Fake Coding Tests Deliver OtterCookie Malware Hidden in SVG Flag Images
North Korean threat actors linked to the Contagious Interview campaign have been observed using steganography in SVG image files to conceal malicious…
Tag: Elastic Security Labs
New TELEPUZ Malware Spreads via ClickFix to Steal Data and Run Commands
Cybersecurity researchers have uncovered a new modular malware called TELEPUZ that has been spreading since late April 2026 through websites infected with…
SCMBANKER Malware Uses ClickFix Lures to Target Mexican Banking Users
A new banking fraud operation tracked as REF6045 by Elastic Security Labs is targeting customers of Mexican banks, fintech platforms, payment processors,…
REF6045: Banking Fraud Operation Targeting Mexican Financial Institutions
REF6045 is a threat actor cluster tracked by Elastic Security Labs that uses ClickFix lures to infect victims with the SCMBANKER malware.…
Suspected China-Nexus Hackers Use Fake Indian Tax Filing Utility to Deploy DcRAT
A suspected China-nexus threat activity cluster, codenamed Operation DragonReturn by Seqrite Labs, has been targeting Indian taxpayers, tax professionals, and corporate finance…
REF3864: Intrusion Set Targeting Chinese-Speaking Regions with Malicious Installers
REF3864 is an intrusion set attributed by Elastic Security Labs for targeting Chinese-speaking regions with malicious installers for Telegram and Opera, delivering…
OceanLotus Targets Vietnam Investors With SPECTRALVIPER in FireAnt Supply Chain Attack
ESET has uncovered two campaigns by the Vietnam-aligned threat actor OceanLotus (APT32) targeting domestic entities and stock investors with the SPECTRALVIPER backdoor.…
New OXLOADER Loader Uses Malicious Google Ads to Deliver CastleStealer
Cybersecurity researchers from Elastic Security Labs have disclosed a new campaign that delivers the CastleStealer information stealer via a previously unreported malware…
Elastic Security Labs: Cybersecurity Research and Threat Intelligence
The cybersecurity arm of Elastic, providing threat research and intelligence, including detection of the REF9403 campaign.