OTX Bot

Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix

Threat actors exploited ChatGPT's Custom GPT feature to impersonate legitimate ChatGPT models, directing victims through sponsored Google ads to malicious Custom GPTs titled 'Plus 5.6'. These instances served fake service availability notices, redirecting users to Google Sites pages hosting ClickFix lures disguised as CloudFlare CAPTCHA checks. Victims were tricked into executing PowerShell commands that downloaded malicious MSI installers. The attack chain employed DLL sideloading through legitimate Canon-signed and later Stardock-signed executables, establishing dual persistence mechanisms via registry Run keys and scheduled tasks. The multi-stage infection involved obfuscated scripts, encrypted payloads hidden in WAV files and NuGet packages, and ultimately deployed a feature-rich remote access trojan with capabilities including remote desktop, browser hijacking, credential theft, and follow-on payload delivery. Huntress investigated approximately 40 incidents linked to this campaign, with confirmed Cus...

Pulse ID: 6ac12c993806593609d1c30c
Pulse Link: https://otx.alienvault.com/pulse/6ac12c993806593609d1c30c
Pulse Author: AlienVault
Created: 2026-10-03 16:26:01

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#ChatGPT #Clickfix #RAT #CAPTCHA #OTX #AlienVault

Cling Malware Masquerades as Google STUN Traffic to Control Compromised IoT Devices

Cling malware is turning compromised internet-connected devices into a botnet while disguising its control traffic as replies from Google’s public STUN service. The technique makes attacker instructions look like routine communications used by applications to connect across network boundaries. The infection begins with attacks against exposed devices running vulnerable Realtek software. Earlier reporting on Realtek […] The post Cling Malware Masquerades as Google STUN Traffic to Control Compromised IoT Devices appeared first on Cyber Security News .

Pulse ID: 6ac35805e1df7ad5ed81fdf1
Pulse Link: https://otx.alienvault.com/pulse/6ac35805e1df7ad5ed81fdf1
Pulse Author: CyberHunter_NL
Created: 2026-10-05 07:55:49

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Google #IoT #botnet #Malware #OTX #CyberHunter_NL

SMTP is the key: BPFDoor and AVERAT hitting the network edge

A sophisticated multi-component campaign targeting telecommunications and network-edge appliances has been discovered, featuring BPFDoor variants and a newly identified implant designated AVERAT. The operation leverages SMTP traffic on port 25 to blend command-and-control communications with legitimate mail relay activity, exploiting the trust environments of targeted systems. Attackers deploy a dropper that stages payloads into memory-only execution, leaving no on-disk artifacts for forensic analysis. BPFDoor variants impersonate legitimate processes such as SpamSniper components on South Korean systems, while AVERAT samples target Taiwanese appliances using regionalized disguises. The infrastructure relies on compromised consumer devices including NAS units, CCTV systems, and DVRs as operational relays, consistent with China-nexus covert network patterns. Each component demonstrates advanced operational security through process spoofing, encrypted configurations, and deliberate evasion of network monitor...

Pulse ID: 6abfb61b65922c3229d35cf8
Pulse Link: https://otx.alienvault.com/pulse/6abfb61b65922c3229d35cf8
Pulse Author: AlienVault
Created: 2026-10-02 13:48:11

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Edge #Deploy #China #OTX #AlienVault

Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2

Threat actors have been observed attempting to exploit a now-patched critical security flaw impacting the Realtek Jungle software development kit (SDK) to deploy a botnet malware called Cling. "Cling is notable not because it introduces a new propagation technique, but because it repurposes ordinary STUN behavior into a practical command-and-control channel," Nozomi Networks said in a report

Pulse ID: 6ac3ac6e93930b4d37dbe1fa
Pulse Link: https://otx.alienvault.com/pulse/6ac3ac6e93930b4d37dbe1fa
Pulse Author: CyberHunter_NL
Created: 2026-10-05 13:55:58

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#botnet #Deploy #OTX #CyberHunter_NL

CVE-2026-104286: Critical FortiMail Zero-Day Exploited for Unauthenticated File Writes

Fortinet has disclosed a critical FortiMail zero-day vulnerability that attackers are already exploiting in the wild. Tracked as CVE-2026-104286 and rated 9.8 on the CVSS scale, the flaw enables an unauthenticated remote attacker to write arbitrary files to the underlying system by sending specially crafted HTTP or HTTPS requests. The vulnerability poses a significant risk […] The post CVE-2026-104286: Critical FortiMail Zero-Day Exploited for Unauthenticated File Writes appeared first on SOC Prime .

Pulse ID: 6ac3e4c60b5f3d6ef7c5140a
Pulse Link: https://otx.alienvault.com/pulse/6ac3e4c60b5f3d6ef7c5140a
Pulse Author: CyberHunter_NL
Created: 2026-10-05 17:56:22

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CVE2026104286 #ZeroDay #HTTP #HTTPS #OTX #CyberHunter_NL

Citrix NetScaler CVE-2026-88771: Observed Exploitation Artifacts and Hunt Indicators

Pulse ID: 6ac33890e1bfafb65406440a
Pulse Link: https://otx.alienvault.com/pulse/6ac33890e1bfafb65406440a
Pulse Author: Tr1sa111
Created: 2026-10-05 05:41:36

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CVE202688771 #Citrix #NetScaler #OTX #Tr1sa111

Caught in 4K: The Gentlemen Files

A Russian-speaking affiliate of the Gentlemen ransomware group, identifying as Azazel, compromised over two dozen organizations across six countries while simultaneously betraying the RaaS operator. The threat actor deployed independent leak site LEAKNED, keeping all extortion proceeds. Attack chains primarily exploited CI/CD secrets from GitLab instances, with one deep compromise involving an AI platform through SSRF, credential decryption, and continuous object storage exfiltration. Azazel operationalized MCP (Model Context Protocol) as a command-and-control channel, marking the first documented criminal use of AI assistant tooling for attack execution. Infrastructure consisted of three nodes totaling over 50TB storage capacity, with approximately 6TB of actively transferring victim data discovered during investigation. Victims spanned logistics, insurance, pharmaceutical, AI, medical devices, and government-adjacent sectors.

Pulse ID: 6ac3a6d89aeb3e3d383d6d06
Pulse Link: https://otx.alienvault.com/pulse/6ac3a6d89aeb3e3d383d6d06
Pulse Author: AlienVault
Created: 2026-10-05 13:32:08

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#RaaS #Credential #OTX #AlienVault

A STUNning Disguise: Cling Malware Masquerades as Google

A sophisticated IoT botnet dubbed Cling has been discovered exploiting vulnerable internet-exposed devices through CVE-2021-35394 and other command-injection flaws. The malware distinguishes itself by abusing STUN protocol traffic and public STUN infrastructure for command-and-control communications, making malicious activity appear as legitimate NAT-traversal behavior. Cling propagates through multiple CVE exploits targeting routers, DVRs and embedded appliances, establishes persistence via init scripts and wget binary replacement, then communicates with operators through STUN-like exchanges with public servers. The botnet operator uses IP spoofing to make commands appear as if originating from Google's STUN infrastructure. Capabilities include propagation scanning, DDoS flooding, TCP tunneling and proxy relay functions. The malware supports various attack commands hidden within STUN transaction ID fields while maintaining a low detection profile by blending into legitimate application traffic from collab...

Pulse ID: 6ac368846173b592a85473db
Pulse Link: https://otx.alienvault.com/pulse/6ac368846173b592a85473db
Pulse Author: AlienVault
Created: 2026-10-05 09:06:12

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Cling #Google #botnet #CVE202135394 #OTX #AlienVault

XWorm Malware: Worming Its Way From Entry to Exploitation

XWorm is a versatile modular malware that poses a multifaceted threat through remote access, data theft, ransomware delivery, and botnet creation. Associated with the DDGroup cybercrime group, it rapidly gained notoriety for using advanced techniques. The malware employs diverse delivery methods including phishing emails with malicious attachments, drive-by downloads, exploit kits targeting browser vulnerabilities, USB drives, and Remote Desktop Protocol exploitation. Once established, XWorm steals sensitive data like passwords and credit card information, deploys additional malware strains including ransomware and spyware, and causes system crashes and denial-of-service attacks. Its modular nature and varied attack vectors make it a persistent threat requiring robust cybersecurity measures and continuous vigilance.

Pulse ID: 6ac34ecea12957741eb7ac1b
Pulse Link: https://otx.alienvault.com/pulse/6ac34ecea12957741eb7ac1b
Pulse Author: AlienVault
Created: 2026-10-05 07:16:30

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#XWorm #botnet #Malware #CreditCard #OTX #AlienVault

Anatomy of BraZetsu: How Cybercriminals Supply the Underground Ecosystem

BraZetsu is a sophisticated Python-based Windows malware framework attributed to the Brazilian threat actor Exilware. Unlike standard infostealers, it functions as a comprehensive toolkit for Initial Access Brokers, converting compromised systems into high-value commercial assets. The framework employs modular architecture, advanced evasion techniques, and AI-enhanced reconnaissance capabilities to target corporate, financial, industrial, and law enforcement environments across Iberia and Latin America. It specifically harvests financial transaction files in Brazilian CNAB format, detailed browsing histories, and digital certificates. BraZetsu powers the 'Infected Marketplace' where Exilware commercializes initial access to compromised systems, enabling criminal clients to remotely execute additional malicious payloads. The malware demonstrates rapid technical evolution since February 2026, progressing from basic remote access to an AI-enhanced intelligence collection platform.

Pulse ID: 6abfae3085404615c3cf7a32
Pulse Link: https://otx.alienvault.com/pulse/6abfae3085404615c3cf7a32
Pulse Author: AlienVault
Created: 2026-10-02 13:14:24

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Underground #LatinAmerica #LawEnforcement #Python #OTX #AlienVault

Pretty Themes, Hidden Loaders: GlassWorm-Linked Extensions Span VS Code Marketplace and Open VSX

Socket identified a malicious cluster of Visual Studio Code extensions spanning both VS Code Marketplace and Open VSX registries. Two confirmed malicious themes were discovered: Aurora Nocturne Night Theme, which downloaded and executed threat actor-controlled batch files, and Cosmic Nebula Themes, containing a staged loader that decrypts embedded JavaScript, performs Russian-language gating, and uses Solana blockchain transaction memos to dynamically resolve payload infrastructure. The cluster includes at least ten extensions across both platforms, with over 8,000 Visual Studio Marketplace installs and tens of thousands of Open VSX downloads. Git history, Russian-language source code comments, and distinctive execution patterns connect these extensions to the broader GlassWorm supply chain campaign. Several extensions remain unweaponized but retain executable capabilities that pose significant risk. The operation employs brandjacking tactics and demonstrates sophisticated infrastructure rotation technique...

Pulse ID: 6ac07308bd5cef8481adcf61
Pulse Link: https://otx.alienvault.com/pulse/6ac07308bd5cef8481adcf61
Pulse Author: AlienVault
Created: 2026-10-03 03:14:16

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#BlockChain #JavaScript #SupplyChain #OTX #AlienVault

Warlock Ransomware Attackers Hit Water and Telecom Operators

Pulse ID: 6ac338a9cf325c4919d1b050
Pulse Link: https://otx.alienvault.com/pulse/6ac338a9cf325c4919d1b050
Pulse Author: Tr1sa111
Created: 2026-10-05 05:42:01

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Telecom #Warlock #RansomWare #OTX #Tr1sa111

Hackers Abuse Legitimate ScreenConnect Tool to Gain Remote Access Through Phishing

Hackers are using a legitimate ScreenConnect client to turn a payment notification into a route for remote access. Instead of delivering custom malware, the phishing attempt directs recipients to software already designed to let someone else connect to their computer. The email claims that a payment of $5745.65 has been received and invites the recipient […] The post Hackers Abuse Legitimate ScreenConnect Tool to Gain Remote Access Through Phishing appeared first on Cyber Security News .

Pulse ID: 6ac39071863fe3f8d9c2d228
Pulse Link: https://otx.alienvault.com/pulse/6ac39071863fe3f8d9c2d228
Pulse Author: CyberHunter_NL
Created: 2026-10-05 11:56:33

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#ScreenConnect #Phishing #Email #OTX #CyberHunter_NL

Response Overview and Colonel Clustered – Grouping Burp Responses by Content

Two Burp Suite extensions that group responses by content: Response Overview, a BApp with a threshold you set, and Colonel Clustered, which picks its own.

Pulse ID: 6ac39e746ceb2124f3eb1e3d
Pulse Link: https://otx.alienvault.com/pulse/6ac39e746ceb2124f3eb1e3d
Pulse Author: CyberHunter_NL
Created: 2026-10-05 12:56:20

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#OTX #CyberHunter_NL

The Psychedelic Stealer: When the CAPTCHA Is the Installer

Between September 9 and September 14, 2026, an unattributed Russian-speaking operator compromised at least six legitimate Ukrainian small-business websites to deliver a fake Cloudflare verification page. The ClickFix chain convinced victims to manually execute msiexec.exe commands via the Windows Run dialog, achieving a 14 percent completion rate (79 infections from 426 clicks). The payload, internally named Psychedelic, combines credential theft with persistent agent capabilities, installing browser extensions with native-messaging bridges, establishing scheduled tasks, and polling a REST API for arbitrary executable tasking. Targeting focused overwhelmingly on Ukraine with clear financial motivation, collecting browser credentials, session tokens, and cryptocurrency wallet data from MetaMask, Trust Wallet, Exodus, Atomic Wallet, and others. The technique deliberately avoids encoded PowerShell, using signed Microsoft binaries to bypass common ClickFix detections.

Pulse ID: 6abfb63a870eec5021127b09
Pulse Link: https://otx.alienvault.com/pulse/6abfb63a870eec5021127b09
Pulse Author: AlienVault
Created: 2026-10-02 13:48:42

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Psychedelic #CAPTCHA #Atomic #Clickfix #OTX #AlienVault

TIKTOUK: Tracing a WordPress Credential Collection Toolkit

Pulse ID: 6ac338b90015d38c899398ec
Pulse Link: https://otx.alienvault.com/pulse/6ac338b90015d38c899398ec
Pulse Author: Tr1sa111
Created: 2026-10-05 05:42:17

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Credential #TIKTOUK #Wordpress #OTX #Tr1sa111

Hallucinating Credibility: China-Aligned TA419 Impersonates its Way into US AI Policy Circles

Pulse ID: 6ac3389ecc4d8f2f8b8a0c6f
Pulse Link: https://otx.alienvault.com/pulse/6ac3389ecc4d8f2f8b8a0c6f
Pulse Author: Tr1sa111
Created: 2026-10-05 05:41:50

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#TA419 #China #OTX #Tr1sa111

Fake xStocks, Pendle, and other sites bait crypto users with rewards votes

Pulse ID: 6ac338b11e9a6f20af31a928
Pulse Link: https://otx.alienvault.com/pulse/6ac338b11e9a6f20af31a928
Pulse Author: Tr1sa111
Created: 2026-10-05 05:42:09

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#OTX #Tr1sa111

ClickFix Fake CAPTCHA Attack Executes Malware Hidden Inside Browser Cache

A new ClickFix campaign is turning a web safety check into a route for malware. Visitors to compromised websites see a fake CAPTCHA or repair message and are told to open the Windows Run dialog, paste copied text, and press Enter. The instruction looks simple, but it makes the victim run the attacker’s command. The […] The post ClickFix Fake CAPTCHA Attack Executes Malware Hidden Inside Browser Cache appeared first on Cyber Security News .

Pulse ID: 6ac3ac68f9c76cd14a4824e4
Pulse Link: https://otx.alienvault.com/pulse/6ac3ac68f9c76cd14a4824e4
Pulse Author: CyberHunter_NL
Created: 2026-10-05 13:55:52

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CAPTCHA #Clickfix #Browser #Malware #OTX #CyberHunter_NL

Abusing OAuth Device Code Flow

In early 2026, phishing attacks remain a top threat vector in security operations. This analysis covers a novel attack method exploiting Microsoft's OAuth 2.0 Device Authorization Grant (Device Code Flow) to compromise user accounts. Attackers use phishing emails containing Mailchimp's Mandrill service links to bypass security controls, leading victims to fake Adobe-themed websites. The sites abuse legitimate Microsoft authentication mechanisms to obtain access and refresh tokens, granting persistent delegated access to critical resources like Graph API, Teams, Outlook, and SharePoint. The technique leverages shared client IDs across tenants and family of client IDs (FOCI) for lateral movement. Two variants exist: one using external phishing infrastructure with dynamic code generation, and another relying solely on fake meeting invitations containing pre-generated device codes. The attack is particularly effective as it uses legitimate Microsoft services, making detection challenging.

Pulse ID: 69e68ccac96ab3f866763f12
Pulse Link: https://otx.alienvault.com/pulse/69e68ccac96ab3f866763f12
Pulse Author: AlienVault
Created: 2026-04-20 20:30:02

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Adobe #CyberSecurity #Email #InfoSec #Microsoft #OTX #OpenThreatExchange #Outlook #Phishing #RAT #RCE #SMS #bot #AlienVault

GlassWorm Supply Chain Attack Uses Fake VS Code Themes to Deliver Hidden Malware

GlassWorm is turning developer tools into malware delivery channels, this time through extensions advertised as attractive VS Code themes. The investigated cluster spans Visual Studio Marketplace and Open VSX, showing how appearance changes can provide cover for code that runs on developer machines. The campaign first surfaced in October 2025 and has since expanded across […] The post GlassWorm Supply Chain Attack Uses Fake VS Code Themes to Deliver Hidden Malware appeared first on Cyber Security News .

Pulse ID: 6ac39e5ee608657a5f263a97
Pulse Link: https://otx.alienvault.com/pulse/6ac39e5ee608657a5f263a97
Pulse Author: CyberHunter_NL
Created: 2026-10-05 12:55:58

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#SupplyChain #Malware #OTX #CyberHunter_NL