The transaction is valued up to $150 million, including performance-based retention awards, a Varonis spokesperson told SecurityWeek.

Varonis plans to integrate SlashNext's advanced phishing, BEC, and social engineering attack protection capabilities into its data security platform.

Explore how SessionShark hijacks Office 365 session tokens, evades detection, and why organizations need proactive phishing defenses.

A new phishing kit called Astaroth bypasses two-factor authentication through session hijacking and real-time credential interception from services like Gmail,

An advanced but simple phishing tactic is being distributed, it deploys fake Cloudflare CAPTCHA pages to target users with malware.  A recent research by SlashNext says the technique, called  ClickFix tricks users into running commands that deploy malware. ClickFix shows a fake version of Cloudflare’s Turnstile CAPTCHA page. It replicates visual layout and technical elements like Ray ID identifier to look authentic.  Prompt that users generally miss The phishing site is hosted on a domain that looks like the real one, or an authentic website that has been attacked. When users visit the site, they are tricked into checking a box called “Verify you are human.”  This step looks normal and doesn’t raise any suspicion but after this, the users are asked to run a series of commands such as “Win + R” then “Ctrl + V” and after that “Enter.” These steps look harmless but they use a PowerShell command. Once executed, it can extract malware such as Lumma, NetSupport Manager, and Stealc.  According to security expert Daniel  Kelley, “ClickFix is a social engineering attack that tricks users into running malicious commands on their own devices – all under the guise of a routine security check.” ClickFix is dangerous because it uses standard security measures as attack tools.   Experts call this “verification fatigue,” where a user clicks through various prompts without proper investigation. "In the context of a familiar-looking Cloudflare page, a user often assumes these extra steps are normal, especially if they’re in a hurry to reach some content. The instructions to press Win+R and Ctrl+V may raise an eyebrow for tech-savvy people, but an average user – seeing official logos and not understanding the implications – can be socially engineered into treating it as an advanced CAPTCHA," Slash reported in the blog. This tactic doesn't depend on exploiting software flaws, it exploits trust and user habits.  The phishing page is sent as a single HTML file but includes embedded scripts and hidden code to perform clipboard injections. It uses genuine Windows utilities and doesn't download executables so that it can escape traditional identification tools. General defenses such as endpoint protection or antivirus software usually aim to detect binaries or suspicious downloads.  In this incident, users were baited into activating the threat themselves. This underscores the need for sophisticated malware protection with zero-hour defense that can detect clipboard injections and malicious CAPTCHA screens in real-time. 

An independent testing firm found that SlashNext’s product has a 100% detection rate for business email compromise and QR code attacks.

The SlashNext report also found a noteworthy 967% increase in credential phishing attacks

ClickFix tricks users into pasting malware via fake CAPTCHAs. Learn how this low-tech phishing scam works—and how SlashNext stops it at zero hour.

Des experts tirent la sonnette d’alarme au sujet d’Astaroth, un kit de phishing redoutable vendu sur Telegram L’émergence d’Astaroth, un outil de phishing vendu 2 000 dollars sur Telegram, inquiète les experts en cybersécurité. Détecté par les chercheurs de SlashNext, ce kit sophistiqué intercepte en temps réel les données d’authentification, y compris les codes de (...)

Emily Forgash / Bloomberg: Varonis Systems agrees to acquire email security company SlashNext for up to $150M, including retention awards, after buying database company Cyral for ~$25M  —  Data security company Varonis Systems Inc. has agreed to acquire SlashNext, an AI-based email security provider …

Varonis plans to integrate SlashNext's advanced phishing, BEC, and social engineering attack protection capabilities into its data security platform.

Cybersecurity researchers at SlashNext have uncovered this tool, which enables attackers to extract email addresses from public GitHub profiles and launch large-scale phishing campaigns.

The New Normal: A 1265% Increase in Phishing Emails The threat landscape has undergone a seismic shift over the past year, and a new report solidifies this worrying trend. According to the annual SlashNext State of Phishing Report for 20231, there has been a staggering 1,265% increase in maliciou

<p><img src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh8Iw3P8y6QlVvvfM4cTOdTT467tyBoTytBD4MRcmsZYH7z4EG4mhPi1m2qEqsYYGktlKu6FrgaPDbAcvMpfF4Fi-AP3eUtj_kIgZaEtVX4KzFTVAkieHcuMjplStVADAPpv315DELEEI5Dds49BBk0PIvza3BsiVPpNxduHVQdF8oxmmclXuYpk2ZD3wq7/s1600/WormGPT%20-%20AI%20Tools%20Used%20by%20Threat%20Actors%20to%20Launch%20Cyber%20Attacks.webp" alt="WormGPT%20-%20AI%20Tools%20Used%20by%20T"></p>Recently, <b>cybersecurity</b> researchers from SlashNext reported that threat actors are actively using WormGPT to launch business email compromise ...

<p>Generative AI technology is rapidly growing and advancing, driven by continuous research and development efforts.</p> <p>But, besides the growing advancements and positive things, these generative AI technologies are also actively exploited by threat actors for their illicit activities.</p> <p>Recently, cybersecurity researchers from SlashNext reported that threat actors are actively using ChatGPT and a black-hat alternative to GPT models, WormGPT, to launch <a href="https://cybersecuritynews.com/information-security-threats-for-business/">business email compromise (BEC) attacks</a>.</p> <h2><strong><strong>WormGPT</strong> <strong>is Revolutionizing BEC Attacks</strong></strong></h2> <p>ChatGPT and other advanced AI tech enable threat actors to automate convincing personalized fake emails, expanding the scope of BEC attacks and boosting the attack’s success.</p> <p>These advanced AI technologies are indirectly aiding the threat actors to craft sophisticated phishing emails, surpassing language barriers and enhancing their attack effectiveness.</p> <img src="https://lh6.googleusercontent.com/-Gbd9wAhYuzzLvEFHBNF6ZdosnwEawsRlbaFDNXa1eJGHSwABCn2UAbU2WyPo67xWLDvmV9pajIKI6umu_xGtgAZfkzJLbfGEcTj2yOQ2W84n7zxgGFNhIoRRbqplJD2xNuHXWcvdi0moDcT-Akw7B0" alt="">WormGPT <p>In these types of events, threat actors exploit the interfaces of the <a href="https://cybersecuritynews.com/?s=ChatGPT">ChatGPT</a> or similar tools with specialized prompts to manipulate and compromise AI. </p> <p>So, this is clearly highlighting the urgent implementation of robust AI security measures.</p> <p>Moreover, to reach the next level, cybercriminals also develop user-friendly custom AI modules similar to ChatGPT for illicit use, amplifying the complexity of cybersecurity in an AI-driven world.</p> <img src="https://lh6.googleusercontent.com/-fvBRaDUSvTQhjrMutRqu24s9ne6f9_QJGjwZ1S0HJ8S-pHk_wYozsm-9_KiaZXcYbtQQ7NSES-GmKRLbhDhXLU2vVH0cmX6heuiq9bqH86uonpQzOoIsne4pwpJ4yXH7Ix60pMrcrcsLi_J9tiQoY0" alt=""><em>Custom ChatGPT Modules (Source – SlashNext)</em> <h2><strong>WormGPT</strong></h2> <p>WormGPT is mainly designed for malicious activities since it’s a malicious alternative to GPT models. Apart from this, WormGPT offers several powerful features, such as:-</p> <ul> <li>Unlimited character support</li> <li>Chat memory retention</li> <li>Code formatting</li> </ul> <p>WormGPT trained on undisclosed malware-related datasets, keeping its training sources confidential as per the author’s decision.</p> <img src="https://lh3.googleusercontent.com/thjGeYwqSaQQwZcTXmYekBkmTXL7JLtnXXiaM20seK0LvL3bP1X9WM22bQ20CZMXQm6ZbkrHdKx4HUqz_UHiHSIjT1huLLfYaC9knSnQmBfhH6tM0LGF25tqNhc5tODjlaex1p_-FtF11eq0LS0dezw" alt=""><em>WormGPT Source (Source – SlashNext)</em> <p><a href="https://slashnext.com/blog/wormgpt-the-generative-ai-tool-cybercriminals-are-using-to-launch-business-email-compromise-attacks/">Researchers thoroughly</a> evaluated the risks of WormGPT by testing its ability to generate a convincing threatful email targeting an unsuspecting account manager for payment of a fraudulent invoice.</p> <p>The disturbing outcome revealed the exceptional persuasive and tactful email generation capabilities of WormGPT, demonstrating its dangerous capabilities to:-</p> <ul> <li>Generate  advanced phishing emails</li> <li>Launch BEC attacks</li> </ul> <p>WormGPT is an unrestricted variant of ChatGPT since it lacks ethical boundaries or limitations, unlike ChatGPT. WormGPT highlights the significant risk of generative AI.</p> <p>Here below, we have mentioned all the advantages of generative AI for BEC attacks:-</p> <ul> <li>Exceptional Grammar</li> <li>Lowered Entry Threshold</li> </ul> <h2><strong>Recommendations</strong></h2> <p>Here below, we have mentioned all the recommendations offered by the <a href="https://cybersecuritynews.com/network-packet-analyzer-tools/">security analysts</a>:-</p> <ul> <li>BEC-Specific Training</li> <li>Enhanced Email Verification Measures</li> <li>Make sure to test your security efficacy in observability mode</li> <li>Always use a robust security solution.</li> </ul> <p>The post <a href="https://cybersecuritynews.com/wormgpt-ai-tool/">Hackers use WormGPT to Launch Sophisticated cyberattacks</a> appeared first on <a href="https://cybersecuritynews.com">Cyber Security News</a>.</p>

Explore how Varonis enhances its security with the acquisition of SlashNext, an AI-powered email security solutions provider.

The vendor will integrate SlashNext’s phishing and social engineering detection capabilities into its Data Security Platform

Phishing remains one of the most significant cyber threats impacting organizations worldwide, according to SlashNext.

A new wave of browser-based phishing tricks unsuspecting users into copy-pasting malicious commands into their systems, all while believing they’re completing a legitimate CAPTCHA verification. According to a SlashNext research, attackers have been found cloning the Cloudflare Turnstile interface, a privacy-preserving CAPTCHA alternative to verify if a user is human, to lure users into executing a malware. Commenting on why this is an absolute winner for the threat actors, Lionel Litty, chief security architect at Menlo Security, said, “These social engineering attacks are often successful because they astutely tap into users’ frustration: having to solve yet another CAPTCHA.” They then go on to provide instructions that are both obscure for many users and easy to follow, Litty added. In SlashNext observations, Victims were presented with a fake security check with real-looking branding and a Ray ID, a Cloudflare-assigned identifier. After clicking “Verify you are human,” users are guided through key presses that unknowingly paste and run a hidden PowerShell command copied to their clipboard. These ClickFix campaigns (including the one using TurnStile CACHE) were used to deliver a range of payloads, including information stealers such as Lumma and Stealc, as well as full-fledged remote access trojans (RATs) like NetSupport Manager designed for full system compromise. ## Fake Captcha used as new phishing frontier SlashNext researcher Daniel Kelley warned that the observed campaign signals threat actors moving from traditional phishing that involves direct prompting of a file download, to a more sophisticated ClickFix attack that looks like a legitimate security check. The attack begins through compromised websites containing malicious JavaScript. When users interact with these sites, they’re redirected to deceptive pages that display error messages or CAPTCHA verifications, urging users to perform actions such as copying and pasting commands into their system’s terminal or PowerShell. “When a victim visits a malicious or compromised site, they see a message ‘Checking if the site connection is secure-Verify you are human’ just as they would on a real Cloudflare page,” Kelley said in a blog post. Subsequently, a pop-up or on-page message directs users through a sequence of key presses — including Win+R, Ctrl+V, and Enter — resulting in execution of the malware on their machine. “The concept of phishing users with fake security controls is not a new one,” said James Maude, field CTO at BeyondTrust. “In the past, threat actors have had great success with phishing documents that trick users into allowing malicious macros to run using fake security checks that claim the document needs macros enabled for security.” As defences have evolved and gotten better at blocking phishing email attachments that launch malicious code, threat actors have evolved their techniques, too, to find more creative ways to manipulate users into executing code, Maude noted. ## Fail-proof exploit of ‘verification fatigue’ SlashNext highlighted that the campaign’s success stems largely from its exploitation of human psychology. “Modern internet users are inundated with spam checks, CAPTCHAs, and security prompts on websites, and they’ve been conditioned to click through these as quickly as possible,” Kelley added. “Attackers exploit this ‘verification fatigue,’ knowing that many users will comply with whatever steps are presented if it looks routine.” The absence of immediate red flags like suspicious downloads, added with deceptive design using trusted branding and interface, provides a false sense of security. “We have seen an increasing number of this type of attack over the past several months and have had multiple customers inquire about possible ways to hinder the attack,” Litty said. “Because of their limited visibility into browser behavior, AV products and other endpoint protection solutions tend to miss these attacks.” Litty noted a need for browser-specific solutions, including tools for browser isolation, that can detect a website that writes content into the clipboard and flag it to users. ClickFix tactics aren’t anything new and have been picked up in recent years by nation-state actors, most notably in the “Contagious Interviews” campaign linked to the North Korea-aligned Kimsuky group. Other notable state-sponsored actors known for using ClickFix include MuddyWater(Iran), APT28 and UNK_RemoteRogue(Russia).