ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Skills API”

2 stories in the last 3d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllAI research 2Malware 2AI industry 2Threat actor 1AI tools & infra 1AI safety & security 1Industry 1
SeverityAllcritical 0high 2medium 2low 0info 6

Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads

Hijacked verified HBO Max Reddit account ran 108 ClickFix malvertising ads delivering AMOS infostealers, Windows loaders, and crypto clipboard hijackers.

HudsonRock and ADAMnetworks identified a cross-platform ClickFix operation dubbed PasteSwitch that abused the compromised verified Reddit account u/hbomax to publish 108 malicious ads over 48 hours, using domains like hbomaxx[.]us and codex-craft[.]com. macOS victims run curl/zsh commands delivering AMOS-related stealers and fake wallets, while Windows users get an InstallFix route using mshta and PowerShell that loads Amatera in memory and disables AMSI. The operation's AnimateClipper and ZigClipper families hijack clipboards to swap cryptocurrency addresses, with C2 domains rotated via Binance Smart Chain contracts. Reddit paused the ads and is investigating.

Cyber Security Newsupdated · 1d agofirst · 1d agoMalware in the wild 7 sources

Hackers Can Rent VectraRAT for $250 a Month to Take Control of Windows PCs

SOCRadar uncovered VectraRAT, a previously undocumented $250-per-month Windows RAT rental service delivered via Amadey and ClickFix lures.

SOCRadar's Threat Research Unit identified VectraRAT, a rental-only remote access trojan sold by a developer known as Vectra (formerly Nyxel), after an exposed online directory revealed samples, licenses, and operator logs across ten-plus servers. The toolkit includes a Linux control server, Windows implant, payload builder, and VectraHub panel, enabling hidden desktop access, keylogging, command execution, credential theft, file transfer, proxying, and silent privilege escalation. Of victims with OS data, 48 percent ran corporate Windows editions, and researchers recorded 38 genuine victim sessions in under a week, including file theft from business systems. Distribution occurs through the Amadey loader and ClickFix pages impersonating TurboTax, with custom TCP-based C2 over non-standard ports.

Cyber Security News · 12h agoMalware in the wild 3 sources