Hackers Abuse ScreenConnect and Quick Assist to Deploy Persistent Windows Backdoors
Threat actors are abusing legitimate remote-management tools, including ConnectWise ScreenConnect and Microsoft Quick Assist, to install persistent backdoors on Windows devices.
Huntress researchers identified...
Gryxa Toolkit Collects Windows Logs to Learn How Defenders Tried to Remove It
The toolkit uses legitimate remote monitoring and management (RMM) software for covert access, maintains several recovery mechanisms, steals browser-stored credentials, and can retaliate by...
Hackers Use Fake Google Gemini App to Steal Windows Users’ Browser Credentials
Threat actors are increasingly abusing the growing popularity of generative AI tools to spread malware. In a recent incident observed by Darktrace, attackers used...
Shadow hVNC Lets Hackers Operate a Second Windows Desktop Invisible to the Victim
Cybersecurity researchers have uncovered a feature-rich malware strain called Shadow hVNC that gives attackers control of a hidden Windows desktop on an infected system....
Windows Malware Corrupts PE Headers While Dropping Files to Evade On-Access Scanners
Researchers have uncovered a custom Windows backdoor that uses several low-noise techniques to avoid detection, including corrupting executable headers while writing dropped files to...