Malware

AI-powered code has been leveraged by a Vietnamese threat actor to deliver PureRAT malware and other illicit payloads as part of a fake job phishing campaign initially discovered by Trend Micro in December, reports GBHackers News.

The malicious code was concealed within a Basque language dictionary file, disguised as a compressed archive.

TA584's current attack chain begins with emails sent from compromised accounts via SendGrid and Amazon SES.

The Lat61 Threat Intelligence Team at Point Wild discovered that this software can be installed silently and maintain a persistent presence within a hidden folder.

The U.S. Justice Department has disclosed charges against 31 more individuals in connection with a large ATM jackpotting conspiracy that used Ploutus malware to steal cash from machines across the country, according to The Record, a news site by cybersecurity firm Recorded Future.

GBHackers News reports that malware masquerading as the GitHub Desktop installer has been deployed by abusing a GitHub fork architecture vulnerability.

North Korean hacking collective Lazarus Group has used illicit VS Code automation task configurations to launch font-spoofing JavaScript payloads and eventually deploy the InvisibleFerret backdoor as part of the new Fake Font operation, which is yet another variant of the Contagious Interview attack campaign, Cybernews reports.