Gryxa Toolkit Collects Windows Logs to Learn How Defenders Tried to Remove It
The toolkit uses legitimate remote monitoring and management (RMM) software for covert access, maintains several recovery mechanisms, steals browser-stored credentials, and can retaliate by...
Hackers Use Fake Google Gemini App to Steal Windows Users’ Browser Credentials
Threat actors are increasingly abusing the growing popularity of generative AI tools to spread malware. In a recent incident observed by Darktrace, attackers used...
Shadow hVNC Lets Hackers Operate a Second Windows Desktop Invisible to the Victim
Cybersecurity researchers have uncovered a feature-rich malware strain called Shadow hVNC that gives attackers control of a hidden Windows desktop on an infected system....
Windows Malware Corrupts PE Headers While Dropping Files to Evade On-Access Scanners
Researchers have uncovered a custom Windows backdoor that uses several low-noise techniques to avoid detection, including corrupting executable headers while writing dropped files to...
DCRat Malware Uses DLL Sideloading and Process Hollowing to Hide Inside Trusted Windows Process
The attack ultimately hides a remote-access trojan inside a legitimate Windows-related process, helping it blend into normal endpoint activity.
The campaign uses a fake legal-notice...