Hackers targeted the U.S. Federal Election Commission’s systems, forcing the agency to shut down online services and disrupting campaign finance filings just days before the November 3 midterm elections. The outage delayed fresh spending disclosures, but officials have not confirmed a successful breach or data theft. According to Reuters, an FEC electronic filings officer warned […]

The post Hackers Attempt to Breach U.S. Election Commission Systems, Triggering Major Service Outage appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A leaked SquareML access key could have been used to access a database containing personal and health information.

The post Vendor Key Leak Puts Data of 238,000 Denver Health Plan Members at Risk appeared first on SecurityWeek.

Microsoft has released out-of-band (OOB) Windows updates to remove trust in certificates tied to compromised eMudhra certificate authority keys, protecting systems that do not receive automatic certificate trust updates. [...]

CISA added the Brotli flaw to its KEV catalog, and two honeypot operators logged attempts, including one that used a broken exploit.

The post CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts appeared first on SecurityWeek.

Threat Research Team uncovered three malicious Firefox extensions impersonating Phantom, Jupiter, and Bitget wallets to steal cryptocurrency recovery phrases and private keys.

All three contained complete stealers inside Mozilla-signed packages, placing malicious code directly in the submitted extensions.

The listings were available on Firefox Add-ons during analysis but had been removed by publication. Stolen information went to subdomains of bonto[.]io, the campaign’s shared command-and-control infrastructure.

Attackers copied wallet branding, icons, and promotional text while using Unicode homoglyphs, characters that resemble ordinary letters, to disguise extension names.

Each listing came from a separate disposable developer account, spreading the campaign across multiple publishers.

Firefox Wallets Hide Malware

The Phantom impersonator, add-on ID 3092199, combined a bundled stealer with a remote loader hidden in background/serviceWorker.js.

The loader reconstructed its server address from character codes and fetched configuration from phantom[.]bonto[.]io/config.

That configuration contained an activation flag and a base64-encoded JavaScript payload. The extension decoded the payload and executed it inside browser pages, allowing attackers to change its behavior without submitting another extension package.

It first targeted the page’s main execution environment, where it could access website objects and wallet providers. If that failed, it attempted execution in the isolated content-script environment. Cached code was injected again when tabs finished loading.

The payload searched input fields, text areas, pasted content, and numbered recovery-phrase displays. It recognized phrases containing 12, 15, 18, or 24 words and patterns matching Ethereum and Solana private keys.

Jupiter, add-on ID 3092666, and Bitget, ID 3092059, used bundled stealers rather than remote loaders. Jupiter captured secrets during wallet imports and monitored page inputs and clipboard activity.

Bitget monitored page content, extension messages, and wallet storage as recovery phrases were decrypted. Their collection endpoints were jupiter[.]bonto[.]io and bitget[.]bonto[.]io.

Phantom’s package also contained the operator’s Node.js backend. Its code logged stolen secrets, forwarded them through Telegram, and included routines for moving funds across several blockchain networks.

A separate review server returned an inactive configuration. Comments described an “approval flip,” indicating the operator intended to enable the live payload after Mozilla’s review.

However, Socket emphasized that functional stealers already existed inside all three signed packages. Researchers also found provisioned Coinbase and Exodus subdomains under the same infrastructure, but did not locate corresponding Firefox listings.

The Phantom listing’s review count increased from 275 to 546 in roughly two days, while its average rating rose from 2.9 to 3.9. Socket identified this as rating manipulation. Reports of stolen funds in user reviews remained unverified.

Indicators of Compromise

Indicator	Type	Role / Context
bonto[.]io	Domain	Shared command-and-control and exfiltration infrastructure
phantom[.]bonto[.]io	Subdomain	Phantom payload delivery and stolen-data collection

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team 

The post Fake Firefox Crypto Wallet Extensions Hide Malware Inside Mozilla-Signed Add-on Packages appeared first on Cyber Security News.

The banking giant reminds customers that "you're responsible for activity" resulting from your AI agents' access.