| DATE |
|
NAME |
INFO |
CATEGORIE |
WEB |
|
7.10.26 |
 |
CrocoRat Adds a New Twist to ClickFix with DNS Payload
Delivery |
ClickFix campaigns have become one of the most effective ways to
turn a browser session into code execution. The technique is simple: show the
victim a fake verification page, place a command on the clipboard, and convince
them to paste it into the Windows Run dialog. |
Virus |
Flare |
|
24.9.26 |
|
MacSync under the microscope: new delivery methods and a
new payload |
MacSync is a relatively young, rapidly
evolving family of crypto/info stealers. First advertised on the dark
web in 2025 as Mac.c, the stealer was later renamed to MacSync by its
creators. The initial versions were implemented as AppleScripts and
closely resembled the AMOS stealer family, but over time, MacSync
developed distinctive features of its own, including a backdoor module. |
Virus |
SECURELIST |
|
22.9.26 |
|
LausivLoader analysis, or how to pass data between
malware stages |
At the end of August, a malspam message was caught in the
quarantine of a mail gateway operated by one of my customers. The
message was not especially remarkable – it asked the recipient to review
some attached requirements and provide a price quotation for a fiber
optic system and appeared to impersonate an employee of a legitimate
company. |
Virus |
SANS |
|
22.9.26 |
|
Vidar Adds Virtual Machine and Custom Stream Ciphers For String Obfuscation |
Vidar is an information stealer that was first
observed in 2018. Across its iterations, Vidar has
continued to improve its string obfuscation to make
detection and analysis more difficult by changing
deobfuscation algorithms, constants, and primitives.
From May through early September 2026, Zscaler
ThreatLabz tracked Vidar’s string obfuscation as it
evolved from basic XOR to ChaCha20, and more
recently, to a custom virtual machine (VM), which is
executed via a lightweight bytecode interpreter that
is combined with a custom stream cipher that changes
with each build. |
Virus |
Zscaler |
|
21.9.26 |
|
Exvicy: A copycat of the ErrTraffic malware distribution
framework |
This article details how TDR pivoted from a forum advertisement to identify
confirmed operator infrastructure, analyzes the Exvicy infection chain, and
provides code evidence establishing that this emerging MaaS is a direct copycat
of the adopted ErrTraffic framework. |
Virus |
SEKOIA |
|
17.9.26 |
|
The Odyssey and trojans again: MovieReaper attacks users
in multiple countries via compromised torrents |
Torrent trackers have long been abused
for distributing malicious software, disguised as popular films, games,
and other content. Our previous research has shown that cybercriminals
repeatedly turn torrents as an initial infection vector, using
trojanized cracks and installers to reach a large number of users. |
Virus |
SECURELIST |
|
17.9.26 |
|
The extension you never installed: KREMLIN forges Chrome's own
integrity checks to steal banking sessions |
Elastic Security Labs tracked this
malicious browser extension across seven campaigns and 15 months, through
Brazilian bank lures and the Ethereum smart contracts that hold its C2
configuration. |
Virus |
ELASTIC |
|
1.9.26 |
 |
Mirage Kitten targeting aviation and FinTech sectors across the Middle East and
Africa with a new malware set |
While monitoring Mirage Kitten activity, we uncovered a
previously undocumented malware family that we dubbed NodeRabbit. We identified
the first sample on a system in Afghanistan. Further threat hunting revealed two
additional, more advanced, variants: one on a system in Egypt and another on a
system in Ethiopia. |
Virus |
SECURELIST |
|
28.8.26 |
|
ValleyRAT masquerading as adware |
Attackers typically try to
pass off malware as legitimate applications or as potentially unwanted programs
that users deliberately search for and download, such as cheats or cracks. They
often rely on ad and affiliate networks to deliver their creations to victims’
devices. This post examines a less conventional case: a well-known backdoor
distributed under the guise of adware. The attackers may have chosen this
distribution method because the adware was signed by the developer. On top of
that, users often manually add these apps to exclusions, so their useful
features don’t get blocked. |
Virus |
SECURELIST |
|
28.8.26 |
|
Some Malicious PE Stats |
During my last FOR610 session, a student asked me if I had some statistics in
mind about the compilers used to generate malicious PE files? A couple of months
ago, I shared some stats about the trend in 64bits VS. 32bits malware[1]. Can we
go a bit further? I (vibe-)coded a Python script based on the pefile library[2]
to extract some info from the PE headers. Indeed, the PE file format contains a
lot of metadata! They can be accessed using a lot of tools, like Detect It Easy: |
Virus |
SANS |
|
24.8.26 |
|
DOUBLECUP's PNG
Payload |
New malware that uses steganography always gets
my attention, but I was disappointed when I looked at the latest DOUBLECUP
write-up. It doesn't use real
steganography: |
Virus |
SANS |
|
21.8.26 |
|
The invisible passenger in your car |
While monitoring Android threats in June 2026, we discovered a
new piece of Android malware. What struck us as unusual was that it installed
like an ordinary user app yet made no attempt to disguise itself as legitimate
software: it had no user interface at all. This led us to suspect the app might
be reaching users’ devices without their knowledge. Further investigation
confirmed that hypothesis and allowed us to reconstruct the entire infection
chain. |
Virus |
SECURELIST |
|
2.8.26 |
|
Atomic MacOS (AMOS) stealer infection |
This diary provides indicators from an Atomic MacOS (AMOS) stealer infection
that I generated in my lab on July 31st, 2026. This was distributed through a
web page from getmacouscloud[.]com with instructions to paste text into a macOS
Terminal window, supposedly for "macOS toolkit," but instead the text is a
command to retrieve and install AMOS stealer malware.
|
Virus |
SANS |