Expel Archives • Daily CyberSecurity

SynkLoader Malware Deploys Multi-Language Attack Tools

C2Looper Rust backdoor diagram showing GitHub command-and-control and ClickFix ransomware infection chain

SynkLoader Malware Deploys Multi-Language Attack Tools

Do Son August 28, 2026

Expel analyzed the SynkLoader malware attack chain. Discover how SynkLoader malware uses Teams phishing and fake lock screens to steal credentials.

The CAPTCHA Trap: ClearFake Malware Tricks Users Into Hacking Themselves axios Supply Chain Attack WAVESHAPER.V2 SnappyBee Malware Salt Typhoon Stately Taurus ScoringMathTea RAT, Lazarus Reflective DLL

axios Supply Chain Attack WAVESHAPER.V2 SnappyBee Malware Salt Typhoon Stately Taurus ScoringMathTea RAT, Lazarus Reflective DLL

The CAPTCHA Trap: ClearFake Malware Tricks Users Into Hacking Themselves

Do Son January 27, 2026

New ClearFake malware uses fake CAPTCHAs & "ClickFix" tactics to trick users into pasting malicious code. 150k victims infected via blockchain.

Malformed & Dangerous: Gootloader Returns with New Ransomware Ties Ollama Heap Leak CVE-2026-5757 Anritsu Vulnerability Authentication Bypass Gootloader Malware Malformed ZIP Evasion Blender Malware, StealC V2 Lectora, XSS CVE-2025-9125 HFS RCE, Template Injection Arch Linux Malware, CHAOS RAT CVE-2024-56404 - CVE-2024-39327 CVE-2025-2538

Ollama Heap Leak CVE-2026-5757 Anritsu Vulnerability Authentication Bypass Gootloader Malware Malformed ZIP Evasion Blender Malware, StealC V2 Lectora, XSS CVE-2025-9125 HFS RCE, Template Injection Arch Linux Malware, CHAOS RAT CVE-2024-56404 - CVE-2024-39327 CVE-2025-2538

Malformed & Dangerous: Gootloader Returns with New Ransomware Ties

Do Son January 20, 2026

Gootloader returns with malformed ZIPs to bypass detection. New alliance with Vanilla Tempest fuels Rhysida ransomware attacks. See the detection tips.

Zero-Download Malware: New Cache Smuggling Phishing Attack Delivers Payload via Browser Cache DriverFixer0428, Contagious Interview Cache Smuggling, ClickFix Evasion North Korean Cyber Espionage

DriverFixer0428, Contagious Interview Cache Smuggling, ClickFix Evasion North Korean Cyber Espionage

Zero-Download Malware: New Cache Smuggling Phishing Attack Delivers Payload via Browser Cache

Do Son October 10, 2025

Expel uncovered a phishing attack using Cache Smuggling to deliver malware. The technique uses a fake Fortinet lure and PowerShell to execute a payload staged in the browser's cache, bypassing network detection.

Unveiling BaoLoader: How One Malware Family Abuses Trust for 7 Years BaoLoader, code-signing abuse

Unveiling BaoLoader: How One Malware Family Abuses Trust for 7 Years

Do Son September 15, 2025

Researchers expose BaoLoader, a malware operation that has systematically used at least 26 code-signing certificates over seven years to appear legitimate and bypass security.

Expel Uncovers Malicious PUP Ecosystem Masquerading as Free Utility Apps Potentially unwanted program, residential proxy

Expel Uncovers Malicious PUP Ecosystem Masquerading as Free Utility Apps

Do Son August 26, 2025

A new report reveals that potentially unwanted programs are evolving into malicious software that turns victims' computers into residential proxies for a profit.