Fake X-VPN Installers Spread Credential-Stealing Malware; Official App Unaffected
Threat researchers discovered a campaign distributing fake X-VPN installers containing STX RAT malware that steals credentials and grants remote access to infected machines. The malware was not the result of a breach of X-VPN itself, but rather targeted users downloading from unofficial sources, initially focusing on cryptocurrency traders before expanding to privacy-conscious users. The discovery underscores the importance of downloading software only from official sources and keeping applications updated.
Security researchers at Cyderes uncovered an active malware campaign using counterfeit X-VPN installers to deploy STX RAT, a credential-stealing malware that enables remote code execution. The attack employed DLL sideloading, where attackers embedded a malicious file named CRYPTBASE.dll into legitimate X-VPN program files, allowing the malware to inject directly into system memory while the installation appeared normal. The campaign included 11 malicious packages targeting cryptocurrency platforms (Binance, Bybit, MetaTrader 5, Exodus) and Steam, initially focusing on crypto traders before pivoting to X-VPN to reach privacy-conscious users. X-VPN's official download channels and servers were not compromised; only users who installed from attacker-controlled sources were at risk. The company responded by releasing version 77.5.3 with hardened DLL loading controls. Experts recommend downloading software exclusively from official websites or authorized app stores, keeping applications updated, and using reputable security software as additional protection.
What different sources said
- TechRadarCenter
Fake X-VPN installers found to spread credential-stealing malware — here's how to stay safe
Related
Potensic Atom 3 Drone Offers DJI Alternative for Global Markets, But Faces US Import Ban
Potensic has released the Atom 3, an upgraded beginner drone featuring a larger sensor, 4K 60fps video, improved battery life, and AI tracking capabilities at competitive pricing ($429.99-$549.99). The drone competes directly with DJI's Lito X1 but faces the same regulatory barriers as DJI in the US market due to a ban on foreign-made drones. The availability restrictions highlight ongoing US trade restrictions on Chinese drone manufacturers and limit consumer choice in the American market.
Wing and Walmart Expand Drone Delivery to Seven Additional U.S. Cities
Alphabet-owned Wing and Walmart are expanding their drone delivery partnership to seven new U.S. cities including Memphis, New Orleans, Philadelphia, Phoenix, San Diego, the San Francisco Bay Area, and Salt Lake City. The expansion is part of a plan to reach over 270 Walmart locations by next year, building on successful deployments in Atlanta, Dallas-Fort Worth, and Houston. The move signals that drone delivery is transitioning from a novelty service to a mainstream logistics option, with Wing having completed over 1 million commercial deliveries.
Anthropic CEO Calls for FAA-Style Regulation of Powerful AI Models
Anthropic CEO Dario Amodei published an essay calling for government regulation of powerful AI models, comparing the approach to FAA oversight of commercial aviation. The proposal includes mandatory third-party testing for frontier models and potential government authority to block or delay their deployment if they pose safety risks. The call comes as Anthropic released Claude Fable 5 and an updated Claude Mythos 5 model with advanced cybersecurity capabilities.