Overlord and Lampion campaigns hide malware with Windows tools
Phishing in Brazil and Portugal delivers VBScript downloaders that persist as fake Windows Error Reporting tasks and side-loaded DLLs.
1
Stories per day · 30 days
2 RSS
12 stories, newest first · one card per story
Stories tagged #vbscript
ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits
Microsoft says ClickFix attacks now smuggle VBScript through the browser cache to bypass Windows Run limits.
3
ClickFix Fake CAPTCHA Attack Executes Malware Hidden Inside Browser Cache
ClickFix sites hide VBScript in the browser cache and trick users into running it.
13
TASK#STOMP PowerShell Backdoor Steals Business Documents and Executes Remote Commands
TASK#STOMP Windows backdoor combines VBScript, PowerShell, scheduled tasks, and runtime C# compilation for resilient document theft and remote command execution.
1
TASK#STOMP PowerShell Backdoor Steals Documents, Wi-Fi Passwords, and Clipboard Data
Securonix details TASK#STOMP, a PowerShell backdoor stealing documents, Wi-Fi passwords, and clipboard data.
2
Russia-Aligned Hackers Use GuardBreaker Prompt Injection to Disrupt AI Malware Analysis
Russia-aligned group UAC-0099 embeds GuardBreaker prompt injection in a VBScript comment to make AI malware scanners refuse analysis of a MATCHBOIL loader.
4
Hackers Weaponize AI Safety Guardrails to Hide Malware From LLM-Powered Security Scanners
ESET says Russia-aligned actor UAC-0099 hid guardrail-triggering comments in VBScript to derail LLM-based malware scanners in Ukraine.
7
GuardBreaker: Derailing AI-assisted malware analysis with a code comment
ESET names 'GuardBreaker': UAC-0099 embeds a nuclear-weapon question in VBScript comments to trip LLM scanner guardrails during analysis of its MATCHBOIL loader.
7
Modified ScreenConnect Clients Used in Worm-Like Campaign
Huntress warns of worm-like attacks using modified ScreenConnect clients to spread VBScript payloads; ConnectWise issued an advisory.
1
Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts
Huntress says rogue ScreenConnect clients spread a four-stage VBScript chain delivering backdoors, privilege-escalation tools, or an XMRig miner to newly connected hosts.
1
Attackers use rogue ScreenConnect clients to spread malware
Attackers deploy rogue ScreenConnect clients that spread VBScript malware to newly connected machines while ConnectWise patches a file-transfer flaw.
1
Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity
Huntress observed rogue ScreenConnect deployments with worm-like VBScript propagation across unrelated organizations, prompting a ConnectWise advisory on file transfer behavior.
4