Malware

Such exploitation was evident in a January attack by Kimsuky against a South Korean construction trade entity's website that lured employees into installing trojanized security software with a valid digital certificate.

Hunters International has leveraged a typosquatted site for the widely used Angry IP Scanner to lure IT workers into downloading an installer.

Zero-day detection hits for SnakeKeylogger reached hundreds, with the trojan attempting communications with numerous outside servers, according to an alert from Fortinet's FortiGuard Labs.

Deployed in an attack against a South American government's foreign ministry, the latest iteration of BITSLOTH has been integrated with 35 handler functions, as well as other enumeration, command-line execution, and discovery capabilities.

Attackers have been deploying BlankBot in the guise of utility apps, which when installed seek accessibility permissions for proper execution before performing an update that enables the acquisition of permissions for total device takeovers.

After conducting a DNS poisoning attack against the ISP, StormBamboo leveraged vulnerable HTTP software update mechanisms without digital signature validation to facilitate the installation of MACMA and MgBot malware to Windows and macOS systems.

Threat actors who created StackExchange accounts commented on popular threads with high-quality answers that included links to the packages, including 'spl-types,' 'sol-structs,' 'sol-instruct,' 'raydium,' and 'raydium-sdk,' which facilitated the download of scripts enabling browser, messaging app, and cryptocurrency wallet data exfiltration.