#openthreatexchange — Public Fediverse posts

Mozilla Revokes Firefox and Thunderbird Linux Signing Key After Key Lands in Private Repo

Indicators extracted from public reporting. Source: https://thehackernews.com/2026/08/mozilla-revokes-firefox-and-thunderbird.html

Pulse ID: 6a7b1be8d817a5313138fbb2
Pulse Link: https://otx.alienvault.com/pulse/6a7b1be8d817a5313138fbb2
Pulse Author: CyberHunter_NL
Created: 2026-08-11 12:56:08

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #FireFox #HTML #HTTP #HTTPS #InfoSec #Linux #OTX #OpenThreatExchange #RCE #bot #CyberHunter_NL

The Permanent Threat: Analyzing Blockchain-Based C2 Operations and Communications

Aeternum is a C++ botnet loader utilizing the Polygon blockchain for command-and-control infrastructure instead of traditional centralized servers. Threat actors write encrypted and plaintext instructions directly to smart contracts, which infected devices query via public RPC endpoints. The malware implements weak PBKDF2HMAC/AES-GCM encryption with self-salting passwords, allowing payload decryption using only the smart contract address. Analysis reveals three related samples: the core Aeternum loader with Telegram-based exfiltration, a blended threat combining XWorm RAT with XMRig cryptocurrency miner, and Python source code revealing anti-analysis checks and cryptocurrency wallet targeting. The botnet demonstrates resilience through decentralized infrastructure, making traditional law enforcement takedowns significantly more challenging while maintaining low operational costs for attackers.

Pulse ID: 6a7a8be76fe0dfa36d01afa0
Pulse Link: https://otx.alienvault.com/pulse/6a7a8be76fe0dfa36d01afa0
Pulse Author: AlienVault
Created: 2026-08-11 02:41:43

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#BlockChain #CyberSecurity #ELF #Encryption #Endpoint #InfoSec #LawEnforcement #Mac #Malware #OTX #OpenThreatExchange #Password #Passwords #Python #RAT #RCE #RPC #Telegram #Word #Worm #XWorm #bot #botnet #cryptocurrency #AlienVault

Claude Code Sessions Spawn Reverse Tunnels and LaunchAgent Persistence on macOS

Indicators extracted from public reporting. Source: https://www.elastic.co/security-labs/coding-agent-launchagent-tunnel-detection

Pulse ID: 6a79840c1b36868eb7a69483
Pulse Link: https://otx.alienvault.com/pulse/6a79840c1b36868eb7a69483
Pulse Author: CyberHunter_NL
Created: 2026-08-10 07:55:56

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #HTTP #HTTPS #InfoSec #Mac #MacOS #OTX #OpenThreatExchange #RCE #bot #CyberHunter_NL

Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages

A threat actor published over 700 malicious packages to the NPM registry within 48 hours using AI-generated typo-squatting package names. These packages deploy a cross-platform RAT and infostealer without requiring install scripts, executing immediately upon import via require(). The downloader supports Windows, Linux, and macOS, rotating through three Cloudflare Workers hosts for payload delivery with a DNS TXT record fallback under wel1.ru. The macOS payload establishes persistence via LaunchAgents and downloads additional beacons. The Linux version delivers what appears to be a Sliver implant. The campaign shows connections to the earlier Moika malware operation, with shared tradecraft including focus on Russian financial institutions, fake telemetry camouflage, and similar kill switch mechanisms. The malware includes anti-analysis capabilities detecting debuggers, virtualization, and packet capture tools.

Pulse ID: 6a76515e8fbfccabf4dbb65b
Pulse Link: https://otx.alienvault.com/pulse/6a76515e8fbfccabf4dbb65b
Pulse Author: AlienVault
Created: 2026-08-07 21:42:54

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Cloud #CyberSecurity #DNS #InfoSec #InfoStealer #Linux #Mac #MacOS #Malware #NPM #OTX #OpenThreatExchange #RAT #Russia #SMS #Sliver #Windows #bot #AlienVault

Fake Zoom Installer Delivers Overlord RAT on macOS

Pulse ID: 6a7951c3648b349f44da270a
Pulse Link: https://otx.alienvault.com/pulse/6a7951c3648b349f44da270a
Pulse Author: Tr1sa111
Created: 2026-08-10 04:21:23

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #InfoSec #Mac #MacOS #OTX #OpenThreatExchange #RAT #Zoom #bot #Tr1sa111

ClickFix macOS Campaign Evolves Into Crypto-Draining Attack

A ClickFix-based macOS malware campaign targets users by tricking them
into executing malicious Terminal commands that deploy a Go-based
stealer. The malware steals browser credentials, Apple Keychain data and
cryptocurrency assets by exfiltrating sensitive information and draining
targeted wallets.

Pulse ID: 6a7711a399480a065d07328a
Pulse Link: https://otx.alienvault.com/pulse/6a7711a399480a065d07328a
Pulse Author: cryptocti
Created: 2026-08-08 11:23:15

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Browser #CyberSecurity #InfoSec #Mac #MacOS #Malware #OTX #OpenThreatExchange #RAT #bot #cryptocurrency #cryptocti

Mac Malware Drains Crypto Wallets Via Fake CAPTCHA Scam

A sophisticated macOS malware campaign leverages ClickFix social engineering to infect victims. The attack begins with a fake CAPTCHA prompt delivered via email links, tricking users into executing malicious commands in Terminal. This downloads a profiling script that collects system information and deploys architecture-specific Go-based Mach-O payloads. The stealer targets browser passwords, Apple Keychain credentials, and cryptocurrency wallets. Its most notable feature is a DRAIN function that gradually siphons cryptocurrency from victims' wallets by redirecting portions to attacker-controlled accounts. The malware supports Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and XRP. Infrastructure analysis reveals hosting through Aeza Group, a sanctioned Russian bulletproof hosting provider. The malware achieves persistence through macOS Background Task Management and uses various evasion techniques including Gatekeeper bypass and credential harvesting via fake system prompts.

Pulse ID: 6a74c5ff523b6fcb70f5711d
Pulse Link: https://otx.alienvault.com/pulse/6a74c5ff523b6fcb70f5711d
Pulse Author: AlienVault
Created: 2026-08-06 17:35:59

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#BitCoin #Browser #CAPTCHA #CredentialHarvesting #CyberSecurity #Email #InfoSec #Mac #MacOS #Malware #OTX #OpenThreatExchange #Password #Passwords #Russia #SocialEngineering #Troll #Word #bot #cryptocurrency #AlienVault

From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide

Microsoft Threat Intelligence identified a macOS ClickFix operation distributing infostealers including MacSync and Atomic Stealer through over 250 algorithmically generated domains. The campaign evolved from openly displaying malicious content to implementing server-side browser fingerprinting that only reveals lures to visitors whose environment matches genuine macOS browsers. The fingerprinting gate collects browser attributes, hardware details via WebGL, and environmental characteristics to filter out crawlers and sandboxes. Victims are shown fake download pages with Terminal commands that retrieve remote scripts, ultimately deploying AMOS infostealer to harvest credentials, browser data, cryptocurrency wallets, and authentication stores. This Traffic Distribution System approach significantly reduces visibility for security researchers and automated analysis tools while maintaining access to intended targets. The operation represents a notable shift in tradecraft, adding sophisticated cloaking to exis...

Pulse ID: 6a73869b069fb3586fddadf9
Pulse Link: https://otx.alienvault.com/pulse/6a73869b069fb3586fddadf9
Pulse Author: AlienVault
Created: 2026-08-05 18:53:15

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#AMOS #Atomic #AtomicStealer #Browser #CyberSecurity #ICS #InfoSec #InfoStealer #Mac #MacOS #Microsoft #OTX #OpenThreatExchange #RAT #bot #cryptocurrency #AlienVault

Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages

On August 4, 2026, a sophisticated supply chain attack compromised the keyv npm package maintainer, deploying CHAINDROP, a self-propagating worm that automatically backdoors packages using stolen npm credentials. Over 400 npm packages were infected, affecting more than 1.3 billion monthly downloads. The worm executes via preinstall hooks, deploys across Linux, macOS, and Windows platforms, and harvests credentials from over 300 patterns targeting AI tooling, cloud providers, GitHub tokens, and npm credentials. CHAINDROP uses Ethereum smart contracts for C2 resolution and propagates by publishing trojanized versions of packages the compromised maintainer can access. The payload is heavily obfuscated and contains Dune-themed references consistent with previous Shai-Hulud campaigns.

Pulse ID: 6a73cac4902afff959b758aa
Pulse Link: https://otx.alienvault.com/pulse/6a73cac4902afff959b758aa
Pulse Author: AlienVault
Created: 2026-08-05 23:44:04

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#BackDoor #Cloud #CyberSecurity #ELF #GitHub #InfoSec #Linux #Mac #MacOS #NPM #OTX #OpenThreatExchange #SupplyChain #Trojan #Windows #Worm #bot #AlienVault

250+ macOS ClickFix Domains Use Browser Fingerprinting to Hide Atomic Stealer Attacks

Indicators extracted from public reporting. Source: https://cybersecuritynews.com/158536-2250-macos-clickfix-domains/

Pulse ID: 6a7421ea3cb7d6ca6a2de878
Pulse Link: https://otx.alienvault.com/pulse/6a7421ea3cb7d6ca6a2de878
Pulse Author: CyberHunter_NL
Created: 2026-08-06 05:55:54

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Atomic #AtomicStealer #Browser #CyberSecurity #HTTP #HTTPS #InfoSec #Mac #MacOS #OTX #OpenThreatExchange #RCE #bot #CyberHunter_NL

Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures

Indicators extracted from public reporting. Source: https://thehackernews.com/2026/08/over-250-clickfix-domains-use-browser.html

Pulse ID: 6a73959c2ad49ed792b91f28
Pulse Link: https://otx.alienvault.com/pulse/6a73959c2ad49ed792b91f28
Pulse Author: CyberHunter_NL
Created: 2026-08-05 19:57:16

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Browser #CyberSecurity #HTML #HTTP #HTTPS #InfoSec #Mac #MacOS #Malware #OTX #OpenThreatExchange #RCE #bot #CyberHunter_NL

Phishing Email Delivers ScreenConnect Malware

A sophisticated phishing campaign targets Windows users with fraudulent Bank of America emails, delivering ScreenConnect remote monitoring software as malware. The attack begins with convincing emails mimicking Bank of America branding, directing victims to fake security pages. Windows users receive AccountGuard.zip containing a VBS file with multiple layers of base64-encoded content. The attack chain deploys complex decoding scripts and employs a UAC bypass exploit via ICMLuaUtil COM interface to install ScreenConnect with administrator privileges. Additional components use SDDL and ACLs to hide the installation, prevent uninstallation, and conceal the malicious service. The installed client connects to command-and-control infrastructure in the UAE. Mac users encounter traditional credential phishing pages requesting banking credentials and personal information instead of receiving malware payloads.

Pulse ID: 6a722c0bba9d9f436322ae56
Pulse Link: https://otx.alienvault.com/pulse/6a722c0bba9d9f436322ae56
Pulse Author: AlienVault
Created: 2026-08-04 18:14:35

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Bank #CyberSecurity #Email #InfoSec #LUA #Mac #Malware #Mimic #OTX #OpenThreatExchange #Phishing #RAT #ScreenConnect #UAE #VBS #Windows #ZIP #bot #AlienVault

ScreenConnect RMM Abuse, Cloudflare Tunnels, and Trusted Software Lures Threat Intelligence, Threat Research, Threat Security

Threat actors are conducting a multi-wave campaign using social engineering lures themed around Zoom updates, business documents, and system utilities to deploy ScreenConnect Remote Monitoring and Management agents. The operation employs VBScript droppers, batch loaders, compiled .NET executables, and HTML phishing pages, all retrieving payloads from a WsgiDAV staging server at 207.174.0.143:8080. Victims receive silently installed ScreenConnect agents that beacon to three attacker-controlled relay servers, providing persistent remote access. The campaign demonstrates technical evolution from obfuscated VBScript with XOR encryption to aggressive .NET loaders executing nine-step Windows Defender destruction sequences. Cross-platform variants target both Windows and macOS systems. All payloads are legitimately signed ConnectWise ScreenConnect MSIs, designed to evade security controls that trust code signing. The threat actor actively rotates payload hashes and recently pivoted to stealth tactics specifically...

Pulse ID: 6a722d8bdafe1dfae681f87b
Pulse Link: https://otx.alienvault.com/pulse/6a722d8bdafe1dfae681f87b
Pulse Author: AlienVault
Created: 2026-08-04 18:20:59

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Cloud #ConnectWise #CyberSecurity #Encryption #HTML #ICS #InfoSec #Mac #MacOS #NET #OTX #OpenThreatExchange #Phishing #RAT #Rust #ScreenConnect #SocialEngineering #Troll #VBS #Windows #Zoom #bot #AlienVault

Chinese Threat Actor Uses Leaked DarkSword Kit to Deploy GHOSTBLADE on iOS [The Hacker News]

Automatically generated from open-source reporting.

Title: Chinese Threat Actor Uses Leaked DarkSword Kit to Deploy GHOSTBLADE on iOS
Source: The Hacker News
Reference: https://thehackernews.com/2026/08/chinese-threat-actor-uses-leaked.html
Indicators: 15

Extracted via automated RSS monitoring with regex + LLM validation. Indicators are unverified; validate before acting on them.

Pulse ID: 6a7074a62c133f768f849a40
Pulse Link: https://otx.alienvault.com/pulse/6a7074a62c133f768f849a40
Pulse Author: CyberHunter_NL
Created: 2026-08-03 10:59:50

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Chinese #CyberSecurity #HTML #HTTP #HTTPS #InfoSec #OTX #OpenThreatExchange #RAT #RCE #Word #bot #iOS #CyberHunter_NL

A Deep Dive Into the Latest XCSSET Version

After months of dormancy, XCSSET malware version 40 emerged in April 2026 targeting macOS developers through supply chain attacks. The malware hides in Xcode projects of legitimate applications on GitHub, spreading through infected development environments. V40 features advanced detection evasion through polymorphic payload generation, fileless persistence, and in-memory execution while weakening security mechanisms. It introduces 17 distinct modules including a Chrome hijacking backdoor via Chrome DevTools Protocol and a Telegram trojanizer. The malware employs multi-layered encryption, disables system security updates, terminates cloud telemetry, and locks XProtect signature databases. Primary targeting focuses on developers across South Asia. The infrastructure utilizes approximately 40 domains registered in Russia and India, demonstrating a geographic pivot in operations.

Pulse ID: 6a7059ccae49a160e5763d1d
Pulse Link: https://otx.alienvault.com/pulse/6a7059ccae49a160e5763d1d
Pulse Author: AlienVault
Created: 2026-08-03 09:05:16

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Asia #BackDoor #Chrome #Cloud #CyberSecurity #Encryption #GitHub #India #InfoSec #Mac #MacOS #Malware #OTX #OpenThreatExchange #RAT #Russia #SMS #SouthAsia #SupplyChain #Telegram #Trojan #bot #developers #AlienVault

Reverse Engineering the Six Stages of MacSync Stealer and RAT

Pulse ID: 6a701f687e0f95a9d2a3e733
Pulse Link: https://otx.alienvault.com/pulse/6a701f687e0f95a9d2a3e733
Pulse Author: Tr1sa111
Created: 2026-08-03 04:56:08

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #InfoSec #Mac #OTX #OpenThreatExchange #RAT #bot #Tr1sa111

OctLurk and SilkLurk: new Backdoors in Central Asia

Two newly identified backdoors, OctLurk and SilkLurk, have been targeting government organizations across Central Asia since January 2025. Victims span Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and Syria, affecting healthcare, research, government offices, ministries of foreign affairs, logistics, law enforcement, urban planning, and educational institutions. Both backdoors employ heavily obfuscated loaders customized per victim, using machine-specific data for decryption. They deploy multiple plugins for command execution, file manipulation, credential harvesting, keylogging, network scanning, and remote access. The attackers also utilized LurkProxy for network traffic proxying and deployed additional tools including PlugX, Impacket, FSCAN, and Pandora FMS agents. Analysis indicates both backdoors are operated by the same Chinese-speaking threat actor, though attribution to a specific known group remains unconfirmed. The campaigns demonstrate sophisticated persistence mechanisms and ext...

Pulse ID: 6a6b4b97df5f9df74333adfa
Pulse Link: https://otx.alienvault.com/pulse/6a6b4b97df5f9df74333adfa
Pulse Author: AlienVault
Created: 2026-07-30 13:03:19

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Afghanistan #Asia #BackDoor #CentralAsia #Chinese #CredentialHarvesting #CyberSecurity #Education #Government #Healthcare #ICS #InfoSec #Kazakhstan #LawEnforcement #Mac #OTX #Office #OpenThreatExchange #PlugX #Proxy #RAT #RCE #SMS #Syria #bot #AlienVault

Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT

Between July 21-22, 2026, 29 organizations were compromised through a sophisticated malvertising campaign exploiting Claude AI's legitimate domain. Victims searching for Claude Desktop via Bing encountered sponsored advertisements leading to a malicious Claude Artifact hosted on the authentic Claude.ai domain. This artifact redirected users to attacker-controlled infrastructure distributing a fake ClaudeDesktop.exe file containing SectopRAT. The malware employed advanced anti-analysis techniques including VMProtect packing, GPU-based virtual machine detection, and DirectX shader-based payload decryption. Command-and-control infrastructure utilized EtherHiding, storing C2 addresses in Ethereum blockchain transactions for resilience against takedowns. The remote access trojan exfiltrated credit card data, credentials, browser information, and personal files. Analysis revealed connections to previous campaigns dating to December 2025, with infrastructure linked to Operation Endgame seizures and StealC distrib...

Pulse ID: 6a616004250472ee87e19829
Pulse Link: https://otx.alienvault.com/pulse/6a616004250472ee87e19829
Pulse Author: AlienVault
Created: 2026-07-23 00:27:48

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#BlockChain #Browser #CreditCard #CyberSecurity #EtherHiding #InfoSec #Mac #Malvertising #Malware #OTX #OpenThreatExchange #RAT #RemoteAccessTrojan #Stealc #Trojan #Troll #bot #AlienVault

Inside a TrickBot Variant Using DNS Tunneling for C2

A TrickBot variant has been identified that uses DNS tunneling for command-and-control communications instead of traditional HTTP protocols. The malware maintains persistence through Windows Task Scheduler, creating disguised tasks that execute at startup and repeat every five minutes. Configuration data is stored in NTFS Alternate Data Streams to evade detection. The malware employs multiple obfuscation techniques including encrypted strings, runtime API resolution via hash-based lookups, and dynamically calculated constants. Its modular architecture supports twelve different control commands enabling capabilities such as module downloads, process injection through hollowing and doppelgänging techniques, PowerShell execution, and raw machine code execution. The variant transfers data through specially crafted DNS queries to public DNS servers, encoding command data in malformed domain names and receiving responses embedded within multiple IPv4 addresses, achieving transfer speeds of approximately 30.7 KB/s.

Pulse ID: 6a6120390f602b6ee56739c3
Pulse Link: https://otx.alienvault.com/pulse/6a6120390f602b6ee56739c3
Pulse Author: AlienVault
Created: 2026-07-22 19:55:37

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #DNS #HTTP #InfoSec #Mac #Malware #OTX #OpenThreatExchange #PowerShell #RAT #Windows #bot #AlienVault

From E-Sign to RMM: DocuSign Kit Targets Windows and...

A sophisticated phishing campaign leverages DocuSign-themed lures to trick victims into installing legitimate remote management software including MeshAgent, ScreenConnect, and SimpleHelp. The operation employs a reusable web kit featuring staged delivery through simulated document loading interfaces, user-agent based targeting that filters for Windows systems while blocking Edge browsers, and Cloudflare Turnstile verification. The campaign demonstrates operational maturity with separate Windows and macOS delivery paths, real-time victim telemetry via Telegram, and VBS deployment scripts that disable Windows Defender and establish persistence through service installation. Active from May through July 2026, the infrastructure rotates across multiple domains using consistent URL patterns to evade detection while abusing trusted IT tools for persistent access.

Pulse ID: 6a5f5a391cc670d0388a1d29
Pulse Link: https://otx.alienvault.com/pulse/6a5f5a391cc670d0388a1d29
Pulse Author: AlienVault
Created: 2026-07-21 11:38:33

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Browser #Cloud #CyberSecurity #Edge #InfoSec #Mac #MacOS #OTX #OpenThreatExchange #Phishing #RAT #Rust #ScreenConnect #Telegram #VBS #Windows #bot #AlienVault

Botnet Analysis: A Product-Grade Threat for the AI Service Era

NadMesh is an industrial-grade Go-based botnet observed in July 2026 that autonomously scans and exploits AI infrastructure and cloud services. The botnet integrates scanning, exploitation, and intelligence harvesting into a single platform targeting over 90 cloud provider address ranges. It employs 20+ exploitation vectors against Redis, Docker, MCP, Kubernetes, and other services, with particular focus on AI platforms like ComfyUI, Ollama, and Gradio discovered via Shodan API. NadMesh features a web-based management panel, polymorphic builds using Garble obfuscation and UPX packing, and redundant persistence mechanisms including SSH backdoors, agent processes, and cron watchdogs. The operation demonstrates clear commercial intent with conversion funnel statistics, canary updates, and automated task supply loops that amplify high-yield subnets. It harvests cloud credentials, Kubernetes tokens, AI model access, and MCP service intelligence.

Pulse ID: 6a5a11b5327ee76f3502c500
Pulse Link: https://otx.alienvault.com/pulse/6a5a11b5327ee76f3502c500
Pulse Author: AlienVault
Created: 2026-07-17 11:27:49

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#BackDoor #Cloud #CyberSecurity #Docker #ICS #InfoSec #OTX #OpenThreatExchange #RAT #Redis #SMS #SSH #WatchDog #bot #botnet #AlienVault

Telegram Desktop Session Theft Via macOS Infostealer Malware

Recommendations for users of the messaging service Telegram to change their passwords and make sure they are safe and easy to log into, as well as access to the service, have been published by the BBC.

Pulse ID: 6a59dfd7382e71d3bfe00b33
Pulse Link: https://otx.alienvault.com/pulse/6a59dfd7382e71d3bfe00b33
Pulse Author: cryptocti
Created: 2026-07-17 07:55:03

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#BBC #CyberSecurity #InfoSec #InfoStealer #Mac #MacOS #Malware #OTX #OpenThreatExchange #Password #Passwords #Telegram #Word #bot #cryptocti

ClickLock Stealer: Paste Once, Lose Everything

A new modular macOS information stealer named ClickLock Stealer has been discovered targeting users primarily in Europe, North America, and the Middle East. The malware is likely distributed via ClickFix social engineering pages that trick victims into pasting malicious commands into Terminal. Once executed, it deploys four components: a credential stealer, a Keychain stealer targeting Chrome's encryption key, a comprehensive crypto wallet harvester, and a persistent GSocket-based backdoor. The malware employs an aggressive 'locker' technique, killing all visible applications except password dialogs to force user compliance. It targets data from eight browsers, 31 crypto wallet extensions, seven password managers, desktop wallets, macOS Keychain, and shell history. The campaign has compromised at least 100 victims across 33 countries since May 2026, using compromised WordPress domains and Telegram for command and control and exfiltration.

Pulse ID: 6a58c1a90a160ce1e25e78e7
Pulse Link: https://otx.alienvault.com/pulse/6a58c1a90a160ce1e25e78e7
Pulse Author: AlienVault
Created: 2026-07-16 11:34:01

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#BackDoor #Browser #Chrome #CyberSecurity #Encryption #Europe #InfoSec #Mac #MacOS #Malware #MiddleEast #NorthAmerica #OTX #OpenThreatExchange #Password #RAT #RCE #RDP #SocialEngineering #Telegram #Word #Wordpress #bot #AlienVault

June 2026 Infostealer Trend Report

During June 2026, multiple infostealer families including Remus, ACRStealer, LummaC2, and Vidar were distributed through SEO poisoning techniques, disguised as illegal software such as cracks and keygens. Attacks utilized EXE files (84.5%) and DLL side-loading (15.5%) methods, with distribution primarily through Mediafire, Mega, and cloud storage platforms. Microsoft Corporation was the most frequently impersonated entity. MacOS environments were targeted through ClickFix techniques and malicious Bash scripts, with one variant dynamically obtaining C2 addresses via Polygon smart contracts. Email-based campaigns distributed AgentTesla and DarkCloud through compressed attachments, with both variants exfiltrating data via SMTP. The stolen credentials pose significant risks for dark web trading and secondary attacks.

Pulse ID: 6a5775d6071af081378a0eb9
Pulse Link: https://otx.alienvault.com/pulse/6a5775d6071af081378a0eb9
Pulse Author: AlienVault
Created: 2026-07-15 11:58:14

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Cloud #CyberSecurity #Email #InfoSec #InfoStealer #LummaC2 #Mac #MacOS #Microsoft #OTX #OpenThreatExchange #RAT #SEOPoisoning #Tesla #Vidar #bot #AlienVault

Shared Claude Chats Meet ClickFix

A ClickFix campaign has been identified that abuses Anthropic's Claude platform through shareable chat links to distribute MacSync Stealer targeting macOS users. Attackers utilized malvertising with paid Google ads to direct victims searching for Claude-related terms to malicious shared Claude chats falsely labeled as 'Apple Support.' These chats contained obfuscated installation commands that, when executed, deployed a multi-stage infection chain. The malware steals credentials from browsers and password managers, cryptocurrency wallet data, sensitive files, and system information. The campaign ran from June 12-19, 2026, targeting primarily Mac users with Russian-language comments in the code suggesting Russian-speaking threat actors. Domains used adopted themes related to U.S. local services to appear legitimate.

Pulse ID: 6a57b1d61379f5309f46131d
Pulse Link: https://otx.alienvault.com/pulse/6a57b1d61379f5309f46131d
Pulse Author: AlienVault
Created: 2026-07-15 16:14:14

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Browser #CyberSecurity #Google #GoogleAds #InfoSec #Mac #MacOS #Malvertising #Malware #OTX #OpenThreatExchange #Password #Russia #Word #bot #cryptocurrency #AlienVault

CrashStealer: C++ macOS Infostealer Posing as Crash Reporter

Pulse ID: 6a570e3164e59447a4cb59cf
Pulse Link: https://otx.alienvault.com/pulse/6a570e3164e59447a4cb59cf
Pulse Author: Tr1sa111
Created: 2026-07-15 04:36:01

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #InfoSec #InfoStealer #Mac #MacOS #OTX #OpenThreatExchange #bot #Tr1sa111

CrashStealer: C++ macOS Infostealer Posing as Crash Reporter

A newly discovered macOS infostealer, implemented in native C++, impersonates Apple's crash-reporting framework to harvest sensitive data. The malware is distributed through a signed and notarized dropper application that bypasses Gatekeeper, then downloads and installs the payload from attacker infrastructure. The stealer validates victim passwords locally using dscl, unlocks the login keychain, and collects browser credentials, cryptocurrency wallet extensions, password manager data, and keychain material. Collected data is encrypted using AES-GCM before being packaged into hidden ZIP archives and exfiltrated to a command-and-control server. The malware establishes persistence by copying itself to a hidden directory and installing a LaunchAgent. It employs control-flow flattening, encrypted strings, and anti-debugging techniques to resist analysis. The campaign uses GitHub for initial staging and multiple fake collaboration software domains as lures.

Pulse ID: 6a55ec60c2d64907df771c4c
Pulse Link: https://otx.alienvault.com/pulse/6a55ec60c2d64907df771c4c
Pulse Author: AlienVault
Created: 2026-07-14 07:59:28

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Browser #CyberSecurity #ELF #GitHub #InfoSec #InfoStealer #Mac #MacOS #Malware #OTX #OpenThreatExchange #Password #Passwords #RAT #Word #ZIP #bot #cryptocurrency #AlienVault

ModHeader Malware: Inside the Chrome Spyware Google Removed

ModHeader, a popular Chrome developer extension with over 800,000 users, was flagged and removed by Google for containing hidden spyware. Version 7.0.18 included a covert SDK disguised as a date library (dayjs) that harvested visited domain names, encrypted them using AES-GCM, and was configured to upload the data daily to api.stanfordstudies.com. Although the collection remained dormant due to an empty allowlist, the complete exfiltration infrastructure was present and operational. Additionally, the extension displayed active adware behavior, opening affiliate tabs on every update including on enterprise-managed machines. The malicious code shipped with official Chrome Web Store signatures, affecting both Chrome and Edge users. Forensic analysis revealed the extension locally stored 178MB of sensitive HTTP headers from all browsing activity, though no data was successfully exfiltrated from analyzed systems.

Pulse ID: 6a55ed9b6b71e59faf2f8ea7
Pulse Link: https://otx.alienvault.com/pulse/6a55ed9b6b71e59faf2f8ea7
Pulse Author: AlienVault
Created: 2026-07-14 08:04:43

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Chrome #CyberSecurity #Edge #Google #HTTP #InfoSec #Mac #Malware #OTX #OpenThreatExchange #RAT #SpyWare #bot #AlienVault

Everest Ransomware Group's Leak Site Compromised Through Infrastructure Defacement

Everest is a ransomware written in .NET protected using ConfuserEx to
prevent tampering.

Pulse ID: 6a55810d6a411232f910870d
Pulse Link: https://otx.alienvault.com/pulse/6a55810d6a411232f910870d
Pulse Author: cryptocti
Created: 2026-07-14 00:21:33

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #InfoSec #NET #OTX #OpenThreatExchange #RansomWare #bot #cryptocti

jscrambler npm Package Compromised in Supply Chain Attack

A malicious release of the jscrambler npm package (version 8.14.0) was published on July 11, 2026, introducing hidden native binaries that execute automatically during installation. The compromised package added an undocumented preinstall hook executing dist/setup.js, which deploys platform-specific binaries for Linux, macOS, and Windows embedded in an obfuscated CSI container. The payload is a Rust-built infostealer targeting cryptocurrency wallets, AI coding assistants, cloud credentials (AWS, GCP, Azure), browser data, and messaging applications. String obfuscation uses per-string ChaCha20-Poly1305 encryption. The threat actor published five malicious versions (8.14.0, 8.16.0, 8.17.0, 8.18.0, 8.20.0) over three hours, evolving delivery methods to evade detection. Version 8.22.0 is confirmed clean. The package receives approximately 15,800 weekly downloads, affecting developer workstations, CI systems, and build pipelines with access to credentials and secrets.

Pulse ID: 6a52d7f22883fcd1f11046c2
Pulse Link: https://otx.alienvault.com/pulse/6a52d7f22883fcd1f11046c2
Pulse Author: AlienVault
Created: 2026-07-11 23:55:30

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#AWS #Azure #Browser #ChaCha20 #Cloud #CyberSecurity #Encryption #InfoSec #InfoStealer #Linux #Mac #MacOS #NPM #OTX #OpenThreatExchange #Rust #SupplyChain #Windows #bot #cryptocurrency #AlienVault

Fake Software Tutorials on TikTok Spread Vidar Stealer

Threat actors are leveraging TikTok and Instagram Reels to distribute the Vidar infostealer through fake software tutorials. Two distinct campaigns use short-form videos disguised as tutorials for unlocking premium software like Spotify. The first campaign uses accounts mimicking official Windows profiles with AI-voiced clips instructing users to run PowerShell commands that download Vidar from lookalike domains. One video achieved over 100,000 views. The second campaign uses ordinary accounts posting music-backed clips that bait users in comments to receive malicious links via direct message. These campaigns exploit platform recommendation algorithms by encouraging saves and shares. Vidar is sold as a service for $300 lifetime license and harvests credentials, financial data and authentication tokens.

Pulse ID: 6a298f548047c70cc9e2f4ee
Pulse Link: https://otx.alienvault.com/pulse/6a298f548047c70cc9e2f4ee
Pulse Author: AlienVault
Created: 2026-06-10 16:22:44

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #FinancialData #InfoSec #InfoStealer #Instagram #Mimic #OTX #OpenThreatExchange #PowerShell #Vidar #Windows #bot #AlienVault

Latest PyPi Compromise

A supply chain attack targeting the Microsoft DurableTask Python client compromised versions 1.4.1, 1.4.2, and 1.4.3 on PyPi. The threat actor gained access through a compromised GitHub account previously linked to attacks, using stolen credentials to dump GitHub secrets containing PyPi tokens. The evolved payload targets Linux systems, stealing credentials from AWS, Azure, GCP, Kubernetes, Vault, and password managers like Bitwarden and 1Password. It propagates via AWS SSM and Kubernetes lateral movement, limited to 5 targets per infected host. The payload scrapes shell history, bruteforces password managers, and establishes persistence through infection markers. Compromised packages were quarantined following analysis.

Pulse ID: 6a0ce3b0ad791179648c47b0
Pulse Link: https://otx.alienvault.com/pulse/6a0ce3b0ad791179648c47b0
Pulse Author: AlienVault
Created: 2026-05-19 22:26:56

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#AWS #Azure #BruteForce #CyberSecurity #GitHub #InfoSec #Linux #Microsoft #OTX #OpenThreatExchange #Password #PyPI #Python #RCE #SupplyChain #Word #bot #AlienVault

DNS: A Small but Effective C2 system

This analysis explores the exploitation of DNS for command-and-control operations and data exfiltration. It details how cybercriminals leverage DNS tunneling to create covert communication channels, bypassing traditional security measures. The article examines various DNS tunneling families, including Cobalt Strike, DNSCat2, and Iodine, discussing their prevalence and unique characteristics. It also highlights Infoblox's Threat Insight machine learning algorithms, which can detect and block tunneling domains within minutes. The study provides insights into the detection rates of different tunneling families and discusses the challenges in differentiating between legitimate and malicious DNS traffic.

Pulse ID: 6878f6e5d14da64ae460ad61
Pulse Link: https://otx.alienvault.com/pulse/6878f6e5d14da64ae460ad61
Pulse Author: AlienVault
Created: 2025-07-17 13:13:08

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CobaltStrike #CyberSecurity #DNS #ICS #InfoSec #Mac #OTX #OpenThreatExchange #RAT #bot #AlienVault

Smishing Triad: Chinese eCrime Group Targets 121+ Countries, Introduces New Banking Phishing Kit

The Chinese eCrime group Smishing Triad has launched a global SMS phishing campaign targeting over 121 countries across various industries. Their infrastructure generates over one million page visits in 20 days, averaging 50,000 daily. The group has introduced a new 'Lighthouse' phishing kit focusing on banking and financial organizations, particularly in Australia and the Asia-Pacific region. Smishing Triad claims to have '300+ front desk staff worldwide' supporting their operations. They frequently rotate domains, with approximately 25,000 active during any 8-day period. The majority of phishing sites are hosted by Chinese companies Tencent and Alibaba. The campaign primarily targets postal, logistics, telecommunications, transportation, finance, retail, and public sectors.

Pulse ID: 67f80a4937d04f9036252cf7
Pulse Link: https://otx.alienvault.com/pulse/67f80a4937d04f9036252cf7
Pulse Author: AlienVault
Created: 2025-04-10 18:13:29

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Asia #Australia #Bank #Chinese #CyberSecurity #ICS #InfoSec #OTX #OpenThreatExchange #Phishing #RAT #SMS #Smishing #Telecom #Telecommunication #bot #AlienVault

Targeting of freelance developers

North Korea-aligned cybercriminals are targeting freelance software developers through fake job offers and coding challenges containing malware. The campaign, dubbed DeceptiveDevelopment, uses two main malware families - BeaverTail and InvisibleFerret - to steal cryptocurrency wallets and login credentials. Attackers pose as recruiters on platforms like LinkedIn and GitHub, providing trojanized projects as part of fake interview processes. The malware steals browser data, cryptocurrency wallets, and system information, and can deploy remote access tools. Hundreds of victims globally have been observed across Windows, Linux and macOS systems. The operation shows increasing sophistication and is expected to continue evolving its tactics to target cryptocurrency users.

Pulse ID: 67b81609424eb59f7dd64a0b
Pulse Link: https://otx.alienvault.com/pulse/67b81609424eb59f7dd64a0b
Pulse Author: AlienVault
Created: 2025-02-21 05:58:33

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Browser #CyberSecurity #GitHub #ICS #InfoSec #Korea #LinkedIn #Linux #Mac #MacOS #Malware #NorthKorea #OTX #OpenThreatExchange #RAT #Trojan #Windows #bot #cryptocurrency #developers #AlienVault

Typosquatting Attack Targeting Developers using ESLint Plugin

Pulse ID: 6764f5e231a8b1befd001252
Pulse Link: https://otx.alienvault.com/pulse/6764f5e231a8b1befd001252
Pulse Author: cryptocti
Created: 2024-12-20 04:43:14

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #InfoSec #OTX #OpenThreatExchange #TypoSquatting #bot #developers #cryptocti

Vulnerability Discovered in BeyondTrust’s PRA and RS Products Has Been Patched

Pulse ID: 6764f672e630b13da0715d25
Pulse Link: https://otx.alienvault.com/pulse/6764f672e630b13da0715d25
Pulse Author: cryptocti
Created: 2024-12-20 04:45:38

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #InfoSec #OTX #OpenThreatExchange #Rust #Vulnerability #bot #cryptocti

Threat Intelligence Alert: Phish 'n' Ships Fakes Online Shops to Steal Money and Credit Card Information

A sophisticated fraud scheme dubbed 'Phish 'n' Ships' has been uncovered, involving fake web shops that exploit digital payment providers to steal consumers' money and credit card information. The operation, traced back to 2019, has infected over 1,000 websites, created 121 fake web stores, and resulted in estimated losses of tens of millions of dollars. The threat actors, using tools with Simplified Chinese language, drive traffic to these fake shops by infecting legitimate websites and manipulating search engine rankings. The scheme has been partially disrupted through collaborative efforts, but remains an active threat. This operation highlights the dangerous intersection between digital advertising and fraud, emphasizing the need for caution in online shopping.

Pulse ID: 6723dea7b5edf25ba58bf36b
Pulse Link: https://otx.alienvault.com/pulse/6723dea7b5edf25ba58bf36b
Pulse Author: AlienVault
Created: 2024-10-31 19:46:47

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Chinese #CreditCard #CyberSecurity #InfoSec #OTX #OpenThreatExchange #RAT #bot #AlienVault

Russian Hackers Attacking Ukraine Military With Malware Via Telegram

Russian hackers, identified as UNC5812, are targeting the Ukrainian military through a sophisticated cyber operation. The attackers use a deceptive Telegram channel and website posing as a civil defense service to distribute malware for both Windows and Android devices. The Windows attack deploys Pronsis Loader, which installs SUNSPINNER (a decoy mapping application) and PURESTEALER (an information-stealing malware). Android users are targeted with CRAXSRAT, a commercial backdoor malware. The operation spreads through promoted posts in legitimate Ukrainian Telegram channels and employs social engineering tactics. The campaign also includes an influence operation sharing anti-mobilization content across pro-Russian social media networks. This cyber-espionage effort aims to exploit recent changes in Ukraine's mobilization laws and the introduction of digital military IDs.

Pulse ID: 67239ee60b0b02d1805d507b
Pulse Link: https://otx.alienvault.com/pulse/67239ee60b0b02d1805d507b
Pulse Author: AlienVault
Created: 2024-10-31 15:14:46

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#AWS #Android #BackDoor #CyberSecurity #Espionage #ICS #InfoSec #Malware #Military #OTX #OpenThreatExchange #RAT #Russia #SocialEngineering #SocialMedia #Telegram #UK #Ukr #Ukraine #Ukrainian #Windows #bot #cyberespionage #AlienVault

Attackers Distribute Malware Through Fake CAPTCHAs

Pulse ID: 672386f52f7063e3c4058f96
Pulse Link: https://otx.alienvault.com/pulse/672386f52f7063e3c4058f96
Pulse Author: cryptocti
Created: 2024-10-31 13:32:37

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CAPTCHA #CyberSecurity #InfoSec #Malware #OTX #OpenThreatExchange #bot #cryptocti

Interlock Ransomware Setting its Sights on Windows and FreeBSD

Pulse ID: 6723875244094e2f729a82fd
Pulse Link: https://otx.alienvault.com/pulse/6723875244094e2f729a82fd
Pulse Author: cryptocti
Created: 2024-10-31 13:34:10

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #InfoSec #OTX #OpenThreatExchange #RansomWare #Windows #bot #cryptocti

Malwares That Bypass Chrome’s Cookie Protection to Steal Data

Pulse ID: 6722d8915ac4abcd48265166
Pulse Link: https://otx.alienvault.com/pulse/6722d8915ac4abcd48265166
Pulse Author: cryptocti
Created: 2024-10-31 01:08:33

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Chrome #CyberSecurity #InfoSec #Malware #OTX #OpenThreatExchange #bot #cryptocti

Hackers Disguise WrnRAT Malware as Gambling Games

Pulse ID: 6722d9adf5b88f80aaa4d9a9
Pulse Link: https://otx.alienvault.com/pulse/6722d9adf5b88f80aaa4d9a9
Pulse Author: cryptocti
Created: 2024-10-31 01:13:17

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #InfoSec #Malware #OTX #OpenThreatExchange #RAT #bot #cryptocti

Suspected DPRK Phishing Campaign Targets Naver; Separate Apple Domain Spoofing Cluster Identified

Researchers discovered a potential North Korean phishing campaign targeting Naver, a major South Korean tech platform. The investigation revealed an exposed directory containing phishing pages designed to steal Naver user credentials. Separately, an infrastructure cluster was identified using domains and certificates impersonating Apple. Both findings align with tactics commonly associated with DPRK cyber operations. The phishing server, hosted in Seoul, contained multiple folders with files for credential theft. Additionally, a cluster of IPs across various countries was found sharing TLS certificates and domains spoofing Apple. The use of low-cost domains, Let's Encrypt certificates, and frequent infrastructure changes are consistent with known DPRK threat actor behaviors.

Pulse ID: 67224d6c9fdebf46e43df3b9
Pulse Link: https://otx.alienvault.com/pulse/67224d6c9fdebf46e43df3b9
Pulse Author: AlienVault
Created: 2024-10-30 15:14:52

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #DPRK #ICS #InfoSec #Korea #LetsEncrypt #NorthKorea #OTX #OpenThreatExchange #Phishing #RAT #SouthKorea #TLS #bot #AlienVault

Play Ransomware Engagement

Unit 42 has identified Jumpy Pisces, a North Korean state-sponsored threat group, as a key player in a recent ransomware incident. The group appears to be collaborating with the Play ransomware group, marking a shift in their tactics. This is the first observed instance of Jumpy Pisces using existing ransomware infrastructure, potentially acting as an initial access broker or an affiliate. The attack timeline spans from May to September 2024, involving initial access through a compromised user account, lateral movement, and persistence using tools like Sliver and DTrack. The incident culminated in the deployment of Play ransomware in early September. This collaboration signals deeper involvement of North Korean threat actors in the broader ransomware landscape, potentially leading to more widespread and damaging attacks globally.

Pulse ID: 67225f8455c324e956f9ebc1
Pulse Link: https://otx.alienvault.com/pulse/67225f8455c324e956f9ebc1
Pulse Author: AlienVault
Created: 2024-10-30 16:32:04

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #ICS #InfoSec #Korea #NorthKorea #OTX #OpenThreatExchange #PlayRansomware #RAT #RansomWare #Sliver #Unit42 #bot #AlienVault

Strela Stealer Targets Europe Stealthily Via WebDav

Strela Stealer, first identified by DCSO in late 2022, is a type of information-stealing malware primarily designed to exfiltrate email account credentials from widely used email clients, including Microsoft Outlook and Mozilla Thunderbird. This malware initially targeted Spanish-speaking users through spam email campaigns containing malicious ISO attachments, which included a .lnk file and a polyglot file. When executed, the .lnk file triggered the polyglot file, executing both the lure html and Strela stealer DLL using “rundll32.exe”.

Pulse ID: 6722a8e21adc9ea3cc28ec74
Pulse Link: https://otx.alienvault.com/pulse/6722a8e21adc9ea3cc28ec74
Pulse Author: AlienVault
Created: 2024-10-30 21:45:05

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #Email #Europe #HTML #InfoSec #LNK #Malware #Microsoft #OTX #OpenThreatExchange #Outlook #RAT #Spam #bot #AlienVault

Cybercriminals use Webflow to Trick Users into Sharing Credentials

Pulse ID: 6721ab32674eed4002f47723
Pulse Link: https://otx.alienvault.com/pulse/6721ab32674eed4002f47723
Pulse Author: cryptocti
Created: 2024-10-30 03:42:41

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #InfoSec #OTX #OpenThreatExchange #bot #cryptocti

Hackers Maliciously Use Weaponized RDP Files to Attack Servers

Pulse ID: 6721aba4fc7d01c4594b4ac1
Pulse Link: https://otx.alienvault.com/pulse/6721aba4fc7d01c4594b4ac1
Pulse Author: cryptocti
Created: 2024-10-30 03:44:36

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #InfoSec #OTX #OpenThreatExchange #RDP #bot #cryptocti

Cyber-espionage Campaign Hits Sensitive Industries

Pulse ID: 6721a6caaca1d85e120bbfee
Pulse Link: https://otx.alienvault.com/pulse/6721a6caaca1d85e120bbfee
Pulse Author: cryptocti
Created: 2024-10-30 03:23:54

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #Espionage #InfoSec #OTX #OpenThreatExchange #bot #cyberespionage #cryptocti

Malicious CAPTCHA delivers Lumma and Amadey Trojans

An adware campaign targets online users by presenting them with fake CAPTCHA or update prompts, tricking them into running malicious PowerShell commands that deploy credential-stealing malware like Lumma and Amadey. The attackers leverage ad networks to redirect victims to compromised sites hosting these social engineering lures. Once executed, Lumma abuses legitimate BitLocker functionality to harvest cryptocurrency wallets, passwords, and browser data, while Amadey gathers credentials and can deploy Remcos remote access trojan.

Pulse ID: 6720f045401542b5aa46c588
Pulse Link: https://otx.alienvault.com/pulse/6720f045401542b5aa46c588
Pulse Author: AlienVault
Created: 2024-10-29 14:25:09

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Amadey #Browser #CAPTCHA #CyberSecurity #InfoSec #Malware #OTX #OpenThreatExchange #Password #Passwords #PowerShell #Remcos #RemoteAccessTrojan #SocialEngineering #Trojan #Word #bot #cryptocurrency #AlienVault

Chinese Hackers Toolkit Uncovered And Activity History Uncovered

A Chinese hacking group called 'You Dun' was discovered through an exposed open directory, revealing their comprehensive attack infrastructure. The group utilized sophisticated reconnaissance tools and exploited Zhiyuan OA software via SQL injection attacks, targeting South Korean pharmaceutical organizations. They employed advanced privilege escalation tools and operated a C2 infrastructure using Cobalt Strike and Viper framework. The hackers also created a custom ransomware variant based on LockBit 3.0. Their activities extended across multiple Asian countries, focusing on government, education, health, and logistics sectors. The group used proxy servers to conceal their location and employed various hacking tools, including WebLogicScan, Vulmap, Xray, and dirsearch.

Pulse ID: 671fb2564a37133fb0a88d97
Pulse Link: https://otx.alienvault.com/pulse/671fb2564a37133fb0a88d97
Pulse Author: AlienVault
Created: 2024-10-28 15:48:38

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Asia #Chinese #CobaltStrike #CyberSecurity #Education #Government #ICS #InfoSec #Korea #LockBit #Mac #OTX #OpenThreatExchange #Proxy #RAT #RansomWare #SQL #SouthKorea #bot #AlienVault

Evasive Panda scouting cloud services

CloudScout is a post-compromise toolset used by Evasive Panda to target a Taiwanese government entity and religious organization between 2022 and 2023. The toolset can retrieve data from various cloud services using stolen web session cookies. It works with MgBot, Evasive Panda's malware framework, through a plugin. Three CloudScout modules were analyzed, targeting Google Drive, Gmail, and Outlook. The modules are deployed by MgBot plugins and use stolen cookies to access and exfiltrate cloud data. CloudScout's design includes a common architecture across modules and a core CommonUtilities package. The toolset demonstrates Evasive Panda's technical capabilities and focus on cloud-stored data in espionage operations.

Pulse ID: 671ff0a9fda0949b680636f8
Pulse Link: https://otx.alienvault.com/pulse/671ff0a9fda0949b680636f8
Pulse Author: AlienVault
Created: 2024-10-28 20:14:33

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Cloud #Cookies #CyberSecurity #Espionage #EvasivePanda #Google #Government #InfoSec #Malware #MgBot #OTX #OpenThreatExchange #Outlook #RAT #bot #AlienVault

Inside the Open Directory of the “You Dun” Threat Group

An open directory exposed a Chinese-speaking threat actor's toolkit and operational history. The actor conducted extensive scanning and exploitation targeting organizations in South Korea, China, Thailand, Taiwan, and Iran using tools like WebLogicScan, Vulmap, and Xray. The Viper C2 framework and a Cobalt Strike kit with TaoWu and Ladon extensions were found. The actor also utilized the leaked LockBit 3 builder to create a custom ransomware payload with a ransom note referencing a Telegram group. The group claims to offer 'penetration testing' services but engages in illicit activities including data sales, DDoS attacks, and ransomware operations.

Pulse ID: 671f88cacb0b22d6e4c180f7
Pulse Link: https://otx.alienvault.com/pulse/671f88cacb0b22d6e4c180f7
Pulse Author: AlienVault
Created: 2024-10-28 12:51:22

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#China #Chinese #CobaltStrike #CyberSecurity #DDoS #DoS #ICS #InfoSec #Iran #Korea #LockBit #OTX #OpenThreatExchange #RAT #RansomWare #SouthKorea #Telegram #Thailand #bot #AlienVault

Fog Ransomware Targets SonicWall VPNs

Pulse ID: 671f8beda68d3c82e0288722
Pulse Link: https://otx.alienvault.com/pulse/671f8beda68d3c82e0288722
Pulse Author: cryptocti
Created: 2024-10-28 13:04:45

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #InfoSec #OTX #OpenThreatExchange #RansomWare #VPN #bot #cryptocti

An Insight on YOU DUN’s Open Directory

Pulse ID: 671f8c9729f9dde53ca58451
Pulse Link: https://otx.alienvault.com/pulse/671f8c9729f9dde53ca58451
Pulse Author: cryptocti
Created: 2024-10-28 13:07:34

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #InfoSec #OTX #OpenThreatExchange #bot #cryptocti

Black Basta Elevates Their Techniques

Pulse ID: 671f8d2fed3e80bc6cbba9e2
Pulse Link: https://otx.alienvault.com/pulse/671f8d2fed3e80bc6cbba9e2
Pulse Author: cryptocti
Created: 2024-10-28 13:10:07

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #InfoSec #OTX #OpenThreatExchange #bot #cryptocti

HeptaX Campaign Steals and Manipulates Sensitive Data

Researchers have identified the most common indicators of cyber-attack, and their findings will be published in the New Year's Honours.. and they have been published online for the first time since 2012.

Pulse ID: 671f8d9a1a6595d158a251db
Pulse Link: https://otx.alienvault.com/pulse/671f8d9a1a6595d158a251db
Pulse Author: cryptocti
Created: 2024-10-28 13:11:54

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #InfoSec #OTX #OpenThreatExchange #bot #cryptocti

The Good, the Bad and the Ugly in Cybersecurity - Week 43

CISA proposes new security measures to protect sensitive data from adversary nations, following President Biden's Executive Order. A free file recovery tool for early Mallox ransomware victims is released. A novel macOS ransomware, macOS.NotLockBit, is discovered abusing AWS S3 for data exfiltration. A critical Fortinet zero-day vulnerability (CVE-2024-47575) has been exploited in-the-wild since June, potentially affecting over 50 servers. Fortinet has released a patch and provided mitigation strategies for affected customers.

Pulse ID: 671c046cff58f8a468fe3e47
Pulse Link: https://otx.alienvault.com/pulse/671c046cff58f8a468fe3e47
Pulse Author: AlienVault
Created: 2024-10-25 20:49:48

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#AWS #CISA #CyberSecurity #InfoSec #LockBit #Mac #MacOS #Mallox #OTX #OpenThreatExchange #RAT #RansomWare #Vulnerability #ZeroDay #bot #AlienVault

Uncovering the Lounge Pass Scam Campaign: Targeted Android SMS Stealer Preying on Air Travellers

A sophisticated scam targeting air travelers in Indian airports has been uncovered, involving a malicious Android app called 'Lounge Pass'. The app, distributed through fake domains, intercepts and forwards SMS messages from victims' devices to cybercriminals, resulting in significant financial losses. Between July and August 2024, over 450 travelers unknowingly installed the fraudulent app, leading to a theft of more than INR 9 lakhs (approx. $11,000). The scammers exploited an exposed Firebase endpoint to store stolen SMS messages. Multiple related domains were identified spreading similar APKs. Key recommendations include downloading apps only from official stores, avoiding random QR code scanning, and never granting SMS access to travel or lounge apps.

Pulse ID: 671c046cc350e8cc812eecdf
Pulse Link: https://otx.alienvault.com/pulse/671c046cc350e8cc812eecdf
Pulse Author: AlienVault
Created: 2024-10-25 20:49:48

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#APK #Android #CyberSecurity #Endpoint #India #InfoSec #OTX #OpenThreatExchange #RCE #SMS #bot #AlienVault

Remote Access Trojans Deployed using Gophish Framework

Pulse ID: 671f03d9d80432f5e5e33667
Pulse Link: https://otx.alienvault.com/pulse/671f03d9d80432f5e5e33667
Pulse Author: cryptocti
Created: 2024-10-28 03:24:09

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #InfoSec #OTX #OpenThreatExchange #RemoteAccessTrojan #Trojan #bot #cryptocti