PowerShell Malware

Critical FortiClient EMS Exploitation Campaign Spreads New EKZ Infostealer Payload

• Vulnerability Report

Critical FortiClient EMS Exploitation Campaign Spreads New EKZ Infostealer Payload

Do Son May 28, 2026 0

Arctic Wolf warns of a new FortiClient EMS exploitation campaign using CVE-2026-35616 to deploy the stealthy EKZ Infostealer malware.

Weaponized JPEG Payload Deploys Trojanized ScreenConnect for Covert Espionage

• Cybercriminals

Weaponized JPEG Payload Deploys Trojanized ScreenConnect for Covert Espionage

Do Son May 14, 2026 0

CYFIRMA warns of Operation SilentCanvas: A weaponized JPEG delivers trojanized ScreenConnect, bypassing AMSI and UAC for full-system surveillance. Stay alert!

New “PowMix” Botnet Preys on Czech Workforce with Lure of Compliance

• Malware

New “PowMix” Botnet Preys on Czech Workforce with Lure of Compliance

Do Son April 20, 2026 0

Cisco Talos uncovers PowMix, a stealthy botnet targeting Czech HR via AMSI bypass and Heroku-hosted C2. Learn how this malware evades modern EDR systems.

The Sleeper in Your Toolbar: How a “Featured” Chrome Extension Turned Into a Full-Scale Infostealer

• Malware

The Sleeper in Your Toolbar: How a “Featured” Chrome Extension Turned Into a Full-Scale Infostealer

Do Son March 12, 2026 0

Once a "Featured" tool, the ShotBird extension now delivers malware via "vibecoded" scripts and fake updates. Remove it now to protect your passwords and data.

OCRFix: When Fake CAPTCHAs, AI, and Blockchains Collide to Build a Botnet

• Malware

OCRFix: When Fake CAPTCHAs, AI, and Blockchains Collide to Build a Botnet

Do Son March 2, 2026 0

CYJAX uncovers "OCRFix," a stealthy campaign using fake Tesseract OCR sites, ClickFix social engineering, and EtherHiding to bypass security via blockchain.

TAMECAT Exposed: APT42’s Fileless Backdoor Targets Defense Chiefs

• Cyber Security
• Malware

TAMECAT Exposed: APT42’s Fileless Backdoor Targets Defense Chiefs

Do Son February 4, 2026 0

APT42 targets defense officials with "TAMECAT," a modular PowerShell backdoor. The malware uses social engineering and Telegram C2 to steal secrets.

Trusted Tool, Hidden Threat: Official EmEditor Installer Hijacked to Push Malware

• Malware

Trusted Tool, Hidden Threat: Official EmEditor Installer Hijacked to Push Malware

Do Son January 27, 2026 0

Official EmEditor installer hijacked to push malware. This supply chain attack steals credentials & evades detection. Check your logs for these domains.

Stealthy Remcos RAT Campaign Uses PowerShell to Evade Antivirus Detection

• Malware

Stealthy Remcos RAT Campaign Uses PowerShell to Evade Antivirus Detection

Do Son May 17, 2025 0

Remcos RAT campaign evades antivirus using PowerShell-based in-memory execution. Steals data, bypasses UAC, and avoids detection with stealthy tactics.

Chihuahua Stealer Unleashed: Obfuscated PowerShell and AES-GCM Encryption Fuel This Advanced Data Theft Campaign

• Malware

Chihuahua Stealer Unleashed: Obfuscated PowerShell and AES-GCM Encryption Fuel This Advanced Data Theft Campaign

Do Son May 14, 2025 0

Chihuahua Stealer uses stealthy PowerShell loaders, CNG AES-GCM encryption, and .NET memory injection to exfiltrate browser and crypto wallet data.

StealC V2: ThreatLabz Unveils the Evolution of a Stealthy Info-Stealer and Malware Loader

• Malware

StealC V2: ThreatLabz Unveils the Evolution of a Stealthy Info-Stealer and Malware Loader

Do Son May 5, 2025 0

ThreatLabz reveals StealC V2—an evolving info-stealer with encrypted C2, MSI and PowerShell payloads, and a rule-driven control panel for targeted attacks.