Gemini

Hidden HTML Hack Turns Google Gemini Into a Phishing Machine

Hidden HTML tricks let attackers hijack Google Gemini’s email summaries for phishing scams. Learn how this silent threat bypasses defenses and endangers users.

15-Jul-2025

4 min read

No content available.

LAMEHUG

GenAI

CERT-UA discovers LAMEHUG malware using the Qwen2.5-Coder AI model to generate m...

Ukraine's Computer Emergency Response Team (CERT-UA) has [uncovered](https://cert.gov.ua/article/6284730) a sophisticated malware campaign that represents a paradigm shift in cyber warfare tactics. The newly discovered **LAMEHUG malware** leverages artificial intelligence to dynamically generate malicious commands, marking the first confirmed instance of threat actors weaponizing large language models for command-and-control operations. This groundbreaking attack, attributed to the Russian state-sponsored group **[APT28](https://www.secureblink.com/cyber-security-news/polish-government-hacked-apt-28-s-devious-lure)** (also known as Fancy Bear), demonstrates how cyber-criminals are evolving to incorporate cutting-edge AI technology into their arsenals, potentially revolutionizing the threat landscape for organizations worldwide. ## LAMEHUG's AI-Driven Architecture ### Core Functionality and LLM Integration LAMEHUG represents a technical milestone in malware development, built entirely in **Python** and designed to exploit the **Qwen2.5-Coder-32B-Instruct** model developed by Alibaba Cloud. The malware's most distinctive feature is its ability to generate commands through natural language processing rather than relying on pre-programmed instructions. - Python-based payload - Qwen2.5-Coder-32B-Instruct via Hugging Face API - Text-to-code conversion using LLM - SFTP and HTTP POST protocols - Documents, Downloads, Desktop folders ### Qwen2.5-Coder Model Capabilities The weaponized AI model represents state-of-the-art coding capabilities, featuring: - **32.5 billion parameters** with 31.0B non-embedding parameters - **64-layer transformer architecture** with RoPE, SwiGLU, and RMSNorm - **131,072 token context length** for complex code generation - **Multi-language support** across 40+ programming languages - **Performance parity** with GPT-4o on coding benchmarks The model's sophisticated architecture enables **code generation, reasoning, and fixing** capabilities that LAMEHUG exploits for dynamic command creation, making traditional signature-based detection methods ineffective. ## Phishing Campaign Methodology ### Distribution Mechanism The LAMEHUG campaign employs a multi-stage attack vector targeting high-value Ukrainian government officials: **Initial Compromise:** - **Compromised email accounts** used to impersonate ministry officials - **ZIP archives** containing malware payloads - **Three distinct variants**: Додаток.pif, AI_generator_uncensored_Canvas_PRO_v0.9.exe, and image.py **Social Engineering Elements:** - Legitimate-appearing government correspondence - Authority-based trust exploitation - Time-sensitive content to encourage immediate action ### Command Generation Process LAMEHUG's revolutionary approach to malware operation involves: 1. **Text-based command descriptions** embedded in the malware 2. **API calls** to Hugging Face's Qwen2.5-Coder-32B-Instruct model 3. **Dynamic code generation** based on natural language instructions 4. **Real-time command execution** on compromised systems This methodology allows attackers to: - **Bypass signature-based detection** through dynamic code generation - **Adapt attack strategies** without malware updates - **Maintain operational security** through legitimate API usage ## APT28 Attribution and Threat Intelligence ### Actor Profile and Capabilities **APT28 (Fancy Bear)** represents one of Russia's most sophisticated cyber espionage units, with confirmed attribution based on: - **Tactical, Techniques, and Procedures (TTPs)** consistent with historical operations - **Target selection** aligning with Russian intelligence priorities - **Infrastructure patterns** matching known APT28 campaigns - **Medium confidence attribution** by CERT-UA analysts **Known APT28 Aliases:** - Fancy Bear - Forest Blizzard - Sednit - Sofacy - UAC-0001 ### Strategic Implications The integration of AI technology into APT28's operations signals: - **Technological advancement** in state-sponsored cyber capabilities - **Evolution beyond traditional malware** development approaches - **Increased sophistication** in command-and-control mechanisms - **Potential for widespread adoption** across threat actor ecosystem ## Defensive Evasion: AI-Powered Security Bypass ### Legitimate Infrastructure Exploitation LAMEHUG's use of **Hugging Face API infrastructure** for command-and-control presents unique challenges: **Evasion Techniques:** - **Legitimate service abuse** to blend with normal enterprise traffic - **API-based communication** appearing as standard AI development activity - **Cloud infrastructure utilization** for improved availability and resilience - **Dynamic payload generation** frustrating traditional analysis methods ### Skynet Malware Concurrent research by Check Point reveals complementary AI evasion techniques in the **Skynet malware**, which employs **prompt injection** to manipulate AI-based security analysis tools. **Skynet's Anti-AI Techniques:** - **Prompt injection strings** designed to fool LLM analyzers - **Embedded instructions** requesting "NO MALWARE DETECTED" responses - **Adversarial content** targeting AI-powered security solutions - **Proof-of-concept implementation** demonstrating attack feasibility ## Technical Countermeasures and Detection Strategies ### Network-Level Defenses **API Traffic Monitoring:** - Monitor outbound connections to `huggingface.co` domains - Implement rate limiting for AI service API calls - Deploy anomaly detection for unusual LLM query patterns - Establish baseline metrics for legitimate AI development traffic **Behavioral Analysis:** - Track dynamic code generation patterns - Monitor Python execution in enterprise environments - Implement sandboxing for AI-generated code execution - Deploy machine learning models to identify AI-generated malware ### Endpoint Protection Strategies **File System Monitoring:** - Implement real-time scanning of Documents, Downloads, and Desktop directories - Monitor for unusual file access patterns targeting TXT and PDF documents - Deploy integrity checking for sensitive document repositories - Establish baseline access patterns for user directories **Process Behavior Analysis:** - Monitor Python interpreter execution with network connectivity - Track API calls to external AI services - Implement application whitelisting for AI development tools - Deploy advanced persistent threat detection for dynamic payloads ## Industry Impact and Future Threat Landscape ### Paradigm Shift in Malware Development The LAMEHUG discovery represents a fundamental transformation in cybersecurity threat modeling: **Immediate Implications:** - **Traditional signature-based detection** becomes insufficient - **AI-powered security solutions** face adversarial challenges - **Threat intelligence sharing** requires new analytical frameworks - **Incident response procedures** need AI-aware methodologies **Long-term Considerations:** - **Democratization of advanced malware** through AI accessibility - **Escalation of cyber conflict** through AI arms race dynamics - **Evolution of defensive technologies** to counter AI-powered threats - **Regulatory implications** for AI service provider responsibilities ### Organizational Risk Assessment **High-Risk Sectors:** - Government agencies and defense contractors - Critical infrastructure operators - Financial services institutions - Healthcare organizations with sensitive data **Mitigation Priority Matrix:** | Risk Level | Mitigation Strategy | Implementation Timeline | |------------|-------------------|------------------------| | **Critical** | API traffic monitoring | Immediate (0-30 days) | | **High** | Behavioral analysis deployment | Short-term (30-90 days) | | **Medium** | Staff training and awareness | Medium-term (90-180 days) | | **Low** | Policy updates and documentation | Long-term (180+ days) | Organizations must rapidly adapt their defensive strategies to address this new class of threats that leverage legitimate AI services for malicious purposes. The success of APT28's AI-powered campaign against Ukrainian government targets serves as a stark warning that traditional cybersecurity approaches are insufficient against dynamic, AI-generated threats. As threat actors continue to weaponize increasingly sophisticated AI models, the cybersecurity community must evolve its detection, analysis, and response capabilities to match this new level of adversarial innovation. The future of cybersecurity now depends on our ability to defend against not just human creativity in malware development, but the amplified capabilities that artificial intelligence brings to the threat landscape. Organizations that fail to recognize and prepare for this paradigm shift risk being defenseless against the next generation of AI-powered cyberattacks.

18-Jul-2025

6 min read

607 Fake Telegram Sites Spread Android Malware, Janus Exploit Puts Millions at R...

A sophisticated Android malware campaign has been discovered targeting users through 607 malicious domains posing as official Telegram download pages. The operation, uncovered by BforeAI's PreCrime Labs, leverages [typosquatting](https://www.secureblink.com/cyber-security-news/bumblebee-malware-intensifies-corporate-network-attacks-via-seo-poisoning-typosquatting-and-d-do-s-tactics) techniques, QR code redirections, and exploits the critical Janus vulnerability affecting Android devices running versions 5.0 through 8.0. ## Campaign Overview and Scale ### Discovery and Attribution BforeAI's threat intelligence team identified this large-scale operation in recent weeks, revealing one of the most extensive fake app distribution campaigns targeting the popular messaging platform. The research demonstrates how cybercriminals are becoming increasingly sophisticated in their approach to distributing mobile malware. ### Infrastructure Analysis The malicious infrastructure spans across multiple components: | **Component** | **Details** | |---------------|-------------| | **Total Domains** | 607 confirmed malicious domains | | **Primary Registrar** | Gname registrar | | **Hosting Location** | Primarily China-based servers | | **Target Languages** | Chinese, with SEO-optimized phrases | | **APK Variants** | Two versions: 60MB and 70MB | ### Domain Distribution by TLD The campaign strategically utilized various top-level domains to maximize credibility and distribution reach: - **.com domains**: 316 (52% of total) - **.top domains**: 87 (14% of total) - **.xyz domains**: 59 (10% of total) - **.online domains**: 31 (5% of total) - **.site domains**: 24 (4% of total) - **Other TLDs**: 90 (15% of total) The high concentration of .com domains suggests a deliberate strategy to enhance perceived legitimacy. ## Technical Attack Methodology ### Typosquatting and Social Engineering The attackers employed sophisticated typosquatting techniques, creating domains that closely mimic official Telegram branding: - **teleqram** (missing 'g') - **telegramapp** (added 'app') - **telegramdl** (appended 'dl') - **apktelegram** (reversed order) These domains redirect users to a central distribution site, `zifeiji.asia`, designed to replicate Telegram's official appearance with authentic-looking favicons, colors, and download buttons. ### Distribution Vectors The campaign utilizes multiple distribution methods: 1. **QR Code Redirections**: Users scan QR codes that redirect to malicious download pages 2. **SEO Manipulation**: Page titles contain Chinese phrases like "Paper Plane Official Website Download" to improve search engine visibility 3. **Social Media Links**: Direct links shared across various platforms 4. **Blog-Style Pages**: Phishing sites disguised as personal blogs or unofficial fan pages ## Janus Vulnerability Exploitation ### Technical Overview The malicious APKs exploit the Janus vulnerability ([CVE-2017-13156](https://nvd.nist.gov/vuln/detail/cve-2017-13156)), a critical Android security flaw that affects devices running Android 5.0 through 8.0. This vulnerability allows attackers to inject malicious code into legitimate APK files without altering their cryptographic signatures. ### Vulnerability Mechanics The Janus exploit works by: - **Signature Bypass**: Malicious apps appear legitimate to Android's security verification - **Code Injection**: Harmful code is inserted into otherwise valid applications - **Detection Evasion**: Security scanners fail to identify the malicious components - **Widespread Impact**: Affects approximately 74% of Android devices globally ### Payload Capabilities Once installed, the malicious Telegram apps demonstrate extensive capabilities: - **Remote Command Execution**: Attackers can execute arbitrary commands on infected devices - **Data Exfiltration**: Access to external storage, contacts, and sensitive information - **Network Communication**: Uses cleartext protocols (HTTP, FTP) for data transmission - **Media Manipulation**: Interacts with MediaPlayer and multimedia files - **Socket Communication**: Receives and processes remote instructions ## Infrastructure and Persistence Mechanisms ### Firebase Exploitation The campaign leverages Firebase infrastructure for command and control operations: - **Database Endpoint**: `tmessages2.firebaseio.com` (now deactivated) - **Reactivation Risk**: The database could be reactivated by registering a new Firebase project with the same name - **Persistent Threat**: Older malware versions would automatically reconnect to reactivated endpoints ### Tracking and Analytics The malicious infrastructure incorporates sophisticated tracking capabilities: - **JavaScript Tracking**: `ajs.js` script hosted on `telegramt.net` - **Device Fingerprinting**: Collects browser and device information - **User Behavior Analysis**: Monitors user interactions and preferences - **Targeted Delivery**: Contains code for displaying Android-specific download banners ## Impact Assessment ### Geographic Distribution While the campaign primarily targets Chinese-speaking users, the global reach of the infrastructure poses risks to international users. The use of common domain extensions and multiple hosting locations suggests potential for widespread distribution. ### User Risk Profile The campaign particularly endangers users who: - Download apps from unofficial sources - Use older Android devices (versions 5.0-8.0) - Are less familiar with security best practices - Respond to QR code prompts without verification ## Security Implications ### Supply Chain Risks This campaign highlights critical vulnerabilities in the mobile app ecosystem: - **Third-Party Distribution**: Risks associated with downloading apps outside official stores - **Legacy Vulnerabilities**: Continued exploitation of older Android security flaws - **Social Engineering**: Sophisticated impersonation of trusted brands ### Detection Challenges The campaign's sophistication presents significant challenges for traditional security measures: - **Signature Validation**: Janus vulnerability bypasses standard signature verification - **Dynamic Infrastructure**: Rapid deployment and takedown of malicious domains - **Legitimate Appearance**: High-quality impersonation of official services ## Organizational Defense Strategies ### Technical Countermeasures Organizations should implement comprehensive protection strategies: 1. **Automated Domain Monitoring**: Deploy systems to detect suspicious domain registrations 2. **APK Analysis**: Implement multi-source threat intelligence scanning for APK files 3. **Network Filtering**: Block delivery of APK and SVG attachments where not business-essential 4. **URL Verification**: Scan URLs and hash values against multiple threat intelligence sources ### User Education and Awareness Critical user education components include: - **Official Source Verification**: Training users to download apps only from official stores - **QR Code Caution**: Educating users about QR code security risks - **Brand Impersonation Recognition**: Teaching users to identify legitimate vs. fraudulent sites - **Device Security**: Promoting regular security updates and patching ## Regulatory and Industry Response ### Current Enforcement Actions The scale of this campaign has prompted various industry responses: - **Google Play Protect**: Enhanced scanning for malicious APK files - **Registrar Cooperation**: Increased scrutiny of bulk domain registrations - **Threat Intelligence Sharing**: Collaboration between security vendors ### Long-term Implications This campaign demonstrates the need for: - **Enhanced Mobile Security Standards**: Stronger verification for app distribution - **Improved Legacy Support**: Better security updates for older Android versions - **Industry Collaboration**: Coordinated response to large-scale campaigns ## Mitigation Recommendations ### Immediate Actions Organizations should take immediate steps to protect against this campaign: 1. **Block Known Indicators**: Implement blocking for identified domains and IP addresses 2. **Update Security Policies**: Restrict APK installations from unknown sources 3. **Monitor Network Traffic**: Watch for connections to known malicious infrastructure 4. **User Communication**: Issue advisories about the campaign to user communities ### Long-term Strategy Comprehensive protection requires sustained effort: - **Threat Intelligence Integration**: Incorporate IOCs into security monitoring systems - **Continuous Monitoring**: Regular assessment of domain registration patterns - **Security Awareness Programs**: Ongoing user education about mobile security - **Vendor Collaboration**: Work with security vendors for enhanced protection The 607-domain fake Telegram campaign represents a significant leap in mobile malware sophistication. The exploitation of the Janus vulnerability, combined with advanced social engineering techniques and distributed infrastructure, creates a formidable threat to Android users worldwide. This campaign’s ability to bypass traditional security measures highlights the urgent need for better mobile security practices at both the organizational and individual levels.

17-Jul-2025

6 min read

Bluetooth

RCE

PerfektBlue vulnerabilities in OpenSynergy's BlueSDK enable one-click remote cod...

The discovery of four interconnected vulnerabilities in OpenSynergy's BlueSDK Bluetooth stack has exposed millions of vehicles from major manufacturers to potential remote code execution attacks. Dubbed "PerfektBlue" by researchers at [PCA Cyber Security](https://pcacybersecurity.com/), this exploit chain affects infotainment systems across Mercedes-Benz, Volkswagen, and Škoda vehicles, with implications extending far beyond the automotive sector. ## PerfektBlue Attack Chain The PerfektBlue attack leverages four distinct vulnerabilities that can be chained together to achieve remote code execution on target devices. The exploit requires minimal user interaction—often just accepting a Bluetooth pairing request—making it particularly dangerous for unsuspecting vehicle owners. ### Key Vulnerabilities Identified | CVE ID | Component | Severity | CVSS Score | Description | |--------|-----------|----------|------------|-------------| | CVE-2024-45434 | AVRCP | Critical | 8.0 | Use-After-Free vulnerability enabling RCE | | CVE-2024-45433 | RFCOMM | Medium | 5.7 | Incorrect function termination | | CVE-2024-45432 | RFCOMM | Medium | 5.7 | Function call with incorrect parameter | | CVE-2024-45431 | L2CAP | Low | 3.5 | Improper validation of remote channel ID | ## Widespread Impact Across Automotive Sector OpenSynergy's [BlueSDK](http://perfektblue.pcacybersecurity.com/) is extensively used in the automotive industry, making the vulnerability's reach substantial. Confirmed affected manufacturers include: - **Mercedes-Benz**: NTG6 and NTG7 infotainment systems - **Volkswagen**: ICAS3 systems in ID model series - **Škoda**: MIB3 head units in Superb model lines - **Unnamed OEM**: Additional manufacturer to be disclosed The researchers estimate that millions of vehicles manufactured between 2020-2025 contain vulnerable BlueSDK implementations, with potential exposure extending to mobile phones, industrial devices, and other embedded systems utilizing the framework. ## Technical Exploitation Details The PerfektBlue attack operates through a sophisticated multi-stage process: 1. **Initial Discovery**: Attacker identifies target vehicle's Bluetooth MAC address 2. **L2CAP Exploitation**: Weak parameter validation creates malicious connection state 3. **RFCOMM Memory Corruption**: Crafted packets trigger memory handling flaws 4. **AVRCP Code Execution**: Use-After-Free vulnerability enables shellcode injection 5. **System Compromise**: Full remote code execution under Bluetooth daemon privileges Once successful, attackers can access GPS coordinates, record audio, steal contact information, and potentially perform lateral movement to critical vehicle systems. ## Patch Distribution Challenges While OpenSynergy released patches to customers in September 2024, the complex automotive supply chain has delayed widespread deployment. The company confirmed receiving vulnerability reports in May 2024 and addressing the issues within four months. However, many vehicle manufacturers have yet to implement the fixes, leaving consumers vulnerable nearly ten months after patches became available. **Volkswagen** acknowledged the vulnerability, stating that exploitation requires specific conditions including proximity (5-7 meters), active pairing mode, and user approval. **Mercedes-Benz** has not provided public statements regarding patch deployment status. ## Industry Response and Mitigation The automotive industry's response has been mixed, highlighting ongoing challenges in cybersecurity coordination. Some manufacturers have begun over-the-air updates, while others require dealership visits for firmware updates. The incident underscores the critical importance of: - **Immediate firmware updates** for all affected vehicles - **Bluetooth security hardening** in infotainment systems - **Enhanced supply chain communication** between vendors and OEMs - **User awareness** regarding Bluetooth pairing practices ## Broader Implications for Connected Vehicles The PerfektBlue vulnerabilities represent a significant wake-up call for the automotive industry's approach to cybersecurity. As vehicles become increasingly connected, the attack surface expands beyond traditional automotive systems to include telecommunications, entertainment, and navigation components. The incident highlights the need for: - Rigorous security testing of third-party components - Faster patch deployment mechanisms - Enhanced isolation between infotainment and critical vehicle systems - Improved vulnerability disclosure processes ## Recommendations for Vehicle Owners Vehicle owners should take immediate action to protect against PerfektBlue attacks: - **Update infotainment firmware** through manufacturer OTA systems or dealership service - **Disable Bluetooth** when not actively needed - **Avoid pairing with unknown devices** in public areas - **Monitor manufacturer security advisories** for updates - **Consider professional security assessment** for high-value or fleet vehicles The PerfektBlue vulnerabilities expose a critical gap in automotive cybersecurity, demonstrating how widely-used third-party components can create industry-wide risks. While patches exist, the slow deployment highlights the need for more agile security response mechanisms in the automotive sector. As the industry continues its digital transformation, incidents like PerfektBlue serve as crucial reminders that cybersecurity must be prioritized throughout the entire supply chain, from component manufacturers to end-user vehicles. The automotive industry's response to PerfektBlue will likely influence future cybersecurity standards and practices, making this incident a pivotal moment in the evolution of connected vehicle security.

12-Jul-2025

4 min read

Our Product

Resource Library

Subscribe to Our Weekly Threat Digest

Contact Us

PRODUCT

threatspyBulk IP/Domain Lookup

threatspy

Bulk IP/Domain Lookup

SOLUTIONS

By Industry

Healthcare

Healthcare

Education

Education

IT & Telecom

IT & Telecom

By Role

Government

Government

CISO/CTO

CISO/CTO

DevSecOps

DevSecOps

RESOURCES

Threat Feed

Threat Feed

Threat Research

Threat Research

White Paper

White Paper

SB Blogs

SB Blogs

COMPANY

Our Story

Our Story

Our Team

Our Team

Career

Career

Press And Media

Press And Media

Contact Us

Contact Us

Gemini

Hidden HTML Hack Turns Google Gemini Into a Phishing Machine

Related Articles

LAMEHUG

GenAI

CERT-UA discovers LAMEHUG malware using the Qwen2.5-Coder AI model to generate m...

Telegram

607 Fake Telegram Sites Spread Android Malware, Janus Exploit Puts Millions at R...

Bluetooth

RCE

PerfektBlue vulnerabilities in OpenSynergy's BlueSDK enable one-click remote cod...

Product

Solutions

Resources

Company

Find Us Online

contact@secureblink.com

@ Copyright 2025 Secure Blink. All rights reserved.

threatspy
Bulk IP/Domain Lookup