Our team invests countless hours in the exploration, discovery and investigation of emerging trends such as AI and futuristic technology. Stay informed about the evolving landscape of cyberthreats through our diligent efforts and insights.

Threat Analysis Engineer

Research

In recent weeks, our Threat Labs researchers have uncovered two new toolsets that show just how adaptive the DPRK’s operations have become. Kimsuky, known for its espionage-style campaigns, deployed a new backdoor we’ve named HttpTroy, while Lazarus introduced an upgraded version of its BLINDINGCAN remote access tool.&nbsp;Both attacks reveal the same underlying pattern: stealthy code and layered obfuscation. In this post, we’ll break down how these tools work, what they target and what defenders can learn from the latest moves inside the DPRK playbook.&nbsp;<h2>Inside DPRK’s Latest Campaigns: How Kimsuky and Lazarus Refine Their Playbook&nbsp;</h2>The Kimsuky attack targeted a single victim in KR and started with a ZIP file that looked like a VPN invoice, then quietly installed tools that let attackers move files, take screenshots and run commands. The chain has three steps: a small dropper, a loader called MemLoad, and the final backdoor, named “HttpTroy”. We see several signs that possibly tie this activity to Kimsuky: the Korean language lure, an AhnLab-style scheduled task name and command patterns seen in past Kimsuky work.&nbsp;&nbsp;The Lazarus attack targeted two victims in CA and was caught in the middle of the attack chain, where we observed a new version of the Comebacker malware leading to a new variant of their BLINDINGCAN remote access tool.&nbsp;&nbsp;We’ll explain how these attacks work in plain terms, why North Korea-aligned groups use these tricks, and simple steps you can take to avoid similar threats.&nbsp;Quick takeaways for readers: do not open any attachments you did not expect, treat .scr files as programs not documents and keep your security software on and updated.&nbsp;<h2>Diving into the Kimsuky attack: MemLoad and HttpTroy&nbsp;</h2><h3>The Initial dropper&nbsp;</h3>While the exact delivery mechanism remains unknown, telemetry indicates that the samples was obtained via an internet download, packaged within a ZIP archive named “250908_A_HK이노션_SecuwaySSL VPN Manager U100S 100user_견적서”. Given the nature of the filename, it is highly probable that the archive was distributed through a phishing email.&nbsp;Contained within the archive is a “.scr” file bearing the same name. Execution of this file initiates the entire infection chain.&nbsp;This initial sample is a lightweight GO binary containing 3 embedded files. These files are decrypted using a simple XOR operation with the key “0x39”, then written to disk and executed. To maintain user deception, the binary displays a PDF document as a decoy, displaying a fake bill for VPN services, while simultaneously registering the next stage backdoor as a COM server using “regsvr32.exe”. See below an image of the decoy PDF and the decompiled code that decrypts it.&nbsp;

<h3>Stage 1 backdoor: Memload_V3&nbsp;</h3>The first backdoor, internally identified as Memload_V3 (“Memload_V3.dll”), performs 2 primary functions:&nbsp;

<ol><li>Re-registering the “AhnlabUpdate” scheduled task&nbsp;</li></ol>Using COM interfaces instantiated via the Windows API “CoCreateInstance”, the backdoor re-creates a scheduled task named “AhnlabUpdate”, targeting one of the more prevalent anti-virus software in the Korean region to avoid suspicions. This task is configured to execute the current DLL silently using the command “regsvr32.exe /s &lt;CURRENT_FILENAME&gt;”. The task is then set to repeat every minute, using the “PT1M” repetition pattern.&nbsp;

2. Decrypting and executing the final payload&nbsp;After establishing persistence, Memload_V3 proceeds to decrypt the third file dropped by the initial sample. The decryption algorithm used is RC4, and once decrypted, the payload is loaded directly into memory. Execution is then triggered via its exported function named “hello”.

<h3>Final payload: HttpTroy backdoor&nbsp;</h3>The final stage of the attack chain is a highly obfuscated backdoor, internally named HttpTroy (“httptroy_dll.dll”). This component grants the attackers full control over the compromised system, offering a wide range of capabilities:&nbsp;<ul><li>File upload and download</li><li>Screenshot capture and exfiltration</li><li>Command execution with elevated privileges</li><li>Loading an executable in memory</li><li>Reverse shell</li><li>Process termination and trace removal&nbsp;</li></ul>HttpTroy employs multiple layers of obfuscation to hinder analysis and detection. API calls are concealed using custom hashing techniques, while strings are obfuscated through a combination of XOR operations and SIMD instructions.&nbsp;Notably, the backdoor avoids reusing API hashes and strings. Instead, it dynamically reconstructs them during runtime using varied combinations of arithmetic and logical operations, further complicating static analysis.&nbsp;&nbsp;

The HttpTroy backdoor communicates with its command-and-control server exclusively via HTTP POST requests. All transmitted data (both commands and responses) is obfuscated using a two-step process: XOR encryption with the key 0x56, followed by Base64 encoding. Each query to the C2 has a specific ID and is followed by buffers of interest, all formatted in a single special string. Commands received from the server follow a simple structure: “&lt;command&gt; &lt;parameters&gt;”.&nbsp;

After executing a command, the backdoor reports the result to the C2 using ID 2:&nbsp;<ul><li>ok - Successful execution</li><li>fail - Execution failed</li><li>connect ok - Successful reverse shell connection&nbsp;</li></ul>To request a new command from the C2, the backdoor sends a query with ID 1.&nbsp;Below, you can see an example flow of a command in decompiled code, together with the decryption flow of a response from the server for the “down” command:&nbsp;

<h3>Indicators of compromise&nbsp;</h3>SCR file: e19ce3bd1cbd980082d3c55a4ac1eb3af4d9e7adf108afb1861372f9c7fe0b76&nbsp;Memload_V3: 20e0db1d2ad90bc46c7074c2cc116c2c08a8183f3ac6f357e7ebee0c7cc02596&nbsp;HttpTroy: 10c3b3ab2e9cb618fc938028c9295ad5bdb1d836b8f07d65c0d3036dbc18bbb4&nbsp;C2: hxxp[://]load[.]auraria[.]org/index[.]php&nbsp;User-agent (wide-string): Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36&nbsp;Mutexes:&nbsp;a:fnjiuygredfgbbgfcvhutrv&nbsp;u:fnjiuygredfgbbgfcvhutrv&nbsp;<h2>Analysis of the Lazarus Attack: the comeback of Comebacker and the new BLINDINGCAN variant&nbsp;</h2><h3>Comebacker, yet again&nbsp;</h3>During routine threat monitoring, our team identified a sample indicative of a new variant of the previously documented Comebacker malware, which is attributed to the Lazarus APT group. While our telemetry captures the infection chain from this stage onward, the initial access vector remains unclear. However, based on the absence of any exploited vulnerabilities, we assess with moderate confidence that the initial compromise likely originated from a phishing email.&nbsp;We observed two closely related instances of the Comebacker malware:&nbsp;<ul><li>A DLL variant located at “C:\ProgramData\comms.bin” (internally named “NetSvcInst_v1_Rundll32.dll”, using the exported function “InfoHook”)</li><li>An EXE variant located at “C:\ProgramData\Comms\ssh.bin”&nbsp;</li></ul>The DLL sample appears to have been executed via a Windows service, whereas the EXE variant was launched through cmd.exe, suggesting a different execution context.&nbsp;Despite their differing formats, both variants share identical functionality. Their primary objectives include:&nbsp;<ul><li>Validating execution via a specific command-line parameter</li><li>Decrypting embedded payloads</li><li>Configuring registry entries</li><li>Deploying the next-stage payload as a service&nbsp;</li></ul>The dropper's behavior can be summarized in the following stages:&nbsp;<ol><li>Dynamic function resolution&nbsp;</li></ol>Prior to payload execution, the malware dynamically resolves API functions from system DLLs. This is achieved by XOR-decrypting hardcoded strings using a PRNG-like stream.

<ol start="2"><li>Parameter validation&nbsp;</li></ol>Execution is gated by the presence of specific command-line arguments. The DLL variant expects "up45V3FR9ee9", while the EXE variant requires "760H33ls9L5S". If the parameters are incorrect, the malware terminates.&nbsp;<ol start="3"><li>Service name selection&nbsp;</li></ol>The malware enumerates the “REG_MULTI_SZ” entries under “HKLM\ SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\netsvcs”, identifying service names that are listed but not yet registered under “HKLM\ SYSTEM\CurrentControlSet\Services”. A random candidate is then selected and reused as both the service name and the name of the service DLL.&nbsp;

For some of the string decryption processes, it uses the HC256 stream cipher, while for others it uses RC4.&nbsp;

<ol start="4"><li>Timestamp logging&nbsp;</li></ol>The malware writes the current local time to “C:\Windows\system32\AppxProvision.xml” using the format “[%04d-%02d-%02d %02d:%02d:%02d] %s\n”, appending the chosen service name. It then modifies the file’s attributes to mimic those of win32k.sys.

<ol start="5"><li>Payload deployment and configuration&nbsp;</li></ol>The embedded PE file is decrypted using HC256, then decompressed via zlib, and written into a decoy file in the current directory named “kjepl.xml”. To obfuscate its true size, random data is appended at the end. The file is then moved via “cmd.exe” to “C:\Windows\system32\&lt;SERVICE_NAME&gt;.dll”, and its attributes are altered similarly to the timestamp file, but this time it mimics “cmd.exe”.&nbsp;

Subsequently, the embedded configuration is decrypted using HC256, re-encrypted using RC4 and stored as a binary blob in the registry under&nbsp; “HKLM\SYSTEM\ControlSet001\Services\kbddes\GUID”. The configuration includes potential C2 addresses, the path to cmd.exe, the path to the dropped DLL, %TEMP%, and a special integrity-check value.&nbsp;

<ol start="6"><li>Service execution&nbsp;</li></ol>Finally, the malware registers and starts a service using the randomly selected name, thereby initiating the next stage of the attack.&nbsp;

<h3>Second stage: Compcat_v1.dll&nbsp;</h3>Both observed variants of the Comebacker dropper deploy the same service binary, internally named “Compcat_v1.dll”. This component serves a singular purpose: it acts as a wrapper for the final payload.&nbsp;Upon execution, it decrypts an embedded PE file using the HC256 stream cipher. The decrypted data is then decompressed using the miniz library, a lightweight zlib-compatible implementation. The resulting PE is loaded directly into memory, employing a technique similar to that used by the aforementioned MemLoad sample.&nbsp;Once the payload is successfully mapped into memory, the malware invokes the exported function “OPENSLL_NONPIC”, thereby initiating the execution of the final stage.&nbsp;

<h3>Final payload: new variant of BLINDINGCAN&nbsp;</h3>As the final payload, the attackers employed a new variant of their BLINDINGCAN remote access tool, improved with additional cryptographic elements and more capabilities. Internally named “T_DLL64.dll”, it acts as a complete suite for attackers, offering them the possibility to perform any action they desire.&nbsp;The backdoor has 2 operating modes, which are dictated by the parameter passed to the main function:&nbsp;<ul><li>13398 – config stored in a file</li><li>13399 – config stored in registry&nbsp;</li></ul>Apart from the “OPENSSL_NONPIC” export, this sample exports another function, called “MemLoad”, which uses the other operating mode (13398).&nbsp;The malware’s execution begins by dynamically loading APIs, using the same techniques as in the previous cases. It then moves on to loading the configuration, picking a C2 at random and attempting to connect to it.&nbsp;Next, it attempts to authenticate itself within the chosen C2 by sending a “GET” request with the integrity-check value from the config, followed by 4 random uppercase letters. This newly obtained value is then shifted with a random offset between 0 and 9 (which is appended at the end of the buffer), XOR-encrypted with 0xC6 and Base64-encoded before being sent. To add to the authenticity of the request, the malware also sends additional buffers of key-value pairs filled with random values.&nbsp;If the authentication succeeds, it proceeds to generate RSA-2048 keys for encryption. The public key is then sent to the C2 in a similar fashion. The same operations regarding the config integrity-check value are performed, and their value represents the beginning of the data. Following that, the values 23, 0, and the size of the public key are appended before the public key (separated by spaces), then encrypted with HC256 and the same XOR + Base64 combo as before. Similar randomness is added after, and the request is sent as such.&nbsp;

From the response, the malware obtains some RSA-encrypted values, that are then decrypted and will serve in future communications as key and IV for encryption via the EVP interface.&nbsp;

Due to the functions used in the structure that contains the “evp_cipher_st” struct for the encryption functions, we conclude that the encryption used is AES-128-CBC.&nbsp;Subsequently, the malware enters its main command loop, constantly communicating with the C2 and executing the commands of the attackers.&nbsp;The communication pattern to the C2 is now as follows:&nbsp;<ol><li>Join by space 2 per-command specific values and the size of the data to be sent</li><li>First parameter is the command ID</li><li>Second parameter represents the status of the command1 – Success sending regular chunk (for streamed buffers – typically 100KB chunks)2 – Error3 – Success sending end chunk (if the buffers are not streamed, this value is used)</li><li>Append the data and AES-128-CBC encrypt everything</li><li>String-shift the same config token + 4 random letters by a random value (0-9) appended at the end, then XOR+Base64 encode it</li><li>Compute MD5 of the encrypted payload and append the encrypted data after the hash, then XOR+Base64 encode it</li><li>Build the base request data as “&lt;RANDOM_2_LETTERS&gt;=&lt;XOR+BASE64(SHIFTED_TOKEN || 4_RANDOM_LETTERS) || SHIFT_OFFSET&gt;&amp;&lt;RANDOM_4_LETTERS&gt;=&lt;RANDOM_4_OR_5_LETTERS&gt;&amp;&lt;RANDOM_5_LETTERS&gt;=&lt;XOR+BASE64(MD5 || ENCRYPTED_DATA)&gt;”</li><li>Append a random amount of random key-value pairs after the base data&nbsp;</li></ol>

In similar fashion, responses are XOR + Base64 decoded, integrity-checked using MD5, and AES-128-CBC decrypted in case of a match.&nbsp;Continuing, we will describe the functionalities of the RAT:&nbsp;<ul><li>Command ID 1<ul><li>Exfiltrate file, starting from an offset and compressing it</li><li>Input: &lt;SRC_PATH&gt;|&lt;OFFSET&gt;</li><li>Chunked</li></ul></li><li>Command ID 2<ul><li>Downloads a file from the C2</li><li>Input: &lt;DEST_PATH&gt;|&lt;SIZE_OF_DATA_BLOCK&gt;|&lt;BYTES_TO_WRITE</li><li>Chunked</li></ul></li><li>Command ID 3<ul><li>Copies a file to %TEMP% and exfiltrates it from there</li><li>Input: &lt;SRC_PATH&gt;|&lt;OFFSET&gt;</li><li>Chunked</li></ul></li><li>Command ID 4<ul><li>Securely delete a file by overwriting it and renaming it multiple times</li><li>Input: &lt;FILE_PATH&gt;</li><li>Not chunked</li></ul></li><li>Command ID 5<ul><li>Changes a file’s attributes to mimic another file</li><li>&lt;DEST_PATH&gt;|&lt;SRC_PATH&gt;</li><li>Not chunked</li></ul></li><li>Command ID 6<ul><li>Recursively traverses all sub-directories and files from a given path, also reporting their size</li><li>Input: &lt;SRC_DIR_PATH&gt;</li><li>Not chunked</li></ul></li><li>Command ID 7<ul><li>Traverses the entire file system, listing the empty space from drives, files and their attributes</li><li>Chunked</li></ul></li><li>Command ID 8<ul><li>Gathers data from the victim computer, such as locale info, computer name, OS version, MAC address, network adapters, CPU architecture, OEM code page</li><li>Not chunked</li></ul></li><li>Command ID 9<ul><li>Runs a command-line via CreateProcessW</li><li>Input: &lt;CMDLINE&gt;</li><li>Not chunked</li></ul></li><li>Command ID 10<ul><li>Runs a command-line in a given session via CreateProcessAsUserW</li><li>Input: &lt;CMDLINE&gt;|&lt;SESSION_ID&gt;</li><li>Not chunked</li></ul></li><li>Command ID 11<ul><li>Lists active processes (provides EXE name, full image path, PID, PPID, SID, user and creation time)</li><li>Chunked</li></ul></li><li>Command ID 12<ul><li>Kills a process</li><li>Input: &lt;PROCESS_ID&gt;</li><li>Not chunked</li></ul></li><li>Command ID 13<ul><li>Keep alive request</li><li>Not chunked</li></ul></li><li>Command ID 14<ul><li>Sleeps for a given period, checking for early wake conditions such as new drives or sessions every 5 seconds</li><li>Input: &lt;SLEEP_DURATION&gt;</li><li>Not chunked</li></ul></li><li>Command ID 15<ul><li>Hibernate for a given period, checking for early wake conditions every minute</li><li>Input: &lt;HIBERNATION_DURATION&gt;</li><li>Not chunked</li></ul></li><li>Command ID 16<ul><li>Updates the config from the binary’s current config</li><li>Not chunked</li></ul></li><li>Command ID 17<ul><li>Send the current config from the binary to the C2</li><li>Not chunked</li></ul></li><li>Command ID 18<ul><li>Removes traces, securely deletes itself and terminates itself</li><li>Not chunked</li></ul></li><li>Command ID 19<ul><li>Test TCP connection to a given IP address</li><li>Input: &lt;IP&gt;:&lt;PORT&gt; &lt;TIMEOUT&gt;</li><li>Not chunked</li></ul></li><li>Command ID 20<ul><li>Runs cmd.exe with the provided command line and reports back the output</li><li>Input: &lt;COMMAND_LINE&gt;</li><li>Chunked</li></ul></li><li>Command ID 21<ul><li>Changes the current working directory</li><li>Input: &lt;DIR_PATH&gt;</li><li>Not chunked</li></ul></li><li>Command ID 22<ul><li>Obtains the current working directory</li><li>Not chunked</li></ul></li><li>Command ID 23<ul><li>Updates encryption keys with new values</li><li>Not chunked</li></ul></li><li>Command ID 24<ul><li>Takes a screenshot and sends it to the C2</li><li>Chunked</li></ul></li><li>Command ID 25<ul><li>Enumerate or take a photo from the available video capture devices using COM interfaces; in the case of GETPIC, the resulting buffer is compressed</li><li>Input: &lt;GETLIST&gt; or &lt;GETPIC&gt; &lt;INDEX&gt;</li><li>Not chunked</li></ul></li><li>Command ID 26<ul><li>Runs a PE file in memory</li><li>Input: &lt;SIZE&gt;|&lt;EXPORT_NAME&gt;|&lt;ARGUMENT&gt;|&lt;MD5_OF_PE&gt;</li><li>Chunked</li></ul></li><li>Command ID 27<ul><li>Updates the config with data from the C2</li><li>Input: &lt;NEW_CONFIG_BYTES&gt;</li><li>Not chunked&nbsp;</li></ul></li></ul><h3>Indicators of compromise&nbsp;</h3>new Comebacker variants: 509fb00b9d6eaa74f54a3d1f092a161a095e5132d80cc9cc95c184d4e258525b&nbsp;&nbsp;b5eae8de6f5445e06b99eb8b0927f9abb9031519d772969bd13a7a0fb43ec067&nbsp;&nbsp;&nbsp;Service binary: 368769df7d319371073f33c29ad0097fbe48e805630cf961b6f00ab2ccddbb4c&nbsp;&nbsp;new BLINDINGCAN: c60587964a93b650f3442589b05e9010a262b927d9b60065afd8091ada7799fe&nbsp;C2s:&nbsp;&nbsp;hxxp[://]166[.]88[.]11[.]10/upload/check.asp&nbsp;hxxps[://]tronracing[.]com/upload/check.asp&nbsp;hxxp[://]23[.]27[.]140[.]49/Onenote/index.asp&nbsp;<h2>Conclusion&nbsp;</h2>Kimsuky and Lazarus continue to sharpen their tools, showing that DPRK-linked actors aren’t just maintaining their arsenals, they’re reinventing them. These campaigns demonstrate a well-structured and multi-stage infection chain, leveraging obfuscated payloads and stealthy persistence mechanisms. From the initial stages to the final backdoors, each component is designed to evade detection, maintain access and provide extensive control over the compromised system. The use of custom encryption, dynamic API resolution and COM-based task registration/services exploitation highlights the groups’ continued evolution and technical sophistication. Monitoring for these indicators and behaviors is essential for early detection and mitigation of such threats.&nbsp;By tracking every line of code and every new variant, we help surface the patterns that keep defenders one step ahead. Awareness, collaboration, and constant vigilance are what turn technical insights into real-world protection — and that’s where Gen Threat Labs and our global intelligence network can make a difference.&nbsp;&nbsp;

Technical walkthroughs of two DPRK intrusions: Kimsuky’s invoice-themed dropper to HttpTroy, and Lazarus’s Comebacker to BLINDINGCAN plus IOCs, TTPs, and mitigation steps 

DPRK’s Playbook: Kimsuky’s HttpTroy and Lazarus’s New BLINDINGCAN Variant 

Threat Research Team Lead

Sr Threat Analysis Engineer

Junior Threat Analyst Intern

Welcome to the era of VibeScams, where creating a phishing site takes just a few clicks. Using simple prompts, scammers can create nearly any type of website almost instantly, without any prior knowledge. Some web-building platforms recreate an entire site from a screenshot provided by the scammer – from a home page to a shopping cart. They typically also allow perfect language localization, letting scammers instantly clone a legitimate site’s look and feel in multiple languages.&nbsp;This new wave of AI-driven web building tools has dramatically lowered the barrier to entry for cybercriminals, democratizing access to sophisticated site cloning and scam operations. No longer limited to those with knowledge of HTML, CSS, and JavaScript, these platforms allow anyone with an internet connection to replicate trusted brands, banking portals, or exchange interfaces with alarming fidelity. The ease and speed of this process not only accelerate the proliferation of fraudulent websites but also makes it increasingly difficult for users to distinguish between genuine and malicious websites.&nbsp;&nbsp;<h2>A new kind of phishing — VibeScams&nbsp;</h2>We call them VibeScams because the trick isn’t in the code alone — it’s in the feeling. These pages pass the “vibe check”: the right colors, spacing, logo placement, and tiny footer links people trust at a glance. Because AI web builders can recreate that look from a single prompt or screenshot, attackers don’t need coding skills — they only need to get the vibe right. That’s enough to trick people into handing over credentials or cash, and it’s why this wave of scams spreads so fast.&nbsp;

As part of our research for this article, we contacted the web builders which attackers leverage more prevalently, according to our detections. We would like to share our appreciation for those companies, including Lovable, Elementor, Flazio, Softr, Webflow, WebWave, among others, for their fast reactions, quick banning of the websites, and overall cooperation. We would like to encourage anyone who stumbles upon suspicious or malicious websites to also report them to the specific providers. It matters and makes a difference.&nbsp;<h2>VibeScams as an Evolution of Phishing&nbsp;</h2>AI-powered web builders make it easy for anyone—even without coding or design skills—to create professional-looking websites quickly and cheaply. By automating templates, layouts, and even content, these tools lower barriers and speed up development, but they also give attackers the same advantages, enabling scams and phishing campaigns with minimal effort. The process of using such a web builder is so intuitive and user-friendly, it’s familiar to almost everyone. Individuals are typically presented with a simple screen containing a textbox, prompting users to immediately fill in a few lines of instructions to build their dream website. Below, you can find an example of a prompt screen from Lovable, one of the popular AI web building platforms:&nbsp;

AI chatbots always have been constrained in the space what the chatbot allows the user to prompt for. These security mechanisms, which are called “guardrails,” serve as a control system to detect malicious, harmful, or otherwise inappropriate prompts and block the associated responses. However, as we will see in the below examples of impersonating reputable brands, these mechanisms are frequently insufficient.&nbsp;As is typical with phishing and scams, attackers tend to focus on brands, topics or products that are already popular. Typical scam sites include cryptocurrency exchanges, investment portals, banking sites, social media platforms, delivery services, shopping sites and much more.&nbsp;Below, you can find a couple of examples of scam and phishing sites we observed hosted on many of these platforms, all AI generated. Other examples we discovered included MetaMask, DHL and AT&amp;T, among many others.&nbsp;&nbsp;

From cryptocurrency exchanges to fake e-shops and login pages, we’ve also seen other typical types of scams&nbsp; – such as tech-support scams. As can be seen below, in this case, it was recreated using an AI web builder and even localized into German. The attacker likely just uploaded a screenshot of a traditional scam page and asked the AI to rebuild and host it, making the whole process effortless.&nbsp;

While talking about brand impersonation, which is an attempt to mimic the design, logos, content, and URL of a well-known and respected brand, we’ve observed multitude of additional cases using AI web builders. This way the user is easily tricked into believing the website they visited is the official website of the brand. A few examples of brand impersonation of well-known crypto exchange platforms can be found below. Note that none of these are legitimate websites of known cryptocurrency exchanges or login sites for that matter, all of them are either phishing or otherwise scam websites:&nbsp;<ul><li>auth-binance.webflow[.]io</li><li>binance-cdn-auth.webflow[.]io</li><li>coinbase-wallet-verify.replit[.]app</li><li>coinbase-wallet.squarespace[.]com</li><li>auth-coinbase-login.typedream[.]app</li><li>chrome-coinbase-extension.typedream[.]app</li><li>wallet-coinbase.typedream[.]app</li><li>microsoft-teams-login.elementor[.]cloud</li><li>microsoft-outlookserver.odoo[.]com</li><li>cz-microsoft.webflow[.]io</li><li>updateaccount-microsoft.webflow[.]io&nbsp;</li></ul>

Typosquatting is very typical as well. This means the attackers are choosing similarly looking names, with one or more changed characters in the URL:&nbsp;<ul><li>app—trrezor-wallet.webflow[.]io</li><li>app-atomiic-wallet.webflow[.]io</li><li>coiinbase-com-wallet.typedream[.]app</li><li>connect-metamesk-wallet.typedream[.]app&nbsp;</li></ul>A broader list of IoCs can be found in our <a href="https://github.com/avast/ioc/tree/master/VibeScams" target="_blank" rel="noreferrer noopener">GitHub</a>.&nbsp;<h2>Scam Types – Breakdown&nbsp;</h2>Nearly half of the detected websites were traditional phishing pages impersonating familiar login portals like Microsoft, Gmail, or Amazon. About a quarter targeted the cryptocurrency space—either by mimicking popular exchanges such as Coinbase, Binance, and MetaMask, or by promoting cryptocurrency-based investment scams. The remainder included more general scams and other malicious pages.&nbsp;

<h2>Our Testing&nbsp;</h2>During our research, we took this opportunity to try a few web builders ourselves, to see how easy it actually is to create a website resembling known brands. We also used only free versions of the web builders to see what the baseline looks like.&nbsp;You can see our results in a few examples below:&nbsp;

In our opinion, the AI generated testing websites look fairly convincing and they took no money and almost zero effort to create. That’s because we didn’t want to kill the vibe, so we also created all the testing prompts using AI and simply copy and pasted them into the AI web builders. In most cases, we didn’t need any further prompting or tweaking.&nbsp;Note that what we generated here are only the designs. For phishing and scam sites to work properly, there also needs to be some functionality provided, for example credentials exfiltration. Additional functionality like this is commonly offered in paid subscriptions of the web builders, or the attacker can use once again other LLMs to implement this directly into the code because in a lot of cases they can download the design locally and continue the work from there.&nbsp;This demonstration directly showed us the core of why the attackers are using this – they don’t need to understand web at all to create highly believable websites for free (we only used free versions of the web builders).&nbsp;<h2>Pricing models&nbsp;</h2>In general, we consider these services to be cheap since there is quite a bit of competition and the user/attacker has plenty of choices to try, even for free. The fact that the attacker requires almost no skill to create a scam or phishing website highly outweighs the costs here.&nbsp;The range of paid offers is vast, spanning from $0.5 per month to $500 per month, with a variety of free tiers and/or trial periods. Some of the providers also offer lifetime deals for $249 or $599.&nbsp;Many of these subscriptions use a relatively common credits-based model where the customer receives credits which they can use for the AI prompts. Additional aspects, since many of the web builders also offer hosting for the generated webpages, are the website limit, subdomain name selection and the ability to change the subdomain name in the future.&nbsp;Finally, some of the web builders also offer APIs that can be used for streamlining the webpage creation, making the whole process more automatic.&nbsp;<h2>The Impact&nbsp;</h2>It’s important for defenders and analysts to recognize just how accessible and varied these platforms have become. Because the barrier to entry is so low and payment models are flexible, we’re seeing a rapid growth in the number of AI-generated scam and phishing websites. This massive availability means the attackers can quickly spin up new designs and relaunch new scams almost instantly.&nbsp;In total, we were investigating 40 different AI web builders, 12 of which we directly contacted due to a high volume of identified malicious websites. In total, from the beginning of 2025 to the end of August, we blocked approximately 140,000 different AI-generated websites during this time, which makes roughly 580 new malicious generated websites every day, on average.&nbsp;Since January 2025 alone, we protected nearly 190,000 our users, with the U.S., France, Brazil, Germany, and Japan among the most affected. This shows that misuse of AI web builders is a world-wide problem, and we can only expect the threat landscape to grow.&nbsp;

<h2>Conclusion&nbsp;</h2>During our research, we investigated various AI web builders which are being misused by attackers for performing what we call VibeScams – a creation of scam or phishing pages without the need of any knowledge of coding or web creation.&nbsp;AI web builders provide support for individuals who are not technically invested in creating websites, where a simple prompt can suffice for building a new website from scratch. This results in a double-edged sword where it is very useful for both regular users as well as for attackers, which is rather typical with other various AI tools, too.&nbsp;Many of the malicious webpages follow the expected pattern of brand impersonation for phishing attempts and scams, which our research has seen daily for many years. The difference is that with the AI web builders, the attackers need to invest little to no effort or knowledge into creating them. As the AI web builder ecosystem evolves, it’s clear that new features and easier integrations will fuel even more sophisticated phishing campaigns in the future.&nbsp;How to protect yourself:&nbsp;<ul><li>Always watch out for too good to be true offers or investment opportunities</li><li>When dealing with a known brand, always verify whether this is the official website</li><li>Look out for any deviations from the designs you are already familiar with</li><li>Use unique passwords and MFA everywhere, preferably along with a reputable password manager</li><li>Use a reputable AV solution to be proactively protected against phishing and scam attempts</li><li>When in doubt, use products like Norton 360 with AI-powered scam protection to consult the security of links and web pages&nbsp;</li></ul><h3>Indicators of Compromise (IoCs)&nbsp;</h3>A broader list of IoCs can be found on our <a href="https://github.com/avast/ioc/tree/master/VibeScams" target="_blank" rel="noreferrer noopener">GitHub</a>.&nbsp;auth-binance.webflow[.]io&nbsp; binance-cdn-auth.webflow[.]io&nbsp; coinbase-wallet-verify.replit[.]app&nbsp; coinbase-wallet.squarespace[.]com&nbsp; auth-coinbase-login.typedream[.]app&nbsp; chrome-coinbase-extension.typedream[.]app&nbsp; wallet-coinbase.typedream[.]app&nbsp; microsoft-teams-login.elementor[.]cloud&nbsp; microsoft-outlookserver.odoo[.]com&nbsp; cz-microsoft.webflow[.]io&nbsp; updateaccount-microsoft.webflow[.]io&nbsp; app—trrezor-wallet.webflow[.]io&nbsp; app-atomiic-wallet.webflow[.]io&nbsp; coiinbase-com-wallet.typedream[.]app&nbsp; connect-metamesk-wallet.typedream[.]app&nbsp;

AI web builders are fueling a surge in realistic phishing sites that anyone can make

VibeScams: How AI website builders are shaping the internet 

Malware Analyst at Gen

In the ever-evolving landscape of cyber threats, a new ransomware strain known as Midnight has emerged, echoing the notorious tactics of its predecessor, Babuk. First detected by Gen researchers, Midnight blends familiar ransomware mechanics with novel cryptographic modifications – some of which unintentionally open the door to file recovery. This blog dives into the technical anatomy of Midnight, its lineage from Babuk, and the critical indicators of infection. Most importantly, it offers a practical guide to decrypting affected files, empowering victims with a rare opportunity to reclaim their data without paying a ransom.

<h2>Midnight’s Discovery and Roots&nbsp;</h2>Gen researchers have identified a new ransomware strain, internally dubbed Midnight. It shows clear signs of being inspired by the Babuk ransomware family, which first appeared in early 2021 and quickly gained a reputation for its aggressive tactics and advanced technical aspects. Babuk operated as a Ransomware-as-a-Service (RaaS), targeting large organizations across healthcare, finance, government, and other critical infrastructure. The ransomware used strong encryption (HC256 and ECDH) and intermittent file encryption to maximize damage while maintaining speed.&nbsp;In mid-2021, Babuk's operators abruptly shut down and leaked their full source code, including builders for Windows, ESXI and NAS variants. This leak led to a wave of inspired ransomware families, each modifying Babuk's original design to suit their own goals.&nbsp;Midnight is one such evolution. While it retains much of Babuk's core structure, its authors introduced several changes - most notably in the cryptographic scheme used for file encryption. These changes, while likely intended to improve the ransomware's effectiveness, inadvertently introduced weaknesses that make file decryption possible under certain conditions.&nbsp;<h2>How to Recognize Midnight Ransomware&nbsp;</h2>Midnight ransomware typically appends the .Midnight or .endpoint extension to encrypted files. In some cases, the ransomware is configured not to modify the file names. Instead, it appends the extension string directly to the end of the file content. This behavior can be observed in hex dumps and may affect file parsing.&nbsp;

A ransom note named How To Restore Your Files.txt is dropped in the affected directories. It may look similar as on the following screenshots:&nbsp;

Additional indicators include the creation of a mutex named Mutexisfunnylocal, which is used to prevent multiple instances of the ransomware from running simultaneously. Some samples also drop a debug log on the infected system, depending on the configuration. Known variants have been observed creating either Report.Midnight or debug.endpoint as log files.&nbsp;A full list of discovered samples is available in the IoCs section at the end of this article.&nbsp;<h3>Cryptographic Design and Flaws&nbsp;</h3>While Midnight's core structure and execution flow is largely inherited from Babuk, its cryptographic implementation has been significantly reworked. These changes introduced flaws that make file decryption possible, which we leveraged to develop a working decryptor.&nbsp;Midnight uses ChaCha20 for encrypting file contents and RSA for encrypting the ChaCha20 key. The RSA-encrypted key, along with its SHA256 hash, is appended to the end of each encrypted file. This format is consistent across known samples.&nbsp;To improve performance, Midnight employs intermittent encryption, a technique also used by Babuk. However, Midnight refines this approach by applying a more granular file size-based logic to determine which portions of file to encrypt. This allows it to process large files faster while still rendering them unusable.&nbsp;The ransomware accepts several command-line arguments to control its behavior:&nbsp;<ul><li>/e appends the extension string (e.g. .Midnight) directly to the file content instead of modifying the filename.</li><li>/n enables encryption of network-mounted volumes.</li><li>--paths=PATHS targets specific directories for encryption.&nbsp;</li></ul>Earlier samples of Midnight primarily targeted high-value files such as databases, backups, and archives. These included the following extensions:&nbsp;.mdf .ndf .bak .dbf .dmp .rman .frm &nbsp; .ibd .myd .myi .sql .xbk .ldf .vbi &nbsp; .vbk .ibdata .rar .md5 and .bitmap&nbsp; &nbsp;More recent variants have broadened their scope and now encrypt nearly all file types, with the exception of executables such as .exe, .dll, and .msi.&nbsp;<h2>How to Use the Ransomware Decryptor&nbsp;</h2><ol><li>Download the decryptor <a href="https://files.avast.com/files/decryptor/norton/norton_decryptor_midnight64.exe" target="_blank" rel="noreferrer noopener">here</a>. If you still use 32-bit Windows, you can also get the 32-bit version of the decryptor <a href="https://files.avast.com/files/decryptor/norton/norton_decryptor_midnight.exe" target="_blank" rel="noreferrer noopener">here</a>.</li><li>Run the decryptor, preferably as an administrator. It starts as a wizard, leading you through the configuration of the decryption process.</li><li>On the initial page, we have a link to the license information. Click the Next button when you are ready to start.</li></ol>

4. &nbsp; &nbsp; On the next page, the user is asked to provide a list of locations (drives, folders, files) that are to be decrypted. &nbsp; &nbsp; &nbsp; &nbsp; By default, the decryptor provides a list of all local disk drives.

5. &nbsp; &nbsp; On the final page, you can opt-in to back up your encrypted files. These backups may help if anything goes wrong during the decryption process. This option is selected by default, which we recommend. After clicking Decrypt, the decryption process begins. Let the decryptor work and wait until it finishes decrypting all of your files.

For questions or comments about the Norton decryptor, email <a href="mailto:decryptors@avast.com" target="_blank" rel="noreferrer noopener">decryptors@avast.com</a>.&nbsp;<h3>IoCs: Ransomware Samples&nbsp;</h3>dd9de77c6e17093b0b2150b3f0c66e8526369ba68fb7b9a5758ff9274d85342e&nbsp; 3d9a71cfec82fef531227465f40d9106e671ef162fa3ab21119e2ee08612e0aa&nbsp; 300c46bf17e8bd0cd5ac800a33e1d27ef9001aecef1f98965414bf9c33af19e0&nbsp; 1e58448808006de410ddb31a4d6ff8292aa70168f69f2b7e08144d6090d5084d&nbsp; aa8a043fd3d64fc96864cf5361bbb82012cc4b2e1a909c747038edcf2b4369e7&nbsp;&nbsp;

Midnight ransomware echoes Babuk’s tactics but stumbles in its code. Gen researchers explain how those mistakes make decryption and recovery possible

Decrypted: Midnight Ransomware 

Malware Researcher at Gen

Researchers at Avast developed a decryptor for the FunkSec ransomware. We have been cooperating with law-enforcement agencies to help victims decrypt files for free. Because the ransomware is now considered dead, we released the decryptor for public download.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a href="https://files.avast.com/files/decryptor/avast_decryptor_funksec64.exe" target="_blank" title="Download the Decryptor">Skip directly to the decryptor download</a>&nbsp;We counted 113 victims of the ransomware in total (based on the ransomware leak site). Because the first victim appeared earlier than the initial source, we assume that the FunkSec gang only did data exfiltration and subsequent extortion from the beginning, and then also added data encryption. Here’s a simple timeline of the ransomware operations:&nbsp;<ul><li>04-Dec-2024: The first victims appeared on the ransomware gang’s leak site&nbsp;</li><li>15-Dec-2024: The initial source file was uploaded to Virus Total&nbsp;</li><li>31-Dec-2024: The first known ransomware sample was uploaded to Virus Total&nbsp;</li><li>15-Mar-2025: The latest known victim&nbsp;</li></ul><h2 class="text-align-justify">AI-Powered Ransomware&nbsp;</h2><a href="https://www.ransomlook.io/groups#Funksec" target="_blank" rel="noreferrer noopener">Sources</a> report that AI was used to assist in writing this ransomware. Notably, the authors used AI to create tools and phishing templates, though they emphasize that AI contributes to only about 20% of their operations.&nbsp;Overall, samples of the ransomware mostly fail to work. Some of them depend on external image (supposed to become a desktop wallpaper) downloaded from <a href="https://imgur.com/" target="_blank" rel="noreferrer noopener">Imgur</a>:&nbsp;<ul><li>hxxps[:]//i.imgur.com/HCYQoVR.jpeg</li><li>hxxps[:]//i.imgur.com/mlUvWYT.jpeg&nbsp;</li></ul><h2>How to Recognize FunkSec Ransomware&nbsp;</h2>Files encrypted with FunkSec ransomware have the “.funksec” extension:&nbsp;

Also, a ransom note file called “README-{random}.md” is dropped to every folder.

<h2>FunkSec Ransomware Analysis</h2>Ransomware is written in Rust programming language. For cryptographic operations, it uses orion-rs library, <a href="https://github.com/orion-rs/orion/releases/tag/0.17.7">version 0.17.7</a>. Files are encrypted using Chacha20 with the help of <a href="https://github.com/openssl/openssl/blob/master/crypto/poly1305/poly1305.c">Poly1305 MAC</a>. This hash-based method ensures integrity of encryption parameters: the encryption key, n-once, block lengths, and encrypted data itself.Files are encrypted per-blocks of 128 bytes, adding 48 bytes of extra metadata to each block, which means that encrypted files are about 37% bigger than the originals.When executed, the ransomware searches all local drives (by drive letter) and encrypts all files, except the ones with these extensions:<table class="table"><tbody><tr><td>&nbsp;.7z&nbsp; &nbsp; &nbsp; .aac&nbsp; &nbsp; &nbsp;.ai&nbsp; &nbsp; &nbsp; .apk&nbsp; &nbsp; &nbsp;.avi&nbsp; &nbsp; &nbsp;.avro&nbsp; &nbsp; .azw3&nbsp; &nbsp; .bak&nbsp; &nbsp; &nbsp;.bat.bib&nbsp; &nbsp; &nbsp;.bin&nbsp; &nbsp; &nbsp;.bkp&nbsp; &nbsp; &nbsp;.c&nbsp; &nbsp; &nbsp; &nbsp;.cer&nbsp; &nbsp; &nbsp;.chm&nbsp; &nbsp; &nbsp;.cpp&nbsp; &nbsp; &nbsp;.csr&nbsp; &nbsp; &nbsp;.css.csv&nbsp; &nbsp; &nbsp;.cue&nbsp; &nbsp; &nbsp;.dat&nbsp; &nbsp; &nbsp;.db&nbsp; &nbsp; &nbsp; .dbf&nbsp; &nbsp; &nbsp;.deb&nbsp; &nbsp; &nbsp;.djvu&nbsp; &nbsp; .dll&nbsp; &nbsp; &nbsp;.dmg.docx&nbsp; &nbsp; .dwg&nbsp; &nbsp; &nbsp;.dxf&nbsp; &nbsp; &nbsp;.ear&nbsp; &nbsp; &nbsp;.eml&nbsp; &nbsp; &nbsp;.eps&nbsp; &nbsp; &nbsp;.epub&nbsp; &nbsp; .etl&nbsp; &nbsp; &nbsp;.exe.fb2&nbsp; &nbsp; &nbsp;.fla&nbsp; &nbsp; &nbsp;.flac&nbsp; &nbsp; .flv&nbsp; &nbsp; &nbsp;.git&nbsp; &nbsp; &nbsp;.gpg&nbsp; &nbsp; &nbsp;.hdf5&nbsp; &nbsp; .html&nbsp; &nbsp; .indd.ini&nbsp; &nbsp; &nbsp;.ipa&nbsp; &nbsp; &nbsp;.iso&nbsp; &nbsp; &nbsp;.jar&nbsp; &nbsp; &nbsp;.java&nbsp; &nbsp; .js&nbsp; &nbsp; &nbsp; .json&nbsp; &nbsp; .jsx&nbsp; &nbsp; &nbsp;.kdbx.key&nbsp; &nbsp; &nbsp;.log&nbsp; &nbsp; &nbsp;.lst&nbsp; &nbsp; &nbsp;.m3u&nbsp; &nbsp; &nbsp;.md&nbsp; &nbsp; &nbsp; .mdb&nbsp; &nbsp; &nbsp;.midi&nbsp; &nbsp; .mkv&nbsp; &nbsp; &nbsp;.mov.mp3&nbsp; &nbsp; &nbsp;.mp4&nbsp; &nbsp; &nbsp;.msg&nbsp; &nbsp; &nbsp;.msi&nbsp; &nbsp; &nbsp;.nfs&nbsp; &nbsp; &nbsp;.odp&nbsp; &nbsp; &nbsp;.ods&nbsp; &nbsp; &nbsp;.odt&nbsp; &nbsp; &nbsp;.ogg.opf&nbsp; &nbsp; &nbsp;.parquet .pdb&nbsp; &nbsp; &nbsp;.pdf&nbsp; &nbsp; &nbsp;.pem&nbsp; &nbsp; &nbsp;.pfx&nbsp; &nbsp; &nbsp;.pgp&nbsp; &nbsp; &nbsp;.php&nbsp; &nbsp; &nbsp;.pptx.ps&nbsp; &nbsp; &nbsp; .psd&nbsp; &nbsp; &nbsp;.py&nbsp; &nbsp; &nbsp; .rar&nbsp; &nbsp; &nbsp;.raw&nbsp; &nbsp; &nbsp;.rpm&nbsp; &nbsp; &nbsp;.rtf&nbsp; &nbsp; &nbsp;.sh&nbsp; &nbsp; &nbsp; .sql.sqlite&nbsp; .svg&nbsp; &nbsp; &nbsp;.svn&nbsp; &nbsp; &nbsp;.tar&nbsp; &nbsp; &nbsp;.tar.gz&nbsp; .tex&nbsp; &nbsp; &nbsp;.tgz&nbsp; &nbsp; &nbsp;.tiff&nbsp; &nbsp; .ts.tsx&nbsp; &nbsp; &nbsp;.txt&nbsp; &nbsp; &nbsp;.vcs&nbsp; &nbsp; &nbsp;.vhd&nbsp; &nbsp; &nbsp;.vmdk&nbsp; &nbsp; .war&nbsp; &nbsp; &nbsp;.wav&nbsp; &nbsp; &nbsp;.webm&nbsp; &nbsp; .wma.xlsx&nbsp; &nbsp; .xml&nbsp; &nbsp; &nbsp;.xps&nbsp; &nbsp; &nbsp;.xz&nbsp; &nbsp; &nbsp; .yaml&nbsp; &nbsp; .zip&nbsp;</td></tr></tbody></table>

The following processes and services are killed before the ransomware starts the file encryption:<table class="table"><tbody><tr><td>&nbsp;chrome.exe&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; firefox.exe&nbsp; &nbsp; &nbsp;&nbsp; &nbsp; msedge.exe&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; explorer.exeoutlook.exe&nbsp; &nbsp; &nbsp;&nbsp; &nbsp; vlc.exe&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; &nbsp; spotify.exe&nbsp; &nbsp; &nbsp;&nbsp; &nbsp; skype.exediscord.exe&nbsp; &nbsp; &nbsp;&nbsp; &nbsp; steam.exe&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; &nbsp; java.exe&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; python.exenode.exe&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cmd.exe&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; &nbsp; powershell.exe&nbsp; &nbsp; &nbsp; taskmgr.exewmplayer.exe&nbsp; &nbsp; &nbsp; &nbsp; tscon.exe&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; &nbsp; notepad.exe&nbsp;</td></tr><tr><td>spooler&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;bits&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; dnsclient&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; lanmanworkstationwinmgmt&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;netsh&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;iphlpsvc&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;servicesRemoteAccess&nbsp; &nbsp; &nbsp; &nbsp; ShellHWDetection&nbsp; &nbsp; SCardSvr&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;TrkWkswscsvc&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CryptSvc&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; msiserver&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; MpsSvcdefragsvc&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;upnphost&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; WindowsUpdate&nbsp; &nbsp; &nbsp; &nbsp; srservicewsmprovhost&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;AppIDSvc&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; AudioEndpointBuilder Scheduleeventlog&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PlugPlay&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Netman&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;bthservShellExperienceHost SMB&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;WinDefend&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; wuauserv&nbsp;</td></tr></tbody></table>

<h2>How to Use the Ransomware Decryptor</h2><ol><li>The first step is to download the decryptor binary. Avast provides a <a href="https://files.avast.com/files/decryptor/avast_decryptor_funksec64.exe">64-bit decryptor</a>, as the ransomware is also 64-bit and can’t run on 32-bit Windows. If you have no choice but to use 32-bit applications, you may download a 32-bit decryptor <a href="https://files.avast.com/files/decryptor/avast_decryptor_funksec.exe">here</a>.</li><li>Run the executable file, preferably as administrator. It starts as a wizard, leading you through the decryption process.</li><li>On the initial page, we have a link to the license information. Click the Next button when you are ready to start. &nbsp;</li></ol>

4. On the next page, select the list of locations you want to be searched for and decrypted. By default, it has a list of all local drives, but you can pick a different list, such as a directory with important documents:

5. On the final page, you can opt-in to back up your encrypted files. These backups may help if anything goes wrong during the decryption process. This choice is selected by default, which we recommend. After clicking Decrypt, the decryption process begins. Let the decryptor work and wait until it finishes decrypting all your files.

For questions or comments about the Avast decryptor, email <a href="mailto:decryptors@avast.com">decryptors@avast.com</a>.<h2>IOCs</h2>Ransomware samplec233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c &nbsp;Initial source code7e223a685d5324491bcacf3127869f9f3ec5d5100c5e7cb5af45a227e6ab4603&nbsp;

Avast releases free decryptor for AI-assisted FunkSec ransomware

Decrypted: FunkSec Ransomware 

A recent investigation into Neptune RAT unexpectedly uncovered notable overlaps with the notorious remote access trojan, XWORM. Given XWORM’s recent surge in popularity, this discovery prompted a deeper analysis, revealing several intriguing connections between the two malware families. This similarity was also reflected in various OSINT sources, where samples of Neptune RAT triggered detections originally developed for XWORM.

<h2>Neptune RAT</h2>Based on research from <a href="https://www.cyfirma.com/research/neptune-rat-an-advanced-windows-rat-with-system-destruction-capabilities-and-password-exfiltration-from-270-applications/">Cyfima</a>, we identified several GitHub repositories that helped us partially reconstruct the development history of Neptune RAT. Currently, there are at least two major distinct versions. The older version, which we’ll refer to as V1, has been linked to the campaign under investigation.<h3>Neptune RAT V1</h3>We discovered a GitHub repository that appears to be a fork of the original builder for Neptune RAT. Because the original repository is named MasonGroup/NeptuneRatV1, we’ll designate this version as V1. The repository contains commits exclusively from a user named "Freemasonry," with the initial commit and most activity dating back to early December 2024, before activity abruptly ceased. Additionally, the repository references a Discord server called FreemasonryTM.Notably, the builder’s user interface differs significantly from the typical UI seen in XWORM’s builder:

Despite the obvious differences in design and appearance, the codebases reveal a striking similarity. Both XWORM and Neptune RAT share a similar approach to initialization: they load all configuration settings at the start of their respective main functions and then launch executor threads to carry out their tasks.

These values are stored in a single class containing static strings. Except for the mutex, all strings are AES-encrypted and Base64-encoded, a common practice among .NET RATs. What’s unusual, however, is that both XWORM and Neptune RAT V1 use the exact same encryption routine: the mutex is hashed using MD5, and the hash is duplicated to form a 32-byte key used for AES encryption running in the insecure ECB mode. Because of this shared method, Neptune RAT V1 configurations were mistakenly conflated with XWORM’s configurations in our tracking systems.The similarities don’t end there. Both malware families implement persistence using three methods: Task Scheduler, registry entries and the startup folder. The resemblance is especially striking in the first and third approaches:

These similarities extend to their scope as well. Both malware families use identical regular expressions and target the same cryptocurrencies: BTC, ETH and TRC. Notably, although Neptune RAT V1 appears to be a recent variant, it only targets legacy Bitcoin addresses and largely ignores newer standards like Bech32 (BIP-0173, introduced in 2017). The reuse of identical regular expressions and wallet-targeting patterns further reinforces the likelihood that Neptune RAT V1 is derived from XWORM rather than being developed independently.We also examined other popular RATs such as njRAT and AsyncRAT. Their initialization processes and workflows differ significantly, and their structures and implementations do not share these specific patterns. Based on this, we conclude that the similarities between Neptune RAT V1 and XWORM are unlikely coincidental, Neptune RAT V1 is most likely a derivative of XWORM.

<h3>Neptune RAT V2</h3>We also identified another repository, forked from MasonGroup/NeptuneRAT and named NeptuneRatV2, which contains a trial version of a new builder that we’ll refer to as V2. Its initial commit dates to February 22, 2025, with GitHub showing ongoing development in the original, now-private repository. While the V2 builder’s UI appears to be a reskinned and more polished version of V1, the underlying code has undergone significant changes, suggesting either a complete rewrite or an extensive refactoring.

Neptune RAT V2 shows a drastic departure from V1. While V1 completed configuration initialization within the main function, V2 follows a completely different code flow. Unlike V1, variable names in V2 are not obfuscated, and the configuration data is stored as plain strings in the Settings class rather than being AES-encrypted. This unencrypted approach is consistent across both trial and production builds.

<h2>Conclusion</h2>We identified Neptune RAT configurations within our historical XWORM tracking data, which prompted the hypothesis that these two malware strains might be linked. OSINT investigations uncovered some tentative connections, including forks of the MasonGroup/NeptuneRatV1 repository. Although the original repository is no longer accessible, these forks contained code heavily overlapping with XWORM. Notably, the current Neptune RAT builder references the Freemasonry group, aligning with the Discord server identified in our research.Reverse engineering Neptune RAT V1 revealed further compelling similarities. While the shared resource structure might be dismissed as a coincidence, given that many .NET RATs use similar frameworks, the resource encryption scheme is essentially identical in both: AES encryption in insecure ECB mode combined with the same key-derivation method using a hard-coded mutex. Their persistence mechanisms are also functionally and structurally alike. Additionally, the clipper functionality employs the same regular expressions and targets the same cryptocurrencies. Although these expressions focus on legacy Bitcoin addresses rather than newer standards like Bech32, this link is somewhat weak given the widespread use of these expressions in malware.The strong similarities between XWORM and Neptune RAT V1, contrasted with their clear divergence from other open-source RATs, strongly suggest that Neptune RAT V1 is related to XWORM. However, these parallels do not extend to Neptune RAT V2, whose trial version, while functionally similar to V1, appears to be a complete code rewrite.<h2>List of SHA256S&nbsp;</h2><h3>XWORM:&nbsp;</h3>8dd992c363c594b80d10cbc9bc2b26ca8211f88bb12636f98a82627b847cbdae&nbsp;d3ad9240d2abdb9c43e37f546b2420f0a3890742133453650de1b012b4f4a11&nbsp;3283c0031175ae5d68e7cb81d069b40e9c028fa680d19fd34019daad3b2d4828&nbsp;<h3>Neptune V1 RAT&nbsp;</h3>f2c0ee24b7eb590e8caca3abeccd2cf73cdb4cc719e0828062ea50d9484303d5&nbsp;5b27e4bc78e05c098cd97da75f4d4df100039bdb71f6f16da99ae6b9e60a878c&nbsp;<h3>Neptune V2 RAT&nbsp;</h3>be1e0ca3b58139a64fd3cb0127a63b21ffd76721800a55f8ff16479303e8e4a2&nbsp;eac5e8915cd2be4629a5eb02cce0c26c0dd224a3cdef8bcd27b7c28b3fb36dd1&nbsp;3ff3722127d97b03fb866ee6f6c4ca9782b6cc162bd8684cec08425f56d5507f&nbsp;

A closer look at Neptune RAT V1 reveals shared code, persistence methods and encryption patterns with XWORM, suggesting a common origin

Neptune and the legacy of XWORM

Principal Research Engineer

Large language models (LLMs) are everywhere. Since OpenAI’s ChatGPT burst onto the scene a few years ago, these tools have completely reshaped how we search, ask questions and navigate the web. They have quickly woven themselves into our daily routines, helping us build grocery lists, find restaurant recommendations and even plan entire vacations.&nbsp;And all of this? It seems to come at no cost. Just create an account and start using platforms like ChatGPT (OpenAI), Gemini (Google) or DeepSeek. But that leads us to an important question: are these tools truly free? And if not, what is the real price we are paying?&nbsp;To find out, we dug into the privacy policies of the top AI platforms, so you do not have to. Here is what we uncovered about the actual cost of using today’s most popular LLMs.&nbsp;<h2>Privacy by design, and other nice stories&nbsp;</h2>Let’s walk through a familiar scenario: planning your next vacation. Like many of us, you want the perfect destination, at the perfect time, all within a specific budget. That means searching for cheap flights, affordable hotels and ideally, something close to the city center that still feels like a getaway.&nbsp;In the past, you might have spent hours, or days, browsing search engines, comparing options, reading reviews and hunting for deals. It is time-consuming and, frankly, a bit overwhelming.&nbsp;But now? Who has time for all that? More importantly – why bother when your friendly AI assistant can handle it for you? All you need to do is head to your favorite large language model and type in a well-crafted prompt:&nbsp;“Hello, I want to go for vacation on august somewhere sunny. I would like a beautiful island somewhere in the Mediterranean Sea with plenty of activities and tasty food. I do not want it to be too crowded and not extremely expensive. Find me also flights from Oslo to this destination that are cheap or tell me which dates I should look for. Finally, find me a nice hotel 3 stars and above with a room for 2 adults and 2 kids. Find something that is bellow 150 euros per day with availability for 6 days, please.”&nbsp;With a prompt like that, the model gets to work. Within seconds, it returns tailored recommendations that check all your boxes. Even better? It might offer to book the flights and hotel for you – asking for your credit card and passport details so you don’t have to lift a finger. Just sit back, relax and dream of sun-drenched beaches.&nbsp;You may even notice a few quick notifications as the system says things like “memory updated”, but nothing else seems to change, so no need to worry… right?&nbsp;Let’s take a moment to unpack what happened behind the scenes.&nbsp;When we typed our prompt, the model did not just give us a list of results – it broke down our request into smaller, more specific queries. It recognized that we are planning a vacation, live in Oslo, have a partner and two kids, prefer nice hotels, and are working with a budget of €150 per night. Piece by piece, it started building a profile of who we are and what we like.&nbsp;That profile does not just disappear. It is often stored, somewhere.&nbsp;&nbsp;And if we take a closer look at the privacy policies of major AI providers, we start to see how that information can be used. So, let’s break it down: what exactly is being collected, and how is it being used?&nbsp;<h2>ChatGPT by OpenAI&nbsp;</h2>Let’s start with the elephant in the room: OpenAI, the most popular and widely used large language model provider.&nbsp;According to its privacy policy, OpenAI collects a wide range of personal data. This includes:&nbsp;<ul><li>Account information&nbsp;</li><li>User content (everything you type)&nbsp;</li><li>Communication details&nbsp;</li><li>Other information you voluntarily provide&nbsp;</li><li>Log data and usage patterns&nbsp;</li><li>Device and location data&nbsp;</li><li>Cookies and similar tracking technologies&nbsp;</li><li>Information received from third-party sources&nbsp;</li></ul>In short: it is not just your prompts that are being collected. It is your device, your location, how you interact with the model and even data that can be bought or received from other sources.&nbsp;But what is even more important than what is collected is how it is used. OpenAI states that this data helps them “provide, analyze and maintain” their services, “improve and develop” new features, “communicate with users” and “prevent misuse or fraud.” All of which sound standard, until you read the fine print about data sharing.&nbsp;&nbsp;According to the policy, OpenAI may share your information, with broad discretion, for purposes such as:&nbsp;<ul><li>Strategic transactions (e.g., mergers or acquisitions)&nbsp;</li><li>Business operations&nbsp;</li><li>Legal compliance&nbsp;</li><li>And more vaguely, with “affiliates”&nbsp;</li></ul>So, what does this mean in practice?&nbsp;Once you provide your data, it is no longer truly yours. It can be used to train future models, shared with business partners or even leveraged in a corporate acquisition. And the kicker? This applies whether you are a free user or a paying subscriber.&nbsp;&nbsp;Your data powers the system, but it does not belong to you anymore.&nbsp;<h2>Gemini by Google&nbsp;</h2>Next, let’s look at how the most popular search engine’s AI model, Gemini by Google, handles user privacy. Unsurprisingly, the situation is very similar to what we saw with OpenAI.&nbsp;Gemini collects not just your chats and interactions, but also any files, images or browser page content you share. It logs your location, IP address, submitted feedback and even physical addresses, like home or work, if they are part of your input.&nbsp;When it comes to how this data is used, the language is broad and vague. Google states that your data helps them “provide, improve, develop and personalize” their services and machine learning technologies. But if you dig deeper into their multi-layered privacy policy, a clearer picture emerges: your personal information can also be used for targeted advertising and to make recommendations for other Google products.&nbsp;And it gets more concerning.&nbsp;Google explicitly warns users not to share personal or confidential data in Gemini chats. Why? Because human reviewers, known as annotators, may read your conversations, access your files and use that data to improve future model performance. So, not only does your data no longer belong to you; it may also be read and evaluated by actual people.&nbsp;&nbsp;Once again, it does not matter whether you are a free user or a paid subscriber. The privacy terms apply across the board. From the moment you interact with Gemini, your data becomes part of its ecosystem.&nbsp;<h2>DeepSeek: The new kid on the block&nbsp;</h2>Finally, we reviewed the privacy policy of DeepSeek, a platform that gained major traction last year after claiming OpenAI-level performance with just a fraction of the resources. It quickly rose in popularity, eventually topping Apple’s App Store charts.&nbsp;DeepSeek’s privacy policy appears standard. They collect personal data associated with your account, your input and any details you provide when contacting them. But as with the other major players, a deeper dive reveals a long list of data points they track device model, IP address, identifiers, location, cookies, payment details, text inputs, uploaded files, chat history, user age, contact information and more.&nbsp;Where things get even more concerning is where your data goes.&nbsp;Unlike OpenAI or Google, DeepSeek transfers user data from Europe and the U.S. to servers in China, placing it under Chinese authority. This means your information is no longer protected by EU or U.S. privacy laws. According to Chinese regulations, the government may access or request user data at any time, for any reason – with little transparency or recourse.&nbsp;As for how the data is used, the story remains familiar. DeepSeek claims your information helps them improve, develop and train their models, whether by feeding prompts directly into training datasets or by analyzing usage patterns. They also cite compliance with legal obligations and protecting the “interests of users and others”, though who those “others” are is never clearly defined.&nbsp;&nbsp;And, of course, they reserve the right to share your personal data with third-party partners who help operate or develop their services.&nbsp;The bottom line? No matter which platform you choose, your data stops being just yours the moment you use the service.&nbsp;<h2>How privacy has changed&nbsp;</h2>Some might argue that privacy concerns are not new, we have been sharing data online long before large language models (LLMs) took over. After all, even planning a vacation used to involve multiple search queries typed into our favorite search engine. So, what is the difference?&nbsp;That argument seems fair. But there is a key distinction.&nbsp;Before LLMs, we were in control. Searching for cheap flights or hotel deals meant navigating between websites of our choosing. We could decide which platforms to interact with, and, at least to some extent, who saw our data. Tools like <a href="https://us.norton.com/products/norton-antitrack" target="_blank" rel="noreferrer noopener">Norton AntiTrack</a> made it possible to keep trackers at bay, allowing us to interact directly with service providers while limiting what the search engine itself could collect.&nbsp;Now, that dynamic has shifted.&nbsp;When we use LLMs, the model is not just answering a question, it is becoming the gateway to everything. It decides which services to show, which sources to pull from and how to summarize or filter the information. You no longer browse freely; you are handed a curated response. And in the process, the LLM provider sees everything, from your preferences and prompts to your files, location and interactions.&nbsp;Even more troubling? You cannot always tell which sources were used or whether the results are truly in your best interest.&nbsp;So, does this mean privacy is a lost game in the age of LLMs?&nbsp;The answer is not simple.&nbsp;<h2>Countermeasures&nbsp;</h2>Unfortunately, there is no silver bullet when it comes to protecting your privacy while using large language models. But that does not mean you are completely powerless; there are a few settings and habits that can help minimize your data exposure. Let’s take a closer look at what is possible, starting with the most popular platform:<h3>ChatGPT by OpenAI&nbsp;</h3>In OpenAI’s ChatGPT, privacy-conscious users can adjust a few settings to gain more control over how their data is used. To access them, click on your avatar in the top right corner and open Settings. From there, navigate to the Data Controls tab, where you can toggle off “Improve the model for everyone.” This setting tells OpenAI not to use your chats to train future models.&nbsp;You can also visit the Personalization tab and disable memory features to stop the model from saving and recalling information about you. If you are curious about what the model has already learned, click “Manage Memories” to review and delete anything it has inferred.&nbsp;Keep in mind, disabling memory means a less personalized experience, so you may receive less accurate or relevant responses to your prompts. And unfortunately, this does not mean you are fully in the clear: even with all settings turned off, the personal and sensitive information you share may still be collected and stored by OpenAI.&nbsp;Bottom line: these settings offer a degree of control, but not full privacy.&nbsp;<h3>Gemini by Google&nbsp;</h3>With Gemini, your options to control privacy are a bit more limited. The main setting available is found by clicking on Activity in the bottom left panel, where you can disable it. However, this does not mean your data will not be stored or processed, it only means that human reviewers will not inspect the information you share.&nbsp;Gemini’s privacy policy does not explicitly say whether your data is still used to train models without human review, so it remains unclear if your chats contribute to future model training behind the scenes.&nbsp;Unlike ChatGPT, Gemini does not automatically infer information about you. Instead, the model only learns personal details if you explicitly provide them. If you want to delete stored information, you can either switch off Activity altogether or delete entries individually within the same tab.&nbsp;Still, there is no true way to avoid sharing data with Google, and once you share your information, it no longer belongs to you.&nbsp;<h3>DeepSeek&nbsp;</h3>The situation with DeepSeek is a bit grimmer. If you click the bottom left corner and then go to Settings, you will find the Profile tab. Here, the only privacy control available is the option to switch off “Improve model for everyone.”&nbsp;DeepSeek claims that they do not use your content to train their models if you disable this setting, but beyond that, their policy is vague and unclear. What is clear, however, is that once you share your data, it no longer truly belongs to you.&nbsp;<h2>What does the future bring?&nbsp;</h2>AI-powered services like these are here to stay, and they simply cannot operate without the vast amounts of data generated by their users. For now, there are few regulations or safeguards to limit how this data is collected, stored or used, which means privacy is taking a backseat.&nbsp;Until stronger protections are put in place, the responsibility falls on users to safeguard their own sensitive information. That means sharing as little personal data as possible, especially when planning something like a vacation. Otherwise, you might just find your itinerary showing up in someone else’s AI-generated recommendations in the next version of the model you use.&nbsp;The future of privacy in AI is not set in stone yet. But one thing is certain: staying informed and cautious is your best defence.&nbsp;

We dug into the fine print, so you do not have to – here is what ChatGPT, Gemini and DeepSeek are really doing with your prompts

I know what you are doing this summer: What AI knows about you

While conducting routine clipboard monitoring, our team uncovered a sophisticated attack chain masquerading as an official NVIDIA-related update. What initially appeared to be a hiring assessment challenge quickly revealed itself to be a cleverly disguised lure.&nbsp;<h2>The deceptive journey&nbsp;</h2>The attack begins with a prompt to complete a mock interview form, followed by a page instructing users to set up their camera. This page falsely claims there are issues with the user's webcam or microphone, adding a layer of urgency and credibility to the ruse.

A pop-up then urges users to “Request camera access,” which triggers a seemingly legitimate update command using an NVIDIA domain, to help the user fix his issues.

However, once copied, the command morphs into a malicious payload.&nbsp;

<h2>The attack chain&nbsp;</h2>Executing the command initiates a multi-stage attack:&nbsp;<ul><li>A malicious archive is downloaded and automatically extracted.</li><li>The VBS script launches a Python environment embedded within the archive, posing as a legitimate driver update process. It displays verbose output to further trick the user.</li><li>The Python script itself is heavily obfuscated and aligns with known tactics used by the Lazarus APT group.&nbsp;</li></ul>

Upon deobfuscation, the script reveals five major functionalities:&nbsp;<ol><li>Credential Theft: WebBrowserPassView is downloaded, decrypted and executed to extract browser-related credentials. Those credentials, together with system information, are exfiltrated to the command-and-control (C2) server.</li><li>Credential Theft: MailPassView is downloaded, decrypted and run to harvest email credentials, which are also sent to the C2.</li><li>Remote Access: An instance of MeshAgent is silently installed, providing the attackers with persistent remote control over the infected system.</li><li>Advanced Data Theft and Remote Access: A PyInstaller EXE enables file and secret extraction via FTP. Persistence is achieved through a scheduled task disguised as ChromeUpdate.exe, placed within the legitimate Chrome directory to avoid suspicion.</li><li>Cryptocurrency Targeting: Browser extensions and local folders related to cryptocurrencies are harvested and sent to the C2.&nbsp;</li></ol><h2>Attribution and implications&nbsp;</h2>The attack’s complexity and methodology, paired with the initial lure and code similarities throughout the Python scripts, strongly suggest Lazarus’ involvement. This campaign reflects the group’s evolving tactics under the DeceptiveDevelopment umbrella, combining psychological manipulation with technical sophistication to bypass defenses and exploit trust.&nbsp;<h2>Indicators of Compromise (IoCs)&nbsp;</h2>Assessment URL: hxxps[://]assessdome[.]com/invite/7e462f3c/8002565804&nbsp;C2: metakenproxy[.]com:81&nbsp;Initial VBS script (SHA256): 7013822c0a794712c5fe8f62c126e5992dca4a744882a039040569ae4ec1a868&nbsp;Initial Python script (SHA256): 03ad194456951695eb4d4ceb40d9e52aaadbc9a4f4b8b1d020077115103e5359&nbsp;WebBrowserPassView (SHA256): 36541fad68e79cdedb965b1afcdc45385646611aa72903ddbe9d4d064d7bffb9&nbsp;MailPassView (SHA256): bc7bd27e94e24a301edb3d3e7fad982225ac59430fc476bda4e1459faa1c1647&nbsp;MeshAgent (SHA256): 9757780860ec5637c412a8756f25c56f7d1d89358e447782164ba418def1c64e&nbsp;ChromeUpdate.exe (SHA256): 00bef70cd031a830f2ee1ec4ce750947a9c8838995289ecbb253426cca53d046&nbsp;

We traced a deceptive hiring assessment scam back to Lazarus, and here’s how they use psychology and obfuscation to bypass defenses

Lazarus’ latest tactics: Deceptive development and ClickFix

Ransomware isn't what it used to be, it’s gotten a corporate makeover. What began as a work of lone hackers, has evolved into a sophisticated business model known as Ransomware-as-a-Service (RaaS). In this setup, ransomware developers and a network of affiliates collaborate like any legitimate enterprise (minus the part where they extort people).&nbsp;Unlike traditional companies, ransomware groups don't publish earning reports or financial disclosures. Their operations are covered in shadows - until something goes wrong. Occasionally, these groups become targets themselves, and when they do, we get a rare glimpse behind the curtain.&nbsp;This article explores one such moment. On May 7th 2025, arguably the most notorious ransomware group, LockBit, had its panel defaced, exposing a link to a dump of its internal database. The data revealed that the panel had been in operation since at least December 18th, 2024, based on early test entries in the database. While the leak has drawn attention for its technical and operational revelations, this analysis takes a different approach: it focuses on the economic structure behind LockBit's operations. How LockBit recruits affiliates, manages operations, and generates profit. In doing so, we aim to shed light on the inner workings of the underground economy of cybercrime.&nbsp;<h2>Inside the LockBit Panel&nbsp;</h2>The leaked database revealed a sophisticated backend system - basically, a control panel for managing a global extortion operation. It included everything from user accounts and victim profiles to ransomware build information and chat messages exchanged between affiliates and victims.&nbsp;Through this panel, affiliates had access to generate customized ransomware payloads for different environments such as Windows, Linux, and ESXi. The system also stored detailed information about LockBit's victims (or "clients" as they are called internally). Each victim had an assigned public key, responsible affiliate, a payment status, and a complete chat history with the affiliate including features like message read receipts.&nbsp;&nbsp;One particularly eyebrow-rasing detail: affiliate passwords were stored in plaintext. A surprising move for a group that claims to be all about operational control. But hey, even cybercrime syndicates cut corners on cybersecurity.&nbsp;Essentially, we got a preview of a modern CMR (Customer Relationship Management) system - this time not for selling products or services, but rather for extortion.&nbsp;

<h2>A Day in the Life of a LockBit Affiliate</h2>Affiliates are individuals enrolled in the LockBit's affiliate program, think of them as franchises in the ransomware world. After gaining access to the panel, they are granted permissions to build specific versions of the LockBit ransomware. These builds are then deployed to victim systems, either through self-obtained access or via third-party brokers.When a victim is compromised, they are directed to LockBit's infrastructure, where they land in a private chatroom assigned to the affiliate who infected them. This is where real business begins: negotiation, manipulation and psychological warfare.While affiliates often present themselves as cold and transactional, the chat logs reveal a more manipulative side. Affiliates frequently use everything, from manufactured urgency to subtle threats, designed to wear victims down and push them towards payment.&nbsp;

When a ransom is agreed upon, the affiliate generates a new Bitcoin wallet (for our case, we will call it a ransom wallet) to receive the payment. Those wallets are created and controlled by the affiliate, and thus not directly stored in the LockBit panel database. They can be found in the negotiation chats.After receiving the ransom, the affiliate is expected to send 20% of the ransom to a commission wallet (a wallet address that is pre-generated and stored in the panel for each affiliate-victim pair). These commission wallets are under LockBit's control and serve as the group's cut of the ransom payments.The affiliates' share (80%) is usually moved quickly through additional wallets or cryptomixers (services designed to obscure origin of funds), the commission wallets remain largely untouched. The funds sit dormant, likely waiting for a time when they can be withdrawn without drawing the attention of the law enforcement.

<h2>Recruiting New Criminals: The Affiliate Onboarding Funnel</h2>LockBit curates a list of invitations in their panel, each with a specific Bitcoin or Monero wallet and an amount to be paid. The fee for aspiring affiliates ranges from around $700 to $810. After transferring this fee, LockBit creates a new user in the database and sets them the role of newbie. Then, the affiliate officially gets access to the panel and is able to deploy LockBit ransomware and use their infrastructure for ransom negotiations. Startup costs, criminal edition.The dump contained more than 3,600 invitations, with wallets designed to pay the fee either through Bitcoin or Monero. Because of the difficult traceability of the Monero wallets, we cannot say for sure the total number of panel fee payments. But among the invitations that used Bitcoin, only 12 users actually paid the invitation fee during the operation of the panel.<h3>The Revenue Picture</h3>Every LockBit client has an entry in the panel's table. The group collects data about the victim's website, their expected revenue, whether they are an important client or no or their assigned master public key (the tables in the database also show column for private key, however, it is empty for every victim). Since December 2024, the database contained in total of 246 victims with 208 that actually connected to the dedicated chat and started with the negotations. However, from examining the commission and ransom wallets, only 19 paid the ransom payment. The total amount of ransom extorted was 24.8 BTC ($2,660,484 by June 26th, 2025), from which 20% went to the LockBit operators and 80% to the affiliates.The following figures describe the timeline with the amount of LockBit's commissions (20% commission part that went to LockBit) and number of successfully attacked victims with ransom being paid.

In total, there were 40 active affiliates registered in the panel. Ten of them registered by paying the invitation fee, while the rest got the job of affiliate by unknown means - they were either probably affiliates even before the panel was created or registered in another way. Of all the affiliates enrolled, 35 of them started with negotiations, but only 10 of them made some profit. In the following plots, we can see those top 10 affiliates and how successful they were (80% of the ransom extorted), as well as how many messages they exchanged with the victims.

<h2>Final Thoughts: Crime as Business</h2>LockBit’s panel leak is one of the clearest examples we’ve seen on Ransomware-as-a-Service functioning like a tech startup, except its “value proposition” is fear, pressure and extortion.The business was powered by a surprisingly systematic affiliate model, built-in infrastructure, and financial incentives. Despite the flood of invitations and flashy promises, the majority of affiliates never got paid. Of the 246 victims listed, just 19 were paid, suggesting most people either lacked the funds or simply refused to play along. If this all sounds like a parody of a VC-backed startup pitch, it kind of is. But the impact is real, and the profits (while smaller than the headlines suggest) are still enough to fund the next wave of extortion innovation.For readers interested in a more technical breakdown of the LockBit panel and its components, Trellix published an in-depth reverse engineering analysis available <a href="https://www.trellix.com/blogs/research/inside-the-lockbits-admin-panel-leak-affiliates-victims-and-millions-in-crypto/" target="_blank">here</a>. &nbsp;

A rare leak reveals how LockBit operates like a startup — complete with affiliates, onboarding and profit-sharing — offering a glimpse into the business behind one of the world’s top ransomware gangs

Ransomware Inc. The Business Model Behind LockBit's Millions 

Security Evangelist at Gen

You’ve probably seen alarming headlines about a massive leak involving billions of passwords reportedly affecting users of platforms like Google, Facebook, Apple, and more. But before you panic, let's break down what's actually happening, why it matters and what you can do to protect yourself effectively.&nbsp;<h2>Q: What’s this headline-making “16 billion password leak” really about?&nbsp;</h2>A: First things first: this is not a new breach of Google, Apple, Facebook or any major platform. Despite what you may have read. Instead, researchers discovered a massive collection of credentials (over 16 billion login details) compiled from numerous past security breaches and <a href="https://www.avast.com/c-malware">malware infections</a>. While some headlines call it a ‘data leak,’ this compilation is a repackaging of stolen credentials from past breaches.<h2>Q: Where did these leaked passwords come from?&nbsp;</h2>A: These records, gathered mostly by malicious software known as "<a href="https://www.gendigital.com/blog/insights/reports/threat-taxonomy" target="_blank" rel="noreferrer noopener">infostealers</a>," have accumulated over time. Infostealers are sneaky malware programs that quietly steal login details saved in browsers and applications on infected devices. Over time, cybercriminals gather this data into huge databases—like the one now in the news.&nbsp;&nbsp;<h2>Q: Are the leaked credentials new or old?&nbsp;&nbsp;</h2>A: Most of these leaked credentials are likely older, duplicated or previously known from earlier breaches. While 16 billion sounds dramatic, many of these credentials are no longer valid. Still, it’s important not to dismiss the risk entirely because there could be plenty of credentials still active, especially if you reuse passwords.&nbsp;<h2>Q: Why should I care if the data is mostly old?&nbsp;&nbsp;</h2>A: Even if the data is partly old, it’s a critical reminder of the real-world risks associated with reusing passwords or using weak ones. Here’s why it still matters:&nbsp;<ul><li>Account Takeovers: Hackers might still gain access if you haven't changed compromised passwords. </li><li>Identity Theft: Personal information from compromised accounts can be misused in identity fraud. </li><li>Phishing Attacks: Attackers may exploit leaked data to craft convincing scams or phishing emails. </li><li>Sextortion Scams: Criminals may threaten to expose sensitive or embarrassing information allegedly obtained from breached accounts unless a ransom is paid, even if they don't actually have that information.&nbsp;</li></ul><h2>Q: How can I check if my information was part of the leak?&nbsp;&nbsp;</h2>A: Checking if your credentials are part of this or any other known leak is easy:&nbsp;<ul><li>Visit <a href="https://haveibeenpwned.com/" target="_blank" rel="noreferrer noopener">Have I Been Pwned?</a>. And enter your email address. </li><li>Use dark web monitoring services from providers like <a href="https://us.norton.com/" target="_blank" rel="noreferrer noopener">Norton</a> or <a href="https://www.avast.com/en-us/breachguard#mac" target="_blank" rel="noreferrer noopener">Avast</a>. These tools quickly tell you if your email or username has appeared in known breaches. </li><li>If you were in fact part of the leak, <a href="https://lifelock.norton.com/learn/data-breaches/steps-to-take-right-after-a-data-breach" target="_blank" rel="noreferrer noopener">here are some next steps</a>.&nbsp;&nbsp;</li></ul><h2>Q: What can I do right now to protect my information?&nbsp;&nbsp;</h2>A: Here are straightforward tips you can follow immediately:&nbsp;<ul><li>Get a Password Manager and Never Reuse Passwords: Create unique passwords for every account. Use a password manager, such as <a href="https://my.norton.com/extspa/passwordmanager" target="_blank" rel="noreferrer noopener">Norton Password Manager</a>, to help you easily create and store them.&nbsp;</li><li>Enable Two-Factor Authentication (2FA): This provides a second layer of protection. Apps and hardware keys are better than SMS-based methods. </li><li>Use Security Software: Reliable security software, such as Norton or Avast, protects your devices in real-time from threats like malware and <a href="https://www.avast.com/c-phishing">phishing attempts</a>. </li><li>Stay Alert for Phishing Scams: Be wary of unexpected emails or messages, especially those urging immediate action.&nbsp;</li></ul><h2>Q: How does a massive data breach happen in the first place?&nbsp;&nbsp;</h2>A: Massive leaks like this happen over time, not overnight. Infostealer malware quietly infects individual devices, stealing credentials saved in browsers and applications. Cybercriminals then compile, sell or leak these stolen credentials in vast databases. These compilations often contain duplicated data from older leaks, inflating their numbers dramatically.&nbsp;<h2>Q: Should I be worried? &nbsp;</h2>A: While the recent news might seem frightening, it's mainly a powerful reminder about good online habits. By adopting simple but effective practices, you significantly reduce your risks. Be proactive, stay informed and you can navigate the digital world safely.&nbsp; &nbsp;<h2>Bottom line&nbsp;</h2>Massive leaks like this one reinforce the importance of strong, unique passwords and layered security. With a few smart habits and the right tools, you can stay ahead of cybercriminals—no matter how big the numbers get.&nbsp;&nbsp;Worried your credentials were part of this leak? Learn more: <a href="https://hk-en.norton.com/breach-detection" target="_blank" rel="noreferrer noopener">https://lifelock.norton.com/learn/data-breaches/breach-detection</a>&nbsp;&nbsp;&nbsp;

What you need to know and do about the massive credential dump making headlines 

The truth behind the 16-billion password leak: Are your accounts safe? 

Imagine you're going about your day when suddenly you receive an urgent message on Instagram. It's supposedly from “Meta’s Advertising Support Center,” warning you that your account is about to be disabled due to policy violations. The message includes official-sounding language, a Meta logo, a tight deadline (today!) and a link to “verify” your identity.&nbsp;That’s exactly what is happening to influencers and business owners daily, when they receive a message like the one below:&nbsp;

The messages are part of a growing wave of social engineering attacks designed to hijack Instagram accounts and steal access to their audiences.&nbsp;&nbsp;<h2>How the scam works&nbsp;</h2>When someone clicks on the link, they’re taken to a phishing site that mimics Meta’s interface. It asks the victim to “Request Review” to prevent their account from being disabled, a tactic that prompts them to enter their login details.&nbsp;

&nbsp;After submitting login information, the next step asks for their password.&nbsp;&nbsp;Since many people now have two-factor authentication (2FA) enabled, the attackers also try to steal that second layer of security by requesting the authentication code, all under the guise of “identity confirmation.”&nbsp;&nbsp;Once the scammers have the credentials and 2FA code, they immediately lock the victim out of their account, change the login info and take full control.&nbsp;<h2>Key elements of the scam&nbsp;</h2>&nbsp;This scam follows a typical phishing pattern. Here’s what to look for:&nbsp;<ol><li>Impersonation of authority: The scammers pose as a legitimate Meta entity — “Advertising Support Center.” The name sounds official, and they use a generic support logo to appear credible.</li><li>Urgent language: The message claims your Instagram and Facebook accounts will be disabled today due to violations, creating a sense of panic that pressures the victim into acting quickly.</li><li>Fake justification: The message states that the linked Facebook page doesn’t comply with Meta’s terms, suggesting a policy violation that needs to be resolved immediately.</li><li>Malicious link: The person is told to verify their account by clicking a suspicious URL. The domain looks vaguely like a Meta service (businessmetasuite.com-complaintsupportpage...click) but is clearly fake.</li><li>Phishing page: The link opens a page that mimics Meta’s interface and asks the victim to “Request Review” to prevent their account from being disabled. Victims are prompted to enter their login credentials.</li><li>2FA bypass: Since many Instagram accounts now have two-factor authentication (2FA) enabled, attackers know that just a password isn’t enough. These phishing pages are designed to also capture the second factor by requesting the code from the victim under the pretense of confirming their identity. This gives attackers everything they need to log in, bypass security and lock the victim out.&nbsp;</li></ol><h2>What the attackers are after&nbsp;</h2>In these scams, cybercriminals aren’t looking to steal passwords just for fun, they’re after influence, money and access. An account with thousands of followers, especially one used for professional purposes, is a very valuable asset. Once hijacked, it can be used to:&nbsp;<ul><li>Push scams to followers (like investment fraud, phishing links and fake giveaways)</li><li>Demand ransom from the original owner</li><li>Sell the account on underground markets&nbsp;</li></ul>The goal is to gain control of the account, lock the original owner out and monetize the audience.&nbsp;<h2>What to watch out for&nbsp;</h2>These scams can be surprisingly effective, especially for people who manage business or creator accounts. Here’s how to spot and avoid them:&nbsp;Red flags:&nbsp;<ul><li>Messages from accounts with very few followers or no verification badge</li><li>Urgent threats about account deletion or policy violations</li><li>Requests to click external links for “verification”</li><li>Grammatical errors or awkward phrasing&nbsp;</li></ul>Tips to stay safe:&nbsp;<ul><li>Never click on links in DMs from unknown accounts. Meta and Instagram will never ask you to verify your account via private message.</li><li>Check the sender’s profile. Official Meta accounts are verified and won’t have names like advertisingsupportcenter0798.</li><li>Use two-factor authentication on your accounts to prevent unauthorized access.</li><li>Report the account to Instagram if you receive one of these messages.</li><li>Educate your team. If you manage your account with others, make sure everyone knows how these scams work.&nbsp;</li></ul><h2>Why this matters&nbsp;</h2>For businesses and creators, Instagram isn’t just a social platform, it’s a channel for visibility, customer engagement and income. Losing access can have a direct financial impact.&nbsp;Scammers know this, and they’re getting better at creating convincing traps. The more awareness we raise, the harder it is for them to succeed.&nbsp;Stay alert, stay safe — and remember, real support never slides into your DMs.&nbsp;

Fake support messages are hijacking Instagram accounts. Here’s how the scam works and how to stay in control. 

Instagram support scams: How criminals trick you into handing over your account

Threat Researcher at Gen

<h2 class="text-align-justify">Key Points</h2><ul><li>Gen Threat Labs has discovered and analyzed an elaborate Traffic Direction System infrastructure delivering FakeCaptcha, tech scams and other malware campaigns to select users.&nbsp;</li><li>The campaign entry points are infected or otherwise attacker-controlled streaming websites, file sharing services, as well as malvertising campaigns.&nbsp;</li><li>Victims are evaluated based on geolocation, IP address, and browser fingerprinting; for example, connections through VPNs or headless browsers are detected and rejected.&nbsp;</li><li>The FakeCaptcha campaign is increasing its stealth by mimicking legitimate software websites.&nbsp;</li><li>A new variant of FakeCaptcha spreading information stealers and RATs avoids detection by employing Unicode math fonts.&nbsp;</li></ul>

<h2>Introduction</h2>The <a href="https://www.gendigital.com/blog/insights/research/global-surge-in-fake-captcha-attacks" target="_blank" rel="noreferrer noopener">FakeCaptcha campaigns</a> have become a widespread malware infection vector, using clever social engineering and exploiting internet users’ confusion about common CAPTCHA practices to trick victims into infecting their own computers, typically with information-stealing malware like LummaC2, by pasting malicious commands into the Windows Run dialog.&nbsp;We have discovered an elaborate infrastructure actively used to deliver multiple variants of FakeCaptcha and other malicious content to select users. At the core of the operation is an attacker-controlled Traffic Direction System network. It has a single purpose—to fingerprint the visitor’s device and network details to determine what type of content to deliver. This could be malicious, monetized or decoy content, or no content at all. For reasons we will describe later, we are calling this infrastructure HelloTDS.

As shown in the graphic above, the scope of the campaign is massive; in April and May 2025 alone, we have protected over 4.3 million users worldwide. In terms of absolute numbers, the most affected regions include the United States, Brazil, India, and Western Europe. However, when adjusting for population size and user base, a different trend emerges: the highest relative risk is concentrated in the Balkan countries of Europe and in parts of Africa, particularly Rwanda, Egypt, Tanzania, and Kenya.<h2>Attack Chain</h2>At a high level, the attack works as follows: The victim visits an infected website or clicks on a malicious ad. The entry website requests a JavaScript file from the initial HelloTDS endpoint, which fingerprints the connection and decides whether to serve content or stay idle. If the user is not deemed a suitable victim, the attack stops here. Otherwise, the server responds with a script that further fingerprints the browser, logs mouse movements and similar, eventually sending another request to receive the final payload containing a redirect to the malicious landing page. Among users who passed the initial check, FakeCaptcha was observed to be the most prevalent malicious landing page, with Fake Updates, file downloads containing encrypted malware, tech scams and other fraudulent campaigns also having a share.&nbsp;

One specific example of the full attack chain is illustrated in the next figure: We visited the website dailyuploads[.]net, uploaded an arbitrary image file, and navigated to the link generated by the service. The resulting page included a script from HelloTDS, and when we clicked the download link, we were involuntarily redirected to a FakeCaptcha landing page attempting to trick visitors into executing the Emmenhtal loader.

<h2>From Movie Streaming or File Sharing to Malware</h2>Besides ad networks, the primary source of traffic for HelloTDS are legitimate-looking, properly functioning websites, such as movie streaming sites, torrent mirrors, file-sharing services, link shorteners, or porn websites. However, these websites are specifically crafted or manipulated—presumably also by the attacker—to cooperate with the attacker’s infrastructure and load malicious scripts. This tactic completely bypasses the need for malvertising campaigns through “legitimate” advertising companies, as these websites request the attacker’s scripts directly.Moreover, we have observed a repeating pattern in some of these websites, which offer file sharing services and promise their users financial gains. These include dailyuploads[.]net, streamtape[.]{com,net,to}, watchadsontape[.]com, bigwarp[.]art or savefiles[.]com to name a few. Security or data privacy is clearly not a priority for these services, as anyone can sign up with any e-mail address without verification. We suspect that these websites are cloned from some existing file sharing service and controlled by the same threat actor who controls HelloTDS and eventually delivers FakeCaptcha, for the primary purpose of embedding malicious popups and redirects within the page (although email &amp; password harvesting could be a “welcome” byproduct).

<h2>The Anatomy of a HelloTDS Domain</h2>An “entry point” website, like those described previously, will usually statically embed one or more HTML snippets loading remote JavaScript that look like this:

(In case of file-sharing websites described above, this snippet will be included in the page with the uploaded file, i.e. the one you share the link to, but not on the main page itself.)The source domain is randomly rotated and both path segments are randomly generated (although their length and character sets are always the same), presumably to prevent static detection. Despite this, it is easy to spot these URLs with a human eye (or a clustering algorithm). All the HelloTDS domains we have seen so far have the same format: The apex domain consists of 2-3 (pseudo)words with a “.top”, “.shop” or sometimes “.com” TLD; optionally, a short subdomain is used, consisting of usually 2, but up to 4 random letters.&nbsp;Examples of these domains include:<ul><li>yr[.]unasonoric[.]com</li><li>gq[.]binesyorker[.]com</li><li>sb[.]rowlandpodogyn[.]shop</li><li>nutatedtriol[.]com</li></ul>

Apart from the distinctive domain names, another sign that speaks for HelloTDS is that the domain names are almost exclusively registered in Panama through the Pananames registrar, and the servers reliably present Let’s Encrypt certificates during TLS handshakes.In an attempt to make tracking HelloTDS infrastructure difficult, the authors designed it to be highly dynamic, frequently rotating active domains and their DNS records. Even so, we have identified that all domains associated with this infrastructure are registered under AS7979 (SERVERS-COM) within the following IP ranges:<ul><li>23.83.64.0/22</li><li>23.109.120.0/22</li><li>23.109.128.0/19</li><li>23.109.170.0/24</li><li>94.242.232.0/21</li><li>172.240.104.0/21</li><li>172.241.48.0/21</li><li>172.255.96.0/20</li><li>173.0.146.0/23</li><li>173.237.64.0/20</li><li>188.42.104.0/21</li><li>188.42.240.0/21</li><li>209.192.192.0/18</li><li>212.117.184.0/21&nbsp;</li></ul>

Another interesting aspect shared by all HelloTDS servers is the usage of the non-standard HTTP header “megageocheckolololo”, which we believe is not commonly used by any well-known service. Its presence in the “Access-Control-Allow-Headers” HTTP response header is another indicator of a HelloTDS server.

Lastly, domains belonging to HelloTDS can be reliably identified using the information they expose via “robots.txt”:

The “/hi” endpoint always returns a simple HTML response with a single text node that says “Hello!” — hence the name HelloTDS.<h2> First Stage: Fingerprinting Based on Network Information</h2>The first decision is made by the HelloTDS server immediately upon receiving the request sent from one of the entry point websites. Since we can only send requests and observe the servers’ responses, it is difficult to tell the exact shape of the server’s decision tree. We suspect that several factors, such as IP/geolocation checks, timeouts, or maybe even pure randomness, may contribute to the result in some way.From the user’s point of view, there are two possible outcomes. In one case, the server responds with a no-op script (usually an empty function or a single-line comment containing 2 or 3 letters, like “// ipx” or “// mt”, likely codes used for “debugging” the TDS), meaning the user will not get any malicious content (from that endpoint). Alternatively, the server will respond with a large JavaScript that performs heavy client-side fingerprinting and eventually performs a subsequent request to another HelloTDS endpoint. Either way, the server sets a pair of cookies in the response; these encode information about the client’s browser, operating system and network, as detected by the server, and may be used as a client-side cache for further requests (although we have found that tampering with them is generally not useful).

The cookie values contain Zlib-compressed binary data encoded in Base64. Although the low-level data format is unknown, the data itself contains readable ASCII strings like the client’s IP address, country, or ISP, which reveal the purpose these cookies likely serve.

<h2>Second Stage: Fingerprinting in the Browser</h2>Contrary to the logic executed on the server, the next fingerprinting routine is performed in the browser (by the returned JavaScript) and can thus be reverse-engineered. The exact code returned from different HelloTDS endpoints varies somewhat in structure and complexity (at the very least, the server appends a timestamp comment to hinder hash-based detection), but all of them share the same basic high-level functionality.Crucially, the JavaScript sent by the server contains an encrypted configuration variable — a JSON string where each alphanumeric character is substituted with some other. This part of the code can be easily identified: Look for a function call with two arguments, the first being the encrypted JSON string and the second being the key: A concatenation of the characters a-z, 0-9 and a random permutation thereof. This obfuscation is not unique to HelloTDS; however suspicious it may be for an ad network to employ this technique, we have also observed this behaviour in scripts employed by the Czechia-based Clickadu ad network, which happens to share certain characteristics with the threat actor’s infrastructure.The number of key-value pairs in the configuration object varies, but some common ones we regularly encounter are “url”, “zone_id”, “uuid_url”, “rot_url”, “metric_url”, “timezone_offset” and/or “timezone_diff”. Other keys that particularly stand out due to their names are “devtools_protection” and “philanthropic_level”, which were set to “true” and 0 respectively whenever we inspected a chain that landed on FakeCaptcha in the end.The “*_url” keys contain further HelloTDS URLs, which are used to retrieve a sort of unique identifier (“uuid_url”), the target URL (“rot_url”), an endpoint to report errors and other metrics to (“metric_url”), and an endpoint for mouse movement and device sensors tracking (“url”). Notably, the “rot_url” always contains a special parameter named “md” with a placeholder for the fingerprinting information collected by the script.

The JavaScript collects the following information:<ul><li>Basic browser info: window width and height, document referrer, window location (URL), browser language, current datetime, time zone offset, and whether the site is shown in a top-level window or an iframe,</li><li>the “user id” previously returned by the UUID endpoint,</li><li>whether or not a mobile browser is used (by checking if the deprecated window.orientation property is defined),</li><li>whether or not a touch screen is present (by reporting the value of the window.navigator.maxTouchPoints property),</li><li>page title information, most common words in the host webpage as well as any keywords declared in the host document’s head element,</li><li>the approximate amount of physical memory and the number of processor cores,</li><li>battery status (level, charging state),</li><li>WebGL vendor and renderer,</li><li>a “sandbox score” consisting of 6 flags, e.g., whether the browser is Headless Chrome, or whether specific video codecs are supported,</li><li>network information, e.g., network type (Wi-Fi, Ethernet, cellular, …), effective and maximum bandwidth, or the estimated round-trip time,</li><li>screen orientation and colour depth,</li><li>whether cookies are enabled.</li></ul>

A JSON object containing this information (as well as some keys from the config) is Base64-encoded and sent in the md parameter to the rotated URL from the config via a POST request. The response contains a JSON object with a “url” key as well as a TTL and bidding details.

The returned URL is the last HelloTDS endpoint in the whole chain.<h2>Third Stage: Final Payload with Redirect to Landing Page</h2>The final step in the HelloTDS pipeline is a simple JavaScript-based redirect to the target URL.

In this case, bestfree4u[.]com simply responded with a 301 redirect to a FakeCaptcha landing page at finding-from-internet[.]fly[.]storage[.]tigris[.]dev/seacrh-result[.]html. However, when accessed from a different environment, the same domain may seem harmless. In other cases, the final HelloTDS redirect leads to tech support scams, malicious file downloads, fake browser updates, potentially unwanted browser extensions, or cryptocurrency investment platforms.<h2>The Destination: FakeCaptcha Redirectors</h2>In the past months, we have seen a highly predictable pattern in the malicious URL payloads served by HelloTDS: Almost universally, they were machine-generated domains consisting of a couple of English words and a “.com”, “.shop”, “.online”, “.info”, “.live”, “.pro” or similar TLD, and the URL path was a string with 24 hexadecimal digits, the first two usually being 67 or 68. These URLs served as simple redirects, either to FakeCaptcha, or sometimes to a decoy—usually some (benign but potentially unwanted) browser extension or cryptocurrency product website. We have seen multiple of these URLs redirect to both a FakeCaptcha landing page and a decoy at different times, which removes any doubt about this being an inherently malicious service. Example URLs include the following:<ul><li>actednow[.]com/675cb495c39bc481ddf8edd6,</li><li>buzzflying[.]shop/6767af2ee2aa535e92d62a64,</li><li>goldtera[.]live/6758b1d6467532a801fa06c4,</li><li>orbito[.]online/677120fb2cca41d88a7392a2.</li></ul>The domains used by this service could be reliably identified by being registered under Namecheap in Reykjavik, Iceland, using a Let’s Encrypt TLS certificate, and resolving to one of the following IP addresses:<ul><li>5.161.37.228,</li><li>5.161.110.119,</li><li>5.161.178.111,</li><li>23.105.163.27,</li><li>23.105.163.55,</li><li>34.142.174.238,</li><li>172.104.80.249.</li></ul>Recently, the attacker has started employing more sophisticated masking even at the level of the final payload.Additionally, the structure of served URLs redirecting to FakeCaptcha has changed – they now often include parameters with placeholders, which may not even be filled in, yet the victim can still be redirected to a FakeCaptcha landing page. We have seen different variations of these URLs, some of which omit specific parameters.

Interestingly, some of the URLs served by HelloTDS redirect victims to FakeCaptcha landing pages, but when accessed in a controlled environment, they often mimic some legitimate websites and serve some benign content. One example of such a website is&nbsp;hxxps[://]avs4u[.]net/?sub1=39388&amp;sub2=…&amp;sub3=ID&amp;sub4=677886&amp;sub5=0.0004752 — while it often redirects the victims to FakeCaptcha landing pages, it may also display mimicked content of the legitimate website www.avs4you.com, a software for processing videos and images. The downloadable binary is also legitimate, indicating an attempt to conceal malicious activity.Another example of a URL redirecting victims to FakeCaptcha but serving legitimate content in a controlled environment is hxxps[://]arcadeclassic[.]org/?sub1=681978&amp;sub2=0.00037565.&nbsp;

We therefore tried to understand the reasoning behind the decision of whether malicious content is served. As part of this effort, we explored the potential influence of the cookies being set, which we mentioned earlier. Ultimately, we have concluded that the decision is probably based solely on the IP address of the client. We suspect that if the IP address originates from a known VPN or other anonymizing services, the victim is consistently redirected to some benign content, likely because such users are not target victims and may potentially be security analysts. In such cases, HelloTDS delivers benign content to obscure its actual behavior, effectively evading analysis and avoiding detection.<h2>Delivered Malicious Content</h2>In our analysis of HelloTDS landing page redirectors, we observed that they serve a mix of both malicious and legitimate content. These “clean” redirects, however, often lead to investment-related sites, especially those involving cryptocurrencies. We believe that this choice is deliberate. Firstly, generating traffic to advertisers through non-consensual clickjacking may serve as an alternative, more predictable source of income for the attacker without “stepping into the dark” and serving hard malware. Furthermore, if the primary objective of FakeCaptcha is to infect victims with information stealers that ubiquitously target crypto wallets, redirecting users who were not deemed as ideal victims to a crypto investment platform may be the most logical strategy for the attacker in the long run.On the unequivocally malicious side, various forms of FakeCaptcha were predominant, but we have also encountered Fake Updates, tech scams, download links with encrypted archives delivering LummaC2, and various other scams. Some specific examples are listed below.

<h2>Key Takeaways and Defensive Measures</h2>The HelloTDS infrastructure behind FakeCaptcha campaigns demonstrates how attackers continue to refine their methods to bypass traditional protections, evade detection, and selectively target victims. By leveraging sophisticated fingerprinting, dynamic domain infrastructure, and deception tactics (such as mimicking legitimate websites and serving benign content to researchers) these campaigns achieve both stealth and scale.What You Can Do:<ul><li>Use reputable security software with real-time protection to block known TDS and FakeCaptcha domains. Products from Norton, Avast, AVG, and Avira automatically protect users against these threats.</li><li>Enable browser-level protections like anti-tracking and ad-blocking extensions, which may prevent the initial malicious scripts from loading.</li><li>Be cautious with file-sharing and streaming sites, especially those that promise monetary rewards or allow anonymous uploads without verification.</li><li>Avoid copying and pasting commands from unknown or suspicious websites into system dialogs like Windows Run.</li><li>Inspect suspicious domains manually or through security tools—look for signs like oddly-structured URLs, frequent domain rotation, or generic domain names.</li></ul>FakeCaptcha is not just a social engineering trick. It's the final step in a well-orchestrated system that filters, evaluates, and targets users with precision. Understanding the infrastructure—HelloTDS in this case—is key to disrupting the full chain of attack.<h2>Indicators of Compromise (non-exhaustive)</h2>You can find the complete list of IoCs on our <a href="https://github.com/avast/ioc/tree/master/HelloTDS">GitHub</a>.<h3>File Sharing Entry Websites</h3>dailyuploads[.]netstreamtape[.]tostreamtape[.]netstreamtape[.]towatchadsontape[.]combigwarp[.]artsavefiles[.]com<h3>HelloTDS Domains</h3>yr[.]unasonoric[.]comgq[.]binesyorker[.]comsb[.]rowlandpodogyn[.]shopnutatedtriol[.]commixscoggan[.]shopbu[.]unrimedironize[.]shop<h3>FakeCaptcha Redirectors</h3>actednow[.]com/675cb495c39bc481ddf8edd6buzzflying[.]shop/6767af2ee2aa535e92d62a64goldtera[.]live/6758b1d6467532a801fa06c4orbito[.]online/677120fb2cca41d88a7392a2bestfree4u[.]comavs4u[.]net/arcadeclassic[.]org<h3>FakeCaptcha Landing Pages</h3>adelaidavizcaino[.]com/cpwpartage-de-medias[.]fly[.]storage[.]tigris[.]dev/affiliate-link[.]htmlfinding-from-internet[.]fly[.]storage[.]tigris[.]dev/seacrh-result[.]html

A behind-the-scenes look at HelloTDS: the stealthy infrastructure driving FakeCaptcha scams, malware and more across millions of devices

Say hi to HelloTDS: The infrastructure behind FakeCaptcha 

Threat Operations Analyst at Gen

A new wave of charity scams is targeting Brazilians through social media. Scammers are repurposing people’s real-life struggles to create fake charity websites with the intent to steal money from individual charity donors. Victims of this scam may not even be aware that their donation has not reached its intended recipient.&nbsp;The scam starts on social media such as Facebook, Threads and Instagram. Scammers use fake profiles or hacked accounts to join fundraising groups and groups dedicated to local towns. They often repost several posts from other accounts to gain legitimacy, followed by posting links to a prepared fake donation website.&nbsp;

Once the victim with charitable intentions clicks on the link, they are presented with a fake copy of a known fundraising website, often Vakinha. The scammers mostly copy real stories posted by people in need to scam money away from donors. The websites sometimes contain links to YouTube videos posted by the original profiles on the real website.&nbsp;&nbsp;

The websites feature a fake Facebook feed with incoming comments from people who have supposedly donated to the cause. There is also an incoming donation effect that tries to lend legitimacy to the scam, making the victim believe that other people are actively donating.&nbsp;If the victim decides to donate, they are redirected to a payment page with a PIX code and QR code. PIX is a real-time instant payment system in Brazil, created by the Central Bank of Brazil. The payment page often contains further encouragements and a how-to-donate manual. Unlike with phishing and other types of cyberattacks, the scammers are not going after victim’s details, they just syphon away money from legitimate charitable causes.&nbsp;

If the victim sends away the payment, the website displays a thank you page, attempting to convince the victim that the money sent has been received by the cause. It is likely that victims may never know they have sent money away to scammers. The other victims, the people in actual need of assistance, never receive the money.&nbsp;

Avast blocks this new scam and has protected hundreds of users in Brazil in the last week. If you encounter a similar donation scam, please consider the following:&nbsp;<ol><li>Use reputable websites that verify profiles and charity cases. This way you can avoid falling for a scam or sending money to scammers instead of the intended cause.</li><li>Beware of fake links spread through social media. Verify the URL you are clicking on and check that the website is the one you are intending to donate through.</li><li>Research the organization. If you see a post asking for donations with a link to a website, do a quick Google search to ensure its legitimate.</li><li>Avoid pressure tactics. Scammers often create a sense of urgency to keep their victim engaged. Be wary of sending money away if you are feeling pressured.&nbsp;</li></ol>