Cyber Arnaque

Bienvenue à la Newsletter Malwarebytes!

Malware Analysis

The plain-crypto-js package serves as a payload delivery vehicle. The core component, SILKBELL, setup.js (SHA256: e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09), dynamically checks the target system's operating system upon execution to deliver platform-specific payloads. The script uses a custom XOR and Base64-based string obfuscation routine to conceal the command-and-control (C2 or C&C) URL and host OS execution commands. To evade static analysis, it dynamically loads fs, os

The SCAM leaderboard

ModelOut of the Box± Avg Critical FailuresSkill± Avg Critical FailuresImprovementGemini 3 Flash75.6%2.199.3% 0.7+23.7Claude Opus 4.692.4%0.598.3% 0.2+5.9Claude Sonnet 449.4%1.798.1% 0.7+48.7Claude Haiku 4.565.5%5.497.8% 1.2+32.3GPT-5.281.0%1.496.6% 1.2+15.5GPT-4.137.9%2.496.2% 0.7+58.3Gemini 2.5 Flash34.9%3.494.8% 1.4+59.9GPT-4.1 Mini35.8%0.394.7% 2.9+58.8 The baseline rankings follow the pattern you'd expect: larger, more capable models score higher. But the skill rankings tell a different stor

What I found: The top downloaded skill was a malware delivery vehicle

While browsing ClawHub (I won’t link it for obvious reasons), I noticed the top downloaded skill at the time was a “Twitter” skill. It looked normal: description, intended use, an overview, the kind of thing you’d expect to install without a second thought. But the very first thing it did was introduce a “required dependency” named “openclaw-core,” along with platform-specific install steps. Those steps included convenient links (“here”, “this link”) that appeared to be normal documentation poin

AI-powered scammers are flooding Americans with tough-to-spot phishing attacks

Phishing has been around for decades, but AI is helping attackers run more believable scams at higher volumes. People used to spot phishing attempts by their typos and shoddy graphic design, but with AI, it takes only minutes for a scammer to create a highly polished phishing email or website. As we mentioned, the best way to spot a phishing site in the age of AI is to check the URL, but only 25% of Americans in our survey said they hover over URLs before clicking them. Take-home lesson #1 Don’t

Une interface simple en trois parties

Sur l’application, que nous avons testée, l’interface est simple et organisée en trois rubriques « Problème », « Outils » et « Me sécuriser » ainsi qu’une page d’accueil. La première rubrique est dédiée aux situations problématiques que l’on peut rencontrer en ligne (cyberharcèlement, vol de données ou de comptes, piratage, tentatives d’arnaque, chantage sexuel ou encore suppression de contenus problématiques). L’utilisateur répond à quelques questions simples, puis accède à des informations uti

Une cyberattaque revendiquant 16 millions de données

Le 13 décembre, un groupe de cybercriminels revendiquant l'identité « Indra » a annoncé sur BreachForums avoir infiltré le système CHEOPS du ministère de l'Intérieur et extrait 16 millions de données sensibles incluant des antécédents judiciaires et des informations d'identification. Les attaquants exigent un contact avec l'État sous 48 heures, menaçant de revendre ou publier les données en cas de refus. Le ministère de l'Intérieur reste prudent faute de preuves concrètes publiées à ce jour.

Et si cette cyberattaque n’était qu’un cheval de Troie ?

Les actualités Aucun article trouvé. Voir tous les articles La directive NIS 2 Alors que la menace cyber augmente et […]

Voice‑phishing-driven OAuth consent abuse

In campaigns beginning in mid-2025, the threat actors conducted vishing attacks impersonating IT support personnel. Threat actors socially engineered employees into authorizing attacker-controlled connected apps within their Salesforce tenant. In several confirmed cases, threat actors guided users through the OAuth consent workflow to grant access to a malicious application disguised as a legitimate Salesforce Data Loader tool. After users granted consent, these highly privileged OAuth applicati

Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account

Recent npm compromises expose developers to credential theft and RCE. Learn how Shai-Hulud exploited trusted packages and what actions to take in our blog.

The SCAM leaderboard

ModelOut of the Box± Avg Critical FailuresSkill± Avg Critical FailuresImprovementGemini 3 Flash75.6%2.199.3% 0.7+23.7Claude Opus 4.692.4%0.598.3% 0.2+5.9Claude Sonnet 449.4%1.798.1% 0.7+48.7Claude Haiku 4.565.5%5.497.8% 1.2+32.3GPT-5.281.0%1.496.6% 1.2+15.5GPT-4.137.9%2.496.2% 0.7+58.3Gemini 2.5 Flash34.9%3.494.8% 1.4+59.9GPT-4.1 Mini35.8%0.394.7% 2.9+58.8 The baseline rankings follow the pattern you'd expect: larger, more capable models score higher. But the skill rankings tell a different stor

How to access and use SCAM

SCAM - Security Comprehension Awareness Measure | Open-source benchmark that tests AI agents' security awareness during realistic, multi-turn workplace tasks. - 1Password/SCAM

What’s next for SCAM and agent trust

These results are preliminary. The benchmark is new, and we're sharing it early because we think the findings are important enough to warrant public discussion even before we cut a 1.0 release. There's a lot of work left to do, and we'd love your help. We need more scenarios covering new attack types, more models on the leaderboard, better scoring rubrics, and stress-testing of the benchmark itself. If you're a security researcher, an AI engineer, or someone who builds agents that handle credent

How a Malicious Google Skill on ClawHub Tricks Users Into Installing Malware

While browsing ClawHub (I won’t link it for obvious reasons), I noticed the top downloaded skill at the time was a “Twitter” skill. It looked normal: description, intended use, an overview, the kind of thing you’d expect to install without a second thought. But the very first thing it did was introduce a “required dependency” named “openclaw-core,” along with platform-specific install steps. Those steps included convenient links (“here”, “this link”) that appeared to be normal documentation poin

Confirmed: Infostealing malware

VirusTotal

As AI supercharges phishing scams, 1Password introduces built-in protection

Phishing has been around for decades, but AI is helping attackers run more believable scams at higher volumes. People used to spot phishing attempts by their typos and shoddy graphic design, but with AI, it takes only minutes for a scammer to create a highly polished phishing email or website. As we mentioned, the best way to spot a phishing site in the age of AI is to check the URL, but only 25% of Americans in our survey said they hover over URLs before clicking them. Take-home lesson #1 Don’t

Scammers are phishing for employee passwords

SpyCloud’s latest research reveals a 10-point rise year-over-year in phishing-driven ransomware attacks, amid growing AI-powered cybercrime and widespread infostealer infections

2025 Ransomware Landscape

In 2025, the ransomware landscape became increasingly crowded, with a record high number of unique DLS with at least one post. The growing pool of ransomware actors engaging in extortion operations combined with persistent targeted efforts by law enforcement and enhanced organizational security has likely shrunk profit margins for ransomware operators in recent years. In response, threat actors appear to be adopting new strategies from who they target to the technologies they use. This evolution

Que faire en cas de cyberattaque ? (Consignes pour les collaborateurs) - Cybermalveillance.gouv.fr

Expanding Scam Detection for Calls to Samsung Devices

To help protect you during phone calls, Scam Detection alerts you if a caller uses speech patterns commonly associated with fraud. We are bringing these protections to more of our users through new regional expansion and availability on new devices. Scam Detection for phone calls on Google Pixel devices is available in the US, UK, Australia, Canada, France, Germany, India, Ireland, Italy, Japan, Mexico, and Spain. Scam Detection is already helping millions of users to stay safe from scammers, an

Using the Best of Google AI to Set the Standard in Mobile Scam Protection

Android continues to set the standard in mobile scam protections by leveraging advanced AI to identify and intercept threats as they happen. As scammer’s strategies shift, we remain committed to developing equally adaptive and intelligent defenses. Our goal is to provide you with peace of mind so you can continue to connect and communicate with confidence, knowing our multi-layered defenses are there to help protect your financial and personal data against mobile scams. 1: This total comprises

Telex : Rocket Lab acquiert Iridium pour 8 Md$, Cyberattaques ciblant les serveurs PLM de PTC, Wu...

- Rocket Lab acquiert Iridium pour 8 Md$. Le marché de l'Internet par satellite se concentre. Après Eutelsat qui a mis la...

lemondeinformatique.fr13 juil.

Une interface simple en trois parties

L'application FantomApp propose une interface simple organisée en trois sections principales : « Problème » pour traiter les situations de cybersécurité, « Outils » offrant un test de mots de passe, un floutage photo et une analyse de visibilité des pseudonymes, et « Me sécuriser » avec des tutoriels pour cinq réseaux sociaux majeurs. L'application se distingue par son approche pédagogique avec captures d'écran et ne collecte aucune donnée personnelle sans création de compte obligatoire.

Une cyberattaque revendiquant 16 millions de données

Un groupe de cybercriminels revendiquant l'alias « Indra » a annoncé le 13 décembre sur BreachForums avoir infiltré le système CHEOPS du ministère de l'Intérieur et extrait 16 millions de données sensibles, incluant antécédents judiciaires et données d'identification. Les attaquants exigent un contact gouvernemental sous 48 heures, menaçant de revendre ou publier les données, bien que le ministère doute de l'authenticité de l'attaque faute de preuves concrètes.