We discovered fake installers impersonating popular software including ChatGPT, Claude, AutoTune, and Kontakt on GitHub and SourceForge distributing a Deno backdoor known as DinDoor.
Attackers are using compromised YouTube channels to distribute links to the malicious software.
Threat actors are abusing a Javascript runtime called Bun to spread NWHStealer.
Bun’s relatively newer ecosystem helps attackers hide malicious code in larger executables and potentially evade detection.
A fake TradingView AI agent site is delivering Needle Stealer malware via a fake trading agent called TradingClaw that can take over your browser, steal your accounts and financial data, and open the door to further attacks.
#cybersecurity#malware#clickfix#macos#botconf
Hi, I’ve decided to share a tool I wrote in my spare time. The app is designed to track the ongoing ClickFix campaign targeting macOS and Win users and collect compromised websites.
https://t.co/4STTrVRl3G
Hey @madzincyber :)
We’ve identified a campaign using job interviews, project briefs, and financial documents hosted on Google Forms to distribute malware, including the PureHVNC RAT.
https://t.co/bErOCficA0
@smica83@abuse_ch It support different commands and RAT capabilities, but I can't find a particular attribution
take_screenshot
download_file
start_terminal
remote_desktop
self_uninstall
shutdown_host
windows_service
ws_auth_token
@smica83@abuse_ch It executes a Golang malware, it's interesting because it brute force part of the AES key😂
Decrypted URLs:
https[:]//stat.web-analytics.workers.dev/
https[:]//download.stable-releases.workers.dev/
https[:]//gtm.tagmanager.workers.dev/
https[:]//js.webframework.workers.dev/