Solve Alert Fatigue, Focus on High-Risk Incidents: An Action Plan for CISOs

November 13, 2025/in Company Blogs

How many real threats hide behind the noise your SOC faces every day?

When hundreds of alerts demand attention at once, even the best analysts start to lose focus. The nonstop pressure to react to everything drains energy, clouds judgment, and opens the door to real risk.

Teams using ANY.RUN have already flipped that script:

90% of attacks become visible within 60 seconds, giving analysts instant context instead of endless guesswork.

94% of users report faster triage, cutting time spent on false positives and low-value alerts.

95% of SOC teams speed up investigations, easing the overload that leads to burnout.

Ready to see how to get there? This action plan lays out the steps CISOs can take to turn alert fatigue into lasting focus.

Step 1: Replace Guesswork with Real-Time Visibility

Alert fatigue often begins with uncertainty. Analysts spend hours dissecting fragmented data, trying to connect the dots between partial logs and incomplete alerts. When they can’t see the full story, every alert feels critical, and fatigue takes over.

Real-time behavioral visibility changes everything. With ANY.RUN’s interactive sandbox, your team watches the attack unfold in a safe environment. From the first process execution to registry changes and data exfiltration attempts, every move is mapped in real time.

That level of context replaces guesswork with confidence.

Check recent attack fully exposed in real-time

*Real-time analysis of Clickup abuse fully exposed in 60 seconds*

In the following example, analysts used the sandbox to expose a phishing attack that abused ClickUp to deliver a fake Microsoft 365 login page, uncovering the full chain in seconds.

With ANY.RUN’s real-time visibility, team achieve:

3× higher efficiency in daily operations

15 sec median MTTD

Fewer false positives and missed threats

Faster response and a calmer, more focused SOC

Step 2: Automate the Routine, Protect Human Focus

Even the strongest SOCs lose precious hours to repetitive work, copying IOCs, exporting reports, updating tickets. None of these tasks strengthen defense; they just drain energy and attention. Over time, that’s how alert fatigue turns into burnout.

But not every task can or should be automated. Many modern threats still require human-like interaction to be revealed: clicking a phishing link, solving a CAPTCHA, or scanning a QR code that hides a malicious redirect. Traditional tools stop short there.

That’s where automated interactivity changes everything.

*QR code–based phishing fully exposed inside ANY.RUN sandbox; the hidden malicious link and full attack chain revealed in under 60 seconds.*

With ANY.RUN’s sandbox, analysts get the best of both worlds; automation that behaves like a human when automated interactivity is enabled. It clicks through phishing pages, solves CAPTCHAs, follows redirects, and even scans QR codes that hide malicious links. All of this happens automatically, revealing threats most tools would miss. And when deeper insight is needed, analysts can jump in at any point to interact directly.

Outcome of automation and interactivity:

Hidden threats revealed that traditional tools can’t detect

Faster investigations with less manual work

Lower analyst fatigue through balanced automation

Human control preserved for high-priority incidents

This combination helps analysts uncover complex threats in less time and enables Tier 1 teams to resolve more cases independently.

According to recent data among ANY.RUN’s users:

20% lower workload for Tier 1 analysts

30% fewer escalations from Tier 1 to Tier 2

Step 3: Integrate Live Threat Intelligence to Cut Through the Noise

Even the best SOCs struggle to stay focused when analysts waste hours chasing outdated data; verifying expired domains, checking inactive IOCs, or switching between disconnected tools just to confirm what’s real.

*Alert fatigue is a major obstacle for SOCs around the world*

You can easily solve this with the help of live, connected intelligence.

ANY.RUN’s Threat Intelligence Feeds pull verified indicators from 15,000 organizations and 500,000 analysts worldwide, all sourced from real-time sandbox investigations. This means your team acts on current data, active phishing kits, live redirect chains, and real attacker infrastructure, not last month’s reports.

*ANY.RUN’s TI Feeds deliver 99% unique IOCs in real time*

When this intelligence is integrated into your SOC tools, analysts no longer need to jump between platforms or second-guess stale alerts. Every IOC is backed by behavioral evidence and traceable to a live analysis.

With this setup, your team can:

Validate alerts instantly using verified, real-time data

Eliminate repetitive checks for outdated or inactive indicators

Trace every IOC back to its full attack chain

Make faster, evidence-based decisions without leaving their workflow

As a result, businesses achieve stronger detection, less context-switching, and sharper focus across all SOC operations.

Step 4: Create a Unified Response Workflow

Even the most advanced SOCs lose efficiency when investigations and follow-ups aren’t coordinated. Without clear ownership and visibility into who’s handling what, tasks overlap, progress stalls, and important findings slip through the cracks.

With ANY.RUN’s teamwork features, CISOs and SOC leads can manage investigations within a single workspace: assigning tasks, tracking analyst progress, and keeping every case organized.

Each analysis also generates a structured, shareable report, so findings are easy to review, reuse, or hand off across shifts.

This unified workflow keeps everyone aligned, from initial detection to final response, while ensuring accountability and consistency across the SOC.

With a unified response workflow, you can ensure:

Clear task ownership and visibility into investigation progress

Structured, shareable reports for faster knowledge transfer

Stronger coordination between analysts and response leads

Higher overall efficiency with no duplicated effort

Time to Give Your Team a Break from the Noise

Alert fatigue is a sign of systems that demand too much and explain too little.
By giving your analysts real-time visibility, automation that understands context, and intelligence they can trust, you give them what they need most: focus.

When the noise quiets down, your team moves with intent; faster investigations, sharper decisions, and actions backed by real context instead of guesswork.

Talk to ANY.RUN experts to see how your SOC can leave alert fatigue behind.

About ANY.RUN

Built for modern SOC operations, ANY.RUN helps teams detect, analyze, and respond to threats in real time. Its Interactive Sandbox reveals full attack behavior, from process execution to network activity, giving analysts the clarity they need to act with confidence.

Compatible with Windows, Linux, and Android, the cloud-based sandbox provides deep behavioral visibility with no setup required. Integrated Threat Intelligence Lookup and TI Feeds deliver continuously updated, automation-ready IOCs that strengthen every layer of detection.

Experience it with a 14-day trial →

The post Solve Alert Fatigue, Focus on High-Risk Incidents: An Action Plan for CISOs appeared first on ANY.RUN’s Cybersecurity Blog.

ANY.RUN’s Cybersecurity Blog – Read More

CVE-2024-12649: vulnerability in the Canon TTF interpreter

November 12, 2025/in Company Blogs

These days, attackers probing an organization’s infrastructure rarely come across the luxury of a workstation without an EDR agent, so malicious actors are focusing on compromising servers, or various specialized devices connected to the network with fairly broad access privileges yet lacking EDR protection and often even logging capabilities. We’ve previously written in detail about the types of vulnerable office devices. Real-world attacks in 2025 are focused on network devices (such as VPN gateways, firewalls, and routers), video surveillance systems, and the servers themselves. But printers shouldn’t be overlooked either, as independent researcher Peter Geissler reminded the audience at the Security Analyst Summit 2025. He described a vulnerability he’d found in Canon printers (CVE-2024-12649, CVSS 9.8), which allows executing malicious code on these devices. And the most interesting aspect regarding this vulnerability is that exploiting it merely requires sending an innocent-looking file to print.

Trojan Type Font: an attack via CVE-2024-12649

The attack begins with sending an XPS file to print. This format, created by Microsoft, contains all the prerequisites for successful document printing, and serves as an alternative to PDF. XPS is essentially a ZIP archive containing a detailed description of the document, all its images, and the fonts used. The fonts are usually stored in the popular TTF (TrueType Font) format invented by Apple. And it’s precisely the font itself — something not typically perceived as dangerous — that contains the malicious code.

The TTF format was designed to both make letters look identical on any medium, and scale correctly to any size — from the smallest character on a screen to the largest on a printed poster. To achieve this goal, each letter can have font hinting instructions written for it, which describe the nuances of displaying letters of small sizes. Hinting instructions are essentially commands for a compact virtual machine which, despite its simplicity, supports all the basic building blocks of programming: memory management, jumps, and branching. Geissler and his colleagues studied how this virtual machine is implemented in Canon printers. They discovered that some TTF hinting instructions are executed insecurely. For example, the virtual machine commands that manage the stack don’t check for overflow.

As a result, they succeeded in creating a malicious font. When a document containing it is printed on certain Canon printers, it causes a stack buffer overflow, writes data beyond the virtual machine’s buffers, and ultimately achieves code execution on the printer’s processor. The entire attack is conducted via the TTF file; the rest of the XPS file content is benign. In fact, detecting the malicious code even within the TTF file is quite difficult: it’s not very long, the first part consists of TTF virtual machine instructions, and the second part runs on the exotic, proprietary Canon operating system (DryOS).

It should be noted that in recent years Canon has focused on securing printer firmware. For example, it uses DACR registers and NX (no-execute) flags supported in ARM processors to limit the ability to modify system code or execute code in memory fragments intended solely for data storage. Despite these efforts, the overall DryOS architecture doesn’t allow for effective implementation of memory protection mechanisms, such as ASLR or stack canary, which are typical of larger modern operating systems. This is why researchers occasionally find ways to bypass the existing protection. For instance, in the attack we’re talking about, the malicious code was successfully executed by placing it, via the TTF trick, into a memory buffer intended for a different printing protocol — IPP.

Realistic exploitation scenario

In their bulletin describing the vulnerability, Canon asserts that the vulnerability can be exploited remotely if the printer is accessible via the internet. Consequently, they suggest configuring a firewall so the printer can only be used from the internal office network. While this is good advice and the printer should indeed be removed from public access, this isn’t the only attack scenario.

In his report, Peter Geissler pointed to a much more realistic, hybrid scenario in which the attacker sends an employee an attachment in an email or a messenger message and, under one pretext or another, suggests they print it. If the victim does send the document to print — within the internal organization network and without any internet exposure — the malicious code is executed on the printer. Naturally, the capabilities of the malware when running on the printer will be limited compared to malware that’s infected a full-fledged computer. However, it could, for example, create a tunnel by establishing a connection to the attacker’s server — allowing the attackers to target other computers in the organization. Another potential use case for this malware on the printer could result in the forwarding of all information being printed at the company directly to the attacker’s server. In certain organizations, such as law firms, this could lead to a critical data breach.

How to fend off this printer threat

The vulnerability CVE-2024-12649 and several closely related defects can be eliminated by installing the printer firmware update according to Canon’s instructions. Unfortunately, many organizations — even those that diligently update software on computers and servers — lack a systematic process for updating printer firmware. The process must be implemented for all equipment connected to the computer network.

However, security researchers emphasize that there’s a multitude of attack vectors targeting specialized equipment. Therefore, there’s no guarantee that attackers won’t arm themselves tomorrow with a similar exploit unknown to printer manufacturers or their customers. To minimize the risk of exploitation:

Segment the network — limiting the printer’s ability to establish outbound connections and to accept connections from devices and users not authorized to print.
Disable all unused services on the printer.
Set a unique, complex administrator password on each printer/device.
Implement a comprehensive security system within the organization — including EDR installed on all computers and servers, a modern firewall, and comprehensive network monitoring based on an SIEM system.

Kaspersky official blog – Read More

ClickFix Explosion: Cross-Platform Social Engineering Turns Users Into Malware Installers

November 12, 2025/in Company Blogs

Eric Parker, a recognized cybersecurity expert, has recently released a video on ClickFix attacks, their detection, analysis, and gathering threat intelligence. Here is our recap highlighting the key points and practical advice.

ClickFix as the Signature Threat of 2025

In 2025 the internet saw a sharp surge in a deceptively simple but highly effective social-engineering technique known as ClickFix: fake CAPTCHA pages tricking victims into running commands or pasting paths that install malware on their devices. What began as isolated malvertising and phishing pages has evolved into cross-platform, professionally produced scam traps and the second most prevalent attack vector globally, trailing only traditional phishing.

ClickFix bypasses automated defenses by turning victims into unwitting accomplices, exploiting human psychology over technical tricks and vulnerabilities.

The Technique Essence in a Nutshell

*ClickFix attack chain on the example of Rhadamanthys*

An attacker presents a convincing CAPTCHA / verification / “fix this” UI that instructs the user to copy & paste a short snippet into a system dialog or terminal (for example: Run dialog, File Explorer address bar, or Terminal). JavaScript on the page often silently places an obfuscated command on the clipboard and/or shows an instruction video.

When the user pastes and hits Enter they execute that command which downloads and runs malware. The chain relies entirely on social engineering and trusted OS interfaces rather than exploit primitives.

ClickFix isn’t limited to Windows. In 2025 campaigns increasingly tailored payloads and instructions for macOS and Linux. Often they abused legitimate distribution/installation flows (for example, spoofing Homebrew install pages or using shell commands) making the technique even more stealthy on non-Windows platforms.

ClickFix is especially dangerous for organizations because:

It bypasses technical defenses — the user executes the malware themselves, making the activity look legitimate to EDR and antivirus.

It is cross-platform — targeting Windows, macOS, and Linux, and sometimes abusing legitimate package managers such as Homebrew on macOS.

It scales cheaply and quickly — attackers automate landing pages, videos, OS detection, and payload delivery.

It delivers high-impact threats — info-stealers, remote access trojans, and ransomware are already distributed via ClickFix and its variants (e.g., FileFix).

For businesses, this means that endpoint protection alone is not enough. Security teams must pair behavioral detection and browser controls with threat intelligence that tracks malicious domains, payloads, and evolving social-engineering patterns. The attack surface isn’t a vulnerability in code — it’s a vulnerability in human workflows.

ClickFix Examples: Exploring with ANY.RUN

So, let’s see how the technique functions by finding ClickFix samples via ANY.RUN’s Threat Intelligence Lookup and observing their behavior in Interactive Sandbox.

We can discover ClickFix analyses simply by a threat’s name – although TI Lookup allows to combine over 40 search parameters for more complicated and precise queries. We can use the name of a file, the name of a process, and even a registry key; it is possible to find malware that does a specific thing like connecting to a certain domain or making some requests.

threatName:”clickfix”

*Sandbox analyses where ClickFix attacks were detected*

Example 1: Fake Updates

Here is the first example: view a sandbox session.

*Sandbox detonation of fake update ClickFix variant*

This is an example of a “fix-this” swindle persuading a user to run a command to complete a fake Windows update. What happens if they follow the instructions?

mshta.exe process is initiated (utilizing a somewhat unusual IP with a “0x” in it).

*Malicious process featuring a suspicious IP address*

It triggers a PowerShell command that drops an .exe file.

It reads a specific registry key to check if the user is running a certain type of virtual machine and reads the BIOS version which belongs to yet another anti-analysis trick. Pay attention to the process OOBE-Maintenance.exe: looks like it has been injected since it’s a legitimate file, but it’s loading DLLs and demonstrates very suspicious activities.

*Malware gathering the system information*

So, we can classify this sample as malicious revealing info-stealer activity along with anti-analysis.

And here we see a malicious extension having been dropped. Google Chrome puts a lot of effort into making it hard for infostealers, but unfortunately infostealers worked around that.

*The Sandbox allows to view and search files that are part of the attack*

Example 2: Stealthy Classic

Let us view another analysis. It’s a typical ClickFix pseudo-CAPTCHA:

*A typical ClickFix “CAPTCHA” making user run a malicious command*

By running this command, we do mshta for a certain domain that drops payload. And then the system works like nothing has happened, and the CAPTCHA just worked, and everything is fine. But actually, this computer is completely pwned. A massive payload is delivered.

*Malware download detected by the Sandbox*

Example 3: Forged CloudFlare, Actual RAT

View sandbox analysis

Here we see a “verification” website abusing CloudFlare services. Note that the first CAPTCHA is a genuine CloudFlare CAPTCHA:

*An actual CloudFlare CAPTCHA: user just needs to check a box*

And then there comes the tricky one:

*Malicious CAPTCHA closely following the benign one*

This sample is not as clever as the previous one: it’s not stealthy, a PowerShell window opens up and hints that something might be amiss here.

PowerShell spawns this GUI urging the user to click “Continue” which sends them to the actual Booking com so they might think everything is okay.

*Fake verification form redirects the user to the real website but delivers malware along*

Nothing could be further from the truth. The file travelsecurity.exe is dropped, creates persistence, and it all looks like a phishing attack.

Example 4: FileFix and Explorer Commands

This is a relatively new version: a Docusign scam. View analysis.

If you don’t look closely, it seems to be a perfectly legit document that just requires user signature. Eric says he’s been receiving a lot of those via email, usually disguised as sponsorship offers.

But there is the first possible-phishing red flag: the domain eu2-docusign[.]net is not a subdomain of Docusign, it masks like one using a hyphen.

*FileFix variant of ClickFix: a fake document*

We can call this attack variant FileFix as there is no CAPTCHA, just a path to copy into Windows Explorer and open a file to be signed.

(There is also a DocFix variant that masquerade as document viewer errors, particularly targeting Microsoft Office and PDF workflows. MeetFix exploits fake Google Meet errors.)

So the path is copied into the Explorer address bar… And Eric is surprised that you can run commands in Explorer. The command is separated from the path by a string of spaces and is not visible for the user unless they scroll the address bar.

What the user sees:

What they can see after dragging their cursor to the right:

*Unobvious part of the command containing PowerShell call*

The string runs the PowerShell command:

*The malicious process interferes with the system settings*

And a couple of processes later we can welcome an info stealer in the system:

*The malware steals credentials and other personal data*

How to Keep Up with New ClickFix Attacks

So, this is how ClickFix technique works, and this is how it can be researched via Threat Intelligence Lookup and Interactive Sandbox. Over 15,000 SOC teams all over the world analyze fresh malware samples daily, generating loads of contextual data on prevalent and emerging threats.

Use TI Lookup to check IOCs for associations with ClickFix attacks and protect proactively:

domainName:”i-like-ele-phants-verification.live”

*Domain labelled by TI Lookup as an indicator of ClickFix attacks*

Update blocklists, employ targeted preventative controls (e.g., clipboard-protection extensions, blocking certain address-bar patterns in enterprise policies), use TI to create detection rules (SIEM, EDR) that look for suspicious curl | sh, Run dialogue invocations, PowerShell one-liners, or unusual child processes after a browser session.

Conclusion

ClickFix is a human-centric, high-ROI social-engineering technique that matured into a major vector in 2025. It’s cross-platform, fast-evolving (FileFix and other address-bar / clipboard tricks), and amplified by automated tooling and AI.

As AI continues to enhance attack sophistication and lower barriers to entry, organizations must evolve their defenses beyond technical controls to include robust threat intelligence, user education, and behavioral detection. The ClickFix threat will persist and evolve—only through comprehensive, intelligence-driven security programs can organizations hope to stay ahead of this signature threat of 2025.

FAQ

Q1: What is ClickFix?

A: ClickFix is a social engineering technique that tricks users into running malicious commands (e.g., PowerShell scripts) via fake CAPTCHAs or error fixes, leading to self-infection without downloads.

Q2: How has ClickFix evolved in 2025?

A: It surged 517% in H1 2025, becoming the #2 vector after phishing, with cross-platform support and AI-enhanced lures boosting evasion and compliance.

Q3: Is ClickFix only for Windows?

A: No, it’s cross-platform, abusing Homebrew on macOS for root access and terminal commands on Linux, making it deadlier on non-Windows systems.

Q4: What are ClickFix variants like DocFix?

A: Variants include DocFix (HTML “docs” in emails), FileFix (File Explorer pastes), and MeetFix (fake Google Meet errors), all refining the manipulation.

Q5: Why did ClickFix explode in 2025?

A: Underground builders, nation-state adoption (e.g., APT28), and shifts to malvertising/compromised sites made it scalable and stealthy.

Q6: How does AI fuel ClickFix threats?

A: AI crafts personalized lures, injects prompts into summarizers, and generates obfuscated code, automating infections via browser agents.

Q7: Describe a typical ClickFix attack flow.

A: Lure → Fake prompt/clipboard hijack → User pastes command (Win + R/Terminal) → Loader downloads → Payload (e.g., Lumma Stealer) deploys.

Q8: Why are ClickFix attacks so dangerous?

A: They’re fileless, cross-platform, versatile (RATs to ransomware), and exploit psychology, bypassing AV for rapid data theft/escalation.

Q9: How does threat intelligence combat ClickFix?

A: TI maps IOCs, enables behavioral detection (e.g., EDR alerts), shares via alliances, and informs training/policies like Run dialog blocks.

Q10: How can I prevent ClickFix on my device?

A: Use EDR/AV, disable Win + R via GPO, train on suspicious prompts, block known C2 domains, and verify sources—never paste untrusted code.

About ANY.RUN

Trusted by over 500,000 cybersecurity professionals and 15,000+ organizations in finance, healthcare, manufacturing, and other critical industries, ANY.RUN helps security teams investigate threats faster and with greater accuracy.

Our Interactive Sandbox accelerates incident response by allowing you to analyze suspicious files in real time, watch behavior as it unfolds, and make confident, well-informed decisions.

Our Threat Intelligence Lookup and Threat Intelligence Feeds strengthen detection by providing the context your team needs to anticipate and stop today’s most advanced attacks.

Want to see it in action?

Start your 14-day trial of ANY.RUN today →

The post ClickFix Explosion: Cross-Platform Social Engineering Turns Users Into Malware Installers appeared first on ANY.RUN’s Cybersecurity Blog.

ANY.RUN’s Cybersecurity Blog – Read More

Why shadow AI could be your biggest security blind spot

November 12, 2025/in Company Blogs

From unintentional data leakage to buggy code, here’s why you should care about unsanctioned AI use in your company

WeLiveSecurity – Read More

Microsoft Patch Tuesday for November 2025 — Snort rules and prominent vulnerabilities

November 11, 2025/in Company Blogs

Microsoft has released its monthly security update for November 2025, which includes 63 vulnerabilities affecting a range of products, including 5 that Microsoft marked as “critical.” Current intelligence shows that one of the important vulnerabilities, CVE-2025-62215, has already been detected in the wild.

Out of five “Critical” entries, three are remote code execution (RCE) vulnerabilities in Microsoft Windows components including GDI+, Microsoft Office, and Visual Studio. One is an elevation of privilege vulnerability affecting the DirectX Graphics Kernel.

In the following sections we give a concise overview of the critical and important entries that are most relevant for defenders. The full catalogue of all reported issues can be found on Microsoft’s official update page.

Exploited in the Wild

One “important” vulnerability was confirmed to have been exploited in the wild.

CVE-2025-62215 is a Windows Kernel elevation of privilege vulnerability, given a CVSS 3.1 score of 7.8, where a race condition in Windows Kernel allows an authorized attacker to elevate privileges locally. Microsoft assessed that the attack complexity is “low”.

Critical Vulnerabilities

Among all the critical vulnerabilities, none of them were labelled as exploitation more likely. Five are considered exploitation less likely. Below we describe each of those five entries.

CVE-2025-60724 is a RCE vulnerability in GDI+, given a CVSS 3.1 score of 9.8, where a heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network. The vulnerability can be triggered by convincing a victim to download and open a document that contains a specially crafted metafile. In the worst-case scenario, an attacker could trigger this vulnerability on web services by uploading documents containing a specially crafted metafile without user interaction. An attacker doesn’t require any privileges on the systems hosting the web services. Successful exploitation of this vulnerability could cause RCE or Information Disclosure on web services that are parsing documents that contain a specially crafted metafile, without the involvement of a victim user. Microsoft assessed that the attack complexity is “low”, and that exploitation is “less likely”.

CVE‑2025‑30398 is a Nuance PowerScribe 360 information disclosure vulnerability, given a CVSS 3.1 score of 8.1, where missing authorization in Nuance PowerScribe allows an unauthorized attacker to disclose information over a network. An unauthenticated attacker could exploit this vulnerability by making an API call to a specific endpoint. The attacker could then use the data to gain access to sensitive information (including PII data) on the server. Microsoft assessed that the attack complexity is “low”, and that exploitation is “less likely”.

CVE‑2025‑62199 is a RCE vulnerability in Microsoft Office applications, given a CVSS 3.1 score of 7.8, where a use‑after‑free flaw in Microsoft Office allows an unauthenticated attacker to execute code locally on a vulnerable workstation. To exploit this vulnerability, an attacker must send the user a malicious file and convince them to open it. Microsoft assessed that the attack complexity is “low”, and that exploitation is “less likely”.

CVE‑2025‑60716 is a DirectX Graphics kernel elevation of privilege vulnerability, given a CVSS 3.1 score of 7, where a use‑after‑free flaw in Windows DirectX allows an authorized attacker to elevate privileges locally. Successful exploitation of this vulnerability requires an attacker to win a race condition. Microsoft assessed that the attack complexity is “high”, and that exploitation is “less likely”.

CVE‑2025‑62214 is a RCE vulnerability in Visual Studio, given a CVSS 3.1 score of 6.7, where AI command injection in Visual Studio allows an authorized attacker to execute code locally. Exploitation is not trivial for this vulnerability as it requires multiple steps: prompt injection, Copilot Agent interaction, and triggering a build. Microsoft assessed that the attack complexity is “high”, and that exploitation is “less likely”.

Important Vulnerabilities

Talos would also like to highlight the following “important” vulnerabilities as Microsoft has determined that their exploitation is “more likely”:

CVE‑2025‑59512 – Customer Experience Improvement Program (CEIP) Elevation of Privilege Vulnerability.

CVE‑2025‑60705 – Windows CSC Service Elevation of Privilege Vulnerability

CVE-2025-60719 – Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

CVE-2025-62217 – Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

CVE-2025-62213 – Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

A complete list of all the other vulnerabilities Microsoft disclosed this month is available on its update page.

In response to these vulnerability disclosures, Talos is releasing a new Snort ruleset that detects attempts to exploit some of them. Please note that additional rules may be released at a future date, and current rules are subject to change pending additional information. Cisco Security Firewall customers should use the latest update to their ruleset by updating their SRU. Open-source Snort Subscriber Ruleset customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.

The rules included in this release that protect against the exploitation of many of these vulnerabilities are 65496-65501, 65507-65510. There are also these Snort 3 rules: 301343-301345, 301347, 301348.

Cisco Talos Blog – Read More

What is the Pixnapping vulnerability, and how to protect your Android smartphone? | Kaspersky official blog

November 11, 2025/in Company Blogs

Android constantly tightens app restrictions to prevent scammers from using malicious software to steal money, passwords, and users’ private secrets. However, a new vulnerability dubbed Pixnapping bypasses every protective layer and allows an attacker to imperceptibly read image pixels from the screen — essentially taking a screenshot. A malicious app with zero permissions can see passwords, bank account balances, one-time codes, and anything else the owner views on the screen. Fortunately, Pixnapping is currently a purely research-based project and is not yet being actively exploited by threat actors. The hope is that Google will thoroughly patch the vulnerability before the attack code is integrated into real-world malware. As of now, the Pixnapping vulnerability (CVE-2025-48561) likely affects all modern Android smartphones, including those running the latest Android versions.

Why screenshots, media projection and screen reading are dangerous

As demonstrated by the SparkCat OCR stealer we discovered, threat actors have already mastered image processing. If an image on a smartphone contains a valuable piece of information, the malware can detect it, perform optical character recognition directly on the phone, and then exfiltrate the extracted data to the attacker’s server. SparkCat is particularly noteworthy because it managed to infiltrate official app marketplaces including the App Store. It would not be difficult for a malicious Pixnapping-enabled app to replicate this trick, especially given that the attack requires zero special permissions. An app that appears to offer a legitimate, useful feature could simultaneously and silently send one-time multi-factor authentication codes, cryptowallet passwords, and any other information to scammers.

Another popular tactic used by malicious actors is to view the required data as it’s shown, in real-time. For this social engineering approach, the victim is contacted via a messaging app and, under various pretexts, convinced to enable screen sharing.

Anatomy of the Pixnapping attack

The researchers were able to screenshot content from other apps by combining previously known methods of stealing pixels from browsers and from ARM phone graphics processing units (GPUs). The attacking app silently overlays translucent windows atop the target information and then measures how the video system combines the pixels of these layered windows into a final image.

As far back as 2013, researchers described an attack that allowed one website to load another within part of its own window (via an iframe) and, by performing legitimate operations of image layering and transformation, infer exactly what was drawn or written on the other site. While modern browsers have mitigated that specific attack, a group of U.S. researchers have now figured out how to apply the same core principle to Android.

The malicious app first sends a system call to the target app. In Android, this is known as an intent. Intents typically enable not only simple app launching but also things like immediately opening a browser to a specific URL or a messaging app to a specific contact’s chat. The attacking app sends an intent designed to force the target app to draw the sensitive information onto the screen. Special hidden launch flags are used. The attacking app then sends a launch intent to itself. This specific combination of actions allows the victim app to not appear on the screen at all, yet it still renders the information sought by the attacker in its window, in the background.

In the second stage of the attack, the malicious app overlays the hidden window of the victim app with a series of translucent windows, each of which covers and blurs the content beneath it. This complex arrangement remains invisible to the user, but Android dutifully calculates how this combination of windows should look if the user were to bring it to the foreground.

The attacking app can only directly read the pixels from its own translucent windows; the final combined image, which incorporates the victim app’s screen content, is not directly accessible to the attacker. To bypass this restriction, the researchers employ two ingenious tricks. The specific pixel to be stolen is isolated from its surroundings by overlaying the victim app with a mostly opaque window that has a single transparent point precisely over the target pixel. A magnifying layer is then placed on top of this combination, consisting of a window with heavy blurring enabled.

How the Pixnapping vulnerability works

To decipher the resulting mush and determine the value of the pixel at the very bottom, the researchers leveraged another known vulnerability, GPU.zip (this may look like a file link, but it actually leads to a research paper site). This vulnerability is based on the fact that all modern smartphones compress the data of any images being sent from the CPU to the GPU. This compression is lossless (like a ZIP file), but the speed of packing and unpacking changes depending on the information being transmitted. GPU.zip permits an attacker to measure the time it takes to compress the information. By timing these operations, the attacker can infer what data is being transferred. With the help of GPU.zip, the isolated, blurred, and magnified single pixel from the victim app’s window can be successfully read by the attacking app.

Stealing something meaningful requires repeating the entire pixel-stealing process hundreds of times, as it needs to be applied to each point separately. However, this is entirely feasible within a short time frame. In a video demonstration of the attack, a six-digit code from Google Authenticator was successfully extracted in just 22 seconds, while it was still valid.

How Android protects screen confidentiality

Google engineers have nearly two decades of experience combating various privacy attacks, which has resulted in a layered defense built against illegal capture of screenshots and videos. A complete list of these measures would span several pages, so we only list some key protections:

The FLAG_SECURE window flag prevents the operating system from taking screenshots of content.
Access to media projection tools (capturing screen content as a media stream) requires explicit user confirmation and can only be performed by an app that is visible and active.
Tight restrictions are placed on access to administrative services like AccessibilityService and the ability to draw app elements over other apps.
One-time passwords and other secret data are hidden automatically if media projection is detected.
Android restricts apps from accessing other apps’ data. Additionally, apps cannot request a full list of all installed apps on the smartphone.

Unfortunately, Pixnapping bypasses all these existing restrictions and requires absolutely no special permissions. The attacking app only needs two fundamental capabilities: to draw within its own windows and to send system calls (intents) to other apps. These are basic building blocks of Android functionality, so they are very difficult to restrict.

Which devices are affected by Pixnapping, and how to defend oneself

The attack’s viability was confirmed on Android versions 13–16 across Google Pixel devices from generations 6–9, as well as Samsung Galaxy S25. The researchers believe the attack will be functional on other Android devices as well, as all the mechanisms used are standard. However, there may be nuances related to the implementation of the second phase of the attack (the pixel magnification technique).

Google released a patch in September after being notified of the attack in February. Unfortunately, the chosen method for fixing the vulnerability proved to be insufficiently reliable, and the researchers quickly devised a way to bypass the patch. A new attempt to eliminate the vulnerability is planned for Google’s December update release. As for GPU.zip, there are no plans to issue a patch for this specific data leakage channel. At least, no smartphone GPU manufacturer has announced plans to that effect since the flaw became public knowledge in 2024.

User capabilities to defend against Pixnapping are limited. We recommend the following measures:

Promptly update to the latest version of Android with all current security patches.
Avoid installing apps from unofficial sources, and exercise caution with apps from official stores if they are too new, have low download counts, or are poorly rated.
Ensure a full-fledged security system is used on your phone, such as Kaspersky for Android.

What other non-standard Android attack methods exist:

Spyware that pretends to be an antivirus

Trojan embedded in fake Android smartphones

Data theft during smartphone charging

Your pics are at risk: the threat posed by the new SparkKitty Trojan

How the Necro Trojan attacked 11 million Android users

Kaspersky official blog – Read More

What is FileFix — a ClickFix variation? | Kaspersky official blog

November 10, 2025/in Company Blogs

We recently covered the ClickFix technique. Now, malicious actors have begun deploying a new twist on it, which was dubbed “FileFix” by researchers. The core principle remains the same: using social engineering tactics to trick the victim into unwittingly executing malicious code on their own device. The difference between ClickFix and FileFix is essentially where the command is executed.

With ClickFix, attackers convince the victim to open the Windows Run dialog box and paste a malicious command into it. With FileFix, however, they manipulate the victim into pasting a command into the Windows File Explorer address bar. From a user perspective, this action doesn’t appear unusual — the File Explorer window is a familiar element, making its use less likely to be perceived as dangerous. Consequently, users unfamiliar with this particular ploy are significantly more prone to falling for the FileFix trick.

How attackers manipulate the victim into executing their code

Similar to ClickFix, a FileFix attack begins when a user is directed — most often via a phishing email — to a page that mimics the website of some legitimate online service. The fake site displays an error message preventing access to the service’s normal functionality. To resolve the issue, the user is told they need to perform a series of steps for an “environment check” or “diagnostic” process.

To do this, the user is told they need to run a specific file that, according to the attackers, is either already on the victim’s computer or has just been downloaded. All the user needs to do is copy the path to the local file and paste it into the Windows File Explorer address bar. Indeed, the field from which the user is instructed to copy the string shows the path to the file — which is why the attack is named “FileFix”. The user is then instructed to open File Explorer, press [CTRL] + [L] to focus on the address bar, paste the “file path” via [CTRL] + [V], and press [ENTER].

Here’s the trick: the visible file path is only the last few dozen characters of a much longer command. Preceding the file path is a string of spaces, and before that is the actual malicious payload the attackers intend to execute. The spaces are crucial for ensuring the user doesn’t see anything suspicious after pasting the command. Because the full string is significantly longer than the address bar’s visible area, only the benign file path remains in view. The true contents are only revealed if the information is pasted into a text file instead of the File Explorer window. For instance, in a Bleeping Computer article based on research by Expel, the actual command was found to launch a PowerShell script via conhost.exe.

The user believes they’re pasting a file path, but the command actually contains a PowerShell script. Source

What happens after the malicious script is run

A PowerShell script executed by a legitimate user can cause trouble in a multitude of ways. Everything depends on corporate security policies, the specific user’s privileges, and the presence of security solutions on the victim’s computer. In the case mentioned previously, the attack utilized a technique named “cache smuggling”. The same fake website that implemented the FileFix trick saved a file in JPEG format into the browser’s cache, but the file actually contained an archive with malware. The malicious script then extracted this malware and executed it on the victim’s computer. This method allows the final malicious payload to be delivered to the computer without overt file downloads or suspicious network requests, making it particularly stealthy.

How to defend your company against ClickFix and FileFix attacks

In our post about the ClickFix attack technique, we suggested that the simplest defense was to block the [Win] + [R] key combination on work devices. It’s extremely rare for a typical office employee to genuinely need to open the Run dialog box. In the case of FileFix, the situation is a bit more complex: copying a command into the address bar is perfectly normal user behavior.

Blocking the [CTRL] + [L] shortcut is generally undesirable for two reasons. First, this combination is frequently used in various applications for diverse, legitimate purposes. Second, it wouldn’t fully help, as users can still access the File Explorer address bar by simply clicking it with the mouse. Attackers often provide detailed instructions for users if the keyboard shortcut fails.

Therefore, for a truly effective defense against ClickFix, FileFix, and similar schemes, we recommend first and foremost deploying a reliable security solution on all employee work devices that can detect and block the execution of dangerous code in time.

Second, we advise regularly raising employee awareness about modern cyberthreats — particularly the social engineering methods employed in ClickFix and FileFix scenarios. The Kaspersky Automated Security Awareness Platform can help automate employee training.

Kaspersky official blog – Read More

The who, where, and how of APT attacks in Q2 2025–Q3 2025

November 8, 2025/in Company Blogs

ESET Chief Security Evangelist Tony Anscombe highlights some of the key findings from the latest issue of the ESET APT Activity Report

WeLiveSecurity – Read More

In memoriam: David Harley

November 8, 2025/in Company Blogs

Former colleagues and friends remember the cybersecurity researcher, author, and mentor whose work bridged the human and technical sides of security

WeLiveSecurity – Read More

How scammers use email for blackmail and extortion | Kaspersky official blog

November 7, 2025/in Company Blogs

“We’ve hacked your computer! Send money to the specified account, or all your photos will be posted online”. You or someone you know has probably encountered an email with this kind of alarming message.

We’re here to offer some reassurance: nearly every blackmail email we’ve ever seen has been a run-of-the-mill scam. Such messages, often using identical text, are sent out to a massive number of recipients. The threats described in them typically have absolutely no basis in reality. The attackers send these emails out in a “spray and pray” fashion to leaked email addresses, simply hoping that at least a few recipients will find the threats convincing enough to pay the “ransom”.

This article covers which types of spam emails are currently prevalent in various countries, and explains how to defend yourself against email blackmailers.

Classic scams: hacks, sextortion, and “your money or your life”

Classic scam emails may vary in their content, but their essence always remains the same: the blackmailer plays the role of a noble villain, allowing the victim to walk away unharmed if they transfer money (usually cryptocurrency). To make the threat more believable, attackers sometimes include some of the victim’s personal data in the email, such as their full name, tax ID, phone number, or even their physical address. This doesn’t mean you’ve actually been hacked — more often than not, this information is sourced from leaked databases widely available on the dark web.

The most popular theme among email blackmailers is a “hack” where they claim to have gained full access to your devices and data. Within this theme, there are three common scenarios:

The attacker is concise and gets straight to the point: they state the exact amount of money you need to transfer to prevent your private information from becoming public.
Detailed and dramatic emails: these elaborate spam emails contain a wealth of detail about the malware the attacker allegedly used to infect the recipient’s device, and the types of data they’ve accessed. This usually includes everything at once: the PC itself, the mouse, the webcam, and the keyboard. Sometimes, the scammers even graciously advise you to change your passwords regularly and avoid clicking on unknown links in the future to prevent unpleasant situations. On this point we actually agree with their recommendations.
The specific details of the “hacker attack” and the attacker’s demands are omitted from the email body. Instead, the recipient is prompted to find this information by clicking a link to a website. Scammers use this tactic to bypass email spam filters.

Blackmailers also don’t shy away from the topic of adult content. Typically, they simply intimidate the victim with threats that everyone will find out what kind of explicit content they’ve allegedly been viewing. Some attackers go further — they claim to have gained access to the person’s webcam and recorded intimate activity while simultaneously screen-recording their PC. The price of their silence starts at several hundred dollars in cryptocurrency. Crucially, these blackmailers intentionally try to isolate the victim by telling them not to report the email to law enforcement or loved ones, and claiming that doing so will immediately trigger the threats. By the way, safe and private viewing of adult content is a challenge unto itself, but we’ve covered that in Watching porn safely: a guide for grown-ups.

A scammer threatens to publish a victim’s intimate videos and demands cryptocurrency

Perhaps the most extreme form of email blackmail involves death threats. Naturally, such an email would make anyone uneasy, and many people become genuinely worried for their own safety. The noble hitman, however, is always willing to spare the victim’s life if they can “outbid the one who ordered the hit”.

“You have 72 hours left to live.” The blackmailer suggests not involving the police and simply paying off “the one who ordered the hit” instead

You’ve been served: law enforcement impersonation scams in Europe

Besides legends of “noble hackers” and “hitmen” who immediately offer a way out for a hefty fee, there are longer, more elaborate scams.

In these attacks, scammers pose as law enforcement officers. They don’t ask for money right away, as that would arouse suspicion. Instead, the victim receives a “summons” accusing them of committing a serious, often highly delicate crime. This typically involves allegations of distributing pornography (including child pornography), of pedophilia, human trafficking, or even indecent exposure. The “evidence” isn’t pulled out of thin air, but supposedly taken directly from the victim’s computer, to which the “special services” have gained “remote access”.

Spam blackmail targeting users in France

The document is designed to instill absolute terror: it includes a threat of arrest and a large fine, a signature with a seal, an official address, and names of high-ranking prosecutors. The scammers demand that the victim promptly makes contact via the email address provided in the message to offer an explanation — then, perhaps, the charges will be dropped. If the victim fails to respond, they’re threatened with arrest, registration on a list of sex offenders, and having their “file” passed to the media.

When the terrified victim contacts the attackers, the scammers then offer to “pay a fine” for an “out-of-court settlement of the criminal case” — a case that, of course, doesn’t exist.

Scammers once again accuse victims of viewing child pornography

These types of emails are sent under the guise of coming from major law enforcement organizations like Europol. They’re most frequently addressed to residents of France, Spain, the Czech Republic, Portugal, and other European countries. They also share a curious feature: typically, the subject line and the body of the email are quite brief, with the entire fraudulent case being laid out in attached documents. Reminder: we can’t stress this enough — never open email attachments if you don’t know or trust the sender! And to ensure that malicious and phishing emails don’t even reach your inbox, use a reliable protective solution.

Authority scams in CIS countries

The “law enforcement theme” is also prevalent in CIS (former-Soviet-Union) countries. In 2025, scammers circulated “Summons for Criminal Investigation” alleging the initiation of a criminal case. This was supposedly issued by the Russian Ministry of Internal Affairs in collaboration with such fantastic units as “Russian Interpol” and the “Bureau of Investigation Against Organized Crime”.

According to the fictional narrative, a certain “National Center for the Analysis of Child Pornography and Exhibitionism Images” had seized computers somewhere and determined that the recipient’s IP address was used to “access inappropriate and pornographic websites”. Of course, a quick online search will reveal that none of the organizations mentioned in that email have ever officially existed in Russia.

The “Director of the Police Criminal Investigation Department” will, for added persuasiveness, write in ALL CAPS, and sign their name with an English transliteration

In another similar email, the recipient, at the behest of the head of the “Russian Federal Bureau of Investigation (FBI)”, supposedly became a person of interest to a certain “International Criminal Police Organization — Interpol of the Federal Police of Russia”. (We should clarify that no law enforcement agencies with even remotely similar names have ever existed in Russia.) In the email, the attackers refer to a “Cybercrime Act in accordance with the Crimes Act of 1900 (sic!) from 245RU(2)” — laws so secret that apparently no legal expert knows they exist. Moreover, the message, sent from a generic Gmail address, is supposedly from the Minister of Internal Affairs himself. However, in the attached summons, he is referred to as the “Commissioner of the Federal Police of the Russian Federation” — likely a clumsy translation from English.

The scam email from the non-existent “Russian Federal Bureau of Investigation” is signed by none other than the Minister of Internal Affairs

Similar scam emails also reach residents of Belarus, arriving in both Russian and Belarusian. The victims are supposedly being pursued by multiple agencies simultaneously: the Ministry of Internal Affairs and Ministry of Foreign Affairs of Belarus, the Militsiya of the Republic of Belarus, and a certain “Main Directorate for Combating Cybercrime of the Minsk City Internal Affairs Directorate for Interpol in Belarus”. One might assume that the email recipient is the country’s most wanted villain, being hunted by the “cyberpolice” itself.

In the summons, the blackmailers cite non-existent laws, and threaten to add the victim to a fictitious “National Register of Underage (sic!) Sexual Offenders” — a clear machine translation failure — and, of course, request an urgent reply to the email.

An email from the non-existent cyberpolice of Belarus

In another campaign, attackers sent emails in the name of the real State Security Committee of Belarus. However, they referenced a fake law and contacted the accused at the behest of the President of Europol — never mind that Europol doesn’t have a President, and the name of the real executive director is completely different.

Another scam campaign in Belarusian

In addition to sex crimes, citizens of Belarus are also accused of “repeated use of necrotic (sic!) and psychotropic drugs”. In these emails, the attackers claim to be from the DEA — the U.S. Drug Enforcement Administration. Why a U.S. federal agency would be interested in Belarusian citizens remains a mystery.

The scammers failed to realize that the law enforcement body in Belarus is called the “militsya” (militia) rather than “politsya” (police)

Identifying scam emails

As you can see from the examples above, the majority of these scam emails appear highly implausible — and yet they still find victims. That said, with scammers increasingly adopting AI tools, it’s reasonable to expect a significant improvement in both the text quality and design of these fraudulent campaigns. Let’s highlight several indicators that will help you recognize even the most skillfully crafted fakes.

Personal data. Although it makes scam emails look formal and believable, even if the email features your address, tax ID, phone number, or passport details, it doesn’t mean that the threat is legitimate. In all likelihood, your information was simply sourced from leaked databases and exploited by the scammers. The opposite is also true: impersonal greetings like “Dear Sir/Madam” or “Dear Customer” are undoubtedly also a red flag.
The sender’s address is registered on a free email service.
A request to open an attached file, or follow a link to “find out the details”.
Manipulation, threats, calls for urgent action, and demands not to tell anyone about the email. Attackers deliberately use these psychological tricks to throw you off balance and deprive you of external support.
Typos and grammatical errors. If you suspect the email is a very poor word-for-word translation from another language, you’re probably right. However, a well-written email is no reason to let your guard down: while scammers are often not the most skilled linguists, they sometimes create exceptionally high-quality spam campaigns.
Character substitution to bypass spam filters. Attackers mix alphabets, use characters with diacritics such as “Ƙ” instead of “K”, and sometimes simply insert chunks of incoherent text or “noise up” the body with random characters. The text remains readable but often looks odd.

An example of scammers attempting to bypass spam filters by substituting characters and adding meaningless blocks of text

How to protect yourself from email blackmail

Don’t panic. Scammers deliberately use fear, create a sense of urgency, and rely on your trust in authority. Their goal is for you to believe their fabricated story, but they have no real leverage. If you’re being rushed, threatened, or given ultimatums, make a conscious effort to slow down and avoid making impulsive decisions.
Install a reliable security solution that will promptly alert you about suspicious emails, malicious files, or links.
Pay attention to the details. If you receive an email supposedly from a government or law enforcement agency, first examine the sender’s email address. If there’s a reply-to address, compare it with the sender’s. Use search engines to check if the organizations mentioned in the email actually exist, and who manages them. Look up the laws they cite. Pay close attention to signatures and titles — in short, do a full fact-check. Finally, ask yourself if you’re really important enough for, say, the Minister of Internal Affairs to be writing to you personally.
Use only verified communication channels. Remember that government agencies will never blackmail or threaten you in official correspondence. If you’re still unsure whether the email is real or fake, find the official contact information of the organization mentioned in it, and reach out through an alternative, verified channel — for instance, by phone. Don’t click links or call phone numbers (especially mobile numbers) provided in the email you received — always verify contacts online.
If you receive an email with a death threat, don’t engage with the scammer, and contact the police immediately. The vast majority of these scare tactics are blatant blackmail, which is a criminal offense in most countries. The key is to remain calm.

Read more on popular scammer tricks:

How phishers and scammers use AI

The scam on your doorstep

Beware of Google Forms bearing crypto gifts

You’re in for a big payout again

Spam 101: what is spam, and how to defeat it

Kaspersky official blog – Read More