New Magecart skimmers practice steganography, data transfer via WebSocket
Malware
Malware attack compromises over 200K SelectBlinds customersSC StaffNovember 7, 2024Such malware compromise, which was only identified in late September, has impacted login information, names, phone numbers, emails, shipping and billing addresses, and payment card details with CVV codes and expiration dates belonging to individuals who had visited the SelectBlinds website's check-out page.Bogus game-related apps leveraged for new Winos4.0 malware deploymentSC StaffNovember 7, 2024Attacks involving Winos4.0 commence with the retrieval of a bogus BMP file and the eventual extraction of the "you.dll" file, which downloads additional files to facilitate the installation of API-loading shellcode and the launching of a DLL file that facilitates crash restarts, clipboard content recording, system information gathering, and crypto wallet extension and antivirus app monitoring.Microsoft services exploited for stealthy malware deploymentSC StaffNovember 7, 2024Threat actors using an account from a previously targeted organization dubbed "Org A" impersonated IT staff to target employees of a U.S. critical infrastructure entity dubbed "Org C" with Teams messages seeking remote system access permissions via Quick Assist, an analysis from Hunters revealed.Attacks with novel SteelFox trojan hit Windows machinesSC StaffNovember 7, 2024Malicious posts detailing instructions for downloading cracked software on torrent trackers and forums enable deployment of SteelFox and acquisition of administrator access, which is then leveraged to establish a WinRing0.sys driver susceptible to privilege escalation via the CVE-2020-14979 and CVE-2021-41285 flaws, according to an analysis from Kaspersky.We’re Not Saying “I told you so” – PSW #850November 6, 2024In the news: Pacific Rim, Linux on Windows for attackers, one of the worst cases of a former employee's retaliation, Zery-Day FOMO, we predicted that, hacking for fun, working hard for no PoC, an LLM that discovers software vulnerabilities, absurd fines, long usernames and Okta, and paying a ransom with dough! Novel ToxicPanda Android banking trojan used in global attacksSC StaffNovember 6, 2024Widely used apps, including Google Chrome and Visa, have been impersonated by ToxicPanda, which when installed not only aims for privilege escalation and user input modification but also one-time password compromise to facilitate on-device fraud involving unauthorized money transfers.