Daily Reading for 2026-08-15

Security

Security Risk Advisors

• 🚩 Jewelbug Combines Government Espionage and Cryptocurrency Fraud Through Shared Browser-Centric Malware Infrastructure

  ONE SENTENCE SUMMARY

  Jewelbug, a China-based hackers-for-hire group, runs government espionage and cryptocurrency fraud from shared browser-centric malware infrastructure.

  MAIN POINTS

  1. Jewelbug operates espionage against governments and militaries in Middle East, Southeast Asia, and South Asia.
  2. The group runs a parallel for-profit cryptocurrency fraud business targeting Chinese-speaking victims.
  3. Both missions are administered from a single control panel called XG-Web.
  4. XG-Web is a browser-centric remote-access framework turning victims’ browsers into remote-control channels.
  5. The main implant is the Antino backdoor, using Microsoft Graph API for command-and-control.
  6. A malicious “PDF Viewer” browser extension harvests credentials, cookies, and intercepts traffic.
  7. ClientKing, a Rust implant, targets Linux servers and network devices with kernel-module loading.
  8. A watering-hole attack compromised over 15 government webmail tenants in a Middle Eastern country.
  9. The victim database recorded over one million implant check-ins and 580,000 stolen cookies.
  10. Operators are tied to a registered Hunan company with a named legal representative.

  TAKEAWAYS

  1. Browser-centric malware frameworks enable deep access to victims’ digital lives and internal networks.
  2. Shared infrastructure between espionage and criminal operations reveals hack-for-hire business models.
  3. Compromising shared hosting providers can yield access to entire government webmail estates.
  4. Operators’ operational discipline is uneven, with reused credentials and development-mode production servers.
  5. The group’s dual mission demonstrates the convergence of state-sponsored espionage and profit-driven cybercrime.

• Apple Confirms New Mercenary Spyware Threat Notifications Sent to Users in 110 Countries

  ONE SENTENCE SUMMARY

  Apple has sent high-confidence mercenary spyware threat notifications to users in over 150 countries since 2021, with recent alerts going to individuals in 110 countries.

  MAIN POINTS

  1. Apple threat notifications warn users individually targeted by mercenary spyware attacks.
  2. These attacks are far more sophisticated than regular cybercriminal activity.
  3. Mercenary spyware costs millions and has a short shelf life.
  4. Such attacks are associated with state actors and companies like NSO Group.
  5. Targets include journalists, activists, politicians, and diplomats globally.
  6. Apple relies solely on internal threat intelligence to detect attacks.
  7. Notifications are high-confidence alerts but cannot achieve absolute certainty.
  8. Apple does not attribute attacks to specific attackers or regions.
  9. Users are notified via iPhone alerts, email, and Apple Account page.
  10. Apple recommends Lockdown Mode and expert help from Access Now.

  TAKEAWAYS

  1. Enable Lockdown Mode if you suspect you’re a spyware target.
  2. Verify threat notifications by signing into account.apple.com.
  3. Apple never asks for passwords or codes in threat notifications.
  4. Seek help from the Digital Security Helpline at Access Now.
  5. Follow general security practices to protect against cyber threats.

• 🚩 Browser-in-the-Browser (BitB) Phishing Campaign Impersonates Recruiters at 50+ Brands to Steal Credentials

  ONE SENTENCE SUMMARY:

  A global phishing campaign uses fake recruitment portals and Browser-in-the-Browser attacks to steal corporate credentials and bypass MFA.

  MAIN POINTS:

  1. CTM360’s RecruitTrap report exposes a recruitment-themed phishing campaign.
  2. Attackers use fake interview invitations and counterfeit scheduling portals.
  3. Browser-in-the-Browser (BitB) windows steal credentials and relay MFA challenges.
  4. Over 3,000 phishing URLs impersonated recruiters from 50+ organizations.
  5. Campaign primarily targets marketing professionals with corporate email accounts.
  6. Attack filters for corporate accounts to enable credential theft.
  7. Potential account takeover is a major risk for victims.
  8. Campaign ran for over two months before detection.
  9. Fake login windows mimic legitimate authentication to deceive users.
  10. Report provides threat intelligence for defending against BitB attacks.

  TAKEAWAYS:

  1. Verify recruitment communications through official channels before responding.
  2. Be wary of unsolicited interview invitations and scheduling links.
  3. Check browser URLs carefully for signs of BitB phishing windows.
  4. Use phishing-resistant MFA methods to mitigate credential relay attacks.
  5. Organizations should train employees on recruitment-themed phishing tactics.

• 🚩 JWR Phishing Framework gives Operators Real-Time Control over Victim Sessions to Steal Payment Data, Credentials, 2FA Codes, and Identity Documents.

  ONE SENTENCE SUMMARY

  JWR is an undocumented, operator-controlled phishing framework that steals payment data, credentials, 2FA codes, and identity documents in real-time via encrypted WebSocket sessions.

  MAIN POINTS

  1. JWR impersonates checkout and login pages across major payment platforms.
  2. Client engine uses AES-CTR encrypted WebSocket for real-time operator control.
  3. Framework targets payment data, SSNs, passports, licenses, credentials, and 2FA codes.
  4. Talos assesses JWR as a variant of “The Outsider” PhaaS platform.
  5. Campaign uses SMS lures impersonating toll authorities and postal services.
  6. Vue.js application renders 44 phishing pages and streams keystrokes live.
  7. Over 40 distinct operator instructions control victim sessions remotely.
  8. Data exfiltration schema includes comprehensive victim identity and payment fields.
  9. JWR integrates with Shopify and WooCommerce for realistic cart reconstruction.
  10. Operator interface uses Simplified Chinese status messages.

  TAKEAWAYS

  1. Real-time keystroke streaming enables adaptive phishing attacks before form submission.
  2. WebSocket persistence via Web Workers maintains control across page navigations.
  3. Session tokens correlate multiple victim visits for enhanced targeting.
  4. Multi-brand templating and platform integrations make phishing pages highly convincing.
  5. HTTP long-poll fallback ensures C2 functionality even when WebSockets are blocked.

• 🚩 New Evooo1Bot Linux Botnet Exploits Edge Devices to Build Persistent Proxy Infrastructure and Launch DDoS Attacks.

  ONE SENTENCE SUMMARY

  Evooo1Bot is a critical Linux botnet exploiting edge device vulnerabilities to create persistent proxy infrastructure and launch DDoS attacks.

  MAIN POINTS

  1. Evooo1Bot is a newly discovered Linux botnet family tracked by FortiGuard Labs.
  2. It reuses Mirai’s DDoS engine but adds encrypted C2, SSH brute-force, and SOCKS relay.
  3. Active since July 2026, targeting Internet-facing devices across diverse regions.
  4. Exploits 10+ known vulnerabilities in routers, firewalls, and enterprise applications.
  5. Uses multi-layer string obfuscation with AES-256-CTR, ChaCha20, and XOR key derivation.
  6. Includes anti-analysis checks for debugging tools, sandboxes, and VM environments.
  7. Persistence mechanisms include systemd, cron, rc.local, and shell profile injection.
  8. Reverse SOCKS relay converts victims into proxies for anonymous traffic forwarding.
  9. SSH scanner uses 150+ credentials and honeypot detection to avoid detection.
  10. CVE exploit module contains 10+ entries, some with implementation errors making them non-exploitable.

  TAKEAWAYS

  1. Patch Internet-facing devices promptly to reduce exposure to Evooo1Bot exploitation.
  2. Monitor for suspicious outbound connections on port 443 to detect C2 communication.
  3. The reverse SOCKS relay module enables network pivoting and anonymous proxy infrastructure.
  4. Regular firmware updates are essential for routers, cameras, and edge devices.
  5. FortiGuard provides detection and blocking for Evooo1Bot across its security products.

• 🚩 Akira Ransomware Affiliate Abuses Windows Safe Mode to Disable Endpoint Defenses before Attempted Encryption.

  ONE SENTENCE SUMMARY

  Akira ransomware affiliates exploited Windows Safe Mode to disable endpoint defenses, but the tactic inadvertently sabotaged their own encryption attempt.

  MAIN POINTS

  1. Akira ransomware operation breached a SonicWall SSL VPN without MFA via credential spray.
  2. Attacker enumerated Active Directory using PowerShell, dumping all user and computer properties.
  3. WinRAR archived file shares, then s5cmd exfiltrated data to attacker’s S3 bucket.
  4. AnyDesk installed as service for remote control and malware delivery.
  5. Operator rebooted host into Safe Mode with Networking to disable EDR and Defender.
  6. Safe Mode boot caused memory exhaustion, preventing ransomware from executing properly.
  7. Windows Defender eventually quarantined akira.exe after reboot back to normal mode.
  8. Safe Mode tactic is MITRE ATT&CK T1688, previously used by Snatch and AvosLocker.
  9. Attack chain lasted under 10 minutes from AnyDesk session to ransomware execution.
  10. Successful login predated hands-on-keyboard action by nearly two hours.

  TAKEAWAYS

  1. Require MFA on all VPN accounts to prevent credential spray footholds.
  2. Deploy EDR and SIEM across all hosts to close monitoring gaps.
  3. Alert on Safe Mode boots and boot-configuration changes as anti-EDR indicators.
  4. Monitor for tools added to Safe Mode minimal-service registry list.
  5. Rotate all credentials if AD enumeration occurs, treating everything as exposed.

wardley-beta
%% 1. Users: Security teams, SOC analysts, threat intel analysts, CISOs, IT admins, end users
%% 2. Needs: Detect/respond to advanced threats (espionage, ransomware, phishing, botnets, spyware); protect credentials, payment data, 2FA, identity; defend browser-centric attacks; secure edge/Linux; maintain EDR integrity; timely notifications
%% 3. Capabilities: Threat intel gathering/analysis; phishing detection/prevention (BitB, frameworks); EDR with Safe Mode protection; botnet detection/mitigation; spyware detection/notification; browser malware analysis; ransomware defense
%% 4. Components: Threat Intel Platform; Mercenary Spyware Notifications; EDR + Safe Mode Defense; Phishing Framework Detection; Browser Malware Infrastructure Analysis; Linux/Edge Botnet Detection
%% 5. Maturity: Threat Intel Platform (Product->Commodity); Mercenary Spyware Notifications (Product); EDR + Safe Mode Defense (Product); Phishing Framework Detection (Custom->Product); Browser Malware Analysis (Custom); Linux/Edge Botnet Detection (Genesis->Custom)
%% 6. Managed by: Security vendors (Fortinet, Talos, Huntress, CTM360, Apple); internal security teams; threat intel providers

anchor detectAdvancedThreats [0.90, 0.90]
component threatIntelPlatform [0.85, 0.80]
component mercenarySpywareNotifications [0.75, 0.75]
component edrSafeModeDefense [0.60, 0.65]
component phishingFrameworkDetection [0.50, 0.60]
component browserMalwareAnalysis [0.40, 0.55]
component linuxEdgeBotnetDetection [0.35, 0.50]

threatIntelPlatform -> detectAdvancedThreats
mercenarySpywareNotifications -> detectAdvancedThreats
edrSafeModeDefense -> detectAdvancedThreats
phishingFrameworkDetection -> detectAdvancedThreats
browserMalwareAnalysis -> detectAdvancedThreats
linuxEdgeBotnetDetection -> detectAdvancedThreats

threatIntelPlatform -> edrSafeModeDefense
threatIntelPlatform -> phishingFrameworkDetection
threatIntelPlatform -> browserMalwareAnalysis
threatIntelPlatform -> linuxEdgeBotnetDetection
threatIntelPlatform -> mercenarySpywareNotifications

evolve threatIntelPlatform 0.88
evolve mercenarySpywareNotifications 0.78
evolve edrSafeModeDefense 0.65
evolve phishingFrameworkDetection 0.55
evolve browserMalwareAnalysis 0.45
evolve linuxEdgeBotnetDetection 0.40

Interesting Stuff

Daniel Miessler

• The Different Games OpenAI and Anthropic Are Playing

  ONE SENTENCE SUMMARY

  Anthropic targets enterprise operations while OpenAI pursues personal AI agents, representing two distinct multi-trillion dollar market strategies.

  MAIN POINTS

  1. Anthropic focuses on enterprise workflows and unified business context.
  2. OpenAI prioritizes consumer vision with personal AI assistants.
  3. ChatGPT now offers Apple Health integration for personal data.
  4. OpenAI hired Jony Ive to build AI hardware replacing phones.
  5. Sam Altman emphasizes personal ecosystem and always-available agents.
  6. Dario focuses on future of work and enterprise applications.
  7. OpenAI’s ChatGPT and Codex merged into single app.
  8. Anthropic resembles Palantir-type operational business understanding.
  9. Both companies pursue multi-trillion dollar markets simultaneously.
  10. OpenAI’s approach aligns with personal assistant operating on user’s behalf.

  TAKEAWAYS

  1. Enterprise operations replacement offers massive revenue potential for Anthropic.
  2. OpenAI’s consumer agent strategy targets becoming universal personal assistant.
  3. Hardware development signals OpenAI’s commitment to consumer AI dominance.
  4. Both strategies are complementary rather than directly competitive.
  5. Personal AI agents represent the larger total addressable market.

wardley-beta
%% 1. Users: Blog readers seeking AI industry insights
%% 2. Needs: Understand competitive dynamics between major AI labs
%% 3. Capabilities: Content curation, strategic analysis synthesis, publishing & distribution
%% 4. Components: Strategic analysis article, blog platform, RSS feed, AI industry knowledge, author curation
%% 5. Maturity: Article analysis (Custom), AI knowledge (Genesis), Blog/RSS (Commodity), Curation (Custom)
%% 6. Management: Author (Daniel Miessler) curates, writes, publishes via blog platform + RSS

anchor understandAIcompetition [0.90, 0.90]
component strategicAnalysis [0.40, 0.70]
component authorCuration [0.35, 0.55]
component aiIndustryKnowledge [0.15, 0.40]
component blogPlatform [0.85, 0.30]
component rssDistribution [0.90, 0.20]

strategicAnalysis -> understandAIcompetition
authorCuration -> strategicAnalysis
aiIndustryKnowledge -> authorCuration
blogPlatform -> strategicAnalysis
rssDistribution -> blogPlatform

evolve aiIndustryKnowledge 0.30
evolve authorCuration 0.50
evolve strategicAnalysis 0.55

Programming

マリウス

• Recovering BIOS Firmware on the Star Labs StarBook

  ONE SENTENCE SUMMARY

  A Star Labs StarBook Mk VI (AMD) was recovered from a bricked BIOS using a generic CH341A SPI programmer with a 1.8V adapter and flashrom.

  MAIN POINTS

  1. Routine firmware update bricked the StarBook, leaving it with a black screen.
  2. Star Labs’ official recovery kit is expensive, undocumented, and permanently out of stock.
  3. The StarBook uses a SOIC-8 Winbond 25R128JWSQ flash chip running at 1.8V.
  4. A generic CH341A programmer operates at 3.3V and requires a 1.8V adapter.
  5. Opening the laptop involves removing the backplate, battery, and locating the flash chip.
  6. Proper clip orientation is critical, aligning pin 1 with the chip’s indented dot.
  7. Flashrom identifies the chip as W25Q128JW when clip contact is solid.
  8. Backup reads should be taken and compared to verify reliable clip contact.
  9. Star Labs publishes full SPI firmware images in a public GitHub repository.
  10. After flashing, EFI boot variables are wiped, requiring manual boot entry restoration.

  TAKEAWAYS

  1. Always verify clip contact with multiple reads before writing firmware.
  2. Use a 1.8V adapter to avoid damaging low-voltage flash chips.
  3. Check for battery swelling while the laptop is open.
  4. Keep a backup of the original firmware before any modifications.
  5. External flashing with generic tools is viable when official kits are unavailable.

Simon Willison’s Weblog

• Northern Gannet ONE SENTENCE SUMMARY: Morris, the only Northern Gannet in the Pacific, has made a California harbor his home for 14 years.

  MAIN POINTS:

  1. Morris is a unique Northern Gannet in the Pacific Ocean.
  2. He arrived at the Farallon Islands 14 years ago.
  3. He now resides at Pillar Point harbor.
  4. He is easily spotted by his yellow head and white body.
  5. He often associates with black Brandt’s cormorants.
  6. He is visible near the harbor sign from the pier.
  7. Morris is considered a local celebrity.
  8. His presence is notable due to his species’ rarity.
  9. He has adapted to a non-native habitat.
  10. His location is accessible to public viewing.

  TAKEAWAYS:

  1. Morris demonstrates remarkable adaptability to a new environment.
  2. His long-term residency highlights the importance of local habitats.
  3. Birdwatchers can easily observe him at Pillar Point.
  4. His uniqueness draws attention to species distribution patterns.
  5. Morris serves as a symbol of wildlife resilience and curiosity.

• Don’t classify. Hallucinate!

  ONE SENTENCE SUMMARY

  Instead of classifying content against a fixed tag list, generate hallucinated tags and use vector embeddings to map them to the closest existing tags.

  MAIN POINTS

  1. Blog has 1,856 tags, too many to feed to an LLM.
  2. Asking LLM to match content to existing tags is impractical.
  3. Doug Turnbull proposes generating novel tags without vocabulary constraints.
  4. Use vector embeddings to compare hallucinated tags against existing corpus.
  5. Find concrete tags closest to the model’s imagined ones.
  6. Prompt should include examples of tag shape and structure.
  7. Examples show hierarchical taxonomy like Furniture / Living Room / Coffee Tables.
  8. This approach handles large, unwieldy tag vocabularies efficiently.
  9. It leverages LLM creativity plus embedding similarity for accuracy.
  10. Method avoids token limits and classification errors from huge lists.

  TAKEAWAYS

  1. Generate first, then map via embeddings—reverse the classification process.
  2. Provide structural examples to guide useful hallucinated outputs.
  3. Vector search bridges imaginative tags to real, existing ones.
  4. This scales to thousands of tags without context window issues.
  5. Combines LLM semantic understanding with efficient retrieval.

wardley-beta
%% 1. Users: Developers, systems programmers, AI engineers, hardware hackers
%% 2. Needs: Recover bricked firmware, build reliable AI systems, understand LLM behavior
%% 3. Capabilities: Firmware flashing, hardware debugging, LLM prompt engineering, AI eval
%% 4. Components: BIOS recovery tooling, SPI programmer hardware, LLM API, hallucination patterns, eval harness
%% 5. Maturity: SPI programmer [Commodity], BIOS tooling [Product], LLM API [Product], hallucination patterns [Genesis], eval harness [Custom]
%% 6. Managed by: Hardware vendors (SPI), OEM/community (BIOS tooling), AI labs (LLM API), researchers (hallucination), dev teams (eval)

anchor recoverFirmware [0.90, 0.85]
anchor reliableAI [0.88, 0.55]

component spiProgrammer [0.95, 0.30]
component biosTooling [0.70, 0.55]
component llmApi [0.75, 0.65]
component hallucinationPatterns [0.20, 0.70]
component evalHarness [0.45, 0.50]

spiProgrammer -> recoverFirmware
biosTooling -> recoverFirmware
llmApi -> reliableAI
hallucinationPatterns -> llmApi
evalHarness -> reliableAI
evalHarness -> hallucinationPatterns

evolve spiProgrammer 0.98
evolve biosTooling 0.75
evolve llmApi 0.80
evolve hallucinationPatterns 0.15
evolve evalHarness 0.40