Malware

The new security tool is integrated into the company's Edge browser and uses machine learning and computer vision to identify fraudulent full-screen pop-ups that trick users into installing malware or purchasing unnecessary software.

According to a report by Cisco Talos, the attackers use phishing emails disguised as financial transactions or order confirmations, often impersonating banks and logistics companies.

Intrusions by Gama Copy also closely resembled those of the advanced persistent threat operation Core Werewolf with both groups' utilization of 7-ZIP self-extracting archive files for UltraVNC execution, port 443 for server connections, and the EnableDelayedExpansion command, an analysis from the Knownsec 404 Advanced Threat Intelligence team revealed.

Oil and gas, electricity, and legal services organizations in the U.S. and Europe have been targeted with spam emails containing links that download MintsLoader either through a JavaScript file or Windows Run prompt as part of a campaign underway since earlier this month, a report from eSentire showed.

Amateur threat actors have been targeted by the attacker using the "@shinyenigma" and "milleniumrat" aliases with the altered XWorm RAT builder, which not only exfiltrates data via Telegram bot tokens and API calls but also enables registry modification and virtualization checks, according to an analysis from CloudSEK.

Nearly 1,000 imitation pages were discovered, targeting users looking for other software.

Such BC backdoor, which runs as an autonomous program, features not only old QBot samples but also IcedID's KeyHole BC and DarkVNC and was discovered within the ZLoader-distributing infrastructure, a report from Walmart's Cyber Intelligence team showed.