Hackers Use Fake GlobalProtect VPN Software in New WikiLoader Malware Attack
A new malware operation is using search engine optimization (SEO) to spread a variant of the WikiLoader (also known as WailingCrab) loader by impersonating Palo Alto Networks' GlobalProtect VPN software.
Unit 42 researchers Mark Lim and Tom Marsden noted that the malvertising behavior that was seen in June 2024 differs from previously noted strategies in which the virus has been spread using conventional phishing emails.
WikiLoader, which Proofpoint first discovered in August 2023, has been linked to TA544, a threat actor. Danabot and Ursnif are installed via email campaigns using the malware.
Later in April, a trojanized Notepad++ plugin was used as the attack vector, according to information released by the South Korean cybersecurity firm AhnLab read more about Hackers Use Fake...