The Malwarebytes investigation uncovers a massive utility scam campaign that uses geo-targeted Google search ads to lure victims into dialing fraudulent numbers or visiting fake energy-insurance sites. The operation relies on a sprawling infrastructure of doma…
The Agniane Stealer is an information-stealing malware that targets cryptocurrency wallets. The article provides a technical analysis of its delivery chain, obfuscation methods, C2 protocol, and new reverse-engineering insights to aid incident response and det…
Insidious Taurus (also known as Volt Typhoon) is a PRC-aligned APT that pre-positions inside U.S. critical infrastructure by exploiting internet-facing devices and chaining compromised SOHO equipment into covert relay networks such as the KV-botnet. Their tool…
AttackIQ published three attack graphs that emulate DarkGate activity observed in 2023, covering delivery chains (Teams/Skype phishing, SEO poisoning, drive-by downloads, and malicious email) and post-compromise behaviors like process hollowing, Defender exclu…
Mandiant integrated capa v7 into Ghidra using two Python 3 scripts, bringing capa’s capability detections into Ghidra’s UI (symbol tree entries, bookmarks, and inline comments) and providing a text-mode output usable in Ghidra’s console or headless analyzer. T…
FortiGuard research describes a multi-stage .NET dropper family dubbed “TicTacToe” that delivers various final-stage RATs and info stealers by unpacking layered, obfuscated DLLs directly into memory. The dropper is distributed via ISO attachments and uses Deep…
Check Point Research disclosed a vulnerability in Microsoft Outlook where specially-crafted file:// hyperlinks containing an exclamation mark (the “#MonikerLink” pattern) are parsed as COM monikers, causing Outlook to call MkParseDisplayName and hand attacker-…
The article demonstrates how attackers can avoid detection by using shell builtins (like bash’s read and echo) to perform file operations without spawning external processes, thereby bypassing security tools that monitor process-creation syscalls. It shows tha…
K7 Labs analyzed a new Zloader variant that enforces execution only when named IonPulse.exe and uses ntdll copying, syscall usage, and process injection into msiexec.exe to run its payload and connect to C2. The sample performs API hashing/dynamic resolution, …
The primary goal of Malpedia is to provide a resource for rapid identification and actionable context when investigating malware. Openness to curated contributions shall ensure an accountable level of quality in order to foster meaningful and reproducible research. Malware Wikipedia – Click here Thr…
QR code attacks are particularly dangerous because they move the attack vector off a protected computer and onto the target’s personal mobile device, which usually has fewer security protections in place and ultimately has the sensitive information that attackers are after….
SANS Instructors have built more than 150 open source tools that support your work and help you implement better security. Search the lists on the following pages for the free tools that will help you get the job done. Download PDF file : https://assets.contentstack.io/v3/assets/blt36c2e63521272fdc/…
Cyble researchers track a Go-based JKwerlo Ransomware campaign targeting French and Spanish speakers, delivered via language-specific HTML files that embed zip archives. The operation relies heavily on PowerShell for its execution flow, with multi-stage payloa…
ReliaQuest reports a new SocGholish evolution that uses Python to persist on hosts, signaling an evolution in its tactics beyond the Blister Loader. The infection chain starts with suspicious JavaScript (update.js) and moves through an ingress of Python, a hid…
CYFIRMA analyzes XSSLite, an infostealer released as part of the XSSWare malware development competition on a Russian forum, and its spread to other communities. The report highlights capabilities, defense-evasion techniques, and how underground competitions a…