Internet threat news

SteelFox Seen Using "Bring Your Own Vulnerable Driver" Tactics

According to a new report by security firm Kaspersky, researchers discovered a new crimeware bundle being distributed via forum posts, torrent trackers, and blogs, imitating popular software like Foxit PDF Editor and AutoCAD. The malware itself is capable of extracting the victim's credit card data, details about the infected device, and a cryptocurrency miner.

   
Play Ransomware Attack Linked To North Korean State-Sponsored Threat Actors

According to a new report by Palo Alto’s Unit 42, North Korean state-sponsored threat actors, tracked by the security firm as Jumpy Pisces but also tracked as Andariel, have been linked to the Play ransomware gang.

Researchers believe this is the first instance of the group using existing ransomware infrastructure, potentially acting as an initial access broker (IAB) or an affiliate of the Play ransomware group. This also possibly signals deeper involvement in the broader ransomware threat landscape.

   
Black Basta Threat Actors Pose As Microsoft Teams IT Support

According to a blog article published by ReliaQuest, their security team discovered a new Black Basta ransomware campaign that begins with a spam email, which is then followed by threat actors posing as Microsoft Teams IT Support to trick victims into installing remote access software, which is then used to deploy Black Basta.

   
ClickFix Malware Campaign Compromises 6000 WordPress Sites

A recently published article by GoDaddy's Security Team revealed that a new ClickFix malware campaign targeting vulnerable WordPress sites to deliver information-stealing malware is making the rounds. Information-stealing malware, or info stealers, is somewhat in vogue by financially motivated and state-sponsored threat actors.

   
Over 200 Malicious Apps Were Downloaded Nearly 8 Million Times From Google Play

In a recent report by ZScaler, data collected from June 2023 to April 2024 showed that Google Play, the official store for Android, distributed more than 200 malicious applications, which amounted to nearly eight million downloads. The collected data focused on analyzing malware families on both Google Play and other distribution platforms.

   
Cybercrime Cartels In South East Asia Leveraging AI

According to a recent report by the United Nations Office on Drugs and Crime (UNODC), a large and diverse set of malicious AI tools have been developed across Southeast Asia to supplement the needs of cybercrime cartels across the region.

Tools to generate convincing deep fakes appear to be the most popular, with UNODC recording an exponential increase in Telegram channel mentions, with those channels acting as marketplaces for said tools.

   
Microsoft 365 Users Beware The Mamba

Microsoft 365 users should be aware of a new threat actor offering their services as a phishing-as-a-service platform to conduct Adversary-in-the-Middle (AiTM) attacks for a monthly fee. Called Mamba2FA, not to be confused with Mamba ransomware, the malware targets Microsoft 365 users with well-crafted login pages.

However, the real danger to Microsoft 365 users is the ability to conduct AiTM attacks to capture the victim's authentication tokens and bypass multifactor authentication (MFA) protections on their accounts. The malware costs 250 USD per month, making it incredibly competitive and presenting a significant drop in the skill floor required for threat actors to carry out sophisticated attacks.

   
Law Enforcement Cracks Down On Ransomware

Law enforcement agencies from 12 countries have collaborated to arrest four individuals associated with the LockBit ransomware gang. Along with the arrests' law enforcement officials seized servers critical to the ransomware gang's operations.

Regarding the arrests, a suspected developer of LockBit was arrested at the request of the French authorities, while the British authorities arrested two individuals for supporting the activity of a LockBit affiliate. The Spanish officers seized nine servers, part of the ransomware's infrastructure, and arrested an administrator of a Bulletproof hosting service used by the ransomware group.

   
Threat Actors Seen Deploying AI-Written Malware

In HP Wolf Security's Threat Insights Report September 2024, security researchers detailed a targeted attack in which the threat actors used Generative Artificial Intelligence (AI) to write malware code. This trend has grown since AI tools like ChatGPT were released to the public.

   
Massive Info Stealer Campaign Targets Gamers, Streamers, And Crypto Investors

According to a recently published report by Recorded Future's Insikt Group, security researchers uncovered a massive info stealer malware operation encompassing approximately 30 campaigns.

The targets include a broad spectrum of demographics, including prominent gamers and online streamers. The campaigns also targeted multiple system platforms.

   
Pagers Explode In Lebanon And Syria

In a highly sophisticated remote attack, pagers used by Hezbollah members in both Lebanon and Syria exploded. The detonations happened almost simultaneously, killing at least nine people, including an 8-year-old girl, and wounding thousands more.

   
Windows Vulnerability Actively Exploited By Void Banshee

A recently discovered and patched Windows vulnerability, CVE-2024-43461, has been seen used in the wild by the advanced persistent threat (APT) group Void Banshee. Microsoft describes the vulnerability as a "Windows MSHTML spoofing vulnerability" and first disclosed it to the public following September's Patch Tuesday.

   
Musician Charged With Artificially Inflating Music Streams That Earned $10 Million

In what is most likely the first criminal case involving artificially increasing music streams, one musician has been charged with fraudulently inflating music streams. Michael Smith was charged with developing a scheme to create hundreds of thousands of songs with artificial intelligence and using bots to stream the AI-generated songs billions of times.

As a result of the scheme, Smith fraudulently garnered more than 10 million USD in royalties resulting from the automated streams of AI-generated music.

   
MacroPack Abused By Threat Actors To Deploy Brute Ratel

MacroPack, a framework developed by security researchers for red team exercises, has been abused by various threat actors to deliver several malware payloads to victims. Cisco Talos discovered that threat actors were using MacroPack to deploy malicious payloads that included Havoc, Brute Ratel, and PhatomCore.

   

Page 1 of 55

<< Start < Prev 1 2 3 4 5 6 7 8 9 10 Next > End >>
About PCrisk

PCrisk is a cyber security portal, informing Internet users about the latest digital threats. Our content is provided by security experts and professional malware researchers. Read more about us.

Malware activity

Global malware activity level today:

Medium threat activity

Increased attack rate of infections detected within the last 24 hours.

Virus and malware removal

This page provides information on how to avoid infections by malware or viruses and is useful if your system suffers from common spyware and malware attacks.

Learn about malware removal