Tag: powershell
-
BITTER APT Using Fake Diplomatic Documents to Deliver PapRAT Spyware
FortiGuard Labs links BITTER to cyberespionage attacks on South Asian organizations using malicious Windows shortcuts, PowerShell scripts, and PapRAT malware. First seen on hackread.com Jump to article: hackread.com/bitter-apt-fake-diplomatic-documents-paprat-spyware/
-
Hackers Reuse XWorm Malware Loader Across Phishing Campaigns Targeting Colombia and the UK
A judicial-themed phishing campaign targeting Colombian organizations that delivers XWorm through obfuscated scripts, encrypted PowerShell, and a reusable .NET loader. The recovered loader is binary-identical to one documented in a September 10, 2026, UK-linked case, connecting otherwise differently packaged delivery chains. The overlap establishes loader reuse, not common attribution. Different payload hashes, execution targets, and…
-
Hackers Use PowerShell and Windows Error Reporting to Hide Malware on Infected PCs
Malware campaigns that combine phishing, obfuscated VBScript, PowerShell, and legitimate Windows applications to conceal infections targeting users in Brazil and Portugal. The investigation covers Overlord RAT, Lampion, and an unidentified payload delivered through a malicious newdev.dll. Rather than exploiting Windows Error Reporting itself, attackers impersonated its components and naming conventions, disguising malicious executables and scheduled…
-
Midnight Blizzard-Linked Malware Server Still Delivering Payloads 8 Weeks After Disclosure
A server linked to a malware campaign attributed to a Midnight Blizzard-associated cluster was still delivering malicious files on October 5, 2026. The server returned HTTP 200 responses for multiple payload paths, including one used by simple Windows Internet Shortcut files to launch a PowerShell stager. The finding shows that public disclosure and low reputation…
-
Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks
The threat actor known as Silent Lynx has been attributed to a fresh set of attacks targeting government organizations across the Commonwealth of Independent States (CIS).The activity, observed from June 2025 through August 2026, involves four different infection chains that make use of macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and crafted WinRAR archives First seen…
-
UAT-6275 Hackers Use WinRAR Exploit and GitHub PowerShell to Target CIS Governments
An espionage campaign targeting government organizations across the Commonwealth of Independent States (CIS), with additional interest in water, environmental, and energy sectors. The investigation found four infection chains active from June 2025 through 2026. The attackers used macro-enabled Word documents, PS2EXE-built executables, malicious shortcuts that launched GitHub-hosted PowerShell, and a crafted WinRAR archive that exploited…
-
Kimsuky Uses Fake Zoom Installers and Malicious LNK Files to Deploy Malware
Tags: cyber, espionage, group, international, korea, malicious, malware, north-korea, phishing, powershell, spear-phishing, ukraine, windowsNorth Korea-linked cyber espionage group Kimsuky has expanded its Operation GitPower campaign by using fake Zoom installers and malicious Windows shortcut files to target Ukrainian experts working in diplomacy, security, and international policy. Researchers at Genians Security Center found that the campaign combines reply-baiting spear phishing, PDF-themed LNK files, public code-hosting platforms, hidden PowerShell execution,…
-
Ransomware-Tool <> bereitet laterale Bewegung im kompromittierten Netzwerk vor
Zscaler ThreatLabz hat eine neue Malware-Familie mit der Bezeichnung <> analysiert, die die laterale Bewegung innerhalb kompromittierter Umgebungen vorbereitet. Als Grundlage für Ransomware-Angriffe wird SloppyRAT über eine mehrstufige Clickfix-Infektionskette verbreitet. Die Malware unterstützt eine Vielzahl von Funktionen, darunter eine große Anzahl integrierter Powershell-ähnlicher Befehle, verschlüsselte Codeblöcke, ‘EtherHiding” für die Command-and-Control-Auflösung (C2) über das Polygon-JSON-RPC-Protokoll sowie…
-
Operation Conflict Compass Deploys VelvetCake PowerShell Malware Through Malicious LNK Files
Tags: cyber, cyberespionage, intelligence, korea, malicious, malware, north-korea, powershell, russia, threat, ukraine, windowsNorth Korea-linked threat actor Konni has launched a targeted cyberespionage operation against Ukraine-focused entities using malicious Windows shortcut files disguised as PDF documents. The campaign, tracked by SOCRadar Threat Research Unit as Operation Conflict Compass, deploys a modular PowerShell malware family dubbed VelvetCake to collect intelligence on the Russia-Ukraine war. The activity appears designed to…
-
TASK#STOMP PowerShell Backdoor Steals Business Documents and Executes Remote Commands
A Windows-focused backdoor dubbed TASK#STOMP that uses VBScript, PowerShell, Scheduled Tasks, and runtime C# compilation to establish resilient persistence and continuously steal business documents. The implant also captures screenshots, extracts saved Wi-Fi passwords, harvests clipboard data, and executes arbitrary commands received from its operators. While the original delivery method is unconfirmed, the location is consistent…
-
New TASK#STOMP Windows Backdoor Enables Continuous Document Theft
TASK#STOMP Windows backdoor uses PowerShell, scheduled tasks and runtime C# compilation to steal business documents and maintain remote access. First seen on hackread.com Jump to article: hackread.com/taskstomp-windows-backdoor-document-theft/
-
TASK#STOMP PowerShell Backdoor Steals Documents, Wi-Fi Passwords, and Clipboard Data
Cybersecurity researchers have disclosed details of a new campaign dubbed TASK#STOMP that delivers a PowerShell backdoor designed to harvest sensitive data from compromised hosts.The backdoor “automatically harvests and exfiltrates business documents, watches the filesystem for new files in real time, steals Wi-Fi passwords and clipboard contents, takes screenshots, and accepts arbitrary First seen on thehackernews.com…
-
EtherHiding Malware Abuses Polygon Blockchain to Hide C2 and Steal Banking Credentials
Tags: backdoor, banking, blockchain, business, control, credentials, cyber, infrastructure, malware, powershellA newly uncovered EtherHiding campaign has turned the Polygon blockchain into a resilient command-and-control mechanism, allowing operators to rotate malware infrastructure without modifying the payload deployed on victim systems. The operation, active since at least November 2025, has compromised at least 31 legitimate business websites and evolved from deploying a general-purpose PowerShell backdoor to distributing…
-
EtherHiding Malware Abuses Polygon Blockchain to Hide C2 and Steal Banking Credentials
Tags: backdoor, banking, blockchain, business, control, credentials, cyber, infrastructure, malware, powershellA newly uncovered EtherHiding campaign has turned the Polygon blockchain into a resilient command-and-control mechanism, allowing operators to rotate malware infrastructure without modifying the payload deployed on victim systems. The operation, active since at least November 2025, has compromised at least 31 legitimate business websites and evolved from deploying a general-purpose PowerShell backdoor to distributing…
-
EtherHiding Malware Abuses Polygon Blockchain to Hide C2 and Steal Banking Credentials
Tags: backdoor, banking, blockchain, business, control, credentials, cyber, infrastructure, malware, powershellA newly uncovered EtherHiding campaign has turned the Polygon blockchain into a resilient command-and-control mechanism, allowing operators to rotate malware infrastructure without modifying the payload deployed on victim systems. The operation, active since at least November 2025, has compromised at least 31 legitimate business websites and evolved from deploying a general-purpose PowerShell backdoor to distributing…
-
PowerShell Malware Abuses Registry and DNS TXT Records to Deploy XMRig Crypto Miner
A sophisticated cryptomining campaign is employing multiple layers of obfuscation to conceal malicious PowerShell payloads and ultimately deploy an XMRig-based cryptocurrency miner. This obfuscation includes Windows Registry entries, DNS TXT records, PNG images, and WAV audio files. The infection was detected after repeated security alerts indicated suspicious PowerShell activity. The initial execution command launched PowerShell…
-
AsyncRAT Malware Abuses AutoIt and PowerShell to Hide Inside Legitimate Windows Process
A five-stage AsyncRAT campaign that chains a socially engineered batch file, hidden PowerShell execution, AutoIt abuse and process injection to conceal a .NET remote-access trojan inside Microsoft’s legitimate charmap.exe process. The infection begins with a lure named “Right-click to open Invoice Details.bat”, which relies on user interaction to trigger execution. While the precise delivery method…
-
Detecting livingthe-land binaries with Sysmon process events
Living-off-the-land binaries, often shortened to LOLBins, are legitimate Windows executables that attackers abuse to carry out malicious activity while blending in with normal administration. The binaries themselves are not the problem. The issue is that tools such as PowerShell, cmd.exe,… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/detecting-living-off-the-land-binaries-with-sysmon-process-events/
-
Detecting livingthe-land binaries with Sysmon process events
Living-off-the-land binaries, often shortened to LOLBins, are legitimate Windows executables that attackers abuse to carry out malicious activity while blending in with normal administration. The binaries themselves are not the problem. The issue is that tools such as PowerShell, cmd.exe,… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/detecting-living-off-the-land-binaries-with-sysmon-process-events/
-
Detecting livingthe-land binaries with Sysmon process events
Living-off-the-land binaries, often shortened to LOLBins, are legitimate Windows executables that attackers abuse to carry out malicious activity while blending in with normal administration. The binaries themselves are not the problem. The issue is that tools such as PowerShell, cmd.exe,… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/detecting-living-off-the-land-binaries-with-sysmon-process-events/
-
Detecting livingthe-land binaries with Sysmon process events
Living-off-the-land binaries, often shortened to LOLBins, are legitimate Windows executables that attackers abuse to carry out malicious activity while blending in with normal administration. The binaries themselves are not the problem. The issue is that tools such as PowerShell, cmd.exe,… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/detecting-living-off-the-land-binaries-with-sysmon-process-events/
-
Detecting livingthe-land binaries with Sysmon process events
Living-off-the-land binaries, often shortened to LOLBins, are legitimate Windows executables that attackers abuse to carry out malicious activity while blending in with normal administration. The binaries themselves are not the problem. The issue is that tools such as PowerShell, cmd.exe,… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/detecting-living-off-the-land-binaries-with-sysmon-process-events/
-
Detecting livingthe-land binaries with Sysmon process events
Living-off-the-land binaries, often shortened to LOLBins, are legitimate Windows executables that attackers abuse to carry out malicious activity while blending in with normal administration. The binaries themselves are not the problem. The issue is that tools such as PowerShell, cmd.exe,… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/detecting-living-off-the-land-binaries-with-sysmon-process-events/
-
‘TerminalFix’ Campaign Weaponizes PowerShell for Enterprise Attacks
The ClickFix-style campaign features a sophisticated, multistage attack chain that includes reverse tunnels into victim organizations’ networks. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/terminalfix-campaign-weaponizes-powershell-enterprise-attacks
-
Microsoft warns of TerminalFix attacks deploying reverse tunnels
A new ClickFix variant dubbed TerminalFix uses fake Cloudflare CAPTCHA prompts on compromised websites to trick victims into running malicious PowerShell commands in Windows Terminal. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/microsoft-warns-of-terminalfix-attacks-deploying-reverse-tunnels/
-
TerminalFix Uses Fake CAPTCHA, DLL Sideloading and Steganography to Breach Networks
A sophisticated ClickFix variant dubbed TerminalFix that uses fake Cloudflare CAPTCHA prompts to trick users into executing attacker-controlled PowerShell commands. Rather than delivering a conventional infostealer, the campaign builds persistent access and deploys a reverse-tunnel implant capable of turning an infected Windows endpoint into a proxy for reaching internal network resources The intrusion begins on…
-
North Korean Hackers Hide AnyDesk on Victim PCs to Maintain Secret Remote Access
Tags: access, cyber, email, hacker, korea, malicious, north-korea, phishing, powershell, software, spear-phishing, theft, windowsNorth Korea-linked Kimsuky operators have targeted organizations in South Korea and Japan with spear-phishing campaigns that install and conceal AnyDesk, giving attackers persistent, interactive remote access while blending into legitimate software activity. The operation combines OneDrive-hosted lures, malicious Windows shortcut files, scheduled-task persistence, PowerShell payloads, and email theft across Thunderbird, Outlook, and Gmail. The archives…
-
New SynkLoader Malware Uses Fake Windows Lock Screen to Steal Passwords and Pivot Networks
SynkLoader, a newly identified modular malware framework that combines Python, C#, C++, PowerShell, and memory-resident payloads to evade endpoint detection. Delivered through Microsoft Teams phishing, the operation uses a convincing fake Windows lock screen to capture credentials before enabling network tunneling and interactive access to compromised enterprise environments. Compile timestamps and file metadata indicate the…