APT28 conducts long-term espionage on Ukrainian forces using custom malware

GlobalDefenseBot 10 March

4 minutes

APT28 used BEARDSHELL and COVENANT malware to spy on Ukrainian military personnel, enabling long-term surveillance since April 2024. The Russia-linked group APT28 (aka UAC-0001, aka Fancy Bear, Pawn Storm, Sofacy Group, Sednit, BlueDelta, and STRONTIUM) has used BEARDSHELL and COVENANT malware to conduct long-term surveillance of Ukrainian military personnel. According to ESET, the campaign began in April 2024 and relies on […]

HR, recruiters targeted in year-long malware campaign

CySecBot 10 March

1 minute

An attack campaign targeting HR departments and job recruiters has been stealthily compromising systems, Aryaka researchers have discovered. By avoiding analysis environments and leveraging a specialized module designed to kill antivirus and endpoint d…

Fake LinkedIn Interview Used by Lazarus Hackers to Target AllSecure CEO

CySecBot 10 March

1 minute

Researchers at AllSecure have revealed how North Korean hackers from the Lazarus Group used a fake LinkedIn job interview and deepfake technology to target their CEO.

Fake CleanMyMac Site Uses ClickFix Trick to Install SHub Stealer on macOS

CySecBot 9 March

1 minute

Researchers warn of a fake CleanMyMac site using a ClickFix attack to install SHub Stealer on macOS and steal passwords and crypto wallets.

Iran’s MuddyWater Hackers Target US Firms with New Dindoor Backdoor

CySecBot 9 March

1 minute

Researchers say Iran’s MuddyWater hackers targeted US companies and an Israeli software firm’s department in a cyber campaign using the Dindoor malware – All this amid the ongoing conflict.

ClickFix Attack Uses Windows Terminal to Evade Detection

CySecBot 9 March

1 minute

Fake CAPTCHA pages instruct victims to paste malicious commands in the Windows Terminal instead of the Run dialog.
The post ClickFix Attack Uses Windows Terminal to Evade Detection appeared first on SecurityWeek.

Cloned AI Tool Sites Distribute Malware in ‘InstallFix’ Campaign

CySecBot 9 March

1 minute

Threat actors replace legitimate commands on the cloned installation webpages with malicious commands.
The post Cloned AI Tool Sites Distribute Malware in ‘InstallFix’ Campaign appeared first on SecurityWeek.

Cloned AI Tool Sites Distribute Malware in ‘InstallFix’ Campaign

CySecBot 9 March

1 minute

breaking news

Massive GitHub malware operation spreads BoryptGrab stealer

GlobalDefenseBot 8 March

5 minutes

Trend Micro found BoryptGrab stealer spreading through 100+ GitHub repositories, stealing browser data, crypto wallets, system information, and user files. Trend Micro uncovered a campaign distributing the BoryptGrab information stealer through more than 100 GitHub repositories. BoryptGrab is designed to collect browser and cryptocurrency wallet data, system details, and common files. Some variants also deploy […]

breaking news

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 87

GlobalDefenseBot 8 March

2 minutes

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Malware Reverse Engineering is no longer a human problem! StegaBin: 26 Malicious npm Packages Use Pastebin Steganography to Deploy Multi-Stage Credential Stealer Inside a fake Google security check that becomes a browser RAT SloppyLemming […]