I dagens avsnitt diskuterar Erik Zalitis och Mattias Jadesköld tillsammans med Patrick Schlapfer på HP. Patrick arbetar till vardags med Threat research och ligger bakom HP:s senaste rapport.

Vad är det senaste metoderna som angripare använder? ”vibe-hacking” – vad är det? Hur an de komma åt kryptovaluta genom en backupfil? Och hur kan angripare använda ljudfiler för att ta sig in i datorer?

Det och en hel del annat i dagens avsnitt som är på engelska!

Inspelat: 2026-08-26 (publicerat 2026-08-30)
Deltagare: Erik Zalitis, Mattias Jadesköld och Patrick Schlapfer.
Texten skrevs och sammanställdes av Erik Zalitis. Intervjun är på Engelska.
Avsnittet presenteras i samarbete med HP.

Här är transkriptionen av avsnittet.

Medan du lyssnar – Vibe hacking

1
00:00:12,654 –> 00:00:21,262
Mattias Jadesköld: I dagens avsnitt tar vi oss en titt på hotlandskapetsammans med HP. Det finns några angrepp som sticker ut under den första delen av 2026.

2
00:00:21,262 –> 00:00:42,734
Erik Zalitis: Ja, precis. Vibe hacking till exempel, och hur angripare döljer skadlig kod i ljudfiler. Rena agentfilmen. Ja, det kanske är en sanning som kan läsas ut i HP Wolf Security Threat Insights report, som släpptes för ett par månader sedan.

3
00:00:42,734 –> 00:01:01,026
Mattias Jadesköld: Det ska vi ta en titt på närmare idag, och det gör vi tillsammans med Patrik Schlapfer som arbetar som principal threat research. Vi kommer prata engelska rätt avsnitt av IT-säkerhetspodden som förutom Patrik, då består av Mattiaskö i sin vanligording. Welcome, Patrick.

Patrick enters our virtual studio

4
00:01:01,026 –> 00:01:04,558
Patrick Schlapfer: Welcome. Hey, thank you so much for having me.

5
00:01:04,558 –> 00:01:06,990
Mattias Jadesköld: Yeah, how how are you?

6
00:01:06,990 –> 00:01:11,106
Patrick Schlapfer: I’m all good. pretty good actually today. How are you doing?

7
00:01:11,106 –> 00:01:19,310
Mattias Jadesköld: Fine, thank you. We had some issues with the sound but now it seems to be working. Eric is happy with the sound solution now?

8
00:01:19,310 –> 00:01:23,662
Erik Zalitis: It’s always something is screwing up with the sound and that’s just how it is.

9
00:01:23,662 –> 00:01:33,898
Mattias Jadesköld: Right. Okay, so normally you work as threat research at HP. what do you do on a normal basis, Patrick?

10
00:01:33,898 –> 00:02:30,102
Patrick Schlapfer: I do. That’s a good that’s a good question. Well, I have the fun job to actually look through all the collected telemetry data from our different security solutions, analyze the dead data, and then find all the interesting threats and take them apart. With all the data and the analysis I do, I do then get to write interesting reports such as the quarterly threat insights report. I do also write occasional blog posts, which is published on our threat block and I also do share quite a lot of information with the community because in the end security is a game as a team so sharing is definitely caring. Besides the whole threat research part, I do work together with the defensive security research team so that we can improve security solutions and create new solutions, which hopefully also protect for from the future threats.

11
00:02:30,102 –> 00:02:34,766
Mattias Jadesköld: Right, okay, so a lot of different tasks during a day, I guess. Yeah. And where are you located?

12
00:02:34,766 –> 00:02:42,277
Patrick Schlapfer: Absolutely, yeah. I’m actually located in in Zurich in Switzerland.

13
00:02:42,277 –> 00:02:48,320
Mattias Jadesköld: Okay. Some it’s a bit big difference between Switzerland and Sw Sweden, but

14
00:02:48,320 –> 00:02:49,304
Patrick Schlapfer: Yeah.

15
00:02:49,304 –> 00:02:55,330
Erik Zalitis: They get them confused all the time, isn’t it? Like Yeah, Switzerland and Sweden the same country.

16
00:02:55,330 –> 00:03:00,950
Patrick Schlapfer: Yeah, absolutely. Quite in a different place, but both I would say very beautiful landscapes.

The making of an IT-security pro – How Patrick got started in the business

17
00:03:00,950 –> 00:03:10,168
Mattias Jadesköld: Yeah, definitely. Right. So it seems like you’ve been working with IT security for some years now, but how did it all started?

18
00:03:10,168 –> 00:04:59,008
Patrick Schlapfer: Well, that that was actually quite some time ago. So when I studied at the university, I I grew my interest in security in general. So I decided to take one or the other course in the area of security, like from cryptography to network security to to malware analysis. And I decided that malware analysis is probably the most interesting thing to have a look at because I I quite like to take apart software and understand how it works. So after I finished my degree, I actually had the chance to work as a research assistant directly for the university in a research project. So what we built back then was a dynamic malware analysis sandbox, which we created to through writing a custom Linux kernel module to basically do virtual machine introspection. I was very much into memory forensic at the time, and with the kernel module, we were able to capture the memory of a virtual machine from the hypervisor level. And therefore basically do dynamic analysis without having an in-guest agent. So that was that was the start and that was the whole fun around malware analysis. I later then decided after the research project it would be good to understand how security works in the real world outside academia. So I joined to work for a bank in security operations, and we focused a lot on incident response. but also did a bit of threat intelligence, basically taking apart and analyzing the threats we see and then share it with the community. After working for the bank, I was quite keen to understand malware even more in depth. And that’s when I actually joined HP as a threat researcher almost six years ago. Yeah, and that’s been quite an interesting journey and here we are six years in.

19
00:04:59,008 –> 00:05:06,840
Mattias Jadesköld: Right. So interesting. Yeah, you have a lot of banks in Switzerland, don’t you? So it’s a good way to start. Yeah.

20
00:05:06,840 –> 00:05:24,492
Patrick Schlapfer: Well, I mean I mean back at the time this was one of the I would probably say one of the two main companies who would hire security professionals. The other one was was the government. definitely very interesting project as well, but working for a bank was quite an interesting experience as well.

21
00:05:24,492 –> 00:05:46,552
Mattias Jadesköld: Yeah. Right, so we’re gonna dig into this annual report. It’s as Eric said mentioned in the beginning that it’s called HP Wolf’s Security Threat Insight Report. but a bit overall, w w what’s the reason why this is re report being created annually?

22
00:05:46,552 –> 00:06:40,660
Patrick Schlapfer: Well, we do collect all this valuable thread information, right? And one thing I’d like to say is that it does never represent like the full thread landscape. It’s just yet another different vantage point if we compare it to other security vendors and security companies. And therefore, with all the data we have, we thought, well, it’s very valuable information, so let’s share it with the community. First of all, it gives a lot of security awareness to share a bigger picture of the threat landscape, even on a higher level. But there are also technical lug nuggets in the threat insights report, such as interesting techniques which are used by the attackers, which actually help the security practitioners to understand those techniques and then build protections or build detections against those attacks.

We open the actual report and Patrick delves into the emerging patterns worth knowing right now

23
00:06:40,660 –> 00:06:52,770
Mattias Jadesköld: Right. So but if you compare the this report with previous ones, i is there anything that stands out? It’s a bit different or something?

24
00:06:52,770 –> 00:09:13,346
Patrick Schlapfer: Well that’s that’s a wide question, I think. But there are definitely four I would say like well a couple different things that stand out. well if if if we look back about ten years ago or so, we were used to having those classic attacks with Word documents containing macros, which are then sent as an attachment to the user. And only with probably like one or two clicks your device was infected. Back at the time, like emotet one of the big moller families, which is luckily not not around anymore. nowadays it’s it’s quite a bit different. So from those two clicks, I would say it’s like a click to infection. This increased quite a bit. So nowadays we see that an infection requires more clicks because the user has to open a file, open an archive file, type in a password, and then open. Yeah, probably a script inside it and such kind of things. So this whole amount, number of clicks to infection increased, which also means that attackers and threat actors are focusing a lot more on social engineering. So the social engineering component in the beginning of an attack becomes very relevant for them. So they invest quite a bit of resources to make them more convincing. So the attacker actually Well, performs a specific task. Most often they try to blend in with standard business operations. So it’s very difficult for a user to distinguish between something legitimate and something malicious. Then another thing we’re seeing is that there have be has been this shared intermediate stage. Now, if we look from a higher level at an infection chain of such a cyber attack, we can probably split it into two. into three different stages. We have the initial infection with the social engineering. Then we have an intermediate stage with all the scripts which are running, basically which are responsible to then install the final payload. And then in the end we do have the final payload. And one of the things we’re seeing lately is that not only the social engineering and the final payloads are shared amongst thread actors, but also those intermediate stages. And this tells us that it’s not

25
00:09:13,346 –> 00:10:44,416
Patrick Schlapfer: This one man show where a hacker tries to target an organization, but it’s a full ecosystem of cybercrime that works together. So threat actors can go and buy malware families, intermediate stages, or also all kinds of different lures off the shelf from hacker markets or from hacking forums and such kind of things. And then there’s one thing I didn’t mention yet, but AI is of course also a part of the thread landscape and how it evolves over time, right? So one thing I can see up fr say up front is that we haven’t seen autonomous attacks as they are like shown in the movies. But attackers are making very much use of AI models to then create all kinds of different stages. For example, the intermediate stage which is responsible to install the final payload is very often created through Vibe WIPE coding or so-called white hacking. So they use a model and then they tell the model, hey, in in normal language, create me this specific infection stage, do this and that. And then it creates this very well. And it also works quite well for the social engineering engineering laws in the beginning. So if they want to create like a simple website or if they want to create a simple document or something like this. The AI models are very, very helpful for the attackers in this case. So that would probably be the four main things I would say.

The door within your computer – how hackers use remote tools to take control

26
00:10:44,416 –> 00:11:11,566
Mattias Jadesköld: Yeah, we’re gonna dig in a bit more on some topics and some of them are vibe hacking as Erik mentioned as well. But I I found three interesting topics w which from this report I think we should dive into. So let’s start with the first one. This is about remote tools that hackers are using remote tools like Log Me In or Screen Connect. How does this work?

27
00:11:11,566 –> 00:12:48,096
Patrick Schlapfer: Well, that’s a good question. So, first of all, that’s not something that is entirely new, right? we have seen such attacks in the past, like attackers using official and legitimate remote access tools to to compromise devices. That’s been around for quite some time. Now what’s different now is that we have seen quite an uptick over the last quarter, over the last half a year. So that’s something that stood out. And the second thing is that in the past, whenever I did an analysis of such an installer, I noticed that the thread actor actually modified the installer to connect to attacker control servers, right? So in this case, the whole infrastructure of the legitimate service, such as remote administration tool, is not in the whole scenario. So it’s directly connecting to attacker control servers. What they are doing now is that they take it as is and install it on a victim’s device. Now, this remote access solution then connects to the official service provided by by the application company. And therefore, it is very difficult to distinguish whether this is something malicious or something clean. And the thread actor, all he all they do is basically they have a login to this service. And then they see all the different devices which are connecting to the service, and then they can execute various different commands on the device and basically control it.

28
00:12:48,096 –> 00:12:57,034
Mattias Jadesköld: Okay. So these are all the so these are not just hacking tools, these are like normally remote tools that the hackers are using.

29
00:12:57,034 –> 00:13:58,434
Patrick Schlapfer: Exactly. And that makes it so very difficult, right? those are legitimate tools. Lots of organizations actually use those tools specifically in IT support organizations. So whenever someone has an issue with their device, they they can remote in and fix the problem directly on their device. and it it’s it’s a very similar thing for for all kinds of different software solutions or tools, such as for example, take PowerShell. PowerShell is a brilliant tool for to do like system administration. But in the end, it’s also a very common tool to be used by attackers because it has a lot of possibilities to interact with with the device in the end. So with those remote access tools, attacker are using legitimate software in a malicious way. And in the end that’s very, very difficult to figure out in a network. Because maybe the organization is using specifically such an organ such an application as well themselves.

30
00:13:58,434 –> 00:14:07,320
Mattias Jadesköld: But how how how can I prevent these type of attacks, for example, if I’m working in an IT department in on an organization?

31
00:14:07,320 –> 00:15:22,326
Patrick Schlapfer: Well it’s it’s definitely not an easy task third to attack from such an attack, yeah. it might be probably quite a boring answer, but in the end it is it is also an o an evergreen, but a and and you know this for sure, it’s like have a good inventory. I know it always sounds so easy and it never is because having like a clear and and a complete inventory is pretty much impossible. But having an idea of specific services you’re using can be quite helpful. So if you know that, hey, are you using this or the other remote access tool, then you can monitor for other remote access tools to be used within the same organization, which is probably a lot not legitimate in this case. And then the other thing is that, well, try to install software only from trusted sources. Now in those specific campaigns, thread actors are actually installing the software. So it’s not a user installing the software, but it’s a thread actor. And last but not least, if you control the admin privilege on a user device, then they have less capabilities to install such potentially malicious software on their operating system.

32
00:15:22,326 –> 00:15:31,694
Mattias Jadesköld: Yeah. Erik y you work as a pen tester. Have you ever experienced that that these type of attacks using remote tools?

33
00:15:31,694 –> 00:16:01,426
Erik Zalitis: Well, as a pen tester, I’m trying to do the same, pretty much. So I I can’t say that but as working with this SOC at the Security Operations Center, which I can help at my company, the company I work for, that is. Yeah, we we’ve seen they’re trying stuff like that. Mostly they’re trying stuff like that with phishing attacks. But of course, that’s not the only show, so to speak. So yeah, that’s a thing. No disagreement.

Your money at risk – how crypto wallets get stolen

34
00:16:01,426 –> 00:16:24,888
Mattias Jadesköld: Okay, that’s good. Okay, let’s jump to the next topic, which is also kind of interesting. a bit outside my comfort zone because it’s about crypto w wallet wallets and and restore. that it’s mentioned in the report that is false restoring of crypto wallet wallet wallets. How how does it with this work?

35
00:16:24,888 –> 00:16:34,519
Patrick Schlapfer: Well, it’s Yeah, that’s that’s definitely interesting. So did you ever lose your own crypto wallet?

36
00:16:34,519 –> 00:16:40,750
Erik Zalitis: Don’t have any trouble. That seems like a smart thing. The only way to win this game is not playing it.

37
00:16:40,750 –> 00:17:31,562
Patrick Schlapfer: Exactly. Well, definitely, definitely on my side here as well. Yeah. Well, yeah. what is it? Well, so a crypto wallet i i it’s basically the key to the kingdom, right? So it’s basically a a key that you have locally on your device. if you decide to have it locally, it’s a private key, which allows you to gain access to the whole crypto assets you have. the crypto assets themselves are actually stored on the blockchain, such as Bitcoin as an example, but the the private key is something you keep to yourself, in hence the name private key. Now, if an attacker is able to get access to such a private key, then they basically control all the funds you have on the specific blockchain, which is quite a big disaster in this case.

38
00:17:31,562 –> 00:17:38,506
Mattias Jadesköld: Yeah. Because the banks cannot help you in this case because it’s decentralized, like Bitcoin, for example.

39
00:17:38,506 –> 00:18:43,360
Patrick Schlapfer: Exactly. it’s decentralized. So there’s no help from from anyone. and if if if an attacker controls the private key, they can basically redirect all your bitcoins or whatever cryptocurrency you are you are using to yet another wallet because they have the private key and with the private key they can easily sign new transactions, which then sends the money to someone else, which presumably in this case will be a tactor in its own. That’s why our attackers are so interested in finding local crypto wallets and exfiltrating those private keys. So this is a very common technique when we look at all kinds of different information stealers. They are usually built in a modular way where they have like all kinds of different capabilities, such as like password stealing or I don’t know, browsing history stealing. And one of those modules is definitely always like crypto wallet stealers. Because a crypto wallet can contain quite a lot of money in those days. So if they get hold of one of those wallets, then well, they might be rich at some point.

40
00:18:43,360 –> 00:18:50,954
Mattias Jadesköld: Okay, but how does it work with with restoring a crypto wallet?

41
00:18:50,954 –> 00:20:27,803
Patrick Schlapfer: Now this is this is actually the interesting part because this is this is just use as the lure, right? So imagine yourself you lost your crypto wallet on your device and now you’re quite desperate because this is a lot of money. And you want to find this crypto wallet again. so what’s the steps you take? Well, in this desperation, you probably reach out to the internet and search for tools that can recover your crypto wallets because it’s a a lot of money. And that’s basically where the users get trapped. Because the attacker set up this GitHub repository to tell the user, hey, I built this solution, and this solution will actually help you to find your lost crypto wallet on your device. In reality, in reality, it doesn’t do it. In in reality, what happens if you download this crypto wallet recovery tool is that, well, It exfiltrates all kinds of interesting and sensitive information. At some point, they do promise what they claim. They do indeed recover your crypto wallet, but they don’t give it to the user. But they simply exfiltrate this crypto wallet and send it to the attacker’s server. So besides system information, passwords and browsing data, as I mentioned earlier, they of course also collect crypto wallets. They are They they compress it in an archive file and then they send it to an attacker control server in this case. So yeah, unfortunately no crypto wallets recovery tool here.

42
00:20:27,803 –> 00:20:31,775
Erik Zalitis: All I can say is empathy is not a thing with them.

43
00:20:31,775 –> 00:20:35,119
Patrick Schlapfer: No, absolutely not. No.

44
00:20:35,119 –> 00:20:44,482
Mattias Jadesköld: But how c how can I if if I’m having if I’m worried about this, how should I avoid these type of attacks?

45
00:20:44,482 –> 00:21:45,394
Patrick Schlapfer: Well, if you actually lost your crypto wallet on your device, then yeah, it is very frustrating. I do understand this, but don’t act too fast. First of all, I would probably try to investigate well, where is this crypto wallet actually stored on the device? Like in which folder does it normally reside? And I think that’s very different depending on the blockchain you’re using. Yeah. Then in the end you have different names, right? Different file names. So what I would suggest if you actually lost it, go and search and investigate how this crypto wallet is built, where it usually resides and what the fail file name is. And then use like built in Windows tools or Linux tools if you’re if you’re using Linux to search for the files in the different folders. That’s definitely better than downloading a random application from an untrusted source. Yeah. Because yeah, well In this case, they were definitely proved to be something malicious.

ClickFix – the word you need to know

46
00:21:45,394 –> 00:22:08,640
Mattias Jadesköld: Right, okay. Let’s go to the third topic, I guess. This called ClickFix campaign. this was there was this was this some sort sort of recent attack related to clickfix. What is clickfix?

47
00:22:08,640 –> 00:22:46,112
Patrick Schlapfer: Well, ClickFix has actually been around for well, I don’t want to say anything wrong, probably one or two years now. So it’s been around for quite some time. But during this time, they did evolve the attacks and the campaigns. So ClickFix is in the end a social engineering technique. So what happens is that an attacker builds like a social net social engineering website or a social engineering image. Which convinces the user to basically paste some malicious codes into the local Windows run box and then execute malicious code.

48
00:22:46,112 –> 00:23:22,028
Erik Zalitis: I actually interesting you would say that because I actually investigated such a code a few weeks ago. and it was extremely clever. It tried to look like some kind of cloud flare warning that says please click and execute this in in the runbox. And I actually looked through the code and it was extremely well obfuscated, w sending those deobfuscator tools into some sort of eternal loop. The obfuscation level of that was like eleven out of ten. Enormously well done. Seriously.

49
00:23:22,028 –> 00:23:32,235
Patrick Schlapfer: Yeah, I I totally believe that. We have seen so many different, like specifically obfuscated scripts which are terrible to analyze and I definitely like I I do understand your frustration. I’ve spent hours picking apart like JavaScript code or BB script code, which is like it’s unbelievable what kind of techniques attackers can make use of to to obfuscate their scripts.

50
00:23:32,235 –> 00:23:46,934
Erik Zalitis: Like yeah, I know.

51
00:23:46,934 –> 00:23:53,954
Erik Zalitis: I I don’t like hackers very much, but I respect them. I y begrudgedly I do respect them.

CAPTCHAs – annoying but obviously needed

52
00:23:53,954 –> 00:25:10,008
Patrick Schlapfer: Well, in this case, I I actually have to give it to them specifically for for the idea to create such a social engineering lure, right? I mean in the past, like if you remember the good old Word and Excel documents where they tried to convince the user to click the enable button to basically run the in included VBA macros. Now this was quite basic and this this was around for probably like ten, fifteen years or so. Now, this is a totally new concept. And I I think that is quite interesting. And now if you think around, well, it’s been this Cloudflare cap cap capture you mentioned, if you think back like many, many years ago, those captures are not something that are new, right? Because in the end it’s it’s like just the idea to distinguish whether you’re an actual user or if you’re a robot or if you’re some kind of crawler accessing the website. I remember like Many years ago, like even like simple web forms had such a very simple CAPTCHA where you get like two numbers, so you have to add them together, and then you have to type in the number in a specific field and only if the answer was correct your form was submitted, basically to prevent automated attacks.

53
00:25:10,008 –> 00:25:24,450
Erik Zalitis: Yeah I remember that too, I remember that too. Th the the kind of distinction between them were there were two kinds they were super secure and no human beings could solve them, or they were very easy to solve and any hacker could solve them.

54
00:25:24,450 –> 00:25:44,846
Patrick Schlapfer: Yeah, I mean that that’s absolutely true. I mean I remember well when when you get like those other captures like hey yeah click on all the pictures which contain a mountain, click on all the pictures which contain I don’t know, a bicycle or a car. And I and I remember sitting in front of the PC like like clicking all the images and then next and then there’s the next coming up.

55
00:25:44,846 –> 00:26:12,898
Erik Zalitis: It felt like never got it right. It’s like, what the heck? That’s supposed to be a mountain, but obviously not for some reason. And another thing was back in the day of PHP BB, if you remember that forum, it had the worst capture ever. No humans could solve it because it was slanted R’s and S and X and nobody see. Is that a Y or is it a W or whatever? I can’t see it. And the hackers had no problems breaking it for.

56
00:26:12,898 –> 00:27:17,430
Patrick Schlapfer: Yeah, exactly. And and is it like is it uppercase or is it lowercase? Yeah, I I know exactly what you mean. And and and in the end, like let’s be honest, that that’s been one of the issues for the user here, right? I mean, like we can come up with so many different types of captchas that we have seen over the last, I don’t know, maybe twenty years or so that for a normal user who is not like used to work with like those captures every single day, it’s very difficult to know well, what is the next technique a company like figures out to hip to build such a capture. So like at some point it’s you have to select the mountains in another, you have to like have this like maps puzzle, like and and and whatnot. So it can very likely be that at this point you have to execute the specific commands of of of key combinations. So like pressing like Windows R, control V and enter doesn’t seem to be so far fetched. And in the end the normal user has no idea what Windows R does, does do they? So that’s very tricky.

57
00:27:17,430 –> 00:27:28,802
Erik Zalitis: Y d how do you teach people not to do stupid things when everything that’s stupid looks exactly the same way thing f way that things that are smart?

58
00:27:28,802 –> 00:27:45,110
Patrick Schlapfer: They have absolutely no idea. And and if you remember, the user went to this website for a specific purpose. They want to consume the content on this specific website. So all they want is to to get this capture out of their way so they can actually access the website they were looking for.

59
00:27:45,110 –> 00:28:13,292
Erik Zalitis: And people don’t expect that to happen because one of the things where I was checking a few weeks ago, that was like a food site, like a restaurant here in Sweden that was hacked. So it wasn’t like malicious, but it had been hacked by WordPress, if if you know, and and that kind of injected code in the JavaScript that ran this Cloudflare fake. So people weren’t expecting. I mean, you go to a restaurant site, you don’t expect to get hacked.

60
00:28:13,292 –> 00:28:45,190
Patrick Schlapfer: No, not at all. That’s definitely the case. And it’s been the case for so many different websites, especi especially like like in in industries which are not that close to IT and are even further away from IT security. All they need is they need to have a simple website to show what is going on within their organization, to promote like the daily dish or something like this. So so that’s definitely a good target for an attacker and definitely difficult for a user to understand. That something is wrong on this website.

Clicking images to prove you’re human isn’t an easy task for everyone

61
00:28:45,190 –> 00:29:01,870
Mattias Jadesköld: Yeah. And as a user is it’s kind of stressful because a lot of things is on stake because in the beginning they say if you don’t succeed in this capture, you’re not human. It’s like i if I if I can’t find all these mountains or traffic signs, then I’m then I’m a robot, obviously, or something.

62
00:29:01,870 –> 00:29:26,348
Erik Zalitis: The problem is also you can expect people to be the same, but they aren’t. I mean that’s to say some people may actually be old and they have problems understanding these things because they don’t they don’t have the skills. Some people may have some kind of mental deficiency, making it possible impossible for them to solve the captions. This is not the level of playing field.

63
00:29:26,348 –> 00:29:30,059
Patrick Schlapfer: Yeah, absolutely agree with that. Yeah.

64
00:29:30,059 –> 00:29:39,022
Mattias Jadesköld: about this clickfix campaign that was mentioned in the report, there was something about malicious code within a sound file. How how does that work?

65
00:29:39,022 –> 00:31:54,882
Patrick Schlapfer: Exactly. Well, if we look like quickly at the evolution of those click fix campaigns, it’s that basically what happens is that the attacker copies malicious code into the clip port of the user. Then the user wants to fulfill the capture, so they press the key combination like Windows R, Ctrl V and turn. That’s basically how they execute the malicious code, right? And in the beginning, The thread actors always use PowerShell because PowerShell is just so common. You execute PowerShell, you can supply an encoded command in base64, and then the whole device is infected. Now, of course, various different solutions which build detection in A-B systems actually kept up and improved their detection and are therefore able to block such an attack. But yeah, attackers usually find a way around it. So what the attackers did is instead of launching PowerShell, they decided to use MSHTA. And MSHTA is very often used to display those help messages if you press F1 in an older program. It it shows up and then you have a library of all kinds of different documentations. But what you can do in this case, you can also simply supply an HTML document which contains script code, which is then Executed on the host system because there is simply no sandbox. So what the thread actor did in this case is that they simply put in the command line MSHTA and then a link to a sound file. Now, this is not actually a sound file, but it is just using the extension of sound files. And the reason here is that if you look at the web gateway logs, which is something the Security Operations Center usually does. Then they will realize that okay, a sound file was downloaded to the specific device, but it doesn’t suspect anything malicious. Now, in reality, the sound file is actually a script file. In this case, HTML file contained with JavaScript. An MSHTA doesn’t really care what kind of file extension you’re using. So you can use like any kind of like

66
00:31:54,882 –> 00:32:36,790
Patrick Schlapfer: Sound file or picture or movie file, it simply executes and renders the files in HTML within this box. And that’s basically the a trick we see quite often used by thread actors, basically assigning either a wrong file extension or assigning double file extensions. So for example, if a user by default hides file extensions, then there tricked with a double extension to think that an executable file might be a PDF or that an executable file might be a Word document or something like this. So this is quite a common technique used by Chad Actor nowadays.

67
00:32:36,790 –> 00:32:46,892
Erik Zalitis: That seems old, doesn’t it? I mean the whole thing with double extensions is like ”I love you”, virus days. That’s still a thing you should. Yeah.

68
00:32:46,892 –> 00:33:50,135
Patrick Schlapfer: Yeah, it’s it’s super old. I mean like so many techniques are so super old and they still work nowadays, which is to me on the one hand quite surprising. But on the other hand, like we didn’t solve the simple security problems probably as an industry. And that’s that’s quite difficult. How do you teach a user to not click on a specific file? Like We usually get also the question, well, if you have this archive file which is distributed by an attacker, and within this archive file there’s a script file, such as like JavaScript or VPS. Why should a user open this specific file? Because it’s not a document, is it? Well, in the end, the user has no idea, right? The user has no clue whether this is an actual document or if this is a script file or or or if this is an executable file or whatever. A normal user doesn’t even know what a script file is. And that’s how we have to look at it. And that’s why we have to build like technical protections against such attacks.

69
00:33:50,135 –> 00:33:51,674
Mattias Jadesköld: Yeah.

Nothing new under the sun – hackers find new use for old attacks

70
00:33:51,674 –> 00:34:09,144
Erik Zalitis: This is kinda scary because nothing of this feels new. It feels like you’re using very old technology onto the user because I do believe that many of those health file files is that f really used anymore? Isn’t that kinda a legacy component?

71
00:34:09,144 –> 00:34:57,570
Patrick Schlapfer: That that is a really good question. And I so in new applications, if you press one, you’re usually redirected to a website, right? Yeah. I still imagine that there are quite a lot of older applications which do have this helper function implemented through MSHTA. but yeah, that’s that’s actually a really good question. I haven’t come across many of those, but certainly MSHTA is still part of the operating system, which makes it in in in some sense even more dangerous for an organization, because an organization might lose track of such an executable, and therefore they don’t track it anymore in their detections and then in their protection mechanisms and therefore open yet another hole and attack infection vector for threat actors.

72
00:34:57,570 –> 00:35:24,462
Erik Zalitis: was thinking about is it using the Trident engine? That’s like Internet Explorer. Could it be that old? I mean that’s a thing to just like thinking about because Windows such as it is has a lot of legacy code, stuff that was around in the nineteenth and the 2000s, such as it was. And that is not secure. And a lot of it is kind of abandoned but still for some reason works.

73
00:35:24,462 –> 00:36:37,670
Patrick Schlapfer: Totally, totally agree. I mean, if you remember, it’s it’s a long time ago, but to be honest, we’re still seeing them. Remember the equation editor exploits? Like where you had like a malicious RTS document, and then there was a a vulnerability within the Word’s equation editor and the thread actor was actually able to well, exploit this vulnerability and download and execute the file from a remote server. Now, this has been legacy code for a very long time. And this has been on Windows system for ages. And in the end, Microsoft actually got rid of this whole equation editor because they had a very new version in new office installations. But nevertheless, we still see attackers using this specific exploit and targeting all kinds of different users. I I believe myself that this equation editor is gone on most devices nowadays because that’s been like twenty seventeen actually. But for some reason they’re still using it. So probably there is still one or the other device which contains this equation editor and therefore is still vulnerable to this exploit.

From observing to protecting – how do you get there?

74
00:36:37,670 –> 00:36:45,314
Mattias Jadesköld: Right. And how how do I prevent these attacks from happen for me?

75
00:36:45,314 –> 00:38:41,698
Patrick Schlapfer: Well, to prevent such a click fix attacks is certainly not something that is easy, right? in the end well well, you’re on Linux, even though well if you’re around Linux you do have different distributions and you have like like T shortcuts and so on. In the end it’s it’s very difficult also for a user to understand. But nevertheless, I think this this whole concept of the social engineering technique should be part of like an awareness program where you tell the users how to behave. in the end, however, this doesn’t solve the problem, right? Awareness is just one aspect, but you have to have a technical solution to protect the users. So one thing I I can think of is that in most cases they use Windows R, which opens the runbox. Like a normal user in everyday work, they don’t use the runbox at all. So what you can do is you can use group policies, for example, to disable the runbox entirely. An alternative solution is that, well, if you have a secure browser, so so HP basically has this kind of isolation technology where we embed a browser within a micro VM, and there you can disable the clipboards from being used by the website. Because a normal website can usually simply write to the clip port if the user clicks a button. There is different permissions you can also set in an in a regular browser, but as far as I know, in most cases it is very difficult to determine from reading from the clipboard, which is very sensitive and can be restricted, to writing to the clipboard, which is often not possible to restrict by the normal user or in the normal browser. So there were various different approaches to protect from such an attack. And I think in the end it has to be a combination of all of those.

76
00:38:41,698 –> 00:38:45,644
Mattias Jadesköld: All right.

77
00:38:45,644 –> 00:38:48,682
Mattias Jadesköld: Any idea, Erkc? How to print this?

78
00:38:48,682 –> 00:39:37,964
Erik Zalitis: Yep, that’s the problem. Should you teach people not to do dumb dumb stuff? Should you lock their computers down? Depends on. I mean, when people are taught not to do stuff, the hackers kinda mutate the attacks. So they don’t look like what the people were taught not to do. And secondly of all, all those mechanisms also suffer the same fate. Basically put, everything looks good now, but the hackers always evolve the attack. Try something a little bit differently. It passes through whatever you lock down. That that’s a problem. It’s very hard. You can of course say don’t do stuff that feels wrong. If it feels like the gut feeling is like this is weird. Should I really click? Should I really really do this? If the website says click this and this combination, is that really a good thing to do? I I think that’s the b only thing you can do, basically.

79
00:39:37,964 –> 00:39:54,590
Mattias Jadesköld: Yeah. Right. So yeah, a lot of interesting topics that you can read more about in this report. And and that is public available, right, Patrick. So I can we can share this this the link to the report

80
00:39:54,590 –> 00:40:23,370
Patrick Schlapfer: Exactly. Yeah. The report is available on on our on our blog websites. There is also there are all kinds of other blog posts we usually publish around like different malware campaigns, but around all kinds of other security topics as well. If people are interested to have a look there as well. And there’s actually a new report coming, probably mid end September, which will be published pretty soon. So I’m actually doing the analysis at the moment for this specific report.

HP’s report – something you can count on coming out often

81
00:40:23,370 –> 00:40:26,434
Mattias Jadesköld: I thought this was an annual report, but no, okay.

82
00:40:26,434 –> 00:40:53,166
Patrick Schlapfer: No, it’s actually a report we do four times a year. right. So we usually try to cover like each quarter of the year. so we’re doing this for a couple of years now. So having the capability to actually look back, hey, how did everything like start like seven, eight years ago? And how does it look today? How did the thread landscape change? And there were definitely a few quite interesting changes, as I mentioned earlier in this talk.

83
00:40:53,166 –> 00:40:58,770
Mattias Jadesköld: But I hope this was not outdated information that we just gave.

84
00:40:58,770 –> 00:41:31,495
Patrick Schlapfer: No, no, no, no. No, no. Definitely not outdated. I I think like most of those, like most of those techniques are being used by thread actors for quite a long time. I mean what what you mentioned earlier is that thread actors adapt very, very quickly to smaller techniques. So they try to get around your protection mechanism. They try to trick their user into installing something. But in the end, over the long term, that the techniques and tactics stay more or less the same if we look at a higher level at it.

85
00:41:31,495 –> 00:41:40,758
Mattias Jadesköld: Yeah. Right. Is there anything you would like to add? what we miss?

86
00:41:40,758 –> 00:42:05,068
Patrick Schlapfer: I think we did quite cover quite a lot of different topics. Yeah. So doesn’t come anything specific to mind. just have a heads up when you’re seeing the next capture, if it’s a real one or if it’s a fake one. Don’t affect yourself with malware. Yeah. Don’t go and search for your lost crypto wallet with fake tools. yeah, stay safe out there.

87
00:42:05,068 –> 00:42:15,310
Mattias Jadesköld: Yes. Good. thank you so much, Patrick Schlapfer, that you for joining IT-säkerhetspodden.

88
00:42:15,310 –> 00:42:19,544
Patrick Schlapfer: Thank you so much. It’s been a very interesting discussion. Thank you for having me.

89
00:42:19,544 –> 00:42:22,544
Erik Zalitis: Thank you much.

(Denna transkription är automatiskt genererad och kan innehålla felhörningar)

Länkar – AI

• HP Wolf Security Threat Insights Report: June 2026

Felaktigheter

Inget att rapportera denna gång. Kommentera gärna om ni inte håller med om hittar fel i något vi sagt.

Inlägget #334 – Angripare tar till ”vibe hacking” dök först upp på IT-säkerhetspodden.