Langflow is an open-source platform used by developers to build AI applications, agents and automated workflows through a visual interface. Since these environments can connect to external tools, APIs and sensitive information, security weaknesses could expose important application resources and server infrastructure.

According to IBM, Langflow versions ranging from 1.0.0 through 1.12.8 are affected. The company recommends upgrading to version 1.13.0, which addresses the reported vulnerabilities.

Four Security Vulnerabilities Identified

IBM’s security bulletin identifies four vulnerabilities affecting Langflow OSS. Two are rated critical, while the remaining issues carry high and medium severity ratings.

The vulnerabilities are:

The most serious concerns involve CVE-2026-93680 and CVE-2026-110186 because they can be exploited remotely without requiring valid user credentials.

Authentication Bypass and Remote Code Execution Risks

CVE-2026-93680 is an authentication-related vulnerability that could allow an attacker to bypass security restrictions and access functionality without proper authorization.

The issue is particularly relevant to Langflow’s Model Context Protocol (MCP) integration. MCP allows AI applications to interact with external tools and services, while Langflow can expose its workflows as tools through an MCP endpoint.

A publicly available module in the Metasploit Framework references this vulnerability. The module can connect to a vulnerable Langflow MCP endpoint without credentials, establish a session and enumerate the tools exposed by the server.

However, the module’s documented functionality focuses on authentication bypass and tool enumeration; it does not itself execute commands or run arbitrary code on the server.

The second critical issue, CVE-2026-110186, is more severe from a server security perspective. IBM reports that improper control of code generation could allow a remote attacker to execute arbitrary code without authentication.

Six Earlier Langflow Vulnerabilities Already Listed by CISA

The latest vulnerabilities add to a growing list of security concerns involving Langflow.

According to the reported update, six other Langflow vulnerabilities were already included in the Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities (KEV) catalog. The most recently added issue was CVE-2026-9198, which appeared in August 2026.

However, the four vulnerabilities covered in IBM’s October bulletin were not listed in the KEV catalog as of its update.

The absence of these vulnerabilities from the catalog should not be treated as confirmation that affected systems are safe. Organizations should still prioritize remediation based on the severity and exposure of their deployments.

The post Critical Langflow Vulnerabilities Allow Authentication Bypass and Remote Code Execution appeared first on First Hackers News.

The warning applies as a precaution to Trezor devices purchased through CryptoBilis from March 2026 onward. So far, the company has received a report involving only one suspected device.

In its October 30, 2026 security notice, Trezor advised potentially affected customers to create a completely new wallet with a fresh recovery phrase and move their funds. The company has not yet examined the reported device, and no stolen funds have been reported by CryptoBilis customers.

The March 2026 date is a precautionary measure. It does not mean that every device sold during this period has been tampered with.

How the Suspected Hardware Implant Works

The incident was reported by a customer in Indonesia who purchased a Trezor Safe 5 through CryptoBilis on Tokopedia in August 2026.

According to the customer’s report, an additional circuit board was installed between the wallet’s main board and its screen. The component reportedly contains a cellular module and antenna.

This hardware may be able to capture information displayed on the wallet screen, including recovery phrases, and transmit that information over a mobile network when the device is connected to power.

If confirmed, this would create a serious security risk. Anyone who obtains a wallet’s recovery phrase could potentially restore it on another device and gain control of the funds.

Trezor reviewed photographs and spoke with the customer over a video call. The device is now being sent to the company’s security laboratory for further investigation. Until testing is complete, the reported implant’s capabilities have not been independently confirmed.

The incident also highlights a wider risk involving counterfeit or physically modified crypto hardware. In another case, fake crypto wallet screens were reportedly used to trick users into revealing their recovery phrases.

Connection to the Ledger Hardware Incident

This warning follows a separate investigation involving Ledger devices sold through the same reseller.

Ledger reportedly began investigating customer fund losses on October 9 and later confirmed physical tampering in some devices. Trezor removed CryptoBilis from its authorized reseller network on the same date.

However, Trezor has not confirmed whether the incidents involve the same attackers or a connected operation. The company is working with Ledger and other security teams to investigate the matter.

The customer who reported the suspected Trezor implant had already transferred their funds before discovering the issue. Trezor says it has not received similar reports involving devices purchased from other resellers.

What Trezor Users Should Do Now

Trezor recommends that customers who purchased devices through CryptoBilis from March 2026 onward take precautions.

• Create a completely new wallet with a freshly generated recovery phrase.
• Transfer all funds from the existing wallet to the new one.
• Do not reuse the old recovery phrase on another device.
• If the device has not been set up, do not use it or enter an existing recovery phrase.
• Contact official Trezor Support to check replacement options.

Simply restoring an existing wallet on another device is not enough because the old recovery phrase may already be exposed.

Trezor also advises users not to open or weigh their devices to check for tampering. These methods cannot reliably identify a modified wallet.

Eligible customers can contact Trezor Support for a replacement device or a voucher. They should keep their original device for investigation.

Important: Never share your recovery phrase with anyone, including someone claiming to be from Trezor Support. The company will never ask users to provide their recovery words.

The incident is a reminder that crypto security depends on more than software protection. Buying hardware wallets from trusted sources and protecting recovery phrases are equally important.

The post Crypto Wallet Spyware Targets Recovery Phrases appeared first on First Hackers News.

Researchers from Zimperium’s zLabs team discovered a large network of websites distributing these exploits. Their investigation, published on October 29, 2026, identified 608 domains associated with Coruna-related attacks.

The malicious websites check which iOS version a visitor is running and use the corresponding exploit chain. Devices running iOS 17.2.1 or older are targeted with Coruna, while newer devices running iOS 18 may receive the DarkSword exploit chain.

Researchers also linked 93 of the identified domains to 21 tracking servers.

How Coruna and DarkSword Infect iPhones

The campaign uses websites that appear to offer ordinary online services. Researchers discovered malicious pages disguised as dating platforms, AI chat services, cryptocurrency promotions, and streaming websites.

Once someone visits one of these pages, hidden scripts can load the exploit without displaying an obvious warning.

Some websites also encourage visitors to open links in Safari. This helps the malicious code run in the browser environment it is designed to target.

The two exploit kits use different techniques:

• Coruna: Uses Safari and WebAssembly-related weaknesses to access browser memory and bypass security protections.
• DarkSword: Uses several stages to move beyond the browser and reach other iOS system processes.

The Coruna chain includes CVE-2022-48503, which involves a WebAssembly-related Safari vulnerability. After gaining access, its components attempt to reach deeper parts of the operating system.

DarkSword follows a different route. It reportedly moves from browser execution through the GPU process and into a system service called mediaplaybackd.

Stolen Data and Hidden Malware Activity

The researchers examined DarkSword on an iPhone running iOS 18.6.2. During testing, the device contacted an attacker-controlled server 144 times and downloaded seven additional modules.

Some of these components were designed to collect information stored on the device.

The investigation found evidence of capabilities involving:

• Reading Telegram’s local application data.
• Collecting the Apple Notes database.
• Gathering information about installed applications.
• Communicating with remote attacker-controlled servers.

The malware also uses techniques to make investigation harder. These include removing certain crash records and Safari browsing data.

Researchers have also identified other ways the exploits are being distributed. SafeDep found Coruna-related malicious code inside a compromised npm package called art-template. Websites using affected package versions could unknowingly serve the malicious code to their visitors.

Another case involved a fake jQuery file hosted on a domain designed to look like Google’s infrastructure.

These findings show that attackers can spread mobile threats through compromised websites and software dependencies, not just suspicious links.

How iPhone Users and Organizations Can Stay Protected

Apple has released security fixes for the vulnerabilities used in these attack chains. Users should install the newest iOS version available for their devices rather than continuing to use older software.

Recommended precautions include:

• Install security updates: Check Settings and update your iPhone to the latest supported iOS release.
• Use Lockdown Mode: People at higher risk, including journalists, activists, and business executives, should consider enabling this protection.
• Avoid suspicious websites: Be careful with unexpected links and requests to open pages in Safari.
• Review mobile devices: Organizations should ensure that company-managed and personal devices used for work receive security updates.
• Monitor suspicious activity: Security teams should investigate unusual crashes, unexpected system behavior, and signs of compromised applications.
• Check website dependencies: Website owners should review third-party scripts and software packages for malicious changes.

The identity of the operators behind these campaigns has not been confirmed. Researchers also caution that code comments or language found in recovered files are not enough to identify the people responsible.

The main concern is that a normal website visit can become an entry point for a serious mobile attack. Keeping devices updated and checking the security of websites and software dependencies are important steps in reducing this risk.

IoCs

The post Coruna and DarkSword Exploits Put iPhone Data at Risk appeared first on First Hackers News.

The research was scheduled to be presented at OffensiveCon in Tokyo on October 28, 2026. It focuses on weaknesses in Telegram’s sticker-processing code and the possibility of bypassing checks designed to block unsafe content.

The findings come amid an earlier disagreement between Telegram and the Zero Day Initiative (ZDI) over a separate security issue involving the same animation-processing technology.

Researchers Investigate Telegram’s Sticker Protection

Animated stickers may look harmless, but the application must process their underlying data before displaying them. If that processing code contains a memory-handling error, specially crafted content could potentially trigger unexpected behavior.

ZDI previously documented a Telegram vulnerability as CVE-2026-111105. The issue affects the rlottie library and involves incorrect handling of numeric values that can result in a memory write outside its intended boundaries.

Telegram argued that checks performed on its servers reduced the likelihood of exploitation. However, the vulnerability report raised concerns about weaknesses that remained in the application itself.

Aziz’s investigation reportedly went further by examining both the animation library and the way Telegram handles incoming stickers. He says he discovered several memory-corruption and logic issues across different Telegram clients.

The reported research suggests that combining these weaknesses could allow an attacker to bypass existing safeguards and execute code on iOS. The exact exploit requirements and impact still need to be established through the full technical disclosure.

How Multiple Weaknesses Could Form an Attack Chain

The research focuses on more than one potential security weakness. Rather than relying on a single bug, the reported method combines problems in animation processing with flaws in the handling and validation of sticker content.

The main areas of concern include:

• Memory safety: Incorrect processing of animation data may cause memory corruption.
• Content validation: Weaknesses in sticker delivery or checking could allow unexpected data to reach vulnerable code.
• Exploit chaining: Combining separate bugs may overcome protections that limit the impact of an individual vulnerability.
• Cross-platform exposure: The researcher reported findings involving iOS, Android, and Desktop versions of Telegram.

These claims are based on the research abstract, not a fully verified technical demonstration. The available information does not establish whether the newly reported issues have been patched or whether attacks have occurred in the wild.

Previous reports have also linked Telegram’s sticker-processing components to application crashes and other security weaknesses. However, those earlier findings are separate from the latest claimed iOS attack chain.

Steps Users and Security Teams Should Take

Until more technical details become available, Telegram users should keep their applications updated and remain cautious when receiving unexpected content.

Recommended precautions include:

• Install the latest Telegram version available for your device.
• Review privacy settings for messages, groups, and unknown contacts.
• Avoid interacting with suspicious content from unfamiliar accounts.
• Monitor official Telegram security announcements for confirmed fixes.

Application developers should also ensure that security checks are enforced within client software rather than relying entirely on server-side filtering.

The key takeaway: A media-processing vulnerability can become more serious when combined with weaknesses elsewhere in an application. However, the severity of this reported Telegram attack cannot be confirmed until the full technical findings and remediation status are available.

The post New Telegram Zero-Click Exploit Targets iOS Devices Through Stickers appeared first on First Hackers News.

The attacks involve two critical PHP engine flaws, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. Both have a reported CVSS v4.0 score of 9.2 and could allow remote command execution without requiring an attacker to log in.

Although PHP published fixes on October 21, 2026, exploit scripts appeared online soon afterward. This creates a serious challenge for organizations that have not yet updated their systems.

How the PHP2Shell Vulnerabilities Work

The flaws affect PHP’s internal processing rather than a specific website’s application code. As a result, even a well-written website may remain at risk if its underlying PHP environment is vulnerable.

The PHP project identifies Apache configurations that run PHP through the mod_php module as particularly concerning, because exploitation may occur before the website’s own code executes.

Researchers from Akatsuki Legion reported finding attackers using publicly available exploit code. Their analysis linked the exploit chain to a researcher known as 9bie and described proof-of-concept scripts appearing on GitHub after the fixes were released.

The two vulnerabilities work together in the reported exploit chain:

• CVE-2026-109618: A memory-handling flaw associated with upload processing can expose information about the process’s memory.
• CVE-2026-109619: A separate issue involving reused request data can allow information from an earlier request to affect a later one.

The published scripts reportedly combine memory leaks with manipulated data structures to redirect PHP execution and run attacker-selected commands.

Researchers also observed signs of activity around the time of disclosure. Amazon Threat Intelligence reported exploit probing on October 17, before the public release of the patches. Hunt.io later identified three different exploit toolkits in its October 21 telemetry.

What Website Administrators Should Do

The PHP project has released corrected versions for supported branches. Administrators should upgrade to the appropriate version:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

Systems running PHP 8.1 or older require special attention because those branches no longer receive standard updates from the PHP project. Administrators should use a trusted vendor-provided security fix or migrate to a supported release.

Researchers have also reported a possible connection between PHP2Shell activity and Linux botnet operations. Sophos examined a blocked payload resembling a Mirai variant, but found no confirmed evidence that the observed attempt successfully compromised a system.

Security teams should take the following steps:

• Update every PHP installation to a fixed release or a trusted vendor-patched version.
• Restart affected services after patching so that the updated code is loaded.
• Check all deployment types, including Apache modules, PHP-FPM services, containers, and bundled appliances.
• Review web logs for suspicious POST requests involving PHP_SESSION_UPLOAD_PROGRESS.
• Investigate unusual server activity, including unexpected processes, outbound connections, and possible botnet behavior.

Disabling session.upload_progress.enabled and restarting workers may reduce exposure in some environments, but this is only a temporary measure and does not replace installing the appropriate fix.

For universities and businesses, the main concern is that public exploit code reduces the effort needed to attack vulnerable servers. Prompt patching, complete asset inventories, and careful log review can help reduce the risk of website compromise.

IoCs

The post PHP2Shell Exploit Targets Universities and Business Websites appeared first on First Hackers News.

According to researcher Sunil Tripathy, the attack involves hidden instructions placed in a public repository. When ChatGPT reviews the repository, the instructions may influence the AI agent to perform actions in another private repository connected to the user’s account.

The researcher assigned the finding a CVSS 4.0 score of 9.3. This is the researcher’s assessment, not a confirmed vendor rating. His testing reportedly used accounts he controlled and a dummy secret.

How the Attack Could Work

The reported attack uses a technique called indirect prompt injection, in which an AI system encounters malicious instructions inside content it is asked to process.

The researcher describes a scenario involving two GitHub accounts: one controlled by an attacker and another belonging to the user who connected GitHub to ChatGPT.

The attack reportedly follows these steps:

• The attacker adds hidden instructions to a public repository.
• The victim asks ChatGPT to review that repository.
• The AI agent follows the malicious instructions and attempts to modify another private repository.
• A GitHub Actions workflow is added and runs automatically.
• The workflow allegedly sends a dummy secret to an external server.

The researcher also reports private repository discovery and unauthorized file changes. These findings have not been independently verified.

What Makes This Report Important?

The reported behavior raises concerns about how AI assistants handle untrusted repository content and permissions granted to connected services.

However, the exact integration involved remains important. OpenAI’s GitHub connection documentation describes the standard ChatGPT GitHub app as read-only, while Codex supports code editing and pushing. This difference means the affected product, permissions, and execution path need clarification.

The researcher says he reported related behavior on September 4, demonstrated the test scenario on September 28, and received an out-of-scope closure on October 14. He also claims the behavior remained reproducible on October 15. These statements do not establish that OpenAI has confirmed the issue or that a security patch is available.

Recommended Security Measures

Organizations using AI tools with GitHub should take steps to limit potential exposure:

• Restrict repository access: Give connected applications access only to repositories they need.
• Review workflow changes: Investigate unexpected GitHub Actions files, commits, and repository modifications.
• Protect sensitive credentials: Avoid exposing secrets to untrusted workflows and rotate credentials if exposure is suspected.
• Review application permissions: Regularly audit connected GitHub apps and remove unnecessary access.

The key lesson is that AI assistants must treat repository content as untrusted input. Limiting permissions and reviewing automated actions can help reduce the impact of malicious instructions.

As AI-powered development tools become more integrated into software workflows, access control and careful handling of untrusted content remain essential parts of software supply chain security.

The post ChatGPT GitHub Integration Flaw: Risks to Private Code appeared first on First Hackers News.

The vulnerability is tracked as CVE-2026-107181 and affects Telegram Desktop versions before 7.2.9. It has a CVSS 4.0 score of 8.6 (High).

Security researcher Beaksec published details of the vulnerability on October 3, 2026, with an update on October 7. VulnCheck assigned the CVE shortly afterward.

The attack relies on a specially crafted link. If the victim clicks the link from outside Telegram while the desktop application is already running, the attacker may be able to interact with Telegram’s local session data.

How the Telegram Desktop Flaw Works

The problem is related to the way Telegram Desktop processes links opened from other applications.

When Telegram is already running, a newly opened link is passed to the existing Telegram process through a local communication mechanism called inter-process communication (IPC).

The vulnerability occurs because Telegram did not properly handle a special character used to separate commands or records within this communication process.

An attacker could place the character inside a specially crafted link. Telegram could then interpret part of the link as an additional command instead of treating the entire content as normal link data.

The issue has been classified as CWE-143, which covers improper handling of record delimiters.

File Theft Could Lead to Account Takeover

The public PoC shows how the flaw could be combined with an older internal Telegram component.

According to the research, the injected command could reach a legacy helper that was originally designed for publishing releases. The component could access local files and send them through Telegram without requiring normal permission checks or confirmation from the user.

This creates a serious risk because Telegram stores local session information on the device.

If an attacker obtains the right session data, they may be able to reuse the victim’s existing Telegram login and gain access to the account.

The researchers demonstrated the attack on Windows using Telegram Desktop 6.9.3 and reported that the issue remained in versions through 7.2.8.

The attack also has some limitations:

• The malicious link needs to be opened outside Telegram.
• Links opened inside Telegram use a different processing path.
• The attack was demonstrated on Windows; the available research does not show the same attack on macOS or Linux.
• Certain automatic download and group-invitation settings can affect the attack chain.
• A browser may display a warning before opening Telegram Desktop.

These conditions are important when assessing the actual risk rather than assuming every Telegram user is automatically vulnerable.

Telegram Releases a Fix

Telegram addressed the vulnerability in September 2026.

The company fixed the issue in a development commit on September 16 and released Telegram Desktop 7.2.9 on September 17.

The changes include removing the vulnerable legacy helper, properly handling the record-separator character, and improving how different types of local messages are processed.

Users should therefore upgrade Telegram Desktop to version 7.2.9 or later.

Until the update is installed, users can reduce their exposure by:

• Avoiding unexpected links that launch Telegram Desktop.
• Disabling automatic file downloads where possible.
• Restricting who can add them to Telegram groups.
• Enabling a local Telegram passcode.
• Reviewing active Telegram sessions for anything unfamiliar.

A public PoC shows that the vulnerability can be exploited under certain conditions, but it does not by itself confirm that attackers are actively using the flaw in real-world campaigns.

The main takeaway is simple: Telegram Desktop users should update to the latest version and avoid opening suspicious links that attempt to launch the application.

The post One-Click Telegram Desktop Exploit Demonstrated in New PoC appeared first on First Hackers News.

File-notification systems are designed to help applications know when files or folders change. However, researchers discovered that the information they provide can also reveal useful clues about what a user is doing.

The research was conducted by researchers at Graz University of Technology. Their study, titled “File Notification Attacks: Templating and Exploiting Side-Channel Leakage from the File-Notification Systems on Linux, Windows, and macOS,” explores how these signals can be used as a side channel.

How the File Notification Attack Works

Linux, Windows, and macOS use different technologies to monitor file-system changes. These include inotify on Linux, ReadDirectoryChangesW on Windows, and FSEvents on macOS.

These services are not vulnerabilities by themselves. They are legitimate features used by applications to respond to changes in files and folders.

The problem is that notifications can contain information such as file paths, timing, and activity patterns. By collecting this information and comparing it with previously recorded examples, malicious software can potentially identify what a user is doing.

Researchers created a semi-automated system that records file-system activity while different actions are performed. These recordings can then be used as templates to recognize similar activity later.

The study found that these patterns could reveal activities including terminal commands, keyboard and mouse input, website visits, printing, virtual machines, containers, VPN changes, Bluetooth activity, and USB-device connections.

The monitoring also had a very small effect on system performance, with the researchers measuring CPU overhead of no more than 0.21% in their tests.

Linux and Windows Show Significant Information Leakage

Linux produced some of the most detailed activity signals in the study. Researchers found that an unprivileged user could receive certain file notifications even when they could not directly read the related files.

This information was enough to identify keystroke patterns in testing involving seven users, with F1 scores ranging from 93.1% to 100%.

The researchers also monitored pseudo-terminal activity over SSH and achieved a 100% F1 score in their test scenario. Passwords entered into terminals with input echo disabled were not observable.

On Windows, the researchers found that monitoring the root of the C: drive could expose file paths associated with another user’s profile, even when the monitoring user did not have permission to access those directories.

Browser activity was another concern. File-system patterns created by browser storage could help identify websites visited by a user. In the study, Firefox activity from 975 of the top 1,000 tested websites could be identified, achieving a 97.8% F1 score in the researchers’ test. Edge produced fewer site-specific patterns and achieved a 48.5% F1 score.

macOS Reveals Less, But Still Exposes Activity

macOS provided stronger separation between users because FSEvents does not freely expose private directories belonging to other users.

However, researchers were still able to identify patterns associated with activities such as application launches, system setting changes, printing, network activity, external storage, Bluetooth devices, and virtual machines.

The average notification latency on macOS was around 11.48 milliseconds, making it slower than the other platforms tested. Despite this, researchers said the information could still be useful for behavioral monitoring.

Importantly, this technique is not a remote attack that can compromise a computer over the internet. Malicious software must already be running on the machine as a local, unprivileged user.

That makes the technique more relevant to post-compromise surveillance, where malware already present on a system attempts to gather additional information about the victim.

Researchers Recommend Stronger Protection

The researchers reported their findings to Linux, Microsoft, Apple, and KDE in October 2025.

Linux introduced a partial mitigation for certain device files in early 2026. Microsoft classified the behavior as being by design and provides the EnforceDirectoryChangeNotificationPermissionCheck policy to restrict certain unauthorized path disclosures. The researchers noted that this setting is disabled by default.

The researchers recommend stronger permission checks that clearly separate files a user owns, files they can read, and protected files belonging to others. They also recommend tighter controls on applications that attempt to monitor large sections of the file system.

Organizations can reduce the risk by keeping systems updated, limiting untrusted software, using application sandboxing, separating service accounts, and applying stricter notification permissions where available.

The research highlights an important security lesson: attackers do not always need to read sensitive data to learn something about a user. File paths, timing information, and system notifications can become valuable sources of intelligence when analyzed together.

The post Hackers Exploit File Notifications to Track User Activity appeared first on First Hackers News.

Instead of sending victims directly to a suspicious website, attackers route them through genuine Google-owned services before taking them to malicious pages.

Trusted Google Services Used as a Cover

The phishing emails use common workplace themes that employees may recognize, including:

Awareness of Google phishing attacks is crucial for organizations to prevent potential data breaches and financial loss.

• Document review requests
• Expiring mailbox warnings
• Package delivery notifications
• Payment alerts
• Voicemail messages
• Government benefit notices

The campaign has targeted employees in sectors such as manufacturing, government, finance, and non-profit organizations.

Security researchers found that attackers are using services such as Google Meet, Google Search, DoubleClick, Custom Search, Image Search, Tag Manager, and Analytics as part of their redirect chains.

Because these are legitimate Google domains, the links can appear less suspicious to both users and automated security tools.

Hidden Redirects Make Detection Harder

The attack does not always reveal the final phishing website immediately. Victims may pass through several legitimate Google services before reaching the attacker-controlled page.

Attackers also hide the victim’s email address inside the URL fragment after the # symbol. In some cases, the information is encoded using Base64.

This technique can make the targeted email address less visible to security systems because browsers normally do not send URL fragments to web servers.

As a result, the attackers can personalize the phishing page while keeping some of the targeting information out of server logs and scanning systems.

Fake Login Pages Target Corporate Credentials

Once the victim reaches the final website, the phishing kit can collect information about the browser and location before displaying the fake login page.

The page may be customized for each victim by:

• Displaying the company’s logo
• Showing a screenshot of the organization’s website
• Automatically filling in the victim’s email address
• Matching the user’s browser language
• Checking whether the target email domain is active

These details make the fake page look much more like a legitimate company login portal.

When a victim enters a password, the stolen information can be sent to the attackers. The page may then show an incorrect password message and ask the victim to try again, potentially allowing the attackers to capture another credential.

Some Victims Face Remote Access Risks

The campaign also includes a fake verification process that can lead to the installation of ScreenConnect, a legitimate remote-management application.

Although ScreenConnect is a genuine business tool, attackers can misuse remote-access software to gain control of compromised systems.

A successful attack could therefore give criminals access to more than just a password. Compromised credentials or remote access may expose:

• Corporate email
• Cloud documents
• Internal applications
• Sensitive business information
• The employee’s workstation

How Organizations Can Protect Employees

Organizations should treat trusted-domain links with the same caution as unfamiliar links. A legitimate Google domain does not automatically mean that the final destination is safe.

Security teams should:

• Monitor for suspicious Google redirect chains.
• Look for unexpected ScreenConnect installations.
• Reset credentials for users confirmed to be compromised.
• Monitor unusual authentication activity.
• Block known malicious indicators at DNS and proxy layers.
• Watch for suspicious Telegram Bot API traffic.
• Report malicious redirect URLs to Google and security providers.

Final Thoughts

This campaign shows how attackers are adapting traditional phishing techniques by hiding malicious activity behind services that users and security systems already trust.

The key lesson is simple: trusted domains can be abused. Employees should verify the final destination of a link, avoid entering credentials on unexpected pages, and treat unusual verification or software-installation requests as potential warning signs.

Indicators of compromise

The post Hackers Exploit Google Services in New Phishing Attacks appeared first on First Hackers News.

The attackers are not primarily interested in getting developers to install the packages. Instead, they are using the packages as a place to store deceptive web pages. Because those pages can be accessed through well-known package-hosting domains, the links may appear more trustworthy to unsuspecting users.

The campaign was discovered by OX Security, which found that the affected packages contained similar HTML-based phishing content. Some of the packages were receiving hundreds of downloads each week before they were taken down.

Trusted Domains Used to Build Trust

The malicious packages include HTML files designed to resemble familiar security verification pages, including fake Cloudflare CAPTCHA screens.

When someone opens one of these files through a package mirror, hidden JavaScript can communicate with external infrastructure controlled by the attackers. The visitor can then be sent to another website chosen by the attackers.

This approach gives criminals an advantage: the initial link may point to a legitimate package-mirror domain rather than a newly created suspicious website.

Services such as unpkg and other npm mirrors are commonly used by developers, making them difficult to block across an organization.

The destination can also be changed later, meaning the same hosted file could potentially be used to send visitors to different phishing campaigns.

ClickFix Makes the Attack More Dangerous

The campaign is particularly concerning because it can be connected to the growing ClickFix attack technique.

ClickFix campaigns typically show victims a fake verification message and instruct them to perform an action, such as copying a command and running it on their computer. Instead of exploiting a technical vulnerability, the attacker relies on the victim to complete the dangerous step.

Security teams should therefore watch for unusual activity involving package mirrors, especially when employees are accessing HTML files directly rather than downloading normal development dependencies.

Developers should also be careful with package links received through emails, messages, tickets, or search results. A familiar domain does not guarantee that every file hosted on it is safe.

Most importantly, never run a command simply because a webpage claims it is required to complete a CAPTCHA, security check, or verification process.

This campaign demonstrates how attackers are finding creative ways to hide phishing infrastructure inside services that organizations already trust.

Indicators of compromise (IoCs):-

The post npm Packages Exploited for ClickFix Phishing appeared first on First Hackers News.