Malware

Armored Likho utilizes a modular and evolving toolkit that includes obfuscated remote access trojans (RATs), the Python-based BusySnake Stealer, and Go2Tunnel for network tunneling.

The campaign, detailed by Palo Alto Networks' Unit 42, begins with a phishing email containing a malicious PDF.

QuimaRAT features a modular architecture, allowing for dynamic expansion of capabilities through encrypted plugins delivered via its command-and-control (C2) infrastructure.

ChocoPoC operates by hiding its malicious payload within a Python package that is pulled in as a dependency by the seemingly harmless PoC code.

The attack chain begins with a single line of Python code executed via an unauthenticated Langflow API endpoint.

The "Google Notes" extension, identified by McAfee researchers, operates by requesting broad permissions, including access to all websites, browsing history, and the clipboard, which are unusual for a note-taking application.

The Ousaban campaign begins with a phishing PDF disguised as a corrupted file, prompting users to click an "Update" button.

This activity is part of a large, multi-language campaign that distributes malicious installer archives hosted on spoofed websites, according to a recent report by The Hacker News.