Be careful what you use!

Each of us uses many tools on a daily basis  - right❓
And it's a development environment, and it's antivirus software, and it's office software, and so on...

And have you wondered if the tools or additives you use are safe❓ 

Here are some examples just from today that this is not quite the case❗ 

Fake Office Add-ons🗒️ 

• Threat actors are abusing a popular hosting platform for open-source projects, SourceForge, to distribute fake Microsoft Office add-ons.
  These malicious add-ons, posing as legitimate tools, install malware designed to mine and steal cryptocurrencies on victims' computers.
  The misuse of SourceForge to distribute malware has a history, dating back at least to the ZeroAccess Trojan.

(UN)Secure VSCode Marketplace💻 

• The VSCode Marketplace platform was used to distribute extensions that install XMRig cryptocurrency miners.  

AI in The Service of Evil😈 

• A disturbing new offering has appeared on darknet forums - Xanthorox AI. It is advertised as an autonomous, modular artificial intelligence platform specifically designed for offensive cyber operations. The developers claim that the system is based on their own custom AI models (it doesn't use public models like GPT or LLaMA) and is hosted locally on their servers, which is supposed to ensure no monitoring and high flexibility.
  The platform is said to offer a wide range of functions, including script and malware generation, vulnerability exploitation, data analysis, phishing content generation, social engineering, image and voice processing, and Internet scanning for information. Featured modules include Xanthorox Coder
  (for programming tasks) and Xanthorox Vision (for image analysis).  
  
  
  

How to Defend Against It?🛡️ 

Unfortunately, our field is limited but there are a few rules to follow:

✅ Download the software directly from the manufacturer's website

✅ When downloading add-ons from various marketplaces, verify the provider of such add-on

✅ When dealing with AI, use content verification tools such as undetectable.ai

✅ If you feel insecure, rely on proven solutions

What if I Would Rather Give It to Someone?🙋‍♂️ 

Contact the information security specialist you know best - if you don't happen to know one - contact me 😊