PLEASE_READ_ME Ransomware Campaign
A ransomware campaign that compromised over 250,000 MySQL databases by brute-forcing weak credentials, highlighting the risk of exposed databases.
Category: Malware
Malware families, payloads, loaders, ransomware and related tooling.
Malicious JetBrains Plugins Steal AI API Keys; Chrome Extensions Capture Chatbot Chats
Cybersecurity researchers have uncovered a coordinated malware campaign on the JetBrains Marketplace involving 15 malicious plugins that exfiltrate AI provider API keys.…
PromptSnatcher: Chrome Extensions Steal AI Chatbot Conversations
PromptSnatcher is a data collection operation involving two Chrome ad blocker extensions that capture users' conversations with AI chatbots from platforms like…
Havoc: Post-Exploitation Framework
Havoc is a post-exploitation framework used by attackers, including the 'Poisson' operator, to deploy the Demon agent for command and control.
Demon Agent: Havoc’s Implant
The Demon agent is the implant component of the Havoc framework, used for in-memory execution and persistence on compromised systems.
RustDesk: Open-Source Remote Desktop Software Exploited by Armored Likho
RustDesk is an open-source remote desktop software that Armored Likho installs on compromised machines. The stealer prompts victims to enter credentials, then…
Python Keylogger Used by Poisson Operator
A 70-line Python keylogger was deployed by the attacker to capture keystrokes, storing them locally for manual retrieval, targeting banking and email…
Akira Ransomware: Recent Intrusions Using RustDesk
Akira ransomware has been observed using RustDesk in recent intrusions, highlighting the abuse of legitimate tools for malicious purposes.
Crypto Clipper Campaign Abuses Fake Reviews, AI Narrators, and VirusTotal Comments
An unknown threat actor has been observed leveraging paid or promoted posts on legitimate news websites to promote a cryptocurrency clipboard hijacker.…
Crypto Clipper: A Rust-Based Clipboard Hijacker Targeting Cryptocurrency Wallets
A Rust-based cryptocurrency clipboard hijacker that targets Windows and macOS systems. It monitors the clipboard for wallet address patterns and substitutes them…