+84949482065
Jamf Threat Labs tracked CrashStealer, macOS malware disguised as Apple’s crash reporter, stealing browser credentials, crypto wallets, and keychain data via AES-GCM encryption. Written in C++, it spreads via a…
Dutch, Belgian, and Europol authorities dismantled an investment fraud ring (since 2021) using 700 staff across 20 global call centers, making ~€100M/month from fake crypto schemes. Six arrested, including the…
On July 13, Nichirei Corp. suffered a cyberattack affecting servers with personal data. It cut systems, disrupting warehouse and frozen food shipments, and notified Japan's privacy watchdog. Operations will slowly…
The Arsink RAT Android malware campaign continues to proliferate, harvesting SMS, contacts, call logs, media, and enabling remote control of infected devices. Reference here https://zimperium.com/blog/the-rise-of-arsink-rat
Phishing campaigns abusing trusted cloud platforms are rising, exposing enterprises to credential theft, account takeover, and supply chain risks by leveraging legitimate infrastructure for malicious delivery. More information here https://hackread.com/phishing-campaigns-cloud-platforms-enterprises-risks/
The Interlock ransomware group, a dedicated non-RaaS actor, executed a multi-stage intrusion using NodeSnakeRAT/Interlock RAT implants and a zero-day process killing tool to disable EDR and exfiltrate/encrypt victim data. More…
A significant increase in NFC relay malware has been observed in Eastern Europe, with researchers identifying over 760 malicious Android apps exploiting Near-Field Communication technology to steal credit card information.…
Russia-backed COLDRIVER has launched a new cyber-espionage campaign targeting NATO entities using NOROBOT, a downloader that employs fake CAPTCHA lures to deploy backdoors like MAYBEROBOT for intelligence gathering. For more…
A new supply chain attack, GlassWorm malware, has been targeting developers on OpenVSX and Microsoft VS Code marketplaces, with over 35,800 installations. For more information, please check here https://www.koi.ai/blog/glassworm-first-self-propagating-worm-using-invisible-code-hits-openvsx-marketplace
DarkCloud Stealer is targeting financial firms via phishing emails with malicious RAR attachments, using MSBuild.exe injection and a PowerShell-downloaded JPG to decrypt an embedded .NET file and steal credentials from…
