3 casos · pág. 1/1
A ClickFix malvertising campaign uses sponsored Google results for "amazon business" to lure victims to a fake Amazon login page on Google Sites and then to a fake CAPTCHA. The CAPTCHA pastejacks a command into the clipboard that the victim is told to run in the Windows Run box. The command abuses the legacy finger.exe utility to fetch a …
FortiGuard Labs analyzed a SectopRAT variant that is embedded in legitimate software to evade detection. The malware uses a multi-stage loader to extract its payload from files, then applies API hashing, indirect function calls and in-memory loading to run the final .NET payload. Once running, it sets up encrypted communication with its C…
SafeDep reports that the PolinRider loader family now resolves its C2 servers from Ethereum mainnet. The loader reads small transactions from operator wallets and decodes the recipient address as an IP:port. SafeDep confirmed 35 GitHub repositories carrying the loader at HEAD on 2026-09-30 (7,578 stars and 2,884 forks combined). The inves…
