Malware

Attackers who made fraudulent but verified Ross Ulbricht accounts on X, formerly Twitter, sought to lure users into joining Telegram channels purporting to be Ulbricht portals, which provided a walk through on the bogus Safeguard identity verification process leading to a Telegram mini app with a hoax verification dialog.

Execution of a trojanized installer triggers deployment of a loader with another DLL eventually resulting in the running of SlowStepper, which supports commands enabling extensive system info theft, file deletion, Python module execution, and self-deletion, an analysis from ESET revealed.

Attackers drop infostealer malware that grabs credentials, web browser data, and crypto wallets.

The meeting, which was called for by the United States and 15 other nations, sought to address the proliferation and misuse of government and mercenary spyware.

Attackers have used a malicious Google ad with Homebrew's proper "brew.sh" URL to redirect to the typosquatted "brewe[.]sh" site, which lures targets into downloading the package manager that enables infostealer malware execution, according to security researcher Ryan Chenkie.

Threat actors leveraged a phishing webpage luring targets into downloading a legitimate software-spoofing Microsoft Installer package that conceals its malicious nature by launching the app while executing a malicious DLL to deploy the multi-stage PNGPlug loader, a report from Intezer showed.

Threat actor solana-web-stable-huks' "solana-transaction-toolkit" and "solana-stable-web-huks" packages not only compromised Solana private keys through Nodemailer but also enabled the automated transfer of 98% of the targeted cryptocurrency wallets' assets to an attacker-controlled Solana address, according to a Socket analysis.

Installation of Tanzeem or Tanzeem Update triggers a bogus chat page containing a "Start Chat" button, which when clicked would lure targets into permitting accessibility permissions as the app seeks permissions enabling contact, call log, location, account information, and external storage file exfiltration activities, according to an analysis from Cyfirma.