Category: Uncategorized

Protesters in Iran have tried to break into a local government building in the southern province of Fars, on a fourth day of demonstrations sparked by a currency collapse.

Officials said three police officers were injured and four people arrested in the city of Fasa.

Confrontations were also been reported in the western provinces of Hamedan and Lorestan.

The authorities in the capital, Tehran, had declared Wednesday a bank holiday – in an apparent effort to quell the unrest.

In video that emerged on social media and was verified by the BBC, a crowd is filmed breaking the gate of the governor’s office in Fasa.

Then, in another post, security men are seen shooting in response. Clouds of tear gas rise in front of shuttered shops.

Across the country, schools, universities and public institutions were closed because of the last-minute public holiday announced by the Iranian government.

It was ostensibly to save energy because of the cold weather, though it was seen by many Iranians as an attempt to contain the protests.

They began in Tehran on Sunday – among shopkeepers angered by another sharp fall in the value of the Iranian currency against the US dollar on the open market.

By Tuesday, university students were involved and they had spread to several cities, with people chanting against the country’s clerical rulers.

The protests have been the most widespread since an uprising in 2022 sparked by the death in custody of Mahsa Amini, a young woman who was accused by morality police of not wearing her veil properly. But they have not been on the same scale.

To prevent any escalation, tight security is now reported in the areas of Tehran where the demonstrations began.

President Masoud Pezeshkian has said his government will listen to the “legitimate demands” of the protesters.

But the prosecutor general, Mohammad Movahedi-Azad, has also warned that any attempt to create instability would be met with what he called a “decisive response”.

The threat actor behind two malicious browser extension campaigns, ShadyPanda and GhostPoster, has been attributed to a third attack campaign codenamed DarkSpectre that has impacted 2.2 million users of Google Chrome, Microsoft Edge, and Mozilla Firefox.

The activity is assessed to be the work of a Chinese threat actor that Koi Security is tracking under the moniker DarkSpectre. In all, the campaigns have collectively affected over 8.8 million users spanning a period of more than seven years.

ShadyPanda was first unmasked by the cybersecurity company earlier this month as targeting all three browser users to facilitate data theft, search query hijacking, and affiliate fraud. It has been found to affect 5.6 million users, including 1.3 newly identified victims stemming from over 100 extensions flagged as connected to the same cluster.

This also includes an Edge add-on named “New Tab – Customized Dashboard” that features a logic bomb that waits for three days prior to triggering its malicious behavior. The time-delayed activation is an attempt to give the impression that it’s legitimate during the review period and get it approved.

Nine of these extensions are currently active, with an additional 85 “dormant sleepers” that are benign and meant to attract a user base before they are weaponized via malicious updates. Koi said the updates were introduced after more than five years in some cases.

The second campaign, GhostPoster, is mostly focused on Firefox users, targeting them with seemingly harmless utilities and VPN tools to serve malicious JavaScript code designed to hijack affiliate links, inject tracking code, and commit click and ad fraud. Further investigation into the activity has unearthed more browser add-ons, including a Google Translate (developer “charliesmithbons”) extension for Opera with nearly one million installs.

The third campaign mounted by DarkSpectre is The Zoom Stealer, which involves a set of 18 extensions across Chrome, Edge, and Firefox that are geared towards corporate meeting intelligence by collecting online meeting-related data like meeting URLs with embedded passwords, meeting IDs, topics, descriptions, scheduled times, and registration status.

As is evident by the names of the extensions, a majority of them are engineered to mimic tools for enterprise-oriented videoconferencing applications like Google Meet, Zoom, and GoTo Webinar to exfiltrate meeting links, credentials, and participant lists over a WebSocket connection in real-time.

It’s also capable of harvesting details about webinar speakers and hosts, such as names, titles, bios, profile photos, and company affiliations, along with logos, promotional graphics, and session metadata, every time a user visits a webinar registration page via the browser with one of the extensions installed.

These add-ons have been found to request access to more than 28 video conferencing platforms, including Cisco WebEx, Google Meet, GoTo Webinar, Microsoft Teams, and Zoom, among others, regardless of whether they required access to them in the first place.

“This isn’t consumer fraud – this is corporate espionage infrastructure,” researchers Tuval Admoni and Gal Hachamov said. “The Zoom Stealer represents something more targeted: systematic collection of corporate meeting intelligence. Users got what was advertised. The extensions earned trust and positive reviews. Meanwhile, surveillance ran silently in the background.”

The cybersecurity company said the gathered information could be used to fuel corporate espionage by selling the data to other bad actors, and enable social engineering and large-scale impersonation operations.

The Chinese links to the operation are based on several clues: consistent use of command-and-control (C2) servers hosted on Alibaba Cloud, Internet Content Provider (ICP) registrations linked to Chinese provinces like Hubei, code artifacts containing Chinese-language strings and comments, and fraud schemes specifically aimed at Chinese e-commerce platforms such as JD.com and Taobao.

“DarkSpectre likely has more infrastructure in place right now – extensions that look completely legitimate because they are legitimate, for now,” Koi said. “They’re still in the trust-building phase, accumulating users, earning badges, waiting.”