Anti-Spam Appliance spammed: the protectors need protecting too

A range of cases show that compromised computers can be found in almost any field of business. We have seen phishing pages hosted on school and university sites as well as banking and government websites. This week we came across a rather rare case of a Paypal phishing scam planted on a machine apparently belonging to a provider of IT security solutions.

This is one of the many examples that show that even if a network is maintained by qualified specialists, you can’t let your guard down for a minute.

Of course we notified the company the minute we discovered the glitch and 8 hours later the phish had been removed.

Incidentally, the phishing setup contained “Trojan-Spy.HTML.Paylap.hp” as well as “Trojan-Spy.HTML.Paylap.hn”, both of which are detected by Kaspersky products since January 2006.

Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.

Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.