Learn how the North Korean-aligned Famous Chollima is using the a new Python-based RAT, "PylangGhost," to target cryptocurrency and blockchain jobseekers in a campaign affecting users primarily in India.

Wednesday, June 18, 2025 06:00

*   In May 2025, Cisco Talos identified a Python-based remote access trojan (RAT) we call “PylangGhost,” used exclusively by a North Korean-aligned threat actor. PylangGhost is functionally similar to the previously documented GolangGhost RAT, sharing many of the same capabilities. 
*   In recent campaigns, the threat actor Famous Chollima — potentially made up of multiple groups — has been using a Python-based version of their trojan to target Windows systems, while continuing to deploy a Golang-based version for MacOS users. Linux users are not targeted in these latest campaigns. 
*   The attacks are targeting employees with experience in cryptocurrency and blockchain technologies. 
*   Based on open-source intelligence, only a small number of users, predominantly in India, are affected. Cisco product telemetry does not indicate that there are any affected Cisco users. 

Since mid-2024, the threat actor group Famous Chollima (aka Wagemole), a North Korean-aligned threat actor, has been very active through several well-documented campaigns. These campaigns include using variants of Contagious Interview (aka DeceptiveDevelopment) and creating fake job advertisements and skill-testing pages. In the latter, users are instructed to copy and paste (ClickFix) a malicious command line in order to install drivers necessary to conduct the final skill-testing stage.  

Toward the end of the year, researchers documented Famous Chollima’s remote access trojan (RAT) called “GolangGhost” in its source code format, which was frequently used as the final payload in the threat actor’s ClickFix campaigns. 

In May 2025, Cisco Talos discovered threat actors starting to deploy a functionally equivalent Python variant of GolangGhost trojan, which we call “PylangGhost.” 

**Fake job interview sites mislead users to PylangGhost infection **

Famous Chollima seek financial benefit using a two-pronged approach: first, by creating fake employers for the purpose of jobseekers exposing their personal information, and second by deploying fake employees as workers in targeted victim companies.  

This blog focuses on the first method, where real software engineers, marketing employees, designers and other workers are targeted by fake recruiters and instructed to visit skill-testing pages in order to move forward with their application. 

Based on the advertised positions, it is clear that the Famous Chollima is broadly targeting individuals with previous experience in cryptocurrency and blockchain technologies. The skill-testing sites attempt to impersonate real companies such as Coinbase, Archblock, Robinhood, Parallel Studios, Uniswap and others, which helps with the targeting.  

Figure 1. Examples of initial fake job sites.

Each target is sent an invite code to visit a testing website where, depending on the position, they are instructed to enter their details and answer several questions to test their experience and skills. The sites are created using the React framework and have very similar visual designs, no matter the type of position.  

__Figure 2. Example of questions asked for an illegitimate Business Development Manager position at Robinhood.__

Once the user answers all the questions and provides personal details, the site displays an invitation to record a video for the interviewer, recommending that the user request camera access by pressing a button. 

__Figure 3. A camera setup page displayed once questions are answered.__

Finally, when the user requests camera, the site displays the instructions for the user to copy, paste and execute a command to allegedly install the required video drivers, if the OS is supported. When Talos used Windows and MacOS test systems, the instructions were shown as seen in Figure 4 and 5. The Linux test system led to another error message, without any instructions to download and install the payload.  

Figure 4. Windows instructions to copy, paste and execute a malicious command. 

Figure 5. MacOS instructions to copy, paste and execute a malicious command. 

Instructions for downloading the alleged fix are different based on the browser fingerprinting, and also given in appropriate shell language for the OS: PowerShell or Command Shell for Windows, and Bash for MacOS.

__Figure 6. Command Shell, PowerShell or Bash instructions to download a payload.__

**PylangGhost - Python variant of GolangGhost **

As the Golang variant of the RAT is already well-documented, this blog focuses on the Python version and the similarities between the two. The initial stage consists of a command line which the fake webpage tells the unsuspecting user to copy, paste and execute. 

The command line uses either PowerShell Invoke-Webrequest or curl to download a ZIP file containing the PylangGhost modules as well as Visual Basic Script file. This script is responsible for unzipping the Python library stored in the “lib.zip file” and launching the trojan by running a renamed Python interpreter using the file “nvidia.py” as the Python program to run. 

Figure 7. The first stage simply unzips a Python distribution library and launches the RAT. 

 PylangGhost consists of six well-structured Python modules. It is not clear to Talos why the threat actors decided to create two variants using a different programming language, or which was created first. Based on the comments in the code, it is unlikely that the threat actors used a large language model (LLM) to help rewrite the code for Python. One of the strings in the configuration module file (“config.py”) indicates that the Python version is 1.0, while the appropriate configuration variable in the Golang version indicates that the version is 2.0. However, Talos cannot definitively conclude that those two version numbers are comparable. 

 The execution starts with the file “nvidia.py”, which performs several tasks: It creates a registry value to launch the RAT every time user logs onto the system, generates a GUID for the system to be used in communication with command and control (C2) server, connects to the C2 server and enters the command loop for communication with the server.  

__Figure 8. ”nvidia.py” executes the main loop for communication with the C2 server__

 The configuration file “config.py” specifies the commands that can be received from the server, which are identical to the commands previously documented in the Golang version of the RAT. These commands enable remote control the infected system and the theft of cookies and credentials from over 80 browser extensions, including password managers and cryptocurrency wallets, including Metamask, 1Password, NordPass, Phantom, Bitski, Initia, TronLink and MultiverseX. 

The command handling module, “command.py”, defines function handlers and handles the commands received from the C2 server.  

Command 

Functionality 

qwer 

COMMAND\_INFORMATION - collect information about the infected system, username, OS version etc 

asdf 

COMMAND\_FILE\_UPLOAD - file upload 

zxcv 

COMMAND\_FILE\_DOWNLOAD - file download 

vbcx 

COMMAND\_OS\_SHELL - launch an OS shell for remote access and control of the infected system 

ghdj 

COMMAND\_WAIT - sleep for a number of seconds specified by the C2 server 

r4ys 

COMMAND\_AUTO - browser information stealing command 

89io 

AUTO\_CHROME\_GATHER\_COMMAND - subcommand of the browser information stealer command 

gi%# 

AUTO\_CHROME\_COOKIE\_COMMAND - subcommand of the browser information stealer command 

dghh 

COMMAND\_EXIT 

_Table 1. Commands and functionalities._

The module “auto.py” contains the functionality for stealing the stored browser credentials and session cookies, as well as collecting data from various browser extensions.  

“Api.py” is responsible for implementing the communications protocol with the C2 server, using RC4 encryption to encrypt packets over otherwise unencrypted HTTP used while communicating with the C2 server. The data in a HTTP packet is encrypted with RC4 algorithm, but the encryption key is also sent within the packet structure. The packet begins with 16 bytes of MD5 checksum for the rest of the packet, for verification of data integrity, followed by 128 bytes containing the RC4 encryption key, followed by an encrypted data blob.  

Finally, “util.py” handles the compression and decompression of files. 

**Comparison of Python and Golang modules **

To assess the similarity between the two versions, Talos compares the names of the modules written in different languages as well as their functionality. The structure, the naming conventions and the function names are very similar, which indicates that the developers of the different versions either worked closely together or are the same person.   

Module 

Python name 

Golang name 

Main function module 

nvidia.py 

cloudfixer.go 

Configuration module 

config.py 

config/constans.go 

Main command loop 

nvidia.py 

core/loop.go 

Command handlers 

command.py 

core/loop.go 

Browser Stealer functionality 

auto.py 

auto/\* modules 

File compression 

util.py 

util/compress.go 

Base64 message encoding 

command.py 

command/stackcmd.go 

Duplicate process check 

nvidia.py 

instance/check.go 

Communications protocol 

api.py 

transport/htxp.go 

_Table 2. Comparison of Python and Golang RAT module names._ 

**Coverage  **

Ways our customers can detect and block this threat are listed below.  

Cisco Secure Endpoint (formerly AMP for Endpoints) is ideally suited to prevent the execution of the malware detailed in this post. Try Secure Endpoint for free here.  

Cisco Secure Email (formerly Cisco Email Security) can block malicious emails sent by threat actors as part of their campaign. You can try Secure Email for free here.  

Cisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.  

Cisco Secure Network/Cloud Analytics (Stealthwatch/Stealthwatch Cloud) analyzes network traffic automatically and alerts users of potentially unwanted activity on every connected device.  

Cisco Secure Malware Analytics (Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products.  

Cisco Secure Access is a modern cloud-delivered Security Service Edge (SSE) built on Zero Trust principles.  Secure Access provides seamless transparent and secure access to the internet, cloud services or private application no matter where your users work.  Please contact your Cisco account representative or authorized partner if you are interested in a free trial of Cisco Secure Access.  

Umbrella, Cisco’s secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs and URLs, whether users are on or off the corporate network.   

Cisco Secure Web Appliance (formerly Web Security Appliance) automatically blocks potentially dangerous sites and tests suspicious sites before users access them.   

Additional protections with context to your specific environment and threat data are available from the Firewall Management Center.  

Cisco Duo provides multi-factor authentication for users to ensure only those authorized are accessing your network.   

Open-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.  

ClamAV detections available for this threat:

Win.Backdoor.PyChollima-10045389-0
Win.Backdoor.PyChollima-10045388-0
Win.Backdoor.PyChollima-10045387-0
Win.Backdoor.PyChollima-10045386-0
Win.Backdoor.PyChollima-10045385-0
Win.Backdoor.PyChollima-10045384-0

**IOCs **

The IOCs can also be found in our GitHub repository here.

**SHA256 **

a206ea9b415a0eafd731b4eec762a5b5e8df8d9007e93046029d83316989790a - auto.py  
c2137cd870de0af6662f56c97d27b86004f47b866ab27190a97bde7518a9ac1b - auto.py  
0d14960395a9d396d413c2160570116e835f8b3200033a0e4e150f5e50b68bec - api.py 
8ead05bb10e6ab0627fcb3dd5baa59cdaab79aa3522a38dad0b7f1bc0dada10a - api.py 
5273d68b3aef1f5ebf420b91d66a064e34c4d3495332fd492fecb7ef4b19624e - nvidia.py 
267009d555f59e9bf5d82be8a046427f04a16d15c63d9c7ecca749b11d8c8fc3 - nvidia.py 
7ac3ffb78ae1d2d9b5d3d336d2a2409bd8f2f15f5fb371a1337dd487bd471e32 - nvidia.py 
b7ab674c5ce421d9233577806343fc95602ba5385aa4624b42ebd3af6e97d3e5 - util.py 
fb5362c4540a3cbff8cb1c678c00cc39801dc38151edc4a953e66ade3e069225 - util.py 
d029be4142fca334af8fe0f5f467a0e0e1c89d3b881833ee53c1e804dc912cfd - command.py 
b8402db19371db55eebea08cf1c1af984c3786d03ff7eae954de98a5c1186cee - command.py 
1f482ce7e736a8541cc16e3e80c7890d13fb1f561ae38215a98a75dce1333cee - config.py 
ed170975e3fd03440360628f447110e016f176a44f951fcf6bc8cdb47fbd8e0e - config.py 
929c69827cd2b03e7b03f9a53c08268ab37c29ac4bd1b23425f66a62ad74a13b - config.py 
127406b838228c39b368faa9d6903e7e712105b5ad8f43a987a99f7b10c29780 - config.py 
0ec9d355f482a292990055a9074fdabdb75d72630b920a61bdf387f2826f5385 - update.vbs 
c2d2320ae43aaa0798cbcec163a0265cba511f8d42d90d45cd49a43fe1c40be6 - update.vbs 
e7c2b524f5cb0761a973accc9a4163294d678f5ce6aca73a94d4e106f4c8fea4 - nvidiaRelease.zip 
28198494f0ed5033085615a57573e3d748af19e4bd6ea215893ebeacf6e576df - vdriverWin.zip 
fc71a1df2bb4ac2a1cc3f306c3bdf0d754b9fab6d1ac78e4eceba5c6e7aee85d - nvidiaRelease.zip 
d3500266325555c9e777a4c585afc05dfd73b4cbe9dba741c5876593b78059fd - nvidiaRelease.zip 

**C2 servers **

hxxp\[://\]31\[.\]57\[.\]243\[.\]29:8080 
hxxp\[://\]154\[.\]58\[.\]204\[.\]15:8080 
hxxp\[://\]212\[.\]81\[.\]47\[.\]217:8080 
hxxp\[://\] 31\[.\]57\[.\]243\[.\]190:8080

**Download host names **

api\[.\]quickcamfix\[.\]online   
api\[.\]auto-fixer\[.\]online   
api\[.\]quickdriverupdate\[.\]online   
api\[.\]camtuneup\[.\]online   
api\[.\]driversofthub\[.\]online   
api\[.\]drive-release\[.\]cloud   
api\[.\]vcamfixer\[.\]online   
api\[.\]nvidia-drive\[.\]cloud   
api\[.\]nvidia-release\[.\]us   
api\[.\]autodriverfix\[.\]online   
api\[.\]camdriversupport\[.\]com   
api\[.\]smartdriverfix\[.\]cloud   
api\[.\]drivercams\[.\]cloud   
api\[.\]camtechdrivers\[.\]com   
api\[.\]web-cam\[.\]cloud   
api\[.\]camera-drive\[.\]org   
api\[.\]nvidia-release\[.\]org 
api\[.\]fixdiskpro\[.\]online 
api\[.\]autocamfixer\[.\]online

**Fake job interview host names **

krakenhire\[.\]com  
yuga\[.\]skillquestions\[.\]com  
uniswap\[.\]speakure\[.\]com  
doodles\[.\]skillquestions\[.\]com  
www\[.\]hireviavideo\[.\]com  
kraken\[.\]livehiringpro\[.\]com  
quiz-nest\[.\]com  
www\[.\]smartvideohire\[.\]com  
www\[.\]talent-hiringstep\[.\]com  
provevidskillcheck\[.\]com  
skill\[.\]vidintermaster\[.\]com  
digitaltalent\[.\]review  
robinhood\[.\]ecareerscan\[.\]com  
evalswift\[.\]com  
livetalentpro\[.\]com  
quantumnodespro\[.\]com  
evalassesso\[.\]com  
parallel\[.\]eskillora\[.\]com  
coinbase\[.\]talentmonitoringtool\[.\]com  
uniswap\[.\]testforhire\[.\]com  
coinbase\[.\]talenthiringtool\[.\]com  
crosstheages\[.\]skillence360\[.\]com 
parallel \[.\] eskillprov \[.\] com 
assesstrack \[.\] com 
coinbase \[.\] talentmonitoringtool \[.\] com 
talent-hiringtalk\[.\]com 
uniswap\[.\]prehireiq\[.\]com 
fast-video-recording\[.\]com

Famous Chollima deploying Python version of GolangGhost RAT

A former U.S. Central Intelligence Agency (CIA) analyst has been sentenced to little more than three years in prison for unlawfully retaining and transmitting top secret National Defense Information (NDI) to people who were not entitled to receive them and for attempting to cover up the malicious activity.
Asif William Rahman, 34, of Vienna, has been sentenced today to 37 months on charges of

Ex-CIA Analyst Sentenced to 37 Months for Leaking Top Secret National Defense Documents

Scattered Spider targets US insurance firms after UK retail attacks, using social engineering to breach help desks and disrupt services, Google warns.

A hacker group known for high-profile attacks on retail giants is now turning its attention to the insurance sector, according to a new warning from Google’s Threat Intelligence Group. The group, known as **Scattered Spider**, has been linked to a series of recent cyber attacks that disrupted access for insurance customers across the United States.

The alert follows a series of data breaches at major UK retailers earlier this year. After that wave of attacks, Google analysts noted that Scattered Spider had begun targeting US-based retailers. Now, researchers say the group is showing a clear interest in insurance firms and is actively exploiting their workforce through **social engineering**.

****Focused Targeting, Familiar Tactics****

“Actors that bear the hallmarks of Scattered Spider are now targeting the insurance industry, they have a habit of working their way through a sector,” said John Hultquist, chief analyst at Google’s Threat Intelligence Group. In a **post** on X, he noted that Scattered Spider relies heavily on social engineering, especially schemes aimed at help desks and call centers.

> Actors that bear the hallmarks of Scattered Spider are now targeting the insurance industry. They have a habit of working their way through a sector. Insurance companies should be on the lookout for social engineering schemes targeting their call centers.
> 
> — John Hultquist (@JohnHultquist) June 16, 2025

The tactic isn’t new, but it remains effective. Rather than relying on complex exploits or malware, the group frequently poses as employees or contractors to convince staff to reset passwords or share sensitive access credentials. This approach gives attackers a way in, without having to breach security

****Erie Insurance and Scania Affected****

While Google hasn’t publicly named the companies affected in this latest wave of attacks, Erie Insurance, a Pennsylvania-based provider, **reported** a breach on June 7. The company has not confirmed who was behind it, but the timing aligns with Google’s warning. Erie has been issuing updates to customers but has yet to share details about the full extent of the intrusion.

Meanwhile, Scania’s insurance division was also reportedly affected, adding weight to concerns that the group’s focus on insurers is well underway.

> 🚨Data Breach Alert‼️
> 
> 🇸🇪Sweden – Scania Financial Services
> 
> A threat actor using the alias "hensi" claims to have breached the subdomain insurance.scaniacom, allegedly gaining access to and exfiltrating a full set of files.
> 
> The actor states this is a first-time intrusion… pic.twitter.com/aPP09wSjhB
> 
> — Hackmanac (@H4ckmanac) June 12, 2025

****Expert View: Social Engineering Remains a Core Threat****

**Dave Gerry,** CEO at Bugcrowd, says the recent activity highlights long-standing risks in the way companies handle internal support systems.

“They’ve been exploiting vulnerabilities with social engineering tactics, focusing on help desks and call centers, where the human is oftentimes the weakest link,” Gerry said. “Incidents like the one at Erie Insurance show how important it is for the insurance sector to revisit its defenses and incident response strategies. These aren’t one-off events. This is targeted, and it’s ongoing.”

****Why Insurers?****

Insurers hold sensitive financial and personal data, a tempting target for attackers. But what makes them especially vulnerable is the combination of high-value information and complex customer support systems, which often require staff to handle urgent access requests or account changes.

When threat actors can impersonate staff or customers convincingly enough, help desk employees may unknowingly hand over access to internal tools or user accounts.

Organizations should review how support teams verify identity and manage account access. Multi-step verification, better training, and limiting permissions can help reduce the risk of a successful social engineering attack.

Scattered Spider Aims at US Insurers After UK Retail Hit, Google Warns

Consider this: Berkshire Hathaway, Warren Buffett’s $700 billion conglomerate, operates one of the most influential investor websites on…

Consider this: Berkshire Hathaway, Warren Buffett’s $700 billion conglomerate, operates one of the most influential investor websites on the planet, utilizing HTML that predates YouTube, employing table-based layouts and single-color backgrounds that Buffett personally insists on keeping “simple.”

Craigslist processes over 2 billion page views monthly through an interface that hasn’t changed since 2000, deliberately rejecting modern design because founder Craig Newmark believes complexity reduces functionality. Meanwhile, IRS.gov receives 1.4 billion visits annually during tax season through a navigation system so convoluted that TurboTax built a $3 billion business simply by making tax filing less painful.

Healthcare.gov’s initial launch disaster in 2013, where a $400 million website could handle only six users simultaneously, still echoes in government procurement today. The UK’s Gov.uk, conversely, became a global model by ruthlessly prioritizing user needs over departmental politics, saving an estimated £4.1 billion annually through better digital design.

These contrasts reveal a fundamental truth: interface design isn’t cosmetic, it’s economic infrastructure that can make or break trillion-dollar markets.

The Rapid Rebuild Hackathon 2025, organized by Hackathon Raptors, challenged developers to tackle exactly these kinds of functional but frustrating digital experiences. Over 72 hours, twelve teams transformed everything from Berkshire Hathaway’s deliberately minimalist investor portal to revolutionary reimaginings of system-level BIOS interfaces, proving that sometimes the most impactful innovation comes not from building something new, but from fixing what already works, just barely.

****The Art of Digital Resurrection****

“The most impactful solutions don’t always come from building something entirely new,” explains the hackathon’s core philosophy. “Sometimes breakthrough innovation emerges from reimagining what already exists, using modern tools to transform crucial but neglected digital spaces.”

This approach proved prescient when examining the winning submissions. BIOSage, the grand prize winner, didn’t just modernize a website, it completely reimagined how users interact with system-level interfaces. The project integrated a locally hosted LLaMA 3.2 language model to provide offline diagnostics, transforming the traditionally static BIOS experience into an intelligent, multilingual system assistant.

“What sets BIOSage apart is its recognition that even the most fundamental computing interfaces can benefit from modern AI integration,” notes Anand Singh, Technical Lead at Meta and hackathon judge.

Singh’s extensive background in embedded systems and wireless communications, including work on OpenRAN and high-altitude platform systems, provided a unique perspective on the technical challenges of bringing AI to firmware-level interfaces.

Singh’s experience with low-power IoT networks and embedded optimization proved particularly relevant when evaluating BIOSage’s achievement in running complex language models locally without compromising system performance.

“The ability to provide intelligent diagnostics without internet connectivity addresses a critical gap in system administration,” he observed. “This isn’t just a UI improvement, it’s a fundamental advancement in how we approach system-level troubleshooting.”

****Quality Assurance in Rapid Development****

The compressed 72-hour timeline presented unique challenges for maintaining code quality while pushing innovation boundaries. This tension between speed and reliability became a crucial evaluation criterion, drawing heavily on the expertise of Yulia Drogunova, Senior QA Engineer at Raiffeisen Bank.

With over eight years of experience building effective testing processes for major financial institutions, including Raiffeisen Bank and VTB Bank, and her work with international companies such as Luxoft and Lineate, Drogunova brought a critical perspective to evaluating how teams managed quality under extreme time pressure.

“The most impressive projects weren’t just those with flashy features,” Drogunova explained during the evaluation process. “They were the ones that implemented proper testing methodologies even within hackathon constraints.”

Her experience implementing automated tests into CI/CD processes, which has increased development speed and reduced defects in production banking applications, informed her assessment of how teams structured their rapid development cycles.

Drogunova particularly highlighted the Smart Builders team’s approach to their Hacker News reimagining. “They demonstrated an understanding that accessibility testing isn’t an afterthought, it’s integral to the development process,” she noted, referencing their implementation of voice reader capabilities and keyboard navigation. This aligned with her experience in ensuring mobile banking applications meet accessibility standards across diverse user needs.

The winning projects consistently showed evidence of systematic testing approaches. Refreshify, the second-place winner, implemented comprehensive error handling for its AI-powered website transformation engine.

“Sanjay Sah’s team understood that when you’re processing arbitrary URLs and generating real-time previews, robust error handling isn’t optional,” Drogunova observed. Her background in both manual and automated testing for web-based applications informed her appreciation for the defensive programming techniques employed.

****Frontend Architecture Under Pressure****

The hackathon’s focus on user experience transformation highlighted the critical role of frontend architecture in delivering compelling user interfaces rapidly. Vladislav Krushenitskii, a senior front-end developer with over a decade of experience spanning complex management systems and international client projects, evaluated how teams leveraged modern frameworks to achieve maximum impact in the shortest time possible.

Krushenitskii’s background with the Russian Hack Team, a network of 30 elite developers known for exceptional hackathon performance, provided valuable context for assessing rapid development strategies. His experience implementing micro-frontend architectures at EPAM Systems and reducing page load times by 30% through optimized React and Redux implementations informed his evaluation criteria.

“The most successful teams understood that hackathon development isn’t about shortcuts, it’s about intelligent architectural decisions,” Krushenitskii explained. His assessment focused particularly on how teams balanced feature richness with maintainable code structure.

The Delbyte team’s BetterShire Hathaway project caught his attention for its thoughtful component architecture. “They implemented a modular design system that could scale beyond the hackathon scope,” he noted, drawing parallels to his work developing sophisticated management systems with complex components like dynamic trees and filters. “The subsidiary showcase section demonstrated an advanced understanding of data presentation patterns that I’ve seen take weeks to perfect in commercial projects.”

Krushenitskii’s experience with React Native and cross-platform development proved relevant when evaluating mobile-first approaches. Several teams, including the WhaleMatch redesign, implemented responsive design patterns that he recognized from his work on cinema and startup interfaces for clients in the USA and Norway.

“The teams that truly understood modern web development didn’t just make things look better, they fundamentally improved how information flows through the interface,” he observed.

****The Innovation Spectrum: From Extensions to Complete Rebuilds****

The diversity of technical approaches reflected different philosophies about innovation and user experience improvement. Projects ranged from browser extensions enhancing existing platforms to complete ground-up rebuilds, each presenting unique technical challenges and user experience opportunities.

The ReStyle Chrome extension demonstrated how targeted interventions could transform user experiences without requiring comprehensive platform rebuilds. BuildWithKT.dev’s approach to enhancing Stack Overflow’s interface through real-time theme customization showed a sophisticated understanding of browser extension architecture while addressing genuine usability concerns.

At the opposite end of the spectrum, Level One’s Battle City Remastered represented a complete reconstruction of a classic gaming experience using pure Python and Pygame. The technical achievement of recreating complex game mechanics in just 72 hours showcased the team’s deep understanding of game development principles and efficient coding practices.

****Lessons in Scalable Innovation****

The hackathon results revealed consistent patterns among successful projects that extend beyond hackathon contexts into broader software development practices. Teams that achieved top rankings demonstrated several key characteristics that align with industry best practices for rapid innovation.

**Constraint-Driven Creativity**: The most innovative solutions emerged from teams that embraced technical limitations as creative catalysts rather than obstacles. BIOSage’s offline AI diagnostics capability, for instance, turned the constraint of no internet connectivity into a competitive advantage for system administration scenarios.

**User-Centered Problem Solving**: Winning teams consistently prioritized genuine user pain points over technical showcasing. The multiple Hacker News reimaginings each addressed specific usability issues, such as navigation complexity, information density, and accessibility barriers, rather than simply applying modern styling to existing interfaces.

**Architectural Thinking**: Even within hackathon timelines, successful teams implemented architectural patterns that could support future development. This forward-thinking approach distinguished projects with genuine commercial potential from purely demonstrative implementations.

****The Future of Digital Modernization****

The Rapid Rebuild concept addresses a pressing industry need as organizations struggle with legacy systems that serve critical functions, despite their outdated interfaces. The hackathon’s results suggest several emerging trends in how developers approach modernization challenges.

AI integration emerged as a transformative factor, with multiple projects incorporating intelligent features to enhance user experiences. Beyond BIOSage’s diagnostic capabilities, projects like HackerNews-Revamped integrated AI chatbots could discuss articles from the content’s perspective, demonstrating how artificial intelligence can add contextual value to information consumption.

Accessibility considerations became central rather than peripheral to design decisions. Teams consistently implemented features like voice navigation, customizable themes, and keyboard shortcuts as core functionality rather than afterthoughts. This shift reflects growing industry recognition that inclusive design benefits all users while expanding market reach.

The hybrid approach of extension-based enhancements alongside complete rebuilds suggests a pragmatic evolution in how organizations might approach legacy system modernization. Rather than requiring wholesale replacement, targeted improvements through browser extensions or API layers can provide immediate benefits to the user experience while maintaining the underlying system’s stability.

****Implications for Industry Practice****

The 72-hour timeframe compressed typical development cycles while maintaining quality standards, offering insights into rapid innovation methodologies. The most successful teams implemented practices that mirror emerging industry trends toward accelerated development cycles and continuous improvement.

Cross-disciplinary collaboration proved essential, with winning teams effectively combining frontend development, backend architecture, user experience design, and domain expertise. This integration reflects the industry movement toward full-stack competency and collaborative development practices.

The emphasis on immediate usability over feature completeness aligns with lean development principles and minimum viable product approaches. Teams that focused on solving specific user problems comprehensively outperformed those attempting to recreate entire feature sets superficially.

****Looking Forward****

The Rapid Rebuild Hackathon 2025 demonstrated that innovation often emerges not from creating entirely new solutions but from applying fresh perspectives and modern tools to existing challenges. As the digital landscape continues evolving, the ability to thoughtfully modernize legacy systems while preserving their essential value becomes increasingly critical.

The projects showcased techniques and approaches that extend far beyond hackathon contexts, offering roadmaps for organizations seeking to modernize user experiences without abandoning functional infrastructure. From AI-enhanced system interfaces to accessibility-first redesigns, the innovations demonstrated paths forward for digital transformation that prioritize user needs while respecting technical constraints.

The success of diverse approaches, from targeted browser extensions to complete system rebuilds, suggests that digital modernization isn’t a one-size-fits-all challenge. Instead, it requires careful assessment of user needs, technical constraints, and organizational capabilities to determine the most effective intervention strategy.

Most importantly, the hackathon reinforced that exceptional user experiences don’t require revolutionary technology, they require thoughtful application of existing tools, a deep understanding of user needs, and the courage to reimagine how digital interfaces can better serve their intended purposes. In an era of rapid technological change, the ability to bridge legacy functionality with modern expectations may prove more valuable than any individual technical skill.

Rapid Rebuild Hackathon 2025: When Legacy Meets Innovation

The notorious cybercrime group known as Scattered Spider (aka UNC3944) that recently targeted various U.K. and U.S. retailers has begun to target major insurance companies, according to Google Threat Intelligence Group (GTIG).
"Google Threat Intelligence Group is now aware of multiple intrusions in the U.S. which bear all the hallmarks of Scattered Spider activity," John Hultquist, chief analyst

Google Warns of Scattered Spider Attacks Targeting IT Support Teams at U.S. Insurance Firms

Reddit has announced more AI-powered tools to help advertisers. But do users care for it?

Reddit has introduced two Artificial Intelligence (AI) tools which will use Reddit comments, posts, and conversations to help sellers make the most of the community.

Reddit is a social media platform and online forum where users can share and discuss content across a wide range of topics. The platform’s structure divides it into communities known as “subreddits,” each focused on a specific subject or interest (from cars to movies to sports to knitting).

There are also promoted posts, which look like regular Reddit posts but are marked as sponsored. They can include text, images, videos, or carousels and often appear in users’ feeds or within specific subreddits. Due to its size, Reddit has evolved into a major digital platform for both advertising and AI-powered data analysis.

Reddit introduced its “Reddit Community Intelligence” at the Cannes Lions International Festival of Creativity 2025. It described this new addition as the collective knowledge of billions of conversations to help businesses and organizations make “smarter marketing decisions.”

Last year, Reddit launched AI-powered advertising such as an ads inspiration library, AI copywriter, and image auto-cropper to help small businesses create more effective, platform-specific ads.

The new tools, dubbed “Reddit Insights” and “Conversation Summary Add-ons” use AI to analyze conversations, summarize sentiment, and surface relevant user-generated content for advertisers.

Last year, the FTC advised Reddit that it would conduct a non-public inquiry focused on Reddit’s sale, licensing, or sharing of user-generated content with third parties to train AI models. This was before Reddit announced a partnership with OpenAI to bring Reddit content to ChatGPT.

When the FTC launched a Request for Information (RFI) to better understand how technology platforms deny or degrade users’ access to services based on the content of their speech or affiliations, and how this conduct may have violated the law, without specifically mentioning Reddit, the company saw a 9% drop in stock price.

The new tools will undoubtedly fuel the ongoing debates about the ethics of AI-driven analysis on Reddit, especially regarding user consent and the potential for privacy breaches.

In April, users of the r/ChangeMyView subreddit expressed outrage at the revelation that researchers at the University of Zurich were secretly using the site for an AI-powered experiment in persuasion, prompting the moderation team to explain that the experiment was conducted without authorization.

Given the open nature of Reddit it’s important to keep in mind that anything you post can be found by anyone and everything, including AI. So, it’s important to hold yourself to the same standards you may use when posting on social media.

On June 28, 2025 a new Privacy Policy will go into effect. It stands to reason that you should be aware of the current policy and keep up with any changes.

A few general rules to help improve your privacy on the platform:

*   Anonymity: there is no reason to use your real name or any identifying information in your username or profile. Don’t share personal details like your location, workplace, or other identifiers in posts or comments unless they are relevant to the post.
*   Don’t link to other social media profiles in your profile or posts. Also don’t link your account to your Google or Apple account.
*   If you’re active in several Reddit communities, consider creating separate accounts for different interests or sensitive topics.
*   In your Reddit account settings, under Privacy you can turn off “Show up in search results” to prevent your posts and comments from being indexed by search engines or easily browsed by others.
*   You can also disable “Personalize ads on Reddit based on information and activity from our partners.”
*   Protect your account using a unique, complex password and enable two-factor authentication (2FA) for your Reddit account.
*   Regularly check your account activity for unauthorized access and report anything suspicious.

**We don’t just report on threats – we help protect your social media**

Cybersecurity risks should never spread beyond a headline. Protect your social media accounts by using Malwarebytes Identity Theft Protection.

 Reddit&#8217;s new AI-powered tools scan your posts to serve you better ads 

The shooter allegedly researched several “people search” sites in an attempt to target his victims, highlighting the potential dangers of widely available personal data.

The man who allegedly assassinated a Democratic Minnesota state representative, murdered her husband, and shot a state senator and his wife at their homes in a violent spree early Saturday morning may have gotten their addresses or other personal details from online data broker services, according to court documents.

Suspect Vance Boelter, 57, is accused of shooting Minnesota representative Melissa Hortman and her husband, Mark Hortman, in their home on Saturday. The couple died from their injuries. Authorities claim the suspect also shot state senator John Hoffman and his wife Yvette Hoffman in their home earlier that night. The pair are currently recovering and are “incredibly lucky to be alive,” according to a statement from their family.

According to an FBI affidavit, police searched the SUV believed to be the suspect's and found notebooks that included handwritten lists of “more than 45 Minnesota state and federal public officials, including Representative Hortman’s, whose home address was written next to her name.” According to the same affidavit, one notebook also listed 11 mainstream search platforms for finding people's home addresses and other personal information, like phone numbers and relatives.

The addresses for both lawmakers targeted on Saturday were readily available. Representative Hortman's campaign website listed her home address, while Senator Hoffman's appeared on his legislative webpage, The New York Times reports.

“Boelter stalked his victims like prey,” acting US attorney Joseph Thompson alleged at a press conference on Monday. “He researched his victims and their families. He used the internet and other tools to find their addresses and names, the names of their family members.” Thompson also alleged that the suspect surveilled victims' homes.

The suspect faces several charges of second-degree murder.

Privacy and public safety advocates have long argued that the US should regulate data brokers to guarantee that people have better control over the sensitive information available about them. The US has no comprehensive data privacy legislation, and efforts to regulate data brokers from within federal agencies have largely been quashed.

“The accused Minneapolis assassin allegedly used data brokers as a key part of his plot to track down and murder Democratic lawmakers,” Ron Wyden, the US senator from Oregon, tells WIRED. “Congress doesn't need any more proof that people are being killed based on data for sale to anyone with a credit card. Every single American's safety is at risk until Congress cracks down on this sleazy industry.”

In many cases, basic information like home addresses can be found through public records, including voter registration data (which is public in some states) and political donations data, says Gary Warner, a longtime digital scams researcher and director of intelligence at the cybersecurity firm DarkTower. Anything that isn't readily available through public records is almost always easy to find using popular “people search” services.

“Finding a home address, especially if someone has lived in the same place for many years is trivial,” Warner says. He adds that for “younger people, non-homeowners, and less political people, there are other favorite sites” for finding personal information.

For many in the general public as well as in politics, Saturday's violent crime spree brings new urgency to the long-standing question of how to protect sensitive personal data online.

“These are not the first murders that have been abetted by the data broker industry. But most of the previous targets were relatively unknown victims of stalking and abuse,” alleges Evan Greer, deputy director of the digital rights group Fight for the Future. “Lawmakers need to act before they have more blood on their hands.”

Minnesota Shooting Suspect Allegedly Used Data Broker Sites to Find Targets’ Addresses

New research by Infoblox Threat Intel exposes a hidden alliance between major cybercrime groups like VexTrio and seemingly…

New research by Infoblox Threat Intel exposes a hidden alliance between major cybercrime groups like VexTrio and seemingly legitimate AdTech firms such as Los Pollos, Partners House, BroPush, and RichAds. Discover how malware, including DollyWay, shifted operations, revealing shared infrastructure and tactics.

Infoblox Threat Intel has exposed a secret alliance between two cybercrime groups, VexTrio and seemingly legitimate AdTech companies. This discovery came after disrupting VexTrio, causing many malware groups to shift to a single, previously hidden provider.

The investigation began by disrupting VexTrio’s Traffic Distribution System (TDS). A TDS acts like a digital traffic controller, directing website visitors to the content. However, a malicious TDS sends users to harmful sites with malware or scams, often by “cloaking” or hiding its true nature. When VexTrio’s TDS was disturbed, malware actors unexpectedly moved to what appeared to be a new TDS, but it was the same one.

On November 13, 2024, Qurium researchers revealed that Los Pollos, a Swiss-Czech AdTech company, was part of VexTrio. This was discovered when Russia’s Doppelganger group used Los Pollos’ “smartlinks” (links malware operators use to send traffic to a malicious AdTech TDS, leading people to fake apps or scams). Infoblox and Qurium then collaborated, sharing information with other security groups.

Source: Infoblox

****The Domino Effect and a New Player****

On November 17, Los Pollos stopped its push link monetization, causing immediate changes across hacked websites. By November 20, 2024, malware like DollyWay, which previously used VexTrio and had been exploiting WordPress vulnerabilities for eight years, switched to the Help TDS.

Other major malware campaigns, including Balada and Sign1, as identified by GoDaddy, also shifted or ceased operations. GoDaddy’s 2024 report indicated that almost 40% of compromised sites redirected visitors via VexTrio through Los Pollos.

The role of affiliate networks in malicious Adtech (Source: Infoblox)

Further checks confirmed Help TDS was not new, but had been tied to VexTrio for years. Researchers found that Help TDS and Disposable TDS were the same, sharing a special relationship with VexTrio until November 2024.

Analysis of 4.5 million DNS TXT record responses showed malware using DNS TXT records for command and control (C2) also switched to Help TDS. These C2 servers, despite different setups, all led to VexTrio before the change, and then to Help TDS.

****The Hidden Links****

The investigation found many TDSs shared software and web address patterns with VexTrio, suggesting a common origin. While the Help TDS owner is unknown, commercial AdTech companies like Partners House, BroPush, and RichAds operate common TDSs, many with Russian ties, though no common ownership was found.

Malware operators’ reliance on commercial AdTech could be their downfall, as these companies hold personal and payment information that could identify criminals. The consistent use of shared code, trick images, and web address patterns by VexTrio, Help, and Disposable TDSs, plus specific JavaScript hindering user navigation, points to a deeply coordinated operation.

Six TDSs, including VexTrio, Partners House, and RichAds, use identical lure images, often named simply “1.png,” “2.png,” etc., to trick users into allowing malicious push notifications. These networks, run by large public affiliate networks specializing in push advertising, also use PowerDNS, suggesting shared infrastructure.

These findings go on to show that cybercrime sophistication is growing, making it difficult to differentiate between legitimate and malicious operations. However, continuous research and collaboration between security firms can be important for protecting online users from such scams.

Report Links Los Pollos and RichAds to Malware Traffic Operations

The White House has undertaken initiatives to crack down on immigration, suppress speech, and curtail US public health efforts. These online tools are tracking the rapidly changing US landscape.

In just a few months, Donald Trump’s second presidential term has drastically reshaped the United States federal government and moved to consolidate the power of the executive branch. At the behest of the president, numerous federal agencies have undertaken aggressive, invasive initiatives to crack down on immigration, police speech, investigate political opponents, curtail US public health efforts and emergency preparedness, and more.

With so much happening at once, numerous organizations and individuals have launched databases, interactive maps, and other trackers to catalog these government actions and their impacts on people’s civil rights across the US. Using open source intelligence, public data, news coverage, and other research, these tools are vital resources for documenting, contextualizing, and analyzing the flood of federal activity that is fundamentally reshaping the US. Here are a few prominent examples.

**The Impact Map**

**by The Impact Project, Americans for Public Service**

This interactive map tracks changes to US federal government funding, workforce, and policy across the country, documenting things like mass worker firings, hiring freezes, funding cuts, and lease terminations. The tool also shows places where funding has subsequently been unfrozen, federal workers have been rehired or may be, or the federal government has added a new service or benefit.

The map includes notations to specifically document impacts in rural US counties, areas in which the population is majority non-white, places where 20 percent or more of the population live below the poverty line, and indigenous lands. It also catalogs responses to these initiatives, including legal actions as well as local and state responses to funding cuts.

**United States Disappeared Tracker**

**by Danielle Harlow, data analyst**

This dashboard tallies the number of people impacted by the Trump administration’s mass deportations carried out by US Immigration and Customs Enforcement (ICE). The number is already over 4,000. The tool also monitors the status of each individual to the degree that information is available, noting their names, original country of origin, and where they are being detained, when available.

The tracker crucially follows each individual’s status, noting whether they are in ICE custody, have been released temporarily or permanently, have been deported, have “self-deported,” or have died in ICE custody. The tool also lists how many days their ordeal has continued.

**ICE Flight Tracking**

**by Tom Cartwright, immigration rights advocate**

Tom Cartwright is a retired JP Morgan executive who uses flight monitoring data from around the country to track ICE Air deportation flights, return flights, and flights within the US. He posts regular, specific updates on his Bluesky social media page and produces monthly reports for the immigration rights group Witness at the Border about ICE Air flights and tallies. In the past 12 months, Cartwright has collected data on roughly 8,000 ICE Air flights, including 824 in April. More than 1,500 of that 12-month total were “removal flights,” while about 1,400 were “removal return” flights. The other roughly 5,000 trips were “ICE Air domestic flights” within the US.

**Regulatory Changes Tracker**

**by The Brookings Institution**

The think tank Brookings has built a database cataloging significant regulatory changes implemented since the start of the second Trump administration. It includes new executive orders and regulatory freezes as well as Trump administration changes to executive orders that were issued by past administrations. For example, the White House rescinded a 2022 Biden executive order aimed at lowering the cost of prescription drugs and another from that year calling for research into cryptocurrency regulation.

**Trump Administration Litigation Trackers**

**by Just Security and Lawfare**

The law and policy publications Just Security and Lawfare each offer databases that track lawsuits challenging Trump administration initiatives. The tools include case names, docket numbers, and jurisdictions, as well as the executive action being challenged and the status of the litigation. In most cases, the Trump administration has pursued its agenda without congressional oversight or corresponding legislation, and a number of Trump administration efforts that have been challenged in court thus far have either been paused or permanently blocked from continuing.

**Far Right Groups Targeting Pride Month**

**by Teddy Wilson, Radical Reports**

Anti-LGBTQ+ groups, including fundamentalist Christian nationalists and white supremacist extremist groups, have targeted Pride Month events previously and are expected to again this June, particularly given the Trump administration’s violent rhetoric and executive actions related to trans rights. This map is tracking Pride Month events around the country and indications that radical opposition groups plan to target the gatherings.

6 Tools for Tracking the Trump Administration’s Attacks on Civil Liberties

Plus: Spyware is found on two Italian journalists’ phones, Ukraine claims to have hacked a Russian aircraft maker, police take down major infostealer infrastructure, and more.

With demonstrations ramping up against the Trump administration, this week was all about protests. With President Donald Trump taking the historic step to deploy US Marines and the National Guard to Los Angeles, we dove into the “long-term dangers” of sending troops to LA, as well as what those troops are permitted to do while they’re there.

Of course, it’s not just the military getting involved in the LA protests against the heavy crackdowns by Immigration and Customs Enforcement (ICE). There’s also Customs and Border Protection (CBP), which further escalated federal involvement by flying Predator drones over LA. And there are local and state authorities, who’ve used “nonlethal” weapons and chemical agents like tear gas against protesters. Even Waymo’s self-driving taxis—some of which were set on fire during last weekend’s LA protests—could be used to investigate people who commit crimes during demonstrations thanks to their surveillance capabilities.

In addition to protests, the undocumented community is pushing back against ICE’s enforcement activities by turning social media platforms into DIY alert systems for ICE raids and other activities. And with thousands of protests scheduled to take place this weekend, we updated our guide to protecting your privacy—in addition to your physical safety—while demonstrating.

Even if you’re not an immigrant nor attending any protests, it’s possible your data is still getting shared with immigration authorities. In partnership with WIRED, 404 Media this week revealed that a data broker owned by major airlines sold domestic US flight data to CBP and instructed the agency to not reveal that it did so. 404 also detailed a bug that allowed a researcher to discover the phone numbers connected to any Google accounts. (The bug has since been fixed.) Finally, we dissected Apple’s AI strategy, which appears to bank more on privacy than on splashy features.

And that’s not all. Each week, we round up the privacy and security news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

The Trump administration quietly ordered the transfer of Medicaid data belonging to undocumented individuals to deportation officials this week, according to the Associated Press, in a move legal experts warn is likely to erode public trust in the government's handling of personal data and result in a chilling effect among undocumented people desperate for medical care.

The transfer, which was reportedly ordered by Health and Human Services secretary Robert F. Kennedy Jr.'s office and included names, addresses, immigration status, and health claims, pertains to millions of enrollees, many in states that pay for the coverage using their own funds, the AP reports. The transfer may also be illegal, violating the Social Security Act and other data-handling statutes. According to the AP, Medicaid officials warned the administration that they did not have legal authority to disclose the records and that doing so would carry legal and reputation risks that could lead states to begin refusing to share information with the federal government, impacting the agency's operational functions.

California governor Gavin Newsom, whose state is occupied by undesired federal military forces and ICE agents conducting continuous sweeps across neighborhoods heavily populated by immigrants, condemned the act, calling it “potentially illegal.” An HHS official rejected the claim, saying the agency acted in full compliance with the law, while declining to clarify to reporters how the data would actually be used.

**2 Italian Journalists’ Phones Hacked With Paragon Spyware**

Move over, NSO Group. Two Italian journalists were hacked with spyware made by Israeli phone-focused surveillance firm Paragon, Citizen Lab revealed this week in a report based on forensic analyses of their phones. Two other Italians, both staffers at the immigrant rescue nonprofit Mediterranea Saving Humans, also had their phones compromised with the same malware. Paragon’s Graphite malware, like NSO’s Pegasus, infects phones with a zero-click technique that requires no interaction from the victim—in this case using a vulnerability in iPhones that was patched in iOS version 18.3 earlier this year. While Citizen Lab couldn’t determine the Paragon customer behind the intrusions, there’s reason to suspect the Italian government, given that an Italian parliamentary committee determined in a report earlier this month that two Italian intelligence agencies are Paragon customers.

**Ukraine Says It Hacked a Russian Aircraft Maker That Produces Strategic Bombers**

In its latest salvo against the Russian air force, Ukraine’s HUR military intelligence agency said that it had hacked into the network of Tupolev, an aerospace company that manufactures and services Russia’s strategic bombers. According to the cybersecurity news outlet The Record, the Ukrainian state hackers claim to have stolen 4.4 gigabytes of data, including internal communications, meeting notes, personnel files, and purchase records. Specifically, HUR says it was targeting data about individuals involved in the servicing and maintenance of Russia’s bomber fleet, which has targeted Ukrainian cities. The hackers also defaced the homepage of Tupolev’s website to show an owl clutching a Russian aircraft. “There is nothing secret left in Tupolev's activities for Ukrainian intelligence,” HUR said in a statement. “The result of the operation will be noticeable both on the ground and in the sky.” The move follows Ukraine’s unprecedented drone operation earlier this month that damaged or destroyed 41 Russian aircraft, including bombers and spy planes.

**International Law Enforcement Conducts Major Takedown of Infostealer Infrastructure**

On Wednesday, a consortium of cops from Interpol and 26 countries announced a takedown, dubbed “Operation Secure,” of domains and other digital infrastructure linked to 69 infostealer malware variants. In recent years, malicious hackers have leaned more and more on information-stealing malware, or infostealers, that grab sensitive information like passwords, cookies, and search histories to make it easier for attackers to target specific organizations and individuals. Operation Secure ran from January to April this year, Interpol said, and involved takedowns of more than 20,000 malicious IP addresses or domains and seizure of 41 servers as well as more than 100 GB of data. A total of 32 people were also arrested in connection with the investigation in Vietnam, Sri Lanka, Nauru, and elsewhere. Interpol described the operation as a “regional initiative” organized by the Asia and South Pacific Joint Operations Against Cybercrime Project.

**Meta Sues a Nudify App for Advertising on Instagram**

Meta sued Hong Kong–based Joy Timeline HK Limited for repeatedly advertising an app on Instagram called CrushAI that offers “nudify” deepfakes, using artificial intelligence to remove the clothes from anyone in a photo. Meta said in its announcement of the lawsuit that the company had repeatedly violated its terms of service for advertisers and that the move is part of a larger crackdown on similar deepfake apps pushed by “adversarial advertisers,” as it dubs the companies who violate its terms. “We’ll continue to take the necessary steps—which could include legal action—against those who abuse our platforms like this,” Meta wrote in a statement.

Tag

#intel