A fake browser update served over hijacked hotel Wi-Fi has been used to deliver CornFlake, a remote access trojan (RAT) that can capture webcam images, microphone audio, and keystrokes, Microsoft said in its latest report. Researchers track the operation as CaptiveCrunch and attribute it to Storm-2945. It assesses Storm-2945 to be an operational sub-cluster of Midnight Blizzard, also known as APT29 and Cozy Bear. The U.S. and U.K. governments attribute the broader actor to Russia's Foreign Intelligence Service (SVR). On the compromised networks ReliaQuest investigated, the captive portal gateway also served as the DNS resolver assigned to connected devices. Administrative control of that gateway let the attackers forge Domain Name System (DNS) answers and redirect the resulting traffic. They could then redirect a laptop's automatic connectivity check to a fake browser or operating system update.
North Korea's state hackers are no longer content to type prompts into public chatbots. One of the country's main espionage groups has begun running artificial intelligence (AI) offline on its own servers, connecting document-search tools to files in its possession, and collecting the software parts needed to build AI into its malware. South Korean security firm Genians says it uncovered the setup after months of tracking and log analysis on infrastructure tied to Kimsuky, a hacking unit under North Korea's Reconnaissance General Bureau. Genians found no evidence that the group had trained an AI model of its own, and the firm does not offer that as reassurance. It describes an actor in a "research and knowledge acquisition" stage, assembling and testing existing tools rather than making new models, with the apparent aim of folding AI through the operation, from writing malware to analyzing data.
The Computer Emergency Response Team of Ukraine (CERT-UA) has disclosed details of a new social engineering campaign orchestrated by Russian nation-state threat actors targeting IT workers in the country by masquerading as recruiters to trick them into installing malware. CERT-UA pinned the activity on a threat cluster it tracks as UAC-0145, which is a subgroup within Sandworm (aka APT44,
Microsoft released its monthly security updates on Tuesday, and one of the flaws it closed is already being used in attacks. The bug sits in a core Windows kernel driver that handles network socket operations. An attacker with code already running on a machine can use it to escalate to SYSTEM. That patch goes out first. The flaw is tracked as CVE-2026-68820 (CVSS score: 7.0) and is the only one in this month's release Microsoft flags as under active exploitation. Exploitation depends on triggering a race condition in the driver. Microsoft has not publicly attributed the exploitation. Check Point Research says Lazarus used the zero-day in its Operation Dream Job campaign. Four other flaws in the release need nothing at all from the victim: no account, no password, no click. They affect Windows DNS Server, Windows Deployment Services, Microsoft's implementation of the QUIC transport protocol, and High Performance Computing (HPC) Pack, and each carries a CVSS score of 9.8. None was flagged as exploited when the updates shipped.
North Korean hackers have been exploiting a Windows zero-day vulnerability (CVE-2026-68820) to target defense-sector companies as part of the Operation Dream Job campaign. Microsoft addressed the flaw in this month's Patch Tuesday security updates, marking it as actively exploited in the wild. Researchers found that the Lazarus threat group has been leveraging it since early July. Microsoft says that the vulnerability is a "use-after-free in Windows Ancillary Function Driver for WinSock (AFD.sys)" that allows an attacker to increase their local privileges. The tech giant added that a locally authenticated user could run a specially crafted application on an affected system to trigger a race condition, eventually gaining SYSTEM privileges without any user interaction. A recent wave of the long-standing Operation Dream Job campaign has been targeting defense, aerospace, and aviation organizations in Europe and India, using fraudulent recruitment offers to employees in target entities.
The North Korean threat actor known as Lazarus Group has been attributed to the zero-day exploitation of a newly patched security flaw impacting Microsoft Windows to deliver a never-before-seen backdoor targeting defense and aerospace companies across France, Germany, Brazil, and India. The activity, per Check Point Research, is part of Operation Dream Job, a long-running cyber espionage and
Lazarus targets defense professionals with fake Lockheed Martin jobs, exploiting a Windows zero-day to deploy backdoors and evade security controls. Check Point Research has uncovered a new wave of Operation Dream Job, the long-running North Korean campaign that lures defense and aerospace professionals with convincing fake job offers. This iteration is more dangerous than previous versions: it includes a previously unknown Windows vulnerability now patched as CVE-2026-68820, a newly documented backdoor called Troy, and command infrastructure built almost entirely from legitimate servers the attackers didn’t build, they hijacked them. Targets confirmed in France, Germany, Brazil, and India. “The attackers used a previously unknown vulnerability in Windows (CVE-2026-68820) to gain full control of infected computers and evade EDR visibility. Check Point reported the issue to Microsoft, which released a fix before this research was published” reads the report published by Check Point Research. “Rather than running their own servers, the attackers are hijacking legitimate but compromised websites and webmail servers to relay commands, making the malicious traffic harder to distinguish from normal activity” The vulnerability, CVE-2026-68820, is the same actively exploited zero-day that Microsoft patched on August 11 as part of Patch Tuesday, a privilege escalation flaw in AFD.sys, the kernel driver underlying Windows Sockets. Check Point reported the issue to Microsoft on July 28, Microsoft confirmed it three days later, and the fix shipped two weeks after that. The zero-day in this campaign and the zero-day under active exploitation are the same bug. The attack runs through two parallel infection chains. In the first, victims download an encrypted archive containing a legitimate signed PDF viewer and a malicious DLL. The DLL displays a convincing Lockheed Martin job description while silently loading MISTPEN, a lightweight downloader that communicates through Microsoft Graph API and OneDrive. MISTPEN then runs reconnaissance modules, triggers the AFD.sys exploit to achieve SYSTEM privileges, and deploys ForestTiger, a well-documented Lazarus backdoor, along with an updated version of the group’s kernel-mode rootkit, FudModule 3.1, which can now tamper with Windows Smart App Control to bypass software verification. “The second chain is more recent and shares several characteristics with a campaign described by ESET against the UAV sector in 2025. Victims are instructed to download SecurityPDF, a trojanized PDF viewer, from one of several websites impersonating Enveil, a legitimate privacy technology company with no actual connection to the attack. Once installed, the modified viewer inspects any PDF opened through it for a hidden marker.” continues the report. “When the marker is present, the application decrypts and launches an embedded payload that loads the Troy backdoor directly into memory.” Troy is a single DLL implant that supports 17 operator commands covering file operations, shell access, process termination, in-memory DLL injection, and configuration updates. Its name comes from a PDB path embedded in the binary that Check Point also observed in earlier Lazarus samples. Enveil has no connection to the campaign; its brand was simply borrowed because it sounds credible to defense sector professionals. The C2 infrastructure is built from compromised Roundcube webmail installations and WordPress sites, many vulnerable to CVE-2025-49113, infected with a previously undocumented PHP webshell called RelayShell. RelayShell functions as a relay rather than a traditional backdoor, exchanging commands and responses through simple text files. In at least one confirmed case, an already-breached French organization was used to send phishing messages to new victims — the attackers borrowed the company’s reputation to get past filters. Check Point identified at least 17 unique server identifiers in this relay network, with operators connecting through commercial VPNs to further obscure their location. The most urgent action is applying the August 2026 Patch Tuesday update, which contains the CVE-2026-68820 fix. For organizations running public-facing Roundcube or CMS installations, the secondary risk is becoming part of the relay infrastructure rather than the intended target: the servers used in this campaign were compromised through leaked credentials and a known unpatched vulnerability, not anything exotic. The full indicators of compromise are in Check Point’s report. “Given the combination of a zero day vulnerability that now have a patch, a new modular backdoor, and web based infrastructure designed to resemble legitimate traffic, security teams in these sectors should prioritize the August Patch Tuesday update, review the indicators of compromise published in Check Point Research publication, and apply the same level of scrutiny to unsolicited recruiting outreach that they would apply to any unverified download request.” concludes the report. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Lazarus)
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. Crooks Are Buying Your Expired Domains and Using Them to Deliver MalwareSAP Commerce Cloud CVE-2026-58231 Exploited in the WildmacOS Screen Sharing Flaw Exploited to Deploy Monero MinersGeoServer Zero-Day Is Already Being Probed. That’s the ProblemApple warned hundreds of users of mercenary spyware attacksAmnesiaStealer Gives Attackers Live Control of Victims’ macOS BrowsersChess.com Leak Exposes 7.3 Million Users – Evidence Points to ScrapingUS Authorizes Private Cyber Firms to Hack Transnational Criminal NetworksAdobe Commerce CVE-2026-71362 Comes Under Attack Shortly After Public DisclosureU.S. CISA adds Metabase, Windows, and Cisco Secure Firewall flaws to its Known Exploited Vulnerabilities catalogSharePoint CVE-2026-55040 Comes Under Attack Following Public ExploitStorm-1175 Replaces Medusa With New StormEncryptor RansomwareNorth Korean Lazarus Group Uses Windows Zero-Day in Operation Dream JobCEVA Logistics Cyberattack Disrupts European Warehouses and ShipmentsChina-Linked Hackers Use AI Agents in Autonomous Attack on TaiwanKimwolf v7 Hides DDoS Traffic Behind Chrome Fingerprints and EthereumShieldBreak: New Windows Zero-Day Bypasses Microsoft’s RoguePlanet PatchMicrosoft Patch Tuesday for August 2026 Fixed a Zero-Day and Wormable RCEZoom Patches “Zoomsday” Zero-Click Flaw Enabling Remote Code ExecutionExfilSquad Targets New Victims, Shares Data via TorrentsIran-Linked Hackers Target More US Water Infrastructure in New Jersey and AlabamaThe inconvenient truth about AI pentesting: someone has to check all the workCisco Warns of Seven ClamAV Flaws, Two With Public PoCsGym Booking Task Turns Into Real-World AI CyberattackU.S. Defense Manufacturer IEH Hit by Phishing Attack, Exposing Potentially Export-Controlled DataWebmail CSS Attacks Expose a New Risk for AI-Powered Email Tools International Press – Newsletter Cybercrime ExfilSquad Targets New Victims, Shares Data via Torrents Israeli population registry for sale, but the data is old Before Fraud Transacts ExfilSquad Targets New Victims, Shares Data via Torrents Fake CAPTCHA, Real Business: Traffic Distribution for Hire 7.3M chess.com records leaked, and the data is real Drop Something? Don’t Worry, Someone Caught it Malware ShieldBreak – August 2026 disclosure Kimwolf v7: An Evolution of the Kimwolf Botnet AmnesiaStealer: a multi-stage Rust-based macOS infostealer that hijacks Chromium browsers Gone with the WindRelay: A New Malware Combo Behind a Growing Fraud Scheme 737 Chrome VPN Extensions Linked to Brand Impersonation and Browser Traffic Redirection Hacking Chinese Model Kimi K3 Breaks UK AI Safety Institute Benchmark Evaluations AI assistant hacks gym website in first known Australian autonomous cyber attack Zoomsday Attackers Exploit SharePoint Authentication Bypass After Public PoC Release Hackers exploit macOS Screen Sharing flaw to deploy Monero miner It’s a pre-auth, stupid! A root remote command execution on macOS with M5 in 2026? Intelligence and Information Warfare Follow-Up Analysis of the 29 December 2025 Energy Sector Incident New Jersey, Alabama Join States Targeted in Water Cyberattacks Kimsuky Integrates AI into Attack Operations, From AI-Generated Decoy Documents to a Local LLM China-linked hackers hit Taiwan in unprecedented ‘autonomous’ AI cyber attack State Sponsored Hackers Use Fake Job Offers to Deliver New Zero Day Exploit Social engineering performed by UAC-0145: compromising in the employment process Jewelbug: APT Group Runs Espionage and Crypto Fraud Operations Side by Side PATCHCORD: New malware cluster targets Afghan telecom and South Asian critical infrastructure APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit North Korean Remote Workers Are Infiltrating Government and Businesses: How to Expose Them Before Hiring How Tehran’s Use of Cyber Operations in the U.S.-Iran Conflict Has Evolved Cybersecurity How a small Israeli startup was linked to rogue AI hacks at OpenAI, Anthropic and Meta Responding to the next frontier of critical cyber capabilities Facebook is paying controversial creators to produce rage-bait content Cisco Warns of High-Severity ClamAV Vulnerabilities With Public PoC The August 2026 Security Update Review Cyberattack on logistics giant CEVA delivers customer data into the wrong hands About Apple threat notifications and protecting against mercenary spyware If Apple sends you a push notification alerting you to a spyware attack, take it seriously AI isn’t changing how companies work. It’s changing what a company is Swarms of OpenAI systems set up their own chatrooms to discuss and carry out hacks, company reveals Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Kimsuky Integrates AI into Attack Operations, From AI-Generated Decoy Documents to a Local LLM ShieldBreak – August 2026 disclosure Kimwolf v7: An Evolution of the Kimwolf Botnet CISA, FBI and Partners Warn Organizations of Gunra Ransomware Actors Targeting Multiple Critical Infrastructure Sectors China-Linked Hackers Deploy New StormEncryptor Ransomware, Likely via N-central Flaw AmnesiaStealer: a multi-stage Rust-based macOS infostealer that hijacks Chromium browsers Gone with the WindRelay: A New Malware Combo Behind a Growing Fraud Scheme PATCHCORD: New malware cluster targets Afghan telecom and South Asian critical infrastructure 737 Chrome VPN Extensions Linked to Brand Impersonation and Browser Traffic Redirection Concept Drift Detection and Adaptive Retraining of Malware Classification Models A Comparison of Malware Image Transformations Using Grad-CAM and Hybrid Learning Models C-GUARD: Context-Adaptive Conformal Gating for Improving Robustness Against Evasive Windows PE Malware An Explainable Deep Learning Pipeline for Malware Family Classification: GAF Image Encoding and API-Grounded LLM Interpretation APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
Google tracks three Russia-linked espionage clusters using phishing and legitimate authentication tools to target researchers, diplomats and defense staff. Google’s Threat Intelligence Group tracked three separate suspected Russia-linked cyber espionage clusters. All three focus on the same thing: abusing authentication features that are supposed to protect accounts to access them instead. Threat actors target researchers, academics, government officials, think-tank analysts, and defense sector personnel across Europe and the United States. The three clusters are tracked as UNC6293, UNC7005, and UNC5976, and while they operate differently and with different tools, Google published them together for a reason. “These clusters engage in persistent, adaptive phishing campaigns, using sophisticated social engineering tactics to compromise personal accounts across multiple platforms.” reads the report published by GTIG. “Because these operations abuse legitimate authentication flows which may not immediately seem like phishing attempts to users, GTIG is raising awareness about these social engineering campaigns targeting individuals so that targets can more readily recognize malicious outreach.” UNC6293 is the oldest of the three and the most precisely attributed. Google assesses with moderate confidence that it’s a sub-cluster of ICE RELIC, the group also tracked as APT29, responsible for initial access operations. Its operations are narrow by design: typically fewer than five targets at a time, with themes built around diplomatic events and upcoming conferences. Since it was first documented in June 2025, UNC6293 has consistently impersonated US State Department officials to run app password phishing. The technique is simple but effective. The attacker convinces a target to set a specific app password on their account, one that the attacker already knows, and then uses it to log in without triggering two-factor authentication. By October 2025, UNC6293 was still reusing screenshots from its June phishing lures, including the ms.state.gov reference, while only changing the surrounding text. By June 2026, the group had added OAuth phishing. After logging in to a legitimate service, victims were asked to share a URL or “verification code,” allowing attackers to obtain valid access tokens. The trick works because the login itself is legitimate, while the attackers hide the malicious step elsewhere. UNC7005, tracked by Microsoft as STORM-2945, is a related but separate cluster first identified in February 2026. Google assesses it’s also connected to ICE RELIC, but notes it operates with lower technical sophistication and worse operational security than UNC6293. It compensates with a wider toolkit. UNC7005 runs app password phishing, device code phishing against both Microsoft and WhatsApp, malware distribution, and OAuth phishing operations, sometimes in the same month. “UNC7005 also conducts device code phishing operations for both Microsoft and WhatsApp accounts.” continues the report. “The themes of these phishing waves often involve invitations for calls with individuals from notable organizations related to the target’s field or, most recently, invitations to diplomatic events and conferences. “ The GLOBSEC conference spoof is a useful illustration of how UNC7005 works. The actor built a landing page mimicking an invitation to the legitimate GLOBSEC forum in May 2026, collected detailed registration information from targets including, not for the first time in ICE RELIC-linked operations, a wine selection for a fictional dinner, and then presented a Microsoft device code for the target to enter. The registration form still contained a reference to “Embassy security policy” rather than GLOBSEC, a leftover from the previous lure template that the actor hadn’t cleaned up. When Google flagged the page quickly, UNC7005 revised the template within days, citing “technical difficulties” to explain the change to anyone still watching. UNC7005 also used WhatsApp phishing pages to trick victims into linking their accounts to an attacker-controlled device. The fake pages offered options such as joining a call, opening an encrypted chat or downloading a file. If victims chose the call option, malicious JavaScript asked for microphone and camera access, recorded them, and sent the footage to the attackers. In late May 2026, UNC7005 ran a broader phishing wave targeting US-based academics, diplomats, and Russia researchers. The lure was a fake “Summit Companion App” to read a document supporting Ukraine. “In May and June 2026, UNC7005 conducted social engineering operations spoofing WhatsApp. The phishing pages distributed by the attacker lure targets into linking their WhatsApp accounts with an attacker controlled device in order to join a secure WhatsApp call, chat, or document share.” states the report. “The attacker also attempts multiple other methods of compromise after the device is linked.” Windows users who downloaded it received VIDAR, an off-the-shelf infostealer sold as a service that pulls saved credentials, cookies, and payment data from browsers. Mac users received ATOMIC, also known as AtomicStealer, a macOS infostealer operating the same business model. Neither is custom tooling. The actor’s email address in this operation was nearly identical to one used by UNC6293 a year earlier. The hospitality captive portal campaign, previously reported by Reliaquest and Microsoft and attributed to Midnight Blizzard, connects directly to UNC7005. Google traces the infrastructure back to April 2026: domains spoofing Microsoft authentication resources, which Google added to Safe Browsing blocklists as they appeared. By mid-July 2026, those same domains were receiving redirects from captive portals at hotels and conference centers. The IP resolution trail links the captive portal infrastructure to the GLOBSEC device code phishing operation and to ENGINELIGHT, a Go-based malware used in a separate limited UNC7005 operation in May 2026. CHERRYPIE, also known as ChocoShell, is a PowerShell infostealer that adds another interesting detail. Google found comments and code references that appear consistent with AI-generated code, suggesting the attackers may be using an LLM to develop malware. The data it targets overlaps with the commercial infostealers already used by UNC7005, leading Google to suspect that CHERRYPIE could be a customized version of a malware-as-a-service tool. UNC5976 is the third cluster and the most distinct. It focuses on military, aerospace, defense industrial base, and NGO targets, concentrating geographically on Ukraine and Armenia. Instead of residential proxies for post-compromise access, as UNC6293 and UNC7005 use, it runs dedicated infrastructure. Its OAuth phishing is more automated: the actor registers file-sharing-themed domains, creates Google Cloud projects behind them, and uses cloud-hosted scripts to collect authentication tokens from targets who log in through what looks like a Google sign-in prompt on a fake file-sharing page. Within three months of Google disrupting this infrastructure, UNC5976 had built at least twelve new domains and was already migrating toward non-Google hosting providers. In April 2026, UNC5976 also distributed HEADRUSH, a malicious Excel plugin, through a domain impersonating a Ukrainian research institute, potentially targeting a Ukrainian aerospace and imaging company. HEADRUSH eventually leads to an HTA downloader, though Google wasn’t able to recover the full infection chain. The defender challenge that runs through all three clusters is the same one Google names directly. ” The accounts these groups target are often personal, rather than corporate domain-joined accounts, creating a visibility gap for monitoring compromise from an organizational perspective. The likely use of encrypted messenger applications instead of email for initial outreach also presents a challenge to defenders hoping to track and remediate abuse.” concludes the report. “The combination of these tactics not only enables the attacker to conduct quick-turnaround exfiltration operations, but also presents opportunities for the attacker to further phish targets of interest from compromised, legitimate accounts. “ Security teams watching corporate email and endpoint telemetry won’t see the initial contact. By the time a compromised personal account starts being used to phish the target’s contacts, the original access event is already cold. Google’s practical guidance for individuals: don’t set app passwords for anyone who asks, revoke existing ones you don’t recognize, check WhatsApp’s linked devices list, and treat any OAuth authorization prompt from an unsolicited message as suspicious regardless of how polished the surrounding page looks. High-risk individuals should consider Google’s Advanced Protection Program, which blocks app password creation entirely. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Russia)
Confirm this action.
Leaving now will discard your changes.