Malware

Discovered by malware researcher Dominik Reichel, Sleepwalker impersonates Microsoft's dpapi.dll and loads via side-loading into ESET Management Agent.

The attack uses iframes embedded in Google Sites to deliver malicious content from a trusted domain.

The latest Agent Tesla campaign utilizes a JScript dropper that incorporates Unicode emoji characters to disrupt signature-based detection and obscure the malicious code.

Discovered by Zimperium's zLabs team, ToxicPanda 2.0 leverages the Android Accessibility Service to enable wireless debugging, effectively gaining shell access and bypassing standard runtime consent prompts.

The signed packages were authentic – but that’s precisely the problem: the provenance lied.

The campaign, observed in late July 2026, begins with compromised WordPress websites injected with obfuscated ErrTraffic JavaScript.

The latest campaign, observed in May 2026, utilizes DLL sideloading to execute the banking trojan.