LOLBins

Fileless Remcos RAT Hijacks Trusted Windows Tools

• Malware

Fileless Remcos RAT Hijacks Trusted Windows Tools

Do Son April 7, 2026 0

Researchers unmask a fileless Remcos RAT campaign using obfuscated JS and LOLBins to hijack systems in-memory. See the technical breakdown from Lat61.

The Python Predator: PXA Stealer Surges 10% as it Targets Global Finance and Crypto in 2026

• Malware

The Python Predator: PXA Stealer Surges 10% as it Targets Global Finance and Crypto in 2026

Do Son April 6, 2026 0

PXA Stealer activity surges in Q1 2026, targeting global finance. Learn how this Python-based malware uses Telegram and LOLBins to hijack crypto and banking data.

The Rise of SILENTCONNECT: New Stealthy Loader Exploits Trusted Cloud Giants

• Malware

The Rise of SILENTCONNECT: New Stealthy Loader Exploits Trusted Cloud Giants

Do Son March 26, 2026 0

Elastic Security Labs uncovers SILENTCONNECT, a stealthy loader using Cloudflare and Google Drive to deliver RMM tools for "hands-on keyboard" attacks.

Ghost in the Browser: Advanced ‘GoPix’ Trojan Unveils Unprecedented MitM Attacks

• Malware

Ghost in the Browser: Advanced ‘GoPix’ Trojan Unveils Unprecedented MitM Attacks

Do Son March 19, 2026 0

Kaspersky Labs details GoPix, a highly advanced Brazilian banking Trojan using memory-only implants and MitM attacks to target Pix and crypto.

CL-UNK-1068: The Stealthy Chinese Threat Actor Haunting Asian Infrastructure

• Cybercriminals

CL-UNK-1068: The Stealthy Chinese Threat Actor Haunting Asian Infrastructure

Do Son March 11, 2026 0

Unit 42 uncovers CL-UNK-1068, a Chinese APT targeting Asian critical infrastructure using stealthy web shells, LOLBINs, and screen-printed exfiltration.

JS#SMUGGLER Malware Evades EDR Using “Junk Code” JavaScript and Fileless PowerShell to Deploy NetSupport RAT

• Malware

JS#SMUGGLER Malware Evades EDR Using “Junk Code” JavaScript and Fileless PowerShell to Deploy NetSupport RAT

Do Son December 9, 2025 0

The JS#SMUGGLER campaign uses "Junk Code" JavaScript and fileless PowerShell executed via mshta.exe to bypass EDR. This multi-stage attack silently installs the NetSupport RAT.

Tangerine Turkey Cryptomining Worm Spreads Via USB Drives, Hides Payloads with VBScript and LOLBins

• Malware

Tangerine Turkey Cryptomining Worm Spreads Via USB Drives, Hides Payloads with VBScript and LOLBins

Do Son November 3, 2025 0

Cybereason exposed Tangerine Turkey, a VBScript worm that spreads via USB drives. It uses LOLBins (printui.exe) and Windows Defender exclusions to deploy the XMRig cryptominer for profit.

New LNK Malware Uses Windows LOLBins to Evade Detection

• Malware

New LNK Malware Uses Windows LOLBins to Evade Detection

Do Son September 25, 2025 0

A new campaign uses a malicious LNK shortcut sent via Discord to deploy a multi-functional RAT that hijacks legitimate Windows binaries to evade detection.

RedCurl APT Group: Cyber Espionage with Living-Off-the-Land Techniques

• Cyber Security
• Malware

RedCurl APT Group: Cyber Espionage with Living-Off-the-Land Techniques

Do Son January 12, 2025 0

Discover the latest cyber threat: RedCurl APT group. Learn about their sophisticated techniques and targeted cyber espionage campaigns.

LNK Files and SSH Commands: The New Arsenal of Advanced Cyber Attacks

• Cyber Security

LNK Files and SSH Commands: The New Arsenal of Advanced Cyber Attacks

Do Son December 22, 2024 0

Uncover the stealthy techniques threat actors are using: LNK files and SSH commands in advanced cyberattacks.