Latest Cyber-Attack News

Citrus Ransomware Spreads Through Fake Security Deployment Citrus ransomware operators entered corporate networks with stolen contractor credentials, then disguised the rollout of their encryptor as a security-software deployment. A November 11 investigation by Kaspersky describes how a low-privilege remote login could become a domain-wide attack—and why some of the most important servers were deliberately spared. The newly published analysis concerns incidents… https://blog.gridinsoft.com/citrus-ransomware-contractor-fake-security-deployment/

Chrome Fixes Exploited XML Flaw: Relaunch to Apply the Update Google has released a Chrome update for an XML flaw that already has an exploit in the wild. The fix is in the November 9 desktop release, with a corresponding Android update and a separate Extended Stable build. If Chrome has been sitting open for days, check its version and relaunch it: a downloaded… https://blog.gridinsoft.com/chrome-xml-zero-day-125350-relaunch-update/

Miasma Worm Turns AI Coding-Agent Setup Into a Trap A Miasma-family worm is using the files that tell AI coding assistants how to work as a route into developers’ machines. In a November 9 update, SafeDep reported forged commits in 12 GitHub repositories containing a malicious scripts/setup.js, instructions discouraging its inspection, and agent or editor configurations that launch it. A routine… https://blog.gridinsoft.com/miasma-ai-coding-agent-setup-trap/

SEGA Newsletter Breach Exposes 2.2 Million Email Addresses SEGA says a breach at its email provider, ARARA, exposed 2,196,044 addresses used for 11 SEGA and SEGA Fave mailings. The company’s November 9 disclosure covers messages sent from July 2 to October 28, including Lucky Kuji lottery announcements and Tokyo Game Show updates. SEGA Account mailing addresses were held in a separate system… https://blog.gridinsoft.com/sega-arara-newsletter-data-breach/

Swarm Desktop and bee-js Updates Targeted Wallet Keys On November 9, Swarm’s own release pipeline shipped two malicious updates: the npm package @ethersphere/bee-js 13.3.0 and Swarm Desktop 0.56.2. The desktop build could reach Windows x64 PCs and Apple Silicon Macs through the app’s updater. It looked like an emergency patch, but its code could send a Bee node’s wallet file and… https://blog.gridinsoft.com/swarm-desktop-bee-js-malware-wallet-keys/

Chainalysis Restores Reactor and KYT After Token Exposure Chainalysis brought Reactor, the KYT web interface and API, and Address Screening back online on November 7. Customers were told to follow new reconnection instructions. Earlier that week, the blockchain analytics company had disclosed that an attacker had obtained names, usernames, password hashes and live tokens for all Chainalysis users. The November 4 disclosure… https://blog.gridinsoft.com/chainalysis-restores-kyt-reactor-token-breach/

Ukraine Sends UAH 700,000 Telegram Dating-Bot Fraud Case to Court A conversation that began in a Telegram dating bot turned into a request for access to an Odesa student’s bank account. On November 6, Ukraine’s Cyber Police said the case had been sent to court. Investigators allege that a man from Kyiv obtained her card details and online banking credentials, then moved or withdrew… https://blog.gridinsoft.com/telegram-dating-bot-bank-login-fraud-ukraine/

How Ransomware Reached ESXi and Proxmox With Stolen Root Credentials The first attempt to run a ransomware binary on an ESXi host failed. The host recognized that the file was not installed through its approved software path and stopped it. The attacker was already logged in as root. They turned off the execution restriction and ran the file again. That sequence appears… https://blog.gridinsoft.com/esxi-proxmox-ransomware-root-access/

AI CEO Impersonation Alleged in $129M Wire Fraud Case The executive on the call said a deal had to stay confidential and sent the employee to a lawyer for the payment instructions. According to a U.S. federal indictment unsealed on November 5, the people behind both conversations were part of the same alleged fraud. Prosecutors say the scheme used AI to imitate company… https://blog.gridinsoft.com/ai-ceo-impersonation-wire-fraud/

Operation Trade: Fake Brokers Cost 135 German Victims €4.3M Fake brokers in Ukraine talked people through buying cryptocurrency on exchanges, then guided them to transfer it to accounts the brokers controlled, Ukrainian police say. In a November 6 disclosure on Operation Trade, investigators said they had identified 135 German victims who lost more than €4.3 million. The broker stayed on the line through… https://blog.gridinsoft.com/operation-trade-fake-broker-crypto-scam/

ChatGPT Lockdown Mode Bypass Through HTML Previews Was Fixed OpenAI closed a route around ChatGPT Lockdown Mode on September 18, according to research Check Point published on November 5. An HTML preview could open a window outside its sandbox, even with the mode enabled. In the older ChatGPT Classic desktop app, researchers used that window to send messages from a test chat to… https://blog.gridinsoft.com/chatgpt-lockdown-mode-html-preview-bypass/

NIKKE Launcher Cleanup Can Erase Compromise Evidence A NIKKE launcher update can remove malware traces that players need to understand whether their PC was exposed. In a November 5 update to an independent investigation, researcher MotherSphere warned that the client’s new cleanup checks can delete logs and other artifacts. Players should preserve evidence before reopening the launcher or clearing its cache.… https://blog.gridinsoft.com/nikke-launcher-cleanup-compromise-evidence/

Microsoft: Email Exceptions Let Detected Spoofing Through Microsoft found a failure that better phishing detection alone cannot fix: malicious messages were identified, failed sender-authentication checks, and still got through because a business or user had configured an exception. Its November 5 report on July–September 2026 email threats puts the focus on the rules that can overrule a security verdict. A familiar… https://blog.gridinsoft.com/microsoft-email-exceptions-detected-spoofing/

ARTEX AI Agents Steal App-Signing Certificates An operator sent AI agents after app-signing certificates, then spent much of the next two weeks asking how the work was going. The agents broke into gray-market signing shops and collected more than 300 certificates with their passwords. Only three survived their own usability checks. That narrow result, described in Check Point Research’s November… https://blog.gridinsoft.com/artex-ai-agents-app-signing-certificate-theft/

Haiou Turns a Codex Greeting Into a Gateway Ad A simple “hi” made an AI coding assistant advertise an unrelated API gateway. Check Point Research traced that response to Haiou 4.5.0, a downloadable jailbreak bundle that changes the instructions the assistant treats as trusted. Its November 3 investigation describes persistent advertising in the Codex package—not a demonstrated theft of credentials by the advertised… https://blog.gridinsoft.com/haiou-codex-greeting-prompt-adware/

Sogou Icon Request Hijacked to Deliver DarkVigil A request for a tiny dictionary icon became a route into Windows computers. ESET’s November 4 investigation says the SlippyNunchucks espionage group redirected Sogou Input Method traffic and used the response to deliver the DarkVigil implant. The affected Windows software needs version 16.10 or later; an update alone does not establish that a previously… https://blog.gridinsoft.com/sogou-icon-request-darkvigil-dns-hijack/

mSecure Security Notice: What to Change First After mSecure’s November 3 security notice, protect the accounts whose credentials you stored in the app, starting with your main email and financial accounts. Change those credentials through each service’s own website or app. Changing only the mSecure account password does not change the passwords saved inside it. Keep a working sign-in method while… https://trojan-killer.net/msecure-security-notice-credentials-check/

PapRAT Campaign Hides Access Behind a File-Open Error A Windows invitation can appear to fail while leaving an attacker a way back in. In research published on November 2, FortiGuard Labs described a BITTER-linked campaign in which a file-open error concealed scripts and scheduled tasks. Two other delivery chains installed PapRAT, a remote-access trojan. The report concerns targeted activity in South Asia,… https://blog.gridinsoft.com/paprat-bitter-file-open-error/

XCPE Backdoor Came Built Into 1.3 Million TV Boxes A TV box could keep streaming normally while selling access to the network behind it. Google says the XCPE backdoor came built into the firmware of more than 1.3 million set-top boxes, allowing operators to install other companies’ malware and turn household devices into proxy exits and advertising-fraud workers. In its November 2 investigation,… https://blog.gridinsoft.com/xcpe-android-tv-firmware-backdoor/

Fake Installers Turn Windows PCs into Proxies and Compute Workers One fake installer can sell more than a copy of a program: it can turn a Windows PC into a proxy for other people’s traffic or a worker for distributed computing. A November 3 investigation by Microsoft traces both outcomes through downloads posing as cracked Navicat Premium, FabFilter bundles, games and utilities. Its most… https://blog.gridinsoft.com/fake-installers-worldproxypool-boinc/