Storm-1865 used ClickFix and Booking.com lures against hotels
Fake CAPTCHA pages pushed mshta commands that installed stealers and RATs; Booking.com says its own systems were not breached.
36
Malware
VenomRAT
- Mentions · 7d1
- Mentions · 30d1
- All mentions4
- First seenAug 17, 2026
- Last mentioned4d ago
Timeline
4 articles · newest firstPAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks
PAPERMILL phishing campaign abuses a signed Notepad++ copy and tax-audit lures to deploy VenomRAT against targets in India.
55
PAPERMILL Malware Campaign Abuses Signed Notepad++ to Deliver VenomRAT to Windows Users
JUMPSEC tracks PAPERMILL, a China-nexus phishing campaign using a signed Notepad++ binary, libcurl.dll sideloading, and Donut loaders to deploy VenomRAT against Indian tax-audit targets.
55
Fake CVE-2023
A fake PoC for WinRAR RCE CVE-2023-40477 posted on GitHub actually deploys VenomRAT through a multi-step infection chain targeting researchers.
40
Related CVEs
by mentions- CVE-2023-2515785%9.8GeoServer: GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language (CQL) as part of the Web…
- CVE-2023-4047711%7.8RARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution Vulnerability
Appears with
- Notepad++vendor · 2
- PAPERMILLthreat actor · 2
- whalersplonkthreat actor · 1
- Notepad++product · 1
- VenomRATproduct · 1
- Booking.comproduct · 1
- Venom RAT + HVNC + Stealer + Grabber v6.0.3product · 1
- GBHackersorganization · 1
- JUMPSECorganization · 1
- AsyncRATmalware · 1
- GeoServerproduct · 1
- Booking.comvictim · 1
- Silver Foxthreat actor · 1
- XWormmalware · 1
- JUMPSECvendor · 1
- GeoServervendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.