WithSecure Tracks WeevilProxy Stealer
WithSecure is a cybersecurity company that tracks the stealer malware identified in the TradingView malvertising campaign as WeevilProxy. The same malware is…
Tag: malvertising
Bun Runtime Used as Base for Malware Assembly
The Bun runtime, a legitimate JavaScript runtime built on Apple's JavaScriptCore engine, is used by the SourTrade malvertising campaign as a base…
StreamSaver.js Used in Earlier SourTrade Activity
StreamSaver.js is an open-source streamed-download library that was used in earlier SourTrade activity tracked through April 30, 2026. The current campaign retains…
China-Nexus JadeProx Deploys New TriBack Loader in Attacks on Government and Healthcare
Group-IB has uncovered a China-nexus cyber operation tracked as JadeProx, which has been targeting government, healthcare, and education organizations across Asia and…
SANS ISC: Documented ACR Stealer Infection via Claude Impersonation
SANS ISC handler Brad Duncan documented an ACR Stealer infection traced to a page impersonating Claude AI, reached through malicious Google ads.
ACR Stealer Uses ClickFix Lures to Steal Browser Tokens and Microsoft 365 Files
ACR Stealer, an infostealer active since 2024, is targeting enterprise networks by stealing saved browser passwords, live session tokens, PDFs, Microsoft 365…
148 npm Packages Disguised as Student Proxies Turn Browsers Into a DDoS Botnet
A campaign of 148 npm packages disguised as student web proxies turned visitors' browsers into a distributed denial-of-service (DDoS) botnet for roughly…
Fake 7-Zip Installers Recruit Devices into Lurking Lizard Proxy Botnet
Cybersecurity researchers at Infoblox have uncovered a threat actor tracked as Lurking Lizard, operating an end-to-end malicious residential proxy business since at…
Contagious Interview Campaign
A long-running North Korean cyber campaign that typically uses fake job offers and coding tests to lure victims. This iteration uses malvertising…
New OXLOADER Loader Uses Malicious Google Ads to Deliver CastleStealer
Cybersecurity researchers from Elastic Security Labs have disclosed a new campaign that delivers the CastleStealer information stealer via a previously unreported malware…