BusySnake Stealer Targets Browser Passwords, Cookies, Telegram Sessions, and Crypto Keys
BusySnake Stealer, a previously undocumented Python-based infostealer actively deployed by an emerging APT we track as Armored Likho (aka Eagle Werewolf).
BusySnake is purpose-built...
CrownX Ransomware Embedded Inside Avalon Framework Targets Recovery and Backup Systems
A previously undocumented multi-stage malware framework, tracked as Avalon, that embeds a ransomware component internally labeled CrownX and specifically targets recovery and backup systems....
Hackers Abuse EdgeUpdate and GoogleUpdater to Deploy TimbreStealer Infostealer
A targeted campaign deploying the TimbreStealer infostealer by abusing legitimate updater binaries EdgeUpdate (msedgeupdate) and GoogleUpdater (goopdate) via DLL side-loading.
Researchers Euler Neto and...
Hackers Abuse Verified X Ads to Deliver Mac Malware Through ClickFix Attack
A trusted channels and verified profiles to amplify social-engineering campaigns, and a recent ClickFix-style operation on X (formerly Twitter) illustrates that risk.
The ad...
Malicious npm Packages Use PowerShell and VBS Chain to Drop Windows RAT
Threat actors are increasingly targeting the developer ecosystem by exploiting trust in widely used tools. Recently, researchers uncovered a sophisticated campaign using malicious npm...