ExecuteMalware

#malware hunter & analyst.
Opinions are my own.

[ANY.RUN @anyrun_app]

🚨 #Formbook is Back with Regional Lures. A localized business-order lure targets European users and manufacturing orgs, delivering Formbook through an in-memory chain and persisting as SystemUpdate_*.

👨‍💻 See the full attack chain and collect #IOCs in #ANYRUN Sandbox: https://t.co/1hSLfeMDRD

🚀 With #ANYRUN's new Related Threat Context, analysts can explore activity beyond the original sample in one connected workflow. In this case, another document themed malicious archive used similar JS lure — a useful lead for identifying related threats.

#ExploreWithANYRUN 1/3 🧵

[Huntress @HuntressLabs]

Hungry? This ClickFix campaign relies on some mouth-watering domain names: grillmasterspro, EmbersAndBites, and more.

Read more about an attack that starts with a Google search for Amazon business and ends with a serving of “finger-licking” malware: https://t.co/aJ4ShqoXBL

[Varonis @varonis]

Four months after Operation Endgame, StealC's seller is back.

Dubbed Stadia, this new product is a full RAT with hidden desktop control, a command shell, a file explorer, and a loader. Varonis Threat Labs got the build the day it was listed, reversed it, and ran its panel against a host of our own, discovering that the code inside matches StealC's.

Operation Endgame forced StealC's seller to start from scratch with new servers, names, and panels, but it's clear they're not done yet.

Read more about our findings here: https://t.co/0WOqmpMcLX

[Lenny Zeltser @lennyzeltser]

I'll deliver a new in-person workshop at SANS #AISummit, November 2-3, near DC. See you there? https://t.co/0VsW0zOgQv

[REMnux @REMnux]

REMnux now includes CILantro by @jgajek for deobfuscating and unpacking .NET malware variants. https://t.co/GIKcu3jKJ4

[Lenny Zeltser @lennyzeltser]

REMnux is used by many malware analysts, but till now it has only run natively on Intel/AMD systems. Now, you can run it on Apple Silicon. And now can get a prebuilt REMnux VM for several hypervisors, as well as an EC2 AMI.

[PandaRE 🐼 🇺🇦 @PandaRE__]

ANYONE HAS STADIA RAT I POKE AT? 👀
Asking for a friend.

[ANY.RUN @anyrun_app]

Phishing activity in the past 7 days 🐟
Track latest #phishing threats in TI Lookup: https://t.co/46NLF8pdDl

#TopPhishingThreats

[ANY.RUN @anyrun_app]

⚠️ Last week's malware activity showed a clear contrast: #AsyncRAT dropped nearly 30%, while #DonutLoader jumped 48% and #Grandoreiro continued its upward trend. #Romulus also entered the picture as one of the week's most active threats.

📌 Trend to watch: familiar threats continue to dominate, but new entries can quickly become significant. SOC teams need to validate detection coverage for newly observed families without losing focus on persistent threats.

Monitor the malware driving today’s attacks: https://t.co/oPMouhlUuY

#Top10Malware

[Karsten Hahn @struppigel]

Next version of PortexAnalyzerGUI will be able to zoom in and out of the PE visualization, and allow you to interactively browse structures.

Will publish this weekend or so.

(unlisted 1 min video without audio)
https://t.co/xETYjOCxro

[ANY.RUN @anyrun_app]

🚨 We identified #Skyw4lker, a Device Code #phishing campaign mostly active against US orgs in manufacturing, technology, and healthcare. Victims receive a password-protected decoy doc framed as a contract or service proposal, then move from a lure on sites[.]google[.]com into MS authentication, exposing M365 token access without direct password theft.

❗️ The phishing page uses obfuscated JavaScript and a PHP backend to create a victim session, collect IP/geolocation, and keep polling until the flow completes. See the full attack chain and collect #IOCs in #ANYRUN Sandbox: https://t.co/cegmV1HtdT

⚡️ Strengthen phishing detection in your SOC with #ANYRUN: https://t.co/M6dRgM3Sdv

#ExploreWithANYRUN

[Josh Stroschein | The Cyber Yeti @jstrosch]

New episode of Behind the Binary is live!

🎙️Joined by @L0Psec to break down macOS security, ClickFix social engineering, InfoStealers (AMOS/MacSync), DPRK developer targeting, and the evolution of obfuscation.

Plus, we talk about how AI is shifting reverse engineering and the inevitable future state...

🎧 https://t.co/8SlDtgWs55

[Decipher @DecipherSec]

Look who it is! That @_JohnHammond guy from @HuntressLabs, talking to us about ClickFix attacks, AI-assisted attacks, and a future hacker movie episode!

https://t.co/gopCKSEz0U

[ANY.RUN @anyrun_app]

Phishing activity in the past 7 days 🐟
Track latest #phishing threats in TI Lookup: https://t.co/gE1iyEiA9C

#TopPhishingThreats

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

New #AtlasRAT loader checks in with "BFuck" and the C2 protocol switched to using TLS
📡 23.226.57.50:443
📡 38.76.177.46:443
📡 43.99.101.175:443
📡 45.142.152.180:443
📡 116.204.169.70:443
📡 150.158.50.175:443
📡 156.234.7.48:443
📡 192.252.180.45:443
https://t.co/LVSHcx9RXS

[Karsten Hahn @struppigel]

New PortEx release:
➡️ performance improvements for .NET files
➡️ support for interrupting analysis

https://t.co/RXtOWr3YUv

[ANY.RUN @anyrun_app]

⚠️ RATs remained dominant last week, while #Grandoreiro surged more than 2.5x. #Remcos and #XWorm gained ground as #SilentNet and #ReverseLoader declined.

📌 Trend to watch: fast-growing threats can shift SOC priorities even when leading families remain stable. Tracking relative growth helps teams adjust detection coverage early.

Monitor the malware driving today’s attacks: https://t.co/QKz8sDf2Wl

#Top10Malware

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft Threat Intelligence has identified a cluster of compromised websites leading to ClickFix attacks. Instead of downloading and executing remote payloads like the typical attack pattern, in this attack, the websites pre-fetch a script payload into the browser cache disguised as a PNG file.

When a user is later tricked into executing the malicious command, the cached website content is already on the device, loaded, and ready to be executed. This helps to hide the payload script and helps bypass the character limit of the Run dialog.

ClickFix attacks persuade users to execute attacker-supplied commands under the guise of verification or repair. In this specific campaign, a fake lure instructs users to open Windows Run, paste clipboard content and press Enter.

The injected page uses browser caching to stage the larger VBScript payload separately from the Run command. The command invokes cmd.exe to recursively enumerate files whose names start with "f_” in the browser’s profile folder such as %LOCALAPPDATA%\Mozilla\Firefox\Profiles.

It compares each file’s byte length with an expected value. Rather than searching for a marker within the contents like previous attacks, it copies a size-matching cache entry to %LOCALAPPDATA%\Temp\t.vbs, giving the cached payload a VBScript extension, then executes it with wscript.exe. Copy output and errors are suppressed. The expected size varies across variants.

The VBScript collects host information through WMI, retrieves v.ps1 from cocojambo[.]us[.]com/alfa, and launches PowerShell without a profile and with execution-policy bypass. A later PowerShell stage downloads the next-stage payload as cab.dat, then reads and executes its contents in a hidden window. The PowerShell stage triggers .NET compilation using csc.exe and cvtres.exe, then launches timeout.exe.

Subsequent payloads load .NET assemblies into memory and inject code into timeout.exe to target browser and device credentials. The injected process launches PowerShell to retrieve another in-memory stage from capsysnet[.]vg and makes outbound connections to ciliabula[.]cc.

The payload modifies the per-user PowerShell registry configuration to use the Bypass execution policy, then unpacks Python with tar.exe and creates a scheduled task that launches a Python payload through pythonw.exe for persistence.

Microsoft Defender provides layered protection across the ClickFix attack chain. Defender SmartScreen and Defender for Office 365 help block malicious sites, links, attachments, and fake CAPTCHA lures, while Defender for Endpoint detects suspicious command execution and outbound connections through alerts like “Possible ClickFix activity”. Defender Antivirus blocks malicious command execution as Trojan:Win32/ClickFix and Trojan:Win32/TermFix.

Microsoft recommends cloud-delivered, web, and network protection, application control, and PowerShell script-block logging. Hunt across browser activity, RunMRU registry key, WScript/PowerShell child processes and scheduled tasks, not download events alone. A CAPTCHA should not ask users to run code. Users shouln not paste commands from verification prompts into Run, Terminal or PowerShell and should treats such requests as potential initial access attempts.

[Nicolas Krassas @Dinosn]

CastleStealer: An Emerging Infostealer Growing More Sophisticated https://t.co/4YqdVVjjGs

[Thomas Roccia 🤘 @fr0gger_]

🤓 Pretty cool, 10 months ago I applied this concept of Generative UI for Threat Intelligence.

I was tired of lengthy chatbot that generates a wall of text so I created my own visual interaction.

Check out my full report to learn more about my process 👇

https://t.co/7Kwum6cGEj