Malware

Session hijacking is an emerging entry point for ransomware actors but few orgs invalidate open sessions after a malware infection.

Intrusions with the malicious payload, which compromises cryptocurrency wallet addresses by intercepting clipboard data, peaked in late August, according to a new advisory from Binance, which noted clipper malware distribution via unofficial Android and web apps and plugins.

BleepingComputer reports that information-stealing malware attacks have been conducted by advanced persistent threat operation Void Banshee through the exploitation of the recently addressed Windows MSHTML spoofing zero-day vulnerability, tracked as CVE-2024-43461.

Numerous social engineering tactics have been leveraged by threat actors to deploy Ajina.Banker, including fake banking, government, and utility apps, as well as malicious links purporting to be for promotions or offers spread via Telegram, a report from Group-IB revealed.

Attacks involved the utilization of a fraudulent Google Chrome app, which when installed triggers a prompt for updating Google Play Services and eventually downloads TrickMo as "Google Services" before seeking the approval of accessibility permissions.

Attacks as part of the campaign, which commenced in late August, involved the Amadey malware spreading a credential-flushing AutoIT script, which would launch a URL for replacing Google account passwords in kiosk mode and establish parameters that would prevent user escape via the F11 and Escape keys, an analysis from OALABS revealed.

Attacks with the novel Veaty and Spearal malware strains have been deployed by Iranian state-backed advanced persistent threat operation OilRig, also known as APT34, against Iraqi government agencies and organizations as part of a new cyberespionage campaign.

After achieving initial server access via weak passwords, threat actors proceeded to launch a pair of scripts to retrieve the Hadooken malware, which features not only a cryptocurrency miner but also the Tsunami distributed denial-of-service botnet.