Malware

Threat actors leveraged search results for the query 'Are Bengal Cats legal in Australia?' which when clicked enabled the download of a malicious ZIP archive installing the GootKit information-stealing payload and remote access trojan, according to a Sophos report.

Numerous systems have been initially targeted with the RustyStealer credential-harvesting tool to facilitate high-privilege account compromise and lateral movement prior to the execution of SystemBC malware-related scripts and exfiltration of data over two days, an analysis from Kaspersky researchers showed.

Research underscores that many systems remain unpatched and are vulnerable to bugs that were patched several years ago.

Socket researchers say malicious package "Fabrice" has been live on PyPI since 2021.

Such malware compromise, which was only identified in late September, has impacted login information, names, phone numbers, emails, shipping and billing addresses, and payment card details with CVV codes and expiration dates belonging to individuals who had visited the SelectBlinds website's check-out page.

Attacks involving Winos4.0 commence with the retrieval of a bogus BMP file and the eventual extraction of the "you.dll" file, which downloads additional files to facilitate the installation of API-loading shellcode and the launching of a DLL file that facilitates crash restarts, clipboard content recording, system information gathering, and crypto wallet extension and antivirus app monitoring.

Threat actors using an account from a previously targeted organization dubbed "Org A" impersonated IT staff to target employees of a U.S. critical infrastructure entity dubbed "Org C" with Teams messages seeking remote system access permissions via Quick Assist, an analysis from Hunters revealed.