Author: The Virus Informer

The FBI has seized seven domains operated by Chinese state-sponsored hackers known as Flax Typhoon to disrupt two hacking tools used in attacks on critical infrastructure worldwide. The tools, MicroScan and FishHub, were allegedly operated by China-based Integrity Technology Group, which U.S. authorities say has contracts with the Chinese government. MicroScan is a vulnerability-scanning platform that identified security weaknesses in targeted networks, while FishHub conducted spear-phishing attacks and delivered malware to already-compromised systems. Targets included a South Carolina power company, airports in Japan and Poland, Taiwanese energy companies, and universities across multiple countries.

In coordination with the domain seizures, the FBI, CISA, NSA, and international partners issued a joint cybersecurity advisory detailing how Chinese hackers used these tools to compromise organizations and steal sensitive information. The attackers targeted U.S. government agencies, critical manufacturing, healthcare, and educational institutions, as well as organizations in Southeast Asia, Africa, and North America. Authorities are urging organizations to review provided indicators of compromise, patch vulnerable systems, and enforce multifactor authentication. This disruption follows a previous action in September 2024 against an Integrity Tech-operated botnet and sanctions imposed by the UK and European Union against the company.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.

Researchers at Romania-based Bitdefender discovered malware preinstalled on thousands of inexpensive Android phones sold globally. The malicious software, named Midnight Mimosa, targets devices using MediaTek chips and cannot be removed by users. The malware operates with system-level privileges, allowing it to silently install applications, modify permissions, and execute code without approval. Over approximately two years, the campaign affected thousands of devices across more than 150 countries, with Mexico, France, and Italy experiencing the highest concentrations of infected phones.

The malware primarily generates revenue through advertising and click fraud schemes. It secretly installs disguised applications that display ads in invisible windows, creating fake impressions users never see. Researchers identified at least 32 such applications deployed by the preinstalled malware and discovered 13 additional malicious apps on Google Play Store using similar code. The affected phones are typically low-cost, white-label, or counterfeit devices resembling popular brands, sold through mainstream online marketplaces for approximately $180. Bitdefender could not determine who introduced the malware into the supply chain.

Source: Read the full story at The Record

This summary was written with AI assistance from the linked source.

The FakeGit malware campaign has resumed operations with over 17,000 malicious repositories on GitHub, distributing SmartLoader malware that can deploy additional threats. Researchers from Apiiro discovered the campaign reactivated on October 4, adding more than 13,000 repositories in just 34 hours. The attack uses convincing README files with download buttons linking to infected ZIP files. While most accounts involved are disposable, at least 700 accounts belonging to legitimate developers have been compromised and repurposed for the campaign.

Security experts attribute the campaign’s persistence to limitations in removal efforts and the attackers’ ability to redirect downloads while keeping repositories active. Malicious files are distributed across multiple locations including repository forks, release assets, and issue attachments, making deletion ineffective. Researchers recommend users verify repository ownership before downloading, use official registries for AI tools, and treat any SmartLoader execution as a potential account compromise requiring immediate session revocation and token resets.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.

The first day of the Pwn2Own Ireland 2026 hacking competition saw security researchers exploit 32 zero-day vulnerabilities across various devices. Multiple teams successfully compromised the Samsung Galaxy S26 smartphone, with three different groups earning a combined $388,500 for their efforts. The competition featured seven categories of targets, including mobile phones, printers, smart home devices, messaging apps, and AI-related systems. Some of the vulnerabilities discovered had already been known to manufacturers beforehand.

Leading the leaderboard, researchers from VinSOC won $80,000 by chaining multiple zero-day exploits to compromise a Philips Hue Bridge Pro smart lighting hub and an Oracle Autonomous AI Database. Additional achievements included hacking printers from Lexmark and Canon, exploiting vulnerabilities in smart speakers and AI coding agents, and compromising various smart home devices. One team attempted to hack the Google Pixel 10 but ran out of time before completing their exploit. The Zero Day Initiative organizes the competition to identify security flaws before malicious actors can use them, with vendors receiving 90 days to patch vulnerabilities before public disclosure.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.

The FBI and Secret Service have issued a warning about FortiBleed, an ongoing campaign targeting over 86,000 internet-facing Fortinet FortiGate firewalls and VPN gateways across 194 countries. The credential-stealing attacks exploit reused or leaked credentials to harvest and crack authentication data at scale. Attackers continue to scan exposed Fortinet devices, potentially locking organizations out of their systems by disabling accounts or changing passwords. The FortiBleed campaign has also served as an initial entry point for ransomware affiliates associated with INC/Lynx and Payload ransomware.

Federal agencies discovered details about the operation after hackers exposed their own backend server, revealing their internal workflow and methods. The attackers scanned the internet for exposed FortiGate portals, used automated scripts to identify devices, and collected credentials through credential stuffing and password spraying. Stolen credentials were then validated, organized by victim organization characteristics, and either sold to others or used directly for continued access. The FBI and Secret Service recommend organizations review all Fortinet accounts, restrict external device management, reset credentials, and terminate all admin VPN sessions.

Source: Read the full story at The Record

This summary was written with AI assistance from the linked source.

Microsoft will begin blocking .msix and .msixbundle file attachments in Outlook Web and the new Outlook Windows client starting in November. These file types are modern Windows installation packages used for specific computer configurations, with .msixbundle serving as a container for multiple packages. The rollout will commence in early November for Exchange Online users, with full availability expected by mid-November. Once implemented, users will be unable to send, receive, open, or download these attachment types.

The security measure is part of Microsoft’s broader initiative to disable features that attackers have exploited in recent years. Most organizations are expected to be unaffected since these file types are rarely used. However, administrators can whitelist the attachments if necessary through their organization’s OwaMailboxPolicy settings. This update follows previous Outlook security enhancements, including the blocking of .library-ms and .search-ms files in June and restrictions on inline SVG images in October.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.

Zohar Pinhasi, owner of ransomware recovery company MonsterCloud, has been charged with defrauding victims by secretly paying ransomware operators for decryption keys while falsely claiming to use proprietary technology. The 50-year-old was indicted in September and arraigned in Brooklyn federal court on charges including wire fraud conspiracy. Prosecutors allege the scheme operated from June 2018 to June 2023, with Pinhasi and associates facilitating over $8 million in ransom payments while charging victims more than $19 million for recovery services.

According to the indictment, MonsterCloud advertised decryption methods that did not involve paying cybercriminals, though some contracts acknowledged potential communication with attackers. Prosecutors claim contacting ransomware operators was typically the company’s first approach rather than a last resort. In specific cases cited, Pinhasi allegedly paid approximately $8,200 to a ransomware gang while charging the victim $150,000, and paid about $236,000 while charging another customer $380,000. If convicted, Pinhasi faces up to 20 years in prison. He was released on a $2 million bond after pleading not guilty.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.

Attackers compromised three country-code internet registries and obtained unauthorized security certificates for Google and YouTube domains, Google announced in early October. The hijacked registries were for Ghana, Sierra Leone, and American Samoa. Although Google’s systems were not breached, the unauthorized certificates could have allowed attackers to impersonate Google websites and intercept encrypted user communications. Google blocked the certificates through its Chrome browser and worked with certificate authorities to revoke them across all platforms.

Public records show at least 12 certificates were issued between late September and early October for Google and YouTube domains under the three country registries. Most were issued by Let’s Encrypt, with one from ZeroSSL. The attackers obtained these certificates by manipulating domain name system records during the registry hijacks. Google stated that certificate authorities followed proper procedures and bore no responsibility for the breach. The company also noted that other major organizations were likely targeted in similar attacks but declined to name them.

Source: Read the full story at The Hacker News

This summary was written with AI assistance from the linked source.