An under-the-radar malvertising campaign targets Notepad++ users via compromised ad accounts, delivering time-sensitive .hta payloads and decoy Notepad++ pages. It fingerprint VM environments, uses a unique per-user ID, and communicates with a remote C2 domain…
Cofense observed a voice-message phishing campaign that used a dated HTML attachment and an included “access key” in the email to trick recipients into interacting with a staged voice message. The lure leads users to download a file hosted on an AWS URL disgui…
Cofense observed a large credential-phishing campaign that abused LinkedIn Smart Links (Sales Navigator team/business links) to deliver Microsoft Office credential harvesters via trusted LinkedIn URLs, allowing emails to bypass secure email gateways. The campa…
Trend Micro observed a campaign that uses compromised Skype and Microsoft Teams accounts to deliver a VBA/VBS loader which retrieves an AutoIt-based DarkGate payload. The chain abuses renamed/obfuscated binaries (curl.exe), AutoIt scripts (.au3), and LNK short…
Void Rabisu continues to evolve its ROMCOM backdoor family, delivering a slimmed-down variant (PEAPOD) via a fake Women Political Leaders (WPL) Summit website that lures victims to a OneDrive-hosted SFX downloader signed by Elbor LLC. The installer performs in…
Threat actors behind the “ClearFake” campaign have shifted from Cloudflare Workers to hosting malicious JavaScript payloads inside Binance Smart Chain (BSC) smart contracts, allowing read-only eth_call requests from compromised WordPress sites to retrieve and …
ESET researchers analyze LATAM threats under Operation King TUT, noting a shift to high‑value targets and evolving evasion methods. The study covers campaigns from 2019–2023, highlighting spearphishing, PowerShell/VBScript loaders, and RATs like njRAT and Asyn…
BloodAlchemy is a backdoor shellcode loaded into a signed benign process and linked to the REF5961 intrusion set. Elastic Security notes its active development, multiple loading and persistence modes, and a flexible C2/communication design. Hashtags: #BloodAlc…
CVE-2023-43261 likely saw in-the-wild exploitation of Milesight industrial cellular routers, but not at scale, and the CVE description itself is incomplete and sometimes inaccurate. A real-world write-up shows the flaw allowed remote access to the router’s web…
Kimsuky, a North Korea–sponsored threat group, leverages spearphishing and a suite of backdoors, infostealers, and remote-control tools to gain access and exfiltrate data from targets. The operation prominently relies on RDP and related tools (including RDP wr…
The XorDDoS Trojan campaigns compromised Linux devices to form a globally distributed botnet used for DDoS attacks, orchestrated through a resilient C2 network that migrated from dedicated resources to legitimate public hosting. The analysis covers attacking b…
Curl disclosed a high-severity heap buffer overflow in its SOCKS5 handling (CVE-2023-38545) that can overflow a heap buffer during the SOCKS5 proxy handshake and potentially lead to undefined behavior or RCE. Detection is difficult when libcurl is embedded in …
An attacker (pseudonym “kohlersbtuh15”) uploaded multiple typosquatted and starjacked Python packages to PyPI in September 2023 to target developers using Telegram, AWS, and Alibaba Cloud; the packages hide malicious logic inside library functions so the code …
Two QR-code-based phishing campaigns are analyzed, showing attackers bypass email security by using images of text and QR codes in emails and attachments instead of readable URLs. The campaigns employ layered evasion (redirection, anti-bot checks, CAPTCHA evas…
Symantec Threat Hunter Team attributes a new APT group, Grayling, to a campaign targeting multiple organizations in Taiwan’s manufacturing, IT, and biomedical sectors, with additional victims in the Pacific Islands government, Vietnam, and the U.S. The operati…