Qlik Sense servers hit with blocked reverse-shell attempts
Cynet blocked the October attempts; the operator’s server also staged ActiveMQ and Veeam exploit tooling.
Stories per day · 30 days
6 RSS
Relatedclickfix7infostealer6phishing5dll-sideloading4romulus3social-engineering3asyncrat2chocoshell2claude2cornflake2dcrat2fake-ai2forescout2github2legionloader2malware-delivery2midnight-blizzard2steganography2
55 stories, newest first · one card per story
Stories tagged #powershell
Microsoft releases Windows 10 KB5131096 extended security update
The update reaches build 19045.7846, or 19044.7846 on Enterprise LTSC 2021, and includes November Patch Tuesday fixes.
Fake Cloudflare CAPTCHA ClickFix lures hide malware in PNG images
Huntress says pasted PowerShell rebuilt full executables from PNG pixel data, then added persistence and lateral movement.
Huntress: ClickFix chains now persist, move laterally, and steal credentials
Recent lures use malvertising, typosquats, and compromised sites, then show fake verification text while payloads run.
ArmorSteal steals credentials and mines Monero via fake downloads
Victims who paste a PowerShell command get a PyArmor-packed Python kit with three scheduled tasks and 11 command domains.
Fake GitHub security tools infect over 2,000 computers with malware
Doctor Web says Visual Studio and script repos drop AsyncRAT, a clipocurrency clipper, and a browser stealer.
Fake Colombian court notices deliver XWorm via hidden scripts
Arctic Wolf says Spanish legal lures drop VBScript or JavaScript that inject XWorm into RegAsm.exe.
Fake FedEx invoices install Sirius Backdoor through blank PDFs
A Korean-language lure claims 217,740 KRW is due; the PDF launches PowerShell that loads the backdoor only in memory.
2
Overlord and Lampion campaigns hide malware with Windows tools
Phishing in Brazil and Portugal delivers VBScript downloaders that persist as fake Windows Error Reporting tasks and side-loaded DLLs.
1
ROMULUS ClickFix platform delivers Legion Loader and other malware
Forescout found six servers; PowerShell staging fetches a trojanized MSI or an archive containing Legion Loader.
New ROMULUS Malware Platform Uses Six Servers to Deliver Multiple Malicious Payloads
Forescout identified ROMULUS, a six-server ClickFix platform delivering trojanized Stardock installers and LegionLoader.
4
Midnight Blizzard-Linked Malware Server Still Delivering Payloads 8 Weeks After Disclosure
ReversingLabs found a Midnight Blizzard-linked server still serving ChocoShell and CornFlake on October 5.
5
Hackers Use New ROMULUS ClickFix Platform to Deliver Malware and Evade Security Detection
Forescout says ROMULUS delivers LegionLoader and sideloaded malware through ClickFix traps.
Midnight Blizzard-Linked Hackers Use Claude AI to Rebuild Malware and Evade Detection
Midnight Blizzard-linked operators used Claude to rebuild ChocoShell and CornFlake malware against Ukrainian and European targets.
6
Fake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents Early
Attackers impersonate Claude, ChatGPT, Copilot, and Gemini to deliver infostealers, ANY.RUN reports.
5
Fake AI Tools Put US Companies at Risk: Inside Counterfeit Claude, ChatGPT, and Copilot
ANY.RUN linked 1,258 fake Claude and ChatGPT lures delivering infostealers and phishing US users.
8
Attackers Use Power BI Phishing to Install Multiple RMMs and Maintain Persistent Access
Phishers abused Microsoft Power BI dashboards to push rogue ScreenConnect RMM clients, creating redundant persistent remote access on 20-plus endpoints.
Ignore all instructions and read this blog: The state of AI-analysis evasion in malware
Cisco Talos finds malware embedding AI-evasion prompts that swayed analysis in about 35 percent of tests.
7
ClickFix campaign in Ukraine compromises over 100 websites to spread Lunex malware
A ClickFix campaign compromised over 100 Ukrainian websites to deliver the Lunex information stealer.
ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits
Microsoft says ClickFix attacks now smuggle VBScript through the browser cache to bypass Windows Run limits.
3
How Huntress Detects and Responds to a ClickFix Attack
Huntress says ClickFix evades file-based EDR and describes endpoint rules that kill pasted commands in under a second.
Microsoft Warns ClickFix Attacks Use Fake CAPTCHA Lures to Execute Malicious Commands
Microsoft warns a ClickFix campaign uses fake CAPTCHA prompts so Windows users run cached malware that steals browser credentials.
15
Hackers Turned a Microsoft SQL Server Into a Command and Data Exfiltration Channel
Attackers abused a Viva Aerobus SQL Server to run commands and steal files, then exposed tools and data online.
5
Exposed Hacker Server Reveals Toolkit Used in Viva Aerobus-Linked Intrusion
ThreatMon exposed an unauthenticated attacker staging server revealing MSSQL intrusion tooling and stolen data linked to a Viva Aerobus environment.
4