Microsoft warns that a fake ChatGPT desktop app was used to deliver PipeMagic malware, linked to ransomware attacks exploiting a Windows zero-day.

[Brownie2019]

Content source

https://hackread.com/fake-chatgpt-desktop-app-pipemagic-backdoor-microsoft/

Cybersecurity researchers at Microsoft discovered a new backdoor called PipeMagic while investigating attacks that abused a zero-day flaw in Windows CLFS (CVE-2025-29824). What makes this backdoor dangerous is how it poses as a legitimate open-source ChatGPT desktop application while delivering a framework for running ransomware operations.
PipeMagic relies on a modular design that loads different components as needed. These modules handle everything from command-and-control communication to payload execution, all while staying hidden through encrypted named pipes and in-memory operations. By separating its functions this way, the backdoor makes it far more difficult for defenders to detect or analyze.

Read full Story here:

Fake ChatGPT Desktop App Delivering PipeMagic Backdoor, Microsoft

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

hackread.com

 

[Khushal]

Read full Story here:

Fake ChatGPT Desktop App Delivering PipeMagic Backdoor, Microsoft

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

hackread.com

https://www.microsoft.com/en-us/security/blog/2025/08/18/dissecting-pipemagic-inside-the-architecture-of-a-modular-backdoor-framework/

PipeMagic in 2025: How the backdoor operators’ tactics have changed

We examine the evolution of the PipeMagic backdoor and the TTPs of its operators – from the RansomExx incident in 2022 to attacks in Brazil and the Middle East, and the exploitation of CVE-2025-29824 in 2025.

securelist.com

 

[anirbandutta01]

Cybersecurity researchers have lifted the lid on the threat actors' exploitation of a now-patched security flaw in Microsoft Windows to deploy the PipeMagic malware in RansomExx ransomware attacks.

The attacks involve the exploitation of CVE-2025-29824, a privilege escalation vulnerability impacting the Windows Common Log File System (CLFS) that was addressed by Microsoft in April 2025, Kaspersky and BI.ZONE said in a joint report published today.

PipeMagic was first documented in 2022 as part of RansomExx ransomware attacks targeting industrial companies in Southeast Asia, capable of acting as a full-fledged backdoor providing remote access and executing a wide range of commands on compromised hosts.

In those attacks, the threat actors have been found to exploit CVE-2017-0144, a remote code execution flaw in Windows SMB, to infiltrate victim infrastructure. Subsequent infection chains observed in October 2024 in Saudi Arabia were spotted leveraging a fake OpenAI ChatGPT app as bait to deliver the malware.

Earlier this April, Microsoft attributed the exploitation of CVE-2025-29824 and the deployment of PipeMagic to a threat actor it tracks as Storm-2460.

Malware News - Microsoft Windows Vulnerability Exploited to Deploy PipeMagic RansomExx Malware

Cybersecurity researchers have lifted the lid on the threat actors' exploitation of a now-patched security flaw in Microsoft Windows to deploy the PipeMagic malware in RansomExx ransomware attacks. The attacks involve the exploitation of CVE-2025-29824, a privilege escalation vulnerability...

malwaretips.com

 

[anirbandutta01]

Kaspersky said it also uncovered PipeMagic loader artifacts masquerading as a ChatGPT client in 2025 that are similar to those previously seen in October 2024. The samples have been observed leveraging DLL hijacking techniques to run a malicious DLL that mimics a Google Chrome update file ("googleupdate.dll").

 

[Parkinsond]

a remote code execution flaw in Windows SMB

That is why I uninstall SMB immediately after Windows install.

 

[Andy Ful]

The exploit was fixed on April 8, 2025. However, there are many similar & uncovered vulnerabilities.

 

[Parkinsond]

The exploit was fixed on April 8, 2025. However, there are many similar & uncovered vulnerabilities.

There is always vulnerability; it is life.

 

[anirbandutta01]

However, there are many similar & uncovered vulnerabilities.

Yes it's really concerning & we need to alert.

 

[stonjean633]

There is always vulnerability; it is life.

It's part of the business too.

 

[Parkinsond]

It's part of the business too.

It will be vulnerability and patch, bug and fix, and this will last until the end of life on earth

 

[Andy Ful]

It will be vulnerability and patch, bug and fix, and this will last until the end of life on earth

When I look at the starry sky, I think you are too optimistic.