iAuthFlow v2 phishing toolkit uses a phished Google session to enroll an attacker-controlled passkey that survives password resets. Abnormal Security researchers have published an analysis of iAuthFlow v2, a phishing toolkit sold on a Russian-language cybercrime forum for $10,000 base price. The author also offers for sale additional capability modules separately. The headline feature is not the phishing itself. It’s what happens after the phishing succeeds. “Once the target completes a phishable Google login, the toolkit uses the authenticated session to enroll a passkey controlled by the operator.” reads the report published by Abnormal Security. “In the seller’s recorded demonstration, the account owner later changes their password, invalidating the active session—but the operator authenticates with the newly enrolled passkey and returns to the mailbox.” That’s the architecture. The phishing flow gives the attacker a temporary window. iAuthFlow v2 uses that window to create a permanent key that doesn’t close when the window does. The toolkit uses a browser-in-the-middle attack. The victim sees what looks like a real Google login page, while iAuthFlow v2 runs another browser on the attacker’s server. Everything the victim types, including their email, password and two-factor code, is sent to that remote browser, which logs in to Google. The victim provides the credentials, while the attacker gets the authenticated session. In the demo, the fake login page used a trycloudflare.com subdomain, giving the link a valid TLS certificate and a more trustworthy appearance. Once the relay gives the attacker’s browser Google’s session cookies, iAuthFlow v2 holds the target on a “Verification, Processing” page while the toolkit works inside the account. This pause is a named state in the software, not a recording artifact. The session log timestamps tell the story precisely: login at 21:37:18, passkey created and saved at 21:37:24. Six seconds to establish persistent access. The passkey module navigates the target’s Google passkey settings through the authenticated browser and requests a new credential. Google may ask for identity re-verification before allowing the enrollment; the demo shows the toolkit handling this. The enrolled passkey is then stored on the attacker’s side, and the toolkit records “Passkey created and saved.” “The log records “Passkey created and saved.” At this point, the operator no longer has only the authenticated session created through the phishing flow.” continues the report. “The newly enrolled passkey is a separate authentication credential registered to the target’s Google account. The subsequent demonstration shows Google offering that passkey during a later sign-in, consistent with the operator retaining the credential needed to use it.” This is more serious than simply stealing a session cookie because a password reset does not remove a passkey. Changing a Google password ends active sessions, revokes app passwords and invalidates some OAuth tokens. A passkey is different: it is a separate cryptographic credential linked to the account and remains active until it is manually removed. The demo shows the risk clearly. After the victim changes their password, the attacker’s session stops working. But the attacker can choose “Try another way,” use the passkey they previously added and regain access to the mailbox. The victim may have no idea this happened. Abnormal notes a technically plausible mechanism for how iAuthFlow v2 stores and uses the passkey: Chromium’s software-based virtual authenticators, which support WebAuthn registration and retain private keys without requiring the target’s physical device. The researchers don’t confirm this is what the toolkit uses, since the demonstration doesn’t reveal the implementation. What they confirm is that the behavior shown is consistent with how passkeys work, and there’s an available path to produce it. The toolkit targets Google in the build Abnormal examined, but the seller advertises versions for Microsoft, iCloud, and LinkedIn. The same post-authentication persistence logic applies wherever passkeys can be enrolled. Containment after an iAuthFlow v2 compromise needs to go further than incident response teams are often used to going. “That cleanup is particularly important with iAuthFlow v2 because neither a password reset nor session revocation removes an attacker-enrolled passkey.” states the report. “Restore the account only after unauthorized authentication methods and other persistence mechanisms have been removed.” The full sweep should cover unauthorized passkeys and security keys, malicious Gmail filters and forwarding rules, delegated access, OAuth grants and app permissions, and recovery settings. Organizations running Google Workspace can use the Security Investigation Tool to audit the account before declaring it clean. The best way to prevent these attacks is to rely on authentication methods that cannot be easily stolen through phishing. WebAuthn-based authentication is tied to the real website, so stolen passwords or codes cannot be used through a relay attack. Google Workspace can enforce this with the “Only security key” option for 2-Step Verification and through the Advanced Protection Program. These settings also disable app passwords, which the toolkit may target on less protected accounts. The toolkit’s price and professional sales channels suggest this is an ongoing business, not a one-time release. If a Google account is compromised but appears clean after a password reset, security teams should also check the account’s passkeys and security keys before closing the case. “iAuthFlow v2 illustrates how phishing has evolved beyond stealing credentials or even hijacking a single authenticated session. Once an attacker gains legitimate access to an account, that access can become a starting point for establishing new authentication methods, modifying account settings, and creating other forms of persistence.” concludes the report. “Response and recovery cannot end with a password reset or session revocation. Organizations must also examine what changed after authentication—especially newly enrolled credentials, recovery methods, OAuth grants, and mailbox settings—and remove anything the attacker left behind. “ Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, iAuthFlow v2 phishing toolkit)
If your developers are using AI coding tools, you are probably already seeing the upside: faster development, more code, and less time spent on routine work. The harder part is what comes after. AI can also introduce open-source packages at a pace your security team was never built to handle. More dependencies mean more vulnerabilities to review, more remediation work, and a backlog that can
Red Hat and the Keycloak project have released patches to address a critical security flaw in the open-source identity and access management server that could allow an unauthenticated remote attacker to take over any user account by forcing a password reset. The vulnerability, assigned the CVE identifier CVE-2026-18963, is rated 9.1 on the CVSS scoring system by Red Hat, which acts as
Cybersecurity researchers have flagged a cyber espionage campaign targeting Myanmar that uses graduation ceremony invitation lures to deliver a Go backdoor called QUICAgent. The campaign, codenamed Operation QUICSILVER, has been found to target government and information technology sectors, per Seqrite Labs. The activity is assessed to be the work of a China-nexus threat actor with moderate
Big security risks come in small packages. While enterprise security teams focus on policing the proliferation of employees using ChatGPT and Claude for quick drafting tasks, a more urgent threat is posed by a handful of AI super-adopters who are quietly hardcoding unvetted tools into critical business operations. According to new research published by Akamai, the top 5% of enterprise power
Cybersecurity researchers have disclosed details of a Chinese-speaking cybercrime group dubbed UAT-10147 that's targeting Windows and Linux web servers globally across the education, media, technology, and gaming sectors. The vast majority of the targets are located in Brazil, Bolivia, China, Canada, and Vietnam. Details of the threat activity came to light following the discovery of an open
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. ToxicPanda 2.0 Gets a Major Upgrade, Expanding Attacks Across 16 CountriesMalware Hijacks Android Car Head UnitsCritical Flaw in NASA/JPL Open-Source Spacecraft Command Software Allowed Unauthenticated Command ExecutionU.S. CISA adds Zimbra Collaboration Suite (ZCS) flaw to its Known Exploited Vulnerabilities catalogYour Shredded Visa Card May Still Work at the CheckoutSix Maximum-Severity Flaws Found in Cisco ProductsFake Conferences, OAuth and WhatsApp: Inside Russia’s New Espionage TacticsGitLab Warns of Active Exploitation of Critical GraphQL FlawPoland’s CERT Warns of Active Exploitation of Critical Zimbra Collaboration Suite FlawU.S. CISA adds TrueConf Server flaws to its Known Exploited Vulnerabilities catalogCl0p Targets 40+ Organizations Through PTC Windchill FlawManic: The Android Malware That Exfiltrates Data Even When the Phone Is OfflineNSA, CISA, FBI, DOE, and EPA Warn of Active AI-Assisted Attacks on Siemens S7 PLCsU.S. CISA adds an MLflow flaw to its Known Exploited Vulnerabilities catalogUS Indicts 17 Iranians Over Years-Long Cyber Espionage CampaignStopAndProtect Turns 2,000 Hacked WordPress Sites Into a Criminal NetworkInside Operation CameraSwarm: How One Actor Took Over 14,000 Dahua CamerasMicrosoft Tracks MacSync Stealer by Its Behavior, Not Its Domains50,000 Stripe Secrets Leaked in Public CodeU.S. CISA adds Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft IKE flaws to its Known Exploited Vulnerabilities catalogHackers Expose Data of 1.2 Million Heights Finance CustomersProject noRecognition: Teaching AI to Fool Surveillance CamerasGitLab Patches Critical Unauthenticated GraphQL VulnerabilityU.S. CISA adds a Ray-Project Ray flaw to its Known Exploited Vulnerabilities catalogNew Mirai-Based Evooo1Bot Botnet Targets Linux DevicesSafePal Says 39,798 Customers Hit by Data BreachLiteLLM Supply-Chain Attack – Technology, Banking and Healthcare the Most AffectedInvisible AI Prompts Trigger Court SanctionsMcDonald’s Employee Data Appears in Leak, Seller Claims 1.7M Records StolenAkira Ransomware Uses Safe Mode to Bypass EDRDDoS Attacks Cause Major Threema OutagesMustang Panda Upgrades CoolClient With a Kernel RootkitSophisticated Cyberattack Exposes Data of 678,000 French TaxpayersAPT36 Suspected in PATCHCORD Espionage Campaign Using Google Sheets C2 International Press – Newsletter Cybercrime McDonald’s employee data listed for sale in wider Entra campaign $7 Million in Expired Domains Fuel a Streaming Empire with a Malware Secret Live Stripe keys for 659 merchants, published for free Clop Returns with Custom Implant in Mass-Extortion Campaign Justice Department Secures $400M Settlement with TikTok and ByteDance to Resolve Children’s Privacy Litigation Malware Akira Hits Safe Mode: Ransomware Rebooting Around EDR Hunting MacSync Stealer infrastructure through behavioral pivots Manic: Blend between Banking Malware & Spyware The ToxicPanda Never Sleeps: ToxicPanda 2.0 Prepares its Next Strike on Mobile The invisible passenger in your car Grandoreiro goes north: From Brazil to Mexico with a new DLL sideloading campaign Hacking Large-scale DDoS attacks disrupted Threema secure messaging service The LiteLLM Supply-Chain Attack — TeamPCP “SANDCLOCK” CI/CD Credential-Harvesting Campaign via a Backdoored Trivy GitHub Action Actively exploited vulnerability in Zimbra Collaboration Suite AI-assisted tool helped secure satellite communication system after 2022 Russian hacking Expired credit cards revived by researchers to make unauthorized payments CDN Tsunami: Exploiting HTTP/3-HTTP/1.1 Conversion for DoS Attacks When the NASA Ground Station Has No Lock on the Door: Unauthenticated Command Execution in AIT-GUI (GHSA-p9r8-2q67-fp86) Zero-click Grok data theft: Cryptographic Context Injection attack leaks chat histories Intelligence and Information Warfare Operation CameraSwarm: Over 14,000 Dahua cameras compromised across Ukraine and Russia 17 Iranians Charged with Conducting Massive Cyber Theft Campaign on Behalf of the Islamic Revolutionary Guard Corps and Other Iranian Entities Defending Against an Active Threat to Siemens S7 Series PLCs Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia SilkParasite: Tracking a China-Nexus APT Across Central Asia Revealed: Cyber spies used malware from GitHub to hack EncroChat cryptophone network Cybersecurity France probes unprecedented cyberattack after tax data of 678,000 users stolen Person Hides Prompt Injection in Legal Filing Telling AI to Side With Them SafePal Unauthorized Access To A Subset Of Customer Order Information This ‘adversarial’ pattern can prevent surveillance cameras from detecting you France’s cybersecurity problem demands strong political will The Powerful Chinese AI Model Experts Warned About—and Waited for—Is Here OpenAI president says companies should do 10 things ASAP to defend against AI cyber threats Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
New Cryptographic Context Injection technique bypasses AI guardrails via AES-encrypted payloads, leaking full Grok chat histories zero-click Adversa AI researcher Rony Utevsky devised a new attack technique, called Cryptographic Context Injection, that bypasses AI safety filters by sending instructions as AES-encrypted ciphertext and tricking the model into decrypting them inside its own code execution runtime. The technique was demonstrated against two live production systems: xAI’s Grok and Google’s Gemini. “Cryptographic Context Injection hides malicious instructions inside AES-encrypted text so guardrails can’t read them, then tricks the AI into decrypting and trusting them as its own.” reads the report published by Adversa AI. “In Grok, an ordinary “summarize this page” steals the user’s chat data with no click or warning. In Gemini, it produces content the model normally refuses. Both are live production systems.” The Grok case is the more serious of the two. A user asks Grok to summarize a webpage containing an encrypted payload and instructions to decrypt it. Grok visits the page, decrypts the payload in its Python sandbox, and follows the hidden instructions. It then accesses the user’s private session data, including their name, location, subscription plan, and full chat history, and puts this information into a URL that it opens automatically. The user receives no warning and does not need to click anything. The key technical distinction from earlier cipher-based prompt injection work is what happens during decryption. “Static safety guardrails classify inputs as text; they do not execute them. An attacker ships ciphertext along with the key material and an instruction to decrypt it, and the model runs that decryption inside its own code execution sandbox.” continues the report. “Everything a guardrail’s scanner would need is right there on the page, but recovering the plaintext means running PBKDF2 and AES-256-GCM, which no content classifier does at inspection time. “ Prior techniques like CipherChat and CodeChameleon used substitution ciphers, XOR, or base64, schemes the model can decode natively in its own context without an interpreter. AES-256-GCM can’t be decoded that way. Recovery requires the runtime, and that’s the channel the attack depends on. Once the runtime decrypts the payload, the attacker’s instructions appear as the output of code the model just ran, not as untrusted external content. “The runtime execution launders attacker-controlled data into trusted instructions the agent will act upon. That is how the attack got its name: cryptography helps fabricate trusted context for the agent.” states the report. “The same cryptographic backbone works whether the injection is direct or arrives indirectly, for example through the browsing channel.” The attacker payload inherits a credibility the same text would never get if pasted directly into the prompt. The Grok demo hides the data theft behind what looks like a normal request. The payload tells the model to create a “decryption key,” but the key is actually a template containing the user’s private data, such as their name, location, subscription tier, and chat history. Grok then uses this information as a URL parameter when opening an attacker-controlled website to “fetch additional context.” The data is sent through the URL as part of a seemingly normal web request. Adversa said the attack was still reproducible on August 19, 2026. Adversa traces the structural problem to Grok’s agentic framework, not to any model-layer failure. The framework lets instructions from an untrusted external page drive the invocation of a privileged, internet-connected tool. It allows private session metadata and conversation history to be resolved into the inputs of outbound calls. It enforces no egress boundary or consent gate on that path. Adversa’s description maps cleanly to SQL injection: a system that can’t distinguish its own trusted state from attacker-supplied data flowing through the same channel. The Gemini case uses the same basic trick but in a different way. A prompt asks Gemini to run a Python script that decrypts some data and returns a small JSON result. Instead, the decrypted data contains a fake Python error message with hidden instructions designed to bypass Gemini’s safety rules. Because Gemini treats the sandbox output as trusted context, those instructions can influence its behavior. Adversa used the technique to make Gemini generate detailed instructions for building an incendiary device. A modified version also exposed Gemini’s system instructions. Adversa reported the Grok issue to xAI on June 3, 2026, but received no further response after the initial acknowledgment. The attack was still working shortly before publication. The Gemini issue was not formally reported because Google’s bug bounty excludes jailbreaks. Adversa said Gemini’s vulnerability rate has nevertheless dropped sharply since June. For defenders, Adversa’s guidance is that nothing about this attack requires a fix at the model layer. Every control that bounds it sits in the harness around the agent. Untrusted content should be processed in a context with no tools and no credentials, returning only structured data to the privileged context. Outbound network calls and writes outside the workspace should require explicit confirmation with fully resolved arguments visible before approval. Per-session tool traces with resolved arguments should be logged, because without them there’s no forensics and no detection. Detection should alert on sequences, not individual payloads: untrusted content enters context, code executes, agent contacts a host outside its normal dependency graph. That chain is the signal, not any single ciphertext blob. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Cryptographic Context Injection)
ToxicPanda 2.0 targets 349 financial apps and abuses Android Wireless Debugging to gain deeper device access and steal banking credentials. ToxicPanda used to be a Europe-focused nuisance targeting a manageable list of banks. That version is gone. Zimperium’s zLabs team just documented ToxicPanda 2.0, and the numbers alone tell the story: 349 targeted financial institutions across 16 countries, up from 16 apps in the previous version, plus a command set that ballooned to 167 remote instructions. The infection starts with a fairly standard trick dressed up in a new coat of paint. The malware poses as a dropper, requesting VPN permissions through a fake installation screen, then quietly uses that access to block communication from Google Play Protect while it decrypts and installs the real payload hiding inside the app’s own asset files. Once installed, it leans on Android’s Accessibility Service, the same feature legitimate screen readers and automation tools rely on, to see and interact with everything happening on the victim’s screen. ToxicPanda was once a malware mainly targeting a small number of European banks. That has changed. Zimperium’s zLabs team has documented ToxicPanda 2.0, which now targets 349 financial institutions in 16 countries, compared with just 16 apps before. It also has 167 different commands that attackers can send remotely. The attack starts with a common trick. The malware pretends to be a legitimate app and asks for VPN permissions through a fake installation screen. It then uses this access to block Google Play Protect while secretly installing the real malware hidden inside the app’s files. Once installed, ToxicPanda abuses Android’s Accessibility Service. This feature is normally used by legitimate tools such as screen readers, but the malware uses it to monitor the victim’s screen and interact with apps and data on the device. “By abusing the Android Accessibility Service, threat actors can steal every UI element on the screen, alongside an overlay-based credential theft mechanism targeting 349 financial institutions, compared to the previous version, which targeted only 16 banking applications, the latest iteration demonstrates a significant expansion in targeting scope and capabilities.” reads the report published by Zimperium’s zLabs. “Several commands previously identified as unimplemented in Cleafy’s analysis are now fully operational, expanding the malware’s remote control and fraud capabilities.” What sets this version apart isn’t just scale, it’s a genuinely new privilege escalation trick built around a feature most people have never touched: Android’s Wireless Debugging framework. The malware automates the entire process of turning it on, tapping the build number seven times to unlock developer options, toggling wireless debugging, and then scraping the six-digit pairing code straight off the screen using accessibility permissions. From there it performs the actual cryptographic pairing handshake itself, gaining shell-level access to the device without the victim ever realizing developer mode got switched on. ToxicPanda was once a malware mainly targeting a small number of European banks. That has changed. Zimperium’s zLabs team has documented ToxicPanda 2.0, which now targets 349 financial institutions in 16 countries, compared with just 16 apps before. It also has 167 different commands that attackers can send remotely. The attack starts with a common trick. The malware pretends to be a legitimate app and asks for VPN permissions through a fake installation screen. It then uses this access to block Google Play Protect while secretly installing the real malware hidden inside the app’s files. Once installed, ToxicPanda abuses Android’s Accessibility Service. This feature is normally used by legitimate tools such as screen readers, but the malware uses it to monitor the victim’s screen and interact with apps and data on the device. The real danger comes from its ability to use Android Debug Bridge (ADB). Once connected, ToxicPanda can run commands through ADB without showing the usual permission requests. This allows it to give itself more permissions, remove Android restrictions on background activity, enable important components without the user knowing, and maintain access to the device. “The malware also introduces an automated click-based mechanism to abuse Android Wireless Debugging (ADB), enabling privilege escalation and shell-level access on compromised devices. Additionally, it can steal lock screen credentials by placing overlays on top of the lock screen.” continues the report. The credential theft itself runs on two separate tracks. For banking and crypto apps specifically, the malware watches which app the victim opens, matches it against a list of 349 targets, and either overlays a fake login screen or deploys an invisible transparent layer to capture every touch and PIN entry directly. Separately, it can now overlay a convincing fake version of the phone’s own lock screen to steal the device PIN, pattern, or password outright, which hands attackers a way back in even after the initial infection window closes. Several capabilities that security firm Cleafy had previously flagged as unfinished in an earlier ToxicPanda variant are now fully working. The malware can automatically click through OEM-specific permission dialogs across Xiaomi, Samsung, Huawei, and other manufacturers’ customized Android builds, request Device Administrator privileges using a fake “system service” prompt, and even remotely force-reset a victim’s lock screen password using legitimate Android device management APIs. It can also load an attacker-controlled webpage inside a full-screen overlay on command, a feature that simply didn’t exist in prior versions. Distribution has shifted too, with samples now getting served from Amazon AWS-hosted storage buckets rather than whatever ad-hoc infrastructure earlier campaigns used. “The updated campaign also reveals a shift in distribution methods, with ToxicPanda 2.0 samples being delivered through Amazon AWS-hosted buckets, indicating the attackers are leveraging cloud infrastructure for malware delivery.” states the report. Using major cloud providers for malware delivery isn’t new, but it does complicate blocking efforts, since flagging an entire AWS IP range as malicious tends to take down a lot of legitimate traffic along with it. None of this requires a sophisticated zero-day, which is honestly the more unsettling part. Every capability here abuses a feature Android ships intentionally, Accessibility Services, Wireless Debugging, Device Administrator APIs, all designed for legitimate accessibility and enterprise device management. “As mobile banking threats like ToxicPanda become increasingly sophisticated, conventional signature-based security layers are no longer sufficient to protect enterprise mobile endpoints.” concludes the report. If you’re responsible for securing mobile endpoints, this is less a “patch something” problem and more a “detect abnormal use of normal features” problem, and that’s a considerably harder thing to build detection around. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, ToxicPanda 2.0)
Windows named pipes provide fast interprocess communication, but weak access controls can expose privileged services to untrusted processes. ThreatLocker explains how endpoint verification, command authorization, strict input validation, and narrowly scoped privileges can help secure named-pipe communication.
Confirm this action.
Leaving now will discard your changes.