Do Son Splunk exposes a campaign weaponizing Inno Setup installers to deploy RedLine Stealer, using obfuscated Pascal scripts and HijackLoader to steal browser/crypto data.
Malware
FortiGuard Labs exposes NordDragonScan, a new infostealer using weaponized HTA scripts in Ukrainian-themed phishing. It performs recon, steals browser profiles, and exfiltrates documents.
XMRig cryptojacking is surging, leveraging LOLBAS techniques, PowerShell, and Scheduled Tasks to mine Monero undetected, with a 45% rally in XMR price driving the attacks.
ASEC uncovers XwormRAT delivered via phishing emails using steganography, hiding sophisticated .NET malware within JPG images for stealthy execution and full system control.
NSFOCUS uncovers Hpingbot, a rapidly evolving Go-based botnet using Pastebin for payloads and hping3 for DDoS. It targets Windows/Linux/IoT, focusing on stealth and persistence.
Splunk uncovers XWorm's evolution: a modular RAT now delivering LockBit ransomware. It uses flexible delivery, AMSI/ETW bypasses, and process injection to evade detection.
Elastic Security Labs reveals SHELLTER Elite v11.0 is being abused to deploy LUMMA, RHADAMANTHYS, and ARECHCLIENT2 infostealers, leveraging advanced evasion techniques to bypass AV/EDR
FortiGuard Labs exposes RondoDox, a stealthy botnet exploiting critical flaws (CVE-2024-3721, CVE-2024-12856) in TBK DVRs & Four-Faith routers to launch sophisticated DDoS attacks.
Sucuri uncovers a stealthy WordPress malware plugin that mimics your domain to inject SEO spam for bots while remaining invisible to users, evading detection.
Wiz Research Team uncovers rapid exploitation of exposed JDWP interfaces, deploying XMRig cryptominers in TeamCity and other Java environments within hours of exposure.
North Korean APTs are using "NimDoor," a new Nim-based macOS malware, to target Web3/crypto startups via fake Zoom meetings, stealing browser, Keychain, and Telegram data with novel persistence.
Group-IB uncovers Qwizzserial, a new Android malware family stealing financial data from thousands in Uzbekistan by exploiting SMS-based 2FA via Telegram-distributed APKs.
Fortinet exposes a DCRat campaign impersonating a Colombian government agency, using obfuscated multi-stage infection, steganography, and AMSI bypass to deliver the RAT.
A new macOS information stealer, a potential AMOS variant, targets crypto users and Ledger Live accounts, stealing passwords and wallet data using stealthy daemonization and local admin prompt tactics.
A six-day RansomHub attack exploited RDP, used Atera/Splashtop RMM, Mimikatz, and Rclone to breach an enterprise, exfiltrate data, and deploy ransomware.
Sucuri uncovers a complex multi-stage malware campaign infecting WordPress sites via header.php to deliver a hidden RAT (client32.exe) and evade detection.
ASEC uncovers sophisticated attacks targeting South Korean Windows IIS and Linux systems, deploying WogRAT, MeshAgent, and SuperShell for cyber-espionage and lateral movement.
CYFIRMA uncovers "Odyssey Stealer," a new macOS malware using fake App Store prompts & typosquatting to steal crypto wallets, passwords, and browser data from Western users.
Netskope uncovers Sainbox RAT (Gh0stRAT variant) and Hidden rootkit delivered via fake software installers to Chinese users, leveraging DLL sideloading and sRDI for stealth.
A malicious Python package, 'psslib,' typosquats the popular 'passlib' library, forcing immediate Windows system shutdowns, causing data loss for unsuspecting developers.
SonicWall and Microsoft uncover a campaign distributing a trojanized NetExtender VPN client that steals credentials by bypassing certificate validation.
A rogue WordPress plugin is distributing multi-functional malware, performing credit card skimming, credential theft, ad fraud, and RCE through advanced evasion tactics.