject() {
    BYTE* encryptedPayload = LoadResource(MAKEINTRESOURCE(101));
    BYTE* payload = DecryptAES256(encryptedPayload, payloadSize, key, iv);
    HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, targetPid);
    LPVOID remoteMem = VirtualAllocEx(hProc, NULL, payloadSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
    WriteProcessMemory(hProc, remoteMem, payload, payloadSize, NULL);
    CreateRemoteThread(hProc, NULL, 0, (LPTHREAD_START_ROUTINE)remoteMem, NULL, 0, NULL);
}

This unpacker decrypts the core stealer module in memory and injects it into the target browser process.

By avoiding writing the primary payload to disk and leveraging legitimate binaries, Shuyal Stealer bypasses many endpoint detection solutions.

The use of API hashing further thwarts heuristic detection, as function names never appear in string tables.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Shuyal Stealer Attacking 19 Browsers to Steal Login Credentials appeared first on Cyber Security News.