Hacking News

Microsoft Security Copilot discovered 20 previously unknown zero-day vulnerabilities in the open-source bootloaders GRUB2 and U-Boot — the software that runs before your operating system even loads. HN59 covers that plus CoffeeLoader, a next-generation malware loader evolving from SmokeLoader with evasion tricks researchers had not documented before.

Stories Covered

Microsoft AI Finds 20 Zero-Days in GRUB2, U-Boot, and Bare Box

Microsoft used its AI-powered Security Copilot to discover 20 previously unknown vulnerabilities across GRUB2 (the default Linux bootloader used by Ubuntu and most major distros), U-Boot, and Bare Box (used in embedded and IoT devices). The flaws include integer and buffer overflows in filesystem parsers, command handling issues, and a side channel in cryptographic comparison code.

Why does this matter? If an attacker can compromise the bootloader, they get in before the operating system even initializes — before your antivirus, your EDR, your anything. Bootkit and rootkit infections at this level are essentially unremovable through software alone; the firmware needs to be reflashed. The GRUB2 flaws are especially significant because they could enable bypassing UEFI Secure Boot and installing stealthy bootkits that persist across OS reinstalls. Microsoft notes that AI not only found the flaws but also generated targeted mitigation recommendations — meaningful help for open-source projects run by volunteer contributors with limited patch bandwidth.

CoffeeLoader: Next-Generation Malware Evasion

Since last fall, the well-known SmokeLoader backdoor has been shipping with a new second-stage payload dropper called CoffeeLoader — built specifically to defeat modern endpoint security, digital forensics tools, and behavioral analysis. CoffeeLoader is a loader (software that loads other malware in, like infostealers or RATs) but with evasion techniques researchers documented as genuinely novel. It borrows techniques from multiple existing malware families and combines them in ways that make signature detection and sandbox analysis significantly less effective. This is the kind of tooling that signals a new baseline for what commodity malware can do.

Listen to the Episode

A new ClickFix phishing campaign is abusing Microsoft SharePoint to deliver the Havoc post-exploitation framework — hiding command-and-control traffic inside legitimate cloud API calls so it blends with normal corporate traffic. HN58 also covers the UAE financial sector’s ransomware surge, where 19 threat groups are actively targeting banks and the exposed attack surface jumped from 155,000 to 223,000 vulnerable assets in one year.

Stories Covered

ClickFix Phishing Deploys Havoc C2 Through SharePoint

Fortinet FortiGuard Labs documented a phishing campaign that sends emails with an attached HTML file posing as a restricted notice. When the victim opens it, the page displays a fake OneDrive DNS error and prompts them to “fix it manually” by clicking a button — which silently copies a malicious PowerShell command to their clipboard. The victim is then instructed to paste it into a command prompt, triggering a multi-stage infection chain.

The script first runs an anti-sandbox check: it queries how many computers are joined to the Windows domain and exits if the count is too low (indicating a researcher’s isolated VM rather than a real corporate network). If the check passes, it writes a registry key for persistence, installs Python if not already present, downloads a Python script from SharePoint, and uses that script to deploy the Havoc command-and-control framework.

The stealth angle is the most interesting part: Havoc is configured to communicate exclusively through Microsoft’s Graph API — specifically the SharePoint file APIs — so all C2 traffic looks like ordinary SharePoint uploads and downloads. In an environment that already uses SharePoint heavily, this traffic is functionally invisible without deep behavioral analysis. Havoc itself is open-source (similar in purpose to Cobalt Strike) and available on GitHub, meaning attackers do not need to build their own tooling.

ClickFix works precisely because it exploits human instinct: if a website tells a non-technical user there’s a DNS error and they need to paste something to fix it, many will comply. The defense is user education — any instruction to paste a command into a terminal, from any source, should be treated as suspicious and escalated rather than executed.

UAE Financial Sector: 19 Ransomware Groups, 223,000 Exposed Assets

Following their annual Cyber Wargaming 2025 exercise, UAE banking officials released a threat picture that is sharply worse than 2023. The number of ransomware groups actively targeting UAE organizations grew from 12 to 19, with RansomHub and LockBit most active. The financial sector accounts for 21% of all cybersecurity incidents in the region — second only to government systems — and the total exposed attack surface grew from 155,000 to 223,000 vulnerable assets in a single year.

A third of exposed systems were still running with a year-old OpenSSH vulnerability (CVE-2023-38408) at the time of assessment. Known CVEs with published proof-of-concept exploits are low-effort targets: anyone with basic scripting knowledge can automate scans against them using tools like Shodan. An unpatched device in the corner of the network is an open door regardless of how hardened everything else is — once inside, lateral movement and traffic blending (as the SharePoint campaign above demonstrates) can make detection very difficult.

The UAE has pledged $2 billion toward cybersecurity and digital transformation. Tabletop exercises and wargaming are the right instinct — you cannot know where you are actually vulnerable until someone qualified tries to break in. The alternative, security through obscurity, consistently fails.

Listen to the Episode

An Android app called Finance Simplified reached 100,000 downloads on Google Play while secretly operating as a predatory loan shark — harvesting contacts, location data every 3 seconds, SMS messages, and clipboard contents, then using that data to harass and blackmail victims who could not repay. HN57 also covers two patched Xerox printer vulnerabilities that let an attacker on your network harvest Windows Active Directory credentials through an LDAP and SMB passback attack.

Stories Covered

SpyLoan: Predatory Android Malware Bypasses Google Play

CyFirma researchers identified Finance Simplified as part of the SpyLoan malware family — apps that masquerade as financial tools or loan services but exist to harvest personal data for use in predatory lending schemes. The app was live on Google Play and accumulated over 100,000 downloads before removal. Additional variants (Credit Apple, Pocket Me, Stashfur) were found as loose APKs in the same campaign.

The deception is layered. The initial Play Store app loads a WebView that redirects users to an external EC2-hosted server, which serves different content depending on geolocation: users in India receive a list of predatory loan applications; users outside India get a benign calculator. This mirrors the anti-sandbox technique seen in traditional malware — behave innocuously when you suspect you are being analyzed, go malicious otherwise. Once a loan APK is installed, it requests broad permissions and begins exfiltrating: contacts, call logs, SMS messages, photos, documents, device location every three seconds, last 20 clipboard entries, and banking SMS transaction messages.

The extortion follows: victims who cannot meet repayment terms are threatened with edited photos or exposure of their personal data. The review trail documented users reporting exactly this — low loan amounts, extreme interest rates, and blackmail threats. The data exfiltrated is almost certainly also sold or leaked; anything harvested at this scale finds its way to other criminal pipelines eventually.

Removing the app from the Play Store does not remove it from infected devices. If you or someone you know installed a suspicious loan or financial app, uninstall it, revoke permissions for any apps you did not explicitly authorize, change passwords, and factory reset if you suspect ongoing access. The Play Store is a better baseline than third-party APK stores, but it is not a guarantee — this campaign cleared their review process at scale.

Xerox VersaLink Printers: LDAP and SMB Passback Credential Theft

Rapid7 discovered two vulnerabilities in the Xerox VersaLink C7025 multifunction printer — both now patched — that allow an attacker with network access to the printer’s admin interface to redirect its LDAP and SMB authentication requests to an attacker-controlled server, capturing Windows Active Directory credentials in cleartext.

CVE-2024-12510 (CVSS 6.7) affects the LDAP configuration: an attacker can change the LDAP server IP in the printer settings to point at their own server. When the printer next authenticates a user, it sends the credentials to the malicious server instead. CVE-2024-12511 (CVSS 7.6) works the same way against SMB and FTP scan functions. Neither vulnerability allows initial access to a system from the outside — they are lateral movement and privilege escalation tools for an attacker already on the network.

Printers are notoriously under-patched: they sit on the network indefinitely, are owned by no specific team, and are rebooted only when they stop printing. The patch for these is available. If your environment runs Xerox VersaLink hardware with LDAP or SMB scan integration configured, this is a straightforward apply-the-update situation — the window between patch release and patch deployment is exactly when these vulnerabilities get exploited.

Listen to the Episode

A critical remote code execution bug in Microsoft Outlook — CVE-2024-21413, dubbed “Moniker Link” — is actively being exploited in the wild, bypassing Outlook’s protected-view restrictions through a file:// URI trick to steal NTLM credentials and execute arbitrary code. HN56 also covers Kimsuky, the North Korean APT, swapping their noisy PebbleDash backdoor for a custom RDP wrapper and proxy tools that blend into legitimate remote desktop traffic to stay hidden longer.

Stories Covered

CVE-2024-21413: Outlook Moniker Link RCE Actively Exploited

Discovered by Check Point and tracked as CVE-2024-21413, the Moniker Link vulnerability exploits improper input validation in Microsoft Outlook. When a victim previews or opens an email containing a specially crafted file:// URL with an exclamation mark appended to the path, Outlook bypasses its own Protected View restrictions and attempts to resolve the link against an attacker-controlled server. In doing so, it sends the victim’s NTLM authentication credentials in cleartext — and, under the right conditions, executes arbitrary code. CISA added it to the Known Exploited Vulnerabilities catalog and directed federal agencies to patch by February 27th.

The patch was issued a year ago. The reason it is still a live threat is the gap between patch release and actual deployment — organizations running Office LTSC 2021, Microsoft 365 Apps for Enterprise, Outlook 2016, or Office 2019 who have not applied updates remain exposed. The preview pane is an attack vector, meaning a user does not need to open the attachment at all. If you are running any of those product versions, this is a patch-now situation. If someone in your network received a suspicious Office email from an external sender, check their NTLM auth logs.

Kimsuky Swaps PebbleDash for Custom RDP Wrapper and Proxy Tools

AhnLab Security Intelligence Center (ASEC) documented a shift in Kimsuky tactics: the North Korean APT is replacing reliance on their known PebbleDash backdoor — which generates detectable network noise — with a modified version of the open-source RDP Wrapper tool. RDP Wrapper is a legitimate utility that enables Remote Desktop Protocol on Windows Home editions that do not ship with it. Kimsuky’s modified build alters export functions to evade antivirus signature detection while maintaining the same capability: a persistent, GUI-based remote session into the compromised host.

The infection chain starts with a spear phishing email that includes the target’s name and company — indicating prior reconnaissance — with a malicious LNK file disguised as a PDF or Word document. Opening it triggers PowerShell or MSHTA to pull down multiple payloads: PebbleDash for initial access, the custom RDP wrapper for persistent remote control, proxy tools to punch through NAT and firewall restrictions, a keylogger writing captures to local text files, an info stealer called ForcesCopy that extracts browser-saved credentials, and a PowerShell-based reflective loader that executes payloads entirely in memory — leaving no artifacts on disk for forensic recovery.

The strategic logic is clear: RDP traffic is ubiquitous in enterprise environments. An attacker who can make their remote sessions look like legitimate IT activity can dwell for months or years without triggering alerts. The reflective in-memory loader compounds this by preventing disk forensics from finding evidence of secondary payloads. Kimsuky is investing in long-term access quality over speed — the implication is that breaches from this campaign may sit undiscovered until something breaks operational security on their end.

Listen to the Episode

A Russian cybercrime group exploited CVE-2025-0411 in 7-Zip — a zero-day at the time — to bypass Windows’ Mark of the Web protections by nesting archives inside archives, slipping SmokeLoader past Windows security prompts and into Ukrainian government systems. HN55 also covers a malicious Go package that typosquatted the legitimate BoltDB library, exploited Go’s indefinite module mirror cache to stay alive for years, and granted remote access to any developer who installed it.

Stories Covered

7-Zip Double-Archive Attack Bypasses Windows Mark of the Web

CVE-2025-0411 (CVSS 7.0) exploits a flaw in 7-Zip versions prior to 24.09: when a file is double-archived — zipped inside a zip — 7-Zip failed to propagate the Mark of the Web (MOTW) flag to the inner archive’s contents. MOTW is the Windows mechanism that marks files downloaded from the internet and triggers the “this file came from the web, do you want to run it?” warning. Without that flag, the extracted payload runs without the usual security prompt.

The attack chain starts with a spear phishing email sent from compromised Ukrainian government or business accounts — lending it false legitimacy. The email contains a specially crafted archive that uses a homoglyph attack to make the inner zip look like a Word document. When extracted, an internet shortcut (.url) file inside reaches out to an attacker-controlled server and downloads a second archive. That second archive contains SmokeLoader, disguised as a PDF, but without a MOTW flag — so Windows executes it without warning. SmokeLoader then pulls in whatever secondary payload the operator has staged.

The fix has been available since November 2024 in version 24.09. If you have 7-Zip installed, this is the update prompt. The broader lesson: MOTW is a useful friction point but not a guarantee — any file you download, regardless of whether Windows flags it, should be treated as untrusted until you know what it is.

Malicious Go Package Abuses Module Mirror Cache for Persistent Backdoor

Researchers at Socket identified a malicious Go package — github.com/boltdb-go/bolt — as a typosquat of the legitimate github.com/boltdb/bolt BoltDB database library. Version 1.3.1 was published to GitHub in November 2021 and almost immediately cached by the Go module mirror service, which stores packages indefinitely. Once cached, even if the source repository is cleaned up or modified, the mirror keeps serving the original malicious version to anyone who runs go get.

That is exactly what happened: the attacker later modified the GitHub repository’s git tags to point back to a clean version — so any manual audit of the GitHub source would show nothing suspicious. But the Go module mirror was still serving the backdoored 1.3.1 indefinitely. Any developer who installed the package from the cache got a remote access backdoor that phones home and accepts arbitrary commands, while the GitHub repo appeared completely benign.

This is one of the earliest documented cases of deliberately exploiting Go’s indefinite caching behavior as an attack vector. The same class of risk exists in other ecosystems (NuGet’s caching has similar properties; npm is more aggressive about invalidation). The defense is developer-side: vet package names carefully, check download counts and repository age, use a software bill of materials, and consider tools that scan your dependency tree against known typosquats. No ecosystem is immune to supply chain attacks, and the cache amplifies any initial compromise by making it persist long after the source is cleaned up.

Listen to the Episode

Security researchers exposed Phantom Circuit — the hidden administrative layer Lazarus Group uses to centrally manage its C2 servers from Pyongyang, routed through a freight company’s proxy network in Russia to obscure attribution. The same infrastructure connects to Operation 99, a campaign targeting Web3 and crypto developers with malicious GitHub repositories that backdoor corporate environments. HN54 also covers Android 16’s Advanced Protection Mode: blocking sideloading, dropping 2G, and adding memory safety extensions.

Stories Covered

Lazarus Group Phantom Circuit: The Admin Layer Behind Their C2 Empire

SecurityScorecard researchers, while following up on Operation 99, discovered a previously unknown administrative layer Lazarus Group uses to manage its command-and-control infrastructure — dubbed Phantom Circuit. The setup routes all operator connections through AstroVPNs to an intermediate proxy network registered under a freight company in Hassan, Russia, before reaching the actual C2 servers (hosted on infrastructure registered to a likely fictional “Stark Industries LLC”). The layering is designed to make attribution point to Russian threat actors rather than Pyongyang.

Operation 99, the campaign Phantom Circuit supports, targets software developers looking for freelance Web3 and cryptocurrency work. Victims are directed — via fake job lures — to clone GitHub repositories that appear legitimate but contain backdoors and obfuscated Python scripts that phone home to Lazarus C2 servers. The malware then exfiltrates development secrets, cryptocurrency wallet data, and environment configuration. More than 230 victims downloaded the malicious payloads across the campaign, with Italy accounting for the highest victim count in disclosed data.

The concern here goes beyond cryptocurrency theft. Lazarus has been inserting backdoors into legitimate authentication apps and crypto software to get developers to run them in corporate environments. Developers with broad access — to source code, infrastructure configs, internal APIs — represent high-value pivot points for supply chain attacks. An infection at the developer level can compromise everything downstream. The same Phantom Circuit proxy network was also used in Lazarus’s IT worker impersonation campaign, confirming shared infrastructure across multiple concurrent operations.

Android 16 Advanced Protection Mode: Sideloading Blocked, 2G Cut Off

Android 16 extends Google’s Advanced Protection Program with device-level enforcement. When enabled, the mode greys out “allow from this source” install options system-wide — no app, not even a privileged system process, can sideload an APK. This closes the same vector SpyLoan and similar campaigns have exploited: users tricked into installing malicious APKs from outside the Play Store.

Advanced Protection Mode also disables 2G connectivity. Most major markets have sunset 2G, but most Android devices still support it as a fallback — and fake cell towers (IMSI catchers / “stingrays”) can force devices down to 2G, where traffic is unencrypted and interceptable. Blocking it at the OS level closes that downgrade attack. Android 16 also adds Memory Tagging Extension (MTE) support, a hardware-assisted mechanism for detecting memory safety bugs — addressing one of the most common vulnerability classes in Android’s native code.

A new API lets apps check enrollment status and apply additional hardening when a user is in Advanced Protection — useful for security-conscious enterprise apps and IT MDM setups. The feature was found in Android 16 beta and has not been formally announced by Google, so final availability is not guaranteed, but the components are present and functional.

Listen to the Episode