The issue, tracked as CVE-2026-57239, was disclosed following research into Foxit’s updater and service architecture and represents a high-impact post-exploitation pathway, although it requires prior code execution on the target system.

The vulnerability originates from insecure interactions between the Foxit updater component and a privileged Windows service running as NT AUTHORITY\SYSTEM.

During analysis, researchers observed that the updater executable located in the user’s AppData directory performed multiple library load attempts, including references to driver-style modules such as winspool.drv.

Unlike traditional DLL sideload protections implemented in the application, this driver file was not properly validated, allowing attackers to place a malicious proxy file and achieve code execution within the updater context.

Although initial sideloading provided execution, privilege escalation required chaining this behavior with the FoxitPDFReaderUpdateService.exe process.

This service continuously monitors specific files, including FoxitData.txt in the ProgramData directory, which is writable by low-privileged users.

Foxit Updater Vulnerability

By manipulating this file, researchers discovered that it was possible to influence the service into launching the updater executable with SYSTEM privileges.

Further reverse engineering revealed that the service expects encrypted instructions within FoxitData.txt. These instructions are protected using AES-128-CBC encryption with a hardcoded key embedded in the binary.

Once the encryption scheme and encoding format were understood, it became possible to craft valid payloads that trigger execution of the updater process under elevated privileges.

Despite built-in safeguards such as certificate validation for executables, attackers could bypass restrictions by combining the privileged execution flow with sideloading techniques.

In a working exploit chain, a malicious driver file placed alongside the updater executable is loaded when the service launches the updater, effectively granting SYSTEM-level code execution.

Although Foxit previously mitigated sideloading vectors, researcher Luke Paris discovered an alternative exploitation path involving user interface interaction.

By forcing the updater to display a GUI prompt and triggering specific actions, the application attempted to load external modules again, enabling successful exploitation even after initial patches.

Successful exploitation results in full control over the affected system, including the ability to execute arbitrary commands, manipulate security controls, and maintain persistence.

Because the vulnerability requires local access or an existing foothold, it is most relevant in targeted attacks, post-compromise scenarios, or chained exploits.

Organizations can detect potential exploitation by monitoring unauthorized modifications to FoxitData.txt and unusual process execution originating from the AppData Foxit directories.

The presence of unexpected .dll or .drv files in user-controlled Foxit paths, combined with SYSTEM-level process creation events, may indicate abuse. Security teams should also review Windows event logs for token manipulation and anomalous service-driven process launches.

Foxit has addressed the issue in version 2026.2, and users are strongly advised to update immediately. Additional mitigation strategies include enforcing application control policies such as AppLocker to restrict unauthorized module loading and monitoring file system activity in writable directories used by privileged services.

This vulnerability highlights the risks associated with improper validation of inter-process communication and library loading mechanisms, reinforcing the need for strict boundary enforcement between user-controlled inputs and SYSTEM-level services.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.

The post Foxit Updater Vulnerability Gives Standard Users SYSTEM-Level Control of Windows Devices appeared first on Cyber Security News.

One week after disclosing that Anthropic’s Claude Tag Slack integration could be driven by plain “@Claude” text, Tego AI today published a second piece of research on the Claude ecosystem.

This one focuses on Claude Code, Anthropic’s agentic command-line coding tool.

Cloning an ordinary repository and starting Claude Code can cause the tool to read a file from outside the project and include it in the model’s first request, without a warning or approval prompt the user would recognize.

The technique is ordinary, and that is part of why it matters. A repository can commit a normal-looking instruction file, CLAUDE.md, whose @import directive points to a symbolic link.

When a developer clones the repository and starts Claude Code, the tool follows the link to whatever file it resolves to, including files well outside the project, and folds that file’s contents into the first request it sends to the model.

No tool call fires, and no file-edit approval appears. The dialog Claude Code uses to catch out-of-project reads does not appear either, because it checks the in-repository link name, such as ./link, rather than the external file the link resolves to.

The whole delivery mechanism is a repository file named link that GitHub itself labels as a symbolic link pointing to /etc/passwd2, visible to anyone browsing the repository.

“Context is whatever gets sent to the model, and the model is a network endpoint like any other,” said Tomer Niv, Head of Research at Tego AI. “So this is not a file that quietly sits in a prompt.

Clone a repo, answer the same ‘trust this folder?’ question you always answer, and a file from outside that repo can leave your machine on the first request, with no code execution, no cooperation from the model, and no server the attacker has to run.”

The result is that the out-of-project file’s contents appear inside the request body Claude Code sends when the session starts.

The data leaves the local machine as part of the outbound request, rather than remaining only in local model context.

Anthropic has already fixed this underlying class of flaw twice. What makes the new report notable is where the flaw sits, not that the pattern is new.

The same failure, a security check reading one path while the filesystem follows a symbolic link to another, previously appeared in Claude Code and was fixed correctly in CVE-2025-59829 and CVE-2026-25724.

Both were reported through HackerOne and resolved in the permission subsystem.

Tego AI’s research shows that the same defect remained present on a third code path, the startup memory loader, which those fixes never reached.

That path is also the one that places what it finds onto the network before the model has taken any action.

The technical write-up also documents that a repository-committed settings file can redirect Claude Code’s outbound endpoint to a host chosen by the repository author, a separately known behavior.

The exposed file only needs to be readable by the developer’s own account.

That is a realistic condition in CI runners, containers, and standardized developer images, where sensitive file paths are often predictable.

Tego AI’s point is about that security boundary rather than a single bug. The company reported the issue to Anthropic through HackerOne in July 2026, and Anthropic closed it as Informative.

Anthropic’s rationale was consistent and clearly stated: under the Claude Code threat model, the “trust this folder” dialog is the security boundary, and accepting it already grants a project broad read, edit, and execute access.

Tego AI does not dispute that Anthropic applied its stated model consistently.

“We understand the model. Our disclosure is an argument about its terms,” Niv said. “A single ‘trust this folder’ click is being asked to carry an enormous amount of weight, at the least informed moment possible, before you have seen anything the repository does.

It cannot tell the difference between ‘run my code’ and ‘read my SSH key and mail it out,’ and in many real setups that click was inherited from a parent directory and never actually shown for the repository in question.

As enterprises adopt AI coding agents, that is exactly the boundary they need to be able to reason about.”

The disclosure continues a theme in Tego AI’s research: for enterprise AI agents, the unresolved question is authorization, meaning who, or what, is allowed to instruct the agent and reach its data and connected systems.

The Claude Tag research raised that question about an inbound Slack message. This research raises it about an ordinary Git clone.

Tego AI notes that symbolic-link attacks are decades old and that Anthropic has repeatedly hardened Claude Code against them in good faith.

The company published the write-up so users and security teams can reason accurately about what “trust this folder” grants in practice.

Tego AI confirmed the behavior against Claude Code v2.1.x.

The full technical report is available at: https://tego.ai/blog/a-hidden-project-link-can-make-claude-code-silently-send-your-files-to-an-attacker

About Tego AI

Tego AI is a cybersecurity company developing runtime security and control technology for enterprise AI agents.

Its platform helps organizations monitor agent activity and stop unauthorized or risky actions before agents access sensitive data or connected systems.

The company operates in stealth. This is its second public security disclosure in a week. According to Tego AI, there is more to come.

Contact

CTO

Tal Melamed

Tego AI

tal@tego.ai

The post Tego AI Discloses Second Claude Flaw in a Week: Hidden Link Silently Sends Files to Attackers appeared first on Cyber Security News.

Tracked as CVE-2026-54121, the flaw was patched in Microsoft’s July 2026 security updates following responsible disclosure earlier this year.

AD CS is Microsoft’s public key infrastructure (PKI) system, issuing X.509 certificates used for encryption, signing, and authentication across a domain. Certificates act like digital ID cards: a Certification Authority (CA) signs them, binding a public key to an identity that other services can trust.

One key use case is certificate-based Kerberos authentication (PKINIT), where a client requests a certificate and later presents it to the Key Distribution Center (KDC) to obtain a Kerberos ticket. The KDC maps the certificate’s identity data to an AD account — and this mapping process is exactly where Certighost breaks down.

During certain enrollment scenarios, the CA performs a secondary directory lookup called a chase, controlled by two request attributes:

• cdc (Client DC) — specifies the host the CA should contact
• rmd (Remote Domain) — specifies the principal to look up

The vulnerable CA code trusted whatever host was supplied in cdc without verifying it was an actual Domain Controller, reads the advisory.

An attacker could stand up rogue SMB, LDAP, and LSA services on their own machine, point the CA at it via cdc, and return fabricated identity data including a real DC’s SID and DNS hostname for the rmd target.

Combined with a machine account created through the default ms-DS-MachineAccountQuota setting (which lets any user register up to 10 machine accounts), an attacker’s rogue host could pass the CA’s authentication checks as a “valid” domain principal, even though it wasn’t the DC it claimed to be.

Once the CA issued a certificate carrying the impersonated DC’s identity data, the attacker could authenticate as that Domain Controller.

Since DCs hold directory replication rights, this access enabled a DCSync attack extracting sensitive secrets including the krbtgt account hash, effectively handing over full domain control.

Microsoft’s July 2026 patch introduces a new validation function, _ValidateChaseTargetIsDC, gated behind a servicing flag (Feature_3185813818). Before the CA follows a cdc target, it now:

• Rejects empty, oversized, or IP-literal hostnames
• Blocks LDAP injection characters
• Queries AD to confirm the target is a real computer object with the SERVER_TRUST_ACCOUNT flag (value 8192)
• Performs a follow-up SID comparison to prevent object substitution

Only after these checks pass does the CA proceed with the chase and certificate issuance.

Mitigation If You Can’t Patch Immediately

Organizations unable to deploy the July update right away can disable the vulnerable chase fallback with:

textcertutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC
Restart-Service CertSvc -Force

This is a temporary mitigation, not a fix — if the flag is re-enabled later (via policy, imaging, or an admin action), the CA becomes exploitable again. Test this in staging first, since any legitimate workflows relying on the chase fallback will break.

A proof-of-concept is available on GitHub. Organizations running AD CS should prioritize patching immediately and audit EDITF_ENABLECHASECLIENTDC settings across all Enterprise CAs.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.

The post Certighost Active Directory CS Exploit Allows Low-Privileged Users to Compromise Domain appeared first on Cyber Security News.

The findings, disclosed responsibly by XBOW and now patched, expose how an “ordinary” image-handling feature became a gateway to full SYSTEM-level access on production Bing servers.

Microsoft’s advisories classify all three vulnerabilities as Critical, each carrying a maximum CVSS score of 9.8. CVE-2026-32194 is a command injection flaw in Bing’s image-processing pipeline, reachable through the public “Search by Image” upload feature.

Its sibling, CVE-2026-32191, affects a related server-side image ingestion path tied to Bing’s reverse image search crawler. A third, unrelated flaw, CVE-2026-21536, involves unrestricted file upload in the Microsoft Devices Pricing Program.

All three were credited to XBOW, an autonomous AI security researcher that reportedly landed in the top 10 of Microsoft’s bug bounty leaderboard as the first AI to achieve that rank.

The investigation began almost by accident: Bing’s reverse image search could be tricked into fetching an attacker-controlled URL from its backend, a classic server-side request forgery (SSRF) pattern that on its own looked low-impact.

Researchers confirmed the fetch by observing outbound requests from Bing infrastructure carrying a bingbot/2.0 user agent, then noticed inconsistent HTTP 500 errors that hinted the backend was doing more than just retrieving an image.

That anomaly led investigators to test whether the fetched content was being parsed by a vulnerable component rather than simply displayed.

Systematic probing ruled out XML External Entity (XXE) attacks and instead pointed to an ImageMagick-style rendering engine processing SVG files through “coders” and “delegates.”

Because SVG is XML-based, it can embed references to external resources or execute pseudo-protocols like label:, xc:, and pipe-based commands, features useful for trusted input but dangerous when exposed to public uploads.

The successful payload inserted a pipe-prefixed shell command within an SVG reference, which led the backend’s image conversion library to execute it as an operating system command instead of rendering it as an image.

This SVG was submitted either directly through Bing’s image upload endpoint or hosted externally and pulled in via the crawler-based SSRF path, two distinct routes into the same vulnerable delegate-backed pipeline.

Proof of exploitation arrived via out-of-band callbacks rather than the visible HTTP response, since the frontend returned generic errors while the backend silently executed commands.

Command output confirmed execution as NT AUTHORITY\SYSTEM on Bing image-processing workers running Windows Server 2022 Datacenter, with results reproduced across multiple hosts and network ranges indicating the exposure spanned Bing’s image-processing tier, not a single misconfigured server.

XBOW researchers also caught Linux-based workers, initially missed because their automated validator only recognized Linux-style output like uid=0(user) gid=0(group), until they retooled it to also catch Windows proof commands such as whoami /all and systeminfo.

This is not a novel bug; command injection through image converters has plagued software for years, as seen in ImageTragick and similar ExifTool-based RCEs disclosed via GitLab’s bug bounty program.

What made this case notable was that applications treat image parsers as inert “plumbing,” when in reality these helpers carry decades of format compatibility and shell-out behavior that attackers can weaponize.

Takeaway for Defenders

Organizations running similar image-processing pipelines should take several precautions:

• Disable shell-invoking delegates and pipe-based delegate behavior in ImageMagick-style converters.
• Enforce restrictive policy.xml and delegates.xml configurations, disallowing high-risk formats like SVG, MVG, and EPS unless explicitly required.
• Implement strict egress controls, including destination allowlists and internal-address blocking, for any feature that fetches user-supplied URLs.
• Run image conversion in sandboxed environments with reduced privileges and constrained outbound network access.
• Build validation harnesses that account for heterogeneous server fleets (Linux and Windows) to avoid missing real exploitation signals.

Microsoft has fully remediated both Bing Images vulnerabilities in its cloud service, though the underlying lesson extends well beyond Bing: any application accepting image uploads or fetching external image URLs should treat its conversion pipeline as untrusted, security-critical code rather than harmless media handling

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.

The post Bing Images Vulnerability Lets Attackers Execute Remote Code on Microsoft Servers appeared first on Cyber Security News.

The campaign combines software flaws to gain access without credentials, install hidden server-side access, and remove sensitive files before demanding payment.

The activity places manufacturers, automotive firms, aerospace organizations, and retail apparel companies at particular risk because Windchill systems can hold highly valuable product records.

Attackers use a double-extortion model, allowing them to pressure victims with stolen data even when systems can be recovered from backups.

Analysts at Ransom-ISAC, working with eCrime.ch and DEFUSED, identified active exploitation and warned that unpatched, internet-facing deployments remain the main entry point.

The activity is linked to Cl0p affiliates, an operation also known as Graceful Spider, Chubby Scorpius, FIN11, and Lace Tempest.

Ransom-ISAC said in a report shared with Cyber Security News (CSN) that the intrusions appear to date back to early June and have been followed by mass extortion emails sent through randomly compromised accounts.

The messages force organizations to investigate possible theft quickly while also protecting employees from follow-on phishing and social-engineering attempts.

Cl0p Hackers Exploit Windchill Servers

The attack begins with a pre-authentication information disclosure in the FlexPLM WSDL endpoint, followed by abuse of a weakness in the Windchill login servlet.

Chaining the two flaws gives attackers a way to execute code remotely without a valid account and establish a foothold on the server.

The key vulnerability, CVE-2026-12569, is a critical deserialization flaw with a CVSS score of 9.8 that affects PTC Windchill PDMLink and FlexPLM releases before 11.0 M030. It was disclosed on June 17, while CISA added it to its Known Exploited Vulnerabilities catalog on June 25.

After gaining access, the operators deploy JSP webshells, inspect server files, and stage engineering data for theft.

The incident follows the pattern seen in recent Cl0p ransomware actor campaigns, where an exposed enterprise application can become a direct route to confidential data and public extortion.

This is especially concerning for organizations that use Windchill to manage design documents, product specifications, and development workflows.

A successful breach can expose intellectual property that is difficult to replace and may give competitors or criminal buyers insight into unreleased products.

The attackers did not need to break through an employee mailbox or trick a user into opening a malicious attachment.

Instead, they targeted a public-facing application, underscoring why organizations should continuously identify internet-exposed systems and rapidly apply security updates for high-impact vulnerabilities.

Extortion Campaign Raises Pressure

On July 20, Ransom-ISAC began observing emails with the subject line “Windchill PDMLink module serious data leak” sent to hundreds of employees at affected organizations.

This approach spreads the breach allegation internally and increases pressure on executives and incident-response teams before a victim is named publicly.

The tactic is similar to last year’s Oracle EBS campaign, although the current operation uses new email addresses.

Organizations facing such messages should preserve the emails and headers, validate the claim through internal investigation, and remind employees to report suspicious communications, as seen in reported Oracle EBS breach investigations.

The organizations receiving matching emails should hunt for compromise dating back to early June, use published indicators, apply fixed builds, and follow the vendor’s remediation guidance.

Security teams should give immediate priority to externally reachable Windchill and FlexPLM servers, check for unexpected JSP files and unusual outbound activity, and review access logs for the noted reconnaissance request.

Monitoring CISA KEV catalog alerts can also help teams focus patching work on flaws known to be exploited.

The case also highlights the danger of unauthenticated code-execution flaws in business-critical systems.

Similar unauthenticated remote code risks have shown how quickly a server vulnerability can become a broader data-theft incident when patches are delayed.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

ALERT!: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.

The post Cl0p Hackers Exploit Windchill Servers to Steal Companies’ Secret Product Designs appeared first on Cyber Security News.

These flaws affect various versions of Syncope, and administrators are strongly urged to upgrade promptly to the latest secure releases.

The updates are primarily available in versions 4.1.2, 4.0.7, 4.1.1, 4.0.6, 4.0.4, 3.0.16, 4.0.3, and 3.0.15, which collectively resolve a series of newly discovered Common Vulnerabilities and Exposures (CVEs) across the core, console, and end-user components.

The release details how these vulnerabilities impact the 3.0, 4.0, and 4.1 branches of Syncope, with risks present from early milestone builds to recent stable versions.

Apache does not provide binary hotfixes; thus, users must either upgrade to the patched versions or rebuild installations from the updated source code to ensure ongoing security and support.

Apache Syncope Release Patches

One of the significant vulnerabilities involves RCE that can be exploited through Groovy integration and scriptable connectors. Attackers with adequate privileges can leverage Groovy classes or BPMN Groovy ScriptTasks to bypass security controls, executing untrusted code directly on the server.

Additionally, misuse of scripted REST and SQL connectors can allow privileged users to execute arbitrary Groovy logic, leading to post-authentication RCE. Another critical issue is a SQL injection vulnerability, tracked as CVE-2026-57308, affecting the Audit Events search functionality.

This flaw allows authenticated administrators to input unvalidated sort parameters, leading to unauthorized SQL queries against the backing database. It impacts several versions, specifically from 3.0.0-M0 to 3.0.16, and 4.0.0-M0 to 4.0.6, with fixes included in versions 4.0.7 and 4.1.2.

Additionally, there is a privilege escalation flaw (CVE-2026-62183) in self-service workflows that allows users to assign themselves roles without proper admin approval, effectively granting them administrative access. This issue appears in the same version ranges as the SQL injection vulnerability and is resolved in the same updates.

Apache also addressed a low-privilege authenticated SSRF vulnerability, which could allow crafted requests to trigger arbitrary outbound HTTP calls.

There are advisories for information disclosure bugs (CVE-2026-42797) that enable sensitive user field exposure during data reads, as well as web interface vulnerabilities, including XML External Entity (XXE) attacks and cross-site scripting (XSS) issues, which can lead to credential theft and session hijacking.

Beyond these recent issues, Syncope’s security advisories reiterate older flaws, such as a hardcoded AES key (CVE-2025-65998) used for password encryption.

The updates also fix a flaw that could allow attackers with database access to decrypt stored passwords, along with previous RCE vulnerabilities related to Groovy and server-side template injection in mail templates.

Apache advises all administrators to upgrade their systems to the latest secure versions, emphasizing versions 4.1.2 and 4.0.7 to mitigate the most critical vulnerabilities.

It is also recommended to review user roles and entitlements rigorously, especially in workflows and self-service functionalities, to enforce appropriate security measures and access controls.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.

The post Apache Syncope Release Patches for Multiple RCE and SQL Injection Vulnerabilities appeared first on Cyber Security News.

Development teams and CI administrators are urged to apply these patches immediately to prevent potential remote attacks. JetBrains published a security advisory that details multiple issues across its IDE and server products, including IntelliJ IDEA and TeamCity, with several issues classified as critical or high severity.

The fixes are included in IntelliJ IDEA versions 2026.1.4 and 2026.2, as well as TeamCity versions 2026.1.2 and 2025.11.6. Users are advised to upgrade to these versions or later to address the identified vulnerabilities fully.

Among the critical vulnerabilities in IntelliJ IDEA, one significant flaw is related to project workspace ID handling, tracked as CVE-2026-59792. This flaw allows for code execution via path traversal during workspace ID processing.

JetBrains Fixes Critical Vulnerabilities

Additionally, JetBrains has patched a high-risk command injection vulnerability in filename completion (CVE-2026-49366) and another high-risk command execution flaw affecting guest accounts (CVE-2026-49367). Both of these vulnerabilities enable attackers to execute arbitrary commands if they can influence project content or guest sessions.

The advisory also highlights several critical weaknesses in remote development within IntelliJ IDEA, including unauthorized input injection (CVE-2026-64812) and unauthorized modification of settings (CVE-2026-64813) during Remote Development sessions.

Another related high-severity issue (CVE-2026-64814) allowed unauthorized file access within the same Remote Development context, which significantly escalates the risk for teams exposing IDE backends over SSH or in shared environments.

On the CI side, JetBrains has addressed four notable vulnerabilities in TeamCity, including a critical remote code execution flaw in Git VCS roots (CVE-2026-65907). This flaw allows for code execution through malicious repository configuration.

Another high-severity issue (CVE-2026-65906) involves code execution via a Kotlin DSL sandbox escape in build configuration scripts. Additionally, CVE-2026-59793 and CVE-2026-59794 address arbitrary file access in Perforce integration and stored XSS in cloud profile data, respectively.

CVE-2026-65907 (TeamCity Git VCS roots) falls under CWE-94 (Code Injection), enabling attackers to achieve remote code execution through crafted Git root settings on vulnerable TeamCity servers.

CVE-2026-65906 (TeamCity Kotlin DSL sandbox escape) and CVE-2026-59793 (arbitrary file access in Perforce) demonstrate that compromised VCS integrations can be exploited to pivot from source control to build infrastructure.

For IntelliJ IDEA, the critical workspace ID path traversal issue (CVE-2026-59792) has been fixed in versions 2026.1.4 and 2026.2. Users of older 2026.1.x and 2025 branches remain vulnerable and need to upgrade.

For TeamCity, CVE-2026-65906 and CVE-2026-65907 have been resolved in TeamCity versions 2026.1.2 and 2025.11.6, along with patches for the arbitrary file access and XSS issues.

JetBrains recommends that users immediately upgrade to the patched versions of IntelliJ IDEA and TeamCity. Teams should also review build configurations and VCS roots for untrusted or user-supplied scripts.

Additionally, security-conscious teams should limit who can define Kotlin DSL, Git, and Perforce roots, enforce project trust prompts, and monitor build logs for any suspicious script execution or unexpected agent behavior.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.

The post JetBrains Fixes Critical IntelliJ IDEA Code Execution Flaw and Four TeamCity Vulnerabilities appeared first on Cyber Security News.

Between July 21 and July 22, 2026, at least 29 organizations saw unusual software installs and hidden persistence on their systems after staff searched for the Claude desktop app.

The attack begins with paid ads on Microsoft Bing. When someone types a normal query for the app, sponsored results appear that look trustworthy. One of those ads even points to the real Claude.ai website, which lowers suspicion and makes the trap harder to spot.

Analysts from Huntress identified the activity after their security operations center flagged waves of odd executable installs, Defender exclusions, and strange scheduled tasks tied to a file named ClaudeDesktop.exe.

Huntress said in a report shared with Cyber Security News (CSN) that the campaign, which they call FakeAgent, funnels victims through a malicious public Claude Artifact and ultimately delivers SectopRAT, a remote access trojan that steals credit cards, passwords, browser data, and personal files.

Before Anthropic removed the bad Artifact, it had already drawn about 7,100 page views. That volume shows how quickly paid search ads and trusted domains can combine to reach busy office users who only meant to install helpful software.

The campaign also used heavy anti-analysis tricks, including packing and graphics hardware checks that try to spot virtual machines. Those steps slow down defenders and let the malware stay quiet longer on real corporate machines.

FakeAgent Campaign Uses Malicious Bing Ads

The infection chain starts with a simple Bing search for “CLAUDE DESKTOP APP.” Sponsored results fill the top of the page with lookalike download sites, a pattern also seen in earlier weaponized PuTTY Bing ads that abused the same search ads model.

Mixed among them sits a sponsored link that lands on the legitimate Claude.ai domain, specifically a public Artifact page.

Public Artifacts are user-generated pages that anyone can share. Claude itself warns that the content is unverified, yet many people still trust anything hosted on the official domain.

Clicking Download on the fake page sends the user first to claude.ai.download-app.us and then to downloading-api.it.com, where ClaudeDesktop.exe is offered.

Figure 1 in the Huntress material shows the Bing results packed with those sponsored traps. Figure 2 shows the Artifact page dressed up as a normal Claude Desktop installer. Because the journey began on a real Claude.ai address, many users ran the file without a second thought.

ClaudeDesktop.exe is not the real app. It is a renamed, signed JetBrains helper that loads a tampered library beside it, a classic DLL sideloading malware attack that lets malicious code run under a trusted process name.

An identical copy called DockerDesktop.exe is later written as a scheduled task so the infection can restart after reboot.

A second signed program, sslconf.exe, appears under an EdgeUpdate folder and loads yet another altered library.

That stage checks graphics hardware and video memory to avoid sandboxes, then decrypts a hidden payload with a graphics shader instead of ordinary CPU code.

The final result is SectopRAT, which hunts browser logins, cookies, autofill data, credit cards, and messaging apps.

Command addresses are not hard-coded in plain text. They are pulled from Ethereum blockchain contracts, a method known as EtherHiding that lets operators change servers by posting new transactions that are hard to take down.

How Corporate Users Get Infected

Corporate staff often search for AI desktop tools during work hours and click the first convenient result.

That habit turns everyday research into a direct path for malware when ads and trusted domains are abused together.

Similar tricks have already appeared in shared Claude chats malware campaigns that also rode the Claude brand to look real.

Once inside, SectopRAT gives attackers remote control and a steady stream of stolen credentials and files.

Persistence through scheduled tasks and Defender exclusions keeps the foothold alive even after a reboot or a basic cleanup attempt. Huntress linked the same operator style to earlier fake Docker Desktop lures, showing this is not a one-off experiment.

Defenders should treat top-level domains with caution and never assume a familiar brand name equals a safe download.

Users should type official vendor addresses directly instead of trusting sponsored search results, and security teams should watch for unexpected ClaudeDesktop.exe or DockerDesktop.exe activity, new EdgeUpdate paths, and odd scheduled tasks.

Clear remote access Trojan practices still matter: keep software updated, limit unnecessary admin rights, and verify every installer against the vendor’s own site.

Huntress reported the malicious Artifact to Anthropic, and it was removed. The episode still underlines a wider lesson. As more people chase AI tools, both search ads and AI hosting features become attractive stages for malware that looks legitimate until it is far too late.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

ALERT!: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.

The post FakeAgent Campaign Uses Malicious Bing Ads and Claude.ai Artifacts to Infect Corporate Users appeared first on Cyber Security News.

The malware is part of the TAG-195, also called Golden Chickens or Venom Spider, malware-as-a-service ecosystem, which supplies tooling to financially motivated criminal operators.

Recent campaigns begin with ClickFix lures, fake verification pages that persuade targets to paste a copied command into the Windows Run dialog.

That action downloads an OCX payload and launches it with regsvr32.exe, allowing the first-stage TinyEgg backdoor to establish access before ChonkyChicken is delivered.

Readers following ClickFix attacks using trusted tools will recognize how this technique shifts the critical action to the victim.

Analysts at Recorded Future’s Insikt Group identified the malware while tracking the evolving TAG-195 ecosystem. 

Recorded Future said in a report shared with Cyber Security News (CSN) that ChonkyChicken is a second-stage implant that combines browser theft, interactive session control, remote execution, reconnaissance, and sustained monitoring in one framework.

The impact reaches well beyond a stolen password. Attackers can use browser data and active sessions to access business services, map internal systems, and move toward other devices.

The threat also reinforces why organizations need to monitor browser stored credential theft rather than treating saved passwords as a low-risk convenience.

ChonkyChicken Malware

ChonkyChicken uses a tailored helper named ChromEggscalator to bypass Chrome App-Bound Encryption protections and collect protected browser secrets.

The malware downloads the helper, places it in a temporary directory, executes it through a Windows utility, and sends the collected credential material back to its controller.

The malware can also control live Chrome or Edge sessions through Chrome DevTools Protocol automation. It launches a browser out of view with remote debugging enabled, then lets operators interact with an already authenticated session.

That means a password reset alone may not remove an attacker who still holds an active browser session. Its lateral movement features give operators several routes across a network.

ChonkyChicken can use available credentials or access tokens, check logged-in sessions without generating authentication events, create remote scheduled tasks, scan ports, discover hosts, and identify accessible network shares.

This places ChonkyChicken in a different category from basic password stealers. The malware is built to help attackers understand an organization’s network and then use a compromised endpoint as a stepping stone.

Similar risks are seen in browser extension credential theft, where browser access can expose both credentials and active accounts.

Modular Spying and Defense

ChonkyChicken also collects keystrokes, clipboard contents, audio recordings, and screenshots, giving attackers ongoing visibility into victim activity.

A separate modular version can request at least 14 capability plugins only when they are needed, reducing the amount of malicious code initially present on a device.

All current TAG-195 families share tactics intended to complicate detection. They use filename checks to avoid running in unwanted environments, keep persistence through Windows Run keys, obscure strings, and abuse regsvr32.exe to load OCX files from user-writable locations.

Security teams should watch for regsvr32 abuse in malware, especially when it involves files in TEMP or AppData.

Defenders should restrict pasted-command execution where practical, block regsvr32.exe from loading OCX files from user-writable folders, and alert on suspicious Run key entries.

They should also investigate Chrome or Edge processes launched with remote-debugging options, monitor unusual WebSocket traffic, enforce phishing-resistant multifactor authentication, and limit administrator privileges between workstations.

Indocators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

ALERT!: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.

The post ChonkyChicken Malware Steals Chrome Credentials, Moves Laterally and Spies on Victims appeared first on Cyber Security News.

The issue surfaced when owners of premium LG displays reported that plugging in their monitors caused Windows Update to deliver the LG Monitor App Installer.

Once installed via the Microsoft Store path, the app later surfaced a McAfee trial promotion an unexpected ad experience on machines that had never requested antivirus software.

For many users, the problem was straightforward: a monitor that can cost around $1,200 should not become a delivery vehicle for third-party security ads.

The companion app had no legitimate reason to push commercial antivirus offers through an OS-driven install path, and the behavior quickly drew criticism across social media and tech communities.

How the Complaint Reached Microsoft

The situation escalated after Epic Games CEO Tim Sweeney publicly tagged Windows chief Pavan Davuluri on X (formerly Twitter). The spotlight forced a fast response from Microsoft’s Windows leadership.

Within days, Davuluri posted an official update:

The episode highlights a long-running tension in the Windows ecosystem: OEM and peripheral companion apps that arrive through Windows Update or the Microsoft Store can still introduce unwanted prompts, trialware, and advertising. Even when the core OS remains clean, partner software can undermine the user experience.

Microsoft’s public statement is notable for two reasons:

• It explicitly frames bloatware-style ads as incompatible with the Windows 11 experience Microsoft wants to deliver.
• It shows the company willing to pressure an ecosystem partner, in this case LG, to remove the offending behavior rather than leave the complaint unanswered.

LG’s agreement to disable the McAfee pop-up is described as an immediate step. Broader changes to how the LG Monitor App is distributed or what permissions it requests may still follow, but the ad surface is being closed first.

What Users Should Know Right Now

• Connecting certain LG monitors can still trigger the LG Monitor App Installer via Windows Update.
• The McAfee trial pop-up is being disabled at the app level following Microsoft’s intervention.
• Users who already installed the app can check for updates in the Microsoft Store or remove the software if they do not need LG’s monitor controls.
• The incident reinforces that peripheral drivers and companion apps remain a common vector for unwanted software on Windows 11.

Major Windows complaints often fade without a clear resolution. This one did not. Microsoft listened, contacted LG, and secured a concrete fix in a matter of days.

The outcome sends a signal to other hardware partners: silent installs and third-party ad pop-ups will face scrutiny when they damage the shared customer experience.

For Windows 11 users, the message from Redmond is now explicit: there is no place for this class of bloatware advertising, and Microsoft is prepared to act when partners cross the line.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.

The post Microsoft Confirms No Bloatware Ads in Windows 11; LG Disables McAfee Pop-ups appeared first on Cyber Security News.