Oops, No Victims: The Largest Supply Chain Attack Stole 5 Cents

-
Image
The Biggest NPM Supply Chain Attack What is a Supply Chain Attack? A supply chain attack occurs when attackers target trusted third-party components, such as libraries or registries, instead of attacking users directly. By injecting malicious code at the source, they can spread it to all downstream users. These attacks are dangerous because updates happen automatically in build pipelines, making detection harder. A small modification in a common dependency can silently compromise thousands of projects. Defenses require strong authentication, artifact signing, reproducible builds, and active monitoring of supply chain integrity. Introduction On September 8, 2025, the npm ecosystem faced one of its largest compromises. A maintainer’s account was hijacked, and malicious versions of popular packages were published. Since npm packages are used globally in countless projects, the exposure was immediate and severe. Although the financial damage was limited, the operational dis...
Post a Comment

Sometime slash might be Unicode Hiragana

-

Cybercriminals Exploit Unicode Trick to Mimic Booking.com in Phishing Scam

Threat actors have launched a new phishing campaign targeting Booking.com users, leveraging Unicode characters to disguise malicious links as legitimate ones. This attack shows how easily scammers can trick people with subtle visual deceptions.

How the Attack Works

The campaign uses the Japanese hiragana character “ん” (Unicode U+3093) inside phishing URLs. On some systems and fonts, this symbol looks like a forward slash (/) or part of a subdirectory, making the fake URL appear genuine.

For example, a phishing email may display the link (appears safe but is deceptive):

https://admin.booking.com/hotel/hoteladmin/...

But the actual malicious hyperlink is different (neutralized below for safety):

https://account.booking.comんdetailんrestric-access.www-account-booking[.]com/en/

At first glance, it looks like a real Booking.com page. In reality, the true registered domain is “www-account-booking[.]com”, not booking.com. Everything before that is just a deceptive string.

phishing link image

The Payload

Clicking the link leads victims to a malicious site that delivers a malicious MSI installer hosted on a CDN (neutralized for safety):

hxxps://updatessoftware.b-cdn[.]net/john/pr/04.08/IYTDTGTF.msi

When executed, the installer can drop additional payloads such as information-stealing malware or remote access trojans (RATs), giving attackers access to the victim’s device.

Samples of this attack have been shared on MalwareBazaar and analyzed using any.run, confirming the infection chain.

Why Homoglyph Attacks Work

This technique is part of homoglyph (or homograph) attacks, where characters from other alphabets look almost identical to Latin ones.

For example:

  • Cyrillic “О” (U+041E) looks the same as Latin “O” (U+004F).

The use of “ん” is another example, exploiting typography and human error to trick users into trusting malicious links.

Previous Booking.com Phishing Campaigns

This isn’t the first time attackers have abused Booking.com:

  • In March 2024, Microsoft warned about phishing campaigns targeting hospitality workers with malware-laced emails posing as Booking.com.
  • In 2023, Akamai reported hotel guests being redirected to fake Booking.com pages to steal credit card details.

The latest campaign proves that Booking.com remains a lucrative target for cybercriminals.

How to Protect Yourself

Here are key steps to defend against homoglyph phishing:

  • Check the domain name carefully — the real domain is the part just before the first /.
  • Hover over links before clicking to reveal their actual destination.
  • Be extra cautious on mobile devices, where limited screen space makes spotting fake domains harder.
  • Keep security software updated, since many phishing kits deliver malware immediately after a click.

Final Thoughts

This Unicode-based phishing campaign highlights how attackers exploit tiny details to fool even careful users. As cybercriminals grow more inventive, vigilance is essential. A single deceptive character can turn a trusted site like Booking.com into a dangerous trap.

Comments

Post a Comment

Popular posts from this blog

Flask Cookie

-
Image
A cookie is a small piece of data stored on the user’s browser by a website. It helps websites remember user preferences, authentication status, and other session-related data. Key features of ccookies: ✅ Stored on the client-side (browser). ✅ Sent with each request to the server. ✅ Used for sessions, authentication, tracking, and personalization. ✅ Can have attributes like expiration time, HTTPOnly, Secure, and SameSite for security. 🏗 What is a Flask Cookie? A Flask cookie is a way to store data on the user’s browser using Flask’s set_cookie() method. Flask allows developers to set, read, and delete cookies easily. How Flask Uses Cookies: 1️⃣ Setting a Cookie: resp.set_cookie('key', 'value') 2️⃣ Getting a Cookie: request.cookies.get('key') 3️⃣ Deleting a Cookie: resp.set_cookie('key', '', expires=0) from flask import Flask, render_template, request, url_for, redirect, make_response, flash, session import rand...
Read more

AI Agents Assemble: The Future Just Got Smarter!

-
Image
AI Agent 🤖             An  AI Agent  is a computer program that can think and make decisions like a human. It works by observing its surroundings, deciding what to do, and then taking action. These agents are designed to solve problems, complete tasks, and even learn from their mistakes. They don’t need someone to tell them what to do every time they can work on their own. AI Agents use logic, planning, and sometimes learning to get better over time. They can respond to changes, make choices, and keep improving. In simple words, an AI Agent is a smart system that can act on its own using artificial intelligence. It behaves in a way that helps it reach its goals effectively. 1. key Features of an AI Agent:              An AI is an smart software program, that can think, learn and take actions on its own, the key features of an AI Agents includes Reasoning, Acting, Observing, Planning, Col...
Read more

Convolution Neural Network

-
Image
What is a Convolutional Neural Network (CNN)?      A Convolutional Neural Network (CNN) is a type of deep learning model specifically designed to process visual data like images and videos. It works by automatically learning patterns such as edges, textures, shapes, or objects from images without needing manual feature engineering. CNNs are inspired by the way the human visual cortex works and are widely used in computer vision tasks like image classification, object detection, face recognition, and more. CNNs reduce the complexity of image data using a structure of layers that include convolution layers, pooling layers, and fully connected layers. Each layer plays a unique role in extracting, simplifying, and interpreting the visual features. By stacking multiple such layers, CNNs can identify complex patterns and even recognize complete objects. One major advantage is that CNNs learn spatial hierarchies—starting from small patterns like edges to entire objects. CNNs ha...
Read more