Exposed Server Reveals AI-Assisted Phishing Toolkit Behind WebDAV Malware Campaign
A malware operator left its delivery server exposed, allowing Rapid7 to recover a full toolkit of 1,048 files including lure templates, filename-spoofing…
Tag: infostealer
WebDAV Malware Campaign
A malware campaign using WebDAV shares to deliver infostealers and RATs, leveraging AI-assisted tooling and multiple CVEs.
Infostealer Malware: The Root Cause of Snowflake Breaches
Infostealer malware was the primary vector for the Snowflake breaches, harvesting credentials that remained valid for years due to lack of rotation.…
ACR Stealer Uses ClickFix Lures to Steal Browser Tokens and Microsoft 365 Files
ACR Stealer, an infostealer active since 2024, is targeting enterprise networks by stealing saved browser passwords, live session tokens, PDFs, Microsoft 365…
GrMsk Stealer: Precursor to ACR Stealer
GrMsk Stealer is an earlier malware family that ACR Stealer is assessed to be an updated version of, according to Red Canary.
ClickLock macOS Stealer Kills Apps Every 210ms Until Victims Type Their Password
Group-IB has identified a new macOS infostealer, ClickLock Stealer, that uses a coercive technique to force victims to enter their login password.…
SHub Stealer: macOS Malware Using dscl Validation
SHub Stealer is a macOS malware documented by Microsoft that uses dscl for password validation, similar to ClickLock Stealer. It was part…
OmniStealer: Python-Based Infostealer
OmniStealer is a Python infostealer that harvests credentials, browser data, and system information from compromised hosts, first detailed by eSentire in April…
Armored Likho Targets Government and Power Sector with BusySnake Stealer
A previously undocumented threat actor, Armored Likho, has been attributed to cyber attacks targeting government agencies and the electric power sector across…
BusySnake Stealer: Python-Based Infostealer Used by Armored Likho
BusySnake Stealer is a Python-based information stealer targeting Windows systems, used by Armored Likho. It implements evasion techniques like dynamic bytecode decryption…