A new Android malware named Manic targeting users in multiple European countries has a fallback mechanism for exfiltrating data through nearby infected devices. The malware has been active since at least February and combines spyware, banking fraud, and remote control capabilities. It targets at least 169 banking, government/eID, payment, crypto wallet, messaging, and authenticator/2FA apps, with users in Ukraine being the primary focus. Mobile security company ThreatFabric analyzed the Manic malware and found that it uses transparent overlays on the numeric keypads of legitimate applications to capture victims' taps and reproduce them through Android Accessibility, allowing the legitimate applications to continue functioning normally. After obtaining Accessibility and notification access permissions, the malware can capture the lock PIN/password, intercept notifications and SMS messages, collect files and location data, monitor the screen, and provide remote control to operators via WebRTC sessions.
StopAndProtect turned nearly 2,000 hacked WordPress sites into a criminal network for malware delivery, data theft, surveillance and ransomware. Check Point Research uncovered a cybercrime operation, dubbed StopAndProtect, that has turned thousands of hacked WordPress websites into a shared platform for malware delivery, data theft, surveillance and ransomware. The operation is a good reminder that a compromised website isn’t just a problem for its owner. It can become part of someone else’s attack infrastructure. “StopAndProtect is a newly identified operation that combines file encryption with data theft. The criminals abuse thousands of hacked WordPress websites as their infrastructure – using them to spread the malware, control infected machines, and store stolen documents, screenshots, and activity logs (records created by malware to track its actions, progress, or status during execution).” reads the report published by Check Point. Researchers first identified the campaign in May 2026. The operation starts with a fake CAPTCHA based on the ClickFix technique: visitors are told to prove they’re human, but the instructions actually push them into copying and running a PowerShell command. From there, the infection unfolds through several downloaders and loaders before deploying different malware components. StopAndProtect uses a toolkit of different malware rather than a single strain. Its components can encrypt files, steal documents, lock screens and even provide attackers with a chat channel to communicate with victims. That last point is important because StopAndProtect doesn’t always behave like traditional ransomware. In many cases, the operators first collect file lists and then choose specific files to steal. Encryption or screen locking may come later, depending on what the attackers find and what they want to do with the victim.research. The criminals used compromised WordPress sites for several jobs at once. The sites hosted malware stages, delivered commands, received logs and stored stolen files. Check Point discovered this because one of the servers exposed a directory listing through a PHP script, revealing more files, logs and open folders than the operators probably intended. The campaign appears to have reached close to 2,000 compromised WordPress domains. Many of the sites were running old versions of WordPress or outdated plugins, and one site examined by researchers was still using a 2021 version with almost 40 known weaknesses, including SQL injection, authentication bypasses and arbitrary file upload issues. “In one scenario, we suspect that the malware operator infected themselves and accidentally uploaded some of their desktop files to the collection server. This archive contains the source code of an automation tool for managing injected payloads at scale on compromised WordPress sites.” continues the report. “It also contains a few text files listing close to 2,000 compromised WordPress domains, giving us a hint about the size of the operation.” continues the report. The infection chain is straightforward enough to understand, even if it becomes more complex after the first step. A visitor sees a fake CAPTCHA, follows the instructions, runs PowerShell, and downloads further stages written in .NET. The malware can then encrypt files, spread through SMB shares and USB devices, steal credentials, capture screenshots, collect selected documents or show a ransom message. “We first noticed a ransomware family called StopAndProtect in the middle of May 2026. Further analysis of the infrastructure reveals that the infection chain starts with a ClickFix social-engineering technique, which prompts victims to execute a PowerShell command. This leads to two stages of additional downloaders and loaders written in .NET, followed by several main functional components, such as ransomware, SMB/USB worm, LockScreen, VBS spreader, chat utility and credential stealer.” continues the report. “Although the name StopAndProtect was originally given to the ransomware component, we decided to call the whole operation StopAndProtect, as it does not deploy ransomware on all its victims. In many cases, the attackers silently exfiltrate lists of files and later specific files from the infected machines.” The operators also built tools to manage the infected websites at scale. Check Point found an automation utility that could upload and delete files, enable or disable fake CAPTCHA pages, change redirects and manage additional payloads across the compromised sites. It was written with Visual Basic 6, a technology old enough to have a pension plan, but apparently still useful when the job is mass-managing hacked servers. The campaign also collected a remarkable amount of victim information. From mid-May to the end of July 2026, researchers found more than 700 archives containing stolen files, passwords, wallet information, screenshots and activity logs. One exposed directory held more than 20,000 screenshot files, while the researchers collected roughly 31,000 screenshots during the monitoring period. Some of the captured images showed victims’ desktops, browser activity, antivirus windows, ransom messages and lists of encrypted files. The malware could also monitor WhatsApp activity, search for a contact name and capture the person’s details, including a phone number. That moves the campaign well beyond file encryption: it becomes a surveillance operation with a ransomware component attached.research. Check Point counted more than 6,000 unique IP addresses associated with the campaign by 24 July 2026. The largest groups came from the United States, Russia and India, although IP location does not necessarily identify the victims’ real location or the operators behind the operation. The WordPress side of the story is familiar. Sites are compromised because owners don’t update the core platform, plugins or themes, or because administrative accounts are protected badly. Once attackers obtain access, they can install hidden must-use plugins that load automatically and create file-upload functions capable of accepting PHP files, which may lead to remote code execution. For website owners, the basic response is still the right one: update WordPress and every plugin, remove anything unsupported, protect administrator accounts with strong passwords and multi-factor authentication, review installed plugins and check for unexpected PHP files or unfamiliar administrator accounts. Web server logs, outbound connections and recent file changes deserve particular attention if a site may have been compromised. For visitors, the warning is more specific. A CAPTCHA should not ask someone to open PowerShell, paste a command into a terminal or disable security controls. If a webpage tells you to leave the browser and run instructions on your computer, close it. The CAPTCHA isn’t testing whether you’re human. It’s testing whether you’ll do the attacker’s work for them. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, WordPress)
Cybersecurity researchers have disclosed details of a critical flaw in the Elementor Pro WordPress plugin that, if successfully exploited, could lead to remote code execution. The vulnerability, tracked as CVE-2026-32475, carries a CVSS score of 9.0 out of 10.0. It has been described as a case of unrestricted upload of a file with a dangerous type. "The flaw lives in the Forms module's File
In a large-scale campaign that researchers dubbed CameraSwarm, hackers compromised more than 14,500 Dahua IP cameras mostly in Ukraine and Russia. The operation ran for at least 35 days between June 17 and July 22, compromising devices by exploiting vulnerabilities, brute-forcing logins, and using offline recovery codes from serial numbers for cloud-registered cameras. Researchers at threat intelligence company Hunt.io discovered the campaign after finding a working directory on an HTTP server that the operator left unprotected. Hunt.io recovered 407 MB of data comprising 2,616 files across 234 directories, including source code, logs, credentials, captured camera images, shell history, and exploitation results, which helped them map an impressive operation. According to their findings, the 35-day CameraSwarm campaign compromised 14,530 Dahua IP cameras using three attack methods in parallel:
U.S. cybersecurity agencies warn that threat actors are using AI-generated scripts to exploit Siemens S7 Series programmable logic controllers (PLCs) in U.S. critical infrastructure. PLCs are industrial computers used to automate and control machinery and physical processes in factories and other critical infrastructure. The NSA, CISA, FBI, Department of Energy, and Environmental Protection Agency issued the joint advisory Wednesday, saying the attacks are ongoing. "This advisory relates to an active threat to Siemens S7 Series programmable logic controllers (PLCs)," reads the advisory. "However, ongoing PLC targeting activity is broader than Siemens PLCs. All PLC owners and operators should apply relevant mitigations to reduce the risk to their devices and systems." The critical infrastructure sectors most targeted include Critical Manufacturing, Energy, Water and Wastewater Systems, Chemical, Food and Agriculture, and Commercial Facilities. The agencies also note that Siemens S7 PLCs are used in the Defense Industrial Base, which could also be targeted.
Microsoft has reminded customers that systems running Home and Pro editions of Windows 11 24H2 will stop receiving updates in two months. "On October 13, 2026, Windows 11, version 24H2 Home and Pro editions, and Windows 10 Enterprise LTSB 2016 will reach end of updates," Microsoft warned in a message center update. "After this date, devices running these editions will no longer receive monthly security and non-security preview updates containing protections from the latest security threats." However, according to its support website, Windows 11 24H2 Enterprise and Education editions will remain under mainstream support until October 2027. Customers are advised to upgrade to Windows 11 25H2 (also known as the Windows 11 2025 Update), which has become generally available in September 2024 as a minor update installed through an enablement package.
Microsoft tracked over 30 MacSync Stealer domains by focusing on behavioral patterns, revealing a campaign targeting passwords, keys, wallets and other data. Domain blocking is a losing game when the thing you’re blocking can register a new domain faster than you can add it to a list. That’s the exact problem Microsoft Defender Experts ran into while tracking MacSync Stealer, a macOS-focused information stealer that RST Cloud first flagged for swapping out its command-and-control infrastructure almost immediately after getting publicly outed. Microsoft detailed how its experts stopped chasing individual domains and started tracking the behaviors that stayed constant underneath them. Instead of tracking individual domains, Microsoft looked at recurring request patterns, HTTP headers and other behaviors. This allowed its researchers to link more than 30 domains to the same campaign and determine that the infrastructure was doing more than just sending commands to infected Macs. It was also being used to collect, stage and exfiltrate stolen data. “MacSync Stealer is a macOS-focused information stealer that relies on changing infrastructure to deliver payloads, communicate with compromised devices, and exfiltrate data. Earlier reporting by RST Cloud identified the threat through a limited set of domains and documented rapid command-and-control (C2) replacement after public disclosure.” reads the report published by Microsoft. “Microsoft Defender Experts expanded that view by correlating recurring endpoints and network behaviors across the activity. This behavior-led approach connected more than 30 domains and showed that the infrastructure supported more than C2 communication, extending into active collection, staging, and exfiltration.” The infection chain starts with a trick rather than an exploit. Victims get social-engineered through a technique known as ClickFix, tricked into pasting or running commands directly in macOS Terminal, and once that shell session fires, curl pulls down attacker-controlled payload content from a path formatted as /curl/[token]. Then, native macOS tools decode and unpack the payload, and an AppleScript-driven layer takes over, blending Unix commands like sh, cp, rm, and killall with osascript calls that make the whole chain look more like ordinary system scripting than malware. Once active, the stealer focuses on valuable data. The malicious code looks for macOS Keychain data, saved browser passwords and cookies, SSH keys, AWS credentials, Kubernetes configurations and files in common user folders. It also searches for Ledger and Trezor wallet data, showing that the malware targets users with valuable credentials and assets rather than simply collecting random browser history. What actually confirms exfiltration, rather than just suspicious traffic, is the upload mechanism itself. Collected data gets staged under temporary paths, compressed into an archive, split into chunks, and pushed out through HTTP PUT requests carrying parameters like upload_id, chunk_index, and total_chunks. “The staged archive was uploaded through rotating infrastructure using curl and HTTP PUT requests. Observed requests included –data-binary, API-key headers, macOS User-Agent string, upload_id values, chunk_index values, and total_chunks parameters.” states Microsoft. “These upload traits confirmed active data exfiltration and provided durable hunting pivots even when domains rotated. “ The researchers pointed out that the exfiltration method stays recognizable even when the destination keeps changing. RST Cloud’s follow-up work backs up how consistent this infrastructure actually is under the surface. Using the same recurring URI patterns, RST Cloud surfaced eleven additional candidate domains and found a static API-key value shared across four confirmed command-and-control domains, even while the build token attached to each deployment kept rotating. A shared static key sitting inside otherwise rotating infrastructure is exactly the kind of detail that makes automated evasion look less impressive up close. The attack wraps up with cleanup, deleting temporary archives, staging folders, and lock files after the upload completes. Microsoft notes this reduces what’s left sitting on disk, but it doesn’t erase the behavioral sequence itself. “After exfiltration, the malware removed temporary archives, staging folders, lock files, and other artifacts. Although this cleanup reduced on-disk evidence, the sequence of archive creation, chunked upload, and deletion can still provide a useful behavioral correlation for defenders.” concludes Microsoft. For anyone defending Mac fleets, the practical takeaway here isn’t a list of domains to block, since that list will be stale within days. It’s building detection around the recurring shape of the attack itself: shell sessions spawning curl with those specific flag patterns, osascript chaining rapidly into network activity, and archives appearing under /tmp/sync* right before outbound PUT traffic starts. Chase the pattern, not the address, because the address was never going to sit still long enough to matter. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, malware)
Cybersecurity researchers have flagged a global cybercrime operation that abuses thousands of hacked WordPress websites as infrastructure to disseminate malware, commandeer infected hosts, store stolen documents, screenshots, and activity logs created to track the status of the activity. "The operation doesn't rely on a single piece of malware, but on a whole toolkit of criminal software
A JavaServer Pages (JSP) web shell deployed following the exploitation of a critical security flaw in PTC Windchill and FlexPLM servers is specifically designed for the enterprise Product Lifecycle Management (PLM) software, according to new findings from ReliaQuest. The cybersecurity company characterized the web shell as a fully equipped extortion platform capable of mapping sensitive vault
Researchers tested 31 million patterns to disrupt surveillance AI, with promising results but significant gaps between simulation and real-world use. The Kansas City-based cybersecurity researcher Bill Swearingen spent the past year doing something that sounds almost too simple to work: printing patterns, watching cameras fail to detect them, and repeating. TechCrunch reports that after roughly 31 million tests, he can now generate patterns on demand that block license plate readers and surveillance cameras from recognizing whatever the pattern covers, whether that’s a person or a vehicle. The project is called noRecognition, and the core idea isn’t stealth in the traditional sense. The camera still records everything just fine. What breaks is the detection layer sitting on top of the footage, the software that flags license plates, tracks faces, or spots “activity of interest” across thousands of hours of video. Swearingen’s patterns don’t hide you from the lens; they make the algorithm looking through that lens shrug and move on. Swearingen, co-founder of the SecKC meetup, said his project started for personal reasons. He became concerned about the growing number of surveillance cameras in his town and the possibility of being tracked while attending a protest. What started as a simple experiment later became a reinforcement learning system. He taught the model to create patterns, learn from failures and keep improving. Over time, it learned how to avoid detection by several camera systems. Every time a pattern failed and got detected, the system adjusted and tried again, eventually learning to defeat multiple detection algorithms simultaneously rather than just one at a time. The research dashboard behind the project, published at sandbox.norecognition.org, goes considerably deeper into the numbers than the headline claim suggests, and it’s refreshingly upfront about what’s proven versus what isn’t. The team states its overall objective plainly as “one pattern that defeats every detector,” and by their own account that goal remains only partially met. Their strongest validated result against a detector extracted directly from a real deployed surveillance camera sits at 61.7% non-detection across held-out test subjects, a solid number, but nowhere near total, and still a digital simulation rather than a real-world fabric test. That distinction matters more than it might seem. Most of the dashboard’s headline figures are explicitly labeled as digital, simulated results, meaning the pattern was tested against a virtual camera and printed ink model rather than an actual garment photographed by an actual camera in the field. The gap between “works in simulation” and “works when Donut Media wraps a real 2009 Toyota Yaris in it,” which is the physical test Swearingen ran live at DEF CON, is exactly the gap this kind of research has to close before anyone should treat it as a reliable, everyday privacy tool. “On Friday at the Def Con cybersecurity conference in Las Vegas, Swearingen ran his first real-world test. With help from Donut Media, the test involved covering a 2009 Toyota Yaris with one of Swearingen’s newest patterns to see if the car would be invisible to detection by a Flock camera.” reports TechCrunch. “We proved it was effective,” said Swearingen, though the wheels were a challenge. The video of the demo will be out in the next few weeks, said Donut Media.” That DEF CON demo is where things got concrete. Swearingen covered a car in one of his newest patterns and tested it against a Flock Safety camera, the kind widely deployed for automated license plate reading across the US. He said the test proved effective, though the vehicle’s wheels turned out to be a persistent weak point, curved surfaces apparently don’t cooperate with flat printed patterns the way a car door does. Source Tech Crunch – A photo of a 2009 Toyota Yaris at the Def Con conference in Las Vegas, covered in a pattern made by Bill Swearingen, as part of a test to see if it can defeat surveillance camera detection. Image Credits:Bill Swearingen / Donut Media Swearingen is not publishing his best patterns because he does not want camera makers to easily find and block them. Instead, he is using crowdfunding to develop and sell printed products such as T-shirts and hoodies, with vehicle wraps possibly coming later. It is still unclear whether the project will become a practical privacy tool for everyday users or remain mainly a DEF CON demonstration. Its real effectiveness will depend on how well the patterns work on real clothing, in different weather and camera conditions. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Surveillance camera)
Confirm this action.
Leaving now will discard your changes.