Do Son Jamf Threat Labs uncovers GhostClaw, a macOS threat exploiting GitHub stars and AI workflows to steal credentials. Protect your dev environment today!
Malware Distribution
Unit 42 exposed two massive campaigns (Trio & Chorus) using 2,500 spoofed domains to target Chinese users. The multi-stage attack uses MSI/VBScript and DLL sideloading via Avast to deploy Gh0st RAT.
Check Point exposed the YouTube Ghost Network, a coordinated op using 3,000+ videos (Game/Software Cracks) to spread Rhadamanthys/Lumma infostealers via fake engagement and external file hosts.
Mandiant exposed UNC5142 for using EtherHiding—hiding malicious JavaScript in BNB Smart Chain smart contracts—to create a resilient C2 and distribute VIDAR/ATOMIC to 14,000+ sites.
RVTools briefly hijacked in a Bumblebee malware supply chain attack. Learn how attackers used a trusted tool to deliver post-exploitation payloads.
A deep dive into Lumma Stealer's sophisticated techniques: from fake CAPTCHAs to complex infection chains designed to evade detection and steal sensitive data.