Posts in category: Cybersecurity News

In a significant move as part of its rebranding and security overhaul, X formerly Twitter has announced it will stop supporting the old Twitter.com website for two-factor authentication by November 10, 2025. This decision underscores X’s ongoing transition away from its Twitter roots and towards a more secure, streamlined future.

Why This Matters

Two-factor authentication is a crucial security measure, providing an added layer of protection against phishing and unauthorized access. X’s decision to phase out the old Twitter domain for 2FA support primarily impacts users who rely on hardware security keys like YubiKeys for authentication. If you’re among those users, you’ll need to re-enroll your security key by the deadline to avoid any disruptions in accessing your account.

In a blog post, X explained, “By November 10, we’re asking all accounts that use a security key as their two-factor authentication method to re-enroll their key to continue accessing X.” The move aims to enhance security while also supporting the platform’s broader rebranding strategy under Elon Musk’s leadership.

What Does This Mean for Users

If you’re using a hardware security key for 2FA, here’s what you need to do:

1. You’ll need to either update your existing key or register a new one. However, registering a new key will deactivate any prior keys, so make sure both are updated if you’re switching.
2. If you don’t re-enroll by November 10, 2025, your account will be locked. To regain access, you’ll need to either update your security key, switch to an alternative 2FA method like authenticator apps or SMS codes, or, if you choose, disable 2FA altogether. X strongly discourages disabling 2FA, as this would leave your account more vulnerable.
3. X recommends that users back up multiple hardware security keys, especially for high-profile accounts prone to targeted attacks. This ensures you have a fail-safe in case one key is lost or compromised.

The Reason Behind the Change

This change is a direct result of X’s shift to its x.com domain following its 2023 rebrand. The move is aimed at streamlining the platform’s authentication systems while eliminating potential vulnerabilities tied to the outdated Twitter.com infrastructure.

Experts in the field of cybersecurity have applauded this decision, noting that the old domain structure could expose users to domain-spoofing risks. As cybercriminals continue to exploit outdated branding and infrastructure flaws for social engineering attacks, this update will make it harder for bad actors to trick users into giving up their credentials.

What Security Experts Are Saying

The transition to a more modern authentication system aligns with industry trends towards domain-agnostic authentication. As the digital landscape becomes increasingly complex, platforms like X are recognizing the need to break free from legacy systems that could potentially expose users to greater security risks. By removing ties to the old Twitter branding, X is taking a proactive step in safeguarding its user base—an essential move, considering the platform boasts over 500 million active users worldwide.

Cybersecurity experts agree that the phase-out of the Twitter domain for 2FA support is a much-needed step, especially as cyber threats continue to evolve. Phishing attacks, domain spoofing, and social engineering tactics are on the rise, making this update not only timely but necessary to keep users safe.

The Big Picture

This update is part of a larger trend in the tech industry to move away from domain-specific authentication methods. As cybercriminals exploit outdated branding to manipulate users, it’s becoming more important than ever for platforms to modernize their security measures. X’s move to phase out the Twitter.com domain for 2FA reflects the ongoing evolution of digital security, and other platforms may soon follow suit in addressing legacy security concerns.

While there are clear benefits to the update, users must take action now to avoid potential disruptions. By re-enrolling your security keys before the November 10 deadline, you’ll ensure that your account remains secure and fully accessible as X continues to enhance its platform.

The notorious hacker group Mem3nt0 mori has once again made headlines, this time for actively exploiting a critical zero-day vulnerability in Google Chrome. This attack has caused a stir across Russia and Belarus, compromising high-profile targets with alarming precision. Known as CVE-2025-2783, the flaw in Chrome allowed these hackers to bypass the browser’s robust sandbox protections, leading to the deployment of sophisticated spyware on the victim’s machines.

Discovered by Kaspersky’s researchers in March 2025, the vulnerability was swiftly patched by Google. However, by then, the attackers had already used it in a series of well-coordinated cyberattacks. The attacks were part of a larger operation named ForumTroll, a campaign that targeted media outlets, universities, government agencies, and financial institutions. In this piece, we’ll take a closer look at how this attack unfolded and what it means for cybersecurity moving forward.

What is CVE-2025-2783?

CVE-2025-2783 is a flaw in Chrome’s sandboxing system that allowed attackers to escape its confines with minimal user interaction. Sandboxing is a security feature that isolates processes to prevent malicious code from affecting other parts of the system. However, this vulnerability circumvented Chrome’s sandbox defenses, enabling malware to run with elevated privileges and persist in the browser’s process.

The attackers exploited this flaw by crafting phishing emails that lured victims to malicious websites. When victims visited these sites, the exploit was triggered automatically — no downloads or clicks beyond the initial visit were required. This drive-by infection tactic is particularly insidious, as it leverages Chrome’s Mojo inter-process communication system, a key component responsible for managing data between browser processes on Windows.

The Technical Details Behind the Exploit

At the core of the exploit was a subtle logic flaw. Chrome’s code failed to properly validate certain pseudo-handles (e.g., -2, which refers to the current thread), allowing attackers to manipulate the system into duplicating handles across sandbox boundaries. This seemingly innocuous oversight was rooted in outdated Windows optimizations and proved to be a serious vulnerability.

By exploiting this flaw, attackers could execute shellcode within the privileged browser process. Once this access was gained, the attackers could deploy malware, ensuring persistence on the system by circumventing the browser’s sandboxing protections. In short, the attackers had found a way to inject malicious code into the browser’s core, enabling it to run with high-level privileges and evade detection.

The Attack Chain: How It Unfolded

Kaspersky’s Global Research and Analysis Team (GReAT) meticulously reconstructed the attack chain, which unfolded in several stages. Here’s how the attack worked:

1. Phishing Email Validation: The initial stage involved the delivery of a phishing email, crafted to appear legitimate. The attackers used WebGPU, a web graphics API, to confirm that the email was being read by a genuine browser rather than an automated scanner. This made it difficult for security software to detect the attack.
2. Key Exchange and Payload Decryption: If the email was opened in a real browser, the attacker would initiate an elliptic-curve Diffie-Hellman key exchange. This secure key exchange mechanism was used to decrypt the next stage of the attack, which was hidden in benign-looking files like JavaScript bundles and fonts.
3. RCE Exploit: A remote code execution (RCE) exploit was used to inject malicious code into the victim’s system. However, the key element that made this attack particularly dangerous was the ability to bypass Chrome’s sandbox using CVE-2025-2783. Once inside the sandbox, the attacker could hijack browser processes and inject a persistent loader.
4. Persistence via COM Hijacking: The persistent loader used COM hijacking to override Windows registry entries for legitimate system files like twinapi.dll. This ensured that the malware would continue running even after the browser was closed or the system was rebooted.
5. LeetAgent: A Rare Spyware: The loader eventually decrypted and deployed LeetAgent, a highly sophisticated piece of spyware. LeetAgent operated using “leetspeak” commands, which allowed it to conduct keylogging, steal sensitive documents (including PDFs and spreadsheets), and inject itself into other processes. The malware communicated with command-and-control (C2) servers over HTTPS, with traffic obfuscation pointing to commercial origins.

Connections to Memento Labs and Dante Spyware

The technical sophistication of LeetAgent led Kaspersky to link it to Memento Labs, an infamous Italian firm that has been tied to spyware development in the past. LeetAgent’s design bore similarities to Dante, a spyware tool unveiled at the 2023 ISS World conference and attributed to Memento Labs. Dante itself was a rebranded version of software originally developed by the notorious hacking firm Hacking Team.

Dante was known for its advanced obfuscation techniques, including VMProtect encryption, anti-debugging features, and dynamic API resolution to evade detection. The fact that LeetAgent shares code with Dante suggests that Mem3nt0 mori’s operations are closely tied to this commercial spyware market, which has proven resilient despite efforts to shut it down.

The Fallout and Response

After Kaspersky’s discovery, Google quickly issued a patch to fix the CVE-2025-2783 vulnerability in Chrome. Users are urged to update their browsers to version 134.0.6998.177 or later to mitigate the risk. Additionally, experts recommend enabling Chrome’s enhanced safe browsing feature and staying vigilant against phishing attempts, which remain the primary vector for these types of attacks.

Interestingly, Firefox also patched a similar inter-process communication flaw (CVE-2025-2857), highlighting that other browsers may be vulnerable to similar exploits. Security professionals are warning that the risk of pseudo-handle vulnerabilities could extend to other software, so vigilance is critical across all platforms.

The Bigger Picture: The Shadowy Spyware Market

The attack by Mem3nt0 mori underscores a deeper issue within the world of cyber espionage: the persistence of commercial spyware. Despite the closure of notorious firms like Hacking Team, their legacy lives on in the tools developed by companies like Memento Labs. These tools are being used by APT (Advanced Persistent Threat) groups to infiltrate and extract valuable intelligence from high-profile targets.

While the technical details of CVE-2025-2783 and the resulting malware campaign are concerning, they are only one part of the larger picture. As the spyware market continues to evolve, so too does the sophistication of the attacks carried out by groups like Mem3nt0 mori.

Staying Ahead of the Game

The Mem3nt0 mori attack serves as a reminder of the evolving nature of cyber threats and the importance of staying one step ahead in the digital arms race. While patching vulnerabilities is essential, it’s equally important to remain vigilant against phishing attacks, ensure browsers and software are up to date, and be aware of the techniques used by cybercriminals.

As we continue to navigate the cat-and-mouse game of digital espionage, understanding the methods behind these attacks is key to developing better defenses. Whether it’s through zero-day vulnerabilities, social engineering, or sophisticated spyware, the stakes are higher than ever in the battle for digital security.

A widespread outage at Amazon Web Services over the weekend caused massive disruptions across the internet, affecting e-commerce, streaming platforms, and critical enterprise systems that rely on Amazon’s cloud infrastructure.

The incident began late on October 19, 2025, and continued into the early hours of October 20, underscoring how deeply integrated AWS has become in the global digital ecosystem and how even short-lived technical failures can ripple across industries.

The Outage Unfolds

AWS first reported elevated error rates in its US-EAST-1 region at approximately 11:49 PM PDT on October 19. This region, based in Northern Virginia, serves as a major hub for internet traffic and cloud services worldwide.

As systems began to fail, the disruption quickly cascaded, affecting Amazon.com’s retail operations, multiple AWS services, and a wide range of third-party clients, from tech startups to major enterprises.

Users attempting to shop, stream media, or access cloud-hosted resources experienced widespread timeouts, failed logins, and service interruptions. Even AWS’s internal support tools were temporarily impacted.

Root Cause: DNS Resolution Failure

According to AWS’s incident report, engineers traced the root cause to a DNS resolution issue affecting the regional endpoints for DynamoDB, Amazon’s popular NoSQL database service.

The Domain Name System often referred to as the internet phone book failed to properly route traffic to the correct servers, leading to cascading failures across dependent systems.

By 12:26 AM PDT, engineers had implemented corrective measures, and DynamoDB functionality was restored by 2:24 AM PDT. However, secondary effects persisted for several hours.

To stabilize the environment, AWS temporarily restricted the launch of new EC2 virtual machines, a precautionary step designed to prevent further instability during the recovery process.

Gradual Recovery and Service Restoration

Progress toward full recovery continued through the morning of October 20. By 12:28 PM PDT, the majority of AWS services including those supporting high-traffic platforms such as Netflix and several government websites had regained normal functionality.

AWS engineers then began reducing the restrictions on EC2 instance launches while addressing lingering performance issues. Full operational stability was confirmed at 3:01 PM PDT.

Postmortem and Industry Response

In its post-incident analysis, AWS clarified that no evidence of a cyberattack was found, attributing the disruption solely to an internal DNS misconfiguration. The company emphasized its rapid response and the steps taken to prevent recurrence.

Despite the swift recovery, cybersecurity and cloud experts say the incident serves as a stark reminder of the centralized nature of the modern internet.

“Even a short-lived DNS failure can have a disproportionate impact,” said one independent cloud infrastructure analyst. “This outage shows how dependent global businesses are on a handful of core cloud providers — and how critical redundancy and failover planning have become.”

AWS has urged customers to monitor the AWS Health Dashboard for ongoing updates and published a detailed summary of the event on its official website.

Takeaways for the Cloud Industry

While the outage lasted less than a full day, its reach was significant — disrupting everything from online retail and streaming services to government systems and internal enterprise tools.

Experts say the incident highlights three key lessons for organizations operating in cloud environments:

1. Diversify infrastructure to avoid single-region dependency.
2. Implement robust DNS redundancy and real-time monitoring.
3. Plan for fail over and recovery as part of standard business continuity strategies.

As cloud adoption continues to grow, the AWS outage of October 2025 stands as a critical case study in resilience and a reminder that even the most advanced infrastructures are not immune to failure.

Microsoft’s October 2025 cumulative update (KB5066835) for Windows 11 has introduced a disruptive issue that’s impacting developers and IT environments across the board. After installing the update—particularly on build 26100.6899—many users have reported that localhost functionality is broken, rendering local web services and applications unreachable via 127.0.0.1.

Developers began noticing issues immediately after the update was rolled out on October 14, 2025. Applications that rely on local web servers, such as those running via IIS Express or Kestrel, are now frequently throwing HTTP/2 protocol errors like:

• ERR_HTTP2_PROTOCOL_ERROR
• ERR_CONNECTION_RESET

This bug is more than an inconvenience. It’s disrupting core workflows like:

• Debugging in Visual Studio
• Testing ASP.NET applications
• Running desktop software that communicates internally via loopback

Even Chromium-based browser previews are failing in local environments, causing widespread frustration among developers.

The issue isn’t limited to individual users or hobbyist developers. Large software vendors and enterprise customers are affected too.

For instance, Autodesk confirmed that its Vault software has been impacted, advising customers to roll back the update to restore functionality. Posts on Microsoft’s own support forums, Stack Overflow, and Server Fault further confirm this is a global issue affecting production environments, internal business tools, and development setups alike.

Root Cause: HTTP.sys Modifications

Preliminary investigations suggest that the problem originates from changes made to HTTP.sys—the Windows kernel-mode driver responsible for handling HTTP traffic.

Update KB5066835 included security-related updates to HTTP.sys, but these changes seem to have broken HTTP/2 loopback negotiation under certain configurations. Systems that had also installed the September preview update (KB5065789) appear especially vulnerable.

Workarounds and Fixes

Until Microsoft releases an official fix, affected users have reported several temporary workarounds:

Uninstall Recent Updates

Run the following commands in Command Prompt (admin) to remove the offending updates:

wusa /uninstall /kb:5066835
wusa /uninstall /kb:5065789

Then restart your system.

Disable HTTP/2 (Registry Edit)

Navigate to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IIS\Parameters

Create or modify the DWORD key:

EnableHttp2 = 0

Then reboot. (Proceed with caution and backup your registry first.)

Update Microsoft Defender

Some users report that updating Microsoft Defender Antivirus definitions via KB2267602 has resolved the problem without uninstalling the updates entirely.

Notable Observations

• Fresh installs of Windows 11 are not affected, indicating that the bug arises due to conflicts with existing configurations, not a core OS flaw.
• As of October 17, 2025, Microsoft has not officially acknowledged the issue on the KB5066835 update page, though internal responses on support forums hint that engineers are working on a fix.
• A Defender intelligence update or minor patch may already be softening the impact for some users, but success appears to vary by system and setup.

A new and highly advanced banking Trojan, dubbed Maverick, has surfaced in Brazil, exploiting WhatsApp as its main vector to compromise thousands of unsuspecting users. First detected in mid-October 2025, Maverick has already triggered over 62,000 blocked infection attempts within just the first ten days, signaling a significant threat to Brazilian internet users

Maverick targets Brazilian users by sending Portuguese-language WhatsApp messages that include malicious ZIP archives. These archives cleverly bypass WhatsApp’s security filters and contain a weaponized .LNK file, a Windows shortcut file that acts as the Trojan’s entry point.

The infection process begins when victims open these ZIP files, often disguised as bank notifications or important documents. The .LNK file then launches a chain of commands through cmd.exe and PowerShell, connecting stealthily to command-and-control (C2) servers. These servers validate the malware with stringent authentication protocols before downloading additional payloads.

What makes Maverick especially dangerous is that it operates in a fully fileless manner, all malicious components run directly in the system’s memory without writing files to the disk. This approach makes detection by traditional antivirus tools extremely difficult.

An Evolution in Malware Development: AI-Assisted Coding

Researchers at Securelist have found that Maverick shares significant code overlap with Coyote, a Brazilian banking Trojan documented in 2024. However, Maverick is more sophisticated, notably due to its use of artificial intelligence during its development. AI techniques are leveraged particularly for decrypting security certificates and optimizing the malware’s code-writing process.

This marks a worrying trend where cybercriminals are integrating AI tools to create more potent and evasive malware, raising the stakes in the cybersecurity battle.

Confirming the Victim’s Location

Maverick includes stringent geographic targeting measures to avoid detection and ensure attacks focus solely on Brazilian users. The malware checks:

• System timezone
• System language
• Region settings
• Date format

If any of these indicators do not confirm a Brazilian environment, the malware immediately terminates, preventing analysis by security researchers outside Brazil.

Spyware Capabilities and Data Theft

Once activated, Maverick unleashes an arsenal of surveillance tools:

• Capturing screenshots
• Monitoring browsers
• Logging keystrokes
• Controlling the mouse
• Displaying overlay phishing pages

These tactics target credentials from 26 Brazilian banks, six cryptocurrency exchanges, and one payment platform, aiming to steal sensitive financial information and take over accounts.

Self-Propagation Through WhatsApp Account Hijacking

Perhaps the most alarming feature of Maverick is its ability to self-propagate by hijacking infected users’ WhatsApp accounts. Using WPPConnect, an open-source WhatsApp Web automation framework, the malware automatically sends malicious messages to all contacts in the victim’s list.

This worm-like behavior allows the Trojan to spread rapidly and exponentially, leveraging WhatsApp’s massive user base as a distribution network.

Advanced Command-and-Control Security

Maverick’s C2 infrastructure employs sophisticated security measures to avoid detection and tampering:

• HMAC-256 signatures authenticate each request with a hardcoded secret key: "MaverickZapBot2025SecretKey12345".
• Validation of User-Agent headers ensures that only genuine malware clients connect.
• API endpoints deliver payloads encrypted as shellcodes using Donut loaders, with XOR encryption keys cleverly hidden within the payload’s final bytes.

The malware’s decryption method extracts the encryption key from the payload itself by reading the last four bytes to determine key size and then applying XOR operations to decrypt the entire code. Additionally, heavy code obfuscation techniques, such as Control Flow Flattening, make reverse engineering and analysis extremely challenging.