Today, I spoted on VirusTotal an interesting Python RAT. They are tons of them but this one attracted my attention based on some function names present in the code: self_modifying_wrapper(), decrypt_and_execute() and polymorph_code(). A polymorphic malware is a type of malware that has been developed to repeatedly mutate its appearance or signature files at every execution time. The file got a very low score of 2/64 on VT! (SHA256:7173e20e7ec217f6a1591f1fc9be6d0a4496d78615cc5ccdf7b9a3a37e3ecc3c).
Recent research indicates that AI technologies have become the leading channel for data exfiltration within enterprises. This emerging threat leverages AI capabilities to bypass traditional security controls, making detection and prevention more challenging. The use of AI for data theft can involve automated reconnaissance, sophisticated social engineering, and covert data extraction methods. European organizations face increased risks due to widespread AI adoption and the sensitivity of data handled under regulations like GDPR. Mitigation requires tailored strategies including AI behavior monitoring, enhanced data loss prevention tuned for AI patterns, and strict access controls on AI tools. Countries with advanced digital economies and high AI integration, such as Germany, France, and the UK, are particularly vulnerable. Given the high potential impact on confidentiality and integrity, ease of exploitation through AI automation, and broad scope across enterprises, this threat is assessed as high severity. Defenders must prioritize understanding AI-driven exfiltration tactics and adapt their security frameworks accordingly.
A recent cyberattack on Red Hat's GitLab instance by the Crimson Collective resulted in the theft of approximately 570GB of compressed data, including 28,000 internal repositories and sensitive customer engagement reports containing infrastructure and authentication details. This breach exposes critical intellectual property and sensitive information across multiple sectors. Additional significant incidents include ransomware and data breaches affecting global organizations, highlighting a trend of sophisticated attacks targeting supply chains, manufacturing, and service providers. Notably, vulnerabilities in widely used software such as VMware Aria Operations, Linux sudo, and Fortra’s GoAnywhere MFT have been actively exploited, increasing the attack surface. European organizations relying on Red Hat and related open-source infrastructure are at risk of indirect impacts from leaked credentials and infrastructure details. The threat landscape underscores the need for targeted mitigation strategies focusing on supply chain security, privileged access management, and rapid patching of critical vulnerabilities. Given the scale and sensitivity of the stolen data, the threat severity is assessed as high for European entities.
CometJacking: One Click Can Turn Perplexity’s Comet AI Browser Into a Data Thief
Source: https://thehackernews.com/2025/10/cometjacking-one-click-can-turn.html
ShinyHunters Launches Data Leak Site: Trinity of Chaos Announces New Ransomware Victims
Source: https://securityaffairs.com/182918/cyber-crime/shinyhunters-launches-data-leak-site-trinity-of-chaos-announces-new-ransomware-victims.html
Red Hat confirms security incident after hackers breach GitLab instance
Source: https://www.bleepingcomputer.com/news/security/red-hat-confirms-security-incident-after-hackers-breach-gitlab-instance/
Google Patches “Gemini Trifecta” Vulnerabilities in Gemini AI Suite That Could Steal User Data
Source: https://hackread.com/google-gemini-trifecta-vulnerabilities-gemini-ai/
AMI BMC vulns are on the CISA Known Exploited Vulnerabilities catalog now. I think this is the first BMC vuln to hit the KEV. Here are some Nuclei templates to detect this vuln in your BMCs.
Red Hat OpenShift AI Flaw Exposes Hybrid Cloud Infrastructure to Full Takeover
Source: https://thehackernews.com/2025/10/critical-red-hat-openshift-ai-flaw.html
FlipSwitch introduces a new syscall hooking technique for Linux kernel 6.9+, bypassing traditional methods rendered obsolete by changes in the syscall dispatch mechanism. The technique locates the original syscall function, scans the x64_sys_call function's machine code for a specific call instruction, and modifies its offset to redirect to a malicious function. This precise method leaves minimal traces and can be fully reverted. FlipSwitch demonstrates the ongoing evolution of attack techniques in response to kernel hardening efforts, highlighting the cat-and-mouse game between attackers and defenders in cybersecurity.
CISA Sounds Alarm on Critical Sudo Flaw Actively Exploited in Linux and Unix Systems
Source: https://thehackernews.com/2025/09/cisa-sounds-alarm-on-critical-sudo-flaw.html
