Kaspersky

Fake EU Migration Declaration Scam Targets Russian Travelers for Passport Scans

Kaspersky researchers have uncovered a phishing campaign impersonating the EU migration authority to trick Russian citizens planning Schengen trips into submitting personal data and passport scans. The emails reference the real EES border system and threaten entry delays unless travelers complete a fake digital declaration five days before arrival. Victims are directed to a professionally designed multilingual site mimicking official EU portals, where they must upload scans of their passports along with trip details and companion information. The stolen data is then used for follow-up social engineering calls aimed at extracting money or further credentials. Attackers likely obtain target email addresses from hotel and booking service data breaches. No pre-registration is actually required by the genuine EES system, making any unsolicited requests suspicious. Travelers are advised to verify all such demands only through official consulate or visa center websites.

PAYLOAD Ransomware Seizes Active Directory GPO to Disrupt Entire Windows Domain Without Encryption

Researchers at Kaspersky have documented an attack by the PAYLOAD ransomware that paralyzes an entire Windows domain without encrypting a single file. Instead of encryption, the operators leverage native Windows policy mechanisms to enforce disruption across the environment. The core of the attack is a malicious Group Policy Object named PAYLOAD linked directly to the root of the Active Directory domain. This placement allows the policy to reach virtually every connected device, turning it into a corporate-wide disruption tool. Through the GPO, the group distributes ransom notes from SYSVOL, replaces wallpapers and lock screens with extortion images displaying the message Welcome to Payload, and disables local administrator accounts on affected machines. A second policy object named win Firewall Off disables the Windows firewall across the entire fleet, increasing exposure during the operation. Initial access occurred in April 2026 via a compromised legitimate domain account on a FortiGate SSL VPN, with possible entry vectors including phishing, password spraying, and credential stuffing. The victim is a manufacturing company in the Middle East. The extortion model combines data theft with operational shutdown, delivering effects similar to traditional ransomware but without any decryption key to negotiate.

Ransomware Operators Hijack Active Directory via GPO to Lock Companies Without Encryption

Kaspersky researchers have uncovered a new extortion campaign called Payload that targets manufacturing companies by compromising privileged accounts and seizing control of Active Directory. Instead of deploying traditional ransomware encryptors, the attackers created a Group Policy Object named Payload linked to the domain root. This GPO automatically changed desktop wallpapers and lock screens across all systems, displayed ransom demands, and disabled administrative accounts after policy refresh. The group also exfiltrated valuable corporate data before the lockdown and later published it on the dark web to increase pressure on victims. Because the attack relied entirely on legitimate Windows mechanisms such as VPN access and Group Policy, conventional antivirus solutions proved ineffective. Experts recommend monitoring GPO changes, enforcing phishing-resistant MFA on VPN and admin systems, and applying least-privilege principles to limit the impact of credential compromise.

MacSync Malware Evolves to Steal Cryptocurrency and Conceal Components in iCloud

Updated MacSync malware for macOS now arrives bundled with a stealer and backdoor, allowing attackers to harvest browser history, cookies, passwords, Telegram data, and cryptocurrency wallet details while maintaining persistent remote access. Discovered by Kaspersky researchers in September 2026, the new variant uses a multi-stage infection chain that begins with a fake application download, such as a document collaboration tool or crypto wallet. One component is delivered through a publicly shared iCloud calendar entry in ICS format, bypassing traditional loaders. After execution, MacSync requests administrator credentials, displays a fake macOS damage notification, and installs the stealer alongside a Finder-masquerading backdoor. The backdoor enables arbitrary code execution, file theft, browser extension installation, and replacement of the legitimate Ledger application with a malicious version to drain cryptocurrency funds. Users are advised to download software only from trusted sources and remain cautious of unexpected administrator password prompts.

Backblaze Responds in Minutes While reg.ru Delays Action on Banking Trojan Infrastructure

A detailed reverse-engineering report reveals a sophisticated Android banking Trojan distributed via Telegram spam that disables antivirus apps, intercepts SMS one-time codes, and exfiltrates banking credentials. The malware uses AES-encrypted assets, a custom binary protocol over sockets, and multiple modules for screen streaming, keylogging, microphone access, and remote control. Infrastructure analysis traced the payload to an S3-compatible bucket on Backblaze, four command-and-control domains, and a VPS, with the domains registered through reg.ru. Notifications sent to Backblaze resulted in account termination within 11 minutes, while reg.ru responded only after a week with a statement refusing action without a court order. The same signing certificate appears across multiple variants, allowing rapid infrastructure rotation that keeps the campaign active despite takedown attempts. Kaspersky and CERT teams were also notified but produced no visible results within the observed period.

CISA Adds Two Remotely Exploitable TrueConf Server Vulnerabilities to KEV Catalog

The US Cybersecurity and Infrastructure Security Agency has added two critical vulnerabilities affecting TrueConf Server to its Known Exploited Vulnerabilities catalog. CVE-2026-72529 allows unauthenticated remote attackers to execute arbitrary scripts due to missing authentication in a critical function. CVE-2026-72530 is a code injection flaw that enables attackers to run arbitrary code on the underlying host system by escaping the sandboxed environment. Both issues can be exploited over TCP port 4307 without requiring authentication. Kaspersky assigned CVSS v3.1 base scores of 9.8 and 9.0 respectively, rating both as Critical. US federal agencies must apply mitigations for the first vulnerability by August 23 and for the second by September 3.

Kaspersky Adds Call Filtering to Kaspersky Secure Mobility Management for Android Devices

Kaspersky has introduced call control capabilities into the expanded version of Kaspersky Secure Mobility Management. The new feature allows corporate Android devices running Kaspersky Endpoint Security for Android to check incoming call numbers against both local offline databases and global online reputation sources. Depending on company policy, the system can display warnings to employees or automatically block suspicious calls. Administrators gain the ability to define rules by call category, maintain black and white lists, and apply different policies to specific employee groups. The update targets risks from telephone fraud and social engineering attempts that aim to extract confidential corporate information or funds. It also helps reduce unwanted spam calls that disrupt staff who handle high volumes of incoming communications. Kaspersky Secure Mobility Management provides full lifecycle control over corporate mobile devices, applications, data, and security policies.

Spyware-Laden Modified iOS Apps Distributed via Russian Telegram Channel, Kaspersky Discovers

Kaspersky researchers have identified modified versions of popular iOS applications that are being distributed through a Russian-language Telegram channel and contain a malicious spying module. The infected apps include a marketplace platform for selling goods, a photo editor, and a video viewing service, all offered as ad-free versions with extra free features. Attackers embed the spyware directly into legitimate IPA files, while some clean apps simply promote the same channel to funnel users toward the malicious downloads. Installation requires users to obtain a developer certificate and sign the app using tools such as eSign or Scarlet, or to sideload via a computer or jailbroken device, completely bypassing the App Store. Once launched, the malware collects device name, battery level, regional settings, memory information, jailbreak status, geolocation, carrier code, and screenshots before sending the data to the attackers, although it stops when the app is closed. Kaspersky advises users to obtain applications only from official stores or verified developer websites rather than random Telegram sources.

macOS Users Encounter Phishing and Scams More Often Than Windows Users but Adopt Fewer Protections, Kaspersky Study Reveals

A new study from Kaspersky Lab shows that macOS users report higher rates of phishing encounters and various scams compared to Windows users, yet they are less likely to implement basic security measures. Over the past year, 12 percent of macOS users faced phishing attempts versus 9 percent of Windows users, while 16 percent encountered investment fraud schemes compared to 13 percent. Privacy violations and personal data theft were also reported more frequently by Mac owners at 11 percent and 12 percent respectively, against 8 percent and 7 percent for Windows. Security habits differ notably, with only 51 percent of macOS users avoiding suspicious links and emails versus 62 percent of Windows users, and just 35 percent installing additional protection tools compared to 42 percent. Password practices and multi-factor authentication usage follow the same pattern, with Mac users trailing in creating unique or complex passwords and enabling 2FA. Kaspersky notes that while macOS built-in defenses handle many threats effectively, they offer limited protection against social engineering and platform-specific attacks, underscoring that the Apple brand does not serve as automatic security.

From Free Game Cheats to Arson: Cybercriminals Recruit Children for Espionage and Violent Crimes

Cybercriminals are increasingly targeting children not only to steal money from parents but also to turn them into unwitting accomplices in dangerous criminal activities. During school holidays, teenagers spend more time in games and messengers where scammers offer free in-game currency, mods, cheats, and pirated game versions to build trust. Once access is gained, fraudsters extract SMS codes, bank card details, or device control, escalating to threats and blackmail when initial tactics fail. Kaspersky Lab recorded over 19 million attempts to distribute malware disguised as popular games between April 2024 and April 2025, installing spyware and RAT trojans that monitor chats, keystrokes, cameras, and microphones. In severe cases, children are manipulated into believing they assist law enforcement, leading to real-world crimes such as photographing apartments, handing over keys, setting fires, or attacking people. Specific incidents include a 12-year-old boy from Leningrad Oblast forced to assault a police officer and a 13-year-old from Podolsk ordered to ignite a gas pump at a filling station. Izvestia reporting highlights that parents should watch for signs like hidden screens or strange tasks and teach children that no stranger can demand codes, money, or secret missions.

US Accuses Russian Cybersecurity Specialist D.O. of Void Blizzard Attacks on European Governments and US Companies, Kaspersky Ties Emerge

American authorities have charged Russian information security specialist D.O. with participating in cyberattacks by the Void Blizzard group, also known as Laundry Bear, targeting NATO-aligned European government agencies and at least 11 US companies since 2023. D.O., who previously held a senior position at one of Russia’s largest cybersecurity firms widely identified as Kaspersky, did not plead guilty during a court hearing in Boston. The US Department of Commerce banned the company’s software in 2024 over national security concerns, while European agencies had issued similar warnings earlier. Prosecutors also linked D.O. to a Nizhny Novgorod IT company where he served as deputy director from 2024, although his earlier Kaspersky employment was confirmed through salary records and a former colleague rather than the indictment itself. D.O. graduated from Bauman Moscow State Technical University with a degree in information security, an institution previously flagged by European journalists as a potential training ground for state-linked operatives. Experts note that movement between commercial cybersecurity roles and intelligence structures occurs across countries, but D.O.’s guilt remains to be proven in court.