Podcasts

Reason Labs uncovered a polymorphic malware campaign that has infected at least 300,000 Chrome and Edge users through fake download sites mimicking Roblox, YouTube, VLC, and KeePass. The trojans install browser extensions that steal search queries, cannot be removed even in developer mode, and modify the Windows registry to mark the browser as “managed by organization” — locking users out of their own browser settings.

Stories Covered

Extension Trojan Campaign: 300K Users Hit via Fake Download Sites, Fileless PowerShell Delivery

The campaign, active since 2021 and documented by Reason Labs in August 2024, exploits the trust users place in browser extension ecosystems. Victims are lured via ads pointing to look-alike download sites for popular software — Roblox FPS Unlocker, YouTube downloaders, VLC, KeePass. The downloaded executable doesn’t install the expected software. Instead, it registers a scheduled task (Windows equivalent of a cron job) running a PowerShell script named to blend with system processes — patterns like Updater_PrivacyBlocker_PR1 or Microsoft_Windows_Optimizer_Update_Task — which then contacts a remote C2 server to download the second-stage payload directly into memory. Writing nothing to disk at the payload stage is deliberate: in-memory execution leaves no file artifact for antivirus to scan or forensic analysts to extract. At time of writing, Reason Labs reported that almost no AV engines were flagging the C2 domain or the installer. The installers are signed by “Tommy Tech Ltd” — a certificate used across campaign variants going back to 2021.

The extension behavior once installed is the technically interesting part. The malware modifies the browser’s registry entries to declare the machine “managed by an organization,” a legitimately intended enterprise control mechanism that overrides the user’s ability to remove or disable extensions through the normal browser UI — even with developer mode enabled. Search queries are hijacked and routed through attacker-controlled infrastructure. Newer campaign variants also tamper with browser LNK shortcut files to load local extensions and disable automatic browser updates — preventing the browser from patching vulnerabilities the attacker may want to preserve access through. The C2 architecture handles staged execution: the scheduled task runs a short PowerShell script, that script fetches a second-stage script from C2 to memory, which then handles the browser modification. This multi-hop, in-memory architecture makes the campaign resistant to both detection and analysis.

The user-facing symptom is an extension that reappears after every attempt to remove it — reviews on the Chrome Web Store extension pages were filled with complaints from users who had tried and failed to delete it. The core defense is straightforward: only install software from official sources (the Chrome Web Store, Microsoft Edge Add-ons, or software vendor’s official site). Executable downloads from third-party sites — especially ones linked from ads — should be treated with extreme skepticism. The scheduled task persistence mechanism means that even successfully removing the extension leaves a recurring trigger behind; full remediation requires identifying and deleting the scheduled task and its associated PowerShell script from C:\Windows\System32 and the NV Optimizer Log folder. Reason Labs alerted Google and Microsoft, who began taking action, but the underlying distribution vector — fake download sites — remains active.

Listen to the Episode

Hunters International — a Russian-linked ransomware group that acquired the Hive ransomware after its operators were shut down by law enforcement — is deploying SharpRHino, a RAT disguised as the legitimate Angry IP Scanner network admin tool. The attack targets IT professionals specifically, betting that administrators install software with elevated privileges and are more likely to have access to high-value systems worth ransoming.

Stories Covered

SharpRHino RAT: Hunters International Tricks IT Admins with Fake Network Scanner

Hunters International emerged after international law enforcement took down the original Hive ransomware operation. The group acquired Hive’s codebase and rapidly scaled — claiming 134 attacks in the first seven months of 2024 and reaching the top 10 most active ransomware groups. SharpRHino is their initial access tool: a RAT built to look like Angry IP Scanner, an open-source network administration utility commonly used by IT professionals. Distribution is via typosquatting domains that closely mimic the legitimate Angry IP Scanner download site. Because Angry IP Scanner is open source, attackers can sign their malicious installer with a “valid” certificate (attributed to “J. Golden’s Drive Trading Co. Ltd.”) paired with a domain name close enough to the real one that a hurried admin won’t notice. The downloaded executable is an NSIS-packed installer that bypasses suspicion by appearing to be standard installation software.

Once executed, SharpRHino establishes persistence by modifying the Windows registry Run key and creating two directories under C:\ProgramData\Microsoft\ — named “Windows Updater 24” and “Log Update Windows” — to blend into existing Microsoft infrastructure and maintain multiple fallback channels to the Hunters International C2 server. The persistence mechanism is designed to survive removal attempts: even if security tools delete one component, registry keys and scripts can rebuild the necessary foothold. Quorum Cyber researchers who analyzed the campaign note that complete remediation may require a full system reimaging rather than targeted file deletion. Once SharpRHino is established, the group follows a standard double-extortion ransomware playbook: exfiltrate data first, then encrypt files with the .locked extension and direct victims to a Tor payment portal. The encryption layer is implemented in Rust — a language increasingly favored by cybercriminal developers for its resistance to reverse engineering and memory safety properties that reduce detectable vulnerabilities in the malware itself.

The IT professional targeting is strategically sound. Standard phishing targets general users who may or may not have access to sensitive systems. IT admins routinely install software, often under elevated or administrative accounts, and their access frequently spans the network — giving a successful infection broad lateral movement potential from the first moment of compromise. The typosquatting + code signing combination lowers the bar for a technically informed target: the download looks like the right domain, the installer is signed, and the tool performs its advertised function. Quorum Cyber has published MITRE ATT&CK mappings for the campaign covering defense evasion, discovery, privilege escalation, execution, persistence, and C2 stages — useful reference material for defenders building detection rules.

Listen to the Episode

Pakistani state-sponsored hackers (Transparent Tribe / APT36) are targeting TikTokers and gamers with CapraRAT spyware hidden in four fake Android apps. Meanwhile, researchers at Drexel University developed MISLNet — an AI deepfake detector that identifies AI-generated video with 98.3% accuracy, outperforming every other tool currently available.

Stories Covered

CapraRAT Android Spyware: Pakistani APT36 Targets TikTokers and Gamers with Fake Apps

Sentinel Labs researchers identified four malicious Android apps distributing CapraRAT — an Android Remote Access Trojan attributed to Transparent Tribe (also tracked as APT36 and Operation C Major), a Pakistani state-linked threat actor active since 2016 with a history of targeting Indian victims. The four apps — a fake CrazyGames clone (com.maeps.crygms.tktols), a “Sexy Videos” app, a TikTok-branded downloader, and a clone of the “Forgotten Weapons” YouTube channel — were designed to attract downloads through recognizable brand names or exploitative content. Once installed, the apps request an extensive permission set: SMS access, contact lists, GPS location, storage read/write, camera, audio recording, screen recording, call history, call-making, and network state management. A video-viewing or gaming app has no legitimate use case for the majority of these permissions, but the social engineering vector (a game, a video app) reduces user scrutiny.

The updated campaign incorporates a WebView feature — an in-app browser component — to load legitimate-looking content and reduce immediate suspicion. For the TikTok clone, the app likely loads YouTube content in a WebView to simulate a functional experience while the spyware payload runs in the background harvesting the permitted data. CapraRAT has been in use by Transparent Tribe since at least 2021 in various forms; the 2024 variant reflects an ongoing evolution of the malware rather than a new actor. The defense against sideloaded or Play Store-mimicking spyware is consistent: only install apps from official stores (Google Play), scrutinize permission requests against what the app actually needs to function, and treat any app requesting call-making or SMS-access permissions that isn’t a communication tool as a red flag.

MISLNet: AI Deepfake Detector Hits 98.3% Accuracy by Analyzing Sub-Pixel Video Patterns

Researchers at Drexel University published results from MISLNet, a constrained neural network trained to detect AI-generated video by analyzing patterns at the sub-pixel level. Prior deepfake detection tools were trained on the artifacts left by video editing software — inconsistencies in pixel relationships between frames that arise from tools like Premiere or After Effects manipulating existing camera footage. AI-generated video (from tools like Sora or Luma) doesn’t pass through a camera or video editor, so it doesn’t carry those artifacts. MISLNet was trained to detect the different telltale signatures that generative AI leaves behind in how it constructs pixel relationships across frames. The result: 98.3% accuracy on AI-generated video, outperforming the next-best competing tool by approximately 5.3 percentage points. At scale — millions of videos on social platforms — a 5-point accuracy gap translates to tens of thousands of correctly classified videos that other tools miss. Overfitting was a concern during development; the 98.3% figure represents real-world test data, not training data performance.

Listen to the Episode

Two stories define this episode: the US sanctioned Russian hacktivists who breached water facility SCADA systems in Texas, and threat actors wasted no time exploiting the CrowdStrike outage chaos — using fake hotfix emails to drop Remcos RAT and a data wiper against Israeli companies while businesses scrambled to recover from the mass blue screen event.

Stories Covered

US Sanctions Russian Hacktivists Who Breached Texas Water Facility SCADA Systems

The US government sanctioned two members of the Cyber Army of Russia Reborn (CARR) following the group’s January 2024 claims of compromising SCADA (Supervisory Control and Data Acquisition) systems at a US energy firm and manipulating a water storage unit in Texas — with video proof posted publicly. SCADA systems are the industrial control infrastructure behind water treatment, power generation, and manufacturing — they manage sensors, motors, and actuators that control physical processes. Successful manipulation of water treatment SCADA could allow an attacker to alter chemical levels (fluoride, chlorine) or disable safety shutoffs. CARR did not cause major damage in these incidents, but demonstrated access sufficient to warrant Treasury action. Sanctions block US-based property and assets of the designated individuals and prohibit US persons from transacting with them — meaningful pressure even without extradition agreements, as they isolate sanctioned hackers from the US financial system and create legal risk for any international entities that work with them.

CrowdStrike Chaos: Threat Actors Drop Remcos RAT and Data Wiper Using Fake Fix Emails

When CrowdStrike’s July 19, 2024 sensor update triggered a logic error that caused blue screens across millions of Windows hosts worldwide — grounding flights, disrupting hospitals, and taking down banking systems — threat actors immediately launched phishing campaigns masquerading as official remediation. Two distinct campaigns were identified. The first impersonated BBVA bank’s intranet portal, distributing a fake CrowdStrike hotfix that delivered the HijackLoader, which then dropped the Remcos Remote Access Trojan onto affected systems. The second campaign was attributed to the pro-Iranian hacktivist group Handala: emails sent from crowdstrike.com.vc targeted Israeli companies with a PDF claiming to contain a recovery tool, which instead delivered a data wiper that destroyed files and reported activity over Telegram.

The pattern is consistent with how opportunistic threat actors operate during high-profile incidents — chaos reduces vigilance, urgency drives clicks, and the fake fix is exactly what affected users are desperately looking for. CrowdStrike and the UK National Cyber Security Centre both issued warnings during the incident urging victims to verify any communications through official channels only. The actual cause of the outage was a defective update to a CrowdStrike sensor file that modified a Windows host configuration and triggered a crash — a software bug, not a Microsoft vulnerability. The core lesson holds regardless: never run an executable obtained through an unsolicited email or unfamiliar download link, even when the situation feels urgent. Verified remediation instructions were available through CrowdStrike’s official channels throughout the event.

Listen to the Episode

Two stories this episode: London police arrested suspects running a fake cell tower to blast phishing SMS past carrier protections, and a deep look into Southeast Asian cyber scam slave camps — forced labor operations that have siphoned more than $64 billion in three years using trafficked workers running pig butchering and romance scams from guarded compounds.

Stories Covered

Fake Cell Tower Used to Blast Phishing SMS: London Makes First-of-Its-Kind Arrests

London Metropolitan Police arrested two individuals in connection with what law enforcement described as a first-of-its-kind crime: standing up a homemade cell phone tower to send thousands of malicious SMS messages impersonating banks and official organizations. Mobile carriers implement anti-phishing protections at the network infrastructure level — on their own towers and backend systems — but not on end-user devices themselves. A rogue tower broadcasting a stronger signal than the nearest legitimate cell tower will attract nearby phones, which automatically connect to the strongest available signal. Once phones are communicating with the fake tower instead of a legitimate one, the network-level protections the carrier implemented are bypassed entirely. The rogue tower can then deliver SMS messages that appear to come from trusted sources — banks, government agencies, any organization — with no way for the phone to verify the tower’s authenticity. Fake cell towers (sometimes called IMSI catchers or stingrays) are not a new concept, but their deployment for mass SMS phishing campaigns is an escalation of the attack surface beyond standard internet-based smishing.

Cyber Scam Slave Camps: $64B Operation Running on Trafficked Forced Labor in Southeast Asia

A Dark Reading investigation documented the scale of cyber scam operations running from compounds in Cambodia, Laos, and Myanmar — where Chinese criminal syndicates shifted from illicit gambling houses (closed by COVID border controls in 2020) to online fraud at massive scale. The estimated annual revenue from scam centers across Cambodia, Laos, Myanmar, Thailand, and Vietnam is approximately $44 billion — representing roughly 40% of the combined GDP of Cambodia, Laos, and Myanmar. Over three years, these operations siphoned an estimated $64+ billion globally through romance scams and pig butchering schemes targeting victims worldwide. The operations have a second category of victims: job seekers from China, India, the Philippines, and neighboring countries, lured with promises of legitimate employment and then held in compounds against their will to conduct the scams. China’s law enforcement agencies have conducted operations rescuing 45,000 trapped workers. Singapore police, working with six banks, prevented over 3,000 scam cases and blocked approximately $74 million USD in a two-month operation.

University of Texas researchers traced $75 billion in cryptocurrency flows connected to these operations, with approximately $39 billion landing in Binance accounts, $14 billion in Huobi, and $6 billion in OKEx — suggesting major cryptocurrency exchanges are knowingly or unknowingly serving as laundering infrastructure for the syndicate. The broader structural problem is that corrupt local officials and militias in coup-disrupted Myanmar provide protection to the compounds in exchange for a share of profits — a corruption dynamic that neutralizes local law enforcement. The city of Sihanoukville in Cambodia reportedly converted shuttered casinos into guarded scam facilities. The episode makes a point worth holding: many of the individuals conducting these scams are themselves victims of human trafficking with no free will to stop — a distinction that complicates any simple moral framing of online scammers.

Listen to the Episode

Two stories this episode: scammers used AI to clone a BBC presenter’s voice and defraud an ad company out of £20,000, and threat actor TA547 deployed AI-generated PowerShell scripts to deliver the Rhadamanthus information stealer against dozens of German organizations.

Stories Covered

AI Voice Clone Used to Defraud Ad Company Out of £20,000 Impersonating BBC Presenter

Scammers used AI-generated audio to impersonate BBC science presenter Liz Bonìn, convincing the CEO of UK company Incognito that she had agreed to endorse their insect repellent product. The attackers contacted Howard Carter, Incognito’s chief executive, via WhatsApp and email — explicitly steering negotiations away from official channels to avoid professional representation that would have caught the fraud. They supplied a fake contract they claimed Bonìn had electronically signed and provided fabricated contact details for someone impersonating her management at the Wildlife Trust, where Bonìn serves as president. Carter transferred £20,000 to a digital bank account linked to the scammers and received images for the campaign shortly after. The ad ran on Monday. Hours later, Bonìn posted on X that she had never agreed to any endorsement with the company.

Two AI audio experts who assessed the voice recording confirmed it was likely artificially generated. The tells were characteristic: early in the clip the voice matched Bonìn’s Irish accent, then shifted to sound Australian, then British — losing coherent accent identity across the recording. Experts noted gaps in recitation speed, inconsistent cadence, and speech quality that was unusually clean despite apparent background noise, artifacts consistent with current AI voice synthesis limitations. When AI models generate speech, they tend toward unnatural evenness — a flattening of the subtle tonal variation, emphasis drift, and trailing letter sounds that characterize natural human speech. Those gaps are detectable now, but are narrowing as the technology improves. The fraud illustrates the risk vector clearly: AI voice cloning lowers the barrier to impersonating specific named individuals for targeted financial fraud, with the attack surface extending to any public figure with enough recorded audio to train on.

The scam worked because Carter was willing to conduct the entire deal off official channels. The warning pattern is well established: any negotiation that redirects away from a person’s professional representation, verified contact information, or established platform carries elevated fraud risk. If someone contacts you claiming to represent a known person or organization and asks to keep things unofficial — that is the signal to stop and verify through an independent, documented channel. The actual legitimate parties almost never ask to bypass their own management or legal structures. In this case the £20,000 was gone before the campaign even ran.

TA547 Uses AI-Generated PowerShell to Deploy Rhadamanthus Info-Stealer Against German Firms

Proofpoint researchers attributed a March 2024 email campaign targeting dozens of German organizations across multiple industries to TA547, a threat actor also tracked as Scully Spider and active since at least 2017. The campaign impersonated Metro Cash & Carry using invoice-themed lures. Messages carried a password-protected ZIP archive (password: MAR26) containing a malicious .lnk shortcut file. Executing the shortcut triggered a PowerShell script that decoded a Base64-encoded copy of the Rhadamanthus executable stored in a variable, loaded it into memory as an assembly, and executed it — never writing the payload to disk. The fileless execution technique is deliberate: a payload that never touches disk is harder to detect through traditional antivirus signature scanning, leaves less forensic evidence, and cannot be trivially pulled for reverse engineering the way a dropped binary can.

Rhadamanthus is an information stealer distributed since September 2022 under a malware-as-a-service model — sold to cybercrime groups who pay per install or by subscription, following the same commercial structure as legitimate SaaS products. Proofpoint flagged an unusual characteristic in the PowerShell script: it included a hash or pound sign followed by descriptive comments for nearly every component of the code. Professional developers and threat actors alike rarely comment every line of working code — comments appear to mark what is needed or to annotate unusual behavior, not to narrate routine operations. The dense, instructional commenting pattern — including markers like “Replace with your actual Base64 string” — is characteristic of code generated by large language models responding to simple prompts, which produce heavily annotated output by default. Bleeping Computer reproduced the experiment using ChatGPT-4 with a similar prompt and got structurally identical output, matching variable names, commenting style, and structure.

The implication is that TA547 used an AI assistant to write or rewrite portions of the attack toolchain — not to develop novel malware, but to accelerate script production and potentially evade signature-based detection by generating code that does not match known human-authored samples. In mid-February 2024, OpenAI announced it had blocked accounts linked to state-sponsored groups including Charcoal Typhoon and Salmon Typhoon (China), Crimson Sandstorm (Iran), Emerald Sleet (North Korea), and Forest Blizzard (Russia) for misuse of ChatGPT. The practical uses: LLMs serve as a fast reconnaissance tool, a code assistant for writing attack scripts, and a way to produce polished phishing content at scale. The convergence of AI tooling and offensive security operations is accelerating — the same tools developers use to write faster are available to the people attacking them.

Listen to the Episode