malware

Multilayered Email Attack: How a PDF Invoice and Geo-Fencing Led to RAT Malware

Email campaign distributing Ratty RAT malware exploits legitimate invoicing tactics and geofencing to bypass security. Attackers use a trusted email service and file-sharing platforms, manipulate recipients through social engineering, and employ Ngrok for covert links. Targeting mainly Italy, the campaign exemplifies advanced evasion strategies and challenges conventional detection systems. Fortinet provides protections, urging users to stay vigilant against such phishing threats.

https://www.fortinet.com/blog/threat-research/multilayered-email-attack-how-a-pdf-invoice-and-geofencing-led-to-rat-malware

CISA and FBI Warn Fast Flux Is Powering Resilient Malware, C2, and Phishing Networks

,

CISA and FBI warn that “fast flux” technique aids malware, C2, and phishing networks by obscuring malicious server locations through rapid DNS record changes. It's a persistent network security threat, complicating tracking and blocking by authorities. Recommended countermeasures include blocking malicious IPs and domains and enhancing monitoring.

https://thehackernews.com/2025/04/cisa-and-fbi-warn-fast-flux-is-powering.html

Malware Is Harder to Find When Written in Obscure Languages

Malware authors are increasingly using obscure programming languages like Delphi and Haskell to evade detection. Researchers found that using less common languages complicates static analysis, making malware harder to identify and analyze. While C and C++ remain prevalent, many threat groups now employ diverse languages and compilers to obscure malicious code. This shift makes automated detection less effective, as unique signatures are harder to create for various programming languages, leading to greater challenges for security analysts. More focus on these lesser-used languages in security measures is necessary.

https://www.theregister.com/2025/03/29/malware_obscure_languages/

FBI Warnings Are True—fake File Converters Do Push Malware

FBI warns fake online document converters distribute malware, including ransomware, targeting users' sensitive information. Cybercriminals create deceptive sites mimicking legitimate converters. Victims report scams to IC3, leading to malware like Gootloader, causing serious breaches. Not all converters are harmful, but users should research before using them.

https://www.bleepingcomputer.com/news/security/fbi-warnings-are-true-fake-file-converters-do-push-malware/

Microsoft Trusted Signing Service Abused to Code-sign Malware

Microsoft's Trusted Signing service is exploited by cybercriminals to code-sign malware using short-lived three-day certificates. These signed executables can bypass security filters. Criminals prefer this method due to easier access compared to Extended Validation certificates. Microsoft monitors and revokes misuse of their signing service, citing active threat intelligence measures.

https://www.bleepingcomputer.com/news/security/microsoft-trusted-signing-service-abused-to-code-sign-malware/

New XCSSET Malware Adds New Obfuscation, Persistence Techniques to Infect Xcode Projects

,

New XCSSET malware variant enhances techniques for infecting Xcode projects, employing improved obfuscation, persistence methods, and novel infection strategies. This modular macOS malware targets developers via their Xcode projects, using encoded payloads and enhanced scripting for stealth. Its modular design enables complex multi-stage infections, focusing on stealing user information and while remaining difficult to detect. Mitigation includes using updated OS versions, inspecting Xcode projects, and employing Microsoft Defender for security against threats.

https://www.microsoft.com/en-us/security/blog/2025/03/11/new-xcsset-malware-adds-new-obfuscation-persistence-techniques-to-infect-xcode-projects/

DeepSeek Lure Used To Spread Malware

,

DeepSeek malware campaign exploits the popularity of the DeepSeek AI chatbot, using look-alike domains to mislead users into executing malware. This includes techniques such as clipboard injection via a fake CAPTCHA page, leading to the installation of the Vidar information stealer. Key concerns raised include the increased risk of data theft and the need for organizations to enforce security measures around generative AI tools.

https://www.zscaler.com/blogs/security-research/deepseek-lure-using-captchas-spread-malware

Microsoft Spots XCSSET macOS Malware Variant Used for Crypto Theft

,

Microsoft has identified a new variant of the XCSSET macOS malware targeting sensitive user information for crypto theft. This updated malware features improved obfuscation, persistence methods, and novel infection techniques, typically spread via contaminated Xcode projects. Key modifications include sophisticated encoding methods, persistent payload behaviors, and the ability to manipulate Xcode project settings. Microsoft recommends users verify their Xcode projects to prevent potential compromises.

https://www.bleepingcomputer.com/news/security/microsoft-spots-xcsset-macos-malware-variant-used-for-crypto-theft/

Hacker Infects 18,000 “script Kiddies” With Fake Malware Builder

Hacker infects 18,000 “script kiddies” globally with fake malware builder, a trojanized XWorm RAT, which steals data and controls infected systems. The malware was spread through various platforms and included a kill switch, but many systems remain compromised. Security researchers disrupted the botnet using a mass uninstall command. Users are warned against trusting unsigned software from other criminals.

https://www.bleepingcomputer.com/news/security/hacker-infects-18-000-script-kiddies-with-fake-malware-builder/

Lumma Stealer: Fake CAPTCHAs & New Techniques to Evade Detection

,

Lumma Stealer uses fake CAPTCHAs for malware delivery in a global campaign targeting various sectors, particularly telecom. Attackers use social engineering to trick victims into executing commands outside the browser, evading security measures, leveraging techniques like process hollowing and PowerShell obfuscation to bypass defenses. The malware evolves continuously, making detection and prevention challenging, and Netskope provides proactive threat detection against this campaign.

https://www.netskope.com/blog/lumma-stealer-fake-captchas-new-techniques-to-evade-detection

Scroll to Top