Defender's Corner

The PolinRider campaign described above spreads through a VS Code feature called task files. These are configuration files that can run code automatically when you open a project folder. Most developers never review them, which makes them a perfect hiding spot.

Here is what to do right now. In any project you have cloned or installed recently, open the .vscode folder and look for a file called tasks.json. Check whether any task includes "runOn": "folderOpen". If it does and you did not put it there, treat it as suspicious.

You can also disable automatic task running entirely. In VS Code, go to Settings and search for "task auto detect" to review what runs without your explicit permission.

This takes five minutes and requires no extra software.

A joint operation involving Google, the FBI, and Lumen Technologies has disrupted NetNut, a residential proxy botnet that had quietly compromised at least two million Android devices — smart TVs, streaming boxes, and phones — according to Bleeping Computer. Infected devices were used to route criminal and espionage traffic through ordinary home internet addresses, making the traffic look legitimate.

Devices typically get infected through pre-installed malware or trojanized apps downloaded outside the official Play Store.

What to do right now:

1. Open the Google Play Store, tap your profile icon, and select Play Protect → Scan. Google has been automatically disabling infected apps for enrolled devices.
2. Avoid sideloading apps (installing from outside the Play Store) on Android TV boxes or streaming sticks.
3. If you use a cheap Android streaming device from an unfamiliar brand, consider replacing it with a device that receives regular security updates.

ClickFix attacks work by tricking you into copying a dangerous command, usually disguised as a verification step or a helpful fix, and then pasting it directly into your computer's terminal. The result is malware running with your own permissions, bypassing most security tools entirely.

Opera has introduced Paste Protect, a feature that blocks suspicious commands before they ever reach your clipboard. When it detects a harmful pattern, it stops the copy action, shows you a warning, and flags a red indicator in the address bar. You can still review the first 120 characters of what was blocked and approve it manually after a short delay if you know it is safe.

The feature is on by default in the latest Opera release. You can manage it at Settings → Privacy & Security → Paste Protect.

Get Opera at opera.com — it is free. Full details on Paste Protect via Bleeping Computer.

A ClickFix attack starts with something completely ordinary: a video that will not load, or a CAPTCHA that keeps failing. A pop-up offers a quick fix and asks you to copy a command and paste it into your computer's terminal. The command installs malware — and you ran it yourself, which means most security software never stops it. Huntress reports this technique now accounts for over 53% of malware-delivery attacks.

Opera has added a feature called Paste Protect to its desktop browser, enabled by default, that monitors clipboard activity in real time and blocks malicious commands before you can paste them. If it detects something suspicious, the action is blocked and a warning appears immediately.

If you use Opera, you are already protected. If you use another browser, the rule is simple: never paste a command into your terminal because a website told you to.

Download Opera here.

Microsoft has rolled out a new admin policy for Microsoft Teams (the video conferencing and collaboration platform) that detects external bots before they join your meetings and holds them in a lobby for organiser approval, according to Help Net Security.

Previously, bots could join meetings with the same one-click admit as any other participant. Under the new policy, Teams uses behavioural and infrastructure signals to identify bots, groups them separately in the lobby, and removes the one-click admit option for them. The organiser sees a clear visual indicator and must explicitly approve entry.

What to do: If your organisation uses Teams, ask your IT admin to enable the Manage external bots and their access to meetings policy in the Teams Admin Center. Also set Who can admit from the lobby to organizers and co-organizers only. If you run meetings yourself and have admin access, this takes about two minutes to configure.

WhatsApp is rolling out usernames globally today, and reserving yours is worth doing immediately, according to The Hacker News.

Once enabled, your phone number becomes invisible to anyone who contacts you via username. They need your exact username to find you — and optionally a username key (a secondary code you set that new contacts must also know before they can message you). No public directory exists, so you cannot be discovered by browsing.

This matters because phone numbers are a common starting point for SIM-swapping attacks, spam, and targeted scams. Removing your number from the equation cuts off one well-travelled route.

To reserve your username: Open WhatsApp, go to Settings > Account > Username, and follow the prompts. The feature is rolling out gradually, so it may not appear immediately.

Mozilla's 0DIN team demonstrated today that malicious code does not need to live in a repository to compromise your machine. The attack exploits the trust developers place in AI coding tools — the agent reads setup instructions and follows them faithfully, with no way to see what will be fetched at runtime.

The practical defence is to review any initialisation or setup command before running it, regardless of whether an AI tool recommends it. Before executing a shell script from an unfamiliar source, check where it fetches content from. If a command pipes anything directly to bash or sh — particularly one that resolves an external address — treat it as suspicious.

0DIN's full write-up, including the proof-of-concept chain, is available via Help Net Security. If you work with developers or manage engineering teams, sharing this finding today is worthwhile.

Fake support messages from Russian intelligence have put messaging account security back in the spotlight, and the fix does not require any special software.

Both Signal and WhatsApp let you see every device your account is currently linked to. If an attacker has used a stolen recovery key or confirmation code to link your account to their device, it will show up here.

On Signal: Go to Settings → Linked Devices. Remove anything unfamiliar.

On WhatsApp: Go to Settings → Linked Devices. Review the list and tap any unrecognised session to remove it.

While you are there, enable two-step verification on both apps. Signal: Settings → Account → Two-Step Verification. WhatsApp: Settings → Account → Two-Step Verification.

This takes under five minutes. The SSU advisory behind this story is available via The Hacker News if you want the full detail on how the campaign operates.

Russian intelligence groups are actively phishing Signal users out of their Backup Recovery Keys, according to an updated FBI and CISA advisory covered by The Hacker News. Hand that key to an attacker and they can restore your entire message history and take over the account. The old key keeps working even after you change devices.

The fix is fast. Open Signal, go to Settings > Linked Devices, and remove anything unfamiliar. Then go to Settings > Account > Backups and generate a new Recovery Key. That kills the old one.

One firm rule: Signal support does not message you inside the app. Any message asking for your Recovery Key, a PIN, or a verification code is an attack. Treat it as one.

This applies to high-profile targets first, but the tactics will broaden. Anyone using Signal for sensitive conversations should do this today.

Security expert Richard Bejtlich has published a free practical guide on network detection and response (NDR) — the discipline of monitoring traffic moving inside your network, not just at its edges — in partnership with Corelight, according to The Hacker News.

The core argument is worth understanding. Alerts tell you something may have happened. Network evidence tells you what actually did. Bejtlich calls this interdiction: catching attackers after they get in but before they achieve their goal. Today's phishing campaign targeting hotels is a perfect example — the implant was already running before any alert fired.

If you manage a small network, the practical takeaway is this: start logging outbound traffic, not just inbound. Unusual connections to unfamiliar IPs on non-standard ports are often the first real sign of compromise. The free guide is available via the link above.