Security Affairs

MARCH 31, 2025

Russia-linked Gamaredon targets Ukraine with a phishing campaign using troop-related lures to deploy the Remcos RAT via PowerShell downloader. The threat actor is using troop-related lures to deploy the Remcos RAT via PowerShell downloader. Talos researchers warn that Russia-linked APT group Gamaredon (a.k.a.

Phishing 112

Phishing Antivirus Encryption Hacking 112

Security Affairs

JUNE 9, 2025

Cyber criminals gain unauthorized access to home networks by either configuring the product with malicious software prior to the users purchase or infecting the device as it downloads required applications that contain backdoors, usually during the set-up process. 3 ” reads the alert published by the FBI. ” BADBOX 2.0

IoT 145

IoT Internet Internet Advertising 145

Security Affairs

FEBRUARY 24, 2025

CYFIRMA researchers discovered that the SpyLend Android malware was downloaded 100,000 times from the official app store Google Play. The Finance Simplified app is still available on Google Play at the time of this reports publication, with downloads doubling to 100,000 in a week. ” reads the report published by CYFIRMA.

Malware 118

Malware Marketing Hacking Mobile 118

Security Affairs

JULY 30, 2024

A new version of the Mandrake Android spyware has been found in five apps on Google Play, which have been downloaded over 32,000 times since 2022. Researchers from Kaspersky discovered a new version of the Mandrake Android spyware in five app on Google Play, totaling over 32,000 downloads between 2022 and 2024.

Spyware 126

Spyware Malware Mobile Marketing 126

Security Affairs

JANUARY 4, 2025

The campaign is still ongoing and the malicious packages collectively totaled more than one thousand downloads. The attack has led to the identification of 20 malicious packages published by three primary authors, with the most downloaded package, @nomicsfoundation/sdk-test , accumulating 1,092 downloads.”

Encryption 133

Encryption Hacking Cybercrime Information Security 133

Security Affairs

MARCH 15, 2025

The attack involves executing a cmd script followed by a PowerShell script, which downloads three executables, including the Amadey botnet and two.NET executables (32-bit and 64-bit). The malware, dubbed PackerE, downloads an encrypted DLL (PackerD1) that employs multiple anti-analysis techniques.

Software 117

Software Cryptocurrency Malware Encryption 117

Security Affairs

DECEMBER 21, 2024

” Recently, The Federal Office for Information Security (BSI) announced it had blocked communication between the 30,000 devices infected with the BadBox malware and the C2. BadBox can also download additional payloads, amplifying the risks for the users. .” continues the report “Second, let’s talk volume.

Firmware 142

Firmware Malware Internet Internet 142

Security Affairs

APRIL 23, 2025

is the recommended library for integrating a JavaScript/TypeScript app with the XRP, it has more than 140.000 weekly downloads. Hundreds of thousands of applications and websites use this package, the package has been downloaded over 2.9 It is the official SDK for the XRP Ledger, with more than 140.000 weekly downloads.”

Cryptocurrency 107

Cryptocurrency Malware Hacking Risk 107

Security Affairs

MAY 5, 2025

“The campaign leveraged fake CAPTCHA verification pages (ClickFix/KongTuke lures) to trick users into executing a copied PowerShell command, which downloaded and ran MintsLoader” The experts observed other infection chains that used fake invoice files (e.g., “Fattura####.js”)

Malware 126

Malware Phishing Threat Reports Encryption 126

Malwarebytes

NOVEMBER 12, 2024

Customers were only able to look at their test results online, these were not downloadable, so now they are not only unable to see them, but they also have no idea what has happened to that data. Keep threats off your devices by downloading Malwarebytes today. The atlasbiomed.com domain appears to be inactive.

Insurance 145

Insurance Accountability Risk Data breaches 145

Security Affairs

NOVEMBER 26, 2024

We’ve archived the leak and made it available for download on GitHub.” We've archived the leak and made it available for download on GitHub. ” Yesterday Banshee Stealer, the MacOS-based Malware-as-a-Service infostealer, had their source code leaked online.

Malware 143

Malware Cryptocurrency Encryption Hacking 143

Security Affairs

JUNE 18, 2025

Attackers exploit CVE-2025-3248 in Langflow servers to deliver Flodrix botnet via downloader scripts, Trend Research reports. Attackers exploit the flaw to run scripts on Langflow servers, downloading and installing Flodrix malware. Once satisfied, they download and execute the Flodrix botnet malware from a remote server.

DDOS 109

DDOS Malware Encryption Hacking 109

The Last Watchdog

DECEMBER 5, 2024

5, 2024, CyberNewswire — One Identity proudly announces it has been named a winner in the Hot Company: Privileged Access Management (PAM) category in the 12th annual Cyber Defense Awards by Cyber Defense Magazine (CDM), the industrys leading information security magazine. Alisa Viejo, Calif., Ackerman Jr.

InfoSec 130

InfoSec Cyber Risk CISO Cybersecurity 130

Security Affairs

APRIL 28, 2025

A large-scale phishing campaign targets WordPress WooCommerce users with a fake security alert urging them to download a ‘critical patch’ hiding a backdoor. Patchstack researchers uncovered a large-scale phishing campaign targeting WordPress WooCommerce users with a fake security alert.

Phishing 90

Phishing DDOS Accountability Hacking 90

Security Affairs

OCTOBER 22, 2024

Once executed, it downloads the payload directly into memory. “Once opened, the LNK file executes a Powershell command to download an MSI file from a remote server, renames it as “%AppData%y.msi”, and then executes/installs it using the Microsoft msiexec.exe tool.” lnk” that, once executed, starts the attack chain.

Malware 123

Malware Phishing Ransomware Hacking 123

Security Affairs

MAY 12, 2025

Users seeking free AI video tools unknowingly download Noodlophile Stealer, a new malware that steals browser credentials, crypto wallets, and may install remote access trojans like XWorm. Users are tricked into downloading a malicious ZIP (“VideoDreamAI.zip”) after uploading media.

Malware 110

Malware Media Cybercrime Scams 110

Krebs on Security

DECEMBER 1, 2022

When a support technician wants to use it to remotely administer a computer, the ConnectWise website generates an executable file that is digitally signed by ConnectWise and downloadable by the client via a hyperlink. ” A composite of screenshots researcher Ken Pyle put together to illustrate the ScreenConnect vulnerability.

Phishing 322

Phishing Architecture Passwords Accountability 322

Security Affairs

DECEMBER 2, 2024

WebTunnel is a stealthy bridge that blends with web traffic, with a small download size and uTLS integration, making it safer and harder to detect for users. Russian watchdog Roskomnadzor is making some bridges inaccessible, highlighting the urgent need for more WebTunnel bridges.

Government 127

Government Internet Internet Hacking 127

Security Affairs

NOVEMBER 27, 2024

. “The compromise chain is composed of a fake website that redirects the potential victim to the server hosting the exploit, and should the exploit succeed, shellcode is executed that downloads and executes the RomCom backdoor.” This leads to downloading and executing the RomCom backdoor from C2 servers like journalctd[.]live,

Cybercrime 111

Cybercrime Hacking Government Information Security 111

Krebs on Security

APRIL 20, 2023

In late March 2023, 3CX disclosed that its desktop applications for both Windows and macOS were compromised with malicious code that gave attackers the ability to download and run code on all machines where the app was installed. “This could cause the file to run when double-clicked instead of opening it with a PDF viewer.”

Malware 337

Malware Software Technology Accountability 337

Security Affairs

APRIL 17, 2025

In this attack phase, a PowerShell script downloads an archive from the command-and-control server containing the Node.js In a documented instance, attackers used a ClickFix social engineering tactic to trick users into running a PowerShell command that downloads and installs Node.js runtime and a compiled JavaScript file. components.

Social Engineering 115

Social Engineering Malware Cryptocurrency Engineering 115

Security Affairs

MAY 4, 2025

Researchers found 3 malicious Go modules with hidden code that can download payloads to wipe a Linux system’s main disk, making it unbootable. ” The executions of the malicious modules can cause total data loss, major downtime, and severe financial and reputational harm, highlighting the need for strong supply chain security.

Software 110

Software Hacking Malware Cybercrime 110

Security Affairs

FEBRUARY 13, 2025

PCMag cited the case of a gamer who downloaded the game and reported that his accounts were hijacked using stolen cookies. SteamDB estimates that over 800 users may have downloaded the game. According to the website PCMag , the free-to-play game PirateFi was released last week. A few days later, Valve notified impacted users.

Malware 109

Malware Antivirus Accountability Software 109

Security Affairs

OCTOBER 23, 2024

“Afterwards, the attacker downloaded and deployed the SRBMiner cryptominer from GitHub, and started mining to their cryptocurrency wallet and public IP address.” The attacker downloads SRBMiner from GitHub, unzips it into a temporary directory, and deploys it in the /usr/sbin directory. continues the analysis.

Cryptocurrency 117

Cryptocurrency Authentication Hacking Cybercrime 117

Security Affairs

OCTOBER 29, 2024

The threat actors use the Civil Defense website to distribute multiple software programs that, once installed, download different malware families. The site provides a downloader called Pronsis Loader to Windows users, this malware starts an attack chain, ultimately installing SUNSPINNER and the PURESTEALER information stealer.

Malware 119

Malware Social Engineering Software Mobile 119

Security Affairs

FEBRUARY 12, 2025

Upon running the code as an administrator, it downloads and installs a browser-based remote desktop tool and downloads a certificate file with a hardcoded PIN from a remote server. When opened, they execute PowerShell or Mshta to download malware like PebbleDash and RDP Wrapper, to control the infected systems.

Phishing 88

Phishing Malware Security Intelligence Hacking 88

Security Affairs

NOVEMBER 15, 2024

To extract cookies from Chromium-based browsers, it downloads a module from the C&C to bypass App-Bound encryption. Upon execution, Glove Stealer pretends to search for system errors while secretly contacting a command-and-control (C&C) server to harvest and exfiltrate data. ” reads the report published by Gen Digital.

Encryption 116

Encryption Password Management Cryptocurrency Social Engineering 116

Security Affairs

OCTOBER 21, 2024

This file contained an authentication token that allowed the attacker to download the Internet Archive’s source code, which included additional credentials and tokens. This allowed the threat actor to download the organization’s user database, further source code, and modify the site.

Internet 127

Internet Internet Data breaches Authentication 127

Security Affairs

JANUARY 22, 2025

Attackers can exploit a vulnerability, tracked as CVE-2025-0411 , in the free, open-source file archiver software 7-Zip to bypass the Mark of the Web (MotW) Windows security feature. Mark of the Web (MotW) is a security feature in Microsoft Windows that identifies files downloaded from untrusted sources, such as the internet.

Software 125

Software Internet Internet Hacking 125

Security Affairs

MARCH 24, 2025

Initially, the group published screenshots of stolen data as proof of the attack, now the whole archive can be downloaded from the leak page. The group said that the waiting period had expired and claimed the theft of 134GB of sensitive data.

Ransomware 102

Ransomware Hacking Social Engineering Manufacturing 102

Security Affairs

MARCH 20, 2025

The script will download and run the.NET bootloader MSCommondll.exe,which in turn will download and run the malware DarkCrystal RAT. The RAR archive analyzed by the Ukrainian CERT-UA contains the document Algorithm_LegalAid.xlsm.Upon opening the document and enabling the macro, a PowerShell command will be executed.

Computers and Electronics 107

Computers and Electronics Telecommunications Malware Surveillance 107

Security Affairs

OCTOBER 19, 2024

This led to a zero-click attack, requiring no user interaction, as the ad program automatically downloaded and rendered the malicious content. APT37 exploited this flaw to trick victims into downloading malware on their desktops with the toast ad program installed. dll), allowing type confusion to occur.

Internet 142

Internet Internet Engineering Malware 142

Security Affairs

OCTOBER 29, 2024

The latest patch builds are available for download on mysonicwall.com “ In September, SonicWall warned that the flaw CVE-2024-40766 in SonicOS is now potentially exploited in attacks. The latest patch builds are available for download on mysonicwall.com ,” warns the updated SonicWall advisory.

VPN 128

VPN Ransomware Firewall Internet 128

Security Affairs

NOVEMBER 21, 2024

. “In January, someone leaked the personal information of 263 journalists who had signed up to cover presidential activities.” “In that case, officials at the president’s press office later said the information appeared to have been downloaded using the password of a former employee.”

Government 144

Government Hacking Ransomware Insurance 144

Security Affairs

JANUARY 20, 2025

” The malicious packages discovered by the experts are posing as Solana tools and have 130+ downloads, using Nodemailer to steal keys via Gmail and automate wallet draining. “It is important to verify a packages authenticity by examining its download counts, publisher history, and any associated GitHub repository links.

Authentication 101

Authentication Malware Hacking Accountability 101

Security Affairs

DECEMBER 27, 2024

projects or npm packages downloaded from GitHub or Bitbucket. Loaders for OtterCookie download JSON data from a remote source and execute the cookie property as JavaScript code. Attackers may also directly download and execute JavaScript, with control passing to a catch block when an HTTP 500 status code occurs.

Malware 87

Malware Cryptocurrency Software Hacking 87

Security Affairs

DECEMBER 26, 2024

” Upon exploiting the vulnerability, the malicious code can inject commands via the ntp parameter, allowing attackers to download Mirai-based malware through HTTP POST requests over port 80, referencing IP Address :80/cfg_system_time.htm in the HTTP Referer header. dyn” for C2 communication.

Manufacturing 88

Manufacturing Malware Firmware IoT 88