New ClickFix Attack Deploys Lorem Ipsum Malware Loader to Establish Remote Access
A ClickFix campaign uses the Lorem Ipsum loader to install a Python tunnel for covert remote access.
5
Stories per day · 30 days
3 RSS
24 stories, newest first · one card per story
Stories tagged #loader
Inside AvisLoader: A Windows Malware Loader Built to Resist Disruption
Varonis details AvisLoader, a Windows malware loader using ClickFix lures and Tox peer-to-peer command and control.
3
GlassWorm Supply Chain Attack Hides Malware Inside VS Code Color Themes
GlassWorm-linked malicious VS Code color themes on Visual Studio Marketplace and Open VSX shipped staged JavaScript loaders that pulled C2 addresses from Solana memos.
8
New 2CLoader Malware Evades Security Tools to Deploy Vidar and Remus Stealers
Zscaler found 2CLoader, a Windows loader delivering Vidar, Remus, and XWorm while evading analysis.
New 2CLoader Malware Uses Anti-VM and API Hooking to Deliver Vidar and Remus Stealers
Zscaler details 2CLoader, a Windows loader using anti-VM checks and API hooks to deploy Vidar and Remus.
Hackers Hide Malware Inside 7-Zip Installers Using a New Evasion Technique
G Data found OpenSUpdater loaders hidden inside tampered 7-Zip SFX extraction code, using nested legitimate installers and padded certificates to evade analysis.
Sauron Loader Malware Uses DLL Side-Loading and In-Memory Decryption to Evade Detection
Sauron Loader, sold to Russian-speaking criminals, uses DLL side-loading and memory decryption against German organizations.
13
New Windows Malware Built to Survive Takedowns With a Hidden P2P Command Network
Varonis uncovers AvisLoader, a Windows loader using encrypted Tox P2P for takedown-resistant C2, delivered via ClickFix DocuSign lures.
1
GHAPPIER Supply Chain Attack Compromises 65 GitHub Repositories and Poisons npm Package
GHAPPIER supply chain campaign compromised 65 GitHub repositories and pushed a malicious four-stage npm loader via compromised maintainer trusted publishing.
Attackers Abuse npm Trusted Publishing in GHAPPIER Campaign
Attackers abused npm trusted publishing to ship the GHAPPIER loader via a legitimate package in the North Korea-linked PolinRider campaign.
3
Hackers Poison Movie Torrents With MovieReaper Malware That Uses Solana for C2
Poisoned movie torrents deliver MovieReaper malware using Solana blockchain for resilient C2, infecting several hundred victims across multiple continents.
4
MovieReaper Malware Spreads Through Pirated Movie Torrents and Uses Solana for C2
Kaspersky reports MovieReaper malware distributed via compromised torrent repository itorrents.org, using Solana blockchain for resilient C2 across four continents.
2
LausivLoader analysis, or how to pass data between malware stages, (Thu, Sep 17th)
SANS dissects a LausivLoader JavaScript malspam sample that passes staged payload file paths to PowerShell via process environment variables.
1
The Odyssey and trojans again: MovieReaper attacks users in multiple countries via compromised torrents
Kaspersky uncovers MovieReaper, a multi-stage malware framework spread via compromised itorrents.org torrent files, hitting hundreds of users.
Conti Hacker Who Built Malware and Attacked Victims Gets Four-Year Sentence
Ukrainian lawyer and Conti malware developer Oleksii Lytvynenko was sentenced to four years in U.S. prison for wire fraud conspiracy tied to Conti ransomware.
1
Conti Ransomware Hacker Sentenced After Group Attacked Over 1,000 Victims Worldwide
Ukrainian national Oleksii Lytvynenko sentenced to four years in US prison for his role in Conti ransomware attacks on 1,000+ victims.
Ukrainian lawyer's second career as a Conti coder earns him 4 years behind bars
Ukrainian lawyer turned Conti malware coder sentenced to four years in US prison, ordered to forfeit $25,042 in Bitcoin.
2
Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure
Unit 42 exposes CL-CRI-1171, a pay-per-install network spreading malware like Insomnia RAT via YouTube channels and SEO poisoning for over two years.
4
THost9 Android RAT Pairs Packed Loader With ADB Worm
Dark Atlas details THost9, a packed Android RAT paired with an ADB worm that installs itself on devices with exposed Android Debug Bridge services.
Guildma (Astaroth) malware infection from Brazilian Portuguese email, (Tue, Sep 1st)
Guildma (Astaroth) malware spread via geofenced Brazilian Portuguese phishing emails, using zip archives, shortcuts, and AutoIt loaders.
Foul Language: WordlistLoader Disguises Malware as Ordinary Text
ClickFix-style campaigns deploy WordlistLoader, which disguises malware as ordinary text, to deliver the increasingly prevalent Amatera infostealer.
Tricky 'SynkLoader' Multitool May Herald Ransomware
Researchers detail SynkLoader, an advanced multilingual multitool that hijacks screens to steal passwords and may precede ransomware attacks.
Analysis of Smoke Loader in New Tsunami Campaign
Fake Japanese Meteorological Agency tsunami warning emails delivered Smoke Loader and AzoRult malware to steal credentials from targets in Japan.
2
The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications
Unit 42 analyzes the Aeternum botnet loader, which uses Polygon blockchain smart contracts for resilient decentralized C2 and payload execution.