Google Warns Three Russia-Linked Groups Exploit Legitimate Auth Flows to Spy

·3 views

Google Threat Intelligence Group published a report on August 20, 2026, detailing three Russia-linked threat clusters — UNC6293, UNC7005, and UNC5976 — abusing legitimate authentication mechanisms to compromise targeted individuals. Rather than relying solely on fake login pages, the attackers manipulate victims into completing real actions such as creating app passwords, approving OAuth logins, or linking WhatsApp devices, then capturing the resulting credentials or tokens. In some cases, targets are lured to sites mimicking secure call or file-sharing tools, where malware like VIDAR, ATOMIC, and HEADRUSH is also deployed to steal credentials, cookies, and audio-video data. The campaigns frequently involve impersonation of diplomats or trusted contacts to make the requests appear legitimate, with post-compromise access routed through residential proxies to evade detection. Google recommends blocking app passwords, enabling advanced phishing-resistant MFA, auditing linked devices, and verifying unexpected authentication requests through independent channels.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

New Windows RATs E4del and PINHOLE Hide Commands Inside FTP Server Banners

Security researchers at SOCRadar Threat Research Unit have identified two new Windows remote access trojans, E4del and PINHOLE, that use an unusual technique of embedding PowerShell commands inside FTP server pre-login banners to initiate infection. Victims are compromised when they open an LNK shortcut file inside a ZIP archive, which silently connects to an attacker-controlled FTP server and retrieves the hidden commands. E4del disguises itself as a Discord application using a signed Electron wrapper, offering capabilities including remote shell access, screen capture, and live streaming via WebSockets. PINHOLE employs a multi-stage loader that resolves encrypted command-and-control server details stored on legitimate platforms like Pinterest and SurveyMonkey, then proxies traffic through Cloudflare Workers before injecting the final payload into a suspended ApplicationFrameHost.exe process. Security teams are advised to block ZIP and LNK files at gateways, restrict outbound FTP traffic, and monitor for abnormal connections to Pinterest, SurveyMonkey, and Cloudflare Workers domains.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Head Mare APT Exploits TrueConf Server Flaws to Spread PhantomCore Malware

The Head Mare APT group has been actively exploiting two critical vulnerabilities, CVE-2026-72529 and CVE-2026-72530, in unpatched TrueConf Server installations to deliver the PhantomCore malware. Attackers chain the two flaws via port 4307/TCP to execute code, escape sandboxed environments, and plant a web shell granting privileged database access. They then replace the official TrueConf Windows client installer with a trojanized version, causing conference participants to unknowingly install PhantomCore alongside the legitimate client during routine updates. Kaspersky ICS CERT published its findings on August 12, 2026, and both CVEs have since been added to the CISA Known Exploited Vulnerabilities catalog. Administrators are urged to upgrade to TrueConf Server versions 5.3.9, 5.4.9, or 5.5.5 and restrict access to port 4307/TCP to trusted networks immediately.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Design a Scalable URL Shortener System Like Bit.ly

A high-level system design for a URL shortener outlines how to convert long URLs into short codes and redirect users back to the originals. The architecture relies on Base62 encoding of unique IDs — generated via auto-increment, UUID, or Snowflake — to produce 7-character codes supporting up to 3.5 trillion unique URLs. The system is built to handle roughly 11,500 reads per second at a 100:1 read-to-write ratio, with Redis caching targeting a 95% cache hit rate to minimize database load. A PostgreSQL database stores URL records and click analytics, with read replicas and automated failover ensuring high availability. Optional features include custom aliases, URL expiration, and analytics tracking clicks, referrers, and geographic data.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

SynkLoader Malware Spreads via Microsoft Teams Phishing, Steals Credentials and Proxies Traffic

A newly identified malware campaign dubbed SynkLoader targets employees by impersonating IT support staff through external Microsoft 365 tenants on Microsoft Teams. Victims are tricked into downloading and running a malicious MSI file hosted on Azure Blob Storage, which silently installs a multi-stage Python-based loader. The malware establishes persistence via randomly named scheduled tasks created through COM, and deploys a fake full-screen Windows lock screen to harvest user passwords. A module called TrafficRedirector converts the infected machine into a reverse proxy, allowing attackers to tunnel into internal networks while bypassing IP allowlists. Security researchers at Expel published findings on the campaign on August 20, 2026, recommending organizations restrict external Teams communications, block MSI execution, and monitor for suspicious COM-based scheduled task creation.

0 comments Read more at DEV Community