Tag: cybercriminals

Rhadamanthys infostealer disrupted as cybercriminals lose server access
News

Rhadamanthys infostealer disrupted as cybercriminals lose server access

The operation of the Rhadamanthys infostealer has been interrupted, and many “customers” using the malware-as-a-service are reporting that they can no longer access their servers. Rhadamanthys is a type of infostealer malware that pilfers credentials and authentication cookies from browsers, email clients, and various other applications. It is widely disseminated via campaigns disguised as software cracks, YouTube videos, or harmful search ads. The malware is provided on a subscription basis, with cybercriminals paying the developer monthly for access to the malware, assistance, and a web panel for collecting stolen data. Cybersecurity researchers g0njxa and Gi7w0rm, who monitor malware operations such as Rhadamanthys, report that cybercriminals involved in the operation assert t...
Cybercriminals Target AI Users with Malware-Loaded Installers Posing as Popular Tools
News

Cybercriminals Target AI Users with Malware-Loaded Installers Posing as Popular Tools

The CyberLock and Lucky_Gh0$t ransomware families, as well as a new malware called Numero, are being spread by using fake installers for well-known artificial intelligence (AI) products like OpenAI ChatGPT and InVideo AI as baits. In a report released today, Cisco Talos researcher Chetan Raghuprasad stated that the CyberLock ransomware, which was created with PowerShell, is mostly concerned with encrypting particular files on the victim's computer. With only little changes to the ransomware binary, the Lucky_Gh0$t ransomware is another variation of the Yashma ransomware, the sixth version of the Chaos ransomware series. Conversely, Numero is a malicious software that affects users by altering the Windows operating system's graphical user interface (GUI) components, making the comput...
Cybercriminals Clone Antivirus Site to Spread Venom RAT and Steal Crypto Wallets
News

Cybercriminals Clone Antivirus Site to Spread Venom RAT and Steal Crypto Wallets

Researchers studying cybersecurity have revealed a new harmful operation that tricked users into installing the Venom RAT remote access trojan by using a phony website that promoted Bitdefender antivirus software. The DomainTools Intelligence (DTI) team said in a new study released with The Hacker News that the effort shows a clear goal to target individuals for financial benefit by compromising their credentials, crypto wallets, and maybe selling access to their systems. The aforementioned website, "bitdefender-download[.]com," encourages users to download an antivirus program for Windows. A file download from a Bitbucket repository that reroutes to an Amazon S3 bucket is started when the conspicuous "Download for Windows" button is clicked. The account on Bitbucket has been deacti...
Darcula Adds GenAI to Phishing Toolkit, Lowering the Barrier for Cybercriminals
News

Darcula Adds GenAI to Phishing Toolkit, Lowering the Barrier for Cybercriminals

New improvements to their cybercrime suite featuring generative artificial intelligence (GenAI) capabilities have been released by the threat actors behind the Darcula phishing-as-a-service (PhaaS) platform. In a recent article published with The Hacker News, Netcraft stated that this change lowers the technical barrier for constructing phishing pages, allowing less tech-savvy crooks to run tailored frauds in minutes. By making it easier to create customized phishing sites with multi-language support and form generation without the need for programming expertise, the new AI-assisted capabilities increase Darcula's danger potential. In March 2024, the cybersecurity firm initially described Darcula as a toolkit that used RCS and Apple iMessage to deliver smishing messages to users,...
Cybercriminals Exploit CSS to Evade Spam Filters and Track Email Users’ Actions
News

Cybercriminals Exploit CSS to Evade Spam Filters and Track Email Users’ Actions

Cascading Style Sheets (CSS), which are used to format and style web page layouts, are being utilized by malicious actors to get around spam filters and monitor user behavior. According to recent research from Cisco Talos, a victim's security and privacy may be jeopardized by such malevolent actions. Even if certain elements linked to dynamic content (like JavaScript) are limited in email clients compared to web browsers, Talos researcher Omid Mirzaei stated in a paper released last week that the tools accessible in CSS allow attackers and spammers to follow users' actions and preferences. The information expands on the cybersecurity firm's earlier findings of an increase in email threats using hidden text salting in the second part of the year read more about Cybercriminals Expl...
Cybercriminals Use Eclipse Jarsigner to Deploy XLoader Malware via ZIP Archives
News

Cybercriminals Use Eclipse Jarsigner to Deploy XLoader Malware via ZIP Archives

The DLL side-loading approach has been used by a malware campaign that uses a legal program connected to the Eclipse Foundation to distribute the XLoader malware. According to the AhnLab Security Intelligence Center (ASEC), the legitimate application utilized in the assault, jarsigner, is a file generated after the installation of the Eclipse Foundation's IDE package. It is a JAR (Java Archive) file signing utility. According to the South Korean cybersecurity company, the malware is sent as a compressed ZIP file that contains both the genuine executable and the DLLs that must be sideloaded in order for the malware to run read more about Cybercriminals Use Eclipse Jarsigner to Deploy XLoader Malware via ZIP Archives. Get up to date on the latest cybersecurity news and enhance your...
Cybercriminals Exploit Onerror Event in Image Tags to Deploy Payment Skimmers
News

Cybercriminals Exploit Onerror Event in Image Tags to Deploy Payment Skimmers

Researchers studying cybersecurity have discovered a credit card theft malware operation that targets Magento-powered e-commerce sites. To avoid detection, the harmful content is disguised as HTML code picture elements. The spyware known as MageCart has the ability to steal private payment details from online retailers. Numerous methods, both client-side and server-side, are known to be used in the assaults to compromise websites and install credit card skimmers in order to enable theft. Usually, this type of malware is only activated or loaded when users go to the checkout pages to enter their credit card information. It does this by either displaying a phony form or by instantly recording the data that the victims enter read more about Cybercriminals Exploit Onerror Event in Image...
Cybercriminals Use Go Resty and Node Fetch in 13 Million Password Spraying Attempts
News

Cybercriminals Use Go Resty and Node Fetch in 13 Million Password Spraying Attempts

The use of authentic HTTP client tools by cybercriminals to enable account takeover (ATO) assaults on Microsoft 365 systems is growing. In order to carry out ATO attacks, enterprise security firm Proofpoint reported seeing campaigns that used the HTTP clients Axios and Node Fetch to send HTTP requests and retrieve HTTP replies from web servers. According to security researcher Anna Akselevich, these tools, which were initially taken from open repositories like GitHub, are being utilized more and more in brute force and adversary-in-the-middle (AitM) assaults, which have resulted in a number of account takeover (ATO) events read more about Cybercriminals Use Go Resty and Node Fetch in 13 Million Password Spraying Attempts Get up to date on the latest cybersecurity news and enhance...
Cybercriminals Target Ethereum Developers with Fake Hardhat npm Packages
News

Cybercriminals Target Ethereum Developers with Fake Hardhat npm Packages

A number of malicious packages on the npm registry have been discovered by cybersecurity experts to mimic the Hardhat tool from the Nomic Foundation, which is used to steal confidential information from developer workstations. According to an analysis by the Socket research team, attackers have gained access to these platforms by using malicious npm packages and taking advantage of people's faith in open source plugins. They have succeeded in stealing important information like private keys, mnemonics, and configuration parameters. With multiple components for authoring, compiling, debugging, and deploying smart contracts and decentralized apps (dApps), Hardhat is an Ethereum software development environment read more about Cybercriminals Target Ethereum Developers with Fake Hardhat...
Cybercriminals Exploit Popular Game Engine Godot to Distribute Cross-Platform Malware
News

Cybercriminals Exploit Popular Game Engine Godot to Distribute Cross-Platform Malware

Since at least June 2024, a new GodLoader malware campaign has infected over 17,000 PCs by abusing the well-known open-source game engine Godot Engine. According to a new investigation released Wednesday by Check Point, cybercriminals have been using Godot Engine to run specially written GDScript code that launches dangerous instructions and spreads malware. Nearly all antivirus engines in VirusTotal do not identify the approach. Even as defenders continue to put up new barriers, it is not surprising that threat actors are always searching for new tools and methods that will enable them to distribute malware while evading detection by security controls read more about Cybercriminals Exploit Popular Game Engine Godot to Distribute Cross-Platform Malware. Get up to date on the late...