Do Son eSentire uncovered a sophisticated attack on a US accounting firm, deploying PureRAT via the new Ghost Crypt crypter and a stealthy "Process Hypnosis" injection technique.
malware
Matanbuchus 3.0, a new sophisticated malware loader, is using social engineering via Microsoft Teams to infiltrate enterprise systems with advanced evasion tactics.
Seqrite Labs uncovers UNG0002, a South Asian APT group using advanced social engineering and new malware like Shadow RAT to target various sectors across Asia.
Proofpoint reveals a surge in China-aligned cyber espionage targeting Taiwan's semiconductor industry with spearphishing, Cobalt Strike, and new malware like Voldemort.
Microsoft and eSentire expose SilentRoute, a backdoored SonicWall SSL VPN NetExtender client distributed via SEO poisoning, stealing credentials and breaching networks.
Imperva uncovered a PyPI supply chain attack: "cloudscrapersafe" disguised as a legitimate Python library, stealing credit card data and exfiltrating it to a Telegram bot.
A sophisticated phishing campaign using a typosquatting domain (npnjs.com) stole an npm maintainer's credentials, injecting malware into popular packages like eslint-config-prettier and synckit.
Google is suing the operators of BadBox 2.0, one of the world's largest smart TV botnets, to combat digital fraud and protect over 10 million infected Android devices.
FortiCNAPP uncovers Lcrypt0rx, an AI-generated ransomware linked to the H2Miner botnet. Despite its flaws, it achieves near-zero detection, targeting systems for crypto-mining and disruption.
Trellix has uncovered SquidLoader, a highly obfuscated malware targeting Hong Kong financial institutions to deploy Cobalt Strike beacons for persistent control.
Cyfirma uncovers "Octalyn Forensic Toolkit," a GitHub-hosted "educational" tool that's actually a modular credential stealer exfiltrating data via Telegram.
The Rainbow Hyena threat cluster is unleashing PhantomRemote, a new backdoor, in phishing attacks against Russia's healthcare and IT sectors, leveraging compromised emails.
A Russian crypto developer lost $500K after installing a fraudulent "Solidity Language" extension for Cursor AI IDE from Open VSX, which deployed malware for remote access and data theft.
North Korean APTs are using XORIndex malware in a new npm supply chain attack, infiltrating developers via 67 malicious packages to steal crypto wallets and credentials.
Interlock RAT Gets PHP Makeover: New Variant Uses Steganography & ClickFix for Stealthy Infiltration
Interlock RAT Gets PHP Makeover: New Variant Uses Steganography & ClickFix for Stealthy Infiltration
The DFIR Report uncovers a new PHP-coded Interlock RAT variant, using compromised websites and ClickFix social engineering to deploy stealthy malware for recon and persistence.
CYFIRMA unveils RenderShock, a zero-click attack strategy exploiting silent OS background processes like file previews and search indexing to execute malware and steal credentials without user interaction.
Unit 42 exposes SLOW#TEMPEST, a new malware variant using advanced CFG obfuscation and indirect function calls to evade static analysis, making it nearly impossible to detect.
A supply chain attack injected backdoor malware into Gravity Forms plugin downloads from the official website. The backdoor allows RCE and creates admin accounts.
Darktrace uncovers a crypto scam using fake software startups (AI, gaming, Web3 themes) with professional online presences to distribute Electron malware (Windows) and Atomic Stealer (macOS) for crypto theft.
A malicious campaign on GitHub is distributing Lumma Stealer via fake "Free VPN for PC" and "Minecraft Skin Changer" repositories, using obfuscation and process injection for stealthy delivery.
SentinelOne uncovers a new macOS.ZuRu variant using a trojanized Termius app. It gains persistence via LaunchDaemon and deploys a Khepri C2 beacon for remote control.
DoNot APT (APT-C-35) expands its cyber-espionage to a European foreign affairs ministry, using spear-phishing with Google Drive links to deliver the LoptikMod backdoor.