Summary Cybersecurity researchers have identified a new malware campaign targeting users in the Middle East. The malware, disguised as the Palo Alto Networks GlobalProtect VPN tool, demonstrates a sophisticated infection chain and utilizes advanced Command and Control (C&C) infrastructure to evade detection. This advisory provides a detailed analysis

Overview PEAKLIGHT is a sophisticated memory-only malware recently identified by cybersecurity researchers at Mandiant. This malware is particularly concerning due to its stealthy nature, residing exclusively in a computer's RAM, which allows it to evade traditional antivirus solutions that rely on disk scanning. The infection is initiated through

Overview Styx Stealer is a sophisticated information-stealing malware targeting Windows systems, with a primary focus on cryptocurrency theft and data exfiltration. It is an advanced variant of the older Phemedrone Stealer and has been actively distributed since April 2024. This malware exploits vulnerabilities in outdated Windows Defender versions, making it

Overview DeerStealer is a recent and increasingly concerning information-stealing malware. It has gained notoriety for its use of deceptive distribution methods, specifically by disguising itself as legitimate applications such as Google Authenticator. The malware is typically spread through fake advertisements and malicious downloads. Once installed, DeerStealer harvests sensitive data including

Overview ACR Stealer is a sophisticated information-stealing malware actively distributed as Malware-as-a-Service (MaaS). It has evolved from its predecessor, GrMsk Stealer, and is known for its advanced obfuscation and anti-analysis techniques, making it a significant threat to user data security. Technical Details ACR Stealer targets sensitive user information by employing

Security Advisory Report: FakeBat Malware Summary FakeBat, also known as EugenLoader or PaykLoader, has emerged as a significant threat in 2024, spreading through drive-by download attacks and malvertising campaigns. Distributed under a Loader-as-a-Service (LaaS) model by the Russian-speaking threat actor Eugenfest, FakeBat targets victims through compromised websites, fake browser updates,

Overview Fickle Stealer, a sophisticated piece of malware written in Rust, has been identified as a significant threat targeting Windows users. Initially observed in May 2024, this malware leverages Rust's performance and safety features, making it challenging for researchers to detect and analyze. Distributed via multiple vectors, including

Overview Hijack Loader, also known as IDAT Loader, has evolved with enhanced evasion techniques aimed at increasing its stealth and persistence within infected systems. Recent variants demonstrate advanced tactics such as process hollowing and User Account Control (UAC) bypass. Technical Details The malware initiates an attack by deploying a first-stage

Overview The ZLoader malware, also known as Terdot, DELoader, or Silent Night, has recently undergone significant updates, enhancing its capabilities and evading detection mechanisms. Originally derived from the Zeus banking trojan, ZLoader has evolved to support a broader range of malicious activities, including the distribution of ransomware. Recent Developments As