Malware

TA584's current attack chain begins with emails sent from compromised accounts via SendGrid and Amazon SES.

The Lat61 Threat Intelligence Team at Point Wild discovered that this software can be installed silently and maintain a persistent presence within a hidden folder.

The U.S. Justice Department has disclosed charges against 31 more individuals in connection with a large ATM jackpotting conspiracy that used Ploutus malware to steal cash from machines across the country, according to The Record, a news site by cybersecurity firm Recorded Future.

GBHackers News reports that malware masquerading as the GitHub Desktop installer has been deployed by abusing a GitHub fork architecture vulnerability.

North Korean hacking collective Lazarus Group has used illicit VS Code automation task configurations to launch font-spoofing JavaScript payloads and eventually deploy the InvisibleFerret backdoor as part of the new Fake Font operation, which is yet another variant of the Contagious Interview attack campaign, Cybernews reports.

Vulnerability lets threat actors drop malware into the Windows Startup folder.

PeckBirdy leverages JScript and living-off-the-land binaries (LOLBins) to execute across various environments.