Hackers are currently exploiting an old vulnerability in Microsoft Excel to inject a newly identified malware known as 'Agent Tesla.
' This malicious software is capable of either cleaning up a database or discreetly gathering intelligence, depending on the commands it receives from the C2C servers.
A study conducted by Zscaler ThreatLabz reveals that the malware's distribution begins with a phishing campaign.
Subsequently, it responds to the hackers' commands to collect intelligence or, if necessary, wipe out stored information.
In a separate incident, a JavaScript malware has been detected infecting servers across 40 financial institutions worldwide.
This web-based malware is estimated to have affected at least 50,000 online sessions within financial institutions in North America, Europe, Japan, and Canada.
The primary objective is to compromise popular banking applications, steal credentials, and drain funds from accounts.
The infection spreads through hackers injecting malware in the form of scripts into the webpage framework of banking institutions.
The malware then lies dormant before taking control from the admin and transferring it to the hacker, who can access currency transfer apps or use it for malvertising purposes.
AT&T Alien Labs cybersecurity researchers have uncovered a new campaign where criminals are circulating JaskaGO malware among Windows and MacOS users.
This malicious software, based on the GO Programming language, can exfiltrate information and deploy additional payloads.
Upon installation, the malware checks whether it is running in a virtual environment or sandbox, and then performs server-related tasks to evade detection by malware detection tools.
Once established, it connects with a remote server and operates according to the hacker's commands.
Delft, a Denmark-based cybersecurity firm, suggests that blockchain technology can not only help mitigate malware risks but also act as a catalyst in its spread. Criminals can use the blockchain network to hide their tracks as soon as their code is triggered, creating an environment favorable for crypto-miners and potentially leading to the development of innovative malware tools.
Microsoft has issued an alert regarding the resurgence and spread of QakBot malware, distributed through an email phishing campaign impersonating an IRS employee.
QakBot, active since 2008, had its crime infrastructure seized by the FBI in 2022 during 'Operation Duck Hunt.' However, a small campaign targeting the hospitality industry was observed from December 11th, 2023, indicating the re-emergence of the criminals spreading the malware.
This Cyber News was published on www.cybersecurity-insiders.com. Publication date: Thu, 21 Dec 2023 16:13:05 +0000