Malware

New AnvilEcho PowerShell trojan distribution has been sought by Iranian state-backed threat operation TA453 in a spear phishing attack campaign against a major Jewish personality that commenced late last month.

Infiltration of vulnerable systems via the security issue, which was addressed by PHP maintainers in early June, was followed by the deployment of Msupedge as a pair of dynamic link libraries, an analysis from Symantec's Threat Hunter Team showed.

Threat actors were able to secure payment card details, including individuals' names, payment card numbers, CVVs, and expiration dates, between Dec. 20, 2023 and Jun. 26, 2024, after redirecting online ticket transactions from a third-party vendor, said Oregon Zoo officials in a filing with Maine regulators.

Integrated within UULoader was an archive file with two main executables that did not have their file headers, with the first being a binary enabling DLL file side-loading of the final-stage payloads.

Typosquatted domains mimicking legitimate sites have been leveraged to host the MSIX installers, which not only spoof Zoom, KeePass, Steam, and other popular software but also facilitate script execution prior to app deployment.

Intrusions with the novel Firmachagent malware and known Spectr spyware were reported by Ukraine's Computer Emergency Response Team to have been launched by pro-Russia and Luhansk People's Republic-associated threat operation Vermin as part of a new hacking campaign.

Banshee Stealer has been advertised to enable the theft of almost 100 browser extensions' data, iCloud Keychain credentials, and Notes, according to an Elastic Security Labs analysis.

Nearly 20 sub-campaigns have been part of Tusk, three of which remain active and leverage a Dropbox-hosted initial downloader to facilitate infostealer infections and personal and financial information compromise, an analysis from Kaspersky revealed.