Vibe Coded Extortion: Path from Legal Lure to CrownX Ransom Capabilities

A sophisticated multi-stage phishing campaign delivers a previously undocumented framework called Avalon through spoofed legal documents hosted on Proton Drive. The intrusion begins with password-protected archives containing ISO images that execute malicious MSBuild projects, loading payloads entirely in memory without conventional executable attachments. Avalon consolidates credential theft, lateral movement, recovery disruption, and ransomware capabilities within a single framework, with its encryption component branded as CrownX. The framework demonstrates hallmarks of AI-assisted development, rapidly combining multiple post-exploitation capabilities that previously required sustained development effort. Avalon targets browsers, cryptocurrency wallets, messaging platforms, VPN configurations, and infrastructure systems while implementing extensive defense evasion techniques against major security products. The framework disrupts recovery by eliminating Volume Shadow Copies, Windows Recovery Environment...

Pulse ID: 6a46d120d41fcc87a8a52932
Pulse Link: https://otx.alienvault.com/pulse/6a46d120d41fcc87a8a52932
Pulse Author: AlienVault
Created: 2026-07-02 20:59:12

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Browser #CyberSecurity #Encryption #Extortion #InfoSec #MSBuild #OTX #OpenThreatExchange #Password #Phishing #RAT #RansomWare #VPN #Windows #Word #bot #cryptocurrency #AlienVault

PamStealer: a Rust-based macOS infostealer that validates credentials through PAM

PamStealer is a two-stage macOS infostealer distributed as a compiled AppleScript impersonating Maccy, a legitimate clipboard manager, hosted on a fake domain. The first stage uses JavaScript for Automation with Objective-C APIs to download payloads while avoiding shell commands. The second stage is a Rust-based Mach-O binary that validates stolen credentials through PAM before harvesting, reads browser databases directly using bundled SQLite, captures clipboard contents repeatedly via pbpaste, and exfiltrates encrypted data using ChaCha20-Poly1305. It establishes persistence through both modern and legacy login item APIs, masquerades as Finder or System Settings, and tricks victims into granting Full Disk Access through counterfeit alerts. The stealer contacts Ethereum RPC endpoints and employs region-based exclusions targeting Apple silicon systems while avoiding Commonwealth of Independent States countries.

Pulse ID: 6a471de6cf9848f2ef9503c0
Pulse Link: https://otx.alienvault.com/pulse/6a471de6cf9848f2ef9503c0
Pulse Author: AlienVault
Created: 2026-07-03 02:26:46

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Browser #ChaCha20 #Clipboard #CyberSecurity #Endpoint #InfoSec #InfoStealer #Java #JavaScript #Mac #MacOS #OTX #OpenThreatExchange #RAT #RPC #Rust #SQL #bot #AlienVault

AsyncRAT and Remcos Delivered in Multi-Stage Phishing Campaign

A widespread phishing campaign distributing AsyncRAT and Remcos RATs has been observed targeting organizations across manufacturing, media, professional services, agriculture, and chemical industries globally. The attack leverages malicious Excel spreadsheets sent via emails impersonating business communications like purchase orders and payment advice. When macros are enabled, VBA code retrieves HTA payloads through URL shorteners and Cloudflare Workers infrastructure. The multi-stage infection chain employs heavy obfuscation including Base64 encoding, steganography in PNG files, and character substitution. The campaign intensified during June 2026, affecting organizations across Europe, Asia-Pacific, and the Americas. Infrastructure includes distinctive HTA naming conventions using concatenated positive English words. The operation likely uses automation for payload generation and may leverage LLMs for development efficiency.

Pulse ID: 6a471de4dcdacfc396979ab8
Pulse Link: https://otx.alienvault.com/pulse/6a471de4dcdacfc396979ab8
Pulse Author: AlienVault
Created: 2026-07-03 02:26:44

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Americas #Asia #AsyncRAT #Cloud #CyberSecurity #Email #Europe #Excel #InfoSec #Mac #Manufacturing #OTX #OpenThreatExchange #Phishing #RAT #Remcos #RemcosRAT #Steganography #Word #bot #AlienVault

Apple in Talks to Buy Memory Chips From Chinese Makers CXMT and YMTC

Apple is in talks to buy memory from Chinese semiconductor companies ChangXin Memory Technologies Co. (CXMT) and Yangtze Memory Technologies Co. (YMTC), reports Bloomberg, citing sources with knowledge of the talks. Dis…

https://www.macrumors.com/2026/07/01/apple-memory-chips-chinese-companies/

#Tech #Technology #TechNews #AI #Gadgets #Software #Cybersecurity #Apple #Google #Microsoft #Startup #OpenSource #MacRumors [MacRumors]

🟠 CVE-2026-54998 - High (8.8)

Incorrect authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-54998/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Alt...

CVE Alert: CVE-2026-54998

🔴 CVE-2026-57100 - Critical (9.9)

Server-side request forgery (ssrf) in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57100/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Alt...

CVE Alert: CVE-2026-57100

Singapore cops seize $42 million mansion, freeze $772k bank account of suspected Nvidia AI GPU smugglers …

Four individuals suspected of smuggling Nvidia AI GPUs into China by using Singapore as a transshipment point are facing multiple charges. Singaporean authorities say they are not obliged to enforce foreign export contr…

https://www.tomshardware.com/tech-industry/singapore-cops-seize-usd42-million-mansion-freeze-usd772k-bank-account-of-suspected-nvidia-ai-gpu-smugglers-individuals-alleged-to-have-illegally-exported-data-center-servers-to-china-charged-with-fraud-money-laundering

#Tech #Technology #TechNews #AI #Gadgets #Software #Cybersecurity #Apple #Google #Microsoft #Startup #OpenSource #TomsHardware [Tom's Hardware]

HP has slashed $1,300 off this colossal 5080 gaming laptop for July 4 — 34% discount gets you 32GB of RAM and 24-core Arrow Lake mobile gaming for $2,499

Get $1,300 off this HP Omen Max Gaming laptop with Intel Core Ultra 9 275HX, RTX 5080, and 32GB of RAM.

https://www.tomshardware.com/laptops/gaming-laptops/hp-has-slashed-usd1-300-off-this-colossal-5080-gaming-laptop-for-july-4-34-percent-discount-gets-you-32gb-of-ram-and-24-core-arrow-lake-mobile-gaming-for-usd2-499

#Tech #Technology #TechNews #AI #Gadgets #Software #Cybersecurity #Apple #Google #Microsoft #Startup #OpenSource #TomsHardware [Tom's Hardware]

What is a robot today? #negativepid #digitalInvestigations #OSINT #cybersecurity #AI #tech #onlineInvestigations #robotics #cyberpsychology #cybercrime https://negativepid.blog/what-is-a-robot-today/?utm_source=mastodon&utm_medium=social&utm_campaign=fedica-Negative-PID-Blog

Possible Phishing 🎣
on: ⚠️hxxp[:]//aartisahu15[.]github[.]io/task5-amazon_clone
🧬 Analysis at: https://urldna.io/scan/6a4684ba3b77500004805712
#cybersecurity #phishing #infosec #urldna #scam #infosec

Save $521 on this 4K-capable RTX 5070 gaming PC from CyberPowerPC, now just $1,349 — huge price drop for budget-friendly rig with impressive I…

Save over $500 on this powerful CyberPowerPC gaming machine with an RTX 5070 and brand-new Intel Core Ultra 5 250KF CPU, alongside a 1TB SSD and 16GB of DDR5 RAM, all for only $1,349.

https://www.tomshardware.com/desktops/gaming-pcs/save-usd521-on-this-4k-capable-rtx-5070-gaming-pc-from-cyberpowerpc-now-just-usd1-349-huge-price-drop-for-budget-friendly-rig-with-impressive-intel-core-ultra-250kf-cpu-16gb-ddr5-and-1tb-ssd

#Tech #Technology #TechNews #AI #Gadgets #Software #Cybersecurity #Apple #Google #Microsoft #Startup #OpenSource #TomsHardware [Tom's Hardware]

Startup activates nuclear microreactor live on stage to power an Nvidia RTX Spark desktop PC — firm worki…

Valar Atomics claims to be the first startup to produce nuclear power, and it demonstrated that ability on stage by using its Ward 250 microreactor to power an RTX Spark unit. It also announced a partnership with Nvidia…

https://www.tomshardware.com/tech-industry/data-centers/startup-activates-nuclear-microreactor-live-on-stage-to-power-an-nvidia-rtx-spark-desktop-pc-firm-working-with-nvidia-to-build-a-30mw-closed-loop-ai-factory-that-doesnt-use-local-water

#Tech #Technology #TechNews #AI #Gadgets #Software #Cybersecurity #Apple #Google #Microsoft #Startup #OpenSource #TomsHardware [Tom's Hardware]

#chrome extension Satoru Gojo Vs Suguru Get seems malicious. Its #cybersecurity badness score is 92/100!

```json
{"id": "gpfdgpikbndcmbfnemoplnkcepogomkl", "score": 92, "platform": "chrome", "name": "Satoru Gojo Vs Suguru Get"}
```

#chrome extension Check Bm KiểM Tra Business seems malicious. Its #cybersecurity badness score is 86/100!

```json
{"id": "nfelknjakpojmdnobefebknmijjgclnp", "score": 86, "platform": "chrome", "name": "Check Bm Ki\u1ec3M Tra Business"}
```

Possible Phishing 🎣
on: ⚠️hxxps[:]//mirror-google[.]com
🧬 Analysis at: https://urldna.io/scan/6a4684ca3b77500004805727
#cybersecurity #phishing #infosec #urldna #scam #infosec

OpenAI mulling giving US gov't a 5% stake in the company, days after Washington delayed GPT-5.6 — Altman reportedly wants every leading U.S. AI lab paying into an Alaska-style pub…

Altman is understood to have raised the idea with President Donald Trump, Commerce Secretary Howard Lutnick, and Treasury Secretary Scott Bessent.

https://www.tomshardware.com/tech-industry/artificial-intelligence/openai-floats-5-percent-government-stake-days-after-washington-delayed-gpt-5-6

#Tech #Technology #TechNews #AI #Gadgets #Software #Cybersecurity #Apple #Google #Microsoft #Startup #OpenSource #TomsHardware [Tom's Hardware]

Intel hikes pricing for its flagship desktop PC chips by up to $50 — official Core Ultra 270K Plus and 250K Plus product pages now …

Intel's Arrow Lake Refresh processors remain among the company's strongest desktop offerings, but newly updated pricing makes both CPUs noticeably more expensive than when they debuted in March.

https://www.tomshardware.com/pc-components/cpus/intel-hikes-pricing-for-its-flagship-desktop-pc-chips-by-up-to-usd50-official-core-ultra-270k-plus-and-250k-plus-product-pages-now-recommend-prices-of-up-to-usd349-and-usd229-respectively

#Tech #Technology #TechNews #AI #Gadgets #Software #Cybersecurity #Apple #Google #Microsoft #Startup #OpenSource #TomsHardware [Tom's Hardware]

🚨 EUVD-2026-41471

📊 Score: 7.5/10 (CVSS v3.1)
📦 Product: AR For WordPress
🏢 Vendor: webandprint
📅 Updated: 2026-07-03

📝 The AR for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 8.40 via the 'file' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary ...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-41471

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-41470

📊 Score: 6.4/10 (CVSS v3.1)
📦 Product: weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot
🏢 Vendor: wedevs
📅 Updated: 2026-07-03

📝 The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sectionTitleTag' and 'articleTitleTag' Block...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-41470

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-41469

📊 Score: 4.9/10 (CVSS v3.1)
📦 Product: Cookie Banner for GDPR / CCPA – WPLP Cookie Consent
🏢 Vendor: wplegalpages
📅 Updated: 2026-07-03

📝 The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 4.3.5 due to insufficient escapin...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-41469

#cybersecurity #infosec #euvd #cve #vulnerability

Possible Phishing 🎣
on: ⚠️hxxps[:]//recreate-instagrampage[.]vercel[.]app
🧬 Analysis at: https://urldna.io/scan/6a466efd3b7750000480548b
#cybersecurity #phishing #infosec #urldna #scam #infosec

🚨 EUVD-2026-41468

📊 Score: 4.3/10 (CVSS v3.1)
📦 Product: weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot
🏢 Vendor: wedevs
📅 Updated: 2026-07-03

📝 The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 2.3.0. This is due to a...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-41468

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-41467

📊 Score: 6.4/10 (CVSS v3.1)
📦 Product: weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot
🏢 Vendor: wedevs
📅 Updated: 2026-07-03

📝 The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'connectorWidth' Block Attribute in all versi...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-41467

#cybersecurity #infosec #euvd #cve #vulnerability

Asus B850-Creator Wifi Neo motherboard review: AM5 Creator mobo looks the part, but is missing useful features

Asus' B850-Creator Wifi Neo offers fast dual 5 GbE, 3x video outputs, and loads of EZ PC DIY/AI features, but lacks enough USB ports (no 40 Gbps at all) and is expensive for the B850 platform.

https://www.tomshardware.com/pc-components/motherboards/asus-b850-creator-wifi-neo-motherboard-review

#Tech #Technology #TechNews #AI #Gadgets #Software #Cybersecurity #Apple #Google #Microsoft #Startup #OpenSource #TomsHardware [Tom's Hardware]

🟠 CVE-2026-58460 - High (7.7)

react-native-receive-sharing-intent contains a path traversal vulnerability that allows a co-resident malicious application to write files outside the intended cache directory by supplying a crafted _display_name value containing dot-dot path comp...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58460/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Alt...

CVE Alert: CVE-2026-58460

🔴 CVE-2026-52830 - Critical (9.4)

fast-mcp-telegram is a Telegram MCP Server. Prior to 0.19.1, fast-mcp-telegram validates HTTP Bearer tokens by joining the raw token string into a session-file path. The verifier rejects the exact reserved token telegram, but it does not reject pa...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-52830/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Alt...

CVE Alert: CVE-2026-52830

🔴 CVE-2026-59099 - Critical (9.1)

Apereo CAS 7.3.0 before 8.0.0-RC6 contains a cryptographic vulnerability that allows remote unauthenticated attackers to recover plaintext conversation state by exploiting AES-GCM initialization vector reuse across the server lifetime. Attackers c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-59099/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Alt...

CVE Alert: CVE-2026-59099

🖲️ #Cybersecurity #Ciberseguridad #Ciberseguranca #Security #Seguridad #Seguranca #News #Noticia #Noticias #Tecnologia #Technology
⚫ Why Identity Security Is Your Cyber Career Entry Point
🔗 https://www.darkreading.com/cybersecurity-operations/identity-security-cyber-career-entry-point

As AI reshapes cybersecurity workflows, John Paul Cunningham, CISO at SIlverfort, says the technology is creating opportunities rather than eliminating jobs — and there are more ways than ever to break into

Tor Project released Arti 2.5.0, moving its next-gen Counter Galois Onion (CGO) encryption to stable status—now included in full feature builds. The update also patches two DoS issues in Arti’s Rust Tor implementation and enables congestion control by default for better performance. 🚀🔒 #Tor #Arti #CGO #Cybersecurity https://cyberinsider.com/tor-releases-arti-2-5-0-with-stable-cgo-encryption-and-security-fixes/

Google loses final fight over its $4.7 billion Android antitrust fine

Google’s long-running battle over a huge Android antitrust fine has ended with the EU’s top court upholding the penalty.

https://www.androidauthority.com/google-android-antitrust-eu-fine-appeal-fails-3683964/

#Tech #Technology #TechNews #AI #Gadgets #Software #Cybersecurity #Apple #Google #Microsoft #Startup #OpenSource #AndroidAuthority [Android Authority]

Tesla driver faces manslaughter charges over Texas crash that killed a woman inside her home

The man whose Tesla struck and killed a woman inside her Texas home last month is now facing manslaughter charges, as reported earlier by The Wall Street Journal and local news outlet KHOU 11. 44-year-old Michael Butler…

https://www.theverge.com/transportation/961161/tesla-fsd-katy-tx-manslaughter-charges

#Tech #Technology #TechNews #AI #Gadgets #Software #Cybersecurity #Apple #Google #Microsoft #Startup #OpenSource #TheVerge [The Verge]

I've been reviewing laptops for years: These are the 15+ best July 4th laptop deals

The Fourth of July weekend brings tons of sales on top laptops we've reviewed, from Apple, Acer, Lenovo, and more.

https://www.zdnet.com/article/july-4-laptop-deals-2026/

#Tech #Technology #TechNews #AI #Gadgets #Software #Cybersecurity #Apple #Google #Microsoft #Startup #OpenSource #ZDNet [ZDNet]

Virginia Bans Sale of Geolocation Data

https://www.hunton.com/privacy-and-cybersecurity-law-blog/virginia-bans-sale-of-geolocation-data

#HackerNews #Virginia #Geolocation #Data #Privacy #DataProtection #TechNews #Cybersecurity

Security Tip: Use lockfiles to ensure deterministic builds. 🛡️

Relying on version ranges in manifest files can lead to different versions being installed across environments. By committing lockfiles (package-lock.json, Gemfile.lock, etc.), you ensure every build uses the exact same dependency tree, preventing "silent" security regressions.

Track the latest vulnerabilities at: https://cvedatabase.com

#CyberSecurity #DevSecOps #AppSec #CVE #InfoSec

Possible Phishing 🎣
on: ⚠️hxxps[:]//general-trading[.]weebly[.]com
🧬 Analysis at: https://urldna.io/scan/6a463e7f3b775000047bd093
#cybersecurity #phishing #infosec #urldna #scam #infosec

Cyberbullying, harassment, and digital trauma #negativepid #digitalInvestigations #OSINT #cybersecurity #AI #tech #onlineInvestigations #robotics #cyberpsychology #cybercrime https://negativepid.blog/cyberbullying-harassment-and-digital-trauma/?utm_source=mastodon&utm_medium=social&utm_campaign=fedica-Negative-PID-Blog

LG is giving away free single-door refrigerators - how to qualify for the deal

When you buy this refrigerator model on sale, LG will give you a free single-door refrigerator too - perfect for the garage or basement.

https://www.zdnet.com/article/lg-free-refrigerator-deal/

#Tech #Technology #TechNews #AI #Gadgets #Software #Cybersecurity #Apple #Google #Microsoft #Startup #OpenSource #ZDNet [ZDNet]