Search: “cloaking”

32 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Malware 81 Ransomware 51 Threat actor 47 Phishing & fraud 41 Vulnerability 30 Exploit / PoC 23 Data breach 20 Policy & legal 14 Industry 14 Research 4 AI tools & infra 3 Advisory 1 AI safety & security 1 AI industry 1

SeverityAll critical 96 high 101 medium 88 low 40 info 7

Sophos discovered new tricks to poison Google Search engine

Security AffairsFeb 17, 16:30 UTC · Feb 17, 2018Malware

New npm Malware Campaign Redirects Victims to Crypto Sites

Infosecurity MagazineNov 18, 16:00 UTC · Nov 18, 2025Malware

Experts Detect Multi-Layer Redirect Tactic Used to Steal Microsoft 365 Login Credentials

The Hacker NewsAug 1, 06:51 UTC · Aug 1, 2025Malware

Astaroth, Mekotio & Ousaban abusing Google Cloud Run in LATAM

Cisco TalosFeb 20, 13:00 UTC · Feb 20, 2024Malware

Researcher warns that Cisco Secure Email Gateways can easily be circumvented

Security AffairsNov 22, 19:04 UTC · Nov 22, 2022Malware

When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts

Cloudflare's Page Shield ML uncovered four malicious JavaScript campaigns on storefronts, including affiliate fraud and a remote-backdoor script, that VirusTotal and URLScan missed.

Cloudflare's Page Shield ML detected four client-side JavaScript operations (eight payloads) in live traffic on online storefronts, enabling affiliate commission hijacking, clickless affiliate theft via hidden iframes, user tracking with a remote-code backdoor, and cloaking of paid mobile visitors. Seven of the eight payloads were absent from VirusTotal and URLScan returned no malicious verdict for any, including a Lnkr-family payload indexed unclassified for roughly 2.5 years. Detection relies on a graph neural network over JavaScript syntax trees, an LLM second opinion on Workers AI, and a frontier-model ensemble voting across benign, magecart, other malware, and cryptomining labels.

Cloudflare BlogSep 16, 20:06 UTC · 7h agoMalware in the wild

Exploring the Latest Mispadu Stealer Variant

Unit 42 found a new Mispadu infostealer variant targeting Mexican users via malicious .url files exploiting the SmartScreen CVE-2023-36025 bypass.

Unit 42 discovered a new variant of Mispadu Stealer, a Delphi-based banking trojan first reported in 2019, found while hunting for the Windows SmartScreen bypass CVE-2023-36025. The campaign uses crafted .url files referencing UNC network-share paths with an HTTP port (@80) that forces payload retrieval over WebDAV via rundll32.exe, avoiding SmartScreen warnings. Analyzed samples (~4 KB, compiled 2023-11-12) predate the CVE publication, and ZIP payloads were likely distributed as email attachments, primarily targeting users in Mexico.