Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan

thehackernews.com Oct 7, 2026

Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan

Curated by Shubham · TechCapsules · Oct 7, 2026

AI-summarised brief · reviewed before publication

Linux backdoors targeting telecom and network appliances in South Korea and Taiwan disguise their traffic as email security tools SpamSniper and ShareTech to evade detection. Rapid7 identified new BPFDoor variants that mimic SpamSniper’s PID file and rotate through ten Linux daemon names, while a separate implant, AVERAT, is delivered via an ELF dropper that encrypts itself with a key derived from “ShareTech.” The malware uses BPF to trigger on HTTPS POST requests, TinyShell for command execution, and SMTP for C2, demonstrating adaptive evasion tactics.

💡 Why It Matters

· The attackers’ use of legitimate product names and standard telecom protocols shows a sophisticated strategy to bypass both signature‑based and behavioral defenses, raising the threat level for critical infrastructure operators in the region.

Capsules Cybersecurity

Read full article on thehackernews.com

100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer

CERT‑UA uncovered over 100 compromised sites that inject malicious JavaScript to deliver LunexStealer, a data‑stealing malware. The attacks, linked to threat cluster UAC‑0277, use forged Cloudflare verification pages to prompt users to run a command that downloads an MSI package via ClickFix. The malware installs a browser extension, LUNARAXE, and a native messaging host, NAIVEMESS, enabling file system access and remote command execution. CERT‑UA recommends restricting MSI execution, blocking vulnerable drivers, and limiting browser extensions.

💡 The campaign demonstrates how attackers blend social engineering with blockchain‑based command retrieval, expanding the attack surface for credential theft and remote control.

amny.com · Oct 7

Data privacy and cybersecurity in the age of AI: Attorney Jean-Marc Appolon…

Attorney Jean‑Marc Appolon, a privacy and cybersecurity specialist at Labaton Keller Sucharow LLP, is leading efforts to safeguard New Yorkers’ personal data amid rising AI‑driven threats. He conducts external audits of corporate data‑handling practices, testing whether publicly stated privacy policies match actual behavior and ensuring compliance with city, state and federal regulations. When violations are uncovered, Appolon initiates litigation to hold companies accountable for illegal or improper use of personally identifying information. He emphasizes the shift from traditional voyeurism to sophisticated internet stalking and mass data exploitation for profit. By combining technical scrutiny with legal action, Appolon aims to reinforce the “wall” protecting residents from data breaches and unauthorized surveillance in an increasingly digital landscape.

💡 Appolon’s proactive legal strategy confronts the expanding scope of AI‑enabled data abuse, forcing companies to align practices with evolving privacy standards before harm reaches consumers.

tomsguide.com · Oct 6

AI scams are getting scary realistic — 4 red flags to watch…

AI‑generated scams are becoming indistinguishable from legitimate communications, prompting a surge in fraud losses. The FBI reports Americans lost $893 million to AI‑driven scams in 2025, and experts warn the figure could rise as deep‑fake voice, text and image tools improve. Scammers exploit urgency (“RIGHT NOW”), impersonate courts, government agencies or loved ones, and craft emails that mimic official account alerts. Victims are urged to verify requests through trusted channels, such as calling the courthouse directly or using known contact numbers, rather than responding to the unsolicited message. The article outlines four red flags—pressuring urgency, false authority claims, realistic account‑related emails, and deceptive personalization—to help consumers spot and avoid these increasingly sophisticated attacks.

💡 As AI lowers the barrier to produce convincing fraud, everyday users face a heightened risk of losing money and personal data, turning what was once a niche crime into a mainstream threat.

helpnetsecurity.com · Oct 6

Cybersecurity jobs available right now: October 6, 2026

Help Net Security published a roundup of open cybersecurity positions on October 6, 2026, highlighting nine roles across government, corporate and regulatory bodies in the United States, Canada and Ireland. The list includes an Associate Identity and Access Management Engineer in New York City supporting Microsoft Entra ID, a Computer Network Defense Analyst at the NSA protecting national‑security systems, and a Cybersecurity Engagement & Policy Specialist for Ireland’s Commission for Communications Regulation who will shape policy and run stakeholder workshops. Corporate openings feature a Cybersecurity Engineer at Reyes Holdings, a Cybersecurity Technology Architect IV at Astreya focused on AI‑driven architectures, and a Cyber Security Developer at BMO (now closed). Postings cover senior analyst, engineering and policy positions, all requiring on‑site or hybrid work arrangements.

💡 The breadth of roles underscores a tightening talent gap as governments and enterprises race to embed advanced security and AI controls across critical infrastructure.

theregister.com · Oct 6

Atlassian warns of critical file access flaw in its datacenter products

Atlassian has issued an urgent security advisory for its datacenter suite, warning that a critical CVE‑2026‑21589 vulnerability allows unauthenticated attackers to read arbitrary files within the web‑application root directory of Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible and Fisheye. Rated 9.3 out of 10, the flaw requires knowledge of exact file names and paths, and does not expose directory listings, but could expose sensitive configuration or credential files in certain deployments. Atlassian has released patched versions and urges customers to apply them immediately. For installations that cannot be patched promptly, the company recommends disconnecting the instances from the public internet and restricting external access. Detailed mitigation steps and verification guidance are included in the advisory.

💡 Exploiting this flaw could give attackers direct insight into internal systems, potentially facilitating broader breaches of enterprise environments that rely on Atlassian’s core collaboration tools.

businessworld.in · Oct 6

Cybersecurity Jobseeker Interest Surges, SOC Analyst Roles See 225% Jump: Indeed

Job‑seeker interest in four cybersecurity roles in India more than doubled over the past year, according to Indeed data. The steepest rise was for Security Operations Centre (SOC) Analyst positions, which saw a 225 % increase, followed by Privacy/Data Protection (189 %), Security Engineer (176 %) and Cybersecurity Analyst (175 %). Despite the surge in candidate interest, employer postings did not keep pace: postings for Privacy/Data Protection grew 18 %, Cybersecurity Analyst 9 %, while Security Engineer listings fell 1 % and SOC Analyst postings dropped 8 %. Frequently required skills included Information Security, Cloud Security, NIST standards, Firewall (19.6 % of ads), ISO 27001 (17.5 %), SIEM (15.2 %), Network Security (12 %) and Vulnerability Assessment (11.6 %). The mismatch highlights divergent demand across specialisations as Indian firms expand digital services across sectors.

💡 The disconnect between booming job‑seeker interest and stagnant hiring reveals a talent‑supply gap that could compel companies to invest heavily in upskilling or risk critical security shortfalls as digital adoption accelerates.