Malware

Malware

Attacker Hijacks 333 Tor Exit Relays to Intercept SSH Logins and Attempt to Read Plaintext Email

Attacker hijacked 333 Tor exit relays to redirect SSH logins to 12 servers and block encrypted email ports to attempt plaintext collection.

Oct 22, 202618:24 3 min readRead →

Malware

Operation Serengeti III Disrupts 10,909 Malicious Networks Across 21 Countries

Operation Serengeti III disrupted 10,909 networks across 21 countries, with 1,462 arrests and over $105M recovered, INTERPOL reports.

Oct 22, 202615:39 2 min readRead →

Malware

Chrome Adds ClickFix Command Warnings for Enhanced Protection Users

Google says Chrome will scan copied commands for Enhanced Protection users to warn on ClickFix; Apple says Safari blocks identity tracking.

Oct 21, 202615:07 3 min readRead →

Malware

AOMEI Backupper Update Channel Hijacked in Months-Long Malware Delivery Campaign

Reported tampering of AOMEI update servers redirected Backupper users to malware via pop-ups, with possible credential exposure.

Oct 20, 202616:14 4 min readRead →

Malware

ROMULUS Turns ClickFix Lures Into a Delivery Pipeline for Legion Loader

Forescout Vedere Labs describes ROMULUS, a delivery platform using ClickFix lures and PowerShell to install Legion Loader for further payloads.

Oct 20, 202608:38 3 min readRead →

Malware

GhostAction Adds Developer Phishing and Persistent Stealer After GitHub Workflow Block

GhostAction expanded its GitHub campaign with phishing for OAuth tokens and a VS Code-triggered stealer, per OpenSourceMalware findings.

Oct 19, 202614:52 4 min readRead →

Malware

CikaBika Bot Pairs Discord Control With an Unconfirmed Edge Sideloading Route

Rust-based CikaBika Bot uses Discord for control while attempting Edge DLL sideloading, which researchers did not confirm as successful.

Oct 18, 202613:07 3 min readRead →

Malware

Attackers Used Brief AOMEI Backupper Update Windows to Deploy Backdoors

Attackers briefly altered AOMEI Backupper updates to deploy CROSSROAD and SHINYROAD backdoors via unsigned files, researchers report.

Oct 16, 202619:35 5 min readRead →

Malware

Typosquatted AUR Packages Ran Remote Malware Installers With Root Privileges

Malicious AUR packages impersonating yay and paru paired legitimate code with install scripts that fetched remote code as root before removal.

Oct 15, 202618:47 2 min readRead →