Malware

Netskope Threat Labs says its finding of a new infection chain indicates a resurgence of the Bumblebee malware.

Intrusions commence with the exploitation of breached admin credentials to infiltrate the targeted WordPress site and enable automated installation of the plugins, which include LiteSpeed Cache Classic, Wordfence Security Classic, Google SEO Enhancer, Content Blocker, and Quick Cache Cleaner, among others.

Threat actors behind the latest intrusions delivered phishing emails with a malicious ZIP archive, which when executed prompts the download of a malicious NVIDIA driver update or Midjourney installer-spoofing .MSI file, according to a Netskope analysis.

Malicious emails alerting of state-sponsored intrusions have been sent to lure organizations' cybersecurity teams into downloading the fraudulent "ESET Unleashed program," which features several ESET DLLs and would enable file and data deletion upon execution.

Microsoft warns users to patch the HM Surf flaw because Defender detected it was actively exploited.

Attacks involved the display of fraudulent Google Meet popup alerts, which would download the StealC or Rhadamanthys infostealers for Windows users and the AMOS Stealer payload for macOS users, according to a Sekoia analysis.

Malicious spear-phishing messages have been leveraged by RomCom to distribute the MeltingClaw or RustyClaw downloaders for the ShadyHammock and DustyHammock backdoors, respectively, with the latter facilitating the delivery of the SingleCamper trojan.