Do Son FortiGuard exposed a cross-regional campaign that expanded to Malaysia using HoldingHands malware. The malware hijacks Task Scheduler via TimeBrokerClient.dll to achieve stealthy persistence.
Malware Evasion
Expel uncovered a phishing attack using Cache Smuggling to deliver malware. The technique uses a fake Fortinet lure and PowerShell to execute a payload staged in the browser's cache, bypassing network detection.