Search: “VenomRAT”

30 stories

PAPERMILL phishing campaign abuses a signed Notepad++ copy and tax-audit lures to deploy VenomRAT against targets in India.

JUMPSEC tracks PAPERMILL as an emerging cluster whose emails pass SPF, DKIM, and DMARC and deliver tax-audit themed disk images. The mounted image pairs a legitimately signed, renamed executable with a rogue libcurl.dll for DLL sideloading, then uses a Donut shellcode loader to run VenomRAT 6.0.3 in memory with hidden VNC, data-stealing, and file-grabbing capabilities. The loader includes anti-analysis checks and RunOnce persistence, and lures plus China-connected infrastructure overlap with the Silver Fox ecosystem, though attribution remains unconfirmed.

Cyber Security News12:23 UTC · 12m agoPhishing & fraud in the wild 2 sources

Fake CVE-2023

A fake PoC for WinRAR RCE CVE-2023-40477 posted on GitHub actually deploys VenomRAT through a multi-step infection chain targeting researchers.

Four days after Zero Day Initiative publicly disclosed the WinRAR RCE vulnerability CVE-2023-40477 on August 17, 2023, an actor using the alias whalersplonk published a fake proof-of-concept on GitHub. The Python script actually repurposed public PoC code for GeoServer SQL injection CVE-2023-25157 and triggered an infection chain ending in VenomRAT. The README and an accompanying video lured users into running the script; the video drew over 100 plays. Unit 42 assesses the actor was opportunistic, targeting other miscreants adopting new vulnerabilities rather than researchers specifically.

Palo Alto Unit 42Aug 17, 10:57 UTC · Aug 17, 2026Malware CVE-2023-40477 CVE-2023-25157

Search: “VenomRAT”

PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacksnew

Fake CVE-2023

A new RevengeHotels campaign targets Latin America

ScrubCrypt used to drop VenomRAT along with many malicious plugins

Get a Loda This: LodaRAT meets new friends

Operation Endgame 3.0 Dismantles Three Major Malware Networks

Fake WinRAR PoC spread VenomRAT malware

Rhadamanthys infostealer operation disrupted by law enforcement

AsyncRAT seeds family of more than 30 remote access trojans

Fake Bitdefender website used to spread infostealer malware

Fake Bitdefender Site Spreads Trio of Malware Tools

Operation Endgame targets malware networks in global crackdown

Crooks use a fake antivirus site to spread Venom RAT and a mix of malware

Operation Endgame: Police reveal takedowns of three key cybercrime tools

Hackers steal hotel guests’ payment data in new AI

AsyncRAT evolves as ESET tracks its most popular malware forks

Attackers Using Obfuscation Tools to Deliver Multi

Week in review: 18 free Microsoft Azure cybersecurity resources, K8 vulnerability allows RCE

Phishing campaign impersonating Booking.com targets hospitality sector with malware

Budding infosec pros and aspiring cyber crooks targeted with fake PoC exploits

Security Affairs newsletter Round 526 by Pierluigi Paganini

Microsoft Warns of ClickFix Phishing Campaign Targeting Hospitality Sector via Fake Booking[.]com Emails

ClickFix: How to Infect Your PC in Three Easy Steps

ClickFix Phishing Scam Impersonates Booking.com to Target Hospitality

PDF Exploitation Targets Foxit Reader Users

Cybercriminals Using Powerful BatCloak Engine to Make Malware Fully Undetectable

FUD Malware obfuscation engine BatCloak continues to evolve

Talos uncovers espionage campaigns targeting CIS countries, embassies and EU health care agency

Threat Source newsletter (Nov. 17, 2022): Hot off the press! The Snort 2023 Calendar is here

Threat Actor