SCMBANKER Malware Uses ClickFix Lures to Target Mexican Banking Users
A new banking fraud operation tracked as REF6045 by Elastic Security Labs is targeting customers of Mexican banks, fintech platforms, payment processors,…
Tag: PowerShell
Armored Likho Targets Government and Power Sector with BusySnake Stealer
A previously undocumented threat actor, Armored Likho, has been attributed to cyber attacks targeting government agencies and the electric power sector across…
SEO-Poisoned Software Sites Abuse ScreenConnect to Deploy AsyncRAT
Unknown threat actors are leveraging the ScreenConnect remote access tool to deploy and execute AsyncRAT as part of a massive, multi-domain, multi-language…
VEIL#DROP Malware Chain Uses Blogger Platform to Deliver PureLogs Stealer
Cybersecurity researchers have identified a new multi-stage malware delivery attack chain, dubbed VEIL#DROP, that leverages social engineering and Google's Blogger platform to…
Researcher Analyzes 3,000 Live ClickFix Payloads, Exposing API-Driven Malware Delivery
Security researcher Bert-Jan Pals analyzed roughly 3,000 live ClickFix payloads and presented findings at OrangeCon in early June, publishing details on June…
Gamaredon Expands Ukraine Attacks with New Malware and Cloud Service Abuse
Russian APT group Gamaredon has continued its cyber onslaught against Ukraine throughout 2025, deploying new malware and increasingly abusing legitimate cloud services.…
PteroPaste: Gamaredon Weaponizer and Downloader
PteroPaste is used by Gamaredon to weaponize USB drives and download additional PowerShell payloads via an encrypted channel.
PteroDee: Gamaredon PowerShell Tool
PteroDee is a PowerShell tool used by Gamaredon to fetch and execute PowerShell payloads in memory.
PteroCache: Gamaredon PowerShell Tool
PteroCache is a PowerShell tool used by Gamaredon to fetch and execute PowerShell payloads in memory.
PteroOdd: Gamaredon PowerShell Tool Using Telegra.ph API
PteroOdd is a PowerShell tool used by Gamaredon to fetch a single PowerShell payload using the Telegra.ph API, likely in collaboration with…