A typosquatted domain impersonating the Microsoft Activation Scripts (MAS) tool was used to distribute malicious PowerShell scripts that infect Windows systems with the ‘Cosmali Loader’.

BleepingComputer has found that multiple MAS users began reporting on Reddit [1, 2] yesterday that they received pop-up warnings on their systems about a Cosmali Loader infection.

You have been infected by a malware called ‘cosmali loader’ because you mistyped ‘get.activated.win’ as ‘get.activate[.]win’ when activating Windows in PowerShell.

The malware’s panel is insecure and everyone viewing it has access to your computer.

Reinstall Windows and don’t make the same mistake next time.

For proof that your computer is infected, check Task Manager and look for weird PowerShell processes.

Based on the reports, attackers have set up a look-alike domain, “get.activate[.]win,” which closely resembles the legitimate one listed in the official MAS activation instructions, “get.activated.win.”

Given that the difference between the two is a single character (“d”), the attackers bet on users mistyping the domain.

Source: Fake MAS Windows activation domain used to spread PowerShell malware

[…]hackers recently breached approximately 120,000 IP cameras across Korea — often found inside private homes like Kim’s — has left her and many others seething, prompting the government to take action.

As shocking the scale of the intrusions was the alleged motive behind them. Videos captured by the hacked cameras were allegedly sold to an overseas pornography website, exposing some of the most intimate moments of unsuspecting victims to anonymous viewers abroad.

Only 1,193 videos from the hacked cameras have been uncovered so far on overseas websites, raising concerns that many more remain undiscovered.

In response, an interagency task force comprising officials from the Ministry of Science and ICT, the Personal Information Protection Commission and the National Police Agency announced on Dec. 7 that it would pursue a multilayered reform package. The measures aim to shift responsibility beyond individuals and camera manufacturers to include installation companies and telecommunications providers.

Yet as policymakers scramble to overhaul regulations and reinforce technical safeguards, interviews with everyday users of IP cameras reveal a gap between how these devices are used and understood and the level of risk they actually pose.

[…]

any hacked cameras were protected by simple or widely known passwords that were rarely changed. A government survey found that only 59 percent of installation companies consistently carried out mandatory security measures, such as changing default password settings.

[…]

What sets the current case apart — and prompted the government’s unusually forceful response — is the nature of the harm involved.

Police believe one suspect hacked 63,000 IP cameras, producing 545 videos that he sold to an overseas website for 35 million won ($24,000) in cryptocurrency. Another suspect allegedly hacked 70,000 devices, creating 648 videos that he later sold to the same website for 18 million won.

The two individuals, whom police say are not accomplices, sourced most of their footage from IP cameras installed in ordinary homes, gynecology offices, breastfeeding rooms, massage parlors, Pilates studios and waxing salons. They often accessed the same compromised devices repeatedly. The videos accounted for 62 percent of all content on the website, which includes a separate “Korean” category.

Two additional suspects are accused of hacking 15,000 cameras and 136 devices, respectively, to collect footage for private possession.

Unlike leaked phone numbers or delivery addresses, compromised IP camera footage can expose faces, bodies, children and private spaces. Prof. Kim emphasized that hacked cameras can reveal “an individual’s movements, daily life and relationships,” making the potential for privacy violations “extremely high.”

[…]

Source: Mass hacking of IP cameras leave Koreans feeling vulnerable in homes, businesses

CyberVolk, a pro-Russian hacktivist crew, is back after months of silence with a new ransomware service. There’s some bad news and some good news here.

First, the bad news: the CyberVolk 2.x (aka VolkLocker) ransomware-as-a-service operation that launched in late summer. It’s run entirely through Telegram, which makes it very easy for affiliates that aren’t that tech savvy to lock files and demand a ransom payment.

CyberVolk’s soldiers can use the platform’s built-in automation to generate payloads, coordinate ransomware attacks, and manage their illicit business operations, conducting everything through Telegram.

But here’s the good news: the ransomware slingers got sloppy when it came time to debug their code and hardcoded the master keys – this same key encrypts all files on a victim’s system – into the executable files. This could allow victims to recover encrypted data without paying the extortion fee, according to SentinelOne senior threat researcher Jim Walter, who detailed the gang’s resurgence and flawed code in a Thursday report.

[…]

“Our analysis reveals an operation struggling with the challenges of expansion: taking one step forward with sophisticated Telegram automation, and one step backward with payloads that retain test artifacts enabling victim self-recovery,” Walter wrote.

[…]

In November, the ransomware operators began advertising standalone RAT and keylogger tools and advertised these pricing models:

• RaaS (single OS): $800-$1,100 USD
• RaaS (Linux + Windows): $1,600-$2,200 USD
• Standalone RAT or Keylogger: $500 USD each

Once the ransomware has been deployed on victims’ systems, it escalates privileges, bypassing Windows User Account Control (UAC) to execute malware with admin-level privileges. It determines which files to encrypt based on exclusion lists for specific paths and extensions that have been configured in the malware’s code, and the ransomware uses AES-256 in GCM mode (Galois/Counter Mode) for file encryption.

But, here’s where the malware developers screwed up: VolkLocker doesn’t dynamically generate encryption keys, but rather hardcodes them as hex strings, and writes a plaintext file with the complete master encryption key in the %TEMP% folder.

The plaintext master key “likely represents a test artifact inadvertently shipped in production builds,” Walter wrote. “CyberVolk operators may be unaware that affiliates are deploying builds with the backupMasterKey() function still embedded.”

This “suggests that the operation is struggling to maintain quality control while aggressively recruiting lesser-skilled affiliates,” he added.

[…]

Source: Russian hackers debut simple ransomware service • The Register

Half of the internet-facing systems vulnerable to a fast-moving React remote code execution flaw remain unpatched, even as exploitation has exploded into more than a dozen active attack clusters ranging from bargain-basement cryptominers to state-linked intrusion tooling.

That’s the assessment from Alon Schindel, VP of AI and Threat Research at Wiz, who says CVE-2025-55182 – the React server-side vulnerability dubbed “React2Shell” – is now being actively exploited at scale, with researchers tracking at least 15 distinct intrusion clusters in the wild over the past 24 hours alone.

According to Wiz’s latest telemetry, roughly 50 percent of publicly exposed resources known to be vulnerable are still running unpatched code, giving attackers a comfortable head start.

The critical-severity flaw, first disclosed earlier this month, affects React Server Components and dependent frameworks such as Next.js and stems from unsafe deserialization in React’s server-side packages, allowing an unauthenticated attacker to send a crafted request to achieve remote code execution. As The Register previously reported, the bug quickly proved attractive to attackers because of React’s ubiquity in modern web stacks, particularly in cloud-hosted environments where a single exposed endpoint can provide a foothold into far larger estates.

What began as opportunistic scanning and cryptomining has now broadened into something messier. Wiz says it is seeing a clear split between “commodity” exploitation – dominated by familiar cryptomining operations using tools like Kinsing, C3Pool, and custom loaders – and more deliberate intrusion sets deploying post-exploitation frameworks and bespoke malware.

Among the clusters observed are Python-based campaigns masquerading as miner droppers while quietly exfiltrating secrets, Sliver command-and-control infrastructure used for hands-on-keyboard operations, and a JavaScript file injector that systematically infects every server-side *.js file it can reach. Wiz also reports the re-emergence of EtherRat backdoor variants, a family of malware that had previously fallen out of favor but appears to have been dusted off for this wave of exploitation.

The technical sophistication is also creeping upward. Multiple miscreants are actively attempting to frustrate incident response by manipulating timestamps, minimizing logs, and otherwise scrubbing evidence of compromise. Those anti-forensics techniques, Wiz warned, suggest operators who expect to be hunted and intend to linger.

[…]

Source: Half of exposed React servers remain unpatched amid attacks • The Register