SEO poisoning is described as a rising method threat actors use to seed malicious sites in top search results after blocking malicious macros in Office. The article analyzes the Gootkit loader’s multi-stage delivery, decoding, and C2 behavior, highlighting how…
ASEC monitors phishing email threats focused on attachments, highlighting FakePage as the dominant method that imitates real login pages to harvest credentials, followed by Downloader, Worm, and Infostealer families distributing malware and stealing data. The …
FortiGuard Labs analyzes the UNIZA ransomware, a Windows-targeting variant that encrypts user files and displays its ransom message via the Command Prompt. It also notes the likely phishing-based infection vector, limited current spread, and Fortinet protectio…
Elastic Security Labs uncovers LOBSHOT, a stealthy hVNC-capable malware tied to TA505, spread via malvertising campaigns that impersonate legitimate software. The analysis provides a YARA signature and a configuration extractor, detailing infection, persistenc…
Cyble researchers reveal a Golang-based macOS stealer named Atomic macOS Stealer (AMOS) advertised on Telegram, designed to exfiltrate a wide range of victim data. The malware collects keychain passwords, system information, Desktop/Documents files, macOS pass…
ESET researchers linked a campaign to the Evasive Panda APT group that hijacked update channels of legitimate Chinese software to deliver MgBot, the group’s flagship backdoor. The report also details MgBot’s modular plugin toolkit and analyzes two main deliver…
Researchers detail a Magecart campaign in which a threat actor uses a custom fraudulent modal to hijack checkout and steal credit card data from compromised Prestashop stores. The skimmer relies on a well-crafted modal, dynamic HTML, obfuscated code, and a red…
Authored by Dexter Shin McAfee Mobile Research Team found an Android banking trojan signed with a key used by legitimate…
The post Fakecalls Android Malware Abuses Legitimate Signing Key appeared first on McAfee Blog….
Infoblox identifies a rare DNS-based toolkit named Decoy Dog, built around the Pupy RAT, observed in enterprise networks through DNS beacons and encrypted DNS traffic. The report links possible Earth Berberoka activity and outlines three infrastructure models …
RedEyes (ScarCruft/APT37) has expanded its toolkit by distributing RokRAT via LNK files. The LNKs trigger PowerShell to create and execute payloads in the Temp folder, download encoded data from cloud storage, and deploy RokRAT to harvest credentials. Hashtags…
The Tonto Team targets mainly Asian countries and has been distributing Bisonal malware, using anti-malware-related files to facilitate DLL side-loading. ASECs analysis traces evolving CHM-based campaigns in Korea, persistence via RUN keys, and C2 communicatio…
Zero Day Initiative — TP-Link WAN-side Vulnerability CVE-2023-1389 Added to the Mirai Botnet Arsenal
Zero Day Initiative flagged Mirai expanding its toolkit by incorporating CVE-2023-1389 to target TP-Link Archer AX21 routers, with evidence of active exploitation starting in April after TP-Link’s patch. The malware downloads and executes architecture-specific…
Unit 42 identified a new PingPull Linux variant used by Alloy Taurus, alongside a related backdoor dubbed Sword2033, expanding their Linux-focused espionage toolkit. The findings link these tools to Alloy Taurus’s C2 infrastructure and regional activity in Sou…
BellaCiao is a highly customized dropper linked to Charming Kitten (APT35) that targets US, European, Middle Eastern, and Indian victims with victim-specific data and C2 communication. The implant combines a tailored payload, a DNS-based command channel, and m…
PaperCut CVE-2023-27350 and CVE-2023-27351 allow remote code execution and authentication bypass on PaperCut MF/NG servers, with unpatched systems actively exploited in the wild. The article highlights PoC dispersion via hacktivist channels and rising ransomwa…