Search: “WinRAR”

48 stories

A fake PoC for WinRAR RCE CVE-2023-40477 posted on GitHub actually deploys VenomRAT through a multi-step infection chain targeting researchers.

Four days after Zero Day Initiative publicly disclosed the WinRAR RCE vulnerability CVE-2023-40477 on August 17, 2023, an actor using the alias whalersplonk published a fake proof-of-concept on GitHub. The Python script actually repurposed public PoC code for GeoServer SQL injection CVE-2023-25157 and triggered an infection chain ending in VenomRAT. The README and an accompanying video lured users into running the script; the video drew over 100 plays. Unit 42 assesses the actor was opportunistic, targeting other miscreants adopting new vulnerabilities rather than researchers specifically.

Palo Alto Unit 42Aug 17, 10:57 UTC · 29d agoMalware CVE-2023-40477 CVE-2023-25157

WinRAR MotW bypass flaw fixed, update ASAP (CVE-2025-31334)

Help Net SecurityApr 7, 00:00 UTC · Apr 7, 2025Vulnerability CVE-2025-31334

WinRAR Flaw Exploited by Russia-Aligned Groups to Deploy Stealers in Ukraine

The Hacker NewsJun 9, 12:26 UTC · Jun 9, 2026Malware CVE-2025-8088

Russian researchers say espionage operation using WinRAR bug is linked to Ukraine

The RecordMar 28, 13:13 UTC · Mar 28, 2024Threat actor CVE-2023-38831

FlyingYeti targets Ukraine using WinRAR exploit to drop Malware

Security AffairsJun 2, 17:55 UTC · Jun 2, 2024Malware CVE-2023-38831

[SI-LAB] EMOTET spread in Chile impacted hundreds of users and targeted financial and banking services

Security AffairsApr 10, 13:37 UTC · Apr 10, 2019Vulnerability CVE-2018-20250

Russia and China

The RecordOct 18, 15:57 UTC · Oct 18, 2023Vulnerability CVE-2023-38831

Threat Roundup for April 8 to April 15

Cisco TalosApr 15, 20:04 UTC · Apr 15, 2022Vulnerability

ISPs were involved in delivering surveillance FinFisher Spyware

Security AffairsOct 16, 21:49 UTC · Oct 16, 2017Malware

Threat Roundup for October 13 to October 20

Cisco TalosOct 20, 19:38 UTC · Oct 20, 2023Vulnerability

Threat Roundup for September 22 to September 29

Cisco TalosSep 29, 16:40 UTC · Sep 29, 2023Vulnerability

Beware of the new phishing technique "file archiver in the browser" that exploits zip domains

Security AffairsMay 30, 10:54 UTC · May 30, 2023Phishing & fraud

Threat Round up for January 13 to January 20

Cisco TalosJan 20, 21:38 UTC · Jan 20, 2023Vulnerability

Threat Roundup for February 4 to February 11

Cisco TalosFeb 11, 19:28 UTC · Feb 11, 2022Vulnerability

Targeted Attacks in the Middle East Using KASPERAGENT and MICROPSIA

Palo Alto Unit 42Jan 28, 20:33 UTC · Jan 28, 2022Malware

Threat Roundup for August 28 to September 4

Cisco TalosSep 4, 22:15 UTC · Sep 4, 2020Vulnerability

Aveo Malware Family Targets Japanese Speaking Users

Palo Alto Unit 42Apr 27, 08:51 UTC · Apr 27, 2020Malware

JhoneRAT: Cloud based python RAT targeting Middle Eastern countries

Cisco TalosJan 16, 19:18 UTC · Jan 16, 2020Malware CVE-2017-0199

Specially Crafted ZIP archives allow bypassing secure email gateways

Security AffairsNov 7, 15:44 UTC · Nov 7, 2019Malware

The return of the BOM

Kaspersky SecurelistMar 28, 14:00 UTC · Mar 28, 2019Malware

Sofacy Creates New ‘Go’ Variant of Zebrocy Tool

Palo Alto Unit 42Jan 15, 12:31 UTC · Jan 15, 2019Malware

Threat Round-up for Mar 31

Cisco TalosApr 7, 20:49 UTC · Apr 7, 2017Vulnerability

Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker

Unit 42 exposed CL-CRI-1171, a pay-per-install operation using YouTube gaming channels and SEO poisoning to deliver RATs and a Chrome hijacker.

Palo Alto Networks Unit 42 identified over 10,000 OfferLoader samples and 11 YouTube channels pushing trojanized installers via gaming lures and SEO-poisoned searches for tools like WinDirStat and Bluetooth drivers. Trojanized Inno Setup installers spawn three payload branches: Insomnia RAT (dual Node.js/Python backdoor that disables Microsoft Defender), ARKTunnel (undocumented RAT hiding its payload in a bitmap image and tunneling TCP/UDP), and Docro Hijacker (alters Chrome protected preferences to hijack search and affiliate links). The pay-per-install model sells each infection to multiple buyers, reaching gamers as well as corporate and government endpoints.

Cyber Security NewsSep 14, 08:01 UTC · 1d agoMalware in the wild1

Autonomous AI Agents Compromise Thousands of Credentials in Under Six Hours

Google's GTIG reports threat actors using autonomous AI agents, credential stealers, and LLMs to steal AI models, API credentials, and harvest thousands of credentials.

Google Threat Intelligence Group says attackers are targeting proprietary AI models across healthcare, government, and media, exfiltrating API credentials, and co-opting victim cloud environments to run unauthorized AI workloads. TeamPCP (Altered Spider/UNC6780) is conducting supply chain compromises of PyPI, npm, and Docker Hub, deploying the SANDCLOCK and DUSTMAKER credential stealers, with DUSTMAKER using AI workspace poisoning and prompt injection for defense evasion. One financially motivated actor used an autonomous multi-agent framework to compromise thousands of third-party credentials in under six hours without human intervention. China-nexus groups UNC6508 and Basin Castle (Mustang Panda) used local open-weight LLMs and commercial LLMs like Gemini, Claude, and Codex for espionage tasks and evading provider monitoring.

The Hacker NewsSep 8, 13:48 UTC · 7d agoThreat actor in the wild 2 sources1