Weekly Cyber Briefing: 01 December 2025

Assured’s head of incident response reacts:

Typosquatting (or domain squatting) remains a serious problem for established brands. Many of our clients have, to their surprise, found impersonations of their websites across the internet and have had to go through the cumbersome process of proving ownership to ISPs, requesting takedowns, and pursuing legal action against the perpetrators.

The intended victims of typosquatting attacks are almost always your customers, employees, or partners. If the attack is successful, the question of who is responsible for the compromise arises.  Perhaps more importantly, who bears the cost for the resulting compromise?

Ultimately, the answer to this question is irrelevant. From a brand-protection standpoint, legal responsibility is another matter. If a customer has lost money or an employee has handed credentials over to a threat actor through a typosquatting attack, they will, at minimum, associate the incident with your company and, at most, blame your company entirely. They wouldn’t blame the criminal who registered ‘rnicrosoft.com’, they’d blame Microsoft. If you’re serious about your reputation and brand protection, any losses are your responsibility.

Your best bet is to take the steps necessary to prevent these attacks in the first place. Our clients often ask us: “Outside of just purchasing every vaguely similar domain name to ours, what can we do to prevent and respond to these types of attacks?” This is our advice:

• Use automated typosquatting monitoring – services that continuously generate thousands of realistic typo combinations (keyboard walks, missing dots, homographs, wrong TLDs, etc.) and crawl them daily for:
  1. Live phishing/malware pages
  2. MX records pointing to real mail servers (credential harvesting)
  3. SSL certificates issued for your brand

• Defensive registration: but smarter, not endless. Instead of buying 5,000 garbage domains, prioritise:

• • The 20–50 most dangerous/likely-to-be-abused typos (e.g., -login, -secure, -signin + .com/.co/.app)
  • Internationalised domain names (IDNs) that look identical in some languages
  • New gTLDs that matter to you (.bank, .sucks, .security, .google, etc.)

• Certificate Transparency (CT) Log Monitoring
  • Free or cheap: get alerted the same day someone gets an SSL cert for “micr0soft.com” or “g00gle.com”. Tools: CertStream, CRT.sh alerts, or paid brand-protection platforms.

• DNS Firewall / RPZ (Response Policy Zones)
  • Push known bad typo domains to your corporate DNS resolver so employees physically can’t resolve them (even if they type wrong).
• Browser/Endpoint Protection that Blocks Known Typo
  • Many enterprise EDRs and secure web gateways now ingest typo feeds and automatically block them.

What should you do when you find an impersonated domain?

Immediate Takedown Paths:

• • Hosting provider abuse helpdesk (usually 4–48 hours)
  • Registrar abuse desk (the official abuse-reporting contact at the domain registrar)
  • Registry takedown (some like .com/.net have trusted notifier programs that resolve in <24h)
  • Google Safe Browsing / Microsoft SmartScreen urgent submission (gets it blocked in Chrome/Edge fast)
  • You send a DMCA Digital Millennium Copyright Act (U.S. law, but respected worldwide by almost every hosting company) takedown notice to the web hosting provider + UDRP Uniform Domain-Name Dispute-Resolution Policy (ICANN’s global arbitration system).

Trusted Notifier / Law-Enforcement Fast Lanes
Many brand-protection firms (and some in-house teams) have “trusted flagger” status with GoDaddy, Namecheap, Cloudflare, Google, Microsoft, etc. This can shave days or weeks off the process.

Legal Pressure That Actually Works
John Doe lawsuits and disclosure orders against privacy-protected registrars (especially in the EU and US) are surprisingly fast now, if you have experienced counsel.

Assured’s head of incident response reacts:

It isn’t uncommon for advanced persistent threats (APTs) like those from FlexibleFerret to slip past EDR tools, which are designed to catch infections through:

i)Signatures,

ii)Behavioural analysis

iii)Heuristics* (or pattern matching).

If you’re interested in how this variant bypassed these features:

Signatures & Heuristics: CDrivers is a new malware variant, making signature comparison impossible. CDrivers also use dynamic imports**, string encryption, and code obfuscation to hide malicious strings and APIs, meaning no obvious red flags for static analysis tools to alert on and bypassing heuristics. And like many multi-stage loaders, CDrivers decrypts its payloads within live memory itself – avoiding writing to disk and triggering file-based scans.

Behavioural analysis: CDrivers leverages legitimate macOS mechanisms (like LaunchAgents (~/Library/LaunchAgents/) for persistence, mimicking benign system services. EDRs often actually whitelist these paths to avoid false positives, allowing anomalous behaviour to unfold in these ‘trusted’ locations. Execution within CDrivers happens via embedded binaries that blend with standard processes, evading process-hollowing detection.

So, what are some footprints you can see to detect CDrvier backdoor malware?

If your investigation identifies anything suspicious, take the usual incident response steps (and add these to your incident response plan or malware playbook if they would be useful):

• Isolate the Device: Disconnect from Wi-Fi and Ethernet. Disable Bluetooth (System Settings > Bluetooth). If enterprise, quarantine via MDM (e.g., Jamf Pro).
• Kill Active Components: From Step 1, unload/quit any suspicious processes/agents. Block domains: Add to /etc/hosts (e.g., 127.0.0.1 api.ipify.org).
• Change Credentials: Assume compromise—update passwords for all accounts (Apple ID, email, banking) from a clean device. Enable 2FA everywhere.
• Automated Removal: Run Malwarebytes or Intego in full scan mode—quarantine hits. For Jamf Protect users, it automatically blocks or quarantines Go payloads.
• Manual Cleanup:
  • Delete suspicious files/plists: rm -rf ~/Library/LaunchAgents/suspicious.plist (backup first!).
  • Clear caches: rm -rf ~/Library/Caches/* and browser data (Chrome > Clear Browsing Data).
  • Reinstall affected apps: E.g., if Chrome was spoofed, uninstall/reinstall from the official site.
• Advanced: Boot to Recovery Mode (Command+R on startup) > Reinstall macOS (non-destructive; preserves files but overwrites system). Or, for belt and braces, erase the disk in Disk Utility and perform a clean install.
• Verify: Re-scan post-cleanup. Monitor logs: log show –predicate ‘process == “curl”‘ –last 1d for residuals.

* Heuristics – in plainer English, is a feature designed to flag things like unusual API calls, code structures, or runtime actions that resemble known malware tactics. EDR providers constantly update these and are therefore more advanced than standard signature detection.

** Dynamic imports mean that the malware does not contain the usual long list of imported macOS API function names inside the binary at compile time.

Assured’s head of incident response reacts:

At risk of preaching to the converted and banging the supply chain risk drum alongside every other cybersecurity advisor, it’s impossible to ignore that the npm ecosystem is a prime target for cyber criminals. The Shai-Hulud is yet another example of malware targeting this ecosystem, primarily affecting developers and businesses that rely on open-source JavaScript packages. Last week, I gave some guidance on what businesses can do to counter these supply chain threats. But to add some thoughts that have occurred to me since then: If you’re a conscientious cyber professional, you might consider collaborating with ecosystems by reporting suspicions to npm/GitHub security teams, and in turn, following their advisories for bulk removals.

To report these:

1. Visit the npm support page and create a ticket.
2. Select “Security” or “Report a vulnerability/malware” as the category.
3. Provide details: Your name, email, package name, version, evidence of the issue (e.g., suspicious behaviour, stolen credentials), and any audit report info from npm audit.
4. For package-specific issues, include the package’s issue tracker link if available.

On top of this, you can monitor sources such as the npm blog and cybersecurity feeds for emerging variants. Shai-Hulud is scaling rapidly, with more than 1,000 new repos appearing every 30 minutes.

Cleaning up potentially infected environments:

And then to add some preventive best practices to counter the threats before they take hold: