A recent malvertising campaign involving the Rhysida group has been uncovered, leveraging the OysterLoader malware. This campaign is notable for its use of over 40 distinct code signing certificates, which help the malware evade detection and appear legitimate. The attackers distribute the malware through malicious advertisements, targeting users to install the OysterLoader, which then facilitates further payload delivery and system compromise. This sophisticated use of code signing certificates highlights the evolving tactics of threat actors to bypass security measures and maintain persistence. Organizations are urged to enhance their security monitoring for signed binaries and scrutinize code signing certificates to detect such threats early. The campaign underscores the importance of vigilance against malvertising as a vector for malware distribution and the need for comprehensive endpoint protection strategies.
This Cyber News was published on www.scworld.com. Publication date: Sun, 02 Nov 2025 23:14:04 +0000