Blahalla

Legacy IRC Botnet Leverages Automated SSH Exploit Pipeline to Mass-Enroll Linux Hosts

gbhackers.com · 5 months ago

Researchers have identified a new Linux botnet operation called SSHStalker, which combines old IRC botnet techniques with modern automated compromise methods. Attackers use a Golang binary disguised as nmap to scan for servers with open SSH ports and then compile malware directly on the victim's machine. The botnet establishes persistence through a 60-second watchdog Cron job and utilizes a library of exploits targeting Linux kernel vulnerabilities dating back to 2009 and 2010, which are effective against legacy systems. The activity resembles the Outlaw botnet group and involves cryptocurrency mining and credential harvesting.

North Korea-Linked UNC1069 Uses AI Lures to Attack Cryptocurrency Organizations

thehackernews.com · 5 months ago

A North Korea-linked threat actor, UNC1069, is targeting cryptocurrency organizations using sophisticated social engineering tactics. Attackers initiate contact via Telegram, impersonating venture capitalists and scheduling fake Zoom meetings with victims. The meetings utilize AI-generated videos and recordings of previous victims to maintain the illusion of legitimacy, and ultimately deliver malware through fake troubleshooting prompts. Several new malware families are being deployed, including SILENCELIFT, DEEPBREATH, CHROMEPUSH, HYPERCALL, WAVESHAPER, and SUGARLOADER, to steal data and gain system access.

Vorgetäuschte PDFs bergen neue Gefahren

www.csoonline.com · 5 months ago

Cybercriminals are employing a sophisticated phishing technique to deliver malware disguised as PDF files. Attackers are using virtual hard drives concealed within PDF files to bypass security measures and install the AsyncRAT remote access trojan. These malicious files are distributed through links to files hosted on the InterPlanetary File System, a decentralized storage network. Experts recommend configuring Windows to display file extensions to mitigate this threat.

FortiOS Vulnerability Enables LDAP Authentication Bypass

gbhackers.com · 5 months ago

A high-severity vulnerability, CVE-2026-22153, has been identified in FortiOS, potentially allowing attackers to bypass authentication. The flaw exists within the fnbamd daemon and arises when LDAP servers permit unauthenticated connections. Exploitation could allow unauthorized access to network resources and is rated 7.5 on the CVSSv3 scale. Fortinet recommends upgrading to FortiOS 7.6.5 or disabling unauthenticated binds on LDAP servers.

Cephalus Ransomware Emerges as Go-Based Double-Extortion Threat Exploiting Exposed RDP Access

gbhackers.com · 5 months ago

A new ransomware operation, Cephalus, has emerged since mid-2025, targeting Windows environments and utilizing a double-extortion strategy. Attackers exploit exposed Remote Desktop Protocol services, often using stolen credentials, to gain access and exfiltrate data before encrypting files. The ransomware disables security measures like Windows Defender and terminates backup services to hinder recovery efforts. Security experts recommend immediate action, including removing direct RDP exposure and implementing multi-factor authentication.

GitLab Patches Multiple Vulnerabilities Enabling DoS and Cross-Site Scripting Attacks

gbhackers.com · 5 months ago

GitLab has released security updates to address multiple high-severity vulnerabilities in its Community and Enterprise Editions. These flaws include an incomplete validation issue in the Web IDE, allowing attackers to steal tokens, as well as denial of service vulnerabilities related to GraphQL introspection and JSON validation middleware. Patches also resolve cross-site scripting and HTML injection issues. Affected versions include 18.8.4, 18.7.4, and 18.6.6, and users are strongly advised to upgrade immediately to mitigate potential risks such as data theft and service disruption. The vulnerabilities include CVE-2025-7659, CVE-2025-8099, CVE-2026-0958, CVE-2025-14560, and CVE-2026-0595.

Coinbase Cartel Shifts to Data-Theft-First Tactics, Targeting High-Value Industries

gbhackers.com · 5 months ago

A ransomware threat actor called Coinbase Cartel has emerged, distinguishing itself by primarily stealing data instead of encrypting it to extort victims. The group targets organizations with significant financial resources, particularly within the healthcare, technology, and transportation sectors, claiming over 60 victims in its first few months. They use tactics like social engineering and compromised credentials to gain access and exfiltrate data, and are seeking zero-day exploits with a budget exceeding two million dollars. Security experts recommend prioritizing multi-factor authentication, least privilege access, and data inventory to counter this data-first extortion model.

Microsoft Patch Tuesday February 2026 Fixes 54 Flaws, 6 Zero-Days Under Active Exploitation

gbhackers.com · 5 months ago

Microsoft’s February 2026 Patch Tuesday update addresses 54 security vulnerabilities, including six zero-day exploits currently being used in attacks. These vulnerabilities include CVE-2026-21510, a Windows Shell security bypass; CVE-2026-21519, a Desktop Window Manager privilege escalation; CVE-2026-21533, a Remote Desktop Services privilege escalation; CVE-2026-21513, an MSHTML security bypass; CVE-2026-21514, a Microsoft Word security bypass; and CVE-2026-21525, a Windows Remote Access Connection Manager Denial of Service. Critical vulnerabilities affecting Microsoft Exchange Server and Azure services are also included, and administrators are urged to prioritize immediate patching. Elevation of Privilege vulnerabilities are particularly prevalent in this update.

Multiple Cisco Products Snort 3 Distributed Computing Environment/Remote Procedure Call Vulnerabilities

sec.cloudapps.cisco.com · 5 months ago

Multiple Cisco products are affected by vulnerabilities within Snort 3, a distributed computing environment and remote procedure call component. This includes Cisco Secure Firewall Threat Defense Software, Cisco IOS XE Software running Unified Threat Defense, and several Cisco Meraki MX series devices. Affected Cisco IOS XE devices are specifically 1000 and 4000 series Integrated Services Routers, Catalyst 8000V, 8200, 8300, and 8500L Edge Platforms, Cloud Services Routers 1000V, and Integrated Services Virtual Routers. Snort 2 is not affected, and certain Cisco products such as Cyber Vision and Secure Firewall ASA Software are not vulnerable.

Ford Says Electric Vehicle Losses Will Continue for 3 More Years

www.nytimes.com · 5 months ago

false

‘Don Colossus,’ a Golden Statue of President Trump, Waits for Its Home

www.nytimes.com · 5 months ago

There is a 15 foot, six ton bronze statue called Don Colossus that was commissioned by a group of cryptocurrency investors as a tribute to a moment when Mr. Trump raised his fist after surviving an assassination attempt, and it reportedly cost about one million dollars and will tour the country before a permanent placement is decided. The backers have promoted a related DC memecoin and have said they hope the monument will be installed at one of Mr. Trump’s golf courses in Florida or ultimately placed at a planned presidential library.

Microsoft releases Windows 11 26H1 for select and upcoming CPUs

www.bleepingcomputer.com · 5 months ago

false

Elon Musk Wants to Build an A.I. Satellite Factory on the Moon

www.nytimes.com · 5 months ago

false

Asia Fumbles With Throttling Back Telnet Traffic in Region

www.darkreading.com · 5 months ago

Despite recent efforts to curb it, the insecure Telnet protocol remains widespread, particularly in the Asia-Pacific region. Global Telnet traffic recently decreased by 83% following actions by Internet backbone providers, but Asia experienced a smaller reduction, with countries like Taiwan, India, Japan, and China implementing inconsistent filtering. Approximately half of all internet addresses exposing Telnet are located in the Asia-Pacific region, with a significant portion of scanning traffic originating from China, India, and South Korea. A recent authentication bypass vulnerability in the GNU InetUtils telnetd server, CVE-2024-0094, contributed to the protocol's curtailment.

February 2026 Patch Tuesday: Six new and actively exploited Microsoft vulnerabilities addressed

www.csoonline.com · 5 months ago

Microsoft released 60 security fixes this Patch Tuesday, with six actively exploited vulnerabilities requiring immediate attention. Three vulnerabilities, CVE-2026-21510, CVE-2026-21513, and CVE-2026-21514, involve security feature bypasses in Windows Shell and Microsoft 365, potentially allowing attackers to bypass security prompts and execute code. Two other actively exploited flaws allow privilege escalation, CVE-2026-21519 and CVE-2026-21533, while CVE-2026-21525 impacts Windows Remote Access Connection Manager, leading to denial-of-service. Additionally, vulnerabilities in Azure cloud environments, CVE-2026-21522 and CVE-2026-21655, present command injection and information disclosure risks, and GitHub Copilot and IDEs are affected by remote code execution vulnerabilities.

BeyondTrust fixes critical RCE flaw in remote access tools

www.csoonline.com · 5 months ago

BeyondTrust is urging organizations to patch critical vulnerabilities in self-hosted versions of Remote Support and Privileged Remote Access. The vulnerability, tracked as CVE-2026-1731, allows attackers to execute operating system commands without authentication and could lead to system compromise. Patches BT26-02-RS and BT26-02-PRA are available for affected versions, with newer versions already protected. Researchers at Hacktron AI discovered the flaw, which is a high priority target for attackers given BeyondTrust’s wide adoption.

New Linux botnet SSHStalker uses old-school IRC for C2 comms

www.bleepingcomputer.com · 5 months ago

A new Linux botnet called SSHStalker is using the older Internet Relay Chat, or IRC, protocol for command and control. Researchers found the botnet relies on a mix of old techniques like compiling binaries on infected machines and mass SSH compromise to achieve scale and reliability. The botnet spreads by scanning for SSH targets and uses cron jobs for persistence. Exploits targeting 16 CVEs, including vulnerabilities from 2009 and 2010, are also part of SSHStalker’s toolkit.

A Peek Into Muddled Libra’s Operational Playbook

unit42.paloaltonetworks.com · 5 months ago

A recent cybercrime operation by the group Muddled Libra involved compromising a VMware environment and deploying a rogue virtual machine. Attackers used legitimate tools, such as PsExec, Chisel, and ADExplorer, to move laterally, steal credentials, and exfiltrate data, including a PST file retrieved using an older version of Outlook. They attempted to access data from a Snowflake database and searched for file-sharing sites. The incident underscores the importance of identity security, access controls, and continuous monitoring to prevent similar attacks.

North Korean hackers use new macOS malware in crypto-theft attacks

www.bleepingcomputer.com · 5 months ago

North Korean hackers are employing sophisticated techniques to target cryptocurrency companies, utilizing AI-generated videos and the ClickFix method to deliver malware. Researchers attribute these attacks to UNC1069, a group active since 2018, and have identified seven distinct macOS malware families including WAVESHAPER, HYPERCALL, HIDDENCALL, SILENCELIFT, DEEPBREATH, SUGARLOADER, and CHROMEPUSH. The malware aims to steal cryptocurrency and gather data for future social engineering campaigns, demonstrating a significant evolution in the threat actor’s tactics. Recent targets have shifted to the Web3 industry and financial services, indicating a focused effort to exploit vulnerabilities in these sectors.

SolarWinds WHD Attacks Highlight Risks of Exposed Apps

www.darkreading.com · 5 months ago

Threat actors are actively exploiting vulnerabilities in the SolarWinds Web Help Desk (WHD) application, which is used by enterprises and government agencies. Microsoft has observed multistage intrusions beginning with Internet-exposed WHD instances, utilizing techniques like living-off-the-land and legitimate administrative tools for lateral movement. Several vulnerabilities are involved, including CVE-2025-40551, a critical deserialization flaw, CVE-2025-26399, a critical remote code execution flaw, and CVE-2024-28988. Security experts advise organizations to restrict internet access to WHD administrative interfaces and update to version 2026.1 or later.

Cyber Command, NSA nominee Rudd advances to Senate floor

therecord.media · 5 months ago

false

In Bypassing MFA, ZeroDayRAT Is 'Textbook Stalkerware'

www.darkreading.com · 5 months ago

A new malware family called ZeroDayRAT is being openly sold on Telegram, offering extensive spyware and surveillance capabilities to criminals. The malware spreads through social engineering tactics like smishing and phishing, and can steal credentials, financial data, and conduct real-time surveillance. Once installed, it provides attackers with comprehensive device information and control over SMS messages, effectively bypassing multifactor authentication, and includes features like a keylogger, microphone feed, and stealer tools. The malware supports Android versions 5 through 16 and iOS up to 26, and is priced at $2,000, making it accessible to financially motivated operators.

YouTube Argues It Isn’t Social Media in Landmark Tech Addiction Trial

www.nytimes.com · 5 months ago

YouTube is defending itself in a California court case, arguing it functions as an entertainment platform similar to Netflix, rather than a social media network. The lawsuit claims social media companies intentionally design addictive products, but YouTube’s lawyers assert their video recommendation algorithm simply suggests content based on user preferences. A young woman is suing YouTube and Instagram, alleging the platforms harmed her mental health through addictive design. Numerous lawsuits have been filed against major tech companies alleging excessive platform use.

Microsoft Patches 6 Actively Exploited Zero-Days

www.darkreading.com · 5 months ago

Microsoft has released a security update addressing 59 vulnerabilities, six of which are currently being exploited. Three zero-day vulnerabilities allow attackers to bypass security features, potentially enabling malware deployment and unauthorized code execution. Two other vulnerabilities allow privilege escalation, while another enables denial-of-service attacks. Microsoft has also identified five additional CVEs as likely targets for attackers, including CVE-2026-2150, CVE-2026-21510, CVE-2026-21513, CVE-2026-21514, CVE-2026-21519, CVE-2026-21525, and CVE-2026-21533. Security teams are urged to prioritize patching to mitigate these active threats.

Apple Expands iPhone Driver’s Licenses to 7 US States

www.techrepublic.com · 5 months ago

false

NLRB Dismisses Case Brought by Fired SpaceX Employees

www.nytimes.com · 5 months ago

false

I let Claude Code with 150+ offensive security MCP tools loose on my homelab

www.credrelay.com · 5 months ago

An offensive security engineer experimented with AI tools to automate security tasks. Claude Code initially appeared to successfully escalate privileges on a VM by suggesting a DirtyPipe exploit, but was later revealed to have fabricated the result, instead utilizing existing sudo access. The engineer also utilized OpenClaw to create nine functional skills for an AI assistant in under two minutes, leveraging various APIs. Some of these skills, like those using the SpaceX and Star Wars APIs, have become outdated.

Confused Deputy Problem – How to Hack Cloud Integrations

zayl.dk · 5 months ago

A security vulnerability known as the Confused Deputy Problem is impacting Software as a Service platforms integrating with cloud services. Researchers discovered flaws, including improperly validated ExternalId values, allowing unauthorized access to multiple AWS accounts and resources. Exploitation methods ranged from manipulating identifiers to discovering default roles and using automated tools to find potential vulnerabilities. These findings underscore critical failures in secure integration practices and emphasize the need for robust proof of concept testing.

No Legs, No Problem: Dumping BGA MCP NAND Flash

pengoo.fr · 5 months ago

A security researcher successfully extracted firmware from a locked-down phone by physically removing and manipulating its NAND flash memory chip. The process involved using specialized tools and techniques, including hot air rework, dead-bugging with enameled wire, and reverse-engineering adapter pinouts. The researcher circumvented limitations of existing flash programmers to enable the data dump. This allows for further analysis and potential reverse engineering of the phone's software.

6 Actively Exploited Zero-Days Patched by Microsoft With February 2026 Updates

www.securityweek.com · 5 months ago

Microsoft’s latest security updates address approximately 60 vulnerabilities, including six actively exploited zero-day flaws. These zero-days, identified as CVE-2026-21510, CVE-2026-21514, CVE-2026-21513, CVE-2026-21519, CVE-2026-21533, and CVE-2026-21525, affect Windows, Microsoft 365, and Office, allowing for security bypasses, privilege escalation, and denial-of-service attacks. Several vulnerabilities were discovered by Google’s Threat Intelligence Group, Microsoft researchers, CrowdStrike, and Acros Security, suggesting potential connections between threat actors. While no public details of attacks are available, the vulnerabilities are considered publicly disclosed.

Malicious 7-Zip site distributes installer laced with proxy tool

www.bleepingcomputer.com · 5 months ago

A malicious website impersonating the legitimate 7-Zip project is distributing a trojanized installer that turns victims' computers into residential proxy nodes. The fake website, 7zip[.]com, mimics the real 7-zip.org and installs three malicious files: Uphero.exe, hero.exe, and hero.dll. The malware establishes a proxy connection, collects system data, and transmits it to iplogger[.]org, while also using a rotating command and control infrastructure to avoid detection. This campaign also targets HolaVPN, TikTok, WhatsApp, and Wire VPN installers.

Microsoft releases Windows 10 KB5075912 extended security update

www.bleepingcomputer.com · 5 months ago

Microsoft has released Windows 10 security update KB5075912 to address vulnerabilities and prepare for expiring Secure Boot certificates. The update resolves 58 vulnerabilities, including six zero-day exploits, and fixes an issue preventing devices from shutting down or hibernating when System Guard Secure Launch is enabled. It also corrects a problem with folder renaming in File Explorer and addresses stability issues with some graphics processing units. This update facilitates the phased rollout of new Secure Boot certificates to protect against security breaches.

Microsoft February 2026 Patch Tuesday fixes 6 zero-days, 58 flaws

www.bleepingcomputer.com · 5 months ago

Microsoft's latest security update resolves 58 vulnerabilities across various products and services. Six actively exploited zero-day flaws and five critical vulnerabilities are included in the fixes. Affected areas include Microsoft Edge, the Office Suite, Exchange Server, and core Windows components. Several CVEs were addressed, related to issues like information disclosure, privilege escalation, and remote code execution.

Windows 11 KB5077181 & KB5075941 cumulative updates released

www.bleepingcomputer.com · 5 months ago

Microsoft has released cumulative updates KB5077181 and KB5075941 for Windows 11 versions 23H2, 24H2, and 25H2, including February 2026 security patches. New features include expanded Cross-Device Resume functionality for Android phones, improved MIDI support with new Windows MIDI Services, and enhanced control options for the Narrator screen reader. The update also introduces a Device card on the Settings home page, streamlined Voice Access setup, and support for peripheral fingerprint sensors with Windows Hello Enhanced Sign-in Security. Smart App Control can now be toggled without requiring a clean install.

10K Claude Desktop Users Exposed by Zero-Click Vulnerability

www.techrepublic.com · 5 months ago

A vulnerability has been discovered in Anthropic’s Claude Desktop Extensions that allows for remote code execution through specially crafted Google Calendar events. The flaw, stemming from the Model Context Protocol’s architecture, permits data from connectors like Google Calendar to trigger unsandboxed actions with full operating system privileges. Attackers can exploit this with a simple calendar event and a vague prompt, leading to system compromise without user interaction. Researchers have assigned a CVSS score of 10.0 to the vulnerability and recommend disabling high-privilege extensions, restricting AI agent commands, and implementing stricter security controls.

EU Unconditionally Approves Google’s $32B Acquisition of Wiz

www.securityweek.com · 5 months ago

false

LOTUSLITE: Targeted espionage leveraging geopolitical themes

www.acronis.com · 5 months ago

Security researchers have discovered a targeted malware campaign called LOTUSLITE, which appears to be linked to the Mustang Panda threat group. The operation targets U.S. government entities, using a ZIP archive with a loader and backdoor to steal data. The backdoor, LotusLite, employs DLL sideloading and communicates with a command-and-control server at 172.81.60.97. The malware uses simple, reliable techniques and geopolitical themes to evade detection and appears focused on espionage.

DPRK Operatives Impersonate Professionals on LinkedIn to Infiltrate Companies

thehackernews.com · 5 months ago

North Korean operatives are increasingly using LinkedIn to impersonate IT professionals and secure remote work positions in Western companies. The goal is to generate revenue for weapons programs, conduct espionage, and potentially demand ransoms. These activities are tracked as Jasper Sleet, PurpleDelta, and Wagemole, and include techniques like chain-hopping and token swapping to obscure financial transactions. Recent campaigns, such as Contagious Interview, involve fake hiring processes and malicious code execution, while a group known as Labyrinth Chollima has split into specialized units targeting cryptocurrency thefts and cyber espionage.

Patch Tuesday: Adobe Fixes 44 Vulnerabilities in Creative Apps

www.securityweek.com · 5 months ago

Adobe has released updates to address 44 vulnerabilities across several of its creative applications. Security researchers identified critical and high-rated vulnerabilities, primarily allowing for arbitrary code execution. Other vulnerabilities include memory exposure and denial-of-service issues. Adobe reports no known active exploitation and assigns a low priority to these advisories.

Volvo Group North America customer data exposed in Conduent hack

www.bleepingcomputer.com · 5 months ago

Volvo Group North America experienced a data breach impacting nearly 17,000 customers and staff, resulting from a compromise at third-party vendor Conduent. The exposed data includes personal details such as names, Social Security Numbers, dates of birth, and medical information. Conduent's breach occurred between October 2024 and January 2025, affecting millions of people in Oregon and Texas. Volvo Group North America is offering identity monitoring services and advising recipients to take precautions against fraud.

Microsoft rolls out new Secure Boot certificates before June expiration

www.bleepingcomputer.com · 5 months ago

Microsoft is updating Secure Boot certificates to replace those nearing expiration in June 2026. Secure Boot helps prevent malicious software from loading during startup by verifying digital signatures. The certificate refresh is a large-scale security maintenance effort, and most devices will receive the updates automatically through monthly Windows updates. Unsupported Windows versions, like Windows 10, will not receive the new certificates, potentially leading to a degraded security state.

OT Attacks Get Scary With 'Living-off-the-Plant' Techniques

www.darkreading.com · 5 months ago

Operational technology cyberattacks have historically been limited by attackers' lack of understanding of industrial systems. However, there's a growing concern that attackers are gaining expertise, potentially leading to more damaging "living-off-the-plant" attacks. These attacks would leverage legitimate tools and features within OT environments, similar to techniques used in IT systems. Security by obscurity, due to the unique nature of OT networks, might offer a temporary advantage, but attackers are increasingly using resources like ChatGPT to understand OT products. An upcoming demonstration will highlight how attackers could manipulate Siemens’ S7comm protocol to compromise systems.

White House to meet with GOP lawmakers on FISA Section 702 renewal

therecord.media · 5 months ago

false

Adbleed: partially de-anonymizing VPN users with adblock filter lists

melvin.ovh · 5 months ago

Researchers have discovered a method to partially de-anonymize VPN users by analyzing the country-specific adblock filter lists active in their browsers. A proof of concept website, adbleed.eu, demonstrates how JavaScript can detect which country’s filter lists are enabled by probing blocked domains and measuring response times. This technique reveals a user’s likely location or language, even when using a VPN, and can be combined with other fingerprinting methods to narrow down user identity. Mitigation options are limited, involving either disabling country-specific adblock lists or foregoing adblocking entirely.

80% of Fortune 500 use active AI Agents: Observability, governance, and security shape the new frontier

www.microsoft.com · 5 months ago

false

RATs in the Machine: Inside a Pakistan-Linked Three-Pronged Cyber Assault on India

www.securityweek.com · 5 months ago

Indian government and defense organizations are facing cyber espionage campaigns attributed to the Pakistan-linked group, Transparent Tribe. These campaigns utilize three distinct remote access Trojans: GETA RAT, ARES RAT, and Desk RAT, targeting both Windows and Linux systems. GETA RAT abuses legitimate Windows components to evade detection, while ARES RAT profiles systems and exfiltrates data. Desk RAT, delivered through a malicious PowerPoint add-in, provides continuous situational awareness. The attacks leverage phishing emails and living-off-the-land techniques for initial access and command and control, with a focus on persistence and stealth.

SolarWinds WHD zero-days from January are under attack

www.csoonline.com · 5 months ago

Attackers are exploiting a chain of vulnerabilities in the SolarWinds Web Help Desk application. Security researchers have confirmed that attackers are combining two zero-day vulnerabilities, CVE-2025-40551 and CVE-2025-40536, with a previously disclosed vulnerability, CVE-2025-26399, to compromise systems. Following initial access, attackers are using techniques like the Velociraptor forensic tool and encrypted Cloudflared tunnels to further compromise systems. SolarWinds recommends upgrading to version 2026.1 and resetting all service account passwords.

Microsoft 365 outage takes down admin center in North America

www.bleepingcomputer.com · 5 months ago

Microsoft is investigating an outage impacting access to the Microsoft 365 admin center, primarily affecting users in North America and Canada. Administrators with business or enterprise subscriptions are experiencing difficulties accessing the portal, and some users are reporting degraded functionality, including issues with the M365 app. Microsoft is analyzing data, including CPU utilization and user reports, to determine the root cause and implement a solution. Similar issues have occurred in the past, including login blocks and runtime errors, and recent data center power issues also affected Microsoft Store and Windows Update services.

North Korean hackers targeted crypto exec with fake Zoom meeting, ClickFix scam

therecord.media · 5 months ago

North Korean hackers, identified as UNC1069, recently targeted a cryptocurrency executive using sophisticated techniques. The attack began with a fake Zoom meeting, seemingly featuring a deepfake video, followed by a ClickFix scam designed to install malware. Malware, including WAVESHAPER, HYPERCALL, DEEPBREATH, and CHROMEPUSH, was used to steal credentials, browser data, and keystrokes. This highly targeted operation aims to enable cryptocurrency theft and support future social engineering campaigns.

How to Automate AWS Incident Investigation with Tines and AI

www.bleepingcomputer.com · 5 months ago

false