ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Windows Remote Desktop Client”

37 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 162Malware 98Ransomware 86Exploit / PoC 43Threat actor 26Data breach 12Industry 7Advisory 6Phishing & fraud 5AI safety & security 3Policy & legal 3AI industry 1AI tools & infra 1Research 1
SeverityAllcritical 213high 149medium 79low 10info 5

ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager

Cisco Talos details ClearFake WebDAV chains delivering Amatera stealer to a Ukrainian government organization, with cryptocurrency and credential theft payloads.

Cisco Talos investigated DLL executions named 'verification.google' via WebDAV UNC paths at a Ukrainian government organization, tracking the actor as UAT-10820 and assessing with moderate confidence the activity is Russian and opportunistic rather than targeted. The infection chain uses ClearFake JavaScript injected via a Cloudflare Worker, EtherHiding storage on BNB Smart Chain contracts, and a ClickFix fake Google CAPTCHA prompt to deliver Amatera stealer. Secondary payloads differ by C2: one loader deploys ZigCryptoStealer with a Go reverse TCP proxy and a vulnerable driver that kills EDR, while the other installs an unauthorized NetSupport Manager with a Russia-based C2. Similar Amatera chains were separately documented by Malwarebytes and Blackpoint Cyber, but with no shared infrastructure.

Cisco Talos · 7d agoMalware in the wild1

ClearFake Deploys Crypto Stealer That Uses Vulnerable Driver to Kill EDR Security Tools

Cisco Talos details ClearFake's fake-CAPTCHA chain deploying ZigCryptoStealer with a BYOVD attack that kills EDR processes, observed at a Ukrainian government organization in April 2026.

ClearFake compromises websites, injects JavaScript via a malicious Cloudflare Worker, retrieves instructions from BNB Smart Chain contracts (EtherHiding), and presents a fake Google CAPTCHA that tricks Windows users into pasting a command that loads a remote library over WebDAV via rundll32. The crypto-stealer branch uses DLL side-loading with a signed Chrome component to launch ZigCryptoStealer, which hijacks clipboard cryptocurrency addresses, alongside a signed but vulnerable Windows driver used in a BYOVD attack to terminate EDR processes. A parallel branch delivers Amatera secondary payloads that install a hidden remote-access client providing operator desktop control, with Cisco Talos tracking the remote-loader activity as UAT-10820. Talos observed unusual remote library execution at a Ukrainian government organization in April 2026 and assesses the attacks are part of a broader theft operation rather than a single targeted campaign.

Cyber Security Newsupdated · 4d agofirst · 6d agoMalware in the wild 4 sources1

ThreatsDay: 296K IoT Botnet, 100+ Water Systems Targeted, SharePoint RCE Chain + 27 New Stories

Weekly ThreatsDay bulletin details a ShinyHunters-style social engineering hit on ReliaQuest, the 296,000-device Dysphoria IoT botnet, and several new malware families.

ReliaQuest confirmed a social engineering attack on August 22, 2026, in which an attacker used a fake SSO page and MFA push approval to gain brief view-only access to an identity dashboard, with tactics matching ShinyHunters, which has since listed the firm on its leak portal. The Shadowserver Foundation reported the Dysphoria botnet has compromised nearly 296,000 IoT devices for DDoS attacks and recently added residential proxy capability. Cisco Talos documented JWR, an operator-driven phishing-as-a-service framework linked to The Outsider that harvests credentials, identity documents, and 2FA codes over an encrypted WebSocket. New malware coverage includes the Octagon Android fraud bot ($1,400/month), the C2Looper Rust backdoor delivered via ClickFix, and the Aeternum loader that moved C2 to the Polygon blockchain.

The Hacker News · 14d agoMalware in the wild

HVNC Backdoor Targets LATAM Organizations with Fake Tax and DocuSign Lures

A custom HVNC backdoor is targeting Latin American financial organizations via fake DocuSign and NFe tax-document lures, giving attackers hidden persistent remote access.

ANY.RUN researchers analyzed a multi-stage phishing campaign delivering a custom HVNC backdoor to banking and financial organizations in Latin America. The chain starts with fake DocuSign and NFe tax-document pages that serve per-visitor ZIP archives, followed by an LNK dropper, an NSIS loader, and a 64-bit backdoor masquerading as Windows Update Assistant. The implant provides hidden remote desktop control, keystroke monitoring, Firefox data theft, Startup-folder persistence, and EDR-aware behavior, communicating over TCP/27015.

ANY.RUN · 7d agoMalware in the wild

E4del and PINHOLE RATs Turn FTP Banners Into Dead Drops for Malware Commands

Researchers identified two new RATs, E4del and PINHOLE, using FTP banners as dead drop resolvers to fetch C2 commands via ClickFix-style lures.

SOCRADAR documented two previously unreported RATs, E4del and PINHOLE, that use FTP banners as dead drop resolvers, a first in-the-wild use of this technique. E4del is a Node.js-based RAT hidden in a digitally signed Electron application masquerading as Discord, with tiered-jitter beaconing, reverse shell, screenshot capture and desktop streaming. PINHOLE is more advanced, using Pinterest, SurveyMonkey and Cloudflare Workers for C2 resolution, six layers of unpacking, Halo's Gate EDR evasion and Early Bird APC injection. A related WebDAV delivery chain overlaps with ClearFake campaigns distributing WordlistLoader and Amatera Stealer.

The Hacker News · 21d agoMalware in the wild

Fake CVE-2023

A fake PoC for WinRAR RCE CVE-2023-40477 posted on GitHub actually deploys VenomRAT through a multi-step infection chain targeting researchers.

Four days after Zero Day Initiative publicly disclosed the WinRAR RCE vulnerability CVE-2023-40477 on August 17, 2023, an actor using the alias whalersplonk published a fake proof-of-concept on GitHub. The Python script actually repurposed public PoC code for GeoServer SQL injection CVE-2023-25157 and triggered an infection chain ending in VenomRAT. The README and an accompanying video lured users into running the script; the video drew over 100 plays. Unit 42 assesses the actor was opportunistic, targeting other miscreants adopting new vulnerabilities rather than researchers specifically.

Palo Alto Unit 42 · 29d agoMalwareCVE-2023-40477CVE-2023-25157