GodDamn Ransomware Deploys PoisonX Driver to Bypass Endpoint Security
Cybersecurity researchers have identified a new ransomware family named GodDamn, which leverages the PoisonX kernel driver to disable endpoint defenses. First observed…
Tag: credential theft
NirSoft-Based Credential Harvester in GodDamn Attack
A NirSoft-based credential harvesting toolkit was used to extract sensitive data from browsers, Windows Credential Manager, and other sources during the GodDamn…
Suspected China-Aligned Hackers Exploit Roundcube Flaws Against Universities
A suspected China-aligned threat activity cluster tracked as UNK_MassTraction by Proofpoint has been exploiting critical Roundcube webmail vulnerabilities to target physics and…
IceCube: JavaScript Credential Stealer Used in Roundcube Attacks
IceCube is a JavaScript malware deployed by UNK_MassTraction after exploiting CVE-2024-42009 in Roundcube. It steals credentials, 2FA tokens, cookies, and browser information,…
n8n: Open-Source Workflow Automation Platform
n8n is an open-source, low-code workflow automation platform with AI agent support and hundreds of integrations. It can be self-hosted or used…
OmniStealer: Python-Based Infostealer
OmniStealer is a Python infostealer that harvests credentials, browser data, and system information from compromised hosts, first detailed by eSentire in April…
New Avalon Malware Framework Packs CrownX Ransomware Capabilities
Cybersecurity researchers at Blackpoint Cyber have uncovered a previously undocumented modular malware framework codenamed Avalon, which is distributed via a multi-stage phishing…
Avalon: Modular Malware Framework with CrownX Ransomware
Avalon is a previously undocumented modular malware framework distributed via a multi-stage phishing chain. It combines credential collection, lateral movement, remote access,…
North Korea-Linked npm Packages Mimic Rollup Polyfills to Steal Developer Secrets
Threat actors with ties to North Korea have been linked to a fresh set of malicious npm packages that masquerade as Rollup…
PamStealer: New macOS Infostealer with PAM Password Validation
PamStealer is a macOS information stealer discovered by Jamf Threat Labs that uses fake Maccy sites for distribution. It employs a two-stage…