“Attackers have backdoored the installer of widely used Justice AV Solutions (JAVS) courtroom video recording software”
JAVS Viewer 8.3.7 shipped with a malicious fffmpeg.exe that phones home, kills Windows logging and AMSI, and grabs browser credentials. The vendor claims over 10,000 installs in courts, law offices, jails and government agencies. JAVS insists no source code, certificates or systems were compromised. Rapid7 found the trojanized installer on the official JAVS website. Rapid7’s advice is to reimage every affected machine, which tells you how much to trust “no compromise.”