Fraudster stole over $1.5 million from city of Baltimore
Source: https://securityaffairs.com/181772/cyber-crime/fraudster-stole-over-1-5-million-from-city-of-baltimore.html
So apparently agents are good enough nowadays that they can run a whole ransomware project on their own, getting in, lateral movement and then figuring out the appropriate ransom amount based on the information they got access to ...
Lazarus, an APT group with suspected East Asian origins, has recently employed the ClickFix social engineering technique in their phishing attacks. The group, known for targeting financial institutions and cryptocurrency exchanges, now uses fake job opportunities to lure victims to interview websites. These sites prompt users to 'fix' non-existent camera issues, tricking them into downloading malware disguised as Nvidia software updates. The malware deploys a Node.js environment and executes BeaverTail, a common Lazarus tool. On Windows 11 systems, an additional backdoor (drvUpdate.exe) is installed. The attack also affects macOS users. The malware establishes persistence and connects to command and control servers for further instructions and data exfiltration.
Amazon's threat intelligence team has uncovered and disrupted a watering hole campaign conducted by APT29, a Russian threat actor. The campaign involved compromising legitimate websites to redirect visitors to malicious infrastructure, tricking users into authorizing attacker-controlled devices through Microsoft's device code authentication flow. This opportunistic approach demonstrates APT29's evolving tactics in scaling their operations for intelligence collection. The group employed techniques such as injecting obfuscated JavaScript, rapidly adapting infrastructure when faced with disruption, and using server-side redirects. Amazon's response included isolating affected EC2 instances, partnering with providers to disrupt domains, and sharing information with Microsoft. The article provides recommendations for user and organizational protection against such attacks.
TinkyWinkey is a sophisticated Windows-based keylogger that combines persistent service execution, low-level keyboard hooks, and comprehensive system profiling. It captures all keystrokes, including special keys and multi-language input, alongside detailed system metrics such as CPU, memory, OS version, and network identifiers. The malware uses DLL injection into trusted processes and service-based persistence for stealth. It creates a log file in the user's temp directory, recording system reconnaissance details and user activity data. First observed in June 2025, TinkyWinkey exemplifies the evolving threat landscape, leveraging advanced programming techniques to maintain stealth and maximize data capture. Organizations should monitor for unusual service activity, unexpected DLL injections, and persistent logging patterns to mitigate this threat.
The Interlock ransomware group has been actively targeting businesses and critical infrastructures in North America and Europe since September 2024. Their ransomware employs AES-256-GCM encryption with RSA-4096 key protection, leveraging the OpenSSL library for efficient file encryption. The malware includes code obfuscation techniques and specific arguments for various behaviors. It excludes certain folders, file extensions, and files from encryption to avoid system damage. The ransomware changes file extensions to '.!NT3RLOCK' and may terminate processes during encryption. Interlock's operations involve data theft and public disclosure threats for ransom leverage. The group utilizes a Tor-based negotiation site and references legal regulations to pressure victims. To counter this threat, offsite data backups and regular recovery drills are recommended.
Mosyle has discovered a new Mac malware strain called 'JSCoreRunner' that evades detection by masquerading as a PDF conversion tool. The malware spreads through a malicious website, fileripple.com, and operates in two stages. The first stage, FileRipple.pkg, appears as a legitimate PDF tool while running malicious code in the background. The second stage, Safari14.1.2MojaveAuto.pkg, bypasses Gatekeeper's protections. Once installed, JSCoreRunner targets Chrome browsers, altering search engine settings to redirect users to fraudulent providers. This exposes users to keylogging, phishing, and potential data theft. The malware's sophisticated approach highlights the need for vigilance and proactive security measures for Mac administrators.
PromptLock, a proof-of-concept AI-powered ransomware, leverages Lua scripts generated from hard-coded prompts to perform malicious activities across Windows, Linux, and macOS. Written in Go, it communicates with a locally hosted LLM through the Ollama API. The malware scans the filesystem, identifies sensitive information, and uses SPECK 128-bit encryption in ECB mode to encrypt files. It dynamically generates ransom notes and adapts its behavior based on the infected machine type. PromptLock's cross-platform compatibility and AI-driven script generation make it a significant concern for cybersecurity professionals, highlighting the need for advanced defensive strategies against evolving AI-powered threats.
TamperedChef Malware Disguised as Fake PDF Editors Steals Credentials and Cookies
Source: https://thehackernews.com/2025/08/tamperedchef-malware-disguised-as-fake.html
Feds Seize $6.4M VerifTools Fake-ID Marketplace, but Operators Relaunch on New Domain
Source: https://thehackernews.com/2025/08/feds-seize-64m-veriftools-fake-id.html
A loophole in VS Code Marketplace allows malicious actors to reuse names of removed extensions. ReversingLabs discovered this vulnerability after finding a malicious extension with the same name as one previously identified. The platform's documentation states that extension names must be unique, but removed extensions' names can be reused. This poses a risk of threat actors publishing malicious extensions under previously legitimate names. The research team conducted experiments to confirm this vulnerability, successfully publishing extensions with names of removed packages. This technique has been observed in other open-source platforms like PyPI. The discovery highlights the increasing popularity of VS Code Marketplace among malicious actors and the need for developers to be vigilant about package security.
Malicious Nx Packages in ‘s1ngularity’ Attack Leaked 2,349 GitHub, Cloud, and AI Credentials
Source: https://thehackernews.com/2025/08/malicious-nx-packages-in-s1ngularity.html
