New PATCHCORD Backdoor Targets Afghan Telecom and Indian Critical Infrastructure
Afghan telecom providers and South Asian critical infrastructure organizations are the targets of a new campaign delivering a previously undocumented backdoor called…
Tag: PowerShell
Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Deploy Malicious VPN Client
The Computer Emergency Response Team of Ukraine (CERT-UA) has disclosed a new social engineering campaign attributed to UAC-0145, a subgroup of the…
Fake Adobe and Zoom Updates Deliver ScreenConnect for Persistent Remote Access
Cybersecurity researchers have uncovered an active, multi-wave campaign that uses social engineering lures themed around Adobe and Zoom updates, business document reviews,…
ChocoShell PowerShell Stealer
In-memory PowerShell stealer that collects Microsoft 365 and Azure AD tokens from the Token Broker cache, enabling session replay.
BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery
The North Korean threat actors behind the ClickFix-style campaigns that employ typosquatted Zoom and Microsoft Teams domains have been found to operate…
SCOUTCURL: PowerShell Reconnaissance Script
SCOUTCURL is a PowerShell script used by UAC-0145 to perform basic reconnaissance by harvesting details about infected machines.
TookPS PowerShell Downloader
TookPS is a PowerShell downloader used as the initial payload for OkoBot. It has been active since March 2025, delivered via fake…
Attacker Uses Suspected AI-Generated PowerShell Script to Map Active Directory
Cybersecurity researchers at Huntress have identified an intrusion where an unknown threat actor used a suspected AI-generated PowerShell script to enumerate Active…
SCMBANKER Malware Uses ClickFix Lures to Target Mexican Banking Users
A new banking fraud operation tracked as REF6045 by Elastic Security Labs is targeting customers of Mexican banks, fintech platforms, payment processors,…
Armored Likho Targets Government and Power Sector with BusySnake Stealer
A previously undocumented threat actor, Armored Likho, has been attributed to cyber attacks targeting government agencies and the electric power sector across…