Search: “powershell”

676 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Malware 1209 Ransomware 610 Vulnerability 342 Threat actor 281 Exploit / PoC 193 Data breach 100 Phishing & fraud 68 Industry 32 Policy & legal 17 Advisory 11 Tools 6 Research 5 AI tools & infra 5 AI industry 4

SeverityAll critical 810 high 1305 medium 678 low 79 info 15

HVNC Backdoor Targets LATAM Organizations with Fake Tax and DocuSign Lures

A custom HVNC backdoor is targeting Latin American financial organizations via fake DocuSign and NFe tax-document lures, giving attackers hidden persistent remote access.

ANY.RUN researchers analyzed a multi-stage phishing campaign delivering a custom HVNC backdoor to banking and financial organizations in Latin America. The chain starts with fake DocuSign and NFe tax-document pages that serve per-visitor ZIP archives, followed by an LNK dropper, an NSIS loader, and a 64-bit backdoor masquerading as Windows Update Assistant. The implant provides hidden remote desktop control, keystroke monitoring, Firefox data theft, Startup-folder persistence, and EDR-aware behavior, communicating over TCP/27015.

ANY.RUNSep 8, 10:24 UTC · 8d agoMalware in the wild

Cortex XDR™ Detects New Phishing Campaign Installing NetSupport Manager RAT

Cortex XDR threat hunters uncovered a phishing campaign delivering the NetSupport Manager RAT via a fake password-protected NortonLifelock Word document.

Unit 42 identified a January 2020 phishing campaign using a Microsoft Word document disguised as a password-protected NortonLifelock file. Enabling macros triggered an obfuscated command that built alpaca.bat in the temp directory, which used msiexec to download an MSI payload from quickwaysignstx.com, filtered on the Windows Installer user-agent string. The payload installed a PowerShell script and the campaign, which has delivered NetSupport Manager RAT since at least 2018, showed related activity dating back to early November 2019.

Palo Alto Unit 42Aug 17, 13:18 UTC · Aug 17, 2026Phishing & fraud in the wild1

PureLogs Variant Steals Data via Purchase Order Lures

Infosecurity MagazineMay 27, 08:00 UTC · May 27, 2026Malware

Phishing LNK files and GitHub C2 power new DPRK cyber attacks

Security AffairsApr 6, 19:34 UTC · Apr 6, 2026Phishing & fraud

DeepLoad Malware Uses ClickFix and WMI Persistence to Steal Browser Credentials

The Hacker NewsMar 31, 06:09 UTC · Mar 31, 2026Malware

Experts Confirm JS#SMUGGLER Uses Compromised Sites to Deploy NetSupport RAT

The Hacker NewsDec 10, 07:34 UTC · Dec 10, 2025Malware

New ‘Chihuahua Stealer' Targets Browser Data and Crypto Wallets

Infosecurity MagazineMay 14, 12:00 UTC · May 14, 2025Malware

ClickFix Exploits Users with Fake Errors and Malicious Code

Infosecurity MagazineNov 5, 17:15 UTC · Nov 5, 2024Malware

Server-side attacks, C&C in public clouds and other MDR cases we observed

Kaspersky SecurelistNov 2, 08:00 UTC · Nov 2, 2022Vulnerability

The Document that Microsoft Eluded AppLocker and AMSI

Security AffairsMar 20, 07:51 UTC · Mar 20, 2019Malware

PowerSniff Malware Used in Macro

Palo Alto Unit 42Nov 1, 10:08 UTC · Nov 1, 2018Malware

BBSRAT Attacks Targeting Russian Organizations Linked to Roaming Tiger

Palo Alto Unit 42Nov 1, 09:59 UTC · Nov 1, 2018Malware CVE-2012-0158

Crooks leverage Facebook CDN servers to bypass security solutions

Security AffairsSep 10, 13:10 UTC · Sep 10, 2017Malware

The Coding-Agent Trap: When a "Free" LLM Endpoint Is the Adversary, (Mon, Aug 31st)

A SANS honeypot caught a real coding-agent session routed to a rogue "free" LLM endpoint, exposing a Windows user's transcript and tool outputs.

A SANS analyst describes how an internet-exposed inference honeypot was discovered, relabeled with sought-after model names like DeepSeek, and enrolled in infrastructure serving "free" LLM backends. On 2026-08-30 an opencode terminal coding agent sent an 88-message, 224 KB transcript 210 times in 91 seconds via a China Unicom relay, exposing directory listings, tool outputs and read file portions. The analyst frames tool-enabled agents treating model endpoints as trusted control planes as a novel risk — a "rogue model endpoint" that could request tool executions on the user's machine.