TikTok Pays $400M Settlement; Trojans Found in NPM Packages

TikTok agreed to pay $400 million to settle a U.S. Department of Justice lawsuit that accused the platform of violating child privacy laws under COPPA. The settlement includes an immediate payment of $300 million and an additional $100 million “upon entry of an order vacating” a prior consent decree against the company. This move follows internal reviews prompted by the allegations and signals a shift toward stricter enforcement on social media platforms targeting younger audiences worldwide. ¹

Researchers have identified 14 trojanized npm packages that masquerade as calendar utilities but actually deliver an AI‑powered Linux implant called RedC2 4.0. When loaded, the module locates its bundled binary, marks it executable, and launches it as a detached background process. The new backdoor adapts dynamically based on machine‑learned data from environment variables, making it harder to detect than earlier versions that relied on hardcoded command‑and‑control servers. Similar tactics were used years ago with Stuxnet, illustrating how advanced persistent threat actors increasingly leverage artificial intelligence to evade traditional defenses. ¹

Check Point Research disclosed that Microsoft Defender’s own boot‑time remediation driver, BTR.sys (Boot Time Removal Tool), can be weaponised to perform arbitrary kernel‑level file and registry operations on Windows systems ranging from Windows 7 through Windows 11 25H2. Because the driver is legitimately signed, attackers bypass security checks without exploiting any software flaw or importing external drivers, allowing kernel‑level code execution without triggering standard alerts. A similar technique was previously employed against Symantec Endpoint Protection products, underscoring how well‑intentioned features like automated rollback mechanisms may inadvertently create exploitable vulnerabilities if not carefully secured. This highlights the need for thorough threat modelling, proactive penetration testing, continuous monitoring, and adaptive defense strategies incorporating behavioral analytics and anomaly detection techniques. ¹