Malware

FlutterShell is linked to previous malvertising campaigns including TamperedChef.

The campaign begins with a phishing email containing an HTML attachment.

The WeedHack malware is distributed through malicious Minecraft-related mods, clients, and utilities promoted via YouTube and search engine poisoning.

The DriveSurge threat actor operates as an initial access broker, utilizing a pay-per-install model to facilitate subsequent attacks, according to research by SilentPush.

The malware campaign, discovered in July 2025, has affected approximately 1,980 WordPress sites.

The attack leverages a polyglot file, heavy obfuscation and fileless execution to evade detection.

First identified in February 2025, BTMOB evolved from the SpySolr malware.