Tag: malware

Threat actors are exploiting AhsayCBS vulnerabilities to gain remote access, deploy web shells, and install XMRig cryptocurrency miners disguised as Microsoft Edge processes.

A China nexus threat actor is using the Antino backdoor against Asian government and policy organizations with Microsoft 365 services for command and control.

Security researchers have found the third-party.com placeholder domain serving ClickFix malware lures, affecting users through fake verification pages and malicious commands.

Mandiant reveals how an attacker hijacked an AI coding assistant session at a software provider and used it to spread Shai-Hulud across around 100 internal repositories.

UNC3569 exploited a Sogou Input Method vulnerability to deploy GRAYRABBIT backdoor, giving attackers remote access capabilities on targeted Windows systems.

Attackers chained JFrog Artifactory flaws to gain administrator control, create accounts, install malicious plugins, and deploy backdoors on vulnerable self-hosted servers.

Kaspersky has uncovered a Silver Fox campaign that disguises the ValleyRAT backdoor as signed Chinese adware, using DLL sideloading to evade security controls and gain full access to compromised systems.

Microsoft has disclosed the TerminalFix campaign, a new ClickFix variant that uses fake Cloudflare CAPTCHA pages to deploy a reverse tunnel backdoor through Windows Terminal and PowerShell.

Cybersecurity researchers have identified 19 Chrome and Edge extensions containing wallet stealing and cryptocurrency draining capabilities. The campaign has reportedly been active since February 2024 and uses compromised and newly created browser extensions.

Recorded Future has identified a new HOOKEDGE backdoor linked to APT28, targeting government and diplomatic organizations in Romania, Spain, and Türkiye through malicious Microsoft Word documents.

Arctic Wolf has identified the new GoCaracal malware framework, linking it with medium confidence to Dark Caracal and revealing its use of Ethereum smart contracts to update command and control infrastructure.

Security researcher uncovers the SLEEPWALKER Windows backdoor featuring a custom bytecode language, passive network activation, DLL side loading, and stealth capabilities.