/
ttps_attack:T1140 × criticity:high × latest_source_host:securelist.com × limpar

Resultados

3 casos · pág. 1/1

securelist.com · high

MoYu Group (BADBOX-linked) malware spreads via DoFun Android head unit updater, building ad-fraud and proxy botnet

Kaspersky found the first documented Android malware targeting automotive head units, discovered in June 2026. It is a multi-stage downloader whose ultimate purpose is ad fraud and a residential proxy botnet. It spread through the built-in updater (TWCore, package com.tw.core) of DoFun head unit firmware, which installs APKs pushed over a…

securelist.com · high

ValleyRAT backdoor distributed via trojanized QN Wallpaper adware installer using libcef.dll sideloading, likely Silver Fox

Kaspersky analysis of an installer first classified as adware (MD5 c24e99f9437feacaa63766a3cde3fe3d) found that it delivers the ValleyRAT backdoor. The installer drops a modified, signed Chinese wallpaper tool, QN Wallpaper, and uses it for DLL sideloading of a malicious libcef.dll. The adware's advertising function does not work. Attacke…

securelist.com · high

MacSync macOS stealer returns with binary droppers, iCloud calendar staging and a backdoor targeting crypto users and developers

Kaspersky researchers describe a new MacSync macOS infostealer variant, first seen in the wild in September 2026, that replaces the earlier AppleScript-based droppers with FAT Mach-O binaries written in Objective-C and Swift. MacSync is sold as malware-as-a-service, so delivery varies by operator. In this campaign it spread through malici…