What are the opening hours?

Monday 08:00 - 16:00 Tuesday 08:00 - 16:00 Wednesday 08:00 - 16:00 Thursday 08:00 - 16:00 Friday 08:00 - 15:00

Digital Forensics Research & Service Center - DFRSC

Home
Pakistan
Lahore
Digital Forensics Research & Service Center - DFRSC

DFRSC is the first research facility of its kind in Pakistan. It will work to increase awareness about digital forensics and cyber security in Pakistan.

Digital Forensic Research and Service Centre (DFRSC) have been established at Lahore Garrison University, Lahore. The Prime Purpose of this centre is to Conduct research on Digital forensic problems and provide solutions, in order to, enhance crime investigation process.

09/06/2026

DFRSC | Official Visit & Academic Police Collaboration Update
Lahore/Punjab: Mr. Kaukab Jamal Zuberi (Associate Dean, SS / Director DFRSC) and Dr. Kausar Parveen (HOD, Department of Criminology) visited the Punjab Police Headquarters, where they met Addl. IG Training Mr. Asim and DIG Training Mr. Rao Munir. The meeting focused on strengthening collaboration between law enforcement training institutions and academia.
During the discussion, key areas were highlighted including curriculum upgradation, enhancement of practical training modules, and the development of joint initiatives between universities and Punjab Police. Special emphasis was placed on emerging domains such as digital forensics, cybercrime investigation, white-collar crime investigation, and modern investigative methodologies.
Both sides acknowledged the importance of integrating research-based learning with field practices to bridge the gap between theoretical education and real-world policing requirements. The collaboration aims to equip students and professionals with advanced skills aligned with modern law enforcement challenges.
On this occasion, a copy of the book “Digital Evidence In Court” was also presented to Addl. IG Asim.
The meeting concluded with a mutual commitment to explore future partnerships and capacity-building initiatives that promote evidence-based investigation and professional excellence in policing.

08/06/2026

Smart TVs and Free Apps May Be Quietly Using Your Internet for AI Web Scraping

A recent cybersecurity report highlights a hidden practice happening inside some free apps: they may be turning everyday devices like smart TVs, phones, and other connected systems into background “proxy nodes” for internet traffic.

Researchers discovered that certain apps include embedded software (SDKs) that can route web requests through users’ home internet connections often without users fully realizing the scale of what is happening.
How it works
Free apps integrate a third-party SDK
When installed, it connects your device to a proxy network
Your smart TV or phone may be used to fetch data from websites
This traffic can run silently in the background, especially on always-on devices like smart TVs
Why this is concerning
Your internet bandwidth is being used
Your home IP address may be part of proxy traffic
Consent screens may not clearly explain real usage
Smart TVs are particularly exposed due to constant connectivity
Why this is happening now

With the rise of AI, companies need massive amounts of web data for training and automation. Since many websites block data center IPs, residential internet connections are increasingly being used as an alternative source for scraping traffic.

What users can do
Review and remove unnecessary apps on smart TVs and mobile devices
Use network monitoring tools like Pi-hole or NextDNS
Block suspicious proxy-related domains at router level
Keep devices and apps updated
Final thought

This is not traditional hacking but it raises important questions about transparency, consent, and how “free” apps are actually funded and operated in the background.

03/06/2026

Supply Chain Alert: Miasma Malware Campaign Targets Red Hat npm Packages

A sophisticated software supply chain attack dubbed Miasma has compromised multiple Red Hat npm packages, introducing credential-stealing malware capable of self-propagation across development environments and CI/CD pipelines.

Key capabilities of the malware include:
Harvesting GitHub Actions secrets, npm tokens, cloud credentials, SSH keys, Kubernetes secrets, and Vault tokens
Targeting GitHub repositories and CI/CD workflows for downstream propagation
Establishing persistence through Anthropic Claude Code and VS Code configurations
Collecting Azure and GCP identity information to expand cloud access
Using encrypted exfiltration techniques and signed GitHub commits to evade detection

Affected packages include:
• redhat-cloud-services/vulnerabilities-client
• redhat-cloud-services/tsc-transform-imports
• redhat-cloud-services/topological-inventory-client
• redhat-cloud-services/sources-client
• redhat-cloud-services/rule-components
• redhat-cloud-services/remediations-client
• redhat-cloud-services/rbac-client

Security teams should immediately:
Identify systems where affected package versions were installed
Rotate potentially exposed credentials and tokens
Review GitHub, npm, and cloud activity logs for suspicious behavior
Audit for persistence artifacts in developer workstations and repositories
Rebuild and validate artifacts produced during the exposure period

This incident highlights a growing trend where attackers increasingly target developer tools, open-source dependencies, and CI/CD pipelines as entry points into organizations.

Organizations should strengthen software supply chain security through dependency monitoring, code-signing verification, least-privilege access controls, and continuous threat detection across development environments.

01/06/2026

AI Security Alert: ChatGPhish Turns AI Summaries into a Phishing Surface

Recent research by Permiso Security has uncovered a new attack technique called ChatGPhish, demonstrating how malicious content embedded in web pages can influence AI-generated summaries and potentially expose users to phishing attacks.

The research highlights an important security challenge for AI-powered assistants: when summarizing untrusted content, attacker-controlled links, images, QR codes, or deceptive messages may appear within a trusted AI interface, increasing the risk of social engineering attacks.

Key takeaways:
AI summarization can become an attack surface.
Prompt injection remains a growing threat across AI systems.
AI coding agents and autonomous tools introduce new security risks.
Organizations should treat AI-generated content with the same caution as other untrusted external data.
Security controls, user awareness, and AI safety mechanisms must continue to evolve alongside AI capabilities.

As AI adoption accelerates, understanding these emerging threats is essential for cybersecurity professionals, developers, and organizations alike.

22/05/2026

It was an honor for the DFRSC Research Center – Cyber Security Department to host Mr. Muhammad Akram Mughal, a veteran Cyber Crime Researcher, Investigator, and Cyber Security Expert.

He delivered an insightful lecture on cyber crime investigation and OSINT, providing valuable practical exposure to the students regarding the evolving landscape of cyber threats, digital investigations, and the professional role of investigative agencies in combating technology-enabled crime.

The session was highly informative, engaging, and particularly beneficial for senior semester students. Participants actively engaged and gained meaningful knowledge from Mr. Mughal’s field experience, professional insights, and real-world case studies.

The DFRSC Research Center sincerely appreciates his time, efforts, and contribution toward academic learning and professional awareness in the field of cyber security and cyber crime investigation.

We look forward to strengthening collaboration with experts and organizations in the field of cyber security for future training sessions, awareness programs, internships, research initiatives, and capacity-building opportunities for students.

Crime has evolved. Cyber security education must evolve with it.

20/05/2026

**Supply Chain Attack Alert: Compromised GitHub Actions Workflow**

A recent software supply chain incident has affected the popular GitHub Actions workflow **actions-cool/issues-helper**, exposing a serious risk to CI/CD pipelines.

Security researchers found that attackers compromised all existing tags in the repository and redirected them to a malicious “imposter commit.” This commit is not part of the original trusted history and was used to inject harmful code into workflows that rely on version tags.

What the malicious code does:

* Downloads the Bun JavaScript runtime on GitHub runners
* Extracts sensitive credentials from the CI/CD environment memory
* Exfiltrates stolen data to an attacker-controlled domain

Additionally, another related action, **actions-cool/maintain-one-comment**, was also found to be compromised in a similar way.

Why this is dangerous:

This attack highlights a critical weakness in how GitHub Actions are often used. When workflows reference actions by **tags instead of full commit SHAs**, they become vulnerable to upstream tampering. In this case, every tagged version now points to malicious code.

Key takeaway:

To stay protected, CI/CD pipelines should:

* Pin actions to a **specific full commit SHA**
* Regularly audit third-party GitHub Actions
* Monitor for unexpected changes in dependencies

GitHub has since disabled the affected repository due to policy violations, but the incident serves as another strong reminder that supply chain security is only as strong as its weakest dependency.

18/05/2026

Cybersecurity History Rewritten

Researchers have revealed that the “fast16” malware was a highly advanced cyber sabotage tool developed even before Stuxnet. The malware specifically targeted nuclear weapons simulations by tampering with engineering software like LS-DYNA and AUTODYN.

What makes this shocking is that fast16 only activated during uranium compression simulations, meaning it was designed with deep knowledge of nuclear weapons research. It manipulated mathematical calculations to generate false results, potentially sabotaging sensitive weapons programs without physical attacks.

Experts believe the malware dates back to around 2005 and may be linked to the Equation Group, allegedly associated with the NSA. The operation shows that nation-state cyber warfare and industrial sabotage were happening years before Stuxnet became public.

This discovery proves how cyber weapons can silently target critical research, industrial systems, and national security infrastructure.

14/05/2026

Microsoft introduces **MDASH AI System** — an advanced AI-powered cybersecurity platform designed to discover vulnerabilities in Windows at scale.

MDASH uses more than **100 specialized AI agents** to analyze code, validate findings, and prove exploitable security flaws automatically. In Microsoft’s latest Patch Tuesday, the system successfully identified **16 Windows vulnerabilities**, including critical remote code ex*****on flaws.

Key Highlights:
• AI-driven vulnerability discovery
• Multi-agent security analysis
• Faster detection & remediation
• Improved Windows security defense

This marks a major shift where AI is no longer just assisting cybersecurity — it is actively defending systems before attackers can exploit them.

12/05/2026

New Banking Malware Alert: TCLBANKER

Cybersecurity researchers have discovered a dangerous Brazilian banking trojan called TCLBANKER targeting banks, fintech apps, and cryptocurrency platforms.

What makes it dangerous?
• Steals banking credentials and sensitive data
• Uses fake login overlays & fake Windows update screens
• Can remotely control victim devices
• Spreads through WhatsApp Web & Microsoft Outlook
• Sends malware directly from victims’ own accounts

The malware also uses advanced anti-detection techniques to avoid antivirus and security analysis tools.

Stay Safe:
Avoid opening unknown ZIP/MSI files
Verify email attachments before opening
Enable 2FA on financial accounts
Keep antivirus and software updated

11/05/2026

Critical Security Alert for Node.js Developers

Researchers have discovered multiple critical vulnerabilities in the vm2 library that allow attackers to escape the sandbox and execute arbitrary code on the host system.

Affected versions: vm2 ≤ 3.11.1
Recommended fix: Update immediately to version 3.11.2

These vulnerabilities can allow attackers to:
• Escape the sandbox environment
• Execute system commands
• Access sensitive server resources
• Achieve Remote Code Ex*****on (RCE)

This incident highlights how difficult it is to securely isolate untrusted JavaScript code in sandbox environments.

If your application uses vm2 for running user-supplied JavaScript, patch your systems as soon as possible and review your security controls.

Address

Lahore Garrison University. , Sector C DHA Phase 6
Lahore

Opening Hours

Monday	08:00 - 16:00
Tuesday	08:00 - 16:00
Wednesday	08:00 - 16:00
Thursday	08:00 - 16:00
Friday	08:00 - 15:00

Website

http://www.dfrsc.org/

Alerts

Be the first to know and let us send you an email when Digital Forensics Research & Service Center - DFRSC posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.

Shortcuts

Want your university to be the top-listed University in Lahore?