AsyncRAT is being distributed in a fileless form via phishing emails, where a compressed attachment leads to an HTML file that generates a malicious ISO containing VBScript and BAT components. The infection chain culminates in a PowerShell-based loader that in…
ASEC’s analysis shows BitRAT and XMRig CoinMiner being distributed as a Windows license verification tool, with the payloads deployed via a MediaFire-hosted 7z SFX bundle and downloader chains that depend on the victim’s environment. The campaign uses Defender…
XCSSET, a macOS malware family, updated in 2022 to adapt to macOS Monterey and to prepare for a future without Python by removing Python-based components and shifting toward SHC-compiled droppers and run-only AppleScripts. The analysis outlines infection refin…
Today’s diary describes a Brazilian malspam campaign delivering Astaroth (Guildma) malware via a Boleto-themed email pretending to be from Grupo Solução & CIA. The malicious ZIP contains a Windows shortcut and a batch file used to infect a Windows host and exf…
Two sentences: Cyble Research Labs dissected an IBAN Clipper malware that targets Windows by monitoring the clipboard and swapping bank account numbers with the attacker’s data. The malware uses remote fetching of IBANs, multithreading for speed, and persisten…
Cyble Research Labs highlights BianLian as a Go language-based ransomware variant that targets multiple industries and leverages cross-platform capabilities to complicate reverse engineering. The campaign includes file encryption across drives, ransom notes, a…
Fortinet FortiGuard Labs analyzes a spearphishing campaign against a South Asian telecommunications agency, weaponizing an RTF document with Royal Road to exploit CVE-2018-0798 and drop a DLL chain leading to PoisonIvy (PivNoxy/Chinoxy) backdoors. The report o…
TA558 is a financially motivated threat actor targeting hospitality, hotel, and travel organizations, predominantly in Latin America, with activity in Western Europe and North America. From 2018 onward, Proofpoint observed TA558 repeatedly using reservation-th…
Cyble researchers exposed a dark web post by a malware developer selling a powerful Windows RAT suite, including XWorm with ransomware and HVNC capabilities. The article details the toolset, persistence and anti-analysis techniques, data exfiltration, and the …
ThreatLabz observed a Grandoreiro banking Trojan campaign targeting Mexico and Spain across multiple industry verticals, using spear-phishing emails that impersonate government officials to lure victims to download and execute Grandoreiro. The loader employs a…
DarkTortilla is a highly configurable .NET-based crypter that delivers commodity information stealers and RATs, with targeted payloads such as Cobalt Strike and Metasploit. It uses a two-component architecture (initial loader and core processor) with strong an…
Cybereason GSOC analyzes a Bumblebee Loader infection, detailing the attack chain from initial lure to full network compromise and Active Directory takeover, with notes on post-exploitation actions, credential theft, and data exfiltration. The report also high…
Follina (CVE-2022-30190) is a remote-code-execution vulnerability in Microsoft’s MSDT exploited via Word documents that load a remote template containing a payload. Researchers show how attackers used remote templates and base64-encoded PowerShell to run code,…
Two newly discovered malicious PyPI packages masquerade as a popular library to steal data and credentials, delivering a multi-stage payload that culminates in the W4SP Stealer which exfiltrates browser data and Discord tokens via a Discord webhook. The campai…
A Checkmarx analysis details a large typosquatting campaign targeting Python’s top packages that drops Windows malware hosted on GitHub and uses a domain-generation algorithm for C2. The operation also includes DDOS capabilities, anti-sandbox tricks, and persi…