Tag: TROJAN

FinStealer
This article discusses a sophisticated malware campaign targeting a leading Indian bank through fake mobile applications, advancing financial fraud via credential theft and social engineering. Key tactics include phishing links, dynamic payloads, and encrypted communications with C2 servers. The malware’s primary objective is to steal credentials and sensitive data for financial gain.…
Read More
In November 2024, ten hacking groups were detected engaging in various cybercriminal activities, including stealing sensitive information, deploying ransomware, and mining cryptocurrency. Each group employed different methods such as phishing, malware distribution, and obfuscation techniques to achieve their objectives, often targeting companies and individuals across multiple countries.…
Read More
Fake Google Chrome Sites Distribute ValleyRAT Malware via DLL Hijacking
Summary: Bogus websites posing as Google Chrome distributors have been employed to spread a remote access trojan known as ValleyRAT, attributed to the Silver Fox threat actor. This malware primarily targets key organizational roles in financial and sales sectors within Chinese-speaking regions, utilizing sophisticated attack chains to deploy other malicious software.…
Read More
North Korean APT Kimsuky Uses forceCopy Malware to Steal Browser-Stored Credentials
Summary: The North Korea-affiliated hacking group Kimsuky has been identified as executing spear-phishing attacks using a malware named forceCopy, which targets web browser configuration files for credential theft. Their attacks involve deceptive emails that contain malicious Windows shortcuts leading to secondary payload downloads, including trojans and proxy malware.…
Read More
University site cloned to evade ad detection distributes fake Cisco installer
This article discusses the methods used by attackers in the online advertising sector, particularly through malvertising campaigns. It highlights a specific case involving a fake Google ad for Cisco AnyConnect that redirected users to a phishing site and ultimately distributed the NetSupport RAT Trojan. Attackers employed clever disguises, such as impersonating a legitimate university, while relying on newly registered domains to bypass detection systems.…
Read More
New ValleyRAT Malware Variant Spreads via Fake Chrome Downloads
Summary: Morphisec Threat Lab has identified a new variant of the ValleyRAT malware that leverages advanced evasion techniques and multi-stage infection methods targeting high-value individuals, especially in finance and sales sectors. This malware is being distributed through phishing emails, messaging platforms, and compromised websites, with a notable new delivery method involving a fake Chinese telecom website.…
Read More
AsyncRAT Reloaded: Using Python and TryCloudflare for Malware Delivery Again
The Forcepoint X-Labs research team has uncovered a new AsyncRAT malware campaign, utilizing malicious payloads via TryCloudflare quick tunnels and disguised Python packages. The attack initiates with a phishing email containing a Dropbox link, which leads to a complex series of downloads that mislead users into executing malware while presenting a legitimate PDF.…
Read More
ALPHV Ransomware: Analyzing the BlackCat After Change Healthcare Attack
The ALPHV ransomware group, also known as BlackCat, has emerged as a significant threat by operating under a Ransomware-as-a-Service model. They caused a major healthcare data breach in February 2024, affecting over 100 million individuals when they attacked Change Healthcare, a subsidiary of UnitedHealth Group. The incident prompted UnitedHealth to pay a million ransom.…
Read More
AsyncRAT Abusing Python and Cloudflare Tunnels for Stealthy Malware Delivery
Summary: Forcepoint’s X-Labs has identified a new malware campaign leveraging AsyncRAT, Python scripting, and TryCloudflare tunnels for stealthy payload delivery. This campaign illustrates a growing trend of attackers using legitimate infrastructure to obscure their malicious activities, posing a significant cybersecurity threat. Through a detailed multi-stage infection process, the attackers manage to bypass traditional security measures, emphasizing the need for enhanced detection strategies.…
Read More
AsyncRAT Campaign Uses Python Payloads and TryCloudflare Tunnels for Stealth Attacks
Summary: A malware campaign delivering the AsyncRAT, a remote access trojan, has been identified utilizing Python payloads and TryCloudflare tunnels. Attackers employ phishing emails to initiate the attack, misleading users into downloading malicious payloads while masquerading as legitimate documents and URLs. This campaign highlights the evolving tactics of cybercriminals using trusted infrastructure to exploit vulnerabilities in user trust.…
Read More
XE Group Cybercrime Gang Moves from Credit Card Skimming to Zero-Day Exploits
Summary: Researchers have uncovered that the Vietnamese cybercrime group XE Group has shifted its tactics to exploit zero-day vulnerabilities in the VeraCore enterprise software, previously targeting credit card-skimming. This investigation highlights their unauthorized access and deployment of malicious tools to exfiltrate data and compromise network security.…
Read More
Coyote Malware Expands Reach: Now Targets 1,030 Sites and 73 Financial Institutions
Summary: Brazilian Windows users are being targeted by a sophisticated banking malware campaign known as Coyote, which executes various malicious activities like keylogging and credential theft. Initially delivered through LNK files that run PowerShell commands, this malware can extract sensitive information from over 1,030 websites and 73 financial agents.…
Read More
Winterthur Media Outlets Hit by Cyberattack Disrupting Live Broadcasts

Date Reported: 2025-02-02 Country: CHE | Switzerland Victim: Radio Top, Tele Top | Radio Top, Tele Top Website: toponline.ch Information : Winterthur media outlets were targeted in a cyberattack over the weekend. The attack disrupted live broadcasts and production for Radio Top and Tele Top. A cryptographic Trojan was responsible for the attack, affecting the company’s systems.…
Read More
ClickFix vs. traditional download in new DarkGate campaign
This article discusses recent malware campaigns utilizing the “ClickFix” technique, which misleads users into executing malicious code through fake CAPTCHA pages. The campaigns have targeted brands like Notion, employing both ClickFix and traditional file download methods to deliver the DarkGate malware loader. Affected: Notion

Keypoints :

Numerous malware campaigns have emerged using the “ClickFix” technique.…
Read More