KREMLIN Malware Forges Chrome Integrity Checks to Hijack Brazilian Banking Sessions

·3 views

Elastic Security Labs has tracked a high-severity malware campaign called KREMLIN across seven operations over 15 months, targeting banking users in Brazil. The attack begins when a user opens a JavaScript file disguised as a bank receipt or invoice, which then silently downloads Node.js and establishes persistence via a scheduled task. KREMLIN uses Ethereum smart contracts as dead-drop resolvers to retrieve payloads and locate malicious browser extensions, which are injected into Chrome or Edge profiles without user consent by forging Chromium's Secure Preferences integrity checks. Once installed, the AVSync extension harvests cookies, session data, keystrokes, and HTTP traffic, and receives attacker commands over WebSocket. At the time of reporting, researchers had identified at least 1,515 infected endpoints, with blocking initial JavaScript execution identified as the most effective prevention measure.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to Secure and Deduplicate Telegram Webhooks in Laravel Using Redis

A Laravel tutorial outlines how to build a production-ready Telegram webhook ingestion pipeline that handles duplicate updates and slow processing. The approach uses a custom middleware to validate Telegram's secret token header, ensuring only legitimate requests reach the application. Incoming payloads are immediately dispatched to a queued job and a 200 OK response is returned, preventing Telegram from timing out and resending updates. Redis is used to enforce idempotency by storing processed update IDs with a 24-hour expiry, using atomic SET NX operations to block duplicate processing. The guide focuses strictly on the webhook ingestion layer and does not cover full bot framework setup or worker daemon management.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Study finds Japanese typography broken on 5 major global brand websites due to font errors

A developer scanned the Japanese-language pages of 146 websites — including 109 global brands — using a custom tool and found widespread typography rendering issues. The core problem stems from a Unicode design decision that assigns identical code points to characters used differently in Japanese and Chinese, leaving visual rendering dependent on whichever font loads first. Five global brands were found to be displaying Japanese text using Chinese glyph shapes for every visitor, due to Chinese fonts like Microsoft YaHei or PingFang SC being declared ahead of any Japanese font in their CSS. Notably, in three of those five cases, the problematic font stack was not in the companies' own stylesheets but embedded inside third-party tools such as cookie-consent banners and live-chat widgets. The audit, conducted on 18 August 2026, highlights how outsourced front-end components can silently undermine localisation efforts without site owners being aware.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Python Pattern Uses Anchor Tags to Fix JSON Parsing Errors in Local LLMs

Developers using local large language models via Ollama frequently encounter a parsing problem where models like Llama3 and Mistral return JSON wrapped in markdown code fences instead of plain JSON. This causes json.loads() to raise a JSONDecodeError, and common workarounds like regex replacements are considered unreliable for complex outputs. A proposed solution called Anchor Tag Framing instructs the model through a system prompt to place its JSON output strictly between custom XML-style boundary tags. A lightweight Python parser then extracts content between those tags, with a fallback regex search for raw JSON objects if the tags are absent. The technique leverages how smaller LLMs assign higher attention to distinct token delimiters, making structured output extraction more deterministic and robust.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Five viral 'AI bot made me rich' posts fact-checked — not one held up to scrutiny

A developer running a logged trading system spent a week investigating five viral social media posts claiming AI agents turned small sums into thousands of dollars. Each claim was tested against primary sources including on-chain pool data, official fee schedules, project websites, and the authors' own public demos. None of the five posts survived scrutiny: problems included unverifiable wallets, mathematical contradictions in the posts' own rules, referral-fee incentives that benefited authors regardless of reader outcomes, and platforms that did not support the trades being described. Where real mechanisms existed — such as stablecoin arbitrage on Uniswap — profits were shown to be structurally capped, time-limited, and captured almost entirely by bots. The investigation concludes that while isolated small gains are possible, the gap between claimed returns and verifiable reality was consistent across all five cases.

0 comments Read more at DEV Community