GitHub identified a low-volume social engineering campaign that targets the personal accounts of employees at technology firms, using fake persona accounts on GitHub and other platforms to lure victims into collaborating on a repository. The malicious npm depe…
Mallox is a ransomware operation targeting Windows systems, leveraging unsecured MS-SQL servers as an entry point and using brute-force techniques to gain access. It employs a double-extortion model, steals data before encryption, and is expanding via affiliat…
Lazarus, a threat group believed to be nationally funded, is targeting Windows IIS web servers and repurposing them as malware distribution points via watering hole attacks and INISAFE CrossWeb EX vulnerabilities. The group uses w3wp.exe to run malware, escala…
In 2022, Kaspersky ICS CERT investigated a series of attacks against industrial organizations in Eastern Europe aiming to establish a persistent data-exfiltration channel, including from air-gapped systems. Attribution points to APT31 (Judgment Panda / Zirconi…
Authored by Yukihiro Okutomi McAfee’s Mobile team observed a smishing campaign against Japanese Android users posing as a power and…
The post Android SpyNote attacks electric and water public utility users in Japan appeared first on McAfee Blog….
Lookout attributes two modular Android surveillanceware families, WyrmSpy and DragonEgg, to Chinese APT41 based on shared signing certificates and overlapping C2 infrastructure linking to Chengdu 404. Both implants request broad device permissions, download se…
JPCERT/CC details a DangerousPassword–linked campaign that targets developers in cryptocurrency exchanges across Windows, macOS, and Linux using Python and Node.js-based malware. The lifecycle includes multi-stage downloads, C2 beacons, and DLL sideloading, wi…
HKLEAKS was a coordinated online harassment operation that doxxed Hong Kong protesters and allied figures, leveraging multiple platforms and a cross-asset network to intimidate targets while masking operators’ identities. The report argues HKLEAKS was an artif…
The CYFIRMA report identifies Blank Grabber as an open-source infostealer builder (reintroduced with high evasiveness) that targets Windows and constantly evolves with new features. It emphasizes its data-exfiltration capabilities, evasion techniques, and use …
Independent cybersecurity researchers uncovered a cluster of malicious Chrome extensions in the Chrome Web Store, with a total of about 87 million downloads. The extensions could load remote code, modify search results, and potentially exfiltrate data from use…
A deceptive PoC has been found that hides a backdoor inside what should be a safe learning tool for security researchers. Discovered by Uptycs, the PoC downloads and executes a hidden Linux bash script, persists via kworker and bashrc, and can exfiltrate data …
Vade’s Threat Intelligence and Response Center (TIRC) detected a new Microsoft 365 phishing campaign delivered via a malicious HTML attachment that loads a fake authentication form hosted on glitch.me. The operation uses base64-encoded payloads, JavaScript in …
Fortinet’s FortiGuard Labs analyzes the Rancoz ransomware in its Ransomware Roundup, detailing its Windows-focused encryption, ransom notes, wallpaper change, and potential links to related variants like Buddy ransomware. The report also notes limited victim s…
The article outlines a new APT29 campaign called “Information,” detailing an SVG dropper, DLL side-loading, and C2 behaviour used in a multi-stage infection. It describes an email phishing chain impersonating the Norwegian embassy, HTML smuggling via an SVG, a…
Two weeks after reporting PDF Toolbox, researchers uncovered a broader campaign: 34 malicious Chrome Web Store extensions with a combined 87 million users, using obfuscated code and remote configuration to inject JavaScript into visited sites. The malware vari…