A fake cryptocurrency trading app called Padre Terminal, previously available on the Apple App Store for iOS devices, has been linked to the theft of approximately $23,000 from 27 Solana wallets. Blockchain investigator Iris confirmed that one victim was compromised through the malicious App Store app, but has not determined how the other affected wallets were compromised. The researcher says the app drains wallets after unsuspecting users import their private keys into it. Padre was a cryptocurrency trading platform, mainly used to buy and sell meme coins on Solana. It was later renamed Terminal by pump.fun, a platform focused on creating, buying, and selling cryptocurrency “meme coins” on the Solana blockchain. Iris says the legitimate Padre trading service, now Terminal by pump.fun, is web-only, so any mobile apps impersonating it, including the one previously available on the App Store, are malicious.
A massive search-hijacking campaign involving 319 Chrome extensions with a combined 13.4 million reported installations redirected users' searches through tracking servers to generate advertising revenue from Bing and Yahoo. A new report by Socket's John Tuckner expands on the researcher's April 2025 discovery of 57 Chrome extensions with 6 million users, adding 264 newly identified add-ons with another 8.7 million users. "These extensions were created by a handful of organized operators all working from the same idea: quietly take over the browser's default search engine, route every query through a suspicious proxy server, and collect partner referral payments from Yahoo or Bing under a syndication partner ID," explained Tuckner. The extensions, with the full list shared at the bottom of Socket's report, pretend to be PDF converters, manual finders, safe search, and AI search tools. However, for the most part, the extensions simply redirect users' searches through a series of sites until they land on Bing or Yahoo.
AI agents can control authenticated browsers, interact with corporate applications, and access sensitive data while appearing to act as legitimate employees. Keep Aware examines three ways agents operate inside browsers and why traditional security tools may struggle to distinguish their activity from human users.
US election websites show improved security, but weak email protection, non-.gov domains and third-party tracking still expose voters to risks. Millions of Americans will use websites to check their registration, find polling places or track ballots before the November 3 election. However, a new study finds that many county election websites still have security weaknesses involving domain names, email authentication, encrypted connections and third-party tracking. Mysterium VPN’s 2026 County Election Website Security Census examines 2,081 county election websites across the United States. “42% of county election websites aren’t on .gov (869 of 2,081 identified). That’s down from 57% in 2024.” states the report. “Weighted by population, it’s 28% because the big counties moved first.” That’s an improvement from 57% in the company’s 2024 census. However, the findings reveal persistent weaknesses that could expose voters to impersonation, misleading websites and unnecessary data collection. These findings concern public information websites and their contact domains. They do not establish that voting machines, ballot-counting systems or election results have been compromised. The researchers started with 3,144 US counties and county equivalents but identified county-run election information pages for 2,081. Of these, 869 used domains outside .gov. Only verified US government organizations can register a .gov domain, making it a useful way for voters to identify official government websites. The study found that larger counties had made more progress: when weighted by population, 28% of residents lived in counties whose election pages used non-.gov domains. Texas accounted for 169 non-.gov sites, including 134 using the older co.<county>.tx.us structure. Arizona and Nebraska had no identified non-.gov county election sites. The FBI and CISA previously warned that criminals were using fake election websites to spread false information and collect personal data. Moving to .gov and redirecting older addresses can reduce confusion, although the domain alone cannot guarantee that every aspect of a website is secure. Election offices communicate with voters about registration, identification requirements and missing ballots. Weak email authentication can make it easier for attackers to impersonate these offices. Of 1,977 readable election pages, 965 displayed a contact address. After excluding consumer email services, researchers examined 942 county-controlled domains. “Of the 1,977 election pages whose content we could read, 965 display a contact address. Twenty-three of those are at consumer providers like Gmail. As in 2024, we set them aside, because Gmail’s security policy is Gmail’s, not the county’s.” states the report. “That leaves 942 county-controlled election email domains.” The study reported that 23% had no DMARC record, while 28% used p=none, a monitoring-only policy that does not request quarantine or rejection of unauthenticated messages. Another 30% requested quarantine and 19% rejection. Together, the first two groups account for roughly 51% of domains without an enforced DMARC policy. The report’s underlying counts total 941 rather than the stated 942, a discrepancy that requires clarification. The share of domains without DMARC fell from 41% in 2024 to 23% in 2026. SPF, another email authentication mechanism, was present on 98% of checked domains. Smaller counties performed worse. Among the third of counties with the fewest residents, 34% of election contact domains lacked DMARC, compared with 12% among the largest counties. Non-.gov domains also showed weaker protection: 32% lacked DMARC, compared with 16% of .gov domains. These findings indicate an association, not proof that adopting .gov automatically improves email security. DMARC enforcement can reduce certain forms of domain spoofing, but it cannot prevent every impersonation attempt, lookalike domain or attack involving compromised accounts. The researchers found 28 websites with consistent HTTPS failures among the 2,081 tested. Fifteen lacked a working HTTPS service, seven presented certificates for the wrong domain, and others had expired or untrusted certificates or failed to establish a secure connection. Another 178 websites would serve election pages over unencrypted HTTP if visitors requested them that way. Only 34% sent an HSTS header, which instructs compatible browsers to insist on encrypted connections. Sixty-three certificates were due to expire within 30 days of Election Day. A separate test examined third-party connections when election pages loaded in a clean browser, without clicks or scrolling. Of 1,930 measured pages, 84% contacted at least one company identified as a tracker by Disconnect or DuckDuckGo. The median page contacted six third-party domains. Google Analytics or Tag Manager appeared on 60% of websites, while Meta Pixel appeared on 3%. Mysterium suggests that some tracking results from default settings in website platforms rather than deliberate decisions by election officials. The presence of third-party code does not, by itself, establish unlawful tracking or prove exactly what information was collected. Still, counties should review whether these connections are necessary on pages designed to provide basic voting information. The study examined recognizable election-related domain names across several extensions, including .gov, .com, .org, .net, .us and .vote. Researchers identified 2,074 matching names that resolved to an address. Of these, 121 were registered outside government control. Thirty-eight hosted unrelated websites, eight were offered for sale, 73 displayed basic server or hosting pages, and two served gambling or spam content. The researchers also found 73 counties with a working .gov version of the name used by their non-.gov election website, suggesting that some had secured the official address without completing the migration. A separate test generated 14,456 single-character misspellings of 77 state and large-county election domains. Researchers found 245 registered variants and identified 26 that served parked, placeholder or unrelated pages after excluding potentially coincidental matches. The study does not establish that these registrations were malicious or identify their owners. However, a voter who mistypes an address or guesses the wrong domain ending could reach a third-party website instead of an official source. Across the seven states that decided the 2024 presidential election, 43% of identified county election websites were outside .gov, down from 55% in 2024. In these states, 26% of election contact domains lacked DMARC, compared with 39% two years earlier. However, 55% still lacked an enforced policy. The nine states whose 2026 Senate races were rated toss-up or lean in mid-October showed similar concerns: 53% of identified county election sites were outside .gov, while 44% of election contact domains lacked enforced DMARC. These figures measure website and email configurations. They are not evidence that an election has been compromised. Mysterium recommends that eligible government organizations complete the move to .gov, redirect old addresses, enforce email authentication policies and configure HTTP-to-HTTPS redirects and HSTS. Counties should inventory legitimate email senders before tightening DMARC policies to avoid disrupting valid communications. They should also review advertising pixels and unnecessary third-party connections, monitor certificate expiration dates and consider registering defensive versions of their domains. For voters, the report recommends starting with the state election office listed on USA.gov and following its link to the relevant county website. Voters should avoid trusting unsolicited messages or plausible-looking search results without checking the destination. If an election-office email comes from an unexpected address, voters should verify it using an independently obtained official telephone number. An unusual address is a reason to check, not proof of fraud, since the study found that some legitimate offices still use consumer email services. The researchers combined Census Bureau county data with official websites recorded in Wikidata and checked them against CISA’s .gov registry. They tested displayed contact addresses, email authentication records, certificates, redirects, tracking requests and lookalike domains. The study identified 2,081 election pages, compared with 2,913 in the 2024 manual survey. Automated discovery favored larger counties with better-structured websites, leaving smaller counties underrepresented even though some had weaker protections. The comparisons indicate progress but are not a perfectly matched before-and-after assessment. Different tests also used different sample sizes, and the tracking analysis measured a single page load from one location. The observations reflect October 17, 2026, rather than continuous monitoring. The findings provide a useful snapshot of public-facing election website security, but individual results should be rechecked before drawing conclusions about a specific county. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Election Website)
ENGIE says attackers accessed French customers’ contact and energy contract data through a partner sales tool. Banking data was not affected. French multinational energy company ENGIE warned customers in France that attackers accessed personal information through a sales tool used by some business partners. The exposed data includes contact details and energy contract information that could help fraudsters impersonate the supplier. The company says its internal IT systems weren’t compromised and banking information wasn’t affected. It has blocked the attackers’ access, notified the relevant authorities and contacted affected customers, according to a spokesperson who spoke to BleepingComputer. According to notification emails sent to affected customers, the incident involved a tool used by partners to sell the company’s electricity and natural gas offers. The notification confirms that attackers gained unauthorized access to personal information stored in the sales tool. “We are informing you that an act of cyber-malice recently affected a tool used by some of our partners to market energy offers. As part of this incident, unauthorized access to your personal data was identified.” reads the notification. The compromised information includes customers’ names, postal addresses, email addresses, telephone numbers, customer IDs, contract numbers and energy supply identifiers. The company hasn’t disclosed the partner or platform involved. It also hasn’t revealed how many customers were affected, when the intrusion began, or when it was discovered. For electricity customers, these include the delivery point identifier (PDL). For gas customers, they include the metering and estimation point (PCE). ENGIE says financial information wasn’t affected and that its investigation indicates the exposure was limited to contact details and certain contract information. That reduces one category of risk but doesn’t eliminate financial fraud. Attackers can use accurate customer information to persuade victims to disclose additional data or make payments. Anyway, the exposed data could support impersonation scams. The company warned customers to watch for attempts to obtain further information or induce payments. A contract number, however, doesn’t prove that a caller is legitimate. It may simply show that the person has access to an exposed record. Customers should verify unexpected requests through trusted channels, even when the sender knows their personal details. ENGIE hasn’t attributed the attack to a specific group, and at this time no ransomware group has claimed responsibility for the attack. Experts recommend visiting ENGIE’s official website or app directly instead of signing in through links received by email. Customers should also be cautious with unexpected calls and messages. If someone requests a payment, password or additional personal information, they should end the exchange and verify the request using independently obtained official contact details. Customers should never share SMS verification codes, passwords or banking details with someone who contacts them unexpectedly. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, data breach)
The FBI seized Virtualine, a hosting service accused of supporting criminal sites, ignoring abuse reports and helping launder money from illegal activities The FBI seized the website of Virtualine, a hosting service that sold its services to criminals. The seized domain is virtualine.net, and the government says the site was used to commit and facilitate prolific criminal activity. That includes the advertisement of sexually explicit images of minors, the intentional disclosure of nonconsensual intimate images of adults and minors, and international money laundering. A court authorized the seizure. “Theophani K. Stamos, First Assistant U.S. Attorney for the Eastern District of Virginia, and Darren B. Cox, Assistant Director in Charge of the FBI Washington Field Office, announced today the seizure of the website virtualine.net after it was used to commit and facilitate prolific criminal activity, including the advertisement of sexually explicit images of minors, the intentional disclosure of nonconsensual intimate visual depictions of adults and minors, and international money laundering designed to conceal and promote criminal conduct.” The Justice Department has the details in a press release. Virtualine, also known as Secury, Massgod, Spamhouse, Lanedo and Omegatech, offers “bulletproof” hosting. It sells hosting, servers and domain names to customers who want a provider that ignores abuse complaints. It promotes its services on cybercrime forums. Court records include examples of those ads. In September 2024, Virtualine told an Exploit.in user that it allowed illegal activities such as phishing, payment card fraud, email spam and port scanning, but banned child sexual abuse material and terrorism-related content. In June 2025, it boasted on HackForums that it ignored more abuse than three therapists combined. In March 2026, Virtualine promoted an “additional protection plan” for customers, offered after the company received an official request from law enforcement. Under the plan, it would move the customer’s criminal infrastructure to another shell company unaffiliated with Virtualine, and then reactivate the server. It was a game of musical shell companies. “In March 2026, Virtualine advertised its “additional protection plan,” which it offered to its customers after “receiv[ing] an official request from law enforcement agencies.” Under this plan, Virtualine would move the customer’s criminal infrastructure to “another shell company not affiliated with Virtualine, after which the server is reactivated.”” continues the press release.”As Virtualine advertised to users on the platform HackForums in June 2025, “Virtualine ignored more abuse than your last three therapists.”” Despite saying it bans child content, the government says Virtualine knowingly hosted a website that carried it. Court records call that site Vendor 1. It’s a criminal online forum where users post and sell access to nude, sexually suggestive or sexually explicit images and videos of minors and adults, and it also promotes a hack-for-hire service in which people pay hackers to get into victims’ online accounts without consent and take explicit images and videos. In January 2026, about a month after assigning Vendor 1 an IP address, Virtualine began receiving reports of child sexual abuse images and videos on the server. The reports came from police in Germany, Canada and Australia, the US National Center for Missing and Exploited Children (NCMEC), and a victim’s lawyer. According to the government, Virtualine continued hosting Vendor 1 despite those warnings. The government also says Virtualine helped Vendor 1 build a new website. It allowed users to upload illegal material and download it after paying. The site accepted several payment methods, including an option called “BTC [NO-AML].” It used bitcoin addresses outside a hosted payment service, allowing customers to pay directly and avoid that service’s checks for illegal funds. Authorities say some payments came directly from criminal groups. They accuse Virtualine of accepting the money and moving it through further transactions to hide its source. The FBI’s Washington Field Office led the investigation, with significant help from Germany’s Polizei Hessen, the Netherlands’ Politie Midden-Nederland, the U.K.’s National Crime Agency, and private partners OverRIPE and Lumen. The Justice Department’s Office of International Affairs also assisted. Assistant U.S. Attorneys Laura D. Withers and Stefanie A. Schwartz represent the government. A domain seizure doesn’t end the problem, and the government says so in plain terms. The new website Virtualine built with Vendor 1 has already drawn at least one abuse complaint about sexually explicit images of children, and the release adds: Virtualine hosts this new website to this day. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Virtualine)
Artem Stryzhak gets 70 months in prison for Hive and Nefilim ransomware attacks, while the FBI offers $11 million for his alleged co-conspirator. A federal court in Brooklyn has sentenced Artem Stryzhak, a Ukrainian national, to 70 months in prison for using ransomware to extort millions of dollars from victims. The U.S. Attorney’s Office for the Eastern District of New York announced it in a press release, and it also says an $11 million reward remains for a co-conspirator who’s still at large. “Earlier today, in federal court in Brooklyn, Artem Stryzhak, a Ukrainian national, was sentenced by United States District Judge Pamela K. Chen to 70 months in prison for using ransomware to extort millions of dollars from victims.” reads the DoJ’s press release. “The defendant pled guilty in December 2025 to conspiracy to commit fraud, extortion, and related activity in connection with computers. “ In December, Artem Aleksandrovych Stryzhak pleaded guilty in the U.S. for Nefilim ransomware attacks. The Ukrainian citizen was arrested in Spain in 2024 and extradited to the US in April 2025. He pleaded guilty to conspiracy to commit computer fraud, extortion, and related activity Nefilim ransomware was used to encrypt networks worldwide, including in the Eastern District of New York, causing millions in losses from ransom payments and system damage. Attackers employed a customized ransomware executable in each attack, generating unique decryption keys and tailored ransom notes for victims. In June 2021, Nefilim administrators granted Artem Stryzhak access to the ransomware code in exchange for 20% of his ransom proceeds, which he deployed via his account on the administrators’ online platform. Stryzhak and co-conspirators researched victims using online databases to collect information on their net worth, size, and contacts. After gaining network access, they stole data to pressure companies into ransom payments. Nefilim notes warned that stolen data would be posted on publicly accessible “Corporate Leaks” sites maintained by the administrators if victims did not comply. Volodymyr Tymoshchuk, Stryzhak’s co-defendant and Nefilim admin, is a serial ransomware cybercriminal who is still at large. According to court documents, his first role was with Nefilim. Starting around June 2021, he joined the ongoing Nefilim conspiracy as an affiliate and got access to the ransomware. In exchange, he agreed with one of the group’s administrators, Volodymyr Tymoshchuk, to pay the administrators 20 percent of the ransom proceeds. Even crime has licensing fees. One of those attacks came in June 2021, when Stryzhak stole data from a company in the oil and gas transportation industry. About a week later, he created email addresses that went into a ransom note sent to the victim. He kept deploying Nefilim ransomware through at least October 2021. Separately, he also joined the Hive ransomware group as one of its earliest affiliates. From June 2021 to January 2023, Hive’s conspirators attacked about 1,500 victims worldwide, including government entities, hospitals and businesses. The attacks caused major disruption to daily operations around the world and affected responses to the COVID-19 pandemic. One hospital had to give up digital technology to treat its patients and couldn’t take in new ones right after the attack. As a Hive affiliate, Stryzhak and his co-conspirators hit seven victims, including law firms, a dentist’s office and a healthcare provider, during the pandemic. Those victims couldn’t get to their encrypted data. The FBI, as part of a months-long effort to disrupt Hive, gave a decryption key to one of Stryzhak’s victims, so that victim recovered its data without paying a ransom. U.S. Attorney Joseph Nocella, Jr. thanked the FBI’s New York Field Office, the Justice Department’s Office of International Affairs and its Computer Crime and Intellectual Property Section, and Spanish law enforcement for helping to capture him. “Ransomware attacks like those committed by the defendant wreak enormous havoc—harming victim companies that pay millions in remediation and ransoms, preventing hospitals and other critical facilities from accessing data, and putting sensitive information in the hands of bad actors,” stated United States Attorney Nocella. “Today’s sentence reflects that cybercriminals cannot hide from law enforcement and will face significant punishment for their criminal conduct. We remain determined to capture Volodymyr Tymoshchuk, a serial ransomware developer and Stryzhak’s co-conspirator.” The State Department’s Transnational Organized Crime Rewards Program is offering up to $11 million for information that leads to the arrest, conviction or location of Tymoshchuk. Anyone with information can call the FBI at +1-917-242-1407 or email TymoTips@fbi.gov, contact a local field office if in the United States, or reach the nearest U.S. Embassy if overseas. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
Unit 42 explores key peak shopping season retail cyber threats, from ransomware to AI attacks, and shares how to defend operations and customer trust. The post Unwrapping Retail Peak Season Cyber Threats appeared first on Unit 42.
Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, including for zero-day attacks targeting high-value systems. The framework has been dubbed Silent Train because the threat actor uses it against select targets, cleans it up after each operation, and refreshes it continuously. Researchers at Black Lotus Labs, the threat research division of communications company Lumen, have been tracking Silent Train for three years and confirmed that Volt Typhoon exploited at least four zero-day vulnerabilities in attacks targeting edge and management infrastructure. Targets include telecommunication firms, government agencies, defense contractors, educational institutes, utilities/critical infrastructure, satellite service providers, IT firms, MSPs, transportation, aviation, and emergency services.
Microsoft again asked Entra ID administrators to migrate users to phishing-resistant methods to avoid sign-in disruptions before it retires SMS and voice authentication in February 2027. This retirement process applies only to Microsoft Entra ID workforce tenant authentication scenarios and not to Azure AD B2C or Microsoft Entra External ID customer identity scenarios. Before Microsoft retires SMS and voice authentication, admins should ensure all users in their organizations use a phishing-resistant method, since they will no longer be able to use them to complete multifactor authentication and log in to their accounts. Admins can choose from passkeys, QR code authentication, FIDO2 security keys, and other Entra ID-supported sign-in methods. "Microsoft-provided SMS and voice authentication will retire starting February 1, 2027. Complete your migration before rollout begins to avoid interrupting users' sign-in experience," Microsoft said in a Microsoft 365 Message Center update on Tuesday.
Confirm this action.
Leaving now will discard your changes.