TA505 Threat Group Distributes Previously Undocumented tRat Remote Access Trojan
Researchers observed the TA505 threat group spreading a previously undocumented remote access Trojan (RAT) called tRaT.
Threat Actors Exploit Equation Editor to Distribute Hawkeye Keylogger
A recent Hawkeye keylogger campaign leveraged an old Microsoft Office Equation Editor vulnerability to steal user credentials, passwords and clipboard content.
Ransomware-as-a-Service Program Offers Affiliates Up to 75 Percent of Revenue to Spread Infection
A ransomware-as-a-service program called FilesLocker offers affiliates commissions of up to 75 percent on all revenue stolen from victims.
NARWHAL SPIDER Uses Steganography to Deliver URLZone Malware in Cutwail Spam Campaign
A new Cutwail spam campaign is leveraging steganography — hiding data within images — to compromise devices and download URLZone.
Threat Actors Combine Windows Utilities in Malware Campaign Targeting Users in Brazil
Researchers observed threat actors impersonating the Brazilian postal service in a malware campaign that combines legitimate Windows files such as WMI and CertUtil to steal banking data.
Lock and sLoad: PowerShell Malware Downloader Geofences Attacks for Maximum Impact
A PowerShell malware downloader known as sLoad uses geofencing, customized emails and device reconnaissance to identify high-value Trojan targets.
30,000 Android Users Infected With Banking Malware From 29 Bogus Apps
Nearly 30,000 Android users accidentally downloaded banking malware after filling out phishing forms that were personalized based on the apps they use.
Cybercriminals Distribute TimpDoor Malware to Turn Android Devices Into Network Proxies
The TimpDoor malware family enables cybercriminals to turn infected Android devices into network proxies without users' knowledge.
How SEO Poisoning Campaigns Are Mounting a Comeback
SEO poisoning is on the rise again. How do threat actors use search engine results to drive victims to malicious sites, and what can users do to protect themselves?
Chalubo Bot Family Launches Distributed Denial-of-Service Attacks Against Linux Systems
Researchers discovered a family of bots dubbed Chalubo launching distributed denial-of-service (DDoS) attacks to brute-force Linux-based systems running internet-facing SSH servers.