Pavel Novák

Threat Analyst at Avast, Webthreats, Ph.D. student & researcher @FI @masarykuni

[Pavel Novák @NovakPauly]

🚨#ScamAlert! Be aware of ongoing extortion mail campaign trying to lure victims to pay ~$1000 in BTC. Scammers have increased their activity in recent days again.

[Gen Threat Labs @GenThreatLabs]

Several waves of #MagniBer #ransomware attacks have hit FR 🇫🇷, IT 🇮🇹 and DE 🇩🇪 in the past hours with roughly 20K protected users. The attackers used #malvertising, leading to downloading a ZIP file with a fake MSI installer that appears to be an important security update.

[Gen Threat Labs @GenThreatLabs]

New wave of a subscription scam currently active in Poland 🇵🇱 using more than 600 infected sites. Almost 6000 users protected. Victims click on #Facebook link leading to subscription scam landing page.

[Gen Threat Labs @GenThreatLabs]

AgentTesla campaign delivered via ISO email attachment started today morning in Australia 🇦🇺, Japan 🇯🇵, Turkey 🇹🇷 and Spain 🇪🇸 with few thousands protected users. Payload is downloaded from 185.216.71[.]120/Nhtjio.jpeg and data are exfiltrated to mail.rimiapparelsltd[.]com

[David Jursa @david_jursa]

Active #fontpack distributing #redline stealer in 🇮🇹.

Fontpack landing: videojo[.]org/lander/sss/template.js
Fontpack download: download.5download[.]net/font_update.zip

Anyrun: https://t.co/LTE0bTfjOZ

[Gen Threat Labs @GenThreatLabs]

New #AgentTesla campaign making waves in South America and Europe, spreading spoofed phishing emails to infect devices to collect info about devices & steal credentials from browsers & email clients. More on #AvastDecoded by @NovakPauly Read, enjoy, share!
https://t.co/lKVYpPYs1F

[Gen Threat Labs @GenThreatLabs]

1/2 An ongoing wave of tech support scam (#TSS) has been detected in Australia right now 🇦🇺. Victims are redirected from adult websites to an attacker-controlled infrastructure at 139[.]180.179.219 and forced to call an Australian phone number [phone].

[Gen Threat Labs @GenThreatLabs]

Analysis of #ParrotTDS by @NovakPauly & @JanRubin now up on Decoded blog: 16,500 sites infected, redirecting to the FakeUpdate campaign used to spread a remote access tool. Read, enjoy, share. https://t.co/zQvsut3BgV