Malware

Aside from being composed of half a dozen sub-teams distributing the StealC and AMOS stealers masquerading as WeChat, Zoom, Selenium Finance, and other platforms, Crazy Evil also sought to provide crypter services for various malware, a report from Recorded Future's Insikt Group revealed.

Attackers who targeted Casio UK's website between Jan. 14 and 24 deployed a two-stage skimmer that consisted of an unobfuscated loader purporting to be a third-party script that triggers the second-stage skimmer that not only encrypted and exfiltrated contact information, credit card details, and billing addresses but also concealed malicious activity through XOR-based string masking and custom encoding.

A new Mirai-based botnet is causing internet backbone provider Akamai to sound the alarm

Advanced Pakistani cybercrime network HeartSender, also known as Saim Raza, had its operations disrupted by the U.S. Department of Justice and Dutch National Police following the sequestration of its domains and servers as part of "Operation Heart Blocker," reports CyberScoop.

The “Time Bandit” vulnerability could be used to make ChatGPT provide malware creation instructions.

Based on reporting from SecurityScorecard's STRIKE team, the North Korean state-backed threat actor employs a React and Node.js-based system in each C2 server to enable centralized management of stolen data, observation of compromised hosts, and payload distribution.

The new security tool is integrated into the company's Edge browser and uses machine learning and computer vision to identify fraudulent full-screen pop-ups that trick users into installing malware or purchasing unnecessary software.

According to a report by Cisco Talos, the attackers use phishing emails disguised as financial transactions or order confirmations, often impersonating banks and logistics companies.