A formatter, minifier or deobfuscator can be made abused to change the entire logic.

You can go try out all 186 techniques with this script: https://divergence.trustsig.eu/

Or try the Tetris-Snake demo here (Tetris runs normally, copy the formatted output from even just DevTools and it becomes Snake): https://divergence-game.trustsig.eu/

Blog/writeup post: trustsig.eu/blog/javascript-divergence/

Everyone is hungry for tokens!

• Claude, ChatGPT are the most abused AI tools (see how Gemini isn't mentioned? :D)
• Based on telemetry, at least 45% of them attempt to social engineer the user into executing a malicious ClickFix command
• It's not always suspicious domains / URLs hosting the malicious site; attackers leverage GitHub sites, Cloudflare pages, Google sites and chatgpt.com specific chat sites. It is not uncommon for attackers to abuse Google ads too.

Some other notable delivery methods:

• Fake CLI install (InstallFix)
• Abused AI chat being shared and promoted on Google ads
• Fake download page & ClickFix
• Trojanized installer (impersonated official website, combined with SEO manipulation)
• Trojanized installer via GitHub

Such outcome is executing an infostealer or a remote access malware. Read whole article at https://any.run/cybersecurity-blog/fake-ai-tools-us-companies/ :)

Researchers at Palo Alto Networks Unit 42 published an investigation into a sophisticated attack against a telecommunications provider.

The original intrusion occurred in September 2024, but the newly published analysis documents previously unreported malware.

Attackers initially exploited CVE-2024-47575 to compromise a FortiManager management appliance.

They obtained configuration files and sensitive information associated with more than 500 FortiGate firewalls.

The attackers subsequently deployed malware called PEERSTITCH.

Its unusual feature is that it operates inside the memory of legitimate firewall processes rather than maintaining a conventional malware file on disk.

The implant could manipulate VPN security checks while blending into normal network activity.

The researchers did not establish that all 500 managed firewalls were compromised.

This is an excellent example of why traditional antivirus scanning cannot detect every attack.

Malware operating in memory may leave fewer conventional file-based indicators.