The research highlights a growing risk for AI-powered coding assistants, where seemingly harmless third-party skills can perform malicious actions once executed.

How the Attack Works

Unlike simple text prompts, AI agent skills can contain instructions, scripts, and additional resources that an AI agent may execute automatically.

Researchers developed an evasion technique called SKILLCLOAK, which hides malicious behavior using code obfuscation and self-extracting payloads. This allows harmful skills to appear legitimate during security checks while preserving their original functionality.

Tests showed that many cloaked skills successfully bypassed existing scanning tools and continued to work normally in AI coding platforms such as Claude Code and Codex.

Runtime Detection Offers Better Protection

To address this issue, researchers introduced SKILLDETONATE, a runtime security system that analyzes what a skill does while it is running instead of relying only on static code inspection.

The system monitors activities such as:

• File access
• Credential usage
• Network connections
• Data transfers
• Process execution

By focusing on runtime behavior rather than code appearance, the approach detected most malicious skills, including obfuscated and packed variants, with a high level of accuracy.

The findings suggest that organizations using AI coding assistants should carefully review third-party agent skills and adopt runtime monitoring solutions, as traditional install-time security checks may no longer be sufficient to detect increasingly sophisticated AI-based threats.

‍Follow Us on:Linkedin, Instagram, Facebook to get the latest security news!

The post Malicious AI Skills Threaten Enterprise Security appeared first on First Hackers News.

The issue affects the browser’s GX Mods feature and could be exploited to leak sensitive information from websites without requiring the victim to install a traditional browser extension.

Researchers demonstrated a zero-click attack where simply visiting a malicious webpage could trigger the installation of a harmful browser mod.

How the Attack Works

GX Mods are designed to let users personalize Opera GX by adding themes, sounds, wallpapers, and CSS-based customizations.

Unlike browser extensions, GX Mods do not require special permissions or JavaScript.

Researchers discovered that malicious GX Mods packaged as .crx files can be installed automatically when downloaded through an embedded webpage, requiring little or no user interaction.

After installation, the malicious CSS is applied across every browser tab, allowing attackers to target multiple websites.

Potential Security Risks

Once the malicious CSS is active, attackers can use CSS-based XS-Leaks techniques to infer sensitive information from webpages.

Although CSS cannot directly read confidential data, it can trigger network requests based on specific webpage elements, allowing attackers to gradually leak information.

Researchers demonstrated that attackers could reconstruct data such as email addresses by analyzing small pieces of information collected from the browser.

Possible risks include:

• Cross-site data leakage
• Exposure of sensitive account information
• Privacy violations
• Universal CSS injection across browser tabs

Browser Crash Issue

Researchers also identified a separate denial-of-service (DoS) issue affecting both Opera GX and the standard Opera browser.

Triggering a malicious .crx download while browsing in Incognito Mode could cause the browser to crash and restart, resulting in the loss of the current browsing session.

Patch Available

The vulnerabilities were responsibly disclosed through Opera’s bug bounty program.

Opera has released fixes to address the reported issues, reducing the risk of automatic mod installation and improving the browser’s handling of GX Mods.

Users are encouraged to update to the latest version of Opera GX to ensure they are protected against these vulnerabilities.

The post Opera GX Flaw Allows CSS Injection appeared first on First Hackers News.

The flaw is caused by insecure BinaryFormatter deserialization, a long-known security risk in .NET applications. According to researchers, the issue continues a pattern of similar vulnerabilities affecting Veeam’s .NET Remoting components.

How the Vulnerability Works

Veeam Backup & Replication is widely used by organizations to manage backup, disaster recovery, and replication across virtual, physical, and cloud environments.

The vulnerability affects the Veeam Backup Service, which exposes a .NET Remoting HTTP endpoint on TCP port 8000.

Instead of allowing only trusted object types, the service relies on a blacklist-based filtering mechanism. While known dangerous classes are blocked, any unlisted serializable class is still accepted, creating an opportunity for attackers to bypass the protection.

Low-Privilege Users Can Exploit the Flaw

Researchers found that the vulnerability can be exploited by any authenticated domain user.

The application only verifies whether a user belongs to the standard Windows User group, meaning administrative privileges are not required to reach the vulnerable component.

An attacker can abuse this weakness to execute malicious serialized objects and ultimately run arbitrary commands on the backup server.

Exploitation Process

The attack follows a sequence of interactions with the Veeam service before delivering the malicious payload.

During exploitation, the attacker:

• Creates a restore session.
• Initializes the backup session.
• Sends a malicious BinaryFormatter payload.
• Triggers insecure deserialization.
• Executes arbitrary commands on the server.

Researchers demonstrated that the exploit abuses System.Data.DataSet deserialization to instantiate ObjectDataProvider, which can invoke Process.Start() and execute attacker-controlled commands.

Because the Veeam Backup Service typically runs with SYSTEM privileges, successful exploitation can result in full control of the backup server.

Why This Vulnerability Exists

The root cause is Veeam’s continued use of BinaryFormatter, a serialization technology that Microsoft has considered unsafe and deprecated since .NET 5.

Researchers explain that relying on blocklists is not a long-term solution because attackers can continue discovering new classes capable of bypassing the restrictions.

Previous vulnerabilities, including CVE-2024-40711 and CVE-2025-23120, were based on the same underlying weakness.

Patch and Mitigation

Veeam addressed the issue in version 12.3.2.4854 (KB4696) by adding the newly discovered gadget class to its BinaryFormatter blacklist.

However, researchers note that the update does not remove BinaryFormatter or redesign the underlying deserialization process.

In contrast, Veeam Backup & Replication 13.x removes the BinaryFormatter-based implementation entirely, eliminating this class of vulnerabilities.

Security Recommendations

Organizations using Veeam Backup & Replication 12.x should take immediate action to reduce the risk of exploitation.

Recommended security measures include:

• Apply the latest Veeam security updates.
• Restrict access to TCP port 8000.
• Limit network exposure of backup servers.
• Consider deploying backup servers in workgroup mode instead of domain-joined environments where appropriate.
• Monitor backup servers for suspicious deserialization or remote execution activity.

Because backup infrastructure is frequently targeted by ransomware groups, organizations should prioritize patching this vulnerability to prevent attackers from gaining control over critical backup systems.

The post Critical Veeam Backup Flaw Discovered appeared first on First Hackers News.

The update introduces a redesigned menu system, faster package handling, optimized builds for modern processors, official Vagrant support, and several quality-of-life improvements aimed at making Parrot OS easier to use for both security professionals and everyday users.

Parrot 7.3 -Performance Improvements

One of the biggest highlights of Parrot 7.3 is improved performance on newer hardware.

The release includes optional packages optimized for modern x86-64-v3 and ARMv8.2-A processors, allowing supported systems to achieve noticeable performance gains during resource-intensive tasks.

These optimizations benefit applications such as:

• FFmpeg
• Inkscape
• NumPy
• Shared libraries
• Programming language runtimes

To maintain compatibility, core system components continue using standard builds, while hardware compatibility checks ensure optimized packages are installed only on supported processors.

Redesigned Menu System

Parrot 7.3 replaces its previous shell-based launcher with a new menu system written in Go.

The updated launcher simplifies application management and allows users to install supported tools directly from the desktop menu without opening the terminal.

The new menu also offers:

• Faster application launching
• Automatic menu updates
• Removal of duplicate launcher entries
• Cleaner navigation across installed and available tools

The goal is to provide a smoother experience for both new users and experienced penetration testers.

Official Vagrant Support

Another major addition is official Vagrant support for the Home and Security editions.

The preconfigured Vagrant boxes allow users to quickly deploy consistent Parrot environments for:

• Security testing
• Training labs
• Development
• CI/CD environments
• Team collaboration

This makes it easier to reproduce testing environments across different systems.

Improved Privacy and Smaller Images

Parrot 7.3 also introduces a redesigned Firefox start page that respects user privacy.

Users can choose their preferred search engine, including:

• DuckDuckGo
• Qwant
• Google

According to the Parrot team, the new page does not collect user data, reflecting the project’s privacy-focused approach.

The release also reduces the number of preinstalled packages in the Home and Security editions, resulting in smaller installation images and a lighter operating system.

Updated Security Tools

Parrot 7.3 ships with updated software packages to keep security professionals working with the latest tools.

Some notable updates include:

• Linux Kernel 7.0.9
• Metasploit 6.4.136
• Ghidra 12.0.4
• SQLMap 1.10.4
• Bettercap 2.41.5

Rather than introducing dozens of new tools, Parrot 7.3 focuses on refining the overall user experience. With improved performance, a redesigned menu system, official Vagrant support, updated security tools, and a lighter installation, the release delivers meaningful improvements for penetration testers, security researchers, and Linux enthusiasts alike.

The post Parrot 7.3 Launches with New Features appeared first on First Hackers News.

The decision comes after videos circulated online showing users remotely shutting down battery-powered three-wheelers, raising serious concerns about passenger and road safety.

Authorities have also warned that any other apps offering similar unsafe remote-control capabilities could face similar action.

Why Were These Apps Removed?

The apps were originally developed as Battery Management System (BMS) tools for electric vehicles.

Their intended purpose was to help:

• Monitor battery health and charging status
• Track vehicle location
• Manage fleet operations
• Disable vehicles in cases of theft or loan default

However, authorities found that the remote shutdown feature was allegedly being misused to stop vehicles without the driver’s permission.

How the Apps Were Misused

According to reports, some users were able to remotely disable nearby e-rickshaws using the connected battery management system.

Researchers believe the issue was caused by weak access controls, allowing unauthorized users with access credentials to send remote shutdown commands.

This meant that features designed for fleet management could potentially be misused by:

• Unauthorized individuals
• Rival financiers
• Disgruntled employees
• Malicious actors
• Pranksters

Such actions could interrupt journeys and create serious safety risks for both drivers and passengers.

Security Concerns

The incident highlights growing security challenges within Internet of Things (IoT)-enabled electric vehicles.

Researchers note that many low-cost electric vehicle platforms prioritize functionality over security, leaving connected systems vulnerable to misuse.

Some of the reported concerns include:

• Weak authentication mechanisms
• Shared or leaked login credentials
• Insufficient access controls
• Lack of driver authorization
• Remote shutdown without safety checks

Without proper safeguards, features intended to improve vehicle management can become potential security risks.

Government Response

Following reports of misuse, the government instructed Google and Apple to remove the affected applications from their respective app stores.

Officials also indicated that additional apps found enabling similar remote vehicle shutdown capabilities could face the same action.

The move reflects increasing efforts to improve the security of connected transportation technologies and protect public safety.

Recommendations for Fleet Operators

Organizations using connected Battery Management Systems should strengthen their security by:

• Enabling multi-factor authentication (MFA)
• Restricting access to authorized users only
• Preventing remote shutdown while vehicles are moving
• Maintaining audit logs for remote commands
• Conducting regular security assessments of BMS platforms
• Securing backend APIs and user credentials

As connected electric vehicles become more common, securing remote management features will be essential to prevent misuse and ensure passenger safety.

The post India Bans Apps Used to Stop E-Rickshaws Remotely appeared first on First Hackers News.

Although the attack requires local code execution on the host system, the research demonstrates that several built-in security mechanisms can be bypassed, ultimately leading to full administrative control within the sandbox.

How Claude Cowork Protects Its Sandbox

Claude Cowork Sandbox is designed to help users build applications and automate tasks using Claude Code within an isolated environment.

On Windows, the platform runs workloads inside a Hyper-V-based Ubuntu virtual machine protected by several security layers, including:

• Hyper-V isolated Ubuntu VM
• Authenticode-based named pipe authentication
• Bubblewrap sandbox namespaces
• Per-session unprivileged Linux users
• Seccomp filtering
• Domain-restricted outbound network access

These protections are intended to isolate workloads and prevent unauthorized access to the underlying environment.

Researchers Found a Way Around the Protections

According to research published by Armadin, the attack targeted the CoworkVMService, a Local System service responsible for managing communication between Windows and the Ubuntu virtual machine.

The service uses a named pipe and validates that only applications digitally signed by Anthropic can communicate with it.

Researchers attempted to bypass the signature validation but found that the authentication checks correctly rejected forged signatures and invalid trust chains.

Instead, they identified another attack path.

DLL Sideloading Enabled Code Execution

Researchers discovered that claude.exe loads USERENV.dll from its application directory before loading the legitimate Windows system library.

By placing a malicious USERENV.dll alongside the application, they successfully performed DLL sideloading, allowing arbitrary code to execute inside the trusted Anthropic process.

Because the malicious code was running within the signed application, it successfully passed the service’s identity verification.

Root Access Achieved Through RPC Manipulation

After gaining code execution, researchers analyzed the application’s JSON-based RPC protocol used to communicate with the virtual machine.

The protocol exposed several methods, including:

• configure
• startVM
• isGuestConnected
• spawn

While most security controls continued to function correctly, researchers discovered that two parameters—isResume and allowedDomains—were forwarded directly to the sandbox daemon without sufficient validation.

By fuzzing the RPC interface, they reconstructed the parameter structure and identified a logic flaw.

Normally, setting isResume to false creates a new unprivileged Linux user.

However, when isResume was set to true, the existing user validation was skipped entirely.

This allowed researchers to specify any username, including root, and execute commands with root privileges inside the sandbox.

Security Impact

The vulnerability demonstrates that multiple security boundaries can be bypassed once an attacker gains local code execution.

Although Anthropic’s threat model assumes local access is already required, the research highlights how privilege escalation can occur even inside heavily sandboxed AI environments.

Successful exploitation could allow an attacker to:

• Execute commands as root inside the Linux sandbox.
• Bypass intended privilege restrictions.
• Gain unrestricted administrative access within the virtual machine.
• Circumvent multiple sandbox security controls.

The issue was successfully demonstrated against Claude Desktop for Windows version 1.9255.2.0.

As AI-powered development environments continue to evolve, this research serves as a reminder that sandbox implementations should be regularly reviewed to ensure privilege boundaries cannot be bypassed through chained vulnerabilities.

The post Claude Cowork Sandbox Flaw Allows Root Access appeared first on First Hackers News.

Instead of relying on traditional malware downloaders, the attackers combine trusted applications, DLL sideloading, reflective loading, and process hollowing to quietly install remote access malware while avoiding detection.

Fake Software Websites Used as Lures

The attackers created numerous fake download websites designed to imitate popular software applications.

Some of the impersonated software includes:

• OBS Studio
• DNS Jumper
• DS4Windows
• Bandicam
• Other widely used freeware applications

Many of these websites were translated into more than ten languages, allowing the campaign to target users across multiple regions.

Researchers also found that search engine optimization (SEO) techniques helped these malicious websites appear higher in search results, increasing the likelihood that users would download the infected installers.

How the Infection Works

Each downloaded archive contains a mix of legitimate and malicious files.

The package typically includes:

• A legitimate Microsoft-signed install.exe
• A malicious install.res.1033.dll
• An Assets folder containing the legitimate software
• A renamed ScreenConnect MSI installer disguised as a trusted file, such as vcredist_x64.dll

When the user launches the installer, the signed executable automatically loads the malicious DLL through DLL sideloading.

The DLL silently installs the ScreenConnect service and registers it under names that appear legitimate, such as Microsoft Update Service, before connecting the infected system to attacker-controlled servers.

Multiple Techniques Used to Evade Detection

Once ScreenConnect is installed, attackers execute PowerShell and VBScript commands to strengthen their foothold on the system.

The scripts perform several actions, including:

• Adding Microsoft Defender exclusions for entire drives and important processes.
• Disabling User Account Control (UAC) prompts.
• Dropping additional malware components into the C:\Users\Public directory.

The malware then decrypts an encrypted payload stored in secret_bytes.txt. A PowerShell script named cap.ps1 reconstructs the payload by decoding hexadecimal data, applying XOR decryption, and rebuilding the executable entirely in memory.

The recovered .NET assembly is loaded directly into memory using reflective loading, avoiding the need to write the malware to disk.

AsyncRAT Deployed Through Process Hollowing

To further reduce detection, the malware launches RegAsm.exe in a suspended state before replacing its memory with the AsyncRAT payload using process hollowing.

Running the malware inside a legitimate Windows process helps it blend in with normal system activity and bypass some security tools that rely on process reputation.

Persistence and Infrastructure

To maintain long-term access, the attackers create a scheduled task named MasterPackager.Updater.

The task runs every two minutes, allowing the malware to restart automatically after reboots or if its processes are terminated.

Kaspersky researchers also identified two major infrastructure clusters supporting the campaign.

The operation used:

• Multiple command-and-control (C2) servers
• Numerous spoofed domains
• Separate download servers for malware archives
• ScreenConnect configuration files pointing to attacker infrastructure

Based on domain registration data, researchers believe the campaign has been active since October 2025 and continued operating through March 2026, with several fake download websites still accessible online.

Security Recommendations

Because this campaign abuses trusted software and legitimate administrative tools, organizations should strengthen their defenses against both malware and software supply chain attacks.

Security teams should consider the following measures:

• Download software only from official vendor websites.
• Block MSI installers from untrusted locations.
• Monitor for newly created Windows services and scheduled tasks.
• Detect unusual DLL sideloading activity.
• Watch for suspicious use of PowerShell, VBScript, and signed Windows binaries.
• Monitor outbound connections to unknown remote management servers.
• Keep endpoint protection enabled and regularly updated.
• Educate users to verify download sources before installing software.

This campaign demonstrates how attackers continue to blend legitimate administration tools with advanced malware techniques. By combining trusted software, stealthy execution methods, and fake software distribution sites, threat actors can significantly increase the chances of compromising both individual users and enterprise environments.

IOCs

The post Fake Installers Spread AsyncRAT Using ScreenConnect appeared first on First Hackers News.

The findings were shared by The Shadowserver Foundation, which recently enhanced its scanning capabilities through domain-based fingerprinting in collaboration with Validin. Although the scan did not verify whether every exposed system is vulnerable, it highlights a large number of publicly accessible Oracle EBS deployments that could become potential targets.

Active Exploitation Detected

Researchers at DefusedCyber have observed active exploitation attempts targeting CVE-2026-46817, indicating that threat actors are already scanning for vulnerable Oracle E-Business Suite servers.

The vulnerability was addressed in Oracle’s May 2026 Critical Patch Update (CPU). While Oracle has released limited technical details, the flaw is considered serious because Oracle EBS often manages sensitive business information, including financial, HR, and operational data.

Compromising these systems could allow attackers to gain unauthorized access, steal sensitive information, or move laterally across enterprise networks.

Exposure and Security Recommendations

Shadowserver’s public dashboard provides visibility into exposed Oracle EBS systems worldwide, while its Device ID reporting service helps organizations identify internet-facing Oracle E-Business Suite instances within their environments.

To reduce the risk of compromise, organizations should:

• Apply Oracle’s latest security patches immediately.
• Restrict public access to Oracle EBS servers.
• Enable strong authentication and access controls.
• Monitor logs for suspicious activity.
• Deploy Web Application Firewall (WAF) protections.
• Segment Oracle EBS servers from critical internal networks.

With hundreds of Oracle E-Business Suite instances exposed and attackers actively exploiting CVE-2026-46817, organizations should prioritize patching and review externally accessible systems before they become targets of compromise.

The post Attackers Target Oracle E-Business Suite Flaw appeared first on First Hackers News.

The platform provides cybercriminals with an advanced web-based dashboard that simplifies Microsoft 365 account compromise. It supports device code phishing, Primary Refresh Token (PRT) persistence, mailbox takeover, Business Email Compromise (BEC), and SharePoint data theft through an easy-to-use interface.

Researchers found that ARToken contains more than 80 API endpoints, giving attackers a wide range of tools to manage phishing campaigns and compromised accounts.

What Makes ARToken Dangerous?

ARToken offers a complete post-compromise toolkit that allows attackers to maintain access to Microsoft 365 accounts even after credentials have been changed.

Some of its key capabilities include:

• Device code phishing attacks
• Primary Refresh Token (PRT) setup and renewal
• Token import and export
• Mailbox takeover
• Business Email Compromise (BEC) operations
• SharePoint and OneDrive file access
• Cloudflare Workers integration for phishing pages
• Automated inbox rule creation
• Mass BCC email campaigns

Researchers discovered these features after analyzing the platform’s 1.7 MB React JavaScript bundle, which exposed the application’s client-side logic and API endpoints without requiring authentication.

Similarities to EvilTokens

Cisco Talos found multiple technical similarities between ARToken and the EvilTokens platform.

Both platforms:

• Use Microsoft device code authentication phishing.
• Return similar device authentication parameters such as device_code, user_code, verification_uri, and expires_in.
• Support the clientMode: “broker” parameter, which uses Microsoft’s Windows Authentication Manager (WAM) to obtain Primary Refresh Tokens (PRTs).
• Follow similar deployment methods using Cloudflare Workers.
• Operate as multi-tenant phishing-as-a-service platforms with subscription-based access and affiliate dashboards.

These similarities strongly suggest that ARToken is built on, or heavily inspired by, the EvilTokens infrastructure.

Advanced Anti-Analysis Techniques

ARToken also includes several techniques designed to prevent automated analysis and security research.

These include:

• User-Agent verification
• Detection of browser automation tools
• Browser feature fingerprinting
• Screen size and window validation
• Mouse and touch interaction checks
• Runtime payload decryption using XOR encryption

These protections make the platform more difficult for automated security tools and sandboxes to analyze.

How the Phishing Campaign Works

Researchers observed phishing emails impersonating a legitimate contractor to target accounts payable employees.

The emails contained SharePoint links that appeared legitimate but redirected victims to attacker-controlled Microsoft 365 environments.

Other characteristics of the campaign included:

• Cloudflare Workers hosting phishing pages
• Reply-chain hijacking techniques
• Unique email variations to bypass detection
• Failed SPF, DKIM, and DMARC authentication
• Victims directed to microsoft.com/devicelogin and instructed to enter a device code supplied by the attacker

Once the device code is entered, attackers obtain access tokens without requiring the victim’s password.

Additional Post-Compromise Features

Beyond stealing tokens, ARToken provides attackers with several tools to manage compromised accounts.

These include:

• Continuous mailbox monitoring
• Automated inbox rule creation
• Bulk token import and export
• Shared token management with role-based permissions
• Dynamic phishing lure customization
• SharePoint site management
• Cloudflare Workers deployment directly from the dashboard

These features allow attackers to maintain long-term access and streamline Business Email Compromise operations.

Security Recommendations

Organizations using Microsoft 365 should take immediate steps to reduce the risk of device code phishing attacks.

Recommended security measures include:

• Monitor for unusual device registration activity.
• Audit Primary Refresh Token (PRT) creation and renewal.
• Revoke active sessions if compromise is suspected.
• Enforce Conditional Access policies.
• Monitor mailbox rule creation and suspicious email forwarding.
• Be cautious of unexpected SharePoint links, even if they appear legitimate.
• Train users to recognize device code phishing attempts.

Because Primary Refresh Tokens (PRTs) can remain valid even after a password change, organizations should immediately revoke active sessions and tokens whenever a compromise is detected to prevent attackers from maintaining persistent access.

The post New ARToken Panel Targets Microsoft 365 Tokens appeared first on First Hackers News.

The vulnerability affects environments where OpenID Connect (OIDC) authentication is enabled. Due to improper verification of cryptographic signatures, attackers can bypass authentication and gain unauthorized access to affected systems.

How the Vulnerability Works

According to CISA, the issue occurs because SimpleHelp does not properly validate identity tokens during the OIDC authentication process. As a result, a remote attacker can create forged identity tokens and have them accepted as legitimate.

This allows attackers to impersonate authorized users without valid credentials and gain technician-level access to the application. In some environments, the vulnerability may also allow attackers to bypass multi-factor authentication (MFA), significantly increasing the risk of unauthorized access.

Because SimpleHelp is widely used for remote IT support, successful exploitation could provide attackers with direct access to managed devices, creating opportunities for privilege escalation and lateral movement across enterprise networks.

Immediate Action Required

CISA has instructed federal agencies to remediate the vulnerability under Binding Operational Directive (BOD) 26-04, with a deadline of July 2, 2026. The agency also recommends that organizations follow vendor guidance, prioritize patching internet-facing systems, and review affected environments for signs of compromise.

If patches cannot be applied immediately, organizations should consider temporarily removing vulnerable SimpleHelp servers from public access until security updates are in place.

Although CISA has not linked the vulnerability to ransomware attacks, its inclusion in the KEV catalog confirms that threat actors are actively exploiting the flaw. Organizations using SimpleHelp should treat this issue as a high priority and apply the latest security updates as soon as possible to reduce the risk of unauthorized access.

The post CISA Flags SimpleHelp Flaw as Actively Exploited appeared first on First Hackers News.