#malspam — Public Fediverse posts

LokiBot After a Decade: An Analysis of a Recent LokiBot Campaign

LokiBot, an infostealer first advertised in May 2015, continues to operate after more than a decade with numerous variants. The malware targets credentials from over a hundred software products including browsers, cryptocurrency wallets, password managers, email and FTP clients. A recent campaign delivers LokiBot through malspam with JScript email attachments, executing a multi-stage infection chain involving PowerShell loaders and .NET injectors protected by ConfuserEx. The final payload uses process injection into aspnet_compiler.exe, employing API hashing techniques to evade detection. While LokiBot maintains extensive credential theft capabilities, recent samples exhibit broken persistence mechanisms due to patched decryption subroutines. The malware communicates with C2 servers to exfiltrate compressed stolen data and await further commands, demonstrating continued evolution despite reduced activity in recent years.

Pulse ID: 6a3c6b9416a51c4cdec616c4
Pulse Link: https://otx.alienvault.com/pulse/6a3c6b9416a51c4cdec616c4
Pulse Author: AlienVault
Created: 2026-06-24 23:43:16

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#ASPNet #ASPNet_Compiler #Browser #CyberSecurity #Email #InfoSec #InfoStealer #MalSpam #Malware #NET #OTX #OpenThreatExchange #Password #PowerShell #RAT #SMS #Spam #Word #bot #cryptocurrency #AlienVault

LokiBot After a Decade: An Analysis of a Recent LokiBot Campaign

LokiBot, an infostealer first advertised in May 2015, continues to operate after more than a decade with numerous variants. The malware targets credentials from over a hundred software products including browsers, cryptocurrency wallets, password managers, email and FTP clients. A recent campaign delivers LokiBot through malspam with JScript email attachments, executing a multi-stage infection chain involving PowerShell loaders and .NET injectors protected by ConfuserEx. The final payload uses process injection into aspnet_compiler.exe, employing API hashing techniques to evade detection. While LokiBot maintains extensive credential theft capabilities, recent samples exhibit broken persistence mechanisms due to patched decryption subroutines. The malware communicates with C2 servers to exfiltrate compressed stolen data and await further commands, demonstrating continued evolution despite reduced activity in recent years.

Pulse ID: 6a3c6b9416a51c4cdec616c4
Pulse Link: https://otx.alienvault.com/pulse/6a3c6b9416a51c4cdec616c4
Pulse Author: AlienVault
Created: 2026-06-24 23:43:16

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#ASPNet #ASPNet_Compiler #Browser #CyberSecurity #Email #InfoSec #InfoStealer #MalSpam #Malware #NET #OTX #OpenThreatExchange #Password #PowerShell #RAT #SMS #Spam #Word #bot #cryptocurrency #AlienVault

LokiBot After a Decade: An Analysis of a Recent LokiBot Campaign

LokiBot, an infostealer first advertised in May 2015, continues to operate after more than a decade with numerous variants. The malware targets credentials from over a hundred software products including browsers, cryptocurrency wallets, password managers, email and FTP clients. A recent campaign delivers LokiBot through malspam with JScript email attachments, executing a multi-stage infection chain involving PowerShell loaders and .NET injectors protected by ConfuserEx. The final payload uses process injection into aspnet_compiler.exe, employing API hashing techniques to evade detection. While LokiBot maintains extensive credential theft capabilities, recent samples exhibit broken persistence mechanisms due to patched decryption subroutines. The malware communicates with C2 servers to exfiltrate compressed stolen data and await further commands, demonstrating continued evolution despite reduced activity in recent years.

Pulse ID: 6a3c6b9416a51c4cdec616c4
Pulse Link: https://otx.alienvault.com/pulse/6a3c6b9416a51c4cdec616c4
Pulse Author: AlienVault
Created: 2026-06-24 23:43:16

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#ASPNet #ASPNet_Compiler #Browser #CyberSecurity #Email #InfoSec #InfoStealer #MalSpam #Malware #NET #OTX #OpenThreatExchange #Password #PowerShell #RAT #SMS #Spam #Word #bot #cryptocurrency #AlienVault

LokiBot After a Decade: An Analysis of a Recent LokiBot Campaign

LokiBot, an infostealer first advertised in May 2015, continues to operate after more than a decade with numerous variants. The malware targets credentials from over a hundred software products including browsers, cryptocurrency wallets, password managers, email and FTP clients. A recent campaign delivers LokiBot through malspam with JScript email attachments, executing a multi-stage infection chain involving PowerShell loaders and .NET injectors protected by ConfuserEx. The final payload uses process injection into aspnet_compiler.exe, employing API hashing techniques to evade detection. While LokiBot maintains extensive credential theft capabilities, recent samples exhibit broken persistence mechanisms due to patched decryption subroutines. The malware communicates with C2 servers to exfiltrate compressed stolen data and await further commands, demonstrating continued evolution despite reduced activity in recent years.

Pulse ID: 6a3c6b9416a51c4cdec616c4
Pulse Link: https://otx.alienvault.com/pulse/6a3c6b9416a51c4cdec616c4
Pulse Author: AlienVault
Created: 2026-06-24 23:43:16

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#ASPNet #ASPNet_Compiler #Browser #CyberSecurity #Email #InfoSec #InfoStealer #MalSpam #Malware #NET #OTX #OpenThreatExchange #Password #PowerShell #RAT #SMS #Spam #Word #bot #cryptocurrency #AlienVault

LokiBot After a Decade: An Analysis of a Recent LokiBot Campaign

LokiBot, an infostealer first advertised in May 2015, continues to operate after more than a decade with numerous variants. The malware targets credentials from over a hundred software products including browsers, cryptocurrency wallets, password managers, email and FTP clients. A recent campaign delivers LokiBot through malspam with JScript email attachments, executing a multi-stage infection chain involving PowerShell loaders and .NET injectors protected by ConfuserEx. The final payload uses process injection into aspnet_compiler.exe, employing API hashing techniques to evade detection. While LokiBot maintains extensive credential theft capabilities, recent samples exhibit broken persistence mechanisms due to patched decryption subroutines. The malware communicates with C2 servers to exfiltrate compressed stolen data and await further commands, demonstrating continued evolution despite reduced activity in recent years.

Pulse ID: 6a3c6b9416a51c4cdec616c4
Pulse Link: https://otx.alienvault.com/pulse/6a3c6b9416a51c4cdec616c4
Pulse Author: AlienVault
Created: 2026-06-24 23:43:16

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#ASPNet #ASPNet_Compiler #Browser #CyberSecurity #Email #InfoSec #InfoStealer #MalSpam #Malware #NET #OTX #OpenThreatExchange #Password #PowerShell #RAT #SMS #Spam #Word #bot #cryptocurrency #AlienVault

Trust this “Amazon” phishing email in Japan—and you’re Prime sashimi 🎣 🍣

Looking into our malspam data, we identified an active campaign impersonating Amazon and targeting Japanese citizens. The emails use subjects such as 「至急 Amazonプライム会員情報の確認」 (“Urgent: Confirm Amazon Prime member information”).

The URLs within the emails ultimately lead to an Amazon phishing page, but only after routing victims through a TDS. Interestingly, instead of keeping the TDS step invisible, the actors chose to show it off—repackaging it as a reassuring security check.

Upon clicking the link within the email, victims are first redirected to an RDGA TDS domain, where fingerprinting occurs. If the user does not match the targeting criteria (e.g., connecting from outside Japan), access is blocked. If they do match, potential victims are redirected to a second RDGA domain.
This second and last domain is not a TDS domain, but funny enough, these actors decided they would emulate it anyway!

At that step victims are already at the landing page but instead of immediately displaying a standard Amazon phishing page, the website displays a CAPTCHA and fake console interface simulating environment fingerprinting checks to “make sure your environment and connection is safe” before "proceeding to the landing page". Ironically, part of their message is true: fingerprinting did happen one domain earlier. It just wasn’t for the user’s benefit—it was to make sure the environment was safe… for the scammers. A few seconds later, without added user interaction needed, a fake Amazon login page is displayed.

Domains samples:
qqc10c[.]cyou
51wang11c[.]cyou

#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #phishing #amazon #malspam #email #fingerprinting #japan

Trust this “Amazon” phishing email in Japan—and you’re Prime sashimi 🎣 🍣

Looking into our malspam data, we identified an active campaign impersonating Amazon and targeting Japanese citizens. The emails use subjects such as 「至急 Amazonプライム会員情報の確認」 (“Urgent: Confirm Amazon Prime member information”).

The URLs within the emails ultimately lead to an Amazon phishing page, but only after routing victims through a TDS. Interestingly, instead of keeping the TDS step invisible, the actors chose to show it off—repackaging it as a reassuring security check.

Upon clicking the link within the email, victims are first redirected to an RDGA TDS domain, where fingerprinting occurs. If the user does not match the targeting criteria (e.g., connecting from outside Japan), access is blocked. If they do match, potential victims are redirected to a second RDGA domain.
This second and last domain is not a TDS domain, but funny enough, these actors decided they would emulate it anyway!

At that step victims are already at the landing page but instead of immediately displaying a standard Amazon phishing page, the website displays a CAPTCHA and fake console interface simulating environment fingerprinting checks to “make sure your environment and connection is safe” before "proceeding to the landing page". Ironically, part of their message is true: fingerprinting did happen one domain earlier. It just wasn’t for the user’s benefit—it was to make sure the environment was safe… for the scammers. A few seconds later, without added user interaction needed, a fake Amazon login page is displayed.

Domains samples:
qqc10c[.]cyou
51wang11c[.]cyou

#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #phishing #amazon #malspam #email #fingerprinting #japan

New 2026 telemetry from Bitdefender indicates 41% of Valentine’s-themed email traffic contained scam elements.

Threat vectors observed:
• Brand impersonation campaigns
• AI-generated dating personas
• Advance-fee survey funnels
• Delivery notification phishing
• Pharma spam distribution
• Healthcare provider impersonation (e.g., Techniker Krankenkasse)
Geographic targeting concentrated in the U.S. (55%) and key European markets.

Question for defenders:
Are current email filtering models sufficiently adaptive to seasonal emotional triggers amplified by generative AI?
Engage below.

Follow @technadu for threat intelligence reporting.

#ThreatIntel #Phishing #EmailSecurity #AIThreats #SOC #BlueTeam #FraudDetection #BrandAbuse #SecurityResearch #CyberDefense #Malspam #DigitalRisk

If you've been experiencing these new #malspam with @Action1corp #action1 RMM, there's a tasty lil file called C:\Windows\Action1\what_is_this.txt that's everything you need to know:
https://app.any.run/tasks/a38ca435-f03f-4e77-aac0-f7446b6fe4df

It sometimes pays to run domains that serve purely as spam honeypots. Case in point: A spammer has been delivering a ConnectWise commercial remote access client application as a payload in a scam that uses the purported arrival of a US Social Security statement as its hook.

A 🧵 ...

#ConnectWise #malware #spam #malspam #attacksurface #SocialSecurity #SocialSecurityAdministration #SSA #usgov

It sometimes pays to run domains that serve purely as spam honeypots. Case in point: A spammer has been delivering a ConnectWise commercial remote access client application as a payload in a scam that uses the purported arrival of a US Social Security statement as its hook.

A 🧵 ...

#ConnectWise #malware #spam #malspam #attacksurface #SocialSecurity #SocialSecurityAdministration #SSA #usgov

#MalspamMonday

Malspam Monday is when I check the inboxes of my honey pot accounts for anything interesting distributed through email.

Today, I found an example of #GuLoader for #Remcos #RAT

Details at https://github.com/malware-traffic/indicators/blob/main/2025-03-24-GuLoader-for-Remcos-RAT.txt

#RemcosRAT #malspam

#MalspamMonday

Malspam Monday is when I check the inboxes of my honey pot accounts for anything interesting distributed through email.

Today, I found an example of #GuLoader for #Remcos #RAT

Details at https://github.com/malware-traffic/indicators/blob/main/2025-03-24-GuLoader-for-Remcos-RAT.txt

#RemcosRAT #malspam

2025-03-05 (Wednesday): #Astaroth ( #Guildma ) distributed through Brazil #malspam

As usual, I didn't get a full infection chain, but I did get the initial zip archive from that link in the email.

Details at https://github.com/malware-traffic/indicators/blob/main/2025-03-05-Astaroth-Guildma-activity-from-Brazil-malspam.txt

2025-03-05 (Wednesday): #Astaroth ( #Guildma ) distributed through Brazil #malspam

As usual, I didn't get a full infection chain, but I did get the initial zip archive from that link in the email.

Details at https://github.com/malware-traffic/indicators/blob/main/2025-03-05-Astaroth-Guildma-activity-from-Brazil-malspam.txt

⚠️ Uwaga na e-maile z kancelarii prawnych

Na skrzynki Polaków znów trafiają pisma, w których oszuści podszywają się pod różne znane kancelarie prawne. Wiadomości informują o naruszeniu praw autorskich i wyglądają profesjonalnie. Zawierają też link do skanu pisma z “dowodami naruszeń praw autorskich”.

I to właśnie kliknięcie na ten link, pobranie oraz uruchomienie podlinkowanych plików może spowodować infekcję komputera złośliwym oprogramowaniem oraz — w konsekwencji — kradzież danych oraz stratę kont w serwisach społecznościowych. Na atak powinni uważać zwłaszcza posiadacze kont na Facebooku.
Po czym rozpoznać, że to oszustwo? E-maile są wysyłane z różnych adresów w domenie GMail. Link do pisma z dowodami, wbrew opisowi, nie prowadzi do PDF. I na marginesie — choć otrzymanie wiadomości o naruszeniu praw autorskich może wywołać stres, to warto mieć świadomość, że poważna korespondencja z kancelarii prawnych, jeśli ma być wiążąca, powinna dotrzeć do nas w formie papierowej.
Otrzymałem taką wiadomość — co robić, jak żyć?

Jeśli otrzymałeś taką wiadomość, nic nie musisz robić. Możesz ją zignorować. Żadne Twoje dane nie wyciekły, a żadna z opublikowanych przez Ciebie treści nie naruszyła praw autorskich innych firm.
Jeśli tylko pobrałeś załącznik — nie zostałeś zainfekowany.


Jeśli pobrałeś załącznik, rozpakowałeś go i uruchomiłeś aplikację z załącznika, to jak najszybciej poddaj swój komputer analizie pod kątem złośliwego oprogramowania z innego urządzenia zaloguj się na wszystkie istotne konta oraz zmień na nich hasła, a tam gdzie to możliwe, wyloguj również “pozostałe sesje/urządzenia”.

To ostrzeżenie wysłaliśmy także jako alert do użytkowników naszej bezpłatnej aplikacji CyberAlerty. Jeśli też chcesz być informowany o atakach, [...]

#Cyberalert #Malspam #PrawaAutorskie #SpearPhishing

https://niebezpiecznik.pl/post/uwaga-na-e-maile-z-kancelarii-prawnych/

⚠️ Uwaga na e-maile z kancelarii prawnych

Na skrzynki Polaków znów trafiają pisma, w których oszuści podszywają się pod różne znane kancelarie prawne. Wiadomości informują o naruszeniu praw autorskich i wyglądają profesjonalnie. Zawierają też link do skanu pisma z “dowodami naruszeń praw autorskich”.

I to właśnie kliknięcie na ten link, pobranie oraz uruchomienie podlinkowanych plików może spowodować infekcję komputera złośliwym oprogramowaniem oraz — w konsekwencji — kradzież danych oraz stratę kont w serwisach społecznościowych. Na atak powinni uważać zwłaszcza posiadacze kont na Facebooku.
Po czym rozpoznać, że to oszustwo? E-maile są wysyłane z różnych adresów w domenie GMail. Link do pisma z dowodami, wbrew opisowi, nie prowadzi do PDF. I na marginesie — choć otrzymanie wiadomości o naruszeniu praw autorskich może wywołać stres, to warto mieć świadomość, że poważna korespondencja z kancelarii prawnych, jeśli ma być wiążąca, powinna dotrzeć do nas w formie papierowej.
Otrzymałem taką wiadomość — co robić, jak żyć?

Jeśli otrzymałeś taką wiadomość, nic nie musisz robić. Możesz ją zignorować. Żadne Twoje dane nie wyciekły, a żadna z opublikowanych przez Ciebie treści nie naruszyła praw autorskich innych firm.
Jeśli tylko pobrałeś załącznik — nie zostałeś zainfekowany.


Jeśli pobrałeś załącznik, rozpakowałeś go i uruchomiłeś aplikację z załącznika, to jak najszybciej poddaj swój komputer analizie pod kątem złośliwego oprogramowania z innego urządzenia zaloguj się na wszystkie istotne konta oraz zmień na nich hasła, a tam gdzie to możliwe, wyloguj również “pozostałe sesje/urządzenia”.

To ostrzeżenie wysłaliśmy także jako alert do użytkowników naszej bezpłatnej aplikacji CyberAlerty. Jeśli też chcesz być informowany o atakach, [...]

#Cyberalert #Malspam #PrawaAutorskie #SpearPhishing

https://niebezpiecznik.pl/post/uwaga-na-e-maile-z-kancelarii-prawnych/

2025-02-25 (Tuesday): #VenomRAT from #malspam uses zip attachment containing a VHD file containing a VBS file. Calls Pastebin link for C2 server information. Details at https://github.com/malware-traffic/indicators/blob/main/2025-02-25-IOCs-for-Venom-RAT-activity.txt

2025-02-25 (Tuesday): #VenomRAT from #malspam uses zip attachment containing a VHD file containing a VBS file. Calls Pastebin link for C2 server information. Details at https://github.com/malware-traffic/indicators/blob/main/2025-02-25-IOCs-for-Venom-RAT-activity.txt

Muddling Meerkat Linked to Domain Spoofing in Global Spam Scams – Source:hackread.com https://ciso2ciso.com/muddling-meerkat-linked-to-domain-spoofing-in-global-spam-scams-sourcehackread-com/ #1CyberSecurityNewsPost #CyberSecurityNews #DomainSpoofing #cybersecurity #CyberAttack #Hackread #security #Malspam #malware #Spam

Muddling Meerkat Linked to Domain Spoofing in Global Spam Scams https://hackread.com/muddling-meerkat-domain-spoofing-spam-scams/ #DomainSpoofing #Cybersecurity #CyberAttack #Security #Malspam #Malware #Spam

Muddling Meerkat Linked to Domain Spoofing in Global Spam Scams – Source:hackread.com https://ciso2ciso.com/muddling-meerkat-linked-to-domain-spoofing-in-global-spam-scams-sourcehackread-com/ #1CyberSecurityNewsPost #CyberSecurityNews #DomainSpoofing #cybersecurity #CyberAttack #Hackread #security #Malspam #malware #Spam

Muddling Meerkat Linked to Domain Spoofing in Global Spam Scams https://hackread.com/muddling-meerkat-domain-spoofing-spam-scams/ #DomainSpoofing #Cybersecurity #CyberAttack #Security #Malspam #Malware #Spam

🔍 Campagne #Malware in Italia – Week 45 🔎
#Remcos: Transazioni bancarie
#Irata / #BingoMod / #ToxicPanda: APK Bank
#AgentTesla: Ordini
#SnakeKeyLogger: Preventivo
#XWorm: Fatturazione
#Formbook: Contratto
#Vidar: Fattura via PEC
#VipKeyLogger: Ordini
#mwitaly #malspam

⚠️ Attenzione: Nuova campagna malware #Guloader - #Formbook in Italia!

Stanno circolando email con falsi termini di contratto che mirano a trarre in inganno gli utenti.

🔍 IoC: ca0415559d7f7c869f5bf3b54070046c

Resta vigile, non aprire allegati sospetti!

#mwitaly #malspam

🐍 Allerta #SnakeKeyLogger in Italia 🐍

#Malware diffuso tramite email di Sollecito Pagamento

🧩 IoC principali:
- MD5: 16e3b155eaf7d1979f651c9d8212c713
- C2: mail.]el-rohim.]com

Resta vigile, non aprire allegati sospetti!

#mwitaly #malspam

⚠️ Nuova campagna #malspam con oggetto: “Specifiche dell’ordine” veicola #malware #ZharkBOT!

La mail contiene un file HTML che scarica un file VBS malevolo.

MD5: ca8ac9a5b0023d32bcd76c65512a6cd3

ℹ️ Tutti gli IoC sono disponibili su #Telegram: https://t.me/D3LabIT

⚠️ Attenzione ⚠️

Nuova campagna #malspam con oggetto: “Conferma dell’ordine”. Il #malware appartiene alla famiglia #Formbook.

ℹ️ Tutti gli IoC sono disponibili nel nostro canale Telegram: https://t.me/D3LabIT

#cybersecurity #threatintel #malware #mwitaly #italy

⚠️ Attenzione ⚠️

Nuova campagna #malspam con oggetto: “Conferma dell’ordine”. Il #malware appartiene alla famiglia #Formbook.

ℹ️ Tutti gli IoC sono disponibili nel nostro canale Telegram: https://t.me/D3LabIT

#cybersecurity #threatintel #malware #mwitaly #italy

⚠️ Attenzione ⚠️

Nuova campagna #malspam con oggetto: “Conferma dell’ordine”. Il #malware appartiene alla famiglia #Formbook.

ℹ️ Tutti gli IoC sono disponibili nel nostro canale Telegram: https://t.me/D3LabIT

#cybersecurity #threatintel #malware #mwitaly #italy

⚠️ Attenzione ⚠️

Nuova campagna #malspam "Distinta Pagamento Bonifico".

🛡️ Il #malware appartiene alla famiglia #VIPKeylogger

📎 #IoC: 9dec40122bbd2f9865c57df3b07e97b1

ℹ️ Tutti gli IoC sono disponibili nel nostro canale Telegram: https://t.me/D3LabIT

#threatintel

More #hagga via booking . com #malspam pdf -> js -> #originlogger

https://app.any.run/tasks/6e0e4947-fd2e-4d97-855a-a3b4cc9d819b

#python #AI #antimalware
#MachineLearning #DataScience #Cybersecurity #malware #SEG #MalSpam #cyberwarfare #VulnerabilityManagement #PatchManagement
#cybersecurityawareness
#security #infosec
t-SNE binary clusters
Best classifiers KNN, Decision Trees

http://newdigitals.org/2024/02/22/effective-ai-powered-malware-detection-interpretation-2-pca-t-sne-ml-tuning/

#python #AI #antimalware
#MachineLearning #DataScience #Cybersecurity #malware #SEG #MalSpam #cyberwarfare #VulnerabilityManagement #PatchManagement
#cybersecurityawareness
#security #infosec
t-SNE binary clusters
Best classifiers KNN, Decision Trees

http://newdigitals.org/2024/02/22/effective-ai-powered-malware-detection-interpretation-2-pca-t-sne-ml-tuning/

Why you need an infosec analyst on your #SchoolBoard: I received two scam emails this past weekend on an account I use for my candidacy and alerted my fellow candidates.

The scams were fairly rudimentary "iTunes gift card" fraud, but the attackers did look for and use the names of other candidates and one actual board member in their scam emails.

I had heard that politicians get hit with a larger-than-average volume of #malspam but this was a new one for me. Also, totally hamfisted, using UTC+3 time zone and a Russia-based webmail provider. Try harder next time, losers!

#ElectMoreHackers

ISC diary: @malware_traffic finds more #malspam pushing #Astaroth (#Guildma) in January 2023 https://i5c.us/d29404

ISC diary: @malware_traffic finds more #malspam pushing #Astaroth (#Guildma) in January 2023 https://i5c.us/d29404