Cybersecurity researchers have discovered a set of trojanized npm packages that masquerade as working calendar and streak utilities but are engineered to stealthily deliver an artificial intelligence (AI)-powered Linux implant dubbed RedC2 4.0. "When the module loads, it locates the bundled binary, marks it executable, and launches it as a detached background process," TrendAI, Trend Micro's
UMass Amherst researchers showed expired Visa contactless cards can make real purchases by exploiting an unsigned expiry field in Visa’s EMV kernel. Researchers at the University of Massachusetts Amherst demonstrated at USENIX Security 2026 in Baltimore that expired Visa contactless credit cards can complete real purchases, including transactions at live retail and grocery merchants, by exploiting a gap in how the payment protocol handles expiration dates. The paper is titled “Zombie Cards Back Online: Reviving Expired Credit Cards for Contactless Payments,” and the name is accurate. Raja Hasnain Anwar, Gerard DeCunha, and Muhammad Taqi Raza built the attack around a structural weakness in EMV, the contactless payment protocol used by Visa, Mastercard, American Express, and Discover. “A central source of fragility is that the EMV contactless protocol is a selectively authenticated transaction flow. Many data objects are exchanged in plaintext between the card and terminal [2], and only a subset is later bound to cryptographic verification via Offline Data Authentication (ODA) and issuer-verified cryptograms.” reads the paper. “In consequence, an adversary who obtains a man-in-the-middle position on the NFC channel can tamper with decision-critical fields that are consumed by the terminal but are not end-to-end integrity protected. Prior NFC attacks [10–12, 44], including relay-based manin-the-middle techniques, exploit this gap by manipulating transaction-relevant objects in transit while leaving cryptographic checks intact.” The attack exploits a specific design decision in Visa’s Kernel 3, the software layer that implements the EMV protocol for Visa transactions. A Visa contactless transaction presents the expiration date twice: once in a field the payment terminal reads (tag 5F24, the Application Expiration Date) and once in a field the issuing bank reads (tag 57, Track 2 Equivalent Data). These two representations should be tied together by a cryptographic signature, but in Visa’s implementation they aren’t. The relay attack changes only the expiry date that the payment terminal sees, replacing it with a future date while leaving the data sent to the bank unchanged. The card’s digital signature remains valid because it does not cover the expiry date. As a result, the bank receives a transaction that appears legitimate and passes its normal security checks. In simple terms, an attacker can change the expiry date between the card and the terminal without breaking the card’s cryptographic protection. The relay itself is two NFC-capable Android phones running custom software over Wi-Fi: one emulates a card, one emulates a terminal. Each communication round trip added roughly 20 milliseconds for relay alone and about 50 milliseconds with the date modification, keeping the per-transaction average around 415 milliseconds, within Visa’s 500-millisecond command limit. None of the test hardware used EMV’s optional Relay Resistance Protocol, which would have detected the added latency by bounding permissible response times. Mastercard, American Express, and Discover all blocked the attack. Mastercard’s terminal checks consistency between the two expiry representations during record parsing and treats a mismatch as a card data error. American Express binds the expiration date into the data covered by offline authentication, so a modified value produces a hash mismatch. Discover’s kernel wraps the modified transaction objects into the verified transaction hash, and those also failed. Visa’s Kernel 3 does none of these things. The outcome also depended on the issuing bank. The researchers tested three banks with expired and replaced physical Visa cards and found three distinct policies, not a clean pass or fail split. Bank A accepted the modified transactions at $1.00, $100.00, and $500.00 in the lab, and completed purchases of $2.79 at a retail merchant and $3.19 at a grocery merchant on campus. Bank A also accepted transactions from both the expired original card and its replacement against the same account simultaneously, a separate finding that Anwar described as alarming. Bank B detected the modification but still accepted some transactions. A third bank tested on Discover’s kernel detected the edit and declined; however, it also showed the simultaneous-card problem without any modification at all. There is another finding that makes the issue more serious. Researchers changed the Consumer Device Cardholder Verification Method flag at five US banks, and the transactions worked at most of them. This flag controls how the terminal verifies the cardholder, and attackers can change it because the payment data can be modified while it travels between the card and the terminal. There is also another problem with Kernel 3. It sends the issuer a Terminal Verification Results value filled with zeros. This means the bank cannot tell whether the terminal checked the card’s expiry date or whether that check failed. The bank must therefore approve the transaction without seeing what the terminal actually detected. “Across all tests, the dominant factors that determine attack success or failure are: (i) the EMV kernel in use and whether expiry data fields are cryptographically bound to authenticated protocol outputs; (ii) issuer-side lifecycle enforcement, especially whether authorization is tied only to the active account and PAN or also to the specific card instrument and expiration date; and (iii) whether terminal-side validation results are visible to the issuer via TVR. In contrast, transaction amount1 , merchant category, and POS terminal brand did not independently determine the transaction outcome.” continues the paper. The researchers disclosed the findings to Visa in May 2025 and followed up in December 2025. The paper records that Visa acknowledged the report, said it passed initial triage, and indicated it was undergoing reproduction by Visa’s red team. No CVE has been assigned. Neither Visa nor any of the notified banks confirmed any mitigation as of the paper’s acceptance. The Register asked Visa for comment and received no response. The countermeasures the paper proposes sit at the kernel, terminal, and issuer layers: bind the expiry date cryptographically to an issuer-verifiable signature, require terminals to compare both expiry representations and make mismatches visible to the issuer, and have issuers authorize against the PAN-and-expiry combination rather than the PAN alone. For cardholders, the researchers recommend destroying the chip and magnetic stripe of expired cards rather than discarding them intact. Given that the attack requires only the expired physical card or sustained NFC proximity to it, that guidance is now slightly less hypothetical than it was before this paper. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Visa)
A previously unknown malware family dubbed SynkLoader is being distributed in Microsoft Teams phishing campaigns to steal credentials via a fake lock screen. The attacker impersonates the target company's IT help desk, a tactic Microsoft highlighted earlier this year as increasingly common in multi-stage attacks. Expel’s security researcher Marcus Hutchins explains that the attacks direct the victim to install a fake “PowerShell Cleaner” executable (.MSI) hosted in Microsoft Azure, making the download appear trustworthy. Analysis of the malware showed "compile dates and file timestamps indicating it was first compiled and distributed around July 28, 2026." The installer extracts a PowerShell script named cleaner.ps1 and a ZIP archive containing the Python framework, a malicious Python script, precompiled Python libraries, and several fake Microsoft runtime DLLs.
More than 9,300 Amazon Web Services (AWS) access keys publicly exposed between August 2022 and August 2026 are still active and valid. Truffle Security has been tracking this exposure for the past four years and says that 817 of the exposed keys were linked to companies, 526 of them being AWS root keys. According to the researchers, 242 of the keys are associated with Identity and Access Management (IAM) users with the AdministratorAccess policy. This role has full permissions to create, modify, delete, and view virtually all AWS services and resources within an account. They note that each key of the 768 live keys in the two sets “full control of a company's AWS account.” The company found 431,875 AWS secrets across code repositories, Git history, datasets, Docker images, registries, and CI logs and extracted 64,024 unique AWS keys that corresponded to 50,654 AWS accounts after removing duplicates.
Microsoft says ongoing issues causing games to crash or fail to launch after installing the August 2026 Windows updates may be caused by peripherals with RGB lighting. As Microsoft explained when it confirmed it's investigating on Wednesday, this known issue affects games like ARC Raiders, MARVEL Tōkon: Fighting Souls, and The Finals on systems running Windows 11 24H2 and 25H2. "Following the release of Windows updates on August 11, 2026 (KB5121003) and later, Microsoft received reports of issues involving inability to run games as expected," Microsoft said on the Windows release health dashboard. On impacted PCs, users are also experiencing gaming freezes, "EXCEPTION_ACCESS_VIOLATION" errors, and even unexpected system restarts. In a Thursday update, Microsoft said the gaming issues may be caused by drivers or components installed by RGB devices on affected Windows systems.
Using the same email, phone number, payment method, and other identifiers makes it easier for data brokers and attackers to profile your activity. Anonyome Labs explains how separate digital personas can reduce correlation and limit the impact of breaches, spam, and identity theft.
Microsoft has started rolling out a Classic Outlook theme for users of Outlook on the web and the New Outlook for Windows. This new Outlook theme is rolling out as part of a targeted release beginning mid-August and expected to complete by the end of September. The theme will become generally available worldwide between late September and late October. "When enabled, the setting applies coordinated changes across the Outlook experience, including visual styling, layout, typography, icons, and selected interactions," Microsoft said in a Microsoft 365 Message Center update. Once rolled out, the feature will not override any existing administrator configurations and will not automatically migrate users from classic Outlook to the new Outlook. Microsoft also added that the new user interface style will be enabled by default for some users, but they can toggle it off to switch to the standard theme from Settings > General > Appearance.
Google tracks three Russia-linked espionage clusters using phishing and legitimate authentication tools to target researchers, diplomats and defense staff. Google’s Threat Intelligence Group tracked three separate suspected Russia-linked cyber espionage clusters. All three focus on the same thing: abusing authentication features that are supposed to protect accounts to access them instead. Threat actors target researchers, academics, government officials, think-tank analysts, and defense sector personnel across Europe and the United States. The three clusters are tracked as UNC6293, UNC7005, and UNC5976, and while they operate differently and with different tools, Google published them together for a reason. “These clusters engage in persistent, adaptive phishing campaigns, using sophisticated social engineering tactics to compromise personal accounts across multiple platforms.” reads the report published by GTIG. “Because these operations abuse legitimate authentication flows which may not immediately seem like phishing attempts to users, GTIG is raising awareness about these social engineering campaigns targeting individuals so that targets can more readily recognize malicious outreach.” UNC6293 is the oldest of the three and the most precisely attributed. Google assesses with moderate confidence that it’s a sub-cluster of ICE RELIC, the group also tracked as APT29, responsible for initial access operations. Its operations are narrow by design: typically fewer than five targets at a time, with themes built around diplomatic events and upcoming conferences. Since it was first documented in June 2025, UNC6293 has consistently impersonated US State Department officials to run app password phishing. The technique is simple but effective. The attacker convinces a target to set a specific app password on their account, one that the attacker already knows, and then uses it to log in without triggering two-factor authentication. By October 2025, UNC6293 was still reusing screenshots from its June phishing lures, including the ms.state.gov reference, while only changing the surrounding text. By June 2026, the group had added OAuth phishing. After logging in to a legitimate service, victims were asked to share a URL or “verification code,” allowing attackers to obtain valid access tokens. The trick works because the login itself is legitimate, while the attackers hide the malicious step elsewhere. UNC7005, tracked by Microsoft as STORM-2945, is a related but separate cluster first identified in February 2026. Google assesses it’s also connected to ICE RELIC, but notes it operates with lower technical sophistication and worse operational security than UNC6293. It compensates with a wider toolkit. UNC7005 runs app password phishing, device code phishing against both Microsoft and WhatsApp, malware distribution, and OAuth phishing operations, sometimes in the same month. “UNC7005 also conducts device code phishing operations for both Microsoft and WhatsApp accounts.” continues the report. “The themes of these phishing waves often involve invitations for calls with individuals from notable organizations related to the target’s field or, most recently, invitations to diplomatic events and conferences. “ The GLOBSEC conference spoof is a useful illustration of how UNC7005 works. The actor built a landing page mimicking an invitation to the legitimate GLOBSEC forum in May 2026, collected detailed registration information from targets including, not for the first time in ICE RELIC-linked operations, a wine selection for a fictional dinner, and then presented a Microsoft device code for the target to enter. The registration form still contained a reference to “Embassy security policy” rather than GLOBSEC, a leftover from the previous lure template that the actor hadn’t cleaned up. When Google flagged the page quickly, UNC7005 revised the template within days, citing “technical difficulties” to explain the change to anyone still watching. UNC7005 also used WhatsApp phishing pages to trick victims into linking their accounts to an attacker-controlled device. The fake pages offered options such as joining a call, opening an encrypted chat or downloading a file. If victims chose the call option, malicious JavaScript asked for microphone and camera access, recorded them, and sent the footage to the attackers. In late May 2026, UNC7005 ran a broader phishing wave targeting US-based academics, diplomats, and Russia researchers. The lure was a fake “Summit Companion App” to read a document supporting Ukraine. “In May and June 2026, UNC7005 conducted social engineering operations spoofing WhatsApp. The phishing pages distributed by the attacker lure targets into linking their WhatsApp accounts with an attacker controlled device in order to join a secure WhatsApp call, chat, or document share.” states the report. “The attacker also attempts multiple other methods of compromise after the device is linked.” Windows users who downloaded it received VIDAR, an off-the-shelf infostealer sold as a service that pulls saved credentials, cookies, and payment data from browsers. Mac users received ATOMIC, also known as AtomicStealer, a macOS infostealer operating the same business model. Neither is custom tooling. The actor’s email address in this operation was nearly identical to one used by UNC6293 a year earlier. The hospitality captive portal campaign, previously reported by Reliaquest and Microsoft and attributed to Midnight Blizzard, connects directly to UNC7005. Google traces the infrastructure back to April 2026: domains spoofing Microsoft authentication resources, which Google added to Safe Browsing blocklists as they appeared. By mid-July 2026, those same domains were receiving redirects from captive portals at hotels and conference centers. The IP resolution trail links the captive portal infrastructure to the GLOBSEC device code phishing operation and to ENGINELIGHT, a Go-based malware used in a separate limited UNC7005 operation in May 2026. CHERRYPIE, also known as ChocoShell, is a PowerShell infostealer that adds another interesting detail. Google found comments and code references that appear consistent with AI-generated code, suggesting the attackers may be using an LLM to develop malware. The data it targets overlaps with the commercial infostealers already used by UNC7005, leading Google to suspect that CHERRYPIE could be a customized version of a malware-as-a-service tool. UNC5976 is the third cluster and the most distinct. It focuses on military, aerospace, defense industrial base, and NGO targets, concentrating geographically on Ukraine and Armenia. Instead of residential proxies for post-compromise access, as UNC6293 and UNC7005 use, it runs dedicated infrastructure. Its OAuth phishing is more automated: the actor registers file-sharing-themed domains, creates Google Cloud projects behind them, and uses cloud-hosted scripts to collect authentication tokens from targets who log in through what looks like a Google sign-in prompt on a fake file-sharing page. Within three months of Google disrupting this infrastructure, UNC5976 had built at least twelve new domains and was already migrating toward non-Google hosting providers. In April 2026, UNC5976 also distributed HEADRUSH, a malicious Excel plugin, through a domain impersonating a Ukrainian research institute, potentially targeting a Ukrainian aerospace and imaging company. HEADRUSH eventually leads to an HTA downloader, though Google wasn’t able to recover the full infection chain. The defender challenge that runs through all three clusters is the same one Google names directly. ” The accounts these groups target are often personal, rather than corporate domain-joined accounts, creating a visibility gap for monitoring compromise from an organizational perspective. The likely use of encrypted messenger applications instead of email for initial outreach also presents a challenge to defenders hoping to track and remediate abuse.” concludes the report. “The combination of these tactics not only enables the attacker to conduct quick-turnaround exfiltration operations, but also presents opportunities for the attacker to further phish targets of interest from compromised, legitimate accounts. “ Security teams watching corporate email and endpoint telemetry won’t see the initial contact. By the time a compromised personal account starts being used to phish the target’s contacts, the original access event is already cold. Google’s practical guidance for individuals: don’t set app passwords for anyone who asks, revoke existing ones you don’t recognize, check WhatsApp’s linked devices list, and treat any OAuth authorization prompt from an unsolicited message as suspicious regardless of how polished the surrounding page looks. High-risk individuals should consider Google’s Advanced Protection Program, which blocks app password creation entirely. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Russia)
Microsoft has patched a maximum-severity vulnerability in the Entra ID identity and access management (IAM) platform that has been exploited in attacks.
Threat actors are abusing FTP banners to hide commands that deliver two previously undocumented remote access trojans named E4del and PINHOLE. MalwareHunterTeam observed this unusual technique in July in an attack that used shortcut files (.LNK) and FTP server banners as dead-drop resolvers (DDR) to retrieve commands. FTP banners are text strings the server uses as a greeting message for connecting hosts before they log in. By embedding commands in the initial response sent when a compromised system connects to an FTP server, a malware stager can receive instructions from a remote server. After discovering FTP banners being used to deliver malicious commands during an investigation, researchers at threat intelligence platform SOCRadar expanded their hunt and found that the technique remains in use.
Confirm this action.
Leaving now will discard your changes.