11 stories, newest first · one card per story
Gen Digital details Warden Stealer, a Rust MaaS infostealer spread via ClickFix, malvertising, cracked software, and fake game cheats stealing browser, wallet, and AI tokens.
Researchers disclosed a Windows console-pipe injection method that avoids WriteProcessMemory and VirtualAllocEx.
Researcher details Windows console named-pipe injection that avoids VirtualAllocEx and WriteProcessMemory EDR checks.
Process parameter-poisoning injects code into process initialization structures, evading EDR tools that monitor standard Windows APIs.
Researchers find CLOSEDQUORUM, a Windows malware that uses commercial LLMs as an autonomous decision engine for post-compromise actions like credential theft.
Cisco Talos documents CLOSEDQUORUM, the first known Windows implant using a four-LLM quorum to autonomously choose credential theft, wallet theft, injection, and persistence actions.
ClosedQuorum, a Go Windows implant, lets several LLMs choose post-compromise actions without a human operator.
Fortinet details Casbaneiro banking Trojan campaign hitting Latin American bank customers via invoice-themed PDF phishing, with AutoIt loading, RegSvcs.exe injection, and bank-site-triggered activation.
Attackers use AutoIt and an invoice-themed batch file to inject AsyncRAT into Microsoft-signed charmap.exe for stealthy remote access.
Casbaneiro banking Trojan targets Latin American bank users via phishing PDFs, geofencing, AutoIt staging, and distributed C2 servers to evade detection.
Point Wild details a five-stage AsyncRAT campaign using AutoIt abuse and process injection to hide a .NET RAT inside Microsoft's signed charmap.exe.
Today 1.5K readers · 2.4K views · 757 reads · all time 189K views