CyberSecurity

The Storm Infostealer: A New Era of Remote Credential Theft

Published

2 months ago

April 12, 2026

The Storm Infostealer: A New Era of Remote Credential Theft

A dangerous evolution in credential theft has emerged from the digital shadows. Security analysts at Varonis have identified a sophisticated new Storm infostealer that operates with a chilling efficiency. Instead of risking detection by decrypting stolen data on a victim’s computer, this malware quietly packages everything and ships it off to the attacker’s own servers. This fundamental shift makes traditional endpoint defenses far less effective, marking a significant escalation in the cybercrime arms race.

How Storm Infostealer Evades Detection

To understand Storm’s threat, we must first look at what came before. Historically, information stealers worked locally. They would infiltrate a system, load libraries to access browser databases, and decrypt saved passwords and cookies right there on the victim’s machine. This activity, however, left clear footprints—processes accessing sensitive files, unusual network calls—that modern security tools learned to recognize and block.

Then, the landscape changed. Building on this, major browsers like Google Chrome introduced stronger, app-bound encryption. This made local decryption incredibly difficult, forcing malware authors to find new methods. Initial workarounds involved complex code injection or abusing debugging features, but these too left traces for vigilant security software to find.

The Remote Decryption Advantage

Therefore, the creators of Storm adopted a radically different approach. The malware acts as a sophisticated collector. It harvests encrypted credential files, session cookies, autofill data, and even credit card information directly from the browser’s secure storage. Crucially, it does not attempt to crack them open locally. Instead, it transmits the encrypted loot back to a command server controlled by the attacker. The decryption happens safely in the attacker’s own environment, completely bypassing the victim’s antivirus and endpoint detection systems. This server-side processing is a core reason why the Storm infostealer is so concerning to experts.

What Does the Storm Infostealer Steal?

The breadth of data targeted by Storm is comprehensive, designed to give attackers maximum leverage. After infection, it systematically collects a victim’s entire digital identity. This includes saved passwords, active session cookies, browsing history, and Google account tokens. Furthermore, it captures autofill data and stored credit card details. One compromised browser can hand an attacker the keys to corporate SaaS platforms, internal tools, and cloud environments without ever triggering a single password alert.

In addition to browser data, Storm casts a wider net. It scours user directories for documents, captures system information and screenshots, and extracts session data from popular messaging apps like Telegram, Signal, and Discord. Perhaps most alarmingly for some, it specifically targets cryptocurrency wallets, pilfering data from both browser extensions and dedicated desktop applications. According to researchers, all this activity runs directly in the computer’s memory to minimize its footprint and further reduce the chance of detection.

Automated Session Hijacking and Criminal Economics

Beyond mere data collection, Storm automates the next critical step: exploitation. Most stealers simply dump raw logs into a buyer’s panel, requiring manual effort to sift through and use the stolen credentials. Storm changes this equation. It automatically feeds stolen Google Refresh Tokens into its operator panel. Simultaneously, it provides a geographically matched SOCKS5 proxy. This combination allows the criminal to silently restore the victim’s authenticated session from a location that appears legitimate, enabling seamless account takeover and fraud.

On the criminal marketplace, this capability comes at a price. Varonis reports that access to the Storm infostealer is sold for less than $1,000 per month, making it an accessible tool for a wide range of threat actors. During their investigation, the company’s threat intelligence team identified 1,715 victim entries in Storm’s panel, with connections originating from countries including the United States, India, Brazil, Indonesia, Vietnam, and Ecuador. The diversity of network sources suggests active, widespread malicious campaigns.

High-Value Targets and the Broader Threat

The credentials stolen by Storm are not random. They are focused on high-value platforms that offer direct financial or strategic payoff. This includes major social media and communication giants like Facebook and Twitter/X. On the financial front, the malware aggressively targets leading cryptocurrency exchanges and services such as Coinbase, Binance, Blockchain.com, and Crypto.com.

Consequently, this stolen data fuels a thriving underground economy. Credentials are packaged and sold on dark web marketplaces, where they are used for everything from straightforward financial fraud and account resale to serving as the initial foothold for more advanced, targeted attacks against individuals and organizations. For more on protecting against such initial access threats, read our guide on endpoint security best practices.

Ultimately, the emergence of Storm signals a troubling trend toward more resilient and automated cybercrime tools. By moving the decryption process off the victim’s machine, attackers have found a way to neutralize a key defensive detection method. This development underscores the need for a layered security approach that includes robust network monitoring, user education on phishing threats, and advanced threat-hunting capabilities to identify anomalous data exfiltration, even when it’s encrypted. For deeper insights into the malware landscape, explore our analysis of the evolution of information stealers.

CyberSecurity

NCSC Outlines Coordinated Plan to Boost NHS Cyber Resilience: Key Steps and Impact

Published

3 minutes ago

June 2, 2026

Social Media Admin

NCSC Outlines Coordinated Plan to Boost NHS Cyber Resilience: Key Steps and Impact

The UK’s National Cyber Security Centre (NCSC) has revealed a comprehensive, coordinated strategy to strengthen NHS cyber resilience across the healthcare sector. Over the past 18 months, government bodies and industry players have deepened their collaboration to reduce cyber risk and improve threat detection, according to a recent NCSC blog post.

This initiative comes in response to a series of devastating cyber attacks that have disrupted patient care and exposed sensitive data. The NCSC’s plan focuses on several key pillars, from piloting new defensive tools to enhancing software supply chain security and sharing threat intelligence more effectively.

Key Pillars of the NCSC’s NHS Cyber Resilience Strategy

The NCSC’s approach is built on multiple strategic pillars designed to create a layered defense for the NHS. These include:

Active Cyber Defence (ACD) 2.0: Piloting new tools and services to proactively block threats.
Software Supply Chain Security: Enhancing the security of third-party software used by the NHS.
Vulnerability Disclosure & Threat Intelligence: Managing disclosures and sharing threat data across the sector.
Improved Visibility: Using analytics to understand the threat surface and deploy advanced defensive techniques.
Promoting NCSC Services: Encouraging adoption of tools like the Early Warning service, Cyber Action Toolkit, and Cyber Essentials scheme.

How the NCSC Is Reducing Supplier Risk in Healthcare

A critical element of the plan is addressing NHS supplier risk. Nicholas W., from the NCSC’s National Resilience Directorate, explained that the government’s Software Security Code of Practice is now being used in NHS procurement to assess suppliers’ cyber maturity. In addition, the NCSC has partnered with a healthcare organization to deploy data science tools that help prioritize supplier risks. This initiative will expand by combining incident history, alert data, and vulnerability activity from the NCSC Early Warning service with technical indicators like remediation patterns and exposed attack surfaces.

Furthermore, the NCSC has helped NHS England, the NHS Business Services Authority, and NHS Scotland establish internal vulnerability disclosure processes. These complement the NCSC’s own Vulnerability Reporting Service (VRS), which has supported GP surgeries, NHS trusts, ambulance services, and health boards since 2019.

Practical Tools and Workshops to Boost Cyber Defenses

Beyond policy, the NCSC is rolling out practical measures to strengthen NHS cyber resilience. For instance, the NHS App became the first government-sponsored app to offer passkeys, with more organizations expected to follow. The agency is also continuing work on External Attack Surface Management (EASM) and deception technology experiments across the sector. Analytics are being used to identify and resolve DNS-related risks, while NCSC Threat Hunting Workshops bring together cyber analysts from across the NHS to tackle real-world threats, develop defensive playbooks, and build stronger collaborative relationships.

Why Cyber Resilience Is Critical for the UK Healthcare Sector

The urgency of this plan is underscored by past incidents. The WannaCry campaign in 2017 cost the NHS an estimated £92 million ($118.6 million). More recently, a ransomware attack on supplier Synnovis in 2024 led to the cancellation of 1,500 operations and appointments and has been linked to a patient’s death. The NHS was also hit by a 2022 ransomware attack on IT partner Advanced Computer Software Group, resulting in the theft of data on tens of thousands of individuals and major disruptions to patient referrals, emergency prescriptions, and ambulance dispatches.

As Nicholas W. concluded, “Taken together, this work shows what is possible when organizations align around a shared goal. Effort is coordinated rather than duplicated, lessons are reused, and risk is reduced across the system, not just within individual organizations.” He added, “Most importantly, this approach offers a model for other critical sectors. Cybersecurity challenges are too complex for any one organization to tackle alone.”

For more on securing healthcare systems, read our guide on healthcare cybersecurity best practices and explore how to implement NCSC Cyber Essentials.

CyberSecurity

OpenAI restricts Cyber tool access after criticizing Anthropic for limiting Mythos

Published

21 hours ago

June 1, 2026

Social Media Admin

OpenAI restricts Cyber access after criticizing Anthropic for limiting Mythos

In a surprising turn of events, OpenAI has decided to restrict access to its cybersecurity tool Cyber, despite earlier criticism of rival Anthropic for doing the same with its Mythos tool. This move has sparked debate about consistency and transparency in the AI industry.

The controversy behind OpenAI restricts Cyber access

Just weeks after OpenAI CEO Sam Altman dismissed Anthropic’s decision to limit Mythos as “fear-based marketing,” the company announced it would roll out GPT-5.5 Cyber only to “critical cyber defenders.” Altman confirmed this on X (formerly Twitter) on Thursday, revealing a stark policy reversal.

Critics quickly pointed out the irony. When Anthropic restricted Mythos, Altman called the tactic unnecessary and overblown. Now, OpenAI is following the same playbook, raising questions about double standards in the industry.

How the Cyber tool works and who gets access

OpenAI’s Cyber tool is designed for advanced cybersecurity tasks, including penetration testing, vulnerability identification, and malware reverse engineering. The application process requires users to submit credentials and planned use cases to gain access.

According to OpenAI’s website, the tool aims to help companies find security holes and test defenses. However, the company fears misuse by malicious actors, which is why access is limited.

The Trusted Access for Cyber (TAC) program

OpenAI has introduced the TAC program to verify legitimate users. A spokesperson told TechCrunch that the system has scaled to thousands of verified defenders and hundreds of teams responsible for protecting critical software. These users can access GPT-5.5 for cybersecurity tasks with fewer safeguards.

The TAC program is tiered, meaning that “critical defenders with legitimate defensive use cases” can apply for access to dedicated models like GPT-5.4-Cyber and the forthcoming GPT-5.5-Cyber.

Industry reactions and the Anthropic comparison

When Anthropic restricted Mythos, Altman called the approach fear-based. Some critics agreed, saying Anthropic’s rhetoric was overblown. Ironically, an unauthorized group reportedly gained access to Mythos anyway, undermining the security rationale.

Now, OpenAI faces similar skepticism. Critics argue that restricting access doesn’t prevent misuse but instead limits innovation. Others point out that the move could be seen as a marketing tactic, just as Altman accused Anthropic of doing.

Building on this, OpenAI says it’s working with the U.S. government to expand access. The company plans to identify more users with legitimate cybersecurity credentials, potentially making Cyber more widely available in the future.

What this means for the cybersecurity landscape

OpenAI restricts Cyber access at a time when cybersecurity threats are escalating. The decision highlights the tension between making powerful tools available for defense and preventing their misuse by attackers.

As a result, the industry is watching closely. Will OpenAI’s TAC program succeed where Anthropic’s failed? Or will restricted access lead to similar breaches and criticism?

For now, the focus remains on balancing security with accessibility. Companies like IBM Security and CrowdStrike offer similar tools but with different access models, suggesting there’s no one-size-fits-all solution.

Ultimately, the debate over OpenAI restricts Cyber access reflects broader questions about AI governance. As tools become more powerful, the challenge is to ensure they’re used responsibly without stifling innovation.

CyberSecurity

International Police Action Takes Down DDoS-for-Hire Services and Arrests Four

Published

1 day ago

June 1, 2026

Social Media Admin

International Police Action Takes Down DDoS-for-Hire Services and Arrests Four

A sweeping international law enforcement effort has dealt a major blow to DDoS-for-hire services, taking down 53 domains and arresting four individuals suspected of running these illegal operations. Known as Operation PowerOff, the coordinated action involved police and cybersecurity agencies from 21 countries, marking one of the largest crackdowns on the cybercrime ecosystem that enables distributed denial-of-service attacks.

These DDoS-for-hire services, often called booter or stresser platforms, allow even unskilled users to launch devastating attacks on websites, servers, and online services. As a result, businesses and individuals worldwide face significant disruption and financial loss. But this latest operation shows that law enforcement is fighting back hard.

How Operation PowerOff Targeted DDoS-for-Hire Infrastructure

Operation PowerOff focused on dismantling the technical backbone of DDoS-for-hire services. Authorities seized servers, databases, and other infrastructure that made these attacks possible. By cutting off the tools that cybercriminals rely on, the operation prevented countless potential victims from being targeted.

Europol, which coordinated the effort, described DDoS-for-hire attacks as “one of the most prolific and easily accessible trends in cybercrime.” The agency noted that these services lower the barrier to entry, enabling people with little technical know-how to follow step-by-step tutorials and execute powerful cyber-attacks. This makes the disruption of such services a critical priority for global security.

In addition to the domain seizures and arrests, the operation removed over 100 URLs advertising DDoS-for-hire services from search engine results. This proactive measure helps reduce the visibility of these illegal offerings to potential customers.

Over Three Million User Accounts Exposed in the Takedown

One of the most striking outcomes of Operation PowerOff was the seizure of databases containing information on more than three million criminal user accounts. These accounts belonged to individuals who had used or paid for DDoS-for-hire services. Law enforcement agencies are now using this data to send warning emails and letters to those users.

Authorities distributed approximately 75,000 warnings to users, aiming to deter them from future involvement in cybercrime. Additional warnings were posted on cryptocurrency and blockchain platforms, which are often used to pay for hiring DDoS attacks. This multi-pronged approach not only disrupts current operations but also sends a clear message to would-be attackers.

Building on this, the FBI emphasized the importance of partnerships in tackling cyber threats. “Partnerships are critical because there is no one government or private sector entity that can address the range of cyber threats we face alone,” the agency stated. This collaborative spirit was evident in the involvement of 21 nations, including the United States, the United Kingdom, Australia, Japan, and many European countries.

Why DDoS-for-Hire Services Pose a Serious Threat

DDoS-for-hire services have become a persistent menace in the cybersecurity landscape. They allow anyone with a few dollars and an internet connection to launch attacks that can cripple online platforms. These attacks overwhelm servers with traffic, making websites and services inaccessible to legitimate users. For businesses, this can mean lost revenue, damaged reputation, and costly recovery efforts.

Moreover, the ease of access to these services has led to a surge in DDoS attacks across various sectors, from e-commerce and gaming to government and healthcare. By targeting the infrastructure behind these services, Operation PowerOff has disrupted a key enabler of cybercrime.

To protect your organization from such threats, consider implementing robust cybersecurity best practices and monitoring tools. Additionally, staying informed about the latest DDoS attack prevention strategies can help mitigate risks.

Ongoing Efforts and Global Cooperation

Operation PowerOff is not a one-time event. Law enforcement agencies continue to monitor and target DDoS-for-hire services, with the operation still ongoing. The full list of participating countries includes Australia, Austria, Belgium, Brazil, Bulgaria, Denmark, Estonia, Finland, Germany, Japan, Latvia, Lithuania, Luxembourg, the Netherlands, Norway, Poland, Portugal, Sweden, Thailand, the United Kingdom, and the United States.

This broad coalition reflects the global nature of the threat. As cybercriminals operate across borders, so too must the response. By sharing intelligence and resources, these nations are making it harder for DDoS-for-hire services to operate with impunity.

In conclusion, the disruption of DDoS-for-hire services through Operation PowerOff represents a significant victory for cybersecurity. However, the fight is far from over. Businesses and individuals must remain vigilant and adopt proactive measures to defend against DDoS attacks. For more insights on staying safe online, explore our guide on how to protect against cyber attacks.