All articles tagged with #malware
A circulating 113GB GTA 6 PC ISO is fake and loaded with malware designed to disable Windows Defender and other security software; analysts warn fans not to trust unofficial downloads amid GTA 6 hype as the November release approaches.
Kaspersky attributes a MoYu group operation to a supply-chain-style attack that infected DoFun Android-based car head units with a rogue update app, dropping JarService to load a second-stage payload that communicates with a C2 server and accepts multiple commands. The malware turns the head unit into a proxy botnet node for ad fraud via a reverse-proxy module dubbed zhima, while still not interfering with vehicle control. DoFun said the issue was resolved after being alerted, and the researchers noted this as the first documented malware infection chain targeting car head units.
Ahead of its August 27 launch, Resonance: A Plague Tale Legacy has leaked and been cracked with playable pirated builds circulating online; pirates warn that the pirated packages may carry malware due to the repacker’s history, the install size is about 75 GB, and there has been no public comment from Focus Entertainment or Asobo Studio.
Microsoft Defender Experts linked more than 30 web domains to the MacSync Stealer infrastructure, tracing a macOS information stealer from payload delivery through exfiltration. The campaign uses interactive zsh terminals, curl-based payload retrieval, AppleScript-assisted execution, and staging in /tmp with HTTP PUT uploads carrying chunked data. Observed exfiltration patterns and recurring endpoints (/curl/, /dynamic?txd=, /gate build) reveal rotating infrastructure, while data collected includes credentials, keys, and sensitive files. Microsoft cautions users and urges monitoring of curl uploads, API-key headers, and domain changes; Apple’s macOS protections (Terminal paste protection, pasteboard blocking, AppleScript scanning) are also relevant. The report follows similar findings from RST Cloud, which noted a static API key across several domains and parallel C2 operation across a rotating set of domains.
Meccha Chameleon, the indie hide-and-seek game, has sold over 20 million copies on Steam in two months, after 15 million in the first month and 5 million more in the second. The game continues to draw about 22,000 concurrent players daily across Steam, PlayStation, and Xbox, aided by ongoing updates, despite a malware incident in user-made maps and a Discord server hack.
A Pass-ta-key–style attack on Windows’ Google Password Manager shows passkeys aren’t universally bound to hardware; while other platforms store keys locally, Windows often uses cloud‑based encrypted blobs, allowing malware on a compromised PC to exfiltrate keys and trigger syncing to the infected device. The underlying design of FIDO2 does not require TPM storage, and the key takeaway is that passkeys reduce phishing but do not protect against a device already under attacker control.
Cybersecurity researchers flagged malicious VS Code extensions named 'solidity-pro' that evolve from loader to information stealer, capable of harvesting browser profiles, crypto wallets, API keys, SSH keys, and Telegram bot tokens, exfiltrating data via a Telegram bot; they use obfuscation and delayed activation to evade detection, with similar incidents in the past. Users should remove the extensions, review dependencies, block known C2 domains, and monitor for risky command usage.
A Go-based malware delivered through ClickFix phishing emails targets macOS users to steal cryptocurrency assets, browser passwords, and Apple Keychain data, and can intercept or redirect crypto transactions. It uses a Bash profiler and loader to load a Mach-O payload, hides itself by copying as com.apple.verified and removing quarantine attributes, and establishes persistence via fake prompts to grab credentials. The malware can modify transactions before signing, potentially draining only a percentage of funds across assets like Bitcoin, Ethereum, XRP, Monero, Litecoin, and Dogecoin. C2 traffic points to Aeza Group infrastructure (AS 210644), a sanctioned bulletproof-hosting provider.
A security researcher says OPPO is among more than 1,600 organizations across 57 countries affected by a years‑long North Korean hacking campaign that used fake software developer interviews to install malware, aiming to steal credentials and cryptocurrency; while OPPO is named in disclosures at Black Hat and Wired, it’s unclear what impact this had on OPPO or its users.
Security researchers from Unit 42 disclosed three TPM-based attacks—Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key—targeting Google Password Manager’s synced passkeys on Windows; the exploits don’t break cryptography but abuse Chrome’s device identity, onboarding, and recovery flows to hijack or recover passkeys. Pass-ta-key impersonates a trusted device to obtain an authentication assertion, though some services verify user verification flags (GitHub blocked it; eBay failed but has since been addressed). Silver Pass-ta-key enables attacker-controlled verification keys during re-registration, letting attackers authenticate from a separate system. Golden Pass-ta-key captures the master key (security domain secret) used to encrypt synced passkeys from memory during re-registration, enabling decryption of passkeys and impersonation across accounts, with no current rotation or revocation. The researchers urge stronger verification, safer recovery/re-registration, and memory-protection of the master key.
Microsoft warns of a campaign called CaptiveCrunch that compromised hotel Wi‑Fi networks, using fake login and update pop-ups to steal credentials, keystrokes, and even remotely hijack devices, with alleged ties to Russia. To stay safe, travelers should use a private connection (like a mobile hotspot) or be wary of unexpected prompts after connecting to hotel Wi‑Fi.
Microsoft says a suspected Russian state-backed hacking group hijacked hotel Wi-Fi gateways to redirect travelers to fake Microsoft login pages and secretly deliver malware via ClickFix. The attacks use doppelganger domains mimicking Microsoft online services and have produced variants like Cornflake that impersonate Windows updates or security scans, targeting Windows and Android. ReliaQuest links the activity to APT28, with Microsoft tying it to a Cozy Bear sub-group of APT29. Users should avoid captive portals, rely on cellular data when possible, ignore unexpected prompts, and consider a full-tunnel VPN; attackers likely gained access by abusing weak or known gateway passwords.
Security researchers warn that AI coding assistants can hallucinate non-existent package names, which attackers can register as real repositories and hide malware inside. When these tools reference the fake packages, they clone them onto users’ machines, enabling automated, stealthy malware deployment. The vulnerability affects many assistants (Cursor, Copilot, Gemini, OpenClaw, etc.) with attack success rates reported between 85% and 100% depending on the task. Researchers from Tel Aviv University and Intuit notified AI companies, but the core issue remains: AI assistants can be confident liars, creating a broad risk for developers relying on AI-generated code.
BlueDash is a Nigeria-linked phishing operation that lures victims with a counterfeit Microsoft Teams update page to trigger a PowerShell-based loader, which downloads and installs multiple remote monitoring and management tools (including Level RMM and ConnectWise ScreenConnect) and registers the host with an attacker-controlled enrollment secret for persistent access; the campaign uses cross-brand lures (like Zoom) and shared infrastructure on Berrydev.xyz and GitHub Pages, and includes reconnaissance steps to map system state, firewall posture, and privileged local accounts to guide its next moves.
User-made Steam Workshop maps for the indie hit Meccha Chameleon were found to contain malware (notably in Laser Tag Neon, with a follow-up map Chroma Grid Arena), prompting removal. The developer stressed the game itself is safe and attributed the Discord server breach to a compromised admin account after 2FA was bypassed. A patch (v3.1.0) was released to fix the vulnerability and remove malicious maps, and the Discord server has been restored. Players who downloaded affected maps are advised to run malware scans. Meccha Chameleon has sold around 15 million copies in a month.