Malware

Kaspersky reported that the campaign utilized phishing emails styled as official notices regarding tax audits, prompting users to download an archive containing a "list of tax violations."

The FEMITBOT platform facilitates various scams, including fake cryptocurrency, financial services, AI tools, and streaming sites.

The attackers gained initial access by abusing the scriptText endpoint of the Jenkins server, achieving remote code execution (RCE) through a Groovy script.

The campaign, attributed to the GitHub account "BufferZoneCorp," involved malicious Ruby gems and Go modules disguised as legitimate libraries.

More sophisticated EtherRAT malware variant delivered via trojanized installer Threat actors have leveraged a malicious copy of the popular Windows TFTP server and admin tool, Tftpd64, to compromise IT administrators and network professionals with an updated iteration of the EtherRAT malware as part of a new hybrid attack campaign that combines system compromise with cryptocurrency theft, according to Cyber Security News.

Infosecurity Magazine reports that Windows systems are being stealthily targeted for protracted surveillance and credential exfiltration with the new Python-based Deep#Door backdoor framework.

Cybersecurity researcher Jeremiah Fowler discovered the data, which included intimate chat logs from apps like WhatsApp, Facebook, TikTok, and Instagram.

High-level fintech and cryptocurrency individuals, including executives and developers, have had their macOS environments targeted by the North Korean hacking collective Lazarus Group with the new Mach-O Man malware kit in a new ClickFix campaign, reports GBHackers News.