40 Malicious Firefox Extensions Pose as Web3 Products to Steal Wallet Secrets
A set of 40 malicious Mozilla Firefox extensions has been discovered masquerading as popular Web3 products like OKX, Rabby Wallet, and TronLink…
Tag: C2 infrastructure
RST Cloud’s Analysis of MacSync Stealer C2 Infrastructure
RST Cloud documented a static API key across four confirmed C2 domains and identified additional candidates via recurring URI patterns, aiding in…
Microsoft Ties 30+ Rotating Domains to MacSync Stealer Infrastructure
Microsoft Defender Experts have linked more than 30 web domains to MacSync Stealer, a macOS-focused information stealer, by correlating endpoint and network…
TWINLOOT Malware Abuses SharePoint and Teams to Steal Credentials and Pivot Networks
Cybersecurity researchers have uncovered a new Python-based implant framework called TWINLOOT that abuses trusted Microsoft services for command-and-control (C2) operations. The malware,…
Chinese-Made Zbtlink Routers Ship With Backdoor That Opens Unauthenticated Root Shells
Cybersecurity researchers have disclosed details of a factory-shipped backdoor implanted in at least 20 Chinese router models from Zbtlink. According to a…
Chinese-Speaking Hackers Target Central Asian Governments with OctLurk and SilkLurk Backdoors
A suspected Chinese-speaking threat actor has been conducting a series of cyber attacks against government organizations in Central Asia since January 2025.…
20+ Hijacked Brazilian Government Websites Used as Malware Delivery Channels in PhantomEnigma Campaign
More than 20 Brazilian government websites were hijacked and turned into malware delivery channels in an active PhantomEnigma campaign uncovered by ANY.RUN,…
PhantomEnigma Backdoor: Modular Malware with Rotating C2 Infrastructure
PhantomEnigma is a modular backdoor built on Inno Setup and Node.js, hidden inside patched Electron applications like Boostnote. It collects system information,…