ACR Stealer Uses ClickFix Lures to Steal Browser Tokens and Microsoft 365 Files
ACR Stealer, an infostealer active since 2024, is targeting enterprise networks by stealing saved browser passwords, live session tokens, PDFs, Microsoft 365…
Tag: EtherHiding
Ethereum Blockchain Platform
Ethereum is a blockchain platform used in the EtherHiding technique of the DPRK malvertising campaign. Malware extracts C2 server addresses from Ethereum…
ClickFix Campaign Uses EtherHiding with Polygon Blockchain
A ClickFix campaign leverages EtherHiding, using the Polygon blockchain to obfuscate and rotate C2 infrastructure, with malicious scripts embedded in WordPress robots.txt…
Silent Swap Crypto Clipper Uses Fake Google Notes Extension to Replace Wallet Addresses
Cybersecurity researchers have flagged an active browser extension campaign designed to steal cryptocurrency by stealthily replacing wallet addresses during transactions. The cryptocurrency…
Silent Swap: Crypto Clipper Campaign Using Fake Google Notes Extension
Silent Swap is a cryptocurrency clipper campaign identified by McAfee Labs that uses unsigned installers to deploy a malicious Chromium extension masquerading…
HellsUchecker: Backdoor Delivered via EtherHiding and ClickFix
HellsUchecker is a backdoor delivered via EtherHiding and ClickFix campaigns, capable of executing files retrieved from C2 and reporting results back.