Do Son WARMCOOKIE has resurfaced post-Operation Endgame with new execution handlers, a MaaS model, and evasive techniques like disguised scheduled tasks using company names.
MaaS
Olymp Loader, a new assembly-based MaaS, has emerged in underground markets. It's a turnkey solution for cybercriminals, with stealth and persistence features.
A new report reveals HijackLoader, a Malware-as-a-Service loader. It uses advanced evasion and anti-analysis techniques to deliver stealers and other payloads.
Salat Stealer, a new Go-based MaaS, is hijacking browsers and crypto wallets. The malware is sold by Russian-speaking operators on the dark web.
IBM X-Force exposes CastleBot, a new MaaS framework that deploys infostealers and backdoors like NetSupport and WarmCookie via trojanized installers and phishing.
Silent Push exposes SocGholish as a MaaS platform for Initial Access Brokers. The malware, disguised as fake updates, fuels top-tier Russian ransomware groups like Evil Corp.
Cleafy uncovers PlayPraetor, a Chinese-speaking MaaS Android RAT that has infected 11,000+ devices, using real-time control via Accessibility Services to conduct on-device fraud.
Elastic Security Labs exposes NOVABLIGHT, a NodeJS-based infostealer-botnet MaaS disguised as an "educational tool," actively distributed via Telegram and targeting victims with fake game installers.
Cyfirma reveals Raven Stealer, a new, lightweight MaaS infostealer built in Delphi/C++, using reflective process hollowing and Telegram bots for stealthy data exfiltration from browsers.
eSentire unveils Cyber Stealer, a new infostealer-botnet hybrid offered as a service, fusing data theft, remote control, crypto mining, and DDoS attacks into one scalable toolkit.
Katz Stealer is a dangerous MaaS info-stealer (starting at $100/month) that plunders digital identities, evades detection with stealthy techniques, and targets a vast array of sensitive data.
Matanbuchus 3.0, a new sophisticated malware loader, is using social engineering via Microsoft Teams to infiltrate enterprise systems with advanced evasion tactics.
Cisco Talos uncovers a sophisticated MaaS operation leveraging public GitHub repos and the Emmenhtal loader to distribute Amadey, SmokeLoader, and AsyncRAT, often via phishing.
AntiDot, an Android trojan from LARVA-398, is infecting thousands of devices via MaaS, using MediaProjection API and Accessibility Services to steal financial and personal data.
Amatera Stealer, a rebranded and enhanced version of ACR Stealer, uses advanced evasion tactics like NTSockets and WoW64 syscalls to steal data from browsers, crypto wallets, and apps.
A new campaign, "Stargazers Ghost Network," weaponizes Minecraft mods on GitHub to distribute a multi-stage infostealer, targeting user credentials and crypto wallets.
A new wave of invoice-themed phishing emails is distributing the Sorillus RAT across Europe, leveraging legitimate platforms like OneDrive and Ngrok for stealthy delivery.
Katz Stealer, a new stealthy MaaS, is actively stealing data from browsers, crypto wallets, and apps, using advanced evasion tactics like steganography and Discord hijacking.
DanaBot's "DanaBleed" memory leak, active for 3 years, exposed C2 server data, aiding law enforcement in Operation Endgame takedown.
Katz Stealer, a new MaaS infostealer, targets browsers, crypto wallets, and Discord using advanced evasion and UAC bypass techniques.
Trellix analysis reveals Lumma Stealer's latest tactics: code obfuscation, API hashing, ETW evasion, anti-VM. Learn how this InfoStealer avoids detection.
TROX Stealer exploits urgency via phishing emails to deliver obfuscated MaaS malware that steals credit cards, browser data, and crypto wallets