Category: Uncategorized

Ryanair boss Michael O’Leary has thanked Elon Musk for all the additional publicity that their online spat has brought his airline, saying sales have risen two to three percent in the last five days.

Musk has suggested he could buy the budget airline and called O’Leary “insufferable” and “an idiot”, after O’Leary rejected the idea of using Musk’s Starlink technology to provide wifi on flights.

At a press conference on Wednesday, O’Leary said he takes “no insult” at Musk’s jibes, and that he is regularly insulted at home by his four teenage children and many others.

He also said Musk is “free” to invest in Ryanair shares, but under EU laws, Musk could not own a majority of a European airline.

Musk is the world’s richest man with an estimated net worth of $769bn (£573bn), and O’Leary runs Europe’s busiest airline. Both are known to court media attention with strong language and provocative statements.

O’Leary said at the press conference that his team is going to X’s office in Dublin to give Musk a free Ryanair ticket to thank him for the “wonderful boost” in publicity he’s had.

“If he wants to call me an idiot, he wouldn’t be the first, and he certainly won’t be the last … But if it helps to boost Ryanair sales, you could insult me all day, every day.”

The squabble between the two intensified after O’Leary called Musk an “idiot” and said using Starlink to provide Ryanair passengers with free wifi would not be cost-effective.

O’Leary added that the cost of installing Starlink would be €250, (£218m) to fit all necessary equipment — and would increase fuel costs by €100m (£87m) per year.

He said he thinks only 5% of Ryanair passengers would pay for wifi, so there would be poor return on investment.

On the prospect of Musk buying the Irish airline, O’Leary said: “We’re a publicly owned company. He’s free to [buy shares] at any time, but non-European citizens cannot own a majority of European airlines.”

“If he wants to invest in Ryanair, we would think it’s a very good investment.”

O’Leary called all social media “a cesspit”, but conceded it was important for Ryanair’s marketing.

The company is known to take an irreverent approach to social media, often mocking customers for complaining about the airline’s cost-cutting measures.

O’Leary said he’d had no direct contact with Elon Musk.

Musk has floated the idea of buying Ryanair several times on X in the past week, but EU-based airlines must be majority owned by people from the EU, Switzerland, Norway, Iceland or Liechtenstein.

Last week, after German airline Lufthansa announced it would install Starlink on its planes to provide all passengers with free wi-fi, O’Leary said Musk knew “zero” about flight aerodynamics.

The health of detained veteran Ugandan opposition figure Kizza Besigye has “reached a critical and deteriorating state”, his party says, after he was taken overnight to a medical facility in the capital, Kampala.

The 69-year-old politician was driven to a private medical facility under “heavy security”, the People’s Front for Freedom (PFF) party said, without specifying what he is suffering from.

However, prison authorities denied that Besigye’s health was dire, describing his overnight visit to a doctor as a “general check-up”.

Besigye, a former personal doctor to President Yoweri Museveni and one of his longest-standing political rivals, has been in detention since November 2024.

The PFF leader was charged in a military court with treason, which carries the death sentence, as well as illegal possession of a firearm and threatening national security. He denies the accusations.

Besigye, who has run for president against Museveni four times, has been in detention with his associate Obeid Lutale since they were both dramatically seized in Kenya and taken back to Uganda.

Last month, a court denied them bail for the fourth time, saying it was too early to release them as they had not yet entered their pleas.

In a statement on Tuesday, the PFF accused Ugandan authorities of denying Besigye proper medical care, noting that his continued detention amounted to a violation of his basic rights.

“It is a tragedy that a man who has dedicated his life to the health and freedom of others is being denied his own right to medical dignity,” the PFF said, adding: “We hold the regime and the prison authorities fully accountable for his well-being.”

Frank Baine, a spokesman for Uganda’s prisons, denied that Besigye’s health was critical, saying the opposition figure was under standard medical supervision.

“Kizza Besigye receives necessary treatment like other prisoners and he is fine,” Baine said, adding: “This morning he was doing his exercises.”

But the PFF described Baine’s remarks as a “blatant attempt to mask the physical toll” of Besigye’s continued detention, insisting: “Our leader is seriously unwell.”

It demanded that Besigye’s personal doctors and family be granted immediate and unrestricted access to him, so they can provide specialised and independent medical care.

Speaking to a local TV station, Besigye’s wife, Winnie Byanyima, said that her husband had complained of acute stomach pain, a high temperature and he was severely dehydrated.

“He was shaking and unable to walk. He is seriously ill and he refused to be treated by the prison authorities,” Byanyima, who is a respected human rights advocate and head of UNAids, added.

Another opposition leader, Bobi Wine, has expressed concern over Besigye’s health while in detention, saying his condition appears to be deteriorating amid limited access to medical care.

“We stand fully in solidarity with him and pray for his recovery,” Wine said in a post on X.

This is not the first time the veteran opposition leader has been taken ill at Luzira Prison, a maximum security jail in Kampala, where he has been held.

Last February, Besigye was also reported critically ill after he went on hunger strike demanding justice.

Besigye, who last contested the presidency in 2016, has previously accused the authorities of political persecution.

In recent years he has been less active in politics and did not contest the general election earlier this month.

There have been increasing calls by his family, opposition and human rights groups for him to be released on medical grounds.

President Museveni has blamed Besigye and his legal team for the delays in the trial, which he said had resulted in the PFF’s leader’s continued detention.

Museveni, who has held power since 1986, was on Saturday declared the winner of last week’s presidential election with 72% of the vote.

His closest challenger Wine, whose real name is Robert Kyagulanyi, got 25%.

Wine rejected the results as “fake” and has gone into hiding citing threats against his life.

Visual Studio Code is a popular open-source code editor[1]. But it’s much more than a simple editor, it’s a complete development platform that supports many languages and it is available on multiple platforms. Used by developers worldwide, it’s a juicy target for threat actors because it can be extended with extensions.

Of course, it became a new playground for bad guys and malicious extensions were already discovered multiple times, like the ‘Dracula Official’ theme[2]. Their modus-operandi is always the same: they take the legitimate extension and include scripts that perform malicious actions.

VSCode has also many features that help developers in their day to day job. One of them is the execution of automatic tasks on specific events. Think about the automatic macro execution in Microsoft Office.

With VSCode, it’s easy to implement and it’s based on a simple JSON file. Create in your project directory a sub-directory “.vscode” and, inside this one, create a “tasks.json”. Here is an example:

PS C:\temp\MyProject> cat .\.vscode\tasks.json
{
  "version": "2.0.0",
  "tasks": [
    {
      "label": “ISC PoC,
      "type": "shell",
      "command": "powershell",
      "args": [
        "-NoProfile",
        "-ExecutionPolicy", "Bypass",
        "-EncodedCommand",
      "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFAAcgBlAHMAZQBuAHQAYQB0AGkAbwBuAEYAcgBhAG0AZQB3AG8AcgBrADsAIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcASQAgAGEAbQAgAG4AbwB0ACAAbQBhAGwAaQBjAGkAbwB1AHMAIQAgAH0AOgAtAD4AJwAsACAAJwBJAFMAQwAgAFAAbwBDACcAKQAgAHwAIABPAHUAdAAtAE4AdQBsAGwA"
      ],
      "problemMatcher": [],
      "runOptions": {
        "runOn": "folderOpen"
      },
    }
  ]
}

The key element in this JSON file is the “runOn” method: The script will be triggered when the folder will be opened by VSCode.

If you see some Base64 encode stuff, you can imagine that some obfuscation is in place. Now, launch VSCode from the project directory and you should see this:

The Base64 data is just this code:

Add-Type -AssemblyName PresentationFramework; [System.Windows.MessageBox]::Show('I am not malicious! }:->', 'ISC PoC') | Out-Null

This technique has already been implemented by some threat actors![3]!

Be careful if you see some unexpected “.vscode” directories!

[1] https://code.visualstudio.com

[2] https://www.bleepingcomputer.com/news/security/malicious-vscode-extensions-with-millions-of-installs-discovered/

[3] https://redasgard.com/blog/hunting-lazarus-contagious-interview-c2-infrastructure

Xavier Mertens (@xme)

Xameco

Senior ISC Handler – Freelance Cyber Security Consultant

PGP Key