Malware

GBHackers News reports that malware masquerading as the GitHub Desktop installer has been deployed by abusing a GitHub fork architecture vulnerability.

North Korean hacking collective Lazarus Group has used illicit VS Code automation task configurations to launch font-spoofing JavaScript payloads and eventually deploy the InvisibleFerret backdoor as part of the new Fake Font operation, which is yet another variant of the Contagious Interview attack campaign, Cybernews reports.

Vulnerability lets threat actors drop malware into the Windows Startup folder.

PeckBirdy leverages JScript and living-off-the-land binaries (LOLBins) to execute across various environments.

Indian government entities have been targeted in two sophisticated cyberattack campaigns, codenamed Gopher Strike and Sheet Attack, by a threat actor operating from Pakistan.

The updated CoolClient malware, deployed via legitimate software from Sangfor, refines existing features like system profiling, keylogging, and tunneling.

Malware spread through eScan antivirus supply chain compromise Infosecurity Magazine reports that MicroWorld Technologies' update infrastructure has been compromised to deliver malicious updates for its eScan antivirus software that spread multi-stage malware as part of a global supply chain compromise.