Gaslight macOS Malware Uses Prompt Injection to Bypass AI Analysis
A new macOS malware called Gaslight uses embedded prompt injection strings and fake debugging data to confuse AI-assisted malware analysis tools. It…
Category: Malware
Malware families, payloads, loaders, ransomware and related tooling.
KuinaExtractor Rust Infostealer Targets Browsers and Crypto Wallets
KuinaExtractor is a new Rust-based information stealer that harvests web browser data, crypto wallets, and credentials for Roblox, Steam, and Discord. It…
SHARDLOADER: DLL Sideloading Malware Loader
SHARDLOADER is a malware loader used by Mustang Panda that sideloads a malicious DLL through legitimately signed binaries like Solid PDF Creator…
MINIRECON: Toneshell Variant Backdoor
MINIRECON is a reworked variant of the Toneshell backdoor, beaconing over WebSocket on HTTPS, used by Mustang Panda.
ZOHOMURK: Zoho WorkDrive Dead Drop Malware
ZOHOMURK is a novel malware that uses hardcoded Zoho OAuth credentials to turn an attacker-controlled WorkDrive account into a dead drop for…
Toneshell: Backdoor Malware
Toneshell is a backdoor malware documented by IBM X-Force, used as a base for the MINIRECON variant by Mustang Panda.
LOTUSLITE: Backdoor Malware
LOTUSLITE is a backdoor used by Mustang Panda in attacks on India's banking sector and South Korean policy circles, staged through legitimate…
ShadowPad Backdoor
A modular backdoor malware previously hosted on the same staging server used in the Thai Ministry of Finance attack. It is known…
PteroSand: Gamaredon Malware Payload
PteroSand is a malware payload delivered by Gamaredon via HTA downloaders in spear-phishing campaigns targeting Ukraine.
PteroLNK: Gamaredon Weaponizer for Lateral Movement
PteroLNK is a weaponizer used by Gamaredon to infect USB and network drives with malicious LNK files for lateral movement.