Hook Version 3: The Banking Trojan with The Most Advanced Capabilities
Hook Android banking trojan, now featuring some of the most advanced capabilities we’ve seen to date. This version introduces:
- Ransomware-style overlays that display extortion messages
- Fake NFC overlays to trick victims into sharing sensitive data
- Lockscreen bypass via deceptive PIN and pattern prompts
- Transparent overlays to silently capture user gestures
- Stealthy screen-streaming sessions for real-time monitoring
https://zimperium.com/blog/hook-version-3-the-banking-trojan-with-the-most-advanced-capabilities
Hook Android banking trojan, now featuring some of the most advanced capabilities we’ve seen to date. This version introduces:
- Ransomware-style overlays that display extortion messages
- Fake NFC overlays to trick victims into sharing sensitive data
- Lockscreen bypass via deceptive PIN and pattern prompts
- Transparent overlays to silently capture user gestures
- Stealthy screen-streaming sessions for real-time monitoring
https://zimperium.com/blog/hook-version-3-the-banking-trojan-with-the-most-advanced-capabilities
Zimperium
Hook Version 3: The Banking Trojan with The Most Advanced Capabilities
true
Loophole allows threat actors to claim VS Code extension names
https://www.reversinglabs.com/blog/malware-vs-code-extension-names
https://www.reversinglabs.com/blog/malware-vs-code-extension-names
ReversingLabs
Loophole allows threat actors to claim VS Code extension names | ReversingLabs
RL has discovered a loophole on VS Code Marketplace that allows threat actors to reuse legitimate, removed package names for malicious purposes.
Like PuTTY in Admin’s Hands
weaponized PuTTY distributed through Bing
https://levelblue.com/blogs/security-essentials/like-putty-in-admins-hands
weaponized PuTTY distributed through Bing
https://levelblue.com/blogs/security-essentials/like-putty-in-admins-hands
LevelBlue
Like PuTTY in Admin’s Hands
Co-author: special thanks to Nikki Stanziale for their invaluable contributions to the research, insights, and development of this blog. While not listed as a primary author, their expertise and collaboration were instrumental in shaping the final content.…
Forwarded from Yevgeniy Goncharov
🦄 Open SysConf'25 - Интересные факты по докладам
Уникальность не только в том, что доклады от первого лица, но и в том, что этот успех достигнут собственными силами.
- Жаслан, автор одного из докладов - История про деплои 2 стартапов в сфере ИИ (dapmeet.kz, marbix.io) это возможность задать вопросы напрямую автору этих сервисов.
- Денис, опытный системный архитектор, преподаватель матчасти - Архитектура ПО для системных администраторов. Что такие Архитектура ПО, принципы, паттерны и стили. Монолит и микросервисы. Представление архитектуры (C4), архитектура как код.
Лично для меня - это будет уникальный опыт узнать, спросить и "намотать на ус", полезную информацию.
Ты готов продолжать катать вату или уже наконец пришло время узнавать новое?
4 Октября, Алматы, Smart Point. Вход свободный.
https://sysconf.io/2025
Уникальность не только в том, что доклады от первого лица, но и в том, что этот успех достигнут собственными силами.
- Жаслан, автор одного из докладов - История про деплои 2 стартапов в сфере ИИ (dapmeet.kz, marbix.io) это возможность задать вопросы напрямую автору этих сервисов.
- Денис, опытный системный архитектор, преподаватель матчасти - Архитектура ПО для системных администраторов. Что такие Архитектура ПО, принципы, паттерны и стили. Монолит и микросервисы. Представление архитектуры (C4), архитектура как код.
Лично для меня - это будет уникальный опыт узнать, спросить и "намотать на ус", полезную информацию.
Ты готов продолжать катать вату или уже наконец пришло время узнавать новое?
4 Октября, Алматы, Smart Point. Вход свободный.
https://sysconf.io/2025
The largest hacker conference in Central Asia is coming back to Almaty🔥
📆 September 17–19, KazHackStan 2025 will take place at Sadu Arena.
This year’s theme — Zero Day: “A vulnerability doesn’t wait. It appears. And it changes everything.”
The program includes:
- 10,000 participants from across the region,
- top speakers and workshops,
- the legendary CyberKumbez competition.
Organizers: TSARKA Group
Co-organizers: The Committee on Information Security of the Ministry of Digital Development, Innovations and Aerospace Industry (CIS MDDIAI RK).
Registration is available at kazhackstan.com.
📆 September 17–19, KazHackStan 2025 will take place at Sadu Arena.
This year’s theme — Zero Day: “A vulnerability doesn’t wait. It appears. And it changes everything.”
The program includes:
- 10,000 participants from across the region,
- top speakers and workshops,
- the legendary CyberKumbez competition.
Organizers: TSARKA Group
Co-organizers: The Committee on Information Security of the Ministry of Digital Development, Innovations and Aerospace Industry (CIS MDDIAI RK).
Registration is available at kazhackstan.com.
AMOS Stealer Campaign Targeting macOS via ‘Cracked’ Apps
https://www.trendmicro.com/en_us/research/25/i/an-mdr-analysis-of-the-amos-stealer-campaign.html
https://www.trendmicro.com/en_us/research/25/i/an-mdr-analysis-of-the-amos-stealer-campaign.html
Trend Micro
An MDR Analysis of the AMOS Stealer Campaign Targeting macOS via Cracked Apps
Trend™ Research analyzed a campaign distributing Atomic macOS Stealer (AMOS), a malware family targeting macOS users. Attackers disguise the malware as “cracked” versions of legitimate apps, luring users into installation.
The Rise of RatOn: From NFC heists to remote control and ATS
https://www.threatfabric.com/blogs/the-rise-of-raton-from-nfc-heists-to-remote-control-and-ats
https://www.threatfabric.com/blogs/the-rise-of-raton-from-nfc-heists-to-remote-control-and-ats
ThreatFabric
The Rise of RatOn: From NFC heists to remote control and ATS
This new research by ThreatFabric exposes RatOn, a new banking trojan with powerful capabilities.
How an Attacker’s Blunder Gave Us a Rare Look Inside Their Day-to-Day Operations
https://www.huntress.com/blog/rare-look-inside-attacker-operation
https://www.huntress.com/blog/rare-look-inside-attacker-operation
Huntress
An Attacker’s Blunder Gave Us a Look Into Their Operations | Huntress
An attacker installed Huntress onto their operating machine, giving us a detailed look at how they’re using AI to build workflows, searching for tools like Evilginx, and researching targets like software development companies.
VMScape: Exposing and Exploiting Incomplete Branch Predictor Isolation in Cloud Environments
https://comsec.ethz.ch/research/microarch/vmscape-exposing-and-exploiting-incomplete-branch-predictor-isolation-in-cloud-environments/
https://comsec.ethz.ch/research/microarch/vmscape-exposing-and-exploiting-incomplete-branch-predictor-isolation-in-cloud-environments/
Satori Threat Intelligence Alert: SlopAds Covers Fraud with Layers of Obfuscation
https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-slopads-covers-fraud-with-layers-of-obfuscation/
https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-slopads-covers-fraud-with-layers-of-obfuscation/
Prompts as Code & Embedded Keys | The Hunt for LLM-Enabled Malware
https://www.sentinelone.com/labs/prompts-as-code-embedded-keys-the-hunt-for-llm-enabled-malware/
https://www.sentinelone.com/labs/prompts-as-code-embedded-keys-the-hunt-for-llm-enabled-malware/
SentinelOne
Prompts as Code & Embedded Keys | The Hunt for LLM-Enabled Malware
LLM-enabled malware poses new challenges for detection. SentinelLABS presents groundbreaking research on how to hunt for this new class of threats.
SystemBC – Bringing The Noise
“SystemBC” botnet, a network composed of over 80 C2s with a daily average of 1,500 victims, nearly 80% of which are compromised VPS systems from several large commercial providers..:
https://blog.lumen.com/systembc-bringing-the-noise/
“SystemBC” botnet, a network composed of over 80 C2s with a daily average of 1,500 victims, nearly 80% of which are compromised VPS systems from several large commercial providers..:
https://blog.lumen.com/systembc-bringing-the-noise/
Lumen Blog
SystemBC: Bringing the noise
Understand how the SystemBC botnet utilizes VPS networks to create powerful proxies for criminal threat groups and malicious activities.
Forwarded from Yevgeniy Goncharov
🚀 Open SysConf'25 → Старт через неделю! Трансляции быть!
4 Октября уже на след. неделе! Готовность и настрой присуствуют, при наличии хорошего Интернета в локации, будет трансляция с вероятностю 90%+!
Доклады, предварительная очередность:
- Мониторинг, как в нем не утонуть.
- Использование MCP и LLM для анализа вредоносного ПО.
- Как запустить два AI-стартапа за месяц и не сойти с ума.
- "Вопрос со звёздочкой" с собеседований: разбор и подходы.
- История о MacOS malware: от "безопасной по умолчанию" до реальных угроз криптографии и ядра.
- Архитектура ПО для сисадминов: монолит, микросервисы, C4, принципы и стили.
- Цепочки DNS на примере малвари под macOS
Встречаемся через неделю!
Все детали здесь: https://sysconf.io/2025
4 Октября уже на след. неделе! Готовность и настрой присуствуют, при наличии хорошего Интернета в локации, будет трансляция с вероятностю 90%+!
Доклады, предварительная очередность:
- Мониторинг, как в нем не утонуть.
- Использование MCP и LLM для анализа вредоносного ПО.
- Как запустить два AI-стартапа за месяц и не сойти с ума.
- "Вопрос со звёздочкой" с собеседований: разбор и подходы.
- История о MacOS malware: от "безопасной по умолчанию" до реальных угроз криптографии и ядра.
- Архитектура ПО для сисадминов: монолит, микросервисы, C4, принципы и стили.
- Цепочки DNS на примере малвари под macOS
Встречаемся через неделю!
Все детали здесь: https://sysconf.io/2025
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
The God Mode Vulnerability That Should Kill “Trust Microsoft” Forever
https://tide.org/blog/god-mode-vulnerability-microsoft-authorityless-security
https://tide.org/blog/god-mode-vulnerability-microsoft-authorityless-security
Tide Foundation
The God Mode Vulnerability That Should Kill "Trust Microsoft"
How One Token Could Have Compromised Every Microsoft Entra ID Tenant on Earth, And Why It’s Time for Authorityless SecurityRecently, security researcher Dirk-Ja
Phishing attacks with new domains likely to continue
Unfortunately the string of phishing attacks using domain-confusion and legitimate-looking emails continues.
In short, there's a new phishing campaign targeting PyPI users occurring right now..:
https://blog.pypi.org/posts/2025-09-23-plenty-of-phish-in-the-sea/
Unfortunately the string of phishing attacks using domain-confusion and legitimate-looking emails continues.
In short, there's a new phishing campaign targeting PyPI users occurring right now..:
https://blog.pypi.org/posts/2025-09-23-plenty-of-phish-in-the-sea/
blog.pypi.org
Phishing attacks with new domains likely to continue - The Python Package Index Blog
A new phishing campaign targeting PyPI users using similar tactics to previous campaigns.
The Trifecta: How Three New Gemini Vulnerabilities in Cloud Assist, Search Model, and Browsing Allowed Private Data Exfiltration
https://www.tenable.com/blog/the-trifecta-how-three-new-gemini-vulnerabilities-in-cloud-assist-search-model-and-browsing
https://www.tenable.com/blog/the-trifecta-how-three-new-gemini-vulnerabilities-in-cloud-assist-search-model-and-browsing
Tenable®
The Trifecta: How Three New Gemini Vulnerabilities in Cloud Assist, Search Model, and Browsing Allowed Private Data Exfiltration
Tenable Research discovered three vulnerabilities (now remediated) within Google’s Gemini AI assistant suite, which we dubbed the Gemini Trifecta. These vulnerabilities exposed users to severe privacy risks. They made Gemini vulnerable to: search-injection…
Начнется 24 октября. Пройдет в Farabi Hub.
DevOpsDays — ежегодный обмен опытом, обсуждение актуальных практик и инноваций в мире IT. Организаторы обещают мероприятие чертовски привлекательным.
— Доклады от топовых экспертов
— 800 участников офлайн и еще 2000+ онлайн
— Инсайды с рынка DevOps
— Нетворкинг с комьюнити
— Мерч и подарки от партнеров
Все детали здесь: https://devopsdays.kz/
Please open Telegram to view this post
VIEW IN TELEGRAM
Shuyal Stealer: Advanced Infostealer Targeting 19 Browsers
https://www.pointwild.com/threat-intelligence/shuyal-stealer-advanced-infostealer-targeting-19-browsers
https://www.pointwild.com/threat-intelligence/shuyal-stealer-advanced-infostealer-targeting-19-browsers
Point Wild
Shuyal Stealer: Advanced Infostealer Targeting 19 Browsers | Point Wild
Introduction: Infection Flowchart: Technical Analysis: MD5: 9523086ab1c3ab505f3dfd170672af1e SHA-256: 8bbeafcc91a43936ae8a91de31795842cd93d2d8be3f72ce5c6ed27a08cdc092 Compiler: 64 bit C++ compiler executable file How Does Shuyal Stealer Stay Persistent?:…
Another Critical RCE Discovered in a Popular MCP Server
https://www.imperva.com/blog/another-critical-rce-discovered-in-a-popular-mcp-server/
https://www.imperva.com/blog/another-critical-rce-discovered-in-a-popular-mcp-server/
Blog
Another Critical RCE Discovered in a Popular MCP Server | Imperva
Artificial Intelligence development is moving faster than secure coding practices, and attackers are taking notice. Imperva Threat Research recently uncovered and disclosed a critical Remote Code Execution (RCE) vulnerability (CVE-2025-53967) in the Framelink…