Malware

Carbonato exploits Docker hosts with unauthenticated API access on port 2375.

The botnet, sold by WraithTools, includes capabilities for credential theft, SOCKS5 proxying, and an AI module for malware persistence, Qrator Research Labs reports.

The TASK#STOMP campaign begins with an encoded Visual Basic Script (VBScript) executed by wscript.exe, with the initial access vector likely being phishing or social engineering.

Exvicy operates as a ClickFix framework, distributing malware through compromised WordPress websites, according to Sekoia's Threat Detection & Research team.

The campaign, uncovered by LastPass and Delphos Labs, impersonates LastPass and at least 39 other companies.

The malware, likely developed using a large language model, according to CrowdStrike's Counter Adversary Operations, was distributed through typosquatted and slopsquatted npm packages.

HEAVYGRAM is a versatile tool capable of remote command execution, system and network information discovery, data exfiltration, screenshot capture, and establishing persistence through Windows registry keys.