Malware

Intrusions involved the use of the domain, crowdstrike-office365[.]com, to lure users into downloading a recovery tool purportedly addressing update-related boot loop issues but delivers a malware loader.

Threat actors set up fake accounts that look legitimate on the GitHub platform.

Stargazer Goblin used such GitHub Ghost accounts to establish the legitimacy of hundreds of repositories touted to be for social media, gaming, and cryptocurrency, according to a Check Point Research report.

Intrusions conducted by PatchWork commenced with the distribution of a malicious LNK file enabling the download of a fraudulent PDF to conceal compromise with Brute Ratel C4 and PGoShell malware.

Attackers leveraged phishing emails with a malicious Word attachment having the same text as Microsoft's support bulletin regarding its Recovery Tool for outage-hit devices that contains macros, which when enabled facilitates the download of a DLL file.

Further examination of a breached checkout page revealed the inclusion of a suspicious script with base64 variables and hex strings that exfiltrate credit card information, as well as names and addresses via the querySelectorAll function.

Chinese state-sponsored hacking group Daggerfly, also known as Evasive Panda and Bronze Highland, has leveraged an updated version of the MACMA macOS malware, as well as the new Nightdoor backdoor, also known as Suzafk and NetMM, in attacks against Taiwanese organizations and a China-based U.S. non-governmental organization.