Threat actors with ties to the Democratic People’s Republic of Korea (aka DPRK or North Korea) have been observed leveraging ClickFix-style lures to deliver a known malware called BeaverTail and InvisibleFerret. “The threat actor used ClickFix lures to target marketing and trader roles in cryptocurrency and retail sector organizations rather than targeting software development roles,” GitLab Threat Intelligence researcher Oliver Smith said in a report published last week. First exposed by Palo Alto Networks in late 2023, BeaverTail and InvisibleFerret have been deployed by North Korean operatives as part of a long-running campaign dubbed Contagious Interview (aka Gwisin Gang), wherein the malware is distributed to software developers under the pretext of a job assessment. Assessed to be a subset of the umbrella group Lazarus, the cluster has been active since at least December 2022. Over the years, BeaverTail has also been propagated via bogus npm packages and fraudulent Windows videoconferencing applications like FCCCall and FreeConference. Written in JavaScript, the malware acts as an information stealer and a downloader for a Python-based backdoor known as InvisibleFerret. An important evolution of the campaign involves the use of the ClickFix social engineering tactic to deliver malware such as GolangGhost, PylangGhost, and FlexibleFerret – a sub-cluster of activity tracked as ClickFake Interview. The latest attack wave, observed in late May 2025, is worth highlighting for two reasons: Employing ClickFix to deliver BeaverTail (rather than GolangGhost or FlexibleFerret) and delivering the stealer in the form of a compiled binary produced using tools like pkg and PyInstaller for Windows, macOS, and Linux systems. A fake hiring platform web application created using Vercel serves as a distribution vector for the malware, with the threat actor advertising cryptocurrency trader, sales, and marketing roles at various Web3 organizations, as well as urging targets to invest in a Web3 company. “The threat actor’s targeting of marketing applicants and impersonation of a retail sector organization is noteworthy given BeaverTail distributors’ usual focus on software developers and the cryptocurrency sector,” Smith said. Users who land on the site have their public IP addresses captured and are instructed to complete a video assessment of themselves, at which point a fake technical error about a non-existent microphone issue is displayed and they are asked to an operating system-specific command to supposedly address the problem, effectively leading to the deployment of a leaner version of BeaverTail either by means of a shell script or Visual Basic Script. “The BeaverTail variant associated with this campaign contains a simplified information stealer routine and targets fewer browser extensions,” GitLab said. “The variant targets only eight browser extensions rather than the 22 targeted in other contemporary BeaverTail variants.” Another important omission is the removal of functions related to stealing data from web browsers other than Google Chrome. The Windows version of BeaverTail has also been found relying on a password-protected archive shipped along with the malware to load Python dependencies related to InvisibleFerret. While password-protected archives are a fairly common technique that various threat actors have adopted for some time, this is the first time the method has been used for payload delivery in connection with BeaverTail, indicating that the threat actors are actively refining their attack chains. What’s more, the low prevalence of secondary artifacts in the wild and the absence of social engineering finesse suggest that the campaign may have been a limited test and unlikely to be deployed at scale. “The campaign suggests a slight tactical shift for a subgroup of North Korean BeaverTail operators, expanding beyond their traditional software developer targeting to pursue marketing and trading roles across cryptocurrency and retail sectors,” GitLab said. “The move to compiled malware variants and continued reliance on ClickFix techniques demonstrates operational adaptation to reach less technical targets and systems without standard software development tools installed.” The development comes as a joint investigation from SentinelOne, SentinelLabs, and Validin found that at least 230 individuals have been targeted by the Contagious Interview campaign in fake cryptocurrency job interview attacks between January and March 2025 by impersonating companies such as Archblock, Robinhood, and eToro. This campaign essentially involved using ClickFix themes to distribute malicious Node.js applications dubbed ContagiousDrop that are designed to deploy malware disguised as updates or essential utilities. The payload is tailored to the victim’s operating system and system architecture. It’s also capable of cataloging victim activities and triggering an email alert when the affected individual starts the fake skill assessment. “This activity […] involved the threat actors examining cyber threat intelligence (CTI) information related to their infrastructure,” the companies noted, adding the attackers engaged in a coordinated effort to evaluate new infrastructure before acquisition as well as monitor for signs of detection of their activity through Validin, VirusTotal, and Maltrail. The information gleaned from such efforts is meant to improve the resilience and effectiveness of their campaigns, as well as rapidly deploy new infrastructure following service provider takedowns, reflecting a focus on investing resources to sustain their operations rather than enacting broad changes to secure their existing infrastructure. “Given the continuous success of their campaigns in engaging targets, it may be more pragmatic and efficient for the threat actors to deploy new infrastructure rather than maintain existing assets,” the researchers said. “Potential internal factors, such as decentralized command structures or operational resource constraints, may restrict their capacity to rapidly implement coordinated changes.” “Their operational strategy appears to prioritize promptly replacing infrastructure lost due to takedown efforts by service providers, using newly provisioned infrastructure to sustain their activity.” North Korean hackers have a long history of attempting to gather threat intelligence to further their operations. As early as 2021, Google and Microsoft revealed that Pyongyang-backed hackers targeted security researchers working on vulnerability research and development using a network of fake blogs and social media accounts to steal exploits. Then last year, SentinelOne warned of a campaign undertaken by ScarCruft (aka APT37) targeting consumers of threat intelligence reporting with fake technical reports as decoys to deliver RokRAT, a custom-written backdoor exclusively used by the North Korean threat group. However, recent ScarCruft campaigns have witnessed a departure of sorts, taking the unusual step of infecting targets with custom VCD ransomware, alongside an evolving toolkit comprising stealers and backdoors CHILLYCHINO
ShadowLeak Zero-Click Flaw Leaks Gmail Data via OpenAI ChatGPT Deep Research Agent
Cybersecurity researchers have disclosed a zero-click flaw in OpenAI ChatGPT’s Deep Research agent that could allow an attacker to leak sensitive Gmail inbox data with a single crafted email without any user action. The new class of attack has been codenamed ShadowLeak by Radware. Following responsible disclosure on June 18, 2025, the issue was addressed by OpenAI in early August. “The attack utilizes an indirect prompt injection that can be hidden in email HTML (tiny fonts, white-on-white text, layout tricks) so the user never notices the commands, but the agent still reads and obeys them,” security researchers Zvika Babo, Gabi Nakibly, and Maor Uziel said. “Unlike prior research that relied on client-side image rendering to trigger the leak, this attack leaks data directly from OpenAI’s cloud infrastructure, making it invisible to local or enterprise defenses.” Launched by OpenAI in February 2025, Deep Research is an agentic capability built into ChatGPT that conducts multi-step research on the internet to produce detailed reports. Similar analysis features have been added to other popular artificial intelligence (AI) chatbots like Google Gemini and Perplexity over the past year. In the attack detailed by Radware, the threat actor sends a seemingly harmless-looking email to the victim, which contains invisible instructions using white-on-white text or CSS trickery that tell the agent to gather their personal information from other messages present in the inbox and exfiltrate it to an external server. Thus, when the victim prompts ChatGPT Deep Research to analyze their Gmail emails, the agent proceeds to parse the indirect prompt injection in the malicious email and transmit the details in Base64-encoded format to the attacker using the tool browser.open(). “We crafted a new prompt that explicitly instructed the agent to use the browser.open() tool with the malicious URL,” Radware said. “Our final and successful strategy was to instruct the agent to encode the extracted PII into Base64 before appending it to the URL. We framed this action as a necessary security measure to protect the data during transmission.” The proof-of-concept (PoC) hinges on users enabling the Gmail integration, but the attack can be extended to any connector that ChatGPT supports, including Box, Dropbox, GitHub, Google Drive, HubSpot, Microsoft Outlook, Notion, or SharePoint, effectively broadening the attack surface. Unlike attacks like AgentFlayer and EchoLeak, which occur on the client-side, the exfiltration observed in the case of ShadowLeak transpires directly within OpenAI’s cloud environment, while also bypassing traditional security controls. This lack of visibility is the main aspect that distinguishes it from other indirect prompt injection vulnerabilities similar to it. ChatGPT Coaxed Into Solving CAPTCHAs# The disclosure comes as AI security platform SPLX demonstrated that cleverly worded prompts, coupled with context poisoning, can be used to subvert ChatGPT agent’s built-in guardrails and solve image-based CAPTCHAs designed to prove a user is human. The attack essentially involves opening a regular ChatGPT-4o chat and convincing the large language model (LLM) to come up with a plan to solve what’s described to it as a list of fake CAPTCHAs. In the next step, a new ChatGPT agent chat is opened and the earlier conversation with the LLM is pasted, stating this was “our previous discussion” – effectively causing the model to solve the CAPTCHAs without any resistance. “The trick was to reframe the CAPTCHA as “fake” and to create a conversation where the agent had already agreed to proceed. By inheriting that context, it didn’t see the usual red flags,” security researcher Dorian Schultz said. “The agent solved not only simple CAPTCHAs but also image-based ones — even adjusting its cursor to mimic human behavior. Attackers could reframe real controls as ‘fake’ to bypass them, underscoring the need for context integrity, memory hygiene, and continuous red teaming.”
Russian Hackers Gamaredon and Turla Collaborate to Deploy Kazuar Backdoor in Ukraine
Cybersecurity researchers have discerned evidence of two Russian hacking groups Gamaredon and Turla collaborating together to target and co-comprise Ukrainian entities. Slovak cybersecurity company ESET said it observed the Gamaredon tools PteroGraphin and PteroOdd being used to execute Turla group’s Kazuar backdoor on an endpoint in Ukraine in February 2025, indicating that Turla is very likely actively collaborating with Gamaredon to gain access to specific machines in Ukraine and deliver the Kazuar backdoor. “PteroGraphin was used to restart the Kazuar v3 backdoor, possibly after it crashed or was not launched automatically,” ESET said in a report shared with The Hacker News. “Thus, PteroGraphin was probably used as a recovery method by Turla.” In a separate instance in April and June 2025, ESET said it also detected the deployment of Kazuar v2 through two other Gamaredon malware families tracked as PteroOdd and PteroPaste. Both Gamaredon (aka Aqua Blizzard and Armageddon) and Turla (aka Secret Blizzard and Venomous Bear) are assessed to be affiliated with the Russian Federal Security Service (FSB), and are known for their attacks targeting Ukraine. “Gamaredon has been active since at least 2013. It is responsible for many attacks, mostly against Ukrainian governmental institutions,” ESET said. “Turla, also known as Snake, is an infamous cyber espionage group that has been active since at least 2004, possibly extending back into the late 1990s. It mainly focuses on high-profile targets, such as governments and diplomatic entities, in Europe, Central Asia, and the Middle East. It is known for having breached major organizations such as the US Department of Defense in 2008 and the Swiss defense company RUAG in 2014.” The cybersecurity company said Russia’s full-scale invasion of Ukraine in 2022 likely fueled this convergence, with the attacks primarily focusing on the Ukrainian defense sector in recent months. One of Turla’s staple implants is Kazuar, a frequently updated malware that has previously leveraged Amadey bots to deploy a backdoor called Tavdig, which then drops the .NET-based tool. Early artifacts associated with the malware have been spotted in the wild as far back as 2016, per Kaspersky. PteroGraphin, PteroOdd, and PteroPaste, on the other hand, are part of a growing arsenal of tools developed by Gamaredeon to deliver additional payloads. PteroGraphin is a PowerShell tool that uses Microsoft Excel add-ins and scheduled tasks as a persistence mechanism and uses the Telegraph API for command-and-control (C2). It was first discovered in August 2024. The exact initial access vector used by Gamaredon is not clear, but the group has a history of using spear-phishing and malicious LNK files on removable drives using tools like PteroLNK for propagation. In all, Turla-related indicators have been detected on seven machines in Ukraine over the past 18 months, out of which four were breached by Gamaredon in January 2025. The deployment of the latest version of Kazuar (Kazuar v3) is said to have taken place towards the end of February. “Kazuar v2 and v3 are fundamentally the same malware family and share the same codebase,” ESET said. “Kazuar v3 comprises around 35% more C# lines than Kazuar v2 and introduces additional network transport methods: over web sockets and Exchange Web Services.” The attack chain involved Gamaredon deploying PteroGraphin, which was used to download a PowerShell downloader dubbed PteroOdd that, in turn, retrieved a payload from Telegraph to execute Kazuar. The payload is also designed to gather and exfiltrate the victim’s computer name and system drive’s volume serial number to a Cloudflare Workers sub-domain, before launching Kazuar. That said, it’s important to note here that there are signs suggesting Gamaredon downloaded Kazuar, as the backdoor is said to have been present on the system since February 11, 2025. In a sign that this was not an isolated phenomenon, ESET revealed that it identified another PteroOdd sample on a different machine in Ukraine in March 2025, on which Kazuar was also present. The malware is capable of harvesting a wide range of system information, along with a list of installed .NET versions, and transmitting them to an external domain (“eset.ydns[.]eu”). The fact that Gamaredon’s toolset lacks any .NET malware and Turla’s Kazuar is based in .NET suggests this data gathering step is likely meant for Turla, the company assessed with medium confidence. The second set of attacks was detected in mid-April 2025, when PteroOdd was used to drop another PowerShell downloader codenamed PteroEffigy, which ultimately contacted the “eset.ydns[.]eu” domain to deliver Kazuar v2 (“scrss.ps1”), which was documented by Palo Alto Networks in late 2023. ESET said it also detected a third attack chain on June 5 and 6, 2025, it observed a PowerShell downloader referred to as PteroPaste being employed to drop and install Kazuar v2 (“ekrn.ps1”) from the domain “91.231.182[.]187” on two machines located in Ukraine. The use of the name “ekrn” is possibly an attempt by threat actors to masquerade as “ekrn.exe,” a legitimate binary associated with ESET endpoint security products. “We now believe with high confidence that both groups – separately associated with the FSB – are cooperating and that Gamaredon is providing initial access to Turla,” ESET researchers Matthieu Faou and Zoltán Rusnák said.
