Best AI Humanizer Tools of 2026: Ranked & Compared

By

-

November 7, 2025

Best AI Humanizer Tools of 2026: Ranked & Compared

Artificial intelligence writing has exploded in 2025. From content farms to small agencies, nearly everyone’s using GPT-based tools. Yet, there’s a problem — AI detectors keep catching them. That’s where AI humanizer tools step in.

These tools rewrite or tweak AI-generated content to make it appear written by humans. Some are subtle, some heavy-handed. Let’s go through the best AI humanizer tools of 2026, tested, ranked, and compared for quality, detection scores, and pricing.

1. Clever AI Humanizer

Clever AI Humaniz er continues to dominate this space in 2026. It’s not only fast but shockingly precise. Content run through this AI humanizer that bypasses detectors often scores under 3% on major AI detectors like GPTZero, Content at Scale, and Turnitin.

The interface is plain, but performance beats fancy dashboards. Users can upload entire documents or paste text blocks. The system auto-detects AI phrasing and rewrites them into natural sentence rhythms.

Its hybrid approach combines language reshaping with unpredictable syntax and tone variation. According to testers, the results pass manual editorial review 95% of the time.

Pros:

Extremely low AI detection
Supports 20+ languages
Bulk document mode

Cons:

Occasional over-editing of technical content

Price: Free for 3,000 words/day; $19/month for unlimited. Ideal for anyone comparing AI humanizer pricing comparison data before subscribing.

2. Undetectable AI

Academic users often mention undetectable AI. It focuses on rewriting GPT, Claude, and Gemini outputs to fool university-level detectors. The tone feels slightly stiff compared to human writers, but it passes AI tests consistently.

One thing users like: it lets you adjust the “humanity” scale. Higher settings add quirks and irregular grammar, lower ones keep it neat. The tool also supports plagiarism scanning.

Reports from Reddit show it can drop GPTZero’s detection score from 92% to under 10% with one click.

Pros:

Excellent academic performance
Custom control over tone randomness
Fast output processing

Cons:

Text may sound slightly robotic at low settings

Price: Starts at $13/month.

This one’s the best undetectable AI humanizer for students and researchers who value precision.

3. Aihumanize

Aihumanize is a fully verified tool focused on converting AI-generated text into naturally flowing human writing. According to the website, it transforms AI-drafts into text that bypasses detectors by preserving meaning while reworking sentence structure.

Writers say it sounds less “machine-like” and more conversational — good for blogs, social posts, even email blasts.

It supports multiple rewriting styles (academic, blog, formal, informal) and claims to achieve detection scores near zero using its “autopilot” mode.

Pros:

Natural tone,
Style-variants
Detection-bypass claims.

Cons:

Some claims (“0% detection”) may be optimistic — still advisable to review manually.

Price: Freemium to start; premium modes unlock higher word limits and advanced modes.

It’s positioned as a strong option for content creators wanting an authentic voice while still using AI as a base.

4. Paraphrasetron

Paraphrasetron isn’t technically built as a humanizer, but it’s often used that way. It started as a paraphrasing tool and evolved into something more. Users discovered its deeper randomization engine tricks AI classifiers.

The writing tends to feel a bit academic, so not great for creative pieces. Yet, it excels for whitepapers or technical blogs.

The free version allows up to 1,500 words, enough for testing. Paid plans unlock bulk uploads and custom style presets.

Pros:

Strong technical tone preservation
Effective for professional content
Solid free plan

Cons:

Flat tone for general writing

Price: Free tier available; Pro $15/month. Many professional copywriters see it as the best AI humanizer for copywriters needing precision.

5. AItoHuman Converter

AItoHuman Converter is quietly rising among SEO professionals. It’s not as refined as Clever AI, but it integrates analytics. After humanizing, it shows how your content ranks on 15 major detectors.

The tool automatically adjusts sentence variance and punctuation style, mimicking human rhythm. Users can even upload Excel sheets with hundreds of posts — ideal for agencies handling bulk rewriting.

It’s not perfect. Sometimes outputs include odd spacing or unusual capitalization. But for quick mass processing, nothing matches its speed.

Pros:

Bulk processing
Detection analytics dashboard
Supports CSV/Excel import

Cons:

Occasional formatting glitches

Price: $25/month, enterprise at $99/month. It’s now the best AI humanizer for SEO content based on agency testing.

Summary Comparison Table

Below is a quick comparison of the top AI humanizer tools for 2026, including accuracy, pricing, strengths, and best-use recommendations.

Tool	Strength	Avg. Detection After	Pricing	Best For
Clever AI Humanizer	Highest accuracy, fast rewriting	2%	Free / $19 monthly	SEO, agencies, everyday writers
Undetectable AI	Strong academic bypassing	8%	$13 monthly	Students, researchers
Aihumanize	Natural tone and style variants	6%	Freemium / Premium tiers	Bloggers, creators
Paraphrasetron	Technical accuracy	15%	Free / $15 monthly	Technical writers, reports
AItoHuman Converter	Bulk rewriting and analytics	10–12%	$25+ monthly	Agencies, high-volume rewrites

Expert Insights: How to Test AI Humanizers

Choosing an AI humanizer isn’t just about scores. You need to run real-world tests. Copy a 300-word GPT sample into GPTZero, note the score, then process it through the humanizer. Re-test. That’s the only honest benchmark.

Watch out for grammar drift. Some tools rewrite text so heavily it feels unnatural. Others might still trigger detectors despite rewriting. Look for balance.

If your goal is SEO or academic submission, test on multiple detectors. GPTZero, Sapling, Winston AI, and Turnitin all read differently. A good tool passes all four.

What’s Next for AI Humanizers in 2026

By mid-2026, major writing platforms are embedding built-in humanizers. OpenAI, Anthropic, and Google DeepMind are rumored to include “style masking” to avoid detector bias.

Smaller startups like Clever AI are moving faster though. Expect new real-time rewriting APIs, direct ChatGPT integrations, and privacy-safe rewriting systems. Enterprise customers already demand this for compliance reasons.

Some experts predict detectors will lose relevance as humanizers grow smarter. Others think it’s an endless arms race. Either way, users benefit — cleaner, more natural writing that doesn’t sound like it came from a silicon brain.

Final Verdict

If you’re hunting for accuracy and natural tone, Clever AI Humanizer remains the leader. For academic rewriting, go with Undetectable AI. If you want an expressive tone, HumanizeByAI is unmatched. Each of these can humanize ChatGPT text effectively and safely.

These tools aren’t just hiding AI origins. They’re redefining how machines write — blending precision and personality into something that feels eerily human.

Herodotus Android Banking Trojan Takes Over Devices, Outsmarts Security Tools

By

Mayura Kathir

-

November 7, 2025

Herodotus Android Banking Trojan Takes Over Devices, Outsmarts Security Tools

A new threat has surfaced in the mobile banking landscape Herodotus, a sophisticated Android banking Trojan that has been wreaking havoc in recent weeks.

Offered under the notorious Malware-as-a-Service (MaaS) model, Herodotus leverages social engineering and technical deception, evading detection by conventional antivirus solutions and putting users’ financial data at serious risk.

Herodotus addressed victims primarily through SMS phishing campaigns that masquerade as legitimate alerts or service messages.

Unsuspecting users receive links guiding them to a counterfeit web page which instructs them to download an APK a process performed outside of the secure environment of the official Play Store. This off-store installation itself is a major red flag, but remains undetected by many traditional defenses.

Once installed, Herodotus immediately requests a series of critical device permissions, most notably the powerful Accessibility permission.

With this elevated access, the malware superimposes convincing fake screens atop authentic banking applications, capturing both screen data and any keystrokes entered by the user.

This enables the Trojan to execute session takeover attacks, stealthily orchestrating banking operations in real-time while the victim remains logged in.

To escape anti-fraud and detection mechanisms, Herodotus introduces “humanized” patterns random delays, subtle movements, and lifelike typing simulations.

These behaviors render automation fingerprints almost invisible, making it exceptionally difficult for legacy detection systems to spot malicious activity.

Why Antivirus Alone Isn’t Enough

The limitations of antivirus engines became apparent following research by the Pradeo team. A primary antivirus provider failed to trigger warnings for the Herodotus APK even though basic online searches identified its threat.

The root cause lies in how antivirus solutions typically operate: signature-based and behavior-driven databases, limited to known threats.

Malicious apps downloaded from non-Play Store sources frequently elude detection, especially if their harmful behaviors only activate after installation and permission approval.

In the Herodotus scenario, only by chaining indicators of compromise suspicious SMS links, third-party app installations, requests for sensitive permissions, screen overlays, and simulated interactions can the attack be reliably identified.

Each individual signal may appear innocuous, but their sequence unmistakably points to an active compromise, illustrating why standalone antivirus solutions continually miss such advanced threats.

Pradeo Mobile Threat Defense

Modern protection calls for multilayered defense mechanisms. Pradeo’s Mobile Threat Defense (MTD) solution stands apart by continuously monitoring device behavior and intercepting attacks at every stage.

The Herodotus campaign underscores a pivotal reality for mobile security teams: Antivirus software cannot keep pace with today’s evolving threat landscape, particularly when attacks leverage a combination of social engineering, off-market software, and abuse of device permissions.

Phishing links are proactively blocked by Pradeo’s anti-phishing module, preventing users from ever reaching malicious download pages.

Should a risky off-store installation be attempted, Pradeo MTD immediately detects the unknown source and alerts security personnel to intervene before compromise.

Crucially, the solution monitors all application requests for sensitive permissions. Any application seeking Accessibility or similar critical controls is promptly flagged and quarantined, neutralizing the attack before it can escalate.

Pradeo also surveils user interface anomalies detecting overlays, monitoring simulated interactions, and halting network activity tied to suspicious behaviors. Sensitive applications are instantly protected at the first sign of danger.

To safeguard enterprise users and sensitive data, deploying a specialized Mobile Threat Defense (MTD) solution is now a necessary standard in cybersecurity.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.

U.S. Congressional Budget Office Hit by Cyberattack, Sensitive Data Compromised

By

Divya

-

November 7, 2025

U.S. Congressional Budget Office Hit by Cyberattack, Sensitive Data Compromised

The Congressional Budget Office (CBO), which serves as Congress’s official financial advisor, has been targeted in a suspected cyberattack by suspected foreign actors.

The breach exposed sensitive financial research data that lawmakers rely on to make crucial budgeting decisions and craft legislation affecting millions of Americans.

The CBO confirmed the attack through an official agency spokeswoman, revealing that unauthorized individuals gained access to the organization’s systems.

This nonpartisan agency conducts some of the most critical financial analyses for the U.S. government, including budget projections, economic forecasts, and cost estimates for proposed legislation.

What Data Was at Risk?

The exact scope of compromised data remains unclear. However, the CBO maintains extensive databases that contain detailed financial research, economic models, and budget analysis, which directly influence congressional decision-making.

This information is typically used to evaluate the financial impact of new legislation before votes occur. The loss of such sensitive information could give foreign adversaries insight into U.S. fiscal planning and legislative priorities.

Government agencies are frequently targets of sophisticated cyberattacks because they hold vast amounts of valuable information and represent high-value targets for state-sponsored hackers.

The breach highlights the ongoing vulnerability of critical U.S. government infrastructure to advanced cyber threats.

Authorities launched an immediate investigation into the attack. The CBO is working with federal cybersecurity officials to determine the full extent of the breach, identify what information was accessed, and prevent similar incidents in the future.

The agency has not disclosed specific details about the attacker’s identity or the methods used to penetrate their systems.

This incident joins a growing list of cyberattacks targeting U.S. government agencies.

Previous breaches have compromised sensitive data across multiple departments, raising concerns about the adequacy of cybersecurity measures protecting critical government networks.

The attack underscores the urgent need for enhanced cybersecurity protections across government agencies.

Congress may face pressure to allocate additional funding for security upgrades and implement stricter protocols for handling sensitive financial data.

The incident serves as a stark reminder that even nonpartisan, essential government organizations remain vulnerable to sophisticated foreign cyber threats.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.

New Analysis Reveals LockBit 5.0’s Core Features and Dual-Stage Attack Model

By

Mayura Kathir

-

November 7, 2025

New Analysis Reveals LockBit 5.0’s Core Features and Dual-Stage Attack Model

LockBit has remained one of the most dominant ransomware-as-a-service (RaaS) groups in the world since its emergence as ABCD ransomware in 2019 and official launch as LockBit in 2020.

Despite high-profile setbacks including international law enforcement takedowns in early 2024 and a damaging affiliate panel leak in May 2025 the group continues to update its codebase, expand affiliate operations, and launch large-scale attacks targeting organizations across industries.

Flashpoint has tracked LockBit through numerous evolutions, from the early .abcd encryptors to the faster and stealthier LockBit 3.0 and the Conti-inspired LockBit Green.

Now, with version 5.0, the group has introduced a refined two-stage ransomware deployment model that aims to maximize evasion, modularity, and destructive impact.

This analysis outlines how LockBit 5.0 works, what’s changed, and why defenders should treat this latest evolution as a clear signal that even after takedowns and leaks, ransomware groups are innovating faster, not backing off.

Trend Micro first flagged the emergence of LockBit 5.0 in late September 2025. Flashpoint’s analysis confirms that the group is building on the existing v4.0 codebase rather than starting from scratch.

Many core functions remain, including familiar file encryption methods, geographic execution limits, and even a recycled ransom note that still misspells “information”.

However, LockBit 5.0 introduces several new or upgraded capabilities. A modular two-stage architecture separates the loader from the primary payload, and expanded anti-analysis features include control-flow obfuscation and API hashing.

The malware employs aggressive EDR bypass using process hollowing, unhooked libraries, and ETW patching. It also supports stealth execution modes that omit file extensions and ransom notes.

These updates demonstrate that LockBit’s developers are focused on staying operational under pressure, iterating on technical defenses while retaining the group’s familiar tooling and affiliate model.

The Two-Stage Execution Model

At the heart of LockBit 5.0 is its new two-stage execution model. Stage one acts as a loader built for stealth and survivability, while stage two executes the core ransomware payload, designed for flexible deployment, targeted destruction, and layered evasion.

Stage One: The Stealthy Loader and EDR Evasion

Key features of the loader at stage one include control flow obfuscation, where the code calculates jump destinations dynamically, making traditional disassembly and reverse engineering more difficult.

Dynamic API resolution means the malware avoids hardcoded API names and instead resolves function calls at runtime using a custom hashing algorithm.

Library unhooking is employed to reload clean copies of NTDLL and Kernel32 from disk, overwriting any hooks placed by security tools in memory.

The loader constructs custom shellcode trampolines that redirect execution to resolved API calls, bypassing standard detection methods.

The loader then creates a suspended instance of defrag.exe and injects the decrypted payload using process hollowing.

Flashpoint analysts confirmed that the stage two payload is written into memory using ZwWriteProcessMemory, the instruction pointer is updated, and the process resumes execution all without triggering default security alerts.

Stage Two: The Destructive Ransomware Payload

Stage two is the main ransomware payload. Flashpoint observed this binary labeled “ChuongDoung Locker v1.01,” a likely nod to researcher Chuong Dong. It contains both familiar LockBit features and new destructive options.

The payload supports various command-line switches and can run with or without a visible impact. In “destruction-only” mode, it encrypts files silently without changing extensions or displaying a ransom note, a tactic that may be used for retaliatory or purely disruptive campaigns.

Additional behaviors include encryption of local drives, specific directories, and network shares, as well as multi-threaded encryption using Curve25519 keys and XChaCha20 cipher.

Repeated library unhooking occurs for every DLL loaded, while system services such as VSS, WSearch, and Edgeupdate are disabled.

File and directory exclusions preserve OS functionality and evade detection. The ransom note text is decrypted using RC4 and written as ReadMeForDecrypt.txt.

Before executing, the payload checks the victim machine to ensure it is not in Russia or Russia-allied locations, and curiously, avoids execution on systems located in the Philippines a behavior Flashpoint continues to investigate.

Implications for Defenders

LockBit 5.0 reflects a broader shift in ransomware development: professionalization under pressure. Despite sanctions, leaks, and arrests, the group continues to operate at scale.

Security teams should monitor illicit forums and breach sites for early warning signals, correlate vulnerability intelligence with ransomware group preferences to prioritize patching, use behavioral detection to flag evasive actions like ETW patching or library unhooking, and prepare tailored response playbooks with negotiation protocols, offline backups, and legal guidance pre-staged before an attack occurs.

The release follows the May 2025 leak of internal LockBit data, which exposed affiliate accounts, ransomware builds, and ransom negotiations between victims and affiliates.

For defenders, this reinforces the importance of tracking ransomware groups not only by indicators of compromise but also by their tooling, tactics, techniques, and procedures.

LockBit 5.0 is the latest proof that ransomware isn’t going away it’s adapting. The best way to stay ahead is by fusing primary source intelligence, behavioral analysis, and coordinated readiness.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.

New Android Malware ‘Fantasy Hub’ Spies on Users’ Calls, Contacts, and Messages

By

Mayura Kathir

-

November 7, 2025

New Android Malware ‘Fantasy Hub’ Spies on Users’ Calls, Contacts, and Messages

Russian-based threat actors are actively distributing a sophisticated Android Remote Access Trojan called “Fantasy Hub” via Telegram-based Malware-as-a-Service channels, marking a significant escalation in mobile-focused cybercrime.

Fantasy Hub represents a dangerous convergence of advanced evasion techniques, social engineering tactics, and deep system-level access.

Security researchers from Zimperium’s zLabs have documented extensive capabilities of this spyware, which operates under a paid subscription model designed to lower barriers to entry for novice attackers seeking to compromise Android devices at scale.

The malware can exfiltrate SMS messages, contacts, call logs, images, and videos while maintaining the ability to intercept, modify, and delete incoming notifications.

Threat actors leveraging this toolkit have specifically targeted financial institutions including Alfa-Bank, PSB, Tbank, and Sber by deploying custom phishing windows that masquerade as legitimate banking applications to harvest credentials.

The operational structure of Fantasy Hub demonstrates how Malware-as-a-Service platforms democratize sophisticated cybercrimes.

Buyers can select the icon, name, and page they wish to impersonate to receive a specific page.

The developer advertises the malware alongside comprehensive documentation, instructional videos, and automated subscription management through a dedicated Telegram bot.

Potential buyers can select subscription tiers that grant access to the malware builder, allowing threat actors to customize and deploy instances targeting specific victims.

The seller even provides detailed instructions on creating counterfeit Google Play Store pages and bypassing Android security restrictions, complete with fabricated reviews to increase legitimacy.

This subscription approach has proven remarkably effective at attracting buyers with varying technical skill levels.

The Telegram bot manages subscription periods, device assignments, and command-and-control access through an intuitive interface.

Threat actors upload their chosen APK file to the builder, which automatically injects the Fantasy Hub dropper before deployment.

This automation significantly reduces the technical complexity required to launch coordinated attacks against financial institutions and enterprise users.

Exploitation Techniques

The technical architecture of Fantasy Hub incorporates multiple sophisticated evasion strategies designed to bypass detection mechanisms and security analysis.

The malware embeds a native dropper within the metamask_loader library that accesses encrypted assets at runtime.

During execution, a custom XOR-based decryption routine using a fixed 36-byte key pattern decrypts the payload stored in a file named metadata.dat, which is subsequently decompressed using gzip compression.

This approach significantly reduces static indicators by keeping the actual payload encrypted until runtime execution on the victim’s device.

The command and control panel displays various details, including the remaining subscription time, online/offline device status, and device-specific information.

C2 panel with different device information.

A hazardous exploitation technique involves abusing the default SMS handler role. Unlike individual runtime permissions requiring separate user approval, becoming the SMS handler role grants unified access to SMS content, contacts, camera functions, and file access through a single authorization step.

Real-Time Surveillance and Financial Targeting

Fantasy Hub leverages WebRTC technology to enable real-time audio and video streaming directly to command-and-control servers without requiring separate permissions.

The dropper masquerades as a Google Play System Update to reduce user suspicion, and recent samples include root detection and installation environment checks designed to evade dynamic analysis and sandbox environments.

From Google play update to requesting default SMS permission.

The malware displays a subtle “Live stream active” indicator to prevent the device from entering sleep mode, then silently disables camera and microphone access once streaming concludes.

Once victims enter credentials through these phishing interfaces, the stolen information is immediately exfiltrated to attacker-controlled servers.

Threat actors managing compromised devices access a Russian-language command-and-control panel that displays device status, remaining subscription time, and comprehensive device information including brand, model, SIM slot assignments, and last activity timestamps.

The financial targeting capabilities represent perhaps the most immediate threat to enterprise organizations and individual consumers.

Threat actors deploy pre-built phishing windows disguised as legitimate banking applications, and the seller provides instructional videos demonstrating how to create custom windows with fully customizable fields for PIN numbers, passwords, and card details.

The emergence of Fantasy Hub underscores the critical need for comprehensive mobile threat defense strategies, particularly in bring-your-own-device environments where personal and corporate mobile usage intersect.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.

Attackers Exploit Active Directory Sites to Escalate Privileges and Compromise Domain

By

Divya

-

November 7, 2025

Attackers Exploit Active Directory Sites to Escalate Privileges and Compromise Domain

Security researchers have uncovered a dangerous attack vector targeting Active Directory Sites, a critical yet often overlooked component of enterprise network infrastructure.

According to a recent technical analysis by Quentin Roland, attackers can exploit ACL-based attack paths within AD Sites to escalate privileges and potentially compromise entire domains.

This discovery highlights a significant security gap that has largely escaped the attention of the offensive security community.

Active Directory Sites are designed to optimize network performance and bandwidth usage in geographically dispersed organizations.

These sites group highly connected subnets and assign domain controllers to handle authentication and replication traffic efficiently.

While these features serve important operational purposes, they also create a hidden attack surface that most security teams have underestimated.

*Attack path for linked GPO exploitation vector.*

The vulnerability exists because sites can be associated with access control lists (ACLs) that, when improperly configured, allow attackers to move laterally across domains.

Researchers have identified that sites can contain clients and domain controllers from multiple, distinct domains within a forest. This cross-domain relationship becomes the foundation for sophisticated privilege escalation scenarios.

How the Attack Works

Attackers can exploit site-based ACLs to gain elevated privileges within the Active Directory environment.

By manipulating site configurations and leveraging Group Policy Object (GPO) exploitation techniques, adversaries can move between domains without triggering traditional security alerts.

The attack is particularly effective because most organizations treat sites as operational infrastructure rather than security-critical components.

The exploitation method relies on documented but lesser-known techniques that allow attackers to bypass SID filtering configurations during intra-forest lateral movement.

This means that even organizations with segmentation controls in place may remain vulnerable. Once an attacker compromises a single site, they potentially gain access to resources across the entire forest.

*Delegation of Group Policy links management via Active Directory GUI.*

Security researchers have recently submitted improvements to BloodHound, the popular Active Directory attack path visualization tool, to help organizations identify these vulnerabilities.

These enhancements enable IT teams to enumerate and visualize site ACL attack paths before attackers can exploit them.

Organizations using BloodHound can now map their site configurations and identify risky permission assignments.

Enterprise security teams should immediately audit their Active Directory site configurations and associated permissions.

Organizations with geographically dispersed environments should prioritize reviewing ACL settings on all site-related objects.

Additionally, implementing the latest BloodHound updates will help identify potential attack paths within their infrastructure.

This discovery serves as a reminder that Active Directory security threats extend beyond domain controllers and user accounts.

Physical network infrastructure components, like sites, can be weaponized to compromise entire environments. Organizations managing extensive Active Directory forests should treat site security as a top priority and include site-based attack vectors in their threat modeling.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.

What Is an eSIM and Why It Matters for Mobile Security

By

PricillaWhite

-

November 7, 2025

What Is an eSIM and Why It Matters for Mobile Security

An eSIM is the digital version of a physical SIM built into some smartphones, especially the latest releases. It works like an ordinary SIM card, allowing you to make and receive calls. You can also use it to send texts and access the internet.

Instead of inserting a new SIM into a smartphone, you scan a QR code to add a profile from your mobile network carrier. You can find smartphones with eSIMs that can hold multiple profiles for easy network switching.

This article will explore the eSIM technology and how it differs from ordinary SIM cards, and much more!

Definition of eSIM: what it is and how it differs from physical SIM

Mobile network subscribers are switching to eSIMs to avoid attackers who have exploited Microsoft Teams and other threats, as they offer a more secure way to connect to a mobile network. This technology is different from the physical SIM cards in the following aspects:

Form factor: An eSIM is a small chip soldered onto the motherboard of your smartphone. It stores all the network access credentials needed to identify you to a mobile network on the motherboard.

Mobile network activation: A physical SIM card requires you to swap it out to connect to a new network carrier. eSIM can store multiple profiles from your preferred carriers without having to eject your SIM card tray. You’ll scan a QR code to add the profiles and toggle on the profile you want to use at the moment.

Security: Since the eSIM chip is soldered onto your motherboard, it can’t be stolen, unlike a physical SIM. It is more secure since it can’t be stolen or damaged. You can secure it with a strong password to ensure nobody uses your plan.

How eSIMs impact device identity and connectivity

Switching to an eSIM has many benefits, such as giving you connectivity in places beyond your country’s borders. However, you’ll need an international carrier like the Holafly eSIM plan for Japan to connect to mobile networks across many countries.

Besides giving you connectivity anywhere, eSIM technology benefits you in the following ways:

Separating your identity from a physical card: The plastic SIM card contains your subscriber identity, which can be stolen and used against you if stolen. An eSIM stores IMSI, which is your identity, on the smartphone’s motherboard, making it hard to steal for identity.

Easy mobile network switching: You may download multiple carrier profiles to your eSIM. This allows you to switch to a new network by toggling on the correct eSIM profile without inserting a new physical SIM.

Global network connectivity: Your eSIM chip can store any carrier profile if the network operator supports eSIM technology. As a result, you can travel to any country and add a local eSIM profile to your smartphone. You’ll then access the internet at local data plans, thereby reducing travel expenses.

Security benefits and risks associated with eSIM technology

Pixabay

The latest smartphones want to ensure you are safe while connecting with friends. One of the features you can expect in Android 16 is the mobile network security, which notifies you of unencrypted connections to mobile networks.

eSIM technology secures your smartphone further by eliminating possible vulnerabilities that can be exploited. This is a reason enough you want to switch to an eSIM for calls, SMS, and access to the internet.

eSIM Benefits

Tamper-proof: eSIM can’t be swapped out or stolen for use in another smartphone, as it’s embedded into the motherboard.

Anti-SIM cloning: Your eSIM profile is controlled via remote provisioning. You can ask your carrier to disable your profile over the air if you lose your device.

Secure information: Your subscriber identity information is stored inside the eSIM chip. But what makes this information more secure is that the chip is a secure element (SE) that can’t be separated from your mobile device.

eSIM Risks

Vulnerable to phishing: Your carrier must have a secure system to safeguard the verification of identity. However, your mobile network system might experience a data breach, which can give advanced hackers access to your subscriber identity information.

Difficulty contacting emergency responses: A physical SIM is easy to swap out and insert in any mobile device, and call for help. On the other hand, an eSIM can make calling for help difficult if your battery dries out.

Real-world use-cases where eSIM improves security (e.g., travel, remote work)

eSIM has become the go-to way if you want to connect to nearby cell towers and use your device for mobile network connectivity. It allows you to use your smartphone in the following ways:

Travel: eSIM can be your travel companion as it gives you access to the internet. You can use your internet connectivity to power Google Maps and translation apps. Additionally, it allows you to book accommodation and find restaurants within your budget.

Remote work: Completing remote tasks and submitting them halfway around the world is a hallmark of digital nomads. Many eSIM carriers offer unlimited data plans for continuous access to the internet, allowing you to complete remote tasks.

Communication: It is also possible to rely on eSIM to connect with friends back home as you explore a particular destination. A local eSIM profile allows you to make calls and receive texts. International carriers, on the other hand, allocate data plans for powering messaging apps like WhatsApp and Messenger.

Best practices when adopting an eSIM provider (what to ask, what to check)

Selecting the best eSIM provider from the many options on the market can be intimidating when it doesn’t have to be. Ensure you consider the following when adopting one eSIM provider:

Data privacy: All eSIM carriers handle user data and store it in their systems. Check if your preferred eSIM carrier complies with SGP.22/SGP.32 standards as set by GSMA.

Network coverage: The best eSIM carrier also provides network coverage in a geographical region. You can travel abroad and explore an entire region with a single eSIM carrier.

Compatible devices: Besides a smartphone, an eSIM can be placed in tablets and IoT modules. Select an eSIM carrier that supports all smart communication devices, like smartphones and IoT modules.

Over 15 Malicious npm Packages Exploiting Windows to Deploy Vidar Malware

By

Mayura Kathir

-

November 7, 2025

Over 15 Malicious npm Packages Exploiting Windows to Deploy Vidar Malware

Datadog Security Research has uncovered a sophisticated supply chain attack targeting the npm ecosystem, involving 17 malicious packages across 23 releases designed to deliver the Vidar infostealer malware to Windows systems.

The campaign, attributed to a threat actor cluster tracked as MUT-4831, represents a significant escalation in npm-based threats and marks the first known public disclosure of Vidar malware being distributed through npm packages.

The malicious packages masquerade as legitimate software development kits and libraries, including fake Telegram bot helpers, icon libraries, and forked versions of popular projects like Cursor and React.

Despite their benign presentation on the npm registry, these packages execute destructive payloads through postinstall scripts that automatically run during installation.

Package custom-tg-bot-plan presents like a legitimate SDK on its npm page.

Researchers discovered that the packages remained live on the npm registry for approximately two weeks before removal, during which they accumulated at least 2,240 downloads. The most popular malicious package, react-icon-pkg, was downloaded 503 times before being taken down.

The Discovery and Initial Attack Chain

Security researchers at Datadog detected the campaign on October 21, 2025, using GuardDog, their command-line static analyzer for identifying suspicious signatures in package code.

The initial detection flagged the package [email protected], revealing multiple malicious indicators, including silent process execution, suspicious network domains, and automatic installation scripts.

Over two burst periods in late October, researchers observed the two threat actors behind the campaign, operating under npm accounts “aartje” and “saliii229911,” publishing their weaponized packages.

The npm profile of the aartje user associated with this campaign.

The attack chain follows a straightforward three-step process executed during package installation. First, the postinstall script downloads an encrypted ZIP archive from a bullethost[.]cloud domain.

Second, the script decrypts and extracts the archive using hardcoded passwords. Third, it executes a Windows PE binary named bridle.exe from the extracted contents before performing cleanup operations.

Some variations of the campaign employed PowerShell scripts embedded directly in package.json files, suggesting the threat actors deliberately diversified their implementations to evade detection mechanisms.

Vidar Infostealer: The Second-Stage Payload

The extracted executable in every malicious package proved to be a Vidar v2 infostealer, a Go-compiled variant of the notorious information stealer that first emerged in 2018 as an evolution of the earlier Arkei trojan.

Unlike traditional Vidar samples written in C/C++, this variant represents a new generation of the malware with enhanced capabilities for compromising victim systems.

Steam profile with Vidar C2 infrastructure history used by MUT-4831 Vidar sample.

Once executed, Vidar aggressively harvests sensitive data including browser credentials, cookies, cryptocurrency wallets, and critical system files, then packages the stolen information into ZIP archives for exfiltration to command-and-control servers.

What distinguishes this Vidar variant is its infrastructure discovery mechanism, which relies on hardcoded Telegram and Steam accounts to retrieve active C2 domains dynamically.

The malware queries these social media profiles to discover which infrastructure is currently operational, allowing threat actors to rotate their command-and-control servers without requiring package updates.

Upon successful data theft, Vidar deletes all traces of itself from the victim system, significantly complicating post-compromise detection and incident response efforts for security teams.

The MUT-4831 campaign underscores the persistent vulnerability of open source package ecosystems to supply chain exploitation.

Both threat actor accounts were newly created and operated for only days before publication, indicating deliberate infrastructure setup specifically for this attack. Following discovery, npm permanently banned both accounts and removed all associated packages, though not before the malware reached hundreds of systems.

The campaign demonstrates that threat actors have learned npm provides a reliable initial access vector for delivering malware to millions of downstream users with minimal friction.

Datadog’s Supply-Chain Firewall technology offers one mitigation approach by blocking known-malicious packages before installation, potentially preventing costly incident response cycles before they begin.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.

Researchers Bypass Elastic EDR Call-Stack Signatures Using Call Gadgets

By

Divya

-

November 7, 2025

Researchers Bypass Elastic EDR Call-Stack Signatures Using Call Gadgets

Security researchers have developed a new technique that leverages call gadgets to insert arbitrary modules into the call stack during module loading, successfully bypassing Elastic EDR’s signature-based detection rules.

Openness in Elastic EDR Detection Logic

Elastic’s policy of transparency making its detection logic and payload testing tools publicly available has enabled the security community to understand better and challenge its EDR mechanisms.

Unlike many vendors, Elastic allows open access to its detection rules, enabling researchers to simulate and analyze real-world evasion techniques.

Elastic EDR’s detection engine focuses heavily on analyzing call stacks for signs of malicious activity.

Suspicious module loads, such as those initiated from unbacked (i.e., in-memory, not from disk) memory regions, are closely monitored, as these behaviors are strongly associated with attacks like shellcode injection.

Specific rules, such as those that track network modules loaded from unbacked memory, help identify standard techniques used by command-and-control (C2) implants.

Over time, threat actors have devised various methods to evade EDR detection by manipulating call stacks. Techniques such as call stack spoofing and API proxying have been covered in detail within the community.

However, Elastic has responded by introducing additional rules targeting these tactics, often focusing on specific system libraries to reduce false positives and maintain performance.

A typical detection might look for a call stack like:

ntdll.dll|kernelbase.dll|Unbacked

or signatures indicative of spoofed or proxied calls. These rules are designed to catch library loads initiated in suspicious contexts.

The newly published research introduces an innovative evasion technique: using call gadgets to insert an arbitrary module into the call stack, thereby breaking the pattern expected by Elastic’s detection rules.

By exploiting controllable call instructions (gadgets) in system DLLs that are not currently targeted by EDR signatures, the researcher can modify the call stack observed during module load operations.

The proof-of-concept leverages a specific call-ret gadget found in an older version of dsdmo.dll.

The detection triggers and the process is killed

By jumping to this gadget during network library loading (such as wininet.dll), the inserted module appears in the call stack, disrupting the signature and preventing the alert from triggering. As a result, the previously detectable operation goes unnoticed by the EDR agent.

This method builds on previous research into shellcode obfuscation and callback-based API proxying.

Stepping over the syscall instruction, the alert will trigger — Stepping over the `syscall` instruction, the alert will trigger

However, it demonstrates a practical approach to finding real gadgets in widely available DLLs. Even though the tested gadget is from a deprecated version, the research outlines the process for finding similar gadgets in current DLL sets.

This finding only addresses a specific detection bypass related to shellcode-based network module loading.

Elastic’s EDR still offers many additional opportunities to detect malicious activity throughout an attack’s lifecycle. However, this technique underlines the constant evolution of evasion and detection strategies.

Researchers have responsibly disclosed the method to Elastic, which is actively updating its detection rules to address this evasion.

The work highlights the need for ongoing collaboration and transparency within the security community to strengthen cyber defenses continually.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.

OPNsense Firewall Update Addresses Multiple Security Issues and Enhances Features

By

Divya

-

November 7, 2025

OPNsense Firewall Update Addresses Multiple Security Issues and Enhances Features

The OPNsense project has released version 25.7.7, delivering critical security improvements and performance enhancements to strengthen enterprise firewall deployments.

This update represents a significant step forward in addressing infrastructure vulnerabilities while introducing user-requested operational enhancements that directly benefit network administrators managing complex security environments.

Security Vulnerabilities Eliminated

The most notable advancement in this release is the systematic removal of unsafe shell-execution patterns from the OPNsense backend.

This remediation addresses a fundamental architectural vulnerability that has historically been the source of multiple security incidents within the project.

By eliminating the use of the exec() function across the codebase, the development team has substantially reduced the attack surface for potential threat actors seeking to exploit command injection vulnerabilities.

The update specifically addressed a previously unknown vulnerability in the RRD backup code, identified by security researcher Alex Williams from Pellera Technologies working alongside the Trend Zero Day Initiative.

This collaborative disclosure process demonstrates OPNsense’s commitment to maintaining transparent relationships with security researchers and implementing rapid responses to discovered vulnerabilities.

Additional security hardening measures include applying the file_safe() functions throughout critical components, including the gateway monitor watcher and the mechanisms for writing the OpenVPN certificate revocation list file.

These targeted improvements prevent path-traversal and file-manipulation attacks that could compromise firewall integrity.

Enhanced Firewall Live Logging Capabilities

Version 25.7.7 introduces substantial improvements to firewall live logging functionality, directly responding to user feedback from the previous 25.7.6 release.

The development team has optimized the live log rendering engine to prevent unnecessary re-resolving of in-flight host-resolution requests, significantly improving performance in high-volume traffic analysis scenarios.

The update implements intelligent data ordering mechanisms and introduces configurable table and history limit options, allowing administrators to customize logging behavior based on specific organizational requirements.

These enhancements address common performance bottlenecks encountered in production environments where administrators analyze thousands of firewall events during incident response procedures.

The release includes updated versions of critical security components, including Suricata 8.0.2 for intrusion detection, StrongSwan 6.0.3 for VPN infrastructure security, and Unbound 1.24.1 for DNS security enhancements.

PHP 8.3.27 provides essential application security updates, while libxml 2.14.6 addresses XML parsing vulnerabilities that could affect configuration processing.

These cumulative third-party updates ensure that OPNsense deployments maintain current protection against evolving threat landscapes, with security teams able to leverage the latest threat intelligence integration capabilities in Suricata’s detection engine.

The OPNsense development team has announced upcoming additions to the 25.7.x release branch, including a new neighbour watch daemon for IPv6 network monitoring, an NDP proxy plugin for enhanced network traffic control, and community-contributed theme options.

These forthcoming features will continue to expand OPNsense’s capabilities to meet modern network security requirements.

Organizations running OPNsense deployments should prioritize updating to version 25.7.7 to benefit from these security improvements.

A hotfix release, 25.7.7_2, has already been issued to address a high availability synchronization regression discovered during initial deployment testing, ensuring administrators can implement this update with confidence in production environments.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.

1. Clever AI Humanizer

2. Undetectable AI

3. Aihumanize

4. Paraphrasetron

5. AItoHuman Converter

Summary Comparison Table

Expert Insights: How to Test AI Humanizers

What’s Next for AI Humanizers in 2026

Final Verdict

Why Antivirus Alone Isn’t Enough

Pradeo Mobile Threat Defense

What Data Was at Risk?

The Two-Stage Execution Model

Implications for Defenders

Exploitation Techniques

Real-Time Surveillance and Financial Targeting

How the Attack Works

Definition of eSIM: what it is and how it differs from physical SIM

How eSIMs impact device identity and connectivity

Security benefits and risks associated with eSIM technology

eSIM Benefits

eSIM Risks

Real-world use-cases where eSIM improves security (e.g., travel, remote work)

Best practices when adopting an eSIM provider (what to ask, what to check)

The Discovery and Initial Attack Chain

Vidar Infostealer: The Second-Stage Payload

Openness in Elastic EDR Detection Logic

Security Vulnerabilities Eliminated

Enhanced Firewall Live Logging Capabilities

Subscribe