Jamf Threat Labs uncovered pirated macOS apps backdoored with a dylib that downloads and executes payloads, secretly compromising the victim’s machine. The campaign shows ZuRu-like traits, including attacker infrastructure communications and persistence via La…
macOS threats are evolving, with a Python-based script targeting wallet apps Exodus and Bitcoin Core by replacing them with rogue equivalents. The malware exfiltrates system data, can execute commands from a C2 server, and uses Electron and AppleScript to impe…
Androxgh0st is a Python-scripted malware used to build a botnet that scans for and exploits vulnerable web applications (notably Laravel and sites with exposed PHPUnit files) to steal credentials and deploy web shells. Observed behaviors include exploiting CVE…
Microsoft observed a technically mature Mint Sandstorm (PHOSPHORUS) subgroup targeting high-profile academics and researchers involved in Middle Eastern affairs across Belgium, France, Gaza, Israel, the UK, and the US, using bespoke phishing lures and social e…
McAfee Labs describes a sophisticated VBScript-driven campaign that began with AgentTesla and now distributes Remcos RAT along with other malware like Guloader, Xworm, and Lokibot. The attack chain uses obfuscated VBS, staged PowerShell, reflective shellcode l…
CRIL identified a Go Stealer variant potentially targeting Indian Air Force personnel, distributed via a ZIP named “SU-30_Aircraft_Procurement” hosted on Oshi. The attack chain progresses ZIP -> ISO -> LNK to deploy a Go-based credential stealer that exfiltrat…
This analysis dissects the Pure malware family, focusing on PureCrypter (a .NET crypter/loader) and PureLogs (a multifunctional stealer), their staged and stage-less loaders, encryption/decompression routines, and C2 traffic formats. The report details decrypt…
Securonix Threat Research analyzes how legitimate RMM tools (Atera, NetSupport, AnyDesk, Splashtop) are abused by threat actors to maintain stealthy command-and-control, persistence, and file transfers that lead to ransomware and data theft. The article outlin…
The article documents how the Mimo threat actor exploits a range of public-facing vulnerabilities to install malware, including CoinMiners, Mimus ransomware, proxyware, and reverse shell tools. It also details the intrusion chain, from initial exploitation to …
Volexity found widespread exploitation of two zero-day vulnerabilities in Ivanti Connect Secure (CVE-2024-21887 and CVE-2023-46805), identifying over 1,700 compromised appliances backdoored with the GIFTEDVISITOR webshell. Organizations should apply Ivanti’s m…
Atomic Stealer (AMOS) is a macOS-focused credential and file stealer that collects browser wallets, keychain items, system info, and user files, then archives and exfiltrates them to C2 servers. The latest AMOS version encrypts its strings with a custom XOR-ba…
Guardio Labs discovered a critical cross-platform zero-day in Opera’s My Flow feature that allowed a malicious extension to write and execute files on Windows and macOS by abusing a built-in high-permission extension. The issue relied on forgotten Opera-hosted…
About a month ago, we started seeing reports on activities from DuckTail , a cybercrime outfit reportedly based in Vietnam. Detonating one of the samples, we observed that a new account was being created on the analysis machine, followed by……
“PT Kereta Api Indonesia” is the national railway company in Indonesia, also known as “Kereta Api.” It is responsible for operating train services throughout the country. The company was established to provide public transportation via railways and plays a vital role in connecting cities and regions in Indonesia.
Discover how GitHub is increasingly exploited for cyberattacks in our latest report.