Researchers demonstrated that the vulnerability can be exploited to modify a SUID binary, such as /usr/bin/su, allowing attackers to execute code with root privileges. The issue affects Linux kernel v6.16-rc1 and later on systems using a 4 KB page size.

How the Vulnerability Works

The flaw is caused by improper validation of directory entry sizes before they are copied into the kernel page cache. When an oversized directory entry is processed, it can trigger a small memory overflow beyond the page boundary.

Researchers showed that this overflow can corrupt cached executable files, including SUID binaries such as /usr/bin/su. When the modified binary is executed, the injected code runs with root privileges before the normal authentication process begins, allowing attackers to gain full control of the system.

To successfully exploit the vulnerability, an attacker must:

• Have local access to the system.
• Be able to mount a FUSE filesystem.
• Create a specially crafted directory entry.
• Trigger the vulnerable code path through FUSE operations.

Affected Systems and Mitigation

The vulnerability becomes practically exploitable on Linux kernel v6.16-rc1 and later, after changes that increased the FUSE directory read buffer size. Systems using a 4 KB page size are affected, while systems with larger page sizes are not vulnerable to this specific overflow.

The Linux kernel developers have released a patch that prevents oversized directory entries from being cached, eliminating the overflow condition.

Organizations should take the following steps to reduce risk:

• Update affected Linux systems with the latest kernel patches.
• Restrict or disable unprivileged FUSE mounts where possible.
• Disable unprivileged user namespaces if they are not required.
• Remove the setuid permission from fusermount3 when it is not needed.
• Monitor systems for unauthorized local privilege escalation attempts.
• Review systems for unusual activity involving FUSE filesystems and SUID binaries.

Although this vulnerability requires local access, it highlights how a small flaw in a kernel subsystem can lead to complete system compromise. Prompt patching, restricting unnecessary FUSE access, and limiting local privileges are the most effective ways to reduce the risk of exploitation.

The post Linux FUSE Vulnerability Allows Root Access appeared first on First Hackers News.

This activity has been closely analyzed by Mauro Eldritch, who has documented how this campaign is impacting high-value macOS users, especially in fintech and crypto sectors.

Initial Access and Social Engineering Flow

The attack typically begins with targeted outreach on Telegram, where threat actors impersonate trusted contacts such as colleagues or business partners. Victims—often executives or developers—receive urgent meeting requests designed to trigger quick action.

They are then redirected to phishing pages that closely resemble platforms like Zoom, Microsoft Teams, or Google Meet. These pages claim a technical issue and instruct the user to fix it manually.

Instead of a traditional exploit, the victim is guided to copy and execute a Terminal command. Because this action is user-initiated, many security tools interpret it as legitimate behavior.

Execution Chain and Malware Behavior

Once the command is executed, the infection chain unfolds in multiple stages designed to blend in with normal macOS activity.

• The first-stage binary (commonly seen as teamsSDK.bin) acts as a downloader that retrieves additional components
• Fake macOS applications are dropped, mimicking meeting tools or system prompts to appear legitimate
• These apps repeatedly request user passwords, often using poorly written prompts to trick the victim
• A secondary module (such as D1YrHRTg.bin) performs deep system profiling using native tools like sysctl

The profiling stage gathers extensive system intelligence, including host identifiers, operating system details, running processes, network configuration, and browser-related data from Chrome, Safari, Brave, and similar applications.

Interestingly, researchers observed flaws in parts of the malware. Some profiling components enter continuous loops, repeatedly sending the same data to command-and-control infrastructure, which can cause noticeable performance issues on infected machines.

To avoid execution barriers, the malware leverages macOS utilities like codesign to apply ad-hoc signatures, helping malicious binaries run under standard policies without raising immediate suspicion.

Credential Theft and Data Exfiltration

The final stage of the attack is handled by a stealer component referred to as macrasv2. This module focuses on extracting high-value data from the compromised system.

Targets include:

• Browser-stored credentials and active session cookies
• macOS Keychain entries containing saved secrets
• Files that can grant access to SaaS platforms, internal systems, or crypto wallets

All collected data is compressed into archive files (for example, user_ext.zip) and exfiltrated to attacker-controlled servers.

Persistence Mechanism

To maintain long-term access, additional components like minst2.bin are deployed. These create persistence by placing disguised binaries—often pretending to be legitimate services like OneDrive—inside directories labeled as security-related (such as an “Antivirus Service” folder).

The malware then registers itself as a LaunchAgent, ensuring execution every time the user logs in.

Why This Campaign Is Effective

This attack stands out because it avoids traditional exploitation techniques. By relying on user-executed commands and built-in macOS tools, the activity appears normal to many EDR solutions until after credentials and access tokens are already compromised.

For organizations where macOS devices are widely used—especially among developers and leadership—this creates a serious risk. A single compromised system can lead to broader access across internal infrastructure and financial assets.

Detection and Defensive Considerations

To counter this type of campaign, defenders need to shift focus toward behavior rather than just exploits.

• Monitor unusual Terminal activity and command execution patterns
• Identify and block ClickFix-style phishing workflows
• Regularly audit LaunchAgents for suspicious or disguised entries
• Track outbound connections to uncommon ports or Telegram-related infrastructure
• Use sandbox environments like ANY.RUN to safely analyze suspicious files, URLs, and execution chains

Interactive sandboxing plays a key role in understanding how these multi-stage attacks operate, allowing defenders to reconstruct the full infection path and extract indicators for detection.

The post Lazarus Delivers “Mach-O Man” macOS Malware via ClickFix appeared first on First Hackers News.

This campaign involves a Linux version of the GoGra backdoor, showing that the group is expanding beyond its earlier Windows-based operations. By using trusted cloud services, the malware blends into normal network traffic, allowing it to bypass many standard security tools that typically look for suspicious external connections.

The attack appears to focus on espionage rather than financial gain. Evidence suggests that targets are mainly located in South Asia, with attackers using region-specific document names to make their phishing attempts more convincing. This level of targeting shows a carefully planned and strategic operation.

Outlook Mailbox Malware Explained

The attackers gain access through social engineering, tricking users into opening files that appear harmless. These files are often disguised as official documents, but they actually contain hidden malicious code.

Once the file is opened, the malware quietly installs itself in the background. It avoids drawing attention while setting up persistence, ensuring it can continue running even after the system is restarted.

Some key characteristics of the infection process include:

• Disguised files that look like PDFs or official documents
• Malware hidden inside Linux executable files
• Silent installation without visible signs
• Persistence mechanisms that allow it to survive reboots

This approach makes it difficult for users to realize they have been infected until much later.

How the Backdoor Uses Microsoft Infrastructure

What makes this attack particularly sophisticated is how it uses Microsoft’s own services as a communication channel. Instead of connecting to suspicious servers, the malware interacts with legitimate cloud infrastructure, which helps it stay hidden.

After installation, the backdoor uses Microsoft APIs to communicate with a real Outlook mailbox. It regularly checks for new messages that contain instructions from the attacker. These commands are processed on the infected system, and the results are sent back through email responses.

The malware is designed to clean up after itself, deleting messages once they are used. This reduces traces of the attack and makes forensic investigation more difficult.

The main capabilities of the backdoor include:

• Receiving commands through Outlook mailbox messages
• Executing those commands on the infected machine
• Sending results back via email
• Removing evidence after communication

Because all of this happens through trusted services, the activity can easily go unnoticed in normal network monitoring.

Why This Attack Is Concerning

This campaign highlights a growing trend where attackers abuse legitimate platforms to hide their operations. By using trusted services like Microsoft’s cloud, they can bypass many traditional defenses that rely on detecting suspicious traffic.

The impact of such an attack can be serious. Attackers may gain long-term access to systems, collect sensitive data, and monitor user activity without being detected. Since the malware operates quietly and removes traces of its actions, it can remain active for extended periods.

This also shows how threat actors are evolving their techniques, moving toward more stealthy and persistent methods. Organizations can no longer rely only on basic perimeter defenses and must adopt more advanced monitoring strategies.

To reduce risk, security teams should pay close attention to unusual system behavior, unexpected background services, and abnormal use of cloud APIs. Monitoring activity from endpoints that do not typically interact with such services can help identify potential threats early.

‍Follow Us on:Linkedin, Instagram, Facebook to get the latest security news!

The post Hackers Hide GoGra Backdoor in Outlook Mailboxes appeared first on First Hackers News.

This issue, identified as CVE-2024-3094, impacts versions 5.6.0 and 5.6.1. The injected code is designed to stay hidden during normal review processes and only becomes active during the software build stage. Once active, it can interfere with SSH authentication, potentially allowing attackers to gain unauthorized access to affected systems.

Technical Impact and Mitigation

The attack is highly sophisticated, as the malicious components are not fully visible in the main source code. Instead, they rely on additional build-time elements to assemble and execute the payload. This makes detection difficult using standard code inspection methods.

Once deployed, the compromised library can alter how SSH authentication behaves, creating an opportunity for attackers to bypass normal security checks and access systems remotely.

Key highlights:

• CVE-2024-3094 affects xz and xz-libs versions 5.6.0 and 5.6.1
• Malicious code is triggered during the build process
• Targets SSH authentication mechanisms
• Impacts Fedora Rawhide, Fedora 40 Beta, Debian unstable, and openSUSE
• Red Hat Enterprise Linux (RHEL) remains unaffected

‍Follow Us on:Linkedin, Instagram, Facebook to get the latest security news!

Immediate Actions

• Downgrade to trusted xz version 5.4.x
• Stop using Fedora Rawhide until systems are secured
• Apply official patches and updates from Red Hat
• Monitor systems for unusual SSH behavior

Even though active exploitation has not been widely reported, the nature of this compromise makes it a high-risk issue. Prompt action is necessary to protect systems from potential unauthorized access.

The post xz Backdoor Vulnerability Exposes Linux Systems to Remote Access appeared first on First Hackers News.

ShadowHS is built from a modified version of a legitimate utility and turned into a full post-exploitation toolkit. It avoids writing anything to disk, hides its process identity, and executes through memory-based techniques that bypass many antivirus and file-monitoring defenses. The infection chain uses encrypted loaders and carefully rebuilds the payload directly in memory before running it.

The final program is launched directly from memory and often imitates trusted processes, such as Python-related services, to reduce suspicion.

Human-Controlled and Stealth Focused

ShadowHS stands out because it does not behave like typical automated malware. Instead of launching noisy actions right away, it stays quiet at first. The framework focuses on studying the system, identifying security defenses, and ensuring the environment is safe for continued access. This careful, low-profile behavior suggests direct human control rather than a fully automated attack.

The tool gathers detailed information about installed security products by checking system paths, running services, and protection components. The findings help operators understand what defenses are active before deciding on the next step.

It also includes logic to remove other malicious programs that may already be present. By scanning for known malware, cryptominers, hidden kernel components, and suspicious in-memory programs, it tries to take exclusive control of the system.

Beyond that, the framework examines the system’s overall defense posture, reviewing kernel protections, loaded modules, and process activity to detect monitoring or security instrumentation.

For data theft, ShadowHS uses less common communication methods instead of standard tools like SSH or file transfer utilities. It creates hidden channels using user-space tunneling techniques, allowing files to be moved without triggering typical network monitoring alerts. Because of how these tunnels work, the traffic can appear local while actually being redirected externally, helping the activity remain unnoticed.

Security Measures

When fully activated, ShadowHS can start hidden crypto mining, scan networks to move sideways, and try to collect credentials from systems, cloud services, and virtual platforms.

Since it runs in memory and avoids writing files, regular antivirus tools may not detect it. Protection depends more on watching system behavior than scanning files.

To lower the risk:

• Monitor unusual process and memory activity
• Track suspicious command-line behavior
• Use deeper system and kernel-level monitoring
• Limit what applications can do at runtime
• Watch for strange or hidden network connections

This threat shows that modern Linux attacks are becoming quieter and more controlled, making behavior-based detection more important than ever.

Indicators of Compromise (IOCs)

‍Follow Us on: Linkedin, Instagram, Facebook to get the latest security news!

The post ShadowHS Linux Malware Spreading Quietly appeared first on First Hackers News.

What Are These Linux Vulnerabilities?

CVE-2025-6018: PAM Misconfiguration

This flaw in openSUSE Leap 15’s Pluggable Authentication Modules (PAM) lets unprivileged users gain “allow_active” status, granting unauthorized Polkit actions. By treating SSH sessions as local, attackers can escalate privileges, paving the way for deeper exploits.

CVE-2025-6019: Udisks Daemon Flaw

Exploiting libblockdev via the udisks daemon—a default component in most Linux distributions—this vulnerability allows attackers with “allow_active” status to achieve root privileges. Qualys TRU’s proof-of-concept exploits confirmed rapid root access on Ubuntu, Debian, and Fedora.

CVE-2025-6020: PAM Namespace Issue

A path traversal vulnerability (CVSS: 7.8) in Linux PAM (up to 1.7.0) enables symlink attacks and race conditions in pam_namespace. Fixed in Linux PAM 1.7.1, it poses a root escalation risk if unpatched.

Chained together, these flaws create a dangerous “local-to-root” path, enabling data theft, ransomware, and backdoor implantation.

Why These Flaws Matter

With udisks installed by default, most Linux systems are vulnerable. As Qualys TRU’s Saeed Abbasi noted, “The exploit’s simplicity and udisks’ ubiquity make this a universal threat.” Root access allows attackers to cause operational downtime or lateral movement in networks, threatening enterprises and individuals.

Protect against these Linux security flaws with these steps:

• Patch Immediately: Update to Linux PAM 1.7.1, patched libblockdev, and udisks. Check Ubuntu’s Security Notices or Fedora’s Updates.
• Disable PAM Namespace: Mitigate CVE-2025-6020 by disabling pam_namespace or securing namespace.init.
• Monitor Systems: Use threat intelligence tools to detect exploit attempts.
• Limit Access: Restrict privileges to minimize lateral movement risks.

The post Critical Linux Vulnerabilities Expose Systems to Root Access Exploits appeared first on First Hackers News.

New Rust Code in Linux Kernel

Rust reduces memory safety bugs, data races, and logic errors, making it ideal for kernel development.

It simplifies writing drivers and modules with modern abstractions and enforces documentation for APIs, safety checks, and ‘unsafe’ blocks.

Rust was officially merged into the Linux kernel in October 2022, with companies now dedicating engineers to its development.

Rust integration in Linux is expanding across subsystems, with drivers like PHY, Null Block, and Apple AGX GPU in development.

The Linux 6.13 merge added Rust misc driver bindings, paving the way for more Rust drivers. Greg Kroah-Hartman sees this as a turning point for adoption.

The next merge window may bring PCI and platform drivers, further strengthening Rust’s role in Linux.

With increased security benefits, support from Miguel Ojeda, and backing from the Alpha-Omega project, Rust for Linux is shaping a safer kernel future.

Kernel maintainer Jonathan Corbet confirmed Rust’s viability, highlighting its importance for Linux’s future.

The post New Rust Code in Linux Kernel Addresses Memory Bugs appeared first on First Hackers News.

GRUB2 Vulnerability

GRUB2’s critical role in booting operating systems makes it a prime target for attackers. Researchers found multiple flaws in filesystem drivers, including integer overflows in UFS, HFS+, and ReiserFS.

• CVE-2025-0677: Crafted symlinks in UFS partitions can cause buffer overflows.
• CVE-2024-45782: Unvalidated HFS volume names can overwrite heap metadata.
• CVE-2025-0624: Malicious DHCP servers can exploit GRUB2’s network stack, leading to remote code execution before the OS loads.

“These flaws allow attackers to compromise systems before security protections activate,” said Red Hat engineer Marco A Benatto.

Seven vulnerabilities arise from insufficient bounds checking in filesystem drivers:

• CVE-2025-0678 (Squash4) & CVE-2025-0685 (JFS): Malicious size values trigger out-of-bounds writes during file reads.
• CVE-2025-0686 (ROMFS): Integer overflow in symlink resolution corrupts heap structures.
• CVE-2024-45774: Crafted JPEGs in boot themes or EFI partitions can overwrite memory via duplicate SOF0 markers, enabling persistence.
• CVE-2025-0622: Use-after-free in the GPG module allows execution of rogue payloads, threatening UEFI Secure Boot.
• CVE-2025-1118: Unsecured memory dumps risk exposing cryptographic secrets under Secure Boot.

“These flaws bypass integrity checks by exploiting legitimate filesystem operations,” said Oracle’s Jan Setje-Eilers.

To address GRUB2 security flaws, updates must be applied to GRUB2, shim, and SBAT metadata, as traditional UEFI revocation lists (dbx) won’t be used.

• Update Requirements: Vendors must rebuild boot artifacts using SBAT generation 5 or higher to ensure component-level revocation.
• Patch Deployment: Major Linux distributions like Red Hat, SUSE, and Oracle Linux began releasing updates on February 25, 2025.
• Residual Risks: Legacy systems and embedded devices remain vulnerable due to infrequent update cycles.
• Security Implications: Unpatched systems could compromise network-wide Secure Boot integrity.

Key Takeaways for Administrators

• Prioritize Bootloader Updates: Ensure GRUB2 and related components are patched.
• Verify SBAT Status: Use tools like mokutil to check compliance.
• Enhance Security Practices: Developers should adopt memory-safe coding to prevent future vulnerabilities.

As attackers target low-level components, cross-industry collaboration remains vital in securing firmware and maintaining system integrity.

‍Follow Us on: Twitter, Instagram, Facebook to get the latest security news!

The post GRUB2 Vulnerabilities Put Millions of Linux Devices at Risk appeared first on First Hackers News.

Found between November and December 2024, the malware targets Linux systems, mainly in universities and government offices in North America and Asia.

It uses advanced techniques to remain undetected, including disguising itself with harmless file names like “door” or “egg” and employing a malicious library, libcext.so.2, to mimic legitimate system files.

Installation and Root Privilege Exploitation

When executed, Auto-Color checks if its file name is “Auto-color.” If not, it renames itself and installs a hidden library implant. The installation requires the user to have root privileges.

Without root access, the malware is limited in its actions but still remains a threat in later stages. With root access, it installs the libcext.so.2 library in the system’s base directory and alters files like /etc/ld.preload for persistence. This change lets the malware load its library first, overriding key system functions.

Auto-Color uses custom encryption to hide its configuration and C2 server communication, making it hard to detect. It encrypts payloads with a stream cipher and manipulates system files, like /proc/net/tcp, to conceal network activity.

The malware also hides C2 connections by removing traces of specific IPs or ports, making its operations difficult to track, similar to techniques used by Symbiote but more advanced.

Once installed, Auto-Color gives attackers full remote access, including:

• Establishing reverse shell connections
• Acting as a proxy for further attacks
• Manipulating files and running programs
• Sending and changing global configuration data

It communicates with C2 servers using a custom encrypted protocol. Commands trigger actions like gathering system data or uninstalling itself.

Indicators of compromise include files with names like “log,” “edu,” or “door,” each with the same size (229,160 bytes) but different hashes due to encrypted payloads. Suspicious changes to /etc/ld.preload or unusual network activity could also indicate infection.

Palo Alto Networks recommends using Cortex XDR and Advanced WildFire to detect and block Auto-Color. Organizations should monitor for IoCs and use strong endpoint protection. In case of infection, consult incident response teams like Unit 42 for remediation.

This highlights the need for proactive threat detection and response against increasingly advanced Linux malware.

Indicators of Compromise

Malicious files from Auto-Color:

SHA256 hash: 270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43

• File size: 229,160 bytes
• File name: log
• File type: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked
• File description: Sample 1 malware from Auto-color

SHA256 hash: 65a84f6a9b4ccddcdae812ab8783938e3f4c12cfba670131b1a80395710c6fb4

• File size: 229,160 bytes
• File name: edus
• File type: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked
• File description: Sample 2 malware from Auto-color

SHA256 hash: 83d50fcf97b0c1ec3de25b11684ca8db6f159c212f7ff50c92083ec5fbd3a633

• File size: 229,160 bytes
• File name: egg
• File type: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked
• File description: Sample 3 malware from Auto-color

SHA256 hash: a1b09720edcab4d396a53ec568fe6f4ab2851ad00c954255bf1a0c04a9d53d0a

• File size: 229,160 bytes
• File name: edu
• File type: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked
• File description: Sample 4 malware from Auto-color

SHA256 hash: bace40f886aac1bab03bf26f2f463ac418616bacc956ed97045b7c3072f02d6b

• File size: 229,160 bytes
• File name: door
• File type: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked
• File description: Sample 5 malware from Auto-color

SHA256 hash: e1c86a578e8d0b272e2df2d6dd9033c842c7ab5b09cda72c588e0410dc3048f7

• File size: 229,160 bytes
• File name: exup
• File type: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked
• File description: Sample 6 malware from Auto-color

SHA256 hash: 85a77f08fd66aeabc887cb7d4eb8362259afa9c3699a70e3b81efac9042bb255

• File size: 229,160 bytes
• File name: law
• File type: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked
• File description: Sample 7 malware from Auto-color

SHA256 hash: bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca

• File size: 35,160 bytes
• File name: libcext.so.2
• File type: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked
• File description: Library Implant from Auto-color

Malicious C2 IP Addresses from Auto-Color:

• 146[.]70[.]41[.]178:443 – log sample
• 216[.]245[.]184[.]214:443 – edus/egg sample
• 146[.]70[.]87[.]67:443 – edu/door sample
• 65[.]38[.]121[.]64:443 – exup sample
• 206[.]189[.]149[.]191:443 – law sample

‍Follow Us on: Twitter, Instagram, Facebook to get the latest security news!

The post Linux Systems Under Attack: New Auto-Color Malware Grants Remote Access appeared first on First Hackers News.

The group employs advanced evasion techniques, cross-platform encryption, and exploits vulnerabilities in enterprise infrastructure. Group-IB analysts report that RansomHub has compromised over 600 organizations, including those in healthcare, finance, and critical infrastructure.

Multi-OS Encryption Capabilities

RansomHub’s ransomware adapts to different platforms, using specific commands and encryption methods for each.

For Windows, a PowerShell command runs the ransomware with options to set a password, disable networking, and skip certain virtual machines:
powershell RansomHub.exe -pass <SHA256> -fast -disable-net -skip-vm "VM1"

A JSON file, decrypted at runtime, controls whitelisted directories, process termination lists, and credentials for spreading within networks.

The ESXi encryptor, written in C++, shuts down virtual machines with vim-cmd and encrypts files like .vmdk and .vmx using ChaCha20 and Curve25519 encryption. A flaw in the /tmp/app.pid check lets defenders stop encryption by writing -1 to the file, forcing an infinite loop.

Example ESXi code:

if (access(“/tmp/app.pid”, F_OK) == 0) {
pid_t pid = read_pid();
if (kill(pid, 0) == 0) {
kill(pid, SIGKILL);
exit(0);
}
}

The Linux version encrypts files in 1 MB chunks and disables syslog to avoid detection.

On FreeBSD, the ransomware, detected as Ransom.FreeBSD.INTERLOCK.THJBBBD, skips important system folders (/boot, /etc) and adds .interlock to encrypted files.

RansomHub spreads by exploiting known vulnerabilities like CVE-2024-3400 (Palo Alto firewalls) and CVE-2021-42278/CVE-2020-1472 (Active Directory).

The post RansomHub Now Targets Windows, ESXi, Linux, and FreeBSD appeared first on First Hackers News.