DEV Community: Shubham Chaudhary

Inside Lumma Stealer: How Fake Movie Torrents Deliver Credential-Stealing Malware

Shubham Chaudhary — Thu, 06 Aug 2026 17:35:44 +0000

A blockbuster just hit theaters. Someone finds a "clean" 2160p torrent, downloads it, double-clicks, and waits for VLC to open.

Nothing plays. No error. But a hidden .exe just reached out to a C2 server, siphoned every saved browser password, hijacked active login session cookies, and hunted for a MetaMask wallet file. By Monday, that "movie fan" is disputing fraud charges and resetting every account.

This is the exact playbook researchers observed after a major 2026 blockbuster release, where threat actors weaponized the film's popularity to distribute Lumma Stealer — a Malware-as-a-Service infostealer.

What makes this campaign notable for defenders:

Filenames mimic real scene-group tagging to avoid suspicion
Windows hides file extensions by default, so the binary shows just a video icon
Lumma prioritizes session cookies over passwords — bypassing MFA by replaying an authenticated session
Loader chains decrypt and run the payload in memory, reducing on-disk artifacts
Exfiltration via encrypted HTTP POST to rotating C2 domains, defeating static blocklisting

Full attack chain, real IOCs, PowerShell detection commands, a registry fix for visible extensions, and IR priorities:

https://www.xpert4cyber.com/2026/08/fake-movie-download-steals-passwords.html

If you're building detections or writing EDR rules — worth the read.

Midnight Blizzard's CaptiveCrunch: How Hotel Wi-Fi Became a Nation-State Attack Vector

Shubham Chaudhary — Tue, 04 Aug 2026 17:37:50 +0000

Hotel Wi-Fi just became a nation-state attack vector — and it bypasses MFA entirely.

Microsoft Threat Intelligence disclosed CaptiveCrunch, run by Storm-2945, a sub-cluster of Midnight Blizzard (APT29 / Cozy Bear, Russia SVR). They compromise hotel Wi-Fi portals to hijack Microsoft 365 and Azure AD sessions — no phishing email needed.

Attack chain:

DNS poisoning at the gateway during connectivity checks
Fake OS/browser update prompts deliver payloads
ClickFix-style social engineering
Microsoft OAuth device-code flow abused to authorize sessions
WPAD abuse to intercept traffic

Toolkit:

CornFlake — Go RAT disguised as an update, persists as a sync service
ChocoShell — in-memory PowerShell infostealer, disables AMSI, steals cookies via Chrome's debug port (9222)
FruitStone — web-based C2 panel

Why it matters: stolen session tokens bypass MFA completely. If the attacker has a live token, MFA already happened — for them.

Detection leads:

New sync/cloud named services after untrusted reconnects
AMSI bypass in PowerShell logs (Event ID 4104), no file write
Unexpected device-code auth after hotel Wi-Fi use
Chrome debug port 9222 from unexpected parent processes

Confirmed across US, India, Saudi Arabia — finance, legal, healthcare, retail orgs affected.

Full write-up with IOCs, WPAD hardening commands, SOC hunting queries:
https://www.xpert4cyber.com/2026/08/midnight-blizzard-hotel-wifi-hack.html

CVE-2026-12935: Unauthenticated RCE in TP-Link TL-WR940N V6 (CVSS 8.7)

Shubham Chaudhary — Mon, 03 Aug 2026 17:25:32 +0000

🚨 CVE-2026-12935: Unauthenticated RCE in TP-Link TL-WR940N V6 (CVSS 8.7)

A newly patched vulnerability in TP-Link's TL-WR940N V6 router lets attackers achieve remote code execution — no credentials, no direct user click required.

The bug

The flaw lives in the router's RTSP connection-tracking module:

Attacker stands up a malicious RTSP server
A LAN device (IP camera, smart TV, streaming client) initiates a connection to it
A crafted RTSP message triggers a stack-based buffer overflow in the kernel module
Result: DoS crash or full RCE

Why it matters

Routers sit at the network perimeter. A compromised device here isn't isolated — it becomes a pivot point for:

DNS hijacking → phishing redirects
Traffic interception (unencrypted sessions)
Persistent malware surviving reboots
Lateral movement to every other device on the LAN

The fix

TP-Link has shipped patched firmware for all regions:

EN: V6_260528
US: V6_260528
JP: V6_260527

If you're running or supporting a TL-WR940N V6 in the field, check firmware version in the admin panel and patch immediately — this is unauthenticated and low-complexity to exploit.

Full writeup

Attack chain breakdown, detection commands, and a prevention checklist:
👉 https://www.xpert4cyber.com/2026/08/tp-link-cve-2026-12935-router-flaw.html

How a Trojanized Ad Script Bypassed Every Antivirus Engine

Shubham Chaudhary — Mon, 03 Aug 2026 08:00:23 +0000

## 🚨 A Trusted Ad Script Just Got Weaponized to Steal Crypto

No phishing email. No malicious download. Just a routine ad-tracking script, on thousands of legitimate sites, silently swapping crypto wallet addresses — and every antivirus engine missed it.

What happened:

Adform, an adtech platform used by ~14,000 businesses, had its core tracking script (trackpoint-async.js) hijacked in a supply chain attack.

The payload:

Polled victims' clipboards every few seconds for BTC/ETH/TRON wallet addresses
Silently swapped the copied address with an attacker-controlled one
Re-overwrote it again if the victim caught the swap and re-copied the correct address
Logged victim IPs + browsing paths to a C2 server

The scary part: submitted to VirusTotal, all 61/61 engines returned clean. 🚩

This isn't a vendor failure — it's a structural blind spot. Reputation-based detection flags known-bad infra. A script served from a trusted, high-traffic domain doesn't fit that profile, even when trojanized.

Why it matters for devs:

If you embed any third-party ad/analytics script, this is a solid case for:

I wrote up the full attack chain, IOCs, detection steps, and prevention controls here:

🔗 https://www.xpert4cyber.com/2026/08/adform-hack-crypto-stealer-ad-script.html

Worth a read if you maintain any production site with third-party scripts.

SplitVPN Data Breach: What 865K Exposed Users Teach Us About "No-Logs" Architecture

Shubham Chaudhary — Sun, 02 Aug 2026 15:24:59 +0000

🚨 A "No-Logs" VPN Was Secretly Logging 58 Million Connections — A Breach Breakdown for Devs & SOC Teams

SplitVPN (formerly NotVPN) suffered a major data breach in July 2026, exposing 865,336 user accounts. The technical details here are worth a closer look, especially if you work anywhere near auth systems, logging infrastructure, or security architecture.

The leaked 17 GB SQL database, verified by researchers at Mysterium, contained:

23.4 million user records
13.6 million device records
2.6 million payment records
58 million VPN connection logs

Here's the part that should make every engineer pause: the service explicitly marketed a "No logs or history" policy. Yet the database included a live connection-log table tracking device-to-server activity continuously from June 2025 through the breach date — meaning the schema itself contradicted the privacy policy from day one.

Payment data was properly tokenized (masked BIN + last 4 digits only) — a good implementation detail worth noting. But connection metadata (device ID, server, timestamp) was retained indefinitely with no apparent enforcement layer.

This is a solid real-world case study in:
🔹 Why "policy vs. schema" mismatches are a recurring root cause in breach incidents
🔹 How breach detection actually works (forum monitoring → third-party verification → breach aggregation via HIBP)
🔹 Why data retention limits need to be enforced at the database layer, not just written in a privacy policy PDF

I break down the full technical timeline, the SOC/threat-intel detection workflow, and practical takeaways for anyone building or auditing systems that make privacy promises:

🔗 https://www.xpert4cyber.com/2026/08/splitvpn-data-breach-865k-users-exposed.html

Brinks Home Data Breach: How ShinyHunters Exploited Microsoft Entra Vishing to Steal 4.9M Records

Shubham Chaudhary — Sun, 02 Aug 2026 06:36:40 +0000

Brinks Home Data Breach: How ShinyHunters Exploited Microsoft Entra Vishing to Steal 4.9M Salesforce Records

TL;DR: No malware. No exploit. No CVE. ShinyHunters allegedly breached Brinks Home's Salesforce environment using a single vishing phone call against Microsoft Entra ID — and it took a full week to detect.

What happened:

On July 13, 2026, an attacker posing as internal IT support convinced a Brinks Home employee to complete what looked like a routine Entra ID authentication/MFA registration step. That single social engineering call was the entire attack chain — no phishing email, no payload, no exploit code.

From there, the technique follows a pattern now well-documented across 2025-2026 breaches (Google, Qantas, Allianz Life, Adidas, EY, RingCentral):

Recon employees via LinkedIn/corporate directories
Vishing call impersonating IT support
MFA/device registration abuse via Entra ID
OAuth Connected App abuse (often Salesforce Data Loader) for bulk export
Exfiltration via legitimate API calls that blend into normal traffic

Brinks Home detected the intrusion on July 20 — roughly a week of dwell time — and confirmed the breach publicly on August 1, after ShinyHunters listed them on its extortion leak site with a July 30 ransom deadline.

Allegedly exposed:

1.1M+ Salesforce Contact records
4,000+ employee PII rows
3.8M+ customer support chat logs (Cresta platform)

Why this matters for engineers and SOC teams, not just execs:

This attack succeeds through valid credentials and legitimate API calls — meaning traditional malware/IOC-based detection won't catch it. Detection has to shift toward behavioral and volume-based anomalies: new MFA registrations followed by immediate sign-ins, new OAuth Connected App grants, and abnormal bulk export volume.

In the full write-up I've included ready-to-use KQL (Microsoft Sentinel) and SOQL queries for:

Detecting MFA registration followed by unusual sign-in
Flagging bulk Salesforce export spikes via Event Monitoring
Auditing newly authorized OAuth Connected Apps

Plus a full breakdown of the attack flow, Entra ID + Salesforce log indicators to hunt for, and a 7-point prevention checklist (phishing-resistant MFA, OAuth app restrictions, help desk vishing drills, and more).

Full technical breakdown: https://www.xpert4cyber.com/2026/08/brinks-home-data-breach.html

If your help desk can reset MFA over a phone call, you already have the exact gap ShinyHunters knows how to exploit.

GPG for DevOps: Encrypting Files, Signing Commits & Key Management

Shubham Chaudhary — Sat, 01 Aug 2026 17:31:57 +0000

Sending sensitive files over email without encryption or signing is basically leaving your front door unlocked. 🔓

If you're working anywhere near security, DevOps, or infrastructure, GPG (GNU Privacy Guard) is one of those tools you'll eventually need — whether it's for signing Git commits, verifying package integrity, or encrypting files before sending them off-site.

I put together a complete, practical GPG command tutorial covering:

🔐 Generating key pairs (--gen-key vs --full-generate-key)
🔐 Encrypting & decrypting files (-e, -d)
✍️ Signing files & verifying signatures (--sign, --verify)
🔑 Exporting/importing public & private keys
🛡️ Managing key trust, expiration & fingerprints
⚙️ Real-world use cases: incident response, CI/CD signing, supply chain security

This isn't just a command list — it walks through when and why you'd actually use each one, based on real SOC and DevSecOps workflows.

Full breakdown with explanations and expected outputs here:
https://www.xpert4cyber.com/2026/08/gpg-command-tutorial-encryption-guide.html

If your team signs commits or handles sensitive data transfers, this is worth bookmarking.

What's your current setup for signing commits or encrypting sensitive files — GPG, SSH signing, something else? Curious how others handle this.

What Devs Should Know About AI-Driven Vulnerability Discovery

Shubham Chaudhary — Sat, 01 Aug 2026 05:59:02 +0000

A Chrome bug hid in the codebase for 13 years. AI found it in one pass. 🔍

Google just disclosed that AI agents helped find and fix 1,072 Chrome vulnerabilities across just two releases — more than the previous 23 releases combined.

One standout: a sandbox escape bug that survived over a decade of manual code review, fuzzing, and bug bounty hunts — undetected until an AI agent with deep codebase context finally caught it.

What's inside the breakdown:

🔹 The AI pipeline behind it — Naptime, Big Sleep, CodeMender, and Gemini-powered agents working together
🔹 Why "critic" AI agents now review AI-generated patches before humans do
🔹 The "patch gap" problem, and why Google is moving toward dynamic, no-restart patching
🔹 How this compares to what Microsoft and Apple are (or aren't) doing
🔹 Practical takeaways for engineers building AppSec, DevSecOps, or CI/CD pipelines

If you're a developer, SRE, or security engineer, this is a solid real-world case study in agentic AI actually shipping to production at scale — not just a demo.

Full breakdown: https://www.xpert4cyber.com/2026/07/ai-found-chrome-bug-hiding-13-years.html

Curious what devs think — does AI-assisted vulnerability discovery change how you'll approach code review going forward?

CyberStrike: The Open-Source AI Agent Turning ChatGPT Into an Autonomous Pentester

Shubham Chaudhary — Fri, 31 Jul 2026 18:11:07 +0000

CyberStrike: The Open-Source AI Agent Turning ChatGPT Into an Autonomous Pentester 🔓🤖

If you're into cybersecurity, AI agents, or open-source dev tools, this one's worth a look.

CyberStrike is an open-source, AI-augmented offensive security harness released in July 2026. Instead of piping scan output into a chatbot for a summary, it wraps your existing ChatGPT, Claude, or other LLM subscription in a full "intelligence layer" — injecting OWASP methodology, attack-chain reasoning, and tool orchestration logic so the model behaves like a specialized red-team operator.

🧠 Architecture highlights:

13+ domain-specific agents — Web (OWASP WSTG), Mobile (MASTG/MASVS), Cloud (CIS benchmarks), Internal Network (AD attacks, lateral movement)
7,600+ Ed25519-signed security skill files covering JWT abuse, SSRF, SSTI, GraphQL exploitation, and post-exploitation playbooks for AWS, Azure, Kubernetes
Supports 150+ AI providers and ~5,300 models — including fully offline runtimes like Ollama and LM Studio for air-gapped environments
HackBrowser — a built-in Chromium browser that captures live traffic and runs 8 parallel proxy sub-testers with a three-gate confirmation protocol to cut false positives
Bolt — lets tooling run on remote servers via Ed25519 key pairing, coordinating multiple attack surfaces from one terminal
Integrates with an MCP ecosystem exposing 176 additional tools for cloud auditing, GitHub security posture, CVE intel, and OSINT

⚙️ Install:

npm i -g @cyberstrike-io/cyberstrike@latest && cyberstrike

Also available via Homebrew, Scoop, or a curl script. AGPL-3.0 licensed, cross-platform (macOS/Windows/Linux).

⚠️ Important distinction: Don't confuse CyberStrike with CyberStrikeAI — a separate, Go-based tool linked by researchers to real-world attacks on Fortinet FortiGate appliances, tied to a suspected nation-state actor. Same-sounding name, completely different project and intent.

For defenders, the deeper takeaway is that autonomous AI-driven recon leaves a distinct network fingerprint — chained contextual requests, near-zero timing variance, and outbound calls to LLM provider APIs from hosts with no legitimate reason to make them.

Full write-up with detection indicators, governance strategies, and FAQ here:
https://www.xpert4cyber.com/2026/07/cyberstrike-open-source-ai-agent-hacking-tool.html

Anyone here building on top of CyberStrike, MCP-based security tooling, or similar AI pentesting agents? Would love to compare notes in the comments.

GenieLocker Ransomware: How Toy Ghouls Are Hitting Windows, Linux & ESXi

Shubham Chaudhary — Fri, 31 Jul 2026 16:51:21 +0000

## GenieLocker Ransomware: How Toy Ghouls Are Hitting Windows, Linux & ESXi

A new ransomware family called GenieLocker is actively targeting Windows, Linux, and VMware ESXi environments — and it skips the usual playbook. No ransom note. No leak site. No confirmed data exfiltration. Just silent, cross-platform encryption.

The group behind it, Toy Ghouls (aka Bearlyfy), used to rely on LockBit, Babuk, and RedAlert. Building a custom encryptor in-house means no shared code signatures and a much harder attribution trail.

Attack chain breakdown:

🔑 Initial access via stolen partner VPN credentials
🔍 Network discovery with SoftPerfect Network Scanner
🔓 Credential theft via Mimikatz + KeePassXC
🖥️ Lateral movement over RDP (Windows) / SSH (Linux)
📡 Persistence through reverse SSH tunnels
💻 Mass deployment via PsExec/PAExec
💀 ESXi VMs shut down, then encrypted — cascading outages

On the crypto side: GenieLocker uses libsodium — XChaCha20-Poly1305 for file encryption, Curve25519-based key wrapping sealed against an attacker-controlled public key. No known decryptor exists.

The Windows build carries anti-debugging checks, a self-integrity watchdog thread, and a hex "secret argument" gate to dodge sandboxes. The Linux/ESXi build is leaner, but purpose-built to target /vmfs/volumes and take down virtualized infrastructure at scale.

I wrote a full technical breakdown covering the attack chain, encryption internals, IOCs, SOC detection queries (including a ready PowerShell snippet), and a hardening checklist for VPN/ESXi/backup strategy 👇

🔗 https://www.xpert4cyber.com/2026/07/genielocker-ransomware-esxi-attack.html

If you run ESXi or grant third-party VPN access, worth a read before it's your incident report.

cybersecurity #ransomware #infosec #security

Linux ln Command Exploit: How Symlink Race Conditions Lead to Root Privilege Escalation

Shubham Chaudhary — Thu, 30 Jul 2026 17:52:41 +0000

🔴 Linux ln Command Exploit: How Symlink Race Conditions Lead to Root Privilege Escalation

Most devs think ln is just "create a link." Attackers know it as the tool behind one of the most persistent Linux privesc bugs in history: the symlink race condition (TOCTOU).

If a root-owned script writes to a predictable path (/tmp/.log, /var/run/.pid) without checking file type first, an attacker can swap that path for a symlink to /etc/passwd or a cron dir — and root writes exactly where the attacker wants.

This bug class has hit container runtimes, backup tools, and logging daemons in real CVEs.

📌 Full breakdown inside:

Hard links vs symbolic links (security implications)
Real-world symlink attack walkthrough
auditd rules + log indicators for SOC detection
Blue team defenses: FIM, symlink sweeps, behavioral correlation
Hardening checklist to stop privilege escalation
Complete ln command reference with security notes

Read the full guide 👉 https://www.xpert4cyber.com/2026/07/linux-ln-command-symlink-attack-hack-root.html

NVIDIA BlueField Flaw Lets Hackers Hijack Cloud Servers

Shubham Chaudhary — Thu, 30 Jul 2026 06:14:47 +0000

🚨 NVIDIA BlueField DPU Vulnerability (CVE-2026-65094): A Write-What-Where Bug With a CVSS 9.0 Score

NVIDIA just disclosed a critical vulnerability in its BlueField-3 DPU platform — the hardware many cloud providers use to offload networking, storage, and security processing from the host CPU.

The technical details are worth understanding if you work anywhere near cloud infra, virtualization, or SOC operations:

🔹 CVE-2026-65094, CVSS v3.1 score of 9.0
🔹 Classified as CWE-123 — a "write-what-where" memory corruption bug
🔹 Root cause: insufficient validation of Virtio-Net message structures
🔹 A low-privileged VM can trigger it with a crafted message — zero user interaction required
🔹 Scope change noted: exploitation can reach resources beyond the vulnerable component, which matters a lot in multi-tenant environments

In practitioner terms: this isn't just "corrupt some memory and crash a process." Write-what-where bugs give attackers the primitives to overwrite function pointers or return addresses and pivot toward arbitrary code execution.

NVIDIA found this internally and shipped patches across VIRTIO-Net GA, LTS25, LTS24, and LTS23. No known exploitation yet — but that's a narrow window for a bug this severe.

I wrote a full breakdown covering the attack chain, detection strategies, firmware-check commands (mst status, mlxfwmanager), and remediation steps here:

🔗 https://www.xpert4cyber.com/2026/07/nvidia-bluefield-flaw-hijack-cloud-servers.html

Curious how other infra/security folks here are prioritizing DPU firmware in their vuln management pipelines — is it getting the same SLA treatment as OS/app CVEs on your team?