Malware

Amateur threat actors have been targeted by the attacker using the "@shinyenigma" and "milleniumrat" aliases with the altered XWorm RAT builder, which not only exfiltrates data via Telegram bot tokens and API calls but also enables registry modification and virtualization checks, according to an analysis from CloudSEK.

Nearly 1,000 imitation pages were discovered, targeting users looking for other software.

Such BC backdoor, which runs as an autonomous program, features not only old QBot samples but also IcedID's KeyHole BC and DarkVNC and was discovered within the ZLoader-distributing infrastructure, a report from Walmart's Cyber Intelligence team showed.

Installation of the malware in targeted routers facilitates the deployment of a cd00r variant scanning for five network signals, which when received triggers reverse shell creation on the local file system, enabling device takeover, data exfiltration, and additional malware compromise, according to an investigation by Black Lotus Labs researchers.

The “uncensored” GenAI tool was advertised on cybercrime forums with a focus on BEC scams.

Attackers who made fraudulent but verified Ross Ulbricht accounts on X, formerly Twitter, sought to lure users into joining Telegram channels purporting to be Ulbricht portals, which provided a walk through on the bogus Safeguard identity verification process leading to a Telegram mini app with a hoax verification dialog.

Execution of a trojanized installer triggers deployment of a loader with another DLL eventually resulting in the running of SlowStepper, which supports commands enabling extensive system info theft, file deletion, Python module execution, and self-deletion, an analysis from ESET revealed.