T1059.005 - Visual Basic

Supply Chain Attack Compromises Popular Rust Crates to Deliver Malware

North Korean Hackers Target macOS Users in Cryptocurrency Theft Campaign

CISA Warns of Exploitation of 17-Year-Old Excel Vulnerability

Multi-Stage Malware Campaign Utilizing Obfuscated VBS and PNG Loaders

North Korean Sapphire Sleet Targets macOS Users in New Social Engineering Campaign

North Korean ClickFake Campaign Targets Web3 Professionals with RATs

SmartApeSG Campaign Distributes Multiple RATs via ClickFix Technique

New ChainScript RAT Exploits ClickFix Lures with Blockchain C2

Vidar Infostealer Adopts Fileless Techniques Using JPEG and TXT Payloads

Malicious LNK Files Disguised as Documents Deliver Fileless Malware

Rogue ScreenConnect Clients Spread Malware Like a Worm

Widespread Abuse of ScreenConnect to Deploy AsyncRAT via Fake Installers

WhatsApp Malware Campaign Exploits VBS Files for Remote Access

Mini Shai-Hulud Supply Chain Attack Targets SAP npm Packages

New Remcos RAT Campaign Exploits CVE-2017-11882 via Phishing

Credential Sniffing Malware Disguised as Windows 11 Update Targets Users

XCSSET Malware Evolves with Enhanced Obfuscation and Persistence Techniques

Grandoreiro Banking Trojan Expands Global Reach with New Campaigns

Active Malware Campaign Distributes VBScript via Compromised WhatsApp Accounts

XCSSET Malware Targets macOS Developers Through Xcode Projects

New Horabot Campaign Targets Victims in Mexico with Banking Trojan

LeakNet Ransomware Expands Tactics with ClickFix and Deno Loader

JanelaRAT Malware Campaign Targets Latin American Financial Sector

InstallFix Campaign Exploits AI Trust to Deliver Malware via Fake Install Pages

Bank of America Phishing Scam Installs ScreenConnect Malware

SeasonalInvite Phishing Campaign Targets Users with Fake eCards

WhatsApp Malware Campaign Targets Finance Professionals

MacSync Infostealer Exploits Google Search for Claude Installation

Fake CCleaner Installer Distributes GhostDesk Spyware via Chrome

Attackers Exploit AI Brand Trust to Distribute Malware

Bybit Exposes Multi-Stage Malware Targeting Claude Code Users

PamStealer: New macOS Infostealer Targets Users via Fake Maccy Manager

Phishing Campaign Exploits Google Storage to Deploy Remcos RAT

Emerging Cyber Threats: CRPx0 Ransomware and TeamPCP Supply Chain Attacks

Lampion Malware Campaign Targets Portuguese Organizations with Phishing Attacks

MioLab MacOS Stealer Targets Users with Advanced Theft Techniques

Cargo Theft Actor Exploits Load Boards for Extended Operations

Millenium RAT 4.* Enhances Stealth with Base64 and XOR Encryption

DarkMe RAT Campaign Shifts to Phishing Tactics

Phishing Campaign Uses Fake Resumes for Credential Theft and Crypto Mining

APT28's Operation MacroMaze: Macro Malware Campaign Targets Europe

TASK#STOMP: Advanced PowerShell Backdoor Stealing Sensitive Data

Credential Theft Operation Poisson Targets French Business with Persistent Access

ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits

Microsoft spots new twist on ClickFix "cache smuggling"

Active Exploitation Alert: China-Nexus UAT-11587 Deploys Antino Backdoor Leveraging Microsoft 365 Outlook and OneDrive for Stealthy Cyber-Espionage in Asia and Middle East

Antino Backdoor Lets China-Linked UAT-11587 Turn Microsoft 365 Into a C2 Channel

Zero

ClickFix Attacks Spread ChainScript RAT via Fake Spotify and Teams Installers

Task Stomp Powershell Backdoor Document Theft Remote Access

TASK#STOMP PowerShell Backdoor Steals Documents, Wi-Fi Passwords, and Clipboard Data

ChainScript: the RAT that hides its command server inside a blockchain contract

The TASK#STOMP Windows backdoor takes Wi-Fi passwords, screenshots, and business files

Macsync The Evasive Macos Stealer Exploiting Clickfix Lures

ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure

Quick Heal Technologies Limited Warns of Evolving WhatsApp Malware Campaign Targeting Finance Teams, Executives and Business Users

Field Effect

Macsync Stealer C2 Infrastructure Rotation

Hunting Macsync Stealer Infrastructure Through Behavioral Pivots

MacSync Stealer Uses ClickFix and Chunked Exfiltration

New Xcsset Malware Adds New Obfuscation Persistence Techniques To Infect Xcode Projects

Attackers use rogue ScreenConnect clients to spread malware

Hijacked ScreenConnect Installs Are Spreading Malware Like a Worm, Huntress Warns

Extradited Russian Hacker Faces Charges Over Excel Malware Campaign That Infected Thousands

Russia-linked hackers use reverse jailbreaks to evade AI malware checks

Iranian Hackers Pose as Recruiters to Deliver Cross

Russia-Aligned UAC

Anatomy of BraZetsu: How Cybercriminals Fuel the Underground Ecosystem | Group

Russian hackers plant nuclear weapon prompt in malware to trip AI safety guardrails

CRPx0 - Threat Actor Profile

Hackers poison arrayref Rust crate to push infostealer malware

Malicious Rust Crate Arrayref Runs a Build

Cyber Conflict Decoy Document

Fake AI, real malware: Attackers impersonating AI brands

MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer

Fake CCleaner downloads turn Chrome into a credential

Fake Bank of America Phishing Scam Installs Remote Access Malware

Fake Zoom update malware campaign expands its reach to macOS

Chaos in Teams vishing

BlueNoroff builds Zoom phishing kit with ChatGPT-made faces

Hackers abuse Notepad++ plugins to stealthily install malware