Our team invests countless hours in the exploration, discovery and investigation of emerging trends such as AI and futuristic technology. Stay informed about the evolving landscape of cyberthreats through our diligent efforts and insights.

Malware Researcher at Gen

Research

Researchers at Avast developed a decryptor for the FunkSec ransomware. We have been cooperating with law-enforcement agencies to help victims decrypt files for free. Because the ransomware is now considered dead, we released the decryptor for public download.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a href="//_How_to_Use" target="_blank" rel="noreferrer noopener">Skip directly to the decryptor download</a>&nbsp;We counted 113 victims of the ransomware in total (based on the ransomware leak site). Because the first victim appeared earlier than the initial source, we assume that the FunkSec gang only did data exfiltration and subsequent extortion from the beginning, and then also added data encryption. Here’s a simple timeline of the ransomware operations:&nbsp;<ul><li>04-Dec-2024: The first victims appeared on the ransomware gang’s leak site&nbsp;</li><li>15-Dec-2024: The initial source file was uploaded to Virus Total&nbsp;</li><li>31-Dec-2024: The first known ransomware sample was uploaded to Virus Total&nbsp;</li><li>15-Mar-2025: The latest known victim&nbsp;</li></ul><h2 class="text-align-justify">AI-Powered Ransomware&nbsp;</h2><a href="https://www.ransomlook.io/groups#Funksec" target="_blank" rel="noreferrer noopener">Sources</a> report that AI was used to assist in writing this ransomware. Notably, the authors used AI to create tools and phishing templates, though they emphasize that AI contributes to only about 20% of their operations.&nbsp;Overall, samples of the ransomware mostly fail to work. Some of them depend on external image (supposed to become a desktop wallpaper) downloaded from <a href="https://imgur.com/" target="_blank" rel="noreferrer noopener">Imgur</a>:&nbsp;<ul><li>hxxps[:]//i.imgur.com/HCYQoVR.jpeg</li><li>hxxps[:]//i.imgur.com/mlUvWYT.jpeg&nbsp;</li></ul><h2>How to Recognize FunkSec Ransomware&nbsp;</h2>Files encrypted with FunkSec ransomware have the “.funksec” extension:&nbsp;

Also, a ransom note file called “README-{random}.md” is dropped to every folder.

<h2>FunkSec Ransomware Analysis</h2>Ransomware is written in Rust programming language. For cryptographic operations, it uses orion-rs library, <a href="https://github.com/orion-rs/orion/releases/tag/0.17.7">version 0.17.7</a>. Files are encrypted using Chacha20 with the help of <a href="https://github.com/openssl/openssl/blob/master/crypto/poly1305/poly1305.c">Poly1305 MAC</a>. This hash-based method ensures integrity of encryption parameters: the encryption key, n-once, block lengths, and encrypted data itself.Files are encrypted per-blocks of 128 bytes, adding 48 bytes of extra metadata to each block, which means that encrypted files are about 37% bigger than the originals.When executed, the ransomware searches all local drives (by drive letter) and encrypts all files, except the ones with these extensions:<table class="table"><tbody><tr><td>&nbsp;.7z&nbsp; &nbsp; &nbsp; .aac&nbsp; &nbsp; &nbsp;.ai&nbsp; &nbsp; &nbsp; .apk&nbsp; &nbsp; &nbsp;.avi&nbsp; &nbsp; &nbsp;.avro&nbsp; &nbsp; .azw3&nbsp; &nbsp; .bak&nbsp; &nbsp; &nbsp;.bat.bib&nbsp; &nbsp; &nbsp;.bin&nbsp; &nbsp; &nbsp;.bkp&nbsp; &nbsp; &nbsp;.c&nbsp; &nbsp; &nbsp; &nbsp;.cer&nbsp; &nbsp; &nbsp;.chm&nbsp; &nbsp; &nbsp;.cpp&nbsp; &nbsp; &nbsp;.csr&nbsp; &nbsp; &nbsp;.css.csv&nbsp; &nbsp; &nbsp;.cue&nbsp; &nbsp; &nbsp;.dat&nbsp; &nbsp; &nbsp;.db&nbsp; &nbsp; &nbsp; .dbf&nbsp; &nbsp; &nbsp;.deb&nbsp; &nbsp; &nbsp;.djvu&nbsp; &nbsp; .dll&nbsp; &nbsp; &nbsp;.dmg.docx&nbsp; &nbsp; .dwg&nbsp; &nbsp; &nbsp;.dxf&nbsp; &nbsp; &nbsp;.ear&nbsp; &nbsp; &nbsp;.eml&nbsp; &nbsp; &nbsp;.eps&nbsp; &nbsp; &nbsp;.epub&nbsp; &nbsp; .etl&nbsp; &nbsp; &nbsp;.exe.fb2&nbsp; &nbsp; &nbsp;.fla&nbsp; &nbsp; &nbsp;.flac&nbsp; &nbsp; .flv&nbsp; &nbsp; &nbsp;.git&nbsp; &nbsp; &nbsp;.gpg&nbsp; &nbsp; &nbsp;.hdf5&nbsp; &nbsp; .html&nbsp; &nbsp; .indd.ini&nbsp; &nbsp; &nbsp;.ipa&nbsp; &nbsp; &nbsp;.iso&nbsp; &nbsp; &nbsp;.jar&nbsp; &nbsp; &nbsp;.java&nbsp; &nbsp; .js&nbsp; &nbsp; &nbsp; .json&nbsp; &nbsp; .jsx&nbsp; &nbsp; &nbsp;.kdbx.key&nbsp; &nbsp; &nbsp;.log&nbsp; &nbsp; &nbsp;.lst&nbsp; &nbsp; &nbsp;.m3u&nbsp; &nbsp; &nbsp;.md&nbsp; &nbsp; &nbsp; .mdb&nbsp; &nbsp; &nbsp;.midi&nbsp; &nbsp; .mkv&nbsp; &nbsp; &nbsp;.mov.mp3&nbsp; &nbsp; &nbsp;.mp4&nbsp; &nbsp; &nbsp;.msg&nbsp; &nbsp; &nbsp;.msi&nbsp; &nbsp; &nbsp;.nfs&nbsp; &nbsp; &nbsp;.odp&nbsp; &nbsp; &nbsp;.ods&nbsp; &nbsp; &nbsp;.odt&nbsp; &nbsp; &nbsp;.ogg.opf&nbsp; &nbsp; &nbsp;.parquet .pdb&nbsp; &nbsp; &nbsp;.pdf&nbsp; &nbsp; &nbsp;.pem&nbsp; &nbsp; &nbsp;.pfx&nbsp; &nbsp; &nbsp;.pgp&nbsp; &nbsp; &nbsp;.php&nbsp; &nbsp; &nbsp;.pptx.ps&nbsp; &nbsp; &nbsp; .psd&nbsp; &nbsp; &nbsp;.py&nbsp; &nbsp; &nbsp; .rar&nbsp; &nbsp; &nbsp;.raw&nbsp; &nbsp; &nbsp;.rpm&nbsp; &nbsp; &nbsp;.rtf&nbsp; &nbsp; &nbsp;.sh&nbsp; &nbsp; &nbsp; .sql.sqlite&nbsp; .svg&nbsp; &nbsp; &nbsp;.svn&nbsp; &nbsp; &nbsp;.tar&nbsp; &nbsp; &nbsp;.tar.gz&nbsp; .tex&nbsp; &nbsp; &nbsp;.tgz&nbsp; &nbsp; &nbsp;.tiff&nbsp; &nbsp; .ts.tsx&nbsp; &nbsp; &nbsp;.txt&nbsp; &nbsp; &nbsp;.vcs&nbsp; &nbsp; &nbsp;.vhd&nbsp; &nbsp; &nbsp;.vmdk&nbsp; &nbsp; .war&nbsp; &nbsp; &nbsp;.wav&nbsp; &nbsp; &nbsp;.webm&nbsp; &nbsp; .wma.xlsx&nbsp; &nbsp; .xml&nbsp; &nbsp; &nbsp;.xps&nbsp; &nbsp; &nbsp;.xz&nbsp; &nbsp; &nbsp; .yaml&nbsp; &nbsp; .zip&nbsp;</td></tr></tbody></table>

The following processes and services are killed before the ransomware starts the file encryption:<table class="table"><tbody><tr><td>&nbsp;chrome.exe&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; firefox.exe&nbsp; &nbsp; &nbsp;&nbsp; &nbsp; msedge.exe&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; explorer.exeoutlook.exe&nbsp; &nbsp; &nbsp;&nbsp; &nbsp; vlc.exe&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; &nbsp; spotify.exe&nbsp; &nbsp; &nbsp;&nbsp; &nbsp; skype.exediscord.exe&nbsp; &nbsp; &nbsp;&nbsp; &nbsp; steam.exe&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; &nbsp; java.exe&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; python.exenode.exe&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cmd.exe&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; &nbsp; powershell.exe&nbsp; &nbsp; &nbsp; taskmgr.exewmplayer.exe&nbsp; &nbsp; &nbsp; &nbsp; tscon.exe&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; &nbsp; notepad.exe&nbsp;</td></tr><tr><td>spooler&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;bits&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; dnsclient&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; lanmanworkstationwinmgmt&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;netsh&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;iphlpsvc&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;servicesRemoteAccess&nbsp; &nbsp; &nbsp; &nbsp; ShellHWDetection&nbsp; &nbsp; SCardSvr&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;TrkWkswscsvc&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CryptSvc&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; msiserver&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; MpsSvcdefragsvc&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;upnphost&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; WindowsUpdate&nbsp; &nbsp; &nbsp; &nbsp; srservicewsmprovhost&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;AppIDSvc&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; AudioEndpointBuilder Scheduleeventlog&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PlugPlay&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Netman&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;bthservShellExperienceHost SMB&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;WinDefend&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; wuauserv&nbsp;</td></tr></tbody></table>

<h2>How to Use the Ransomware Decryptor</h2><ol><li>The first step is to download the decryptor binary. Avast provides a <a href="https://files.avast.com/files/decryptor/avast_decryptor_funksec64.exe">64-bit decryptor</a>, as the ransomware is also 64-bit and can’t run on 32-bit Windows. If you have no choice but to use 32-bit applications, you may download a 32-bit decryptor <a href="https://files.avast.com/files/decryptor/avast_decryptor_funksec.exe">here</a>.</li><li>Run the executable file, preferably as administrator. It starts as a wizard, leading you through the decryption process.</li><li>On the initial page, we have a link to the license information. Click the Next button when you are ready to start. &nbsp;</li></ol>

4. On the next page, select the list of locations you want to be searched for and decrypted. By default, it has a list of all local drives, but you can pick a different list, such as a directory with important documents:

5. On the final page, you can opt-in to back up your encrypted files. These backups may help if anything goes wrong during the decryption process. This choice is selected by default, which we recommend. After clicking Decrypt, the decryption process begins. Let the decryptor work and wait until it finishes decrypting all your files.

For questions or comments about the Avast decryptor, email <a href="mailto:decryptors@avast.com">decryptors@avast.com</a>.<h2>IOCs</h2>Ransomware samplec233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c &nbsp;Initial source code7e223a685d5324491bcacf3127869f9f3ec5d5100c5e7cb5af45a227e6ab4603&nbsp;

Avast releases free decryptor for AI-assisted FunkSec ransomware

Decrypted: FunkSec Ransomware 

Threat Analysis Engineer

A recent investigation into Neptune RAT unexpectedly uncovered notable overlaps with the notorious remote access trojan, XWORM. Given XWORM’s recent surge in popularity, this discovery prompted a deeper analysis, revealing several intriguing connections between the two malware families. This similarity was also reflected in various OSINT sources, where samples of Neptune RAT triggered detections originally developed for XWORM.

<h2>Neptune RAT</h2>Based on research from <a href="https://www.cyfirma.com/research/neptune-rat-an-advanced-windows-rat-with-system-destruction-capabilities-and-password-exfiltration-from-270-applications/">Cyfima</a>, we identified several GitHub repositories that helped us partially reconstruct the development history of Neptune RAT. Currently, there are at least two major distinct versions. The older version, which we’ll refer to as V1, has been linked to the campaign under investigation.<h3>Neptune RAT V1</h3>We discovered a GitHub repository that appears to be a fork of the original builder for Neptune RAT. Because the original repository is named MasonGroup/NeptuneRatV1, we’ll designate this version as V1. The repository contains commits exclusively from a user named "Freemasonry," with the initial commit and most activity dating back to early December 2024, before activity abruptly ceased. Additionally, the repository references a Discord server called FreemasonryTM.Notably, the builder’s user interface differs significantly from the typical UI seen in XWORM’s builder:

Despite the obvious differences in design and appearance, the codebases reveal a striking similarity. Both XWORM and Neptune RAT share a similar approach to initialization: they load all configuration settings at the start of their respective main functions and then launch executor threads to carry out their tasks.

These values are stored in a single class containing static strings. Except for the mutex, all strings are AES-encrypted and Base64-encoded, a common practice among .NET RATs. What’s unusual, however, is that both XWORM and Neptune RAT V1 use the exact same encryption routine: the mutex is hashed using MD5, and the hash is duplicated to form a 32-byte key used for AES encryption running in the insecure ECB mode. Because of this shared method, Neptune RAT V1 configurations were mistakenly conflated with XWORM’s configurations in our tracking systems.The similarities don’t end there. Both malware families implement persistence using three methods: Task Scheduler, registry entries and the startup folder. The resemblance is especially striking in the first and third approaches:

These similarities extend to their scope as well. Both malware families use identical regular expressions and target the same cryptocurrencies: BTC, ETH and TRC. Notably, although Neptune RAT V1 appears to be a recent variant, it only targets legacy Bitcoin addresses and largely ignores newer standards like Bech32 (BIP-0173, introduced in 2017). The reuse of identical regular expressions and wallet-targeting patterns further reinforces the likelihood that Neptune RAT V1 is derived from XWORM rather than being developed independently.We also examined other popular RATs such as njRAT and AsyncRAT. Their initialization processes and workflows differ significantly, and their structures and implementations do not share these specific patterns. Based on this, we conclude that the similarities between Neptune RAT V1 and XWORM are unlikely coincidental, Neptune RAT V1 is most likely a derivative of XWORM.

<h3>Neptune RAT V2</h3>We also identified another repository, forked from MasonGroup/NeptuneRAT and named NeptuneRatV2, which contains a trial version of a new builder that we’ll refer to as V2. Its initial commit dates to February 22, 2025, with GitHub showing ongoing development in the original, now-private repository. While the V2 builder’s UI appears to be a reskinned and more polished version of V1, the underlying code has undergone significant changes, suggesting either a complete rewrite or an extensive refactoring.

Neptune RAT V2 shows a drastic departure from V1. While V1 completed configuration initialization within the main function, V2 follows a completely different code flow. Unlike V1, variable names in V2 are not obfuscated, and the configuration data is stored as plain strings in the Settings class rather than being AES-encrypted. This unencrypted approach is consistent across both trial and production builds.

<h2>Conclusion</h2>We identified Neptune RAT configurations within our historical XWORM tracking data, which prompted the hypothesis that these two malware strains might be linked. OSINT investigations uncovered some tentative connections, including forks of the MasonGroup/NeptuneRatV1 repository. Although the original repository is no longer accessible, these forks contained code heavily overlapping with XWORM. Notably, the current Neptune RAT builder references the Freemasonry group, aligning with the Discord server identified in our research.Reverse engineering Neptune RAT V1 revealed further compelling similarities. While the shared resource structure might be dismissed as a coincidence, given that many .NET RATs use similar frameworks, the resource encryption scheme is essentially identical in both: AES encryption in insecure ECB mode combined with the same key-derivation method using a hard-coded mutex. Their persistence mechanisms are also functionally and structurally alike. Additionally, the clipper functionality employs the same regular expressions and targets the same cryptocurrencies. Although these expressions focus on legacy Bitcoin addresses rather than newer standards like Bech32, this link is somewhat weak given the widespread use of these expressions in malware.The strong similarities between XWORM and Neptune RAT V1, contrasted with their clear divergence from other open-source RATs, strongly suggest that Neptune RAT V1 is related to XWORM. However, these parallels do not extend to Neptune RAT V2, whose trial version, while functionally similar to V1, appears to be a complete code rewrite.<h2>List of SHA256S&nbsp;</h2><h3>XWORM:&nbsp;</h3>8dd992c363c594b80d10cbc9bc2b26ca8211f88bb12636f98a82627b847cbdae&nbsp;d3ad9240d2abdb9c43e37f546b2420f0a3890742133453650de1b012b4f4a11&nbsp;3283c0031175ae5d68e7cb81d069b40e9c028fa680d19fd34019daad3b2d4828&nbsp;<h3>Neptune V1 RAT&nbsp;</h3>f2c0ee24b7eb590e8caca3abeccd2cf73cdb4cc719e0828062ea50d9484303d5&nbsp;5b27e4bc78e05c098cd97da75f4d4df100039bdb71f6f16da99ae6b9e60a878c&nbsp;<h3>Neptune V2 RAT&nbsp;</h3>be1e0ca3b58139a64fd3cb0127a63b21ffd76721800a55f8ff16479303e8e4a2&nbsp;eac5e8915cd2be4629a5eb02cce0c26c0dd224a3cdef8bcd27b7c28b3fb36dd1&nbsp;3ff3722127d97b03fb866ee6f6c4ca9782b6cc162bd8684cec08425f56d5507f&nbsp;

A closer look at Neptune RAT V1 reveals shared code, persistence methods and encryption patterns with XWORM, suggesting a common origin

Neptune and the legacy of XWORM

Principal Research Engineer

Large language models (LLMs) are everywhere. Since OpenAI’s ChatGPT burst onto the scene a few years ago, these tools have completely reshaped how we search, ask questions and navigate the web. They have quickly woven themselves into our daily routines, helping us build grocery lists, find restaurant recommendations and even plan entire vacations.&nbsp;And all of this? It seems to come at no cost. Just create an account and start using platforms like ChatGPT (OpenAI), Gemini (Google) or DeepSeek. But that leads us to an important question: are these tools truly free? And if not, what is the real price we are paying?&nbsp;To find out, we dug into the privacy policies of the top AI platforms, so you do not have to. Here is what we uncovered about the actual cost of using today’s most popular LLMs.&nbsp;<h2>Privacy by design, and other nice stories&nbsp;</h2>Let’s walk through a familiar scenario: planning your next vacation. Like many of us, you want the perfect destination, at the perfect time, all within a specific budget. That means searching for cheap flights, affordable hotels and ideally, something close to the city center that still feels like a getaway.&nbsp;In the past, you might have spent hours, or days, browsing search engines, comparing options, reading reviews and hunting for deals. It is time-consuming and, frankly, a bit overwhelming.&nbsp;But now? Who has time for all that? More importantly – why bother when your friendly AI assistant can handle it for you? All you need to do is head to your favorite large language model and type in a well-crafted prompt:&nbsp;“Hello, I want to go for vacation on august somewhere sunny. I would like a beautiful island somewhere in the Mediterranean Sea with plenty of activities and tasty food. I do not want it to be too crowded and not extremely expensive. Find me also flights from Oslo to this destination that are cheap or tell me which dates I should look for. Finally, find me a nice hotel 3 stars and above with a room for 2 adults and 2 kids. Find something that is bellow 150 euros per day with availability for 6 days, please.”&nbsp;With a prompt like that, the model gets to work. Within seconds, it returns tailored recommendations that check all your boxes. Even better? It might offer to book the flights and hotel for you – asking for your credit card and passport details so you don’t have to lift a finger. Just sit back, relax and dream of sun-drenched beaches.&nbsp;You may even notice a few quick notifications as the system says things like “memory updated”, but nothing else seems to change, so no need to worry… right?&nbsp;Let’s take a moment to unpack what happened behind the scenes.&nbsp;When we typed our prompt, the model did not just give us a list of results – it broke down our request into smaller, more specific queries. It recognized that we are planning a vacation, live in Oslo, have a partner and two kids, prefer nice hotels, and are working with a budget of €150 per night. Piece by piece, it started building a profile of who we are and what we like.&nbsp;That profile does not just disappear. It is often stored, somewhere.&nbsp;&nbsp;And if we take a closer look at the privacy policies of major AI providers, we start to see how that information can be used. So, let’s break it down: what exactly is being collected, and how is it being used?&nbsp;<h2>ChatGPT by OpenAI&nbsp;</h2>Let’s start with the elephant in the room: OpenAI, the most popular and widely used large language model provider.&nbsp;According to its privacy policy, OpenAI collects a wide range of personal data. This includes:&nbsp;<ul><li>Account information&nbsp;</li><li>User content (everything you type)&nbsp;</li><li>Communication details&nbsp;</li><li>Other information you voluntarily provide&nbsp;</li><li>Log data and usage patterns&nbsp;</li><li>Device and location data&nbsp;</li><li>Cookies and similar tracking technologies&nbsp;</li><li>Information received from third-party sources&nbsp;</li></ul>In short: it is not just your prompts that are being collected. It is your device, your location, how you interact with the model and even data that can be bought or received from other sources.&nbsp;But what is even more important than what is collected is how it is used. OpenAI states that this data helps them “provide, analyze and maintain” their services, “improve and develop” new features, “communicate with users” and “prevent misuse or fraud.” All of which sound standard, until you read the fine print about data sharing.&nbsp;&nbsp;According to the policy, OpenAI may share your information, with broad discretion, for purposes such as:&nbsp;<ul><li>Strategic transactions (e.g., mergers or acquisitions)&nbsp;</li><li>Business operations&nbsp;</li><li>Legal compliance&nbsp;</li><li>And more vaguely, with “affiliates”&nbsp;</li></ul>So, what does this mean in practice?&nbsp;Once you provide your data, it is no longer truly yours. It can be used to train future models, shared with business partners or even leveraged in a corporate acquisition. And the kicker? This applies whether you are a free user or a paying subscriber.&nbsp;&nbsp;Your data powers the system, but it does not belong to you anymore.&nbsp;<h2>Gemini by Google&nbsp;</h2>Next, let’s look at how the most popular search engine’s AI model, Gemini by Google, handles user privacy. Unsurprisingly, the situation is very similar to what we saw with OpenAI.&nbsp;Gemini collects not just your chats and interactions, but also any files, images or browser page content you share. It logs your location, IP address, submitted feedback and even physical addresses, like home or work, if they are part of your input.&nbsp;When it comes to how this data is used, the language is broad and vague. Google states that your data helps them “provide, improve, develop and personalize” their services and machine learning technologies. But if you dig deeper into their multi-layered privacy policy, a clearer picture emerges: your personal information can also be used for targeted advertising and to make recommendations for other Google products.&nbsp;And it gets more concerning.&nbsp;Google explicitly warns users not to share personal or confidential data in Gemini chats. Why? Because human reviewers, known as annotators, may read your conversations, access your files and use that data to improve future model performance. So, not only does your data no longer belong to you; it may also be read and evaluated by actual people.&nbsp;&nbsp;Once again, it does not matter whether you are a free user or a paid subscriber. The privacy terms apply across the board. From the moment you interact with Gemini, your data becomes part of its ecosystem.&nbsp;<h2>DeepSeek: The new kid on the block&nbsp;</h2>Finally, we reviewed the privacy policy of DeepSeek, a platform that gained major traction last year after claiming OpenAI-level performance with just a fraction of the resources. It quickly rose in popularity, eventually topping Apple’s App Store charts.&nbsp;DeepSeek’s privacy policy appears standard. They collect personal data associated with your account, your input and any details you provide when contacting them. But as with the other major players, a deeper dive reveals a long list of data points they track device model, IP address, identifiers, location, cookies, payment details, text inputs, uploaded files, chat history, user age, contact information and more.&nbsp;Where things get even more concerning is where your data goes.&nbsp;Unlike OpenAI or Google, DeepSeek transfers user data from Europe and the U.S. to servers in China, placing it under Chinese authority. This means your information is no longer protected by EU or U.S. privacy laws. According to Chinese regulations, the government may access or request user data at any time, for any reason – with little transparency or recourse.&nbsp;As for how the data is used, the story remains familiar. DeepSeek claims your information helps them improve, develop and train their models, whether by feeding prompts directly into training datasets or by analyzing usage patterns. They also cite compliance with legal obligations and protecting the “interests of users and others”, though who those “others” are is never clearly defined.&nbsp;&nbsp;And, of course, they reserve the right to share your personal data with third-party partners who help operate or develop their services.&nbsp;The bottom line? No matter which platform you choose, your data stops being just yours the moment you use the service.&nbsp;<h2>How privacy has changed&nbsp;</h2>Some might argue that privacy concerns are not new, we have been sharing data online long before large language models (LLMs) took over. After all, even planning a vacation used to involve multiple search queries typed into our favorite search engine. So, what is the difference?&nbsp;That argument seems fair. But there is a key distinction.&nbsp;Before LLMs, we were in control. Searching for cheap flights or hotel deals meant navigating between websites of our choosing. We could decide which platforms to interact with, and, at least to some extent, who saw our data. Tools like <a href="https://us.norton.com/products/norton-antitrack" target="_blank" rel="noreferrer noopener">Norton AntiTrack</a> made it possible to keep trackers at bay, allowing us to interact directly with service providers while limiting what the search engine itself could collect.&nbsp;Now, that dynamic has shifted.&nbsp;When we use LLMs, the model is not just answering a question, it is becoming the gateway to everything. It decides which services to show, which sources to pull from and how to summarize or filter the information. You no longer browse freely; you are handed a curated response. And in the process, the LLM provider sees everything, from your preferences and prompts to your files, location and interactions.&nbsp;Even more troubling? You cannot always tell which sources were used or whether the results are truly in your best interest.&nbsp;So, does this mean privacy is a lost game in the age of LLMs?&nbsp;The answer is not simple.&nbsp;<h2>Countermeasures&nbsp;</h2>Unfortunately, there is no silver bullet when it comes to protecting your privacy while using large language models. But that does not mean you are completely powerless; there are a few settings and habits that can help minimize your data exposure. Let’s take a closer look at what is possible, starting with the most popular platform:<h3>ChatGPT by OpenAI&nbsp;</h3>In OpenAI’s ChatGPT, privacy-conscious users can adjust a few settings to gain more control over how their data is used. To access them, click on your avatar in the top right corner and open Settings. From there, navigate to the Data Controls tab, where you can toggle off “Improve the model for everyone.” This setting tells OpenAI not to use your chats to train future models.&nbsp;You can also visit the Personalization tab and disable memory features to stop the model from saving and recalling information about you. If you are curious about what the model has already learned, click “Manage Memories” to review and delete anything it has inferred.&nbsp;Keep in mind, disabling memory means a less personalized experience, so you may receive less accurate or relevant responses to your prompts. And unfortunately, this does not mean you are fully in the clear: even with all settings turned off, the personal and sensitive information you share may still be collected and stored by OpenAI.&nbsp;Bottom line: these settings offer a degree of control, but not full privacy.&nbsp;<h3>Gemini by Google&nbsp;</h3>With Gemini, your options to control privacy are a bit more limited. The main setting available is found by clicking on Activity in the bottom left panel, where you can disable it. However, this does not mean your data will not be stored or processed, it only means that human reviewers will not inspect the information you share.&nbsp;Gemini’s privacy policy does not explicitly say whether your data is still used to train models without human review, so it remains unclear if your chats contribute to future model training behind the scenes.&nbsp;Unlike ChatGPT, Gemini does not automatically infer information about you. Instead, the model only learns personal details if you explicitly provide them. If you want to delete stored information, you can either switch off Activity altogether or delete entries individually within the same tab.&nbsp;Still, there is no true way to avoid sharing data with Google, and once you share your information, it no longer belongs to you.&nbsp;<h3>DeepSeek&nbsp;</h3>The situation with DeepSeek is a bit grimmer. If you click the bottom left corner and then go to Settings, you will find the Profile tab. Here, the only privacy control available is the option to switch off “Improve model for everyone.”&nbsp;DeepSeek claims that they do not use your content to train their models if you disable this setting, but beyond that, their policy is vague and unclear. What is clear, however, is that once you share your data, it no longer truly belongs to you.&nbsp;<h2>What does the future bring?&nbsp;</h2>AI-powered services like these are here to stay, and they simply cannot operate without the vast amounts of data generated by their users. For now, there are few regulations or safeguards to limit how this data is collected, stored or used, which means privacy is taking a backseat.&nbsp;Until stronger protections are put in place, the responsibility falls on users to safeguard their own sensitive information. That means sharing as little personal data as possible, especially when planning something like a vacation. Otherwise, you might just find your itinerary showing up in someone else’s AI-generated recommendations in the next version of the model you use.&nbsp;The future of privacy in AI is not set in stone yet. But one thing is certain: staying informed and cautious is your best defence.&nbsp;

We dug into the fine print, so you do not have to – here is what ChatGPT, Gemini and DeepSeek are really doing with your prompts

I know what you are doing this summer: What AI knows about you

While conducting routine clipboard monitoring, our team uncovered a sophisticated attack chain masquerading as an official NVIDIA-related update. What initially appeared to be a hiring assessment challenge quickly revealed itself to be a cleverly disguised lure.&nbsp;<h2>The deceptive journey&nbsp;</h2>The attack begins with a prompt to complete a mock interview form, followed by a page instructing users to set up their camera. This page falsely claims there are issues with the user's webcam or microphone, adding a layer of urgency and credibility to the ruse.

A pop-up then urges users to “Request camera access,” which triggers a seemingly legitimate update command using an NVIDIA domain, to help the user fix his issues.

However, once copied, the command morphs into a malicious payload.&nbsp;

<h2>The attack chain&nbsp;</h2>Executing the command initiates a multi-stage attack:&nbsp;<ul><li>A malicious archive is downloaded and automatically extracted.</li><li>The VBS script launches a Python environment embedded within the archive, posing as a legitimate driver update process. It displays verbose output to further trick the user.</li><li>The Python script itself is heavily obfuscated and aligns with known tactics used by the Lazarus APT group.&nbsp;</li></ul>

Upon deobfuscation, the script reveals five major functionalities:&nbsp;<ol><li>Credential Theft: WebBrowserPassView is downloaded, decrypted and executed to extract browser-related credentials. Those credentials, together with system information, are exfiltrated to the command-and-control (C2) server.</li><li>Credential Theft: MailPassView is downloaded, decrypted and run to harvest email credentials, which are also sent to the C2.</li><li>Remote Access: An instance of MeshAgent is silently installed, providing the attackers with persistent remote control over the infected system.</li><li>Advanced Data Theft and Remote Access: A PyInstaller EXE enables file and secret extraction via FTP. Persistence is achieved through a scheduled task disguised as ChromeUpdate.exe, placed within the legitimate Chrome directory to avoid suspicion.</li><li>Cryptocurrency Targeting: Browser extensions and local folders related to cryptocurrencies are harvested and sent to the C2.&nbsp;</li></ol><h2>Attribution and implications&nbsp;</h2>The attack’s complexity and methodology, paired with the initial lure and code similarities throughout the Python scripts, strongly suggest Lazarus’ involvement. This campaign reflects the group’s evolving tactics under the DeceptiveDevelopment umbrella, combining psychological manipulation with technical sophistication to bypass defenses and exploit trust.&nbsp;<h2>Indicators of Compromise (IoCs)&nbsp;</h2>Assessment URL: hxxps[://]assessdome[.]com/invite/7e462f3c/8002565804&nbsp;C2: metakenproxy[.]com:81&nbsp;Initial VBS script (SHA256): 7013822c0a794712c5fe8f62c126e5992dca4a744882a039040569ae4ec1a868&nbsp;Initial Python script (SHA256): 03ad194456951695eb4d4ceb40d9e52aaadbc9a4f4b8b1d020077115103e5359&nbsp;WebBrowserPassView (SHA256): 36541fad68e79cdedb965b1afcdc45385646611aa72903ddbe9d4d064d7bffb9&nbsp;MailPassView (SHA256): bc7bd27e94e24a301edb3d3e7fad982225ac59430fc476bda4e1459faa1c1647&nbsp;MeshAgent (SHA256): 9757780860ec5637c412a8756f25c56f7d1d89358e447782164ba418def1c64e&nbsp;ChromeUpdate.exe (SHA256): 00bef70cd031a830f2ee1ec4ce750947a9c8838995289ecbb253426cca53d046&nbsp;

We traced a deceptive hiring assessment scam back to Lazarus, and here’s how they use psychology and obfuscation to bypass defenses

Lazarus’ latest tactics: Deceptive development and ClickFix

Malware Analyst at Gen

Ransomware isn't what it used to be, it’s gotten a corporate makeover. What began as a work of lone hackers, has evolved into a sophisticated business model known as Ransomware-as-a-Service (RaaS). In this setup, ransomware developers and a network of affiliates collaborate like any legitimate enterprise (minus the part where they extort people).&nbsp;Unlike traditional companies, ransomware groups don't publish earning reports or financial disclosures. Their operations are covered in shadows - until something goes wrong. Occasionally, these groups become targets themselves, and when they do, we get a rare glimpse behind the curtain.&nbsp;This article explores one such moment. On May 7th 2025, arguably the most notorious ransomware group, LockBit, had its panel defaced, exposing a link to a dump of its internal database. The data revealed that the panel had been in operation since at least December 18th, 2024, based on early test entries in the database. While the leak has drawn attention for its technical and operational revelations, this analysis takes a different approach: it focuses on the economic structure behind LockBit's operations. How LockBit recruits affiliates, manages operations, and generates profit. In doing so, we aim to shed light on the inner workings of the underground economy of cybercrime.&nbsp;<h2>Inside the LockBit Panel&nbsp;</h2>The leaked database revealed a sophisticated backend system - basically, a control panel for managing a global extortion operation. It included everything from user accounts and victim profiles to ransomware build information and chat messages exchanged between affiliates and victims.&nbsp;Through this panel, affiliates had access to generate customized ransomware payloads for different environments such as Windows, Linux, and ESXi. The system also stored detailed information about LockBit's victims (or "clients" as they are called internally). Each victim had an assigned public key, responsible affiliate, a payment status, and a complete chat history with the affiliate including features like message read receipts.&nbsp;&nbsp;One particularly eyebrow-rasing detail: affiliate passwords were stored in plaintext. A surprising move for a group that claims to be all about operational control. But hey, even cybercrime syndicates cut corners on cybersecurity.&nbsp;Essentially, we got a preview of a modern CMR (Customer Relationship Management) system - this time not for selling products or services, but rather for extortion.&nbsp;

<h2>A Day in the Life of a LockBit Affiliate</h2>Affiliates are individuals enrolled in the LockBit's affiliate program, think of them as franchises in the ransomware world. After gaining access to the panel, they are granted permissions to build specific versions of the LockBit ransomware. These builds are then deployed to victim systems, either through self-obtained access or via third-party brokers.When a victim is compromised, they are directed to LockBit's infrastructure, where they land in a private chatroom assigned to the affiliate who infected them. This is where real business begins: negotiation, manipulation and psychological warfare.While affiliates often present themselves as cold and transactional, the chat logs reveal a more manipulative side. Affiliates frequently use everything, from manufactured urgency to subtle threats, designed to wear victims down and push them towards payment.&nbsp;

When a ransom is agreed upon, the affiliate generates a new Bitcoin wallet (for our case, we will call it a ransom wallet) to receive the payment. Those wallets are created and controlled by the affiliate, and thus not directly stored in the LockBit panel database. They can be found in the negotiation chats.After receiving the ransom, the affiliate is expected to send 20% of the ransom to a commission wallet (a wallet address that is pre-generated and stored in the panel for each affiliate-victim pair). These commission wallets are under LockBit's control and serve as the group's cut of the ransom payments.The affiliates' share (80%) is usually moved quickly through additional wallets or cryptomixers (services designed to obscure origin of funds), the commission wallets remain largely untouched. The funds sit dormant, likely waiting for a time when they can be withdrawn without drawing the attention of the law enforcement.

<h2>Recruiting New Criminals: The Affiliate Onboarding Funnel</h2>LockBit curates a list of invitations in their panel, each with a specific Bitcoin or Monero wallet and an amount to be paid. The fee for aspiring affiliates ranges from around $700 to $810. After transferring this fee, LockBit creates a new user in the database and sets them the role of newbie. Then, the affiliate officially gets access to the panel and is able to deploy LockBit ransomware and use their infrastructure for ransom negotiations. Startup costs, criminal edition.The dump contained more than 3,600 invitations, with wallets designed to pay the fee either through Bitcoin or Monero. Because of the difficult traceability of the Monero wallets, we cannot say for sure the total number of panel fee payments. But among the invitations that used Bitcoin, only 12 users actually paid the invitation fee during the operation of the panel.<h3>The Revenue Picture</h3>Every LockBit client has an entry in the panel's table. The group collects data about the victim's website, their expected revenue, whether they are an important client or no or their assigned master public key (the tables in the database also show column for private key, however, it is empty for every victim). Since December 2024, the database contained in total of 246 victims with 208 that actually connected to the dedicated chat and started with the negotations. However, from examining the commission and ransom wallets, only 19 paid the ransom payment. The total amount of ransom extorted was 24.8 BTC ($2,660,484 by June 26th, 2025), from which 20% went to the LockBit operators and 80% to the affiliates.The following figures describe the timeline with the amount of LockBit's commissions (20% commission part that went to LockBit) and number of successfully attacked victims with ransom being paid.

In total, there were 40 active affiliates registered in the panel. Ten of them registered by paying the invitation fee, while the rest got the job of affiliate by unknown means - they were either probably affiliates even before the panel was created or registered in another way. Of all the affiliates enrolled, 35 of them started with negotiations, but only 10 of them made some profit. In the following plots, we can see those top 10 affiliates and how successful they were (80% of the ransom extorted), as well as how many messages they exchanged with the victims.

<h2>Final Thoughts: Crime as Business</h2>LockBit’s panel leak is one of the clearest examples we’ve seen on Ransomware-as-a-Service functioning like a tech startup, except its “value proposition” is fear, pressure and extortion.The business was powered by a surprisingly systematic affiliate model, built-in infrastructure, and financial incentives. Despite the flood of invitations and flashy promises, the majority of affiliates never got paid. Of the 246 victims listed, just 19 were paid, suggesting most people either lacked the funds or simply refused to play along. If this all sounds like a parody of a VC-backed startup pitch, it kind of is. But the impact is real, and the profits (while smaller than the headlines suggest) are still enough to fund the next wave of extortion innovation.For readers interested in a more technical breakdown of the LockBit panel and its components, Trellix published an in-depth reverse engineering analysis available <a href="https://www.trellix.com/blogs/research/inside-the-lockbits-admin-panel-leak-affiliates-victims-and-millions-in-crypto/" target="_blank">here</a>. &nbsp;

A rare leak reveals how LockBit operates like a startup — complete with affiliates, onboarding and profit-sharing — offering a glimpse into the business behind one of the world’s top ransomware gangs

Ransomware Inc. The Business Model Behind LockBit's Millions 

Security Evangelist at Gen

You’ve probably seen alarming headlines about a massive leak involving billions of passwords reportedly affecting users of platforms like Google, Facebook, Apple, and more. But before you panic, let's break down what's actually happening, why it matters and what you can do to protect yourself effectively.&nbsp;<h2>Q: What’s this headline-making “16 billion password leak” really about?&nbsp;</h2>A: First things first: this is not a new breach of Google, Apple, Facebook or any major platform. Despite what you may have read. Instead, researchers discovered a massive collection of credentials (over 16 billion login details) compiled from numerous past security breaches and <a href="https://www.avast.com/c-malware">malware infections</a>. While some headlines call it a ‘data leak,’ this compilation is a repackaging of stolen credentials from past breaches.<h2>Q: Where did these leaked passwords come from?&nbsp;</h2>A: These records, gathered mostly by malicious software known as "<a href="https://www.gendigital.com/blog/insights/reports/threat-taxonomy" target="_blank" rel="noreferrer noopener">infostealers</a>," have accumulated over time. Infostealers are sneaky malware programs that quietly steal login details saved in browsers and applications on infected devices. Over time, cybercriminals gather this data into huge databases—like the one now in the news.&nbsp;&nbsp;<h2>Q: Are the leaked credentials new or old?&nbsp;&nbsp;</h2>A: Most of these leaked credentials are likely older, duplicated or previously known from earlier breaches. While 16 billion sounds dramatic, many of these credentials are no longer valid. Still, it’s important not to dismiss the risk entirely because there could be plenty of credentials still active, especially if you reuse passwords.&nbsp;<h2>Q: Why should I care if the data is mostly old?&nbsp;&nbsp;</h2>A: Even if the data is partly old, it’s a critical reminder of the real-world risks associated with reusing passwords or using weak ones. Here’s why it still matters:&nbsp;<ul><li>Account Takeovers: Hackers might still gain access if you haven't changed compromised passwords. </li><li>Identity Theft: Personal information from compromised accounts can be misused in identity fraud. </li><li>Phishing Attacks: Attackers may exploit leaked data to craft convincing scams or phishing emails. </li><li>Sextortion Scams: Criminals may threaten to expose sensitive or embarrassing information allegedly obtained from breached accounts unless a ransom is paid, even if they don't actually have that information.&nbsp;</li></ul><h2>Q: How can I check if my information was part of the leak?&nbsp;&nbsp;</h2>A: Checking if your credentials are part of this or any other known leak is easy:&nbsp;<ul><li>Visit <a href="https://haveibeenpwned.com/" target="_blank" rel="noreferrer noopener">Have I Been Pwned?</a>. And enter your email address. </li><li>Use dark web monitoring services from providers like <a href="https://us.norton.com/" target="_blank" rel="noreferrer noopener">Norton</a> or <a href="https://www.avast.com/en-us/breachguard#mac" target="_blank" rel="noreferrer noopener">Avast</a>. These tools quickly tell you if your email or username has appeared in known breaches. </li><li>If you were in fact part of the leak, <a href="https://lifelock.norton.com/learn/data-breaches/steps-to-take-right-after-a-data-breach" target="_blank" rel="noreferrer noopener">here are some next steps</a>.&nbsp;&nbsp;</li></ul><h2>Q: What can I do right now to protect my information?&nbsp;&nbsp;</h2>A: Here are straightforward tips you can follow immediately:&nbsp;<ul><li>Get a Password Manager and Never Reuse Passwords: Create unique passwords for every account. Use a password manager, such as <a href="https://my.norton.com/extspa/passwordmanager" target="_blank" rel="noreferrer noopener">Norton Password Manager</a>, to help you easily create and store them.&nbsp;</li><li>Enable Two-Factor Authentication (2FA): This provides a second layer of protection. Apps and hardware keys are better than SMS-based methods. </li><li>Use Security Software: Reliable security software, such as Norton or Avast, protects your devices in real-time from threats like malware and <a href="https://www.avast.com/c-phishing">phishing attempts</a>. </li><li>Stay Alert for Phishing Scams: Be wary of unexpected emails or messages, especially those urging immediate action.&nbsp;</li></ul><h2>Q: How does a massive data breach happen in the first place?&nbsp;&nbsp;</h2>A: Massive leaks like this happen over time, not overnight. Infostealer malware quietly infects individual devices, stealing credentials saved in browsers and applications. Cybercriminals then compile, sell or leak these stolen credentials in vast databases. These compilations often contain duplicated data from older leaks, inflating their numbers dramatically.&nbsp;<h2>Q: Should I be worried? &nbsp;</h2>A: While the recent news might seem frightening, it's mainly a powerful reminder about good online habits. By adopting simple but effective practices, you significantly reduce your risks. Be proactive, stay informed and you can navigate the digital world safely.&nbsp; &nbsp;<h2>Bottom line&nbsp;</h2>Massive leaks like this one reinforce the importance of strong, unique passwords and layered security. With a few smart habits and the right tools, you can stay ahead of cybercriminals—no matter how big the numbers get.&nbsp;&nbsp;Worried your credentials were part of this leak? Learn more: <a href="https://hk-en.norton.com/breach-detection" target="_blank" rel="noreferrer noopener">https://lifelock.norton.com/learn/data-breaches/breach-detection</a>&nbsp;&nbsp;&nbsp;

What you need to know and do about the massive credential dump making headlines 

The truth behind the 16-billion password leak: Are your accounts safe? 

Imagine you're going about your day when suddenly you receive an urgent message on Instagram. It's supposedly from “Meta’s Advertising Support Center,” warning you that your account is about to be disabled due to policy violations. The message includes official-sounding language, a Meta logo, a tight deadline (today!) and a link to “verify” your identity.&nbsp;That’s exactly what is happening to influencers and business owners daily, when they receive a message like the one below:&nbsp;

The messages are part of a growing wave of social engineering attacks designed to hijack Instagram accounts and steal access to their audiences.&nbsp;&nbsp;<h2>How the scam works&nbsp;</h2>When someone clicks on the link, they’re taken to a phishing site that mimics Meta’s interface. It asks the victim to “Request Review” to prevent their account from being disabled, a tactic that prompts them to enter their login details.&nbsp;

&nbsp;After submitting login information, the next step asks for their password.&nbsp;&nbsp;Since many people now have two-factor authentication (2FA) enabled, the attackers also try to steal that second layer of security by requesting the authentication code, all under the guise of “identity confirmation.”&nbsp;&nbsp;Once the scammers have the credentials and 2FA code, they immediately lock the victim out of their account, change the login info and take full control.&nbsp;<h2>Key elements of the scam&nbsp;</h2>&nbsp;This scam follows a typical phishing pattern. Here’s what to look for:&nbsp;<ol><li>Impersonation of authority: The scammers pose as a legitimate Meta entity — “Advertising Support Center.” The name sounds official, and they use a generic support logo to appear credible.</li><li>Urgent language: The message claims your Instagram and Facebook accounts will be disabled today due to violations, creating a sense of panic that pressures the victim into acting quickly.</li><li>Fake justification: The message states that the linked Facebook page doesn’t comply with Meta’s terms, suggesting a policy violation that needs to be resolved immediately.</li><li>Malicious link: The person is told to verify their account by clicking a suspicious URL. The domain looks vaguely like a Meta service (businessmetasuite.com-complaintsupportpage...click) but is clearly fake.</li><li>Phishing page: The link opens a page that mimics Meta’s interface and asks the victim to “Request Review” to prevent their account from being disabled. Victims are prompted to enter their login credentials.</li><li>2FA bypass: Since many Instagram accounts now have two-factor authentication (2FA) enabled, attackers know that just a password isn’t enough. These phishing pages are designed to also capture the second factor by requesting the code from the victim under the pretense of confirming their identity. This gives attackers everything they need to log in, bypass security and lock the victim out.&nbsp;</li></ol><h2>What the attackers are after&nbsp;</h2>In these scams, cybercriminals aren’t looking to steal passwords just for fun, they’re after influence, money and access. An account with thousands of followers, especially one used for professional purposes, is a very valuable asset. Once hijacked, it can be used to:&nbsp;<ul><li>Push scams to followers (like investment fraud, phishing links and fake giveaways)</li><li>Demand ransom from the original owner</li><li>Sell the account on underground markets&nbsp;</li></ul>The goal is to gain control of the account, lock the original owner out and monetize the audience.&nbsp;<h2>What to watch out for&nbsp;</h2>These scams can be surprisingly effective, especially for people who manage business or creator accounts. Here’s how to spot and avoid them:&nbsp;Red flags:&nbsp;<ul><li>Messages from accounts with very few followers or no verification badge</li><li>Urgent threats about account deletion or policy violations</li><li>Requests to click external links for “verification”</li><li>Grammatical errors or awkward phrasing&nbsp;</li></ul>Tips to stay safe:&nbsp;<ul><li>Never click on links in DMs from unknown accounts. Meta and Instagram will never ask you to verify your account via private message.</li><li>Check the sender’s profile. Official Meta accounts are verified and won’t have names like advertisingsupportcenter0798.</li><li>Use two-factor authentication on your accounts to prevent unauthorized access.</li><li>Report the account to Instagram if you receive one of these messages.</li><li>Educate your team. If you manage your account with others, make sure everyone knows how these scams work.&nbsp;</li></ul><h2>Why this matters&nbsp;</h2>For businesses and creators, Instagram isn’t just a social platform, it’s a channel for visibility, customer engagement and income. Losing access can have a direct financial impact.&nbsp;Scammers know this, and they’re getting better at creating convincing traps. The more awareness we raise, the harder it is for them to succeed.&nbsp;Stay alert, stay safe — and remember, real support never slides into your DMs.&nbsp;

Fake support messages are hijacking Instagram accounts. Here’s how the scam works and how to stay in control. 

Instagram support scams: How criminals trick you into handing over your account

Threat Researcher at Gen

<h2 class="text-align-justify">Key Points</h2><ul><li>Gen Threat Labs has discovered and analyzed an elaborate Traffic Direction System infrastructure delivering FakeCaptcha, tech scams and other malware campaigns to select users.&nbsp;</li><li>The campaign entry points are infected or otherwise attacker-controlled streaming websites, file sharing services, as well as malvertising campaigns.&nbsp;</li><li>Victims are evaluated based on geolocation, IP address, and browser fingerprinting; for example, connections through VPNs or headless browsers are detected and rejected.&nbsp;</li><li>The FakeCaptcha campaign is increasing its stealth by mimicking legitimate software websites.&nbsp;</li><li>A new variant of FakeCaptcha spreading information stealers and RATs avoids detection by employing Unicode math fonts.&nbsp;</li></ul>

<h2>Introduction</h2>The <a href="https://www.gendigital.com/blog/insights/research/global-surge-in-fake-captcha-attacks" target="_blank" rel="noreferrer noopener">FakeCaptcha campaigns</a> have become a widespread malware infection vector, using clever social engineering and exploiting internet users’ confusion about common CAPTCHA practices to trick victims into infecting their own computers, typically with information-stealing malware like LummaC2, by pasting malicious commands into the Windows Run dialog.&nbsp;We have discovered an elaborate infrastructure actively used to deliver multiple variants of FakeCaptcha and other malicious content to select users. At the core of the operation is an attacker-controlled Traffic Direction System network. It has a single purpose—to fingerprint the visitor’s device and network details to determine what type of content to deliver. This could be malicious, monetized or decoy content, or no content at all. For reasons we will describe later, we are calling this infrastructure HelloTDS.

As shown in the graphic above, the scope of the campaign is massive; in April and May 2025 alone, we have protected over 4.3 million users worldwide. In terms of absolute numbers, the most affected regions include the United States, Brazil, India, and Western Europe. However, when adjusting for population size and user base, a different trend emerges: the highest relative risk is concentrated in the Balkan countries of Europe and in parts of Africa, particularly Rwanda, Egypt, Tanzania, and Kenya.<h2>Attack Chain</h2>At a high level, the attack works as follows: The victim visits an infected website or clicks on a malicious ad. The entry website requests a JavaScript file from the initial HelloTDS endpoint, which fingerprints the connection and decides whether to serve content or stay idle. If the user is not deemed a suitable victim, the attack stops here. Otherwise, the server responds with a script that further fingerprints the browser, logs mouse movements and similar, eventually sending another request to receive the final payload containing a redirect to the malicious landing page. Among users who passed the initial check, FakeCaptcha was observed to be the most prevalent malicious landing page, with Fake Updates, file downloads containing encrypted malware, tech scams and other fraudulent campaigns also having a share.&nbsp;

One specific example of the full attack chain is illustrated in the next figure: We visited the website dailyuploads[.]net, uploaded an arbitrary image file, and navigated to the link generated by the service. The resulting page included a script from HelloTDS, and when we clicked the download link, we were involuntarily redirected to a FakeCaptcha landing page attempting to trick visitors into executing the Emmenhtal loader.

<h2>From Movie Streaming or File Sharing to Malware</h2>Besides ad networks, the primary source of traffic for HelloTDS are legitimate-looking, properly functioning websites, such as movie streaming sites, torrent mirrors, file-sharing services, link shorteners, or porn websites. However, these websites are specifically crafted or manipulated—presumably also by the attacker—to cooperate with the attacker’s infrastructure and load malicious scripts. This tactic completely bypasses the need for malvertising campaigns through “legitimate” advertising companies, as these websites request the attacker’s scripts directly.Moreover, we have observed a repeating pattern in some of these websites, which offer file sharing services and promise their users financial gains. These include dailyuploads[.]net, streamtape[.]{com,net,to}, watchadsontape[.]com, bigwarp[.]art or savefiles[.]com to name a few. Security or data privacy is clearly not a priority for these services, as anyone can sign up with any e-mail address without verification. We suspect that these websites are cloned from some existing file sharing service and controlled by the same threat actor who controls HelloTDS and eventually delivers FakeCaptcha, for the primary purpose of embedding malicious popups and redirects within the page (although email &amp; password harvesting could be a “welcome” byproduct).

<h2>The Anatomy of a HelloTDS Domain</h2>An “entry point” website, like those described previously, will usually statically embed one or more HTML snippets loading remote JavaScript that look like this:

(In case of file-sharing websites described above, this snippet will be included in the page with the uploaded file, i.e. the one you share the link to, but not on the main page itself.)The source domain is randomly rotated and both path segments are randomly generated (although their length and character sets are always the same), presumably to prevent static detection. Despite this, it is easy to spot these URLs with a human eye (or a clustering algorithm). All the HelloTDS domains we have seen so far have the same format: The apex domain consists of 2-3 (pseudo)words with a “.top”, “.shop” or sometimes “.com” TLD; optionally, a short subdomain is used, consisting of usually 2, but up to 4 random letters.&nbsp;Examples of these domains include:<ul><li>yr[.]unasonoric[.]com</li><li>gq[.]binesyorker[.]com</li><li>sb[.]rowlandpodogyn[.]shop</li><li>nutatedtriol[.]com</li></ul>

Apart from the distinctive domain names, another sign that speaks for HelloTDS is that the domain names are almost exclusively registered in Panama through the Pananames registrar, and the servers reliably present Let’s Encrypt certificates during TLS handshakes.In an attempt to make tracking HelloTDS infrastructure difficult, the authors designed it to be highly dynamic, frequently rotating active domains and their DNS records. Even so, we have identified that all domains associated with this infrastructure are registered under AS7979 (SERVERS-COM) within the following IP ranges:<ul><li>23.83.64.0/22</li><li>23.109.120.0/22</li><li>23.109.128.0/19</li><li>23.109.170.0/24</li><li>94.242.232.0/21</li><li>172.240.104.0/21</li><li>172.241.48.0/21</li><li>172.255.96.0/20</li><li>173.0.146.0/23</li><li>173.237.64.0/20</li><li>188.42.104.0/21</li><li>188.42.240.0/21</li><li>209.192.192.0/18</li><li>212.117.184.0/21&nbsp;</li></ul>

Another interesting aspect shared by all HelloTDS servers is the usage of the non-standard HTTP header “megageocheckolololo”, which we believe is not commonly used by any well-known service. Its presence in the “Access-Control-Allow-Headers” HTTP response header is another indicator of a HelloTDS server.

Lastly, domains belonging to HelloTDS can be reliably identified using the information they expose via “robots.txt”:

The “/hi” endpoint always returns a simple HTML response with a single text node that says “Hello!” — hence the name HelloTDS.<h2> First Stage: Fingerprinting Based on Network Information</h2>The first decision is made by the HelloTDS server immediately upon receiving the request sent from one of the entry point websites. Since we can only send requests and observe the servers’ responses, it is difficult to tell the exact shape of the server’s decision tree. We suspect that several factors, such as IP/geolocation checks, timeouts, or maybe even pure randomness, may contribute to the result in some way.From the user’s point of view, there are two possible outcomes. In one case, the server responds with a no-op script (usually an empty function or a single-line comment containing 2 or 3 letters, like “// ipx” or “// mt”, likely codes used for “debugging” the TDS), meaning the user will not get any malicious content (from that endpoint). Alternatively, the server will respond with a large JavaScript that performs heavy client-side fingerprinting and eventually performs a subsequent request to another HelloTDS endpoint. Either way, the server sets a pair of cookies in the response; these encode information about the client’s browser, operating system and network, as detected by the server, and may be used as a client-side cache for further requests (although we have found that tampering with them is generally not useful).

The cookie values contain Zlib-compressed binary data encoded in Base64. Although the low-level data format is unknown, the data itself contains readable ASCII strings like the client’s IP address, country, or ISP, which reveal the purpose these cookies likely serve.

<h2>Second Stage: Fingerprinting in the Browser</h2>Contrary to the logic executed on the server, the next fingerprinting routine is performed in the browser (by the returned JavaScript) and can thus be reverse-engineered. The exact code returned from different HelloTDS endpoints varies somewhat in structure and complexity (at the very least, the server appends a timestamp comment to hinder hash-based detection), but all of them share the same basic high-level functionality.Crucially, the JavaScript sent by the server contains an encrypted configuration variable — a JSON string where each alphanumeric character is substituted with some other. This part of the code can be easily identified: Look for a function call with two arguments, the first being the encrypted JSON string and the second being the key: A concatenation of the characters a-z, 0-9 and a random permutation thereof. This obfuscation is not unique to HelloTDS; however suspicious it may be for an ad network to employ this technique, we have also observed this behaviour in scripts employed by the Czechia-based Clickadu ad network, which happens to share certain characteristics with the threat actor’s infrastructure.The number of key-value pairs in the configuration object varies, but some common ones we regularly encounter are “url”, “zone_id”, “uuid_url”, “rot_url”, “metric_url”, “timezone_offset” and/or “timezone_diff”. Other keys that particularly stand out due to their names are “devtools_protection” and “philanthropic_level”, which were set to “true” and 0 respectively whenever we inspected a chain that landed on FakeCaptcha in the end.The “*_url” keys contain further HelloTDS URLs, which are used to retrieve a sort of unique identifier (“uuid_url”), the target URL (“rot_url”), an endpoint to report errors and other metrics to (“metric_url”), and an endpoint for mouse movement and device sensors tracking (“url”). Notably, the “rot_url” always contains a special parameter named “md” with a placeholder for the fingerprinting information collected by the script.

The JavaScript collects the following information:<ul><li>Basic browser info: window width and height, document referrer, window location (URL), browser language, current datetime, time zone offset, and whether the site is shown in a top-level window or an iframe,</li><li>the “user id” previously returned by the UUID endpoint,</li><li>whether or not a mobile browser is used (by checking if the deprecated window.orientation property is defined),</li><li>whether or not a touch screen is present (by reporting the value of the window.navigator.maxTouchPoints property),</li><li>page title information, most common words in the host webpage as well as any keywords declared in the host document’s head element,</li><li>the approximate amount of physical memory and the number of processor cores,</li><li>battery status (level, charging state),</li><li>WebGL vendor and renderer,</li><li>a “sandbox score” consisting of 6 flags, e.g., whether the browser is Headless Chrome, or whether specific video codecs are supported,</li><li>network information, e.g., network type (Wi-Fi, Ethernet, cellular, …), effective and maximum bandwidth, or the estimated round-trip time,</li><li>screen orientation and colour depth,</li><li>whether cookies are enabled.</li></ul>

A JSON object containing this information (as well as some keys from the config) is Base64-encoded and sent in the md parameter to the rotated URL from the config via a POST request. The response contains a JSON object with a “url” key as well as a TTL and bidding details.

The returned URL is the last HelloTDS endpoint in the whole chain.<h2>Third Stage: Final Payload with Redirect to Landing Page</h2>The final step in the HelloTDS pipeline is a simple JavaScript-based redirect to the target URL.

In this case, bestfree4u[.]com simply responded with a 301 redirect to a FakeCaptcha landing page at finding-from-internet[.]fly[.]storage[.]tigris[.]dev/seacrh-result[.]html. However, when accessed from a different environment, the same domain may seem harmless. In other cases, the final HelloTDS redirect leads to tech support scams, malicious file downloads, fake browser updates, potentially unwanted browser extensions, or cryptocurrency investment platforms.<h2>The Destination: FakeCaptcha Redirectors</h2>In the past months, we have seen a highly predictable pattern in the malicious URL payloads served by HelloTDS: Almost universally, they were machine-generated domains consisting of a couple of English words and a “.com”, “.shop”, “.online”, “.info”, “.live”, “.pro” or similar TLD, and the URL path was a string with 24 hexadecimal digits, the first two usually being 67 or 68. These URLs served as simple redirects, either to FakeCaptcha, or sometimes to a decoy—usually some (benign but potentially unwanted) browser extension or cryptocurrency product website. We have seen multiple of these URLs redirect to both a FakeCaptcha landing page and a decoy at different times, which removes any doubt about this being an inherently malicious service. Example URLs include the following:<ul><li>actednow[.]com/675cb495c39bc481ddf8edd6,</li><li>buzzflying[.]shop/6767af2ee2aa535e92d62a64,</li><li>goldtera[.]live/6758b1d6467532a801fa06c4,</li><li>orbito[.]online/677120fb2cca41d88a7392a2.</li></ul>The domains used by this service could be reliably identified by being registered under Namecheap in Reykjavik, Iceland, using a Let’s Encrypt TLS certificate, and resolving to one of the following IP addresses:<ul><li>5.161.37.228,</li><li>5.161.110.119,</li><li>5.161.178.111,</li><li>23.105.163.27,</li><li>23.105.163.55,</li><li>34.142.174.238,</li><li>172.104.80.249.</li></ul>Recently, the attacker has started employing more sophisticated masking even at the level of the final payload.Additionally, the structure of served URLs redirecting to FakeCaptcha has changed – they now often include parameters with placeholders, which may not even be filled in, yet the victim can still be redirected to a FakeCaptcha landing page. We have seen different variations of these URLs, some of which omit specific parameters.

Interestingly, some of the URLs served by HelloTDS redirect victims to FakeCaptcha landing pages, but when accessed in a controlled environment, they often mimic some legitimate websites and serve some benign content. One example of such a website is&nbsp;hxxps[://]avs4u[.]net/?sub1=39388&amp;sub2=…&amp;sub3=ID&amp;sub4=677886&amp;sub5=0.0004752 — while it often redirects the victims to FakeCaptcha landing pages, it may also display mimicked content of the legitimate website www.avs4you.com, a software for processing videos and images. The downloadable binary is also legitimate, indicating an attempt to conceal malicious activity.Another example of a URL redirecting victims to FakeCaptcha but serving legitimate content in a controlled environment is hxxps[://]arcadeclassic[.]org/?sub1=681978&amp;sub2=0.00037565.&nbsp;

We therefore tried to understand the reasoning behind the decision of whether malicious content is served. As part of this effort, we explored the potential influence of the cookies being set, which we mentioned earlier. Ultimately, we have concluded that the decision is probably based solely on the IP address of the client. We suspect that if the IP address originates from a known VPN or other anonymizing services, the victim is consistently redirected to some benign content, likely because such users are not target victims and may potentially be security analysts. In such cases, HelloTDS delivers benign content to obscure its actual behavior, effectively evading analysis and avoiding detection.<h2>Delivered Malicious Content</h2>In our analysis of HelloTDS landing page redirectors, we observed that they serve a mix of both malicious and legitimate content. These “clean” redirects, however, often lead to investment-related sites, especially those involving cryptocurrencies. We believe that this choice is deliberate. Firstly, generating traffic to advertisers through non-consensual clickjacking may serve as an alternative, more predictable source of income for the attacker without “stepping into the dark” and serving hard malware. Furthermore, if the primary objective of FakeCaptcha is to infect victims with information stealers that ubiquitously target crypto wallets, redirecting users who were not deemed as ideal victims to a crypto investment platform may be the most logical strategy for the attacker in the long run.On the unequivocally malicious side, various forms of FakeCaptcha were predominant, but we have also encountered Fake Updates, tech scams, download links with encrypted archives delivering LummaC2, and various other scams. Some specific examples are listed below.

<h2>Key Takeaways and Defensive Measures</h2>The HelloTDS infrastructure behind FakeCaptcha campaigns demonstrates how attackers continue to refine their methods to bypass traditional protections, evade detection, and selectively target victims. By leveraging sophisticated fingerprinting, dynamic domain infrastructure, and deception tactics (such as mimicking legitimate websites and serving benign content to researchers) these campaigns achieve both stealth and scale.What You Can Do:<ul><li>Use reputable security software with real-time protection to block known TDS and FakeCaptcha domains. Products from Norton, Avast, AVG, and Avira automatically protect users against these threats.</li><li>Enable browser-level protections like anti-tracking and ad-blocking extensions, which may prevent the initial malicious scripts from loading.</li><li>Be cautious with file-sharing and streaming sites, especially those that promise monetary rewards or allow anonymous uploads without verification.</li><li>Avoid copying and pasting commands from unknown or suspicious websites into system dialogs like Windows Run.</li><li>Inspect suspicious domains manually or through security tools—look for signs like oddly-structured URLs, frequent domain rotation, or generic domain names.</li></ul>FakeCaptcha is not just a social engineering trick. It's the final step in a well-orchestrated system that filters, evaluates, and targets users with precision. Understanding the infrastructure—HelloTDS in this case—is key to disrupting the full chain of attack.<h2>Indicators of Compromise (non-exhaustive)</h2>You can find the complete list of IoCs on our <a href="https://github.com/avast/ioc/tree/master/HelloTDS">GitHub</a>.<h3>File Sharing Entry Websites</h3>dailyuploads[.]netstreamtape[.]tostreamtape[.]netstreamtape[.]towatchadsontape[.]combigwarp[.]artsavefiles[.]com<h3>HelloTDS Domains</h3>yr[.]unasonoric[.]comgq[.]binesyorker[.]comsb[.]rowlandpodogyn[.]shopnutatedtriol[.]commixscoggan[.]shopbu[.]unrimedironize[.]shop<h3>FakeCaptcha Redirectors</h3>actednow[.]com/675cb495c39bc481ddf8edd6buzzflying[.]shop/6767af2ee2aa535e92d62a64goldtera[.]live/6758b1d6467532a801fa06c4orbito[.]online/677120fb2cca41d88a7392a2bestfree4u[.]comavs4u[.]net/arcadeclassic[.]org<h3>FakeCaptcha Landing Pages</h3>adelaidavizcaino[.]com/cpwpartage-de-medias[.]fly[.]storage[.]tigris[.]dev/affiliate-link[.]htmlfinding-from-internet[.]fly[.]storage[.]tigris[.]dev/seacrh-result[.]html

A behind-the-scenes look at HelloTDS: the stealthy infrastructure driving FakeCaptcha scams, malware and more across millions of devices

Say hi to HelloTDS: The infrastructure behind FakeCaptcha 

Threat Operations Analyst at Gen

A new wave of charity scams is targeting Brazilians through social media. Scammers are repurposing people’s real-life struggles to create fake charity websites with the intent to steal money from individual charity donors. Victims of this scam may not even be aware that their donation has not reached its intended recipient.&nbsp;The scam starts on social media such as Facebook, Threads and Instagram. Scammers use fake profiles or hacked accounts to join fundraising groups and groups dedicated to local towns. They often repost several posts from other accounts to gain legitimacy, followed by posting links to a prepared fake donation website.&nbsp;

Once the victim with charitable intentions clicks on the link, they are presented with a fake copy of a known fundraising website, often Vakinha. The scammers mostly copy real stories posted by people in need to scam money away from donors. The websites sometimes contain links to YouTube videos posted by the original profiles on the real website.&nbsp;&nbsp;

The websites feature a fake Facebook feed with incoming comments from people who have supposedly donated to the cause. There is also an incoming donation effect that tries to lend legitimacy to the scam, making the victim believe that other people are actively donating.&nbsp;If the victim decides to donate, they are redirected to a payment page with a PIX code and QR code. PIX is a real-time instant payment system in Brazil, created by the Central Bank of Brazil. The payment page often contains further encouragements and a how-to-donate manual. Unlike with phishing and other types of cyberattacks, the scammers are not going after victim’s details, they just syphon away money from legitimate charitable causes.&nbsp;

If the victim sends away the payment, the website displays a thank you page, attempting to convince the victim that the money sent has been received by the cause. It is likely that victims may never know they have sent money away to scammers. The other victims, the people in actual need of assistance, never receive the money.&nbsp;

Avast blocks this new scam and has protected hundreds of users in Brazil in the last week. If you encounter a similar donation scam, please consider the following:&nbsp;<ol><li>Use reputable websites that verify profiles and charity cases. This way you can avoid falling for a scam or sending money to scammers instead of the intended cause.</li><li>Beware of fake links spread through social media. Verify the URL you are clicking on and check that the website is the one you are intending to donate through.</li><li>Research the organization. If you see a post asking for donations with a link to a website, do a quick Google search to ensure its legitimate.</li><li>Avoid pressure tactics. Scammers often create a sense of urgency to keep their victim engaged. Be wary of sending money away if you are feeling pressured.&nbsp;</li></ol>

Scammers are faking charity sites to steal donations. Here's how to spot them before it's too late. 

False hope: Scammers exploit Brazil’s kindness in latest charity scam

Principal Data Scientist at Gen

Over the past few months, dozens of ads have flooded Czech Facebook feeds, promising clearance sales from small boutiques, often accompanied by a&nbsp;heartfelt story about a store closing down and bidding farewell to loyal customers. At first glance, these ads look like genuine local sales. But a closer look reveals a sophisticated scam campaign, often powered by AI-generated images and spread through hundreds of variations.&nbsp;In this article, we’ll dive into one such campaign running under the name “Jana Praha” to uncover why it’s so dangerous and how to recognize it before you fall victim.&nbsp;<h2>How the Scam Works&nbsp;</h2>Imagine scrolling through Facebook and seeing an ad from what appears to be a small fashion brand. The message is emotional and believable:&nbsp;“It is with great sadness that I must announce something very difficult. After many years of love and dedication to my boutique Jana Praha, the time has unfortunately come to say goodbye. As a small business, I’ve always struggled against the big chains, which are increasingly dominating the market thanks to their huge budgets and influence. Sadly, it’s no longer financially sustainable for me. The world is changing—and I just can’t keep up…”&nbsp;The story sounds authentic, the name Jana is familiar and the photo shows a woman standing outside a boutique storefront. But here’s the catch—the woman isn’t real. These images are AI-generated, changing subtly across different ads and the storefronts don’t exist in reality.&nbsp;No real map locations, no customer reviews, no store history. The contact information listed in the terms shows a suspicious business registration and address unrelated to the Czech Republic:&nbsp;<ul><li>Business name: Riet E-com&nbsp;</li><li>Company ID: 95561110&nbsp;</li><li>VAT ID: NL005161660B82&nbsp;</li><li>Customer support email: <a href="mailto:podpora@jana-praha.cz" target="_blank" rel="noreferrer noopener">podpora@jana-praha.cz</a>&nbsp;</li><li>Business address: Tessenvijverstraat 3, 4885BC Achtmaal (in the Netherlands)&nbsp;</li></ul><h2>The Facebook Pages Behind the Scam&nbsp;</h2>This fake e-shop is promoted through multiple Facebook pages—like <a href="https://www.facebook.com/ads/library/?active_status=all&amp;ad_type=all&amp;country=CZ&amp;is_targeted_country=false&amp;media_type=all&amp;search_type=page&amp;view_all_page_id=613481905182526" target="_blank" rel="noreferrer noopener">Jana Praha Boutique</a>, <a href="https://facebook.com/61574563287873" target="_blank" rel="noreferrer noopener">Jana Praha Fashion</a> and <a href="https://www.facebook.com/ads/library/?active_status=all&amp;ad_type=all&amp;country=CZ&amp;is_targeted_country=false&amp;media_type=all&amp;search_type=page&amp;view_all_page_id=631552540034282" target="_blank" rel="noreferrer noopener">Jana Praha</a>—all of which share one thing in common: they have no organic posts, only thousands of ads.&nbsp;Clicking the ads redirects people to a fake Shopify-based online store translated into Czech. Enter your payment details here, and you risk losing money, immediately or later through unauthorized use.

<h2>How Many Ads Are There?&nbsp;</h2>Meta’s Ad Library reveals hundreds of campaigns running simultaneously. One page might have hundreds of active ads at once, each with slight variations in images and text. In total, thousands of ad versions rotate continuously to flood Facebook and avoid detection.Each ad targets a limited audience for a short time to prevent negative comments from accumulating and warning others.<h2>Why the Scam Works&nbsp;</h2>Several psychological and technical tricks make this scam effective:&nbsp;<ul><li>Emotional storytelling: Stories of family struggles, “doing it for the kids,” and thanking loyal customers&nbsp;</li><li>Urgency: Phrases like “final clearance” and “last pieces” pressure people to act fast&nbsp;</li><li>Familiarity: Common Czech names like Jana, Petra and Martina boost trust&nbsp;</li><li>AI visuals: Photos look real enough but are difficult to verify&nbsp;</li><li>User behavior: Most people don’t check if the store actually exists or if photos are genuine&nbsp;</li></ul><h2>What Was Suspicious About This E-Shop?&nbsp;</h2>The photos were almost too perfect. &nbsp;Models with flawless smiles, pristine dresses and clean backgrounds, but with inconsistencies in storefront signage and surroundings.&nbsp;The boutique’s “closing” story clashed with an always-stocked e-shop boasting “new arrivals” in every size. Promises like “Ships today if you order by 11 PM” are unrealistic for a small local store.&nbsp;Package tracking was offered, but the tracking page’s browser tab read “Vlog de bestelstatus - Juno mode”, a sign the site was hastily copied from a foreign template.&nbsp;No legitimate contact info or store address, only an email that went unanswered. The terms listed a Dutch business address, further increasing suspicion.&nbsp;Customer reviews appeared as simple quotes on the site, with no independent verification. Claiming “4,500 satisfied customers” seemed inflated for a supposed small boutique.&nbsp;A WHOIS lookup showed the domain was registered just in March 2025, contradicting the brand’s claim of a long tradition.&nbsp;

A quick Google search found no trustworthy references to the store, only a Facebook post from the real owner of a similarly named boutique warning about stolen photos and brand identity misuse.&nbsp;<h2>What Can You Do to Protect Yourself?</h2><ul><li>Don’t click on emotional ads promising unbelievable deals without verifying the source.&nbsp;</li><li>Check for real social media posts, trusted reviews and a website history.&nbsp;</li><li>Be wary of strange domain names and photos that seem too perfect.&nbsp;</li><li>Report suspicious ads to Facebook to help protect others.&nbsp;</li></ul>The “Jana Praha Fashion” case shows how easily the public can be manipulated with a mix of AI, emotional storytelling, and targeted advertising. Scam campaigns aren’t spreading through phishing emails or SMS anymore—they’re coming directly through ad systems that have massive reach and user trust.&nbsp;To protect yourself, stay vigilant. If you come across something suspicious, report the ad. And if this topic concerns you—it’s time we start talking about it more publicly.&nbsp;

Inside the AI-powered farewell sale scam targeting Czech Facebook users and tips to recognize it.

What a scam ad campaign for a fake online store on Facebook looks like in 2025: The case of “Jana Praha”

You’re not just carrying a phone anymore, you’re carrying your identity, your memories, your finances, your secrets. And that’s exactly what cybercriminals are after.&nbsp;In recent months, mobile threats haven’t just grown. They’ve gotten personal. From intrusive adware hijacking your screen time to spyware designed to blackmail, monitor or steal your crypto keys, and banking trojans that steal your NFC tokens to be used for money withdrawals at ATMs, attackers are escalating their tactics to target the people behind the devices.&nbsp;Adware once felt like a nuisance. Now, it’s hard to ignore. Attacks rose by 18% in Q1, led by threats like HiddenAds and MobiDash. MobiDash alone jumped 90%, disguising itself, hiding its icon and overwhelming screens with intrusive ads. It’s turning everyday devices into distraction engines.&nbsp;

These aren’t isolated incidents. Users in Brazil, India, Argentina, Mexico and Turkey were hit hardest, with risk ratios rising sharply. Adware’s persistence is less about innovation and more about sheer volume and its impact is felt every time someone’s screen is hijacked by something they never asked for.&nbsp;While adware dominated in volume, spyware showed the most disturbing evolution. Our telemetry shows a 7% overall increase in mobile spyware detections, but the true story is in where and how it’s spreading.&nbsp;In Brazil, Spain and Turkey, spyware detections jumped by more than 80%. SpyMax is the primary driver, often hidden in repackaged apps and games. In some cases, it even snuck onto the Play Store. But that was only the beginning.&nbsp;But these were eclipsed by the emergence of SparkCat, a spyware strain that may mark a turning point in mobile security. Disguised as AI tools and food delivery apps, SparkCat managed to slip into both the Google Play Store and Apple App Store, an extremely rare feat.&nbsp;

Initially benign, the apps later pushed an update containing a stealthy SDK. Once activated, it used optical character recognition (OCR) to scan the screen for crypto wallet recovery phrases, effectively turning mobile screens into leak points for financial keys.&nbsp;The most alarming part? Evidence suggests SparkCat’s creators compromised the supply chains of legitimate developers to inject their code, without the developers’ knowledge. SparkCat is likely the first true infostealer to operate within the App Store — a milestone we hoped never to reach.&nbsp;Even more harrowing is the rise of SpyLend, a new variant of the notorious SpyLoans spyware family. Popular in India, it masquerades as a finance calculator on the Play Store. But once installed, it redirects users to an off-platform APK download, bypassing Play Store protections entirely.&nbsp;

From there, the app harvests everything: SMS, call logs, documents, photos and even clipboard content, exposing credit card numbers and passwords. But this isn’t just about data. It’s about control.&nbsp;Some mobile threats are crossing new lines — misusing personal content and blurring the boundary between digital risk and real-life impact. In rare cases, we’ve seen manipulative tactics like fake images used to pressure or intimidate victims. These threats remind us why strong mobile protections and digital confidence matter more than ever.&nbsp;At the same time, a shift is underway: some banking trojans now rely on social engineering over technical trickery. Instead of breaking in, they convince users to open the door. It’s a clear signal that awareness and smart defenses are just as critical as detection.&nbsp;

In the ever-evolving mobile banking malware ecosystem, Crocodilus emerges as the novel threat active in Spain and Turkey. Pushing the limits of device control, it abuses accessibility permissions to display fake banking apps overlays and keylogs every input. Not only that, it tricks victims into accessing their crypto wallets, stealing recovery phrases through screen monitoring. It’s part of a disturbing trend: malware that doesn’t just steal, but makes you unwittingly help it do so.&nbsp;&nbsp;

NGate, a pioneer of stealing NFC tokens from victims, strikes again. Victims are faced with a believable copy of their bank’s website, distributed through fake money withdrawal SMS alerts. Once NGate initiates its NFC theft, threat actors must get physically involved to withdraw money from ATMs in the respective country.

Unfortunately, victims have already helped the threat actors by providing their PIN during the infection process, allowing them to proceed with the transaction. Previously targeted at Czech Republic, Slovakia and Hungary, our telemetry shows new variants popping up in Russia and Poland, disguised as government portals and bank apps.&nbsp;These mobile threats reveal a clear trend: attackers are investing in more personal, persistent and creative ways to reach users. From adware that blurs the line between annoyance and abuse, to spyware capable of bypassing official app store protections, the threat landscape is evolving in both scale and sophistication.&nbsp;&nbsp;What’s changing isn’t just the threat — it’s how it works. Attackers are tapping into trust, using familiar apps, clever tactics and even legitimate supply chains to get closer to people, not just devices. As mobile becomes the hub of our digital lives, understanding these shifts is just as important as spotting them.&nbsp;These threats aren’t just technical—they’re personal. They blend into daily routines, using design and deception to stay one step ahead. That’s why staying informed is powerful. It helps you see what’s coming and respond with clarity.&nbsp;Knowledge is step one. Protection is the difference-maker. The right mobile security tools don’t just detect threats — they anticipate them, block them and help you move forward with confidence. Because digital freedom means knowing you’re covered, no matter how threats evolve.&nbsp;

Mobile threats are getting personal — and more dangerous. Here’s what Gen researchers uncovered in Q1. 

When mobile threats turn personal 

Senior Malware Researcher

Cybercriminals continue to refine their methods, and our latest discovery ties together multiple advanced attack techniques into a single campaign which demonstrates the latest trend in “Scam-Yourself” attacks. This particular campaign utilizes fully AI-generated videos created using deepfake principles and AI-generated scripts, created with ChatGPT and hosted on Pasteco and other script sharing websites. In our&nbsp;<a href="https://www.gendigital.com/blog/insights/reports/threat-report-q3-2024">Q3/2024 Threat Report</a>, we reported a 614% surge from “Scam-Yourself” attacks, those which&nbsp;manipulate people into voluntarily downloading malware or compromising their own security. Shortly after, we announced our&nbsp;<a href="https://www.gendigital.com/blog/news/family-of-brands/clipboard-protection">Clipboard Protection</a> feature, adding an extra security layer against these attacks. In a matter of days, we uncovered&nbsp;<a href="https://www.gendigital.com/blog/insights/research/cybercriminals-leveraging-chatgpt-to-create-malicious-payloads">cybercriminals actively leveraging ChatGPT to create and refine malicious payloads</a>. This article sheds light on the latest evolution of these tactics.What makes this discovery even more significant is the revelation that the campaign originates from a well-crafted video hosted on a verified YouTube channel with 110,000 subscribers. The channel appears to have been either compromised or acquired, and the video has already amassed +24,000 views. Additionally, numerous YouTube accounts, all variations of the same AI-generated profile, have been used to amplify the scheme, accumulating hundreds of thousands of subscribers.

<h2>The Dangerous Convergence of Threats</h2>This campaign connects multiple security challenges:<ul><li>Compromised accounts: The attack likely started with data theft using information stealers, allowing cybercriminals to take control of a verified YouTube channel and repurpose it for their scam operations. The channel, at first glance, appears legitimate as it includes a list of videos from the official TradingView channel, making it seem trustworthy. However, it also contains an unlisted deepfake video, which can be shared externally. This deception makes it difficult for victims to identify the fraud when viewing the channel. Furthermore, numerous fake accounts have been created, misusing this person as the “face” of multiple fraudulent channels. These fake YouTube accounts using the AI persona of Thomas Harris / Thomas Roberts have hundreds of thousands of subscribers. Many appear to be taken over or bought-off old accounts, some dating back to 2011. These accounts are continuously being taken down. Additionally, the engagement on these channels is manipulated, with all positive comments typically being 'bought' and added in bulk within a short period. Some of the observed fake accounts include @ThomasHarris-Iives, @thomas_hrris_a, @Thomas_View, @Thomas_Harris_Us, @ThomasRoberts_crypto, @tiommewweb3, @Thomas_Now, @RudoAMIN, and @UC6QvVs237am4RyYo1vGHF3g.</li></ul>

<ul><li>Deceptive tutorial video: The video presents itself as a tutorial to unlock TradingView’s developer mode, claiming that doing so will provide AI-powered indicators to help users grow their portfolio by a significant percentage. This lure is designed to appeal to individuals looking for an easy way to maximize their financial gains, making them more susceptible to following the video's malicious instructions.</li></ul>

<ul><li>Deepfake technology: The video appears to depict a completely AI-generated person, with no identifiable real-world counterpart. It utilizes techniques similar to those used in deepfake creation, combining voice, facial synthesis, and body movement replication to create a highly convincing impersonation. Furthermore, we’ve observed more AI-generated videos used across the fake profiles, suggesting attackers are re-creating multiple versions of this well-crafted content.</li><li>AI-generated malicious scripts: The script used in the attack was created with AI, in this particular case with ChatGPT. The script itself remains largely unchanged across different variations of the campaign, with the only significant difference being the Command-and-Control (C&amp;C) address. Attackers modify the C&amp;C domain as previous ones are flagged or blocked, demonstrating an adaptive approach to evade detections.</li><li>Scam-Yourself trend: The video demonstrates the same tactics seen in past attacks, instructing users to manually execute harmful commands (e.g., pressing Win+R and entering specific code).</li><li>Hosting services: Attackers have shifted from pasteco[.]com to equivalent sites such as 0bin[.]net or pastefy[.]com, and likely attacker-controlled domains such as pasteco[.]net and pasteco[.]io, a strategy designed in an attempt to evade detection.</li><li>Remote access and data theft: The end goal of this campaign is to install NetSupport or Lumma Stealer, granting attackers full control over the infected system and enabling data exfiltration. Cryptocurrency serves merely as a lure to attract an audience motivated by easy profit.&nbsp;</li></ul><h2>Malvertising as the origin</h2>Especially when we consider that some of the videos are unlisted and on verified accounts, one might ask how the user comes across such a video in the first place. What we can see is quite a big promotion via Sponsored advertising on YouTube, allowing the videos to pop-up while watching other videos with similar type of content, for example cryptocurrency related investments or other financial opportunities.

In this case, the account was named Oscar Davies, leading to slightly different variant of the AI generated video. This indicates that the attackers don’t hesitate to re-generate the original video to refresh the content and stay undetected for a longer period of time. When following the advertisement, the video is, in this case, also verified with the checkmark. We can see that the account has nearly half a million subscribers, with the video having 12 thousand views and the time of the analysis. Interestingly, these numbers do not match with the advertised views.

We observed multiple different thumbnails and video titles for the advertised videos, too, likely provided by additional AI driven image generation.

<h2>How We Are Protecting Users</h2>Our security solutions detect and block this threat. Our&nbsp;<a href="https://www.gendigital.com/blog/news/family-of-brands/clipboard-protection">Clipboard Protection</a> feature, designed to prevent clipboard-based scams, is particularly relevant in mitigating such attacks. This campaign reinforces the growing importance of proactive security measures against evolving social engineering threats.We remain committed to tracking these threats and investigating similar campaigns as they evolve. With deepfakes, AI-generated malware, and social engineering tactics advancing rapidly, proactive security measures are more crucial than ever. Given the involvement of a major player in this space, Lumma Stealer, it is likely that we will see even more campaigns following a similar model. This trend could lead to the creation of even more sophisticated AI-generated personas, making it increasingly difficult to distinguish real from fake. As cybercriminals refine their techniques, vigilance and robust security measures will be essential in combating these evolving threats. Stay safe and always verify sources before executing any online instructions.<h2>Indicators of Compromise (IoCs)</h2>902387e7be025fbe2c4b1a3f2ea212a26f9cbbcf82f656416b362c84089b712b (PowerShell commandline)a5e0635363bbb5d22d5ffc32d9738665942abdd89d2e6bd1784d6a60ac521797 (PowerShell script)developer-update[.]dev (C&amp;C)1b5b3e104f80e09f006a1080fefae16fed2dbf1abb697e464cbef3f2fabc5d90 (PowerShell commandline)begenokev[.]com/oauth/harum/voluptas (C&amp;C)2fe60aa1db2cf7a1dc2b3629b4bbc843c703146f212e7495f4dc7745b3c5c59e (Lumma Stealer)developerbeta[.]dev (C&amp;C)b89aa5a2837aa09d0caae2bc5be130186f236471411b279049dd1cfce6a5643f (PowerShell commandline)bcbb6de248a95bfdbf4cfe8db8d84f8a10db2896f27cb90058c69b7bb052d506 (PowerShell script)