Microsoft links hotel Wi-Fi attacks to Russian APT29, new malware

Microsoft ties CaptiveCrunch hotel Wi-Fi attacks to Russian APT29 sub-cluster

The attackers redirect victims to phishing pages impersonating Microsoft 365 login portals or abuse Microsoft Entra ID authentication flows via device code phishing. A third technique uses fake browser and operating system update pages that deliver malware to Windows via ClickFix prompts, with some landings also targeting Android devices with an APK file. CornFlake is a Go-based remote access trojan offering remote shell access, keylogging, clipboard monitoring, screenshot capture, microphone and webcam surveillance, and theft of browser credentials, cookies, and Microsoft 365 session tokens. ChocoShell is an in-memory PowerShell credential stealer targeting browser cookies, saved passwords, Microsoft 365 and Azure AD tokens, and Wi-Fi credentials. Microsoft assesses that AI tools were likely used to develop the malware based on extensive comments in the code. The company recommends treating hotel and conference Wi-Fi as untrusted, using private cellular or managed connections, and adopting phishing-resistant authentication with MFA and passkeys.

Hotel Wi-Fi attacks use custom malware to breach Microsoft 365 accounts →

Pass-ta-key attacks let malware hijack Google-synced passkeys in Chrome

The second technique, Silver Pass-ta-key, allows attackers to register their own user-verification key with Google’s cloud authenticator by forcing Chrome to re-register the device. The third and most severe, Golden Pass-ta-key, lets malware obtain the master key used to encrypt all passkeys synced through the victim’s Google Password Manager account, known as the security domain secret. Unit 42 found the secret was temporarily sent to Chrome and remained accessible in the browser’s process memory, even after Google removed it from internal FIDO logs. The stolen master key could decrypt future passkeys synced to the account, as Google’s current implementation reportedly provides no way to rotate or revoke the key. The researchers recommend websites require and properly validate user verification, credential managers validate newly registered device keys, and prevent master keys from becoming accessible in browser memory. The findings were disclosed to Google and affected services including eBay before publication.

New Pass-ta-key attacks let malware hijack Google-synced passkeys →

JFrog finds fabricated SQLite CVEs likely AI-generated

The fabricated advisories included references to non-existent functions, contradictory metadata, and line numbers that do not exist in the cited versions. A broader audit of 55 advisories from the same GitHub account found 54 were completely fabricated, while one contained a real bug wrapped in unverified CVE metadata. JFrog notes that the CVE submission process via MITRE’s public form lacks real identity verification, and NIST’s manual analysis paused in February 2024 due to a surge in reports. No step in the current system requires a proof-of-concept or bug reproduction, allowing fake advisories to reach GHSA, downstream databases, and enterprise scanners. These fabricated CVEs can cause organizations to waste time investigating non-existent vulnerabilities, pollute vulnerability databases, and mislead AI-based triage systems. JFrog formally reported its findings to GHSA, Red Hat, and NVD.

SQLite Critical CVEs or LLM Slop? - JFrog Security Research →

AI tool Claude Code unlocks BIOS on HP laptop, bypasses RSA-2048 checks

The AI tool handled the patchwork, resulting in a fully open BIOS on the laptop. A Python script that completes the entire process on this specific HP laptop was shared at the bottom of the Reddit post; it backs up the current BIOS, implements all three patches, and leaves the HP 15-dw1036ne unlocked. The script may not work on other laptops, even other HP 15-dw1036ne units with differences like board revision. The example demonstrates that laptops with locked BIOS access and no known specific bypass method can now be fully unlocked with AI assistance.

AI enthusiast unlocks and mods BIOS with Claude Code — AI defeats RSA-2048 signature checks and unlocks 55 hidden settings | Tom’s Hardware →

DOUBLECUP ClickFix service hides malware in browser cache images

SOCRadar observed DOUBLECUP ClickFix campaigns using fake CAPTCHA prompts on login pages impersonating NetSuite, Odoo, HubSpot, and Salesforce. When a victim visits one of these sites, DOUBLECUP forces the browser to download and cache a malicious PNG image, then displays fake CAPTCHA-style instructions that convince visitors to paste and run a command copied to their clipboard. The command searches the browser cache for the PNG based on its exact file size and uses findstr or certutil to recover and execute the hidden first-stage payload. SOCRadar identified two malware families delivered through DOUBLECUP: an updated version of CountLoader targeting Windows and macOS, and a previously undocumented DeviceManager RAT. DeviceManager is a modular Python-based Windows RAT that uses blockchain smart contracts to determine the IP address of its command-and-control server, making it more resistant to disruption attempts.

New DOUBLECUP ClickFix service hides malware in browser cache images →