Three open directories on the PaperCut campaign server exposed the operator's full toolkit.

The tooling included four custom Rust Windows binaries for LSA secret collection and registry hive dumping, Python scripts for offline NT hash recovery and service credential parsing, and a chisel-based Linux persistence mechanism with cron. The exploit framework had three variants targeting different PaperCut versions, with version auto-detection and automatic cleanup of modified config values after each run.

The whole operation was orchestrated by a DeepSeek AI model through the OpenAI Codex harness, with a 19KB instruction file directing up to 25 concurrent subagents.

MD5 hashes and full analysis: https://hunt.io/blog/papercut-attacker-ai-toolkit-exploit-code-second-rce

Hi All, This interesting malware came to my attention. I have analysed it and so far discovered the following: You run the masked .exe file; it checks if the machine is not ARM or running in VMware environment, and then it executes itself. It possibly executes directly into RAM. I am still going through ram dump but its interesting as its masking the IP from Cloudfare - 172.67.168.69 Has anyone seen this or similar one ?

Hi everyone,

I want to issue an urgent security warning regarding a trending YouTube campaign promoting a tool called "VRChat-DLSS5-Cam" hosted on GitHub (under the user seefn1000-afk).

https://github.com/seefn1000-afk/VRChat-DLSS5-Cam

THIS IS A SOPHISTICATED MALWARE TRAP. DO NOT DOWNLOAD OR RUN IT.

Here is the breakdown of the technical evidence proving this is a scam, including how the hacker bypassed automated security filters to trick users:

1. The Ultimate Proof: Globally Blacklisted by URLhaus

This is not a guess; it is verified by global threat intelligence. The exact download link embedded in the repository's README (.../resources/VR-DLS-Cam-Chat-v3.3.zip) has been officially investigated and blacklisted by Abuse.ch URLhaus (Database ID: 3931216).

https://urlhaus.abuse.ch/url/3931216/

• Threat Type: Malware download (SmartLoader / LuaJIT-loader).
• Behavior: Once clicked, it silently drops a malicious payload containing Application.bat and cli.exe into your system to steal browser passwords, active session cookies, Steam configurations, and Discord tokens.

1. The GitDiagram Illusion (How they fooled advanced users)

The hacker went out of their way to make the project look professional by uploading non-functional, stolen C++ files (main.cpp, App.cpp, DlssnrFeature.cpp) so that tools like GitDiagram would generate a massive, highly detailed system architecture map.

• The Reality: The system diagram shows fake components like NvOpticalFlow.cpp and DepthEstimator.cpp claiming to calculate depth maps externally via a "Spout Capture". Physically, a 2D Spout video feed cannot mathematically calculate Unity's 3D game engine depth buffer from the outside without native engine integration.
• The Trap: Automated repository scanners only checked the clean, text-based C++ placeholder files, giving it a "LOW RISK" score based on only 2% file coverage. The remaining 98% of the data—the actual virus—is hidden inside the un-scanned .zip archive.

1. The Technical Lies

• DLSS 5 Does Not Exist: NVIDIA’s current commercial technology is DLSS 3, with active AI research moving into DLSS 4 branches. There is absolutely no official "DLSS 5" on the market.
• GTX 1060 Hardware Impossibility: The repository claims to run "DLSS Neural Rendering" on a GTX 1060. GTX cards physically lack Tensor Cores, making it architecturally impossible for them to compute neural network rendering models.

Current Action Taken

This repository has been officially reported to GitHub Trust & Safety under the Article 16 Digital Services Act (DSA) regulatory framework for immediate removal.

If you see YouTube videos pushing this "DLSS 5 camera mod" with beautiful visual demonstrations, please report the video and do not click the link. Kicking off an executable file with admin rights will compromise your accounts in less than 3 seconds.

If you want realistic photography in VRChat, please stay safe and stick to trusted, avatar-based camera prefabs like VRCLens or VirtualLens2 on BOOTH.pm!

Researchers at Apiiro identified 17,610 malicious GitHub repositories associated with a campaign called FakeGit.

The repositories are designed to resemble legitimate software projects.

Many contain convincing documentation and download buttons. However, the downloads can deliver SmartLoader, a malware loader associated with the StealC information stealer.

StealC is designed to steal sensitive information such as credentials and browser session data. Researchers discovered that attackers were repeatedly updating existing repositories rather than constantly creating new ones.

This allowed the campaign to reuse established repositories and redirect visitors toward fresh malicious downloads.

Some repositories were associated with accounts that appeared to belong to legitimate developers.

Original security research published October 6, with subsequent reporting.

The 17,610 figure represents the researchers' observed campaign inventory, not a verified count of repositories still active today.

This directly affects people who download privacy software, cybersecurity utilities, cryptocurrency tools, and other open-source applications.

A project being hosted on GitHub does not automatically make it trustworthy.

Attackers can create convincing repositories or compromise legitimate developer accounts.

Hey everyone,

While analyzing modern loaders and crypters, I kept running into cases where naive, section-wide Shannon entropy ($H > 7.2$) failed to flag suspicious binaries:

1. Averaging dilution: Stashing a 20 KB encrypted shellcode blob inside a 1 MB .rdata section padded with nulls keeps the global entropy below 5.5.
2. Artificial dilution: Padding ciphertext with repeated non-null bytes (like NOP sleds or repeated delimiters) artificially compresses entropy down to benign code levels.
3. String-based staging: Staging payloads as UUID or IPv4 tables (UuidFromStringA, RtlIpv4StringToAddressA) keeps disk entropy around 4.0 until runtime reassembly in memory.

Most quick-triage tools calculate entropy across the entire file or whole sections, which washes out these localized spikes.

To solve this, I wrote EntropyStrip, an open-source Python CLI designed for fast PE structural triage.

What it does differently:

• Dual-Resolution Sliding Windows: Scans sections and overlays in 1024-byte and 256-byte windows with a 50% step to catch concentrated cryptographic stagers regardless of total section size.
• Dilution Defense & Chi-Square: Analyzes modal byte distributions and opcode frequency curves to flag artificially flattened ciphertext.
• String Staging Primitives: Flags UuidFromString* and RtlIpv4StringToAddress* staging patterns and detects formatted UUID payload clusters.
• False Positive Reduction: Validates WIN_CERTIFICATE Authenticode tables and NSIS header signatures (0xdeadbeef) so digitally signed binaries and legitimate installers are not falsely scored as malware droppers.
• Payload Carving: Includes --dump to carve out anomalous sections or trailing overlays straight to disk for Ghidra or x64dbg.
• Directory Triage: --dir walks entire folders and ranks binaries on a risk leaderboard with MITRE ATT&CK mapping (T1027, T1055, etc.).

Quick install:

bash pip install entropystrip Edit: Fixed Markdown

Over the last few days I’ve seen several WebAssembly game ports go viral: the unofficial GTA V one (playgta5.com, which reportedly went down within hours) and a fan-made BO1 Zombies port. Reports suggest the GTA V one runs locally using WASM + WebGPU and may be built from leaked source code, but nobody has confirmed that.

I know WASM runs in the same browser sandbox as JS, so I’m not assuming “WASM = instant RCE”. What worries me is everything around it, especially now that the original site is gone and clone/mirror domains are probably popping up.

Is Phone Guardian a good antivirus app?

Is malwarebytes actually a good antivirus/security app?

Hello,

I was trying to download a game from www.ziperto.com and after downloading a file I accidentally run a ~600 Kb .exe (I know, I wanted to hit backspace to delete the folder, instead I hastily pressed enter). I then got a message that the executable was not compatible with Windows.

The morning after I've got a notification from my bank about a purchase I didn't make on PayPal, and hundreds of emails in my inbox. I flagged the purchase, changed my passwords, and blocked my card. It seems a strange coincidence with the .exe.

I now ran MalwareBytes and Defender deep scan, nothing was found, but I am still paranoid that something is running on my PC. I checked and couldn't find any browser-proxy installed or any strange service or executable, but I am still paranoid.

I don't have 2FA on PayPal as I have never use it but I am wondering how they got into my PayPal account from another device, even with the password I usually have to confirm the access from a secondary email. My PC was turned off when the purchase happened.

Any idea how this could have happened and what should I check on my PC? I would like to avoid wiping the whole Windows 10 installation.