DSLRoot, a residential proxy provider, operates a network of hardware devices deployed in U.S.homes across at least 20 states. The network is managed by a Belarusian national with ties to both Minsk and Moscow. Unlike typical proxy services, DSLRoot uses dedicated hardware in American residences, creating persistent access to U.S.home networks. The company's custom software enables remote management of consumer modems and Android devices, allowing for IP address rotation and connectivity control. The network operates without authentication, permitting anonymous traffic routing through U.S.residential IPs. The operator also runs related services, including virtual credit card issuance and company formation, targeting both English and Russian-speaking markets. The discovery raises concerns about foreign-controlled infrastructure in sensitive locations, including military homes.
Healthcare Services Group data breach impacts 624,000 people
Source: https://www.bleepingcomputer.com/news/security/healthcare-services-group-data-breach-impacts-624-000-people/
New Sni5Gect Attack Crashes Phones and Downgrades 5G to 4G without Rogue Base Station
Source: https://thehackernews.com/2025/08/new-sni5gect-attack-crashes-phones-and.html
A sophisticated task scam cluster has been discovered, exploiting major brands like Delta Airlines, AMC Theatres, and Universal Studios. The scam uses API-driven templates and cryptocurrency payments, with over $1 million in attributable transactions. Victims are lured into 'earning' money by completing tasks such as booking flights. The scam requires initial cryptocurrency deposits to become a 'VIP' member. The infrastructure utilizes domains registered through Dominet, Alibaba Cloud's registrar, with a distinct registrant pattern. Multiple wallet addresses across different cryptocurrencies have been identified. The scam's configuration files reveal its adaptability across various brands and industries.
Farmers Insurance data breach impacts 1.1M people after Salesforce attack
Source: https://www.bleepingcomputer.com/news/security/farmers-insurance-data-breach-impacts-11m-people-after-salesforce-attack/
APT36, a Pakistan-based threat actor, is conducting a cyber-espionage campaign against Indian Government entities, targeting BOSS Linux systems with weaponized .desktop files. The group uses spear-phishing emails to deliver malicious payloads, exploiting the Linux environment to maintain persistent access and evade security controls. The campaign involves sophisticated tactics, including the use of custom malware, command and control servers, and data exfiltration techniques. The attackers leverage newly registered domains and employ various MITRE ATT&CK techniques to execute their operations. This activity demonstrates APT36's increasing sophistication and adaptability in targeting critical government infrastructure.
Pakistan-linked APT36 (Transparent Tribe) launched a new cyber-espionage campaign targeting Indian government and defense entities. Active in August 2025, the group used phishing ZIP files containing malicious Linux “.desktop” shortcuts that downloaded payloads from Google Drive.
The article discusses the evolution of cryptojacking, from its rise with Coinhive in 2017 to its apparent decline and subsequent resurgence in a more sophisticated form. A new campaign was discovered involving over 3,500 infected websites, using stealthy techniques to mine cryptocurrency without detection. The modern approach involves dropper scripts, environment checks, worker spawning, and C2 communication, prioritizing stealth over resource consumption. This new wave of cryptojacking attacks demonstrates the ongoing cat-and-mouse game between attackers and security measures, highlighting the need for continued vigilance in cybersecurity.
In a recent red team engagement, the client's attack surface was so well-defended that after months of effort, the only system we managed to compromise was a lone server, which was apparently isolated from the rest of the network. Or so we thought.
One developer had been using that server for remote development with Cursor. This setup is becoming increasingly popular: developers run AI agents remotely to protect their local machines.
But when we dug deeper into how Cursor works, we discovered something unsettling. By pivoting through the remote server, we could actually compromise the developer's local machine.
This wasn't a Cursor-specific flaw. The root cause lies in the Remote-SSH extension that Cursor inherits directly from VS Code. Which means the attack path we uncovered could extend across the entire VS Code remote development ecosystem, putting any developer who connects to an untrusted server at risk.
For the details, check out our [blog post](https://blog.calif.io/p/vibe-hacking-abusing-developer-trust). Comments are welcome! If you enjoy this kind of work, [we're hiring](https://calif.io/jobs)!
Threat actors are actively exploiting Microsoft 365's Direct Send feature to deliver phishing emails, bypassing perimeter security solutions by routing malicious messages through trusted infrastructure. This technique requires no credentials, only knowledge of the target domain and valid recipient addresses. The attack process involves identifying organizational domains, crafting emails impersonating internal users, and delivering them through Microsoft 365's infrastructure. Recent campaigns have successfully harvested credentials and established footholds within targeted environments. Attackers use automated tools to generate convincing business-themed lures, often utilizing PDF and DOCX attachments with QR codes or obfuscated HTML leading to phishing pages. The abuse of Direct Send represents a critical gap in email security defenses, particularly for organizations relying heavily on email communications.
Threat Actor Claims to Sell 15.8 Million Plain-Text PayPal Credentials
Source: https://hackread.com/threat-actor-selling-plain-text-paypal-credentials/
EncryptHub abuses Brave Support in new campaign exploiting MSC EvilTwin flaw
Source: https://securityaffairs.com/181203/cyber-crime/encrypthub-abuses-brave-support-in-new-campaign-exploiting-msc-eviltwin-flaw.html
A suspicious Python package named termncolor was discovered, which imports a malicious dependency called colorinal. This multi-stage malware operation leverages DLL sideloading to decrypt payloads, establish persistence, and conduct command-and-control communication, ultimately leading to remote code execution. The attack begins with the execution of terminate.dll, which decrypts and deploys two files: vcpktsvr.exe and libcef.dll. The malware achieves persistence through a registry entry and gathers system information. It communicates with a C2 server using Zulip traffic patterns for disguise. The threat actor's profile and activities on the Zulip platform were analyzed, revealing patterns in their tactics and behavior.
This report provides an in-depth analysis of VexTrio's traffic distribution system (TDS) infrastructure. It reveals their use of resilient, fault-tolerant systems spread across multiple hosting providers and data centers. Key components include DevOps tools like Terraform and Kubernetes, tracking software such as Binom, and cloaking capabilities. The analysis exposes VexTrio's reliance on content delivery networks (CDNs) as potential vulnerabilities. Their CDN domains rank among the top 10,000 most popular websites globally, highlighting the massive scale of their operations. The research aims to shed light on the inner workings of malicious adtech networks to spur further investigation into the industry.
# Summer cybersecurity news catch up
Paris Natural History Museum and hosting provider Francelink paralyzed, Google victim of an attack documented by their own services, urgent CISA directive for Exchange and 5 new KEV vulnerabilities, Microsoft Patch Tuesday with 111 vulnerabilities patched, Alltricks and Manpower compromised, Dell laptops hacked with vegetables 🤯, etc.
There are also some cool articles and cool tools.
Content in french but most of the articles are in english.
A JavaScript-based malware campaign has been discovered affecting compromised WordPress websites. The malware injects a fullscreen iframe that loads content from suspicious external domains, aiming to force users to view unsolicited content for ad fraud, traffic generation, or social engineering. The infection was found embedded in the WordPress wp_options database table, exploiting the WPCode plugin. The malicious script uses advanced evasion techniques like anti-debugging, function hijacking, and localStorage abuse. It selectively targets Windows users on specific browsers, displaying a fake Cloudflare CAPTCHA page that prompts users to run a suspicious PowerShell command. This attack not only intrudes on user experience but also poses significant security risks, potentially leading to system compromise and damage to website reputation.
A significant spike in brute-force traffic targeting Fortinet SSL VPNs was observed on August 3, with over 780 unique IPs triggering the Fortinet SSL VPN Bruteforcer tag. The activity was deliberate and precise, focusing on FortiOS. Two distinct waves of attacks were identified: a long-running set of brute-force activity and a sudden burst beginning August 5. The second wave shifted from targeting FortiOS to FortiManager - FGFM profile. Historical data revealed a potential residential origin or proxy use. The analysis suggests evolving attack patterns and potential reuse of tooling. Research indicates that such spikes often precede new vulnerability disclosures within six weeks. Defenders are advised to use GreyNoise to search for and block malicious IPs associated with this campaign.
How "helpful" AI assistants are accidentally destroying production systems - and what we're doing about it.
Source: https://profero.io/blog/new-attack-vector--ai-induced-destruction
