A new two-stage malware named LeakyInjector and LeakyStealer has been identified, targeting cryptocurrency wallets and browser history. LeakyInjector uses low-level APIs for injection to avoid detection and injects LeakyStealer into explorer.exe. LeakyStealer implements a polymorphic engine to modify its memory area at runtime. Both stages were signed with valid Extended Validation certificates. The malware performs reconnaissance on infected machines, targeting multiple crypto wallets, including browser extensions, and searches for browser history files from various browsers. It establishes persistence through registry manipulation and beacons to the C2 server at regular intervals. The malware exfiltrates sensitive data and can execute additional commands received from the C2 server.
A new Android Trojan masquerades as legitimate news reader or digital ID apps, stealthily stealing sensitive data by exploiting Android Accessibility Services and overlay features. It primarily targets banking and cryptocurrency applications by overlaying fake login screens to capture credentials. The malware operates silently in the background, connects to a remote command center for updates and cleanup, and has been observed mainly in Southeast Asia. Although no CVE or known exploits in the wild are reported, the malware's capabilities pose significant risks to user confidentiality and financial security. This threat highlights the importance of enhanced mobile security and user vigilance against fake apps and overlay attacks.
BlueNoroff is a financially motivated threat actor conducting sophisticated campaigns named GhostCall and GhostHire targeting macOS, Windows, and Linux systems. GhostCall focuses on tech executives and venture capitalists via fake Zoom-like meetings, while GhostHire targets Web3 developers through fraudulent recruitment processes. These campaigns deploy multi-stage malware including ZoomClutch, DownTroy, CosmicDoor, RooTroy, and SilentSiphon, leveraging social engineering and AI-generated images. The attacks aim beyond cryptocurrency theft, focusing on comprehensive data acquisition to enable supply chain attacks and exploit trust relationships. The threat involves complex malware chains and advanced persistence techniques, affecting high-value targets in the tech and crypto sectors. Exploitation requires user interaction but no prior authentication, increasing risk. The campaigns pose a medium severity threat with significant potential impact on confidentiality and integrity. European organizations involved in technology, venture capital, and blockchain development are particularly at risk, especially in countries with strong tech ecosystems. Mitigation requires targeted user awareness, enhanced endpoint detection, and strict verification of recruitment and meeting invitations.
The 'HijackServer' malicious IIS module is actively compromising IIS servers by exploiting exposed ASP . NET machine keys, enabling unauthenticated remote command execution. This threat, attributed to the RudePanda group, uses a customized rootkit and off-the-shelf tools to maintain persistent access. While primarily used to manipulate search engine results for cryptocurrency scams, the module's capabilities allow attackers or third parties to conduct espionage or build malicious infrastructure. Hundreds of servers worldwide have been affected, indicating a broad impact. The exploitation does not require authentication, and the attack leverages a critical misconfiguration or exposure of sensitive cryptographic keys. European organizations running IIS with exposed ASP . NET machine keys are at risk, especially those in countries with high IIS usage and strategic value. Mitigation requires immediate review and protection of ASP . NET machine keys, deployment of advanced monitoring for rootkit activity, and hardening of IIS configurations.
A sophisticated cyber campaign targeting Chinese individuals in the FinTech, cryptocurrency exchange, and trading platform sectors has been uncovered. The operation uses spear-phishing emails with malicious .LNK files embedded in fake resumes. When executed, these files initiate a multi-stage infection process, ultimately deploying ValleyRAT malware. The malware establishes persistence through scheduled tasks, performs system reconnaissance, and exfiltrates sensitive data. The campaign's infrastructure is primarily hosted in Hong Kong, with multiple domains using the .work TLD to impersonate job portals. The attackers employ various techniques to evade detection, including anti-VM checks and attempts to disable antivirus software.
Famous Chollima, a North Korean threat group, has deployed a new malware campaign targeting job seekers by impersonating hiring organizations. The attack involves a trojanized Node.js application named 'Chessfi' and uses evolving malware tools BeaverTail and OtterCookie, which now include keylogging and screenshot capabilities. A malicious Visual Studio Code extension embedding these tools was also discovered, indicating new infection vectors. The malware steals cryptocurrency credentials by targeting multiple browsers and wallet extensions, and it can upload files from compromised systems. This campaign leverages social engineering and developer tools to infiltrate victims, focusing on cryptocurrency theft and credential harvesting. The threat is medium severity due to its broad capabilities and stealth but requires user interaction for infection. European organizations involved in software development, cryptocurrency, and job recruitment are at particular risk.
A new Astaroth banking trojan campaign has been discovered abusing GitHub to host malware configurations. The infection begins with a phishing email containing a link to download a zipped Windows shortcut file, which installs the Astaroth malware. The trojan detects when users access banking or cryptocurrency websites and steals credentials through keylogging. It sends stolen information to attackers using Ngrok reverse proxy and uses GitHub to update its configuration when command and control servers become inaccessible. The malware primarily targets South American countries, with a focus on Brazil. Astaroth employs various anti-analysis techniques and targets specific banking and cryptocurrency-related sites. The GitHub repositories hosting the malicious configurations have been reported and taken down.
The Stealit malware campaign leverages Node.js Single Executable Application (SEA) technology to distribute malicious payloads as standalone binaries, bypassing the need for a Node.js runtime. Distributed mainly as disguised game and VPN installers via file-sharing sites, the malware employs heavy obfuscation and anti-analysis techniques to evade detection. Once executed, it acts as a Remote Access Trojan (RAT), stealing sensitive information such as login credentials and cryptocurrency wallet data. The campaign demonstrates adaptability by switching between Node.js SEA and Electron frameworks for payload delivery. Although no known exploits are currently active in the wild, the malware’s capability to control victim systems and extract valuable data poses a significant threat. The campaign’s medium severity rating reflects its stealth and information theft focus, with no immediate widespread exploitation reported. European organizations using Node.
An analysis of robots.txt files revealed over 60 cryptocurrency phishing pages impersonating hardware wallet brands Trezor and Ledger. The actor behind these pages attempted to block phishing reporting sites by including their endpoints in the robots.txt file, demonstrating a misunderstanding of its function. Most sites were hosted on Cloudflare Pages, with a few on custom domains. The campaign's unusual robots.txt pattern was also found in GitHub repositories containing crypto-themed spoof pages. Merge conflicts in README files suggest the actor may lack web development expertise. Various free web hosting providers were used for similar spoofed pages. The campaign highlights the ongoing targeting of cryptocurrency users and the potential effectiveness of even poorly executed phishing attempts.
This analysis delves into the operations of DeceptiveDevelopment, a North Korea-aligned threat actor, and its connections to North Korean IT worker campaigns. The group targets software developers across major systems, focusing on cryptocurrency and Web3 projects. They use social engineering techniques like fake job offers and the ClickFix method to deliver malware. Their toolset includes multiplatform malware such as BeaverTail, InvisibleFerret, WeaselStore, and TsunamiKit. The group shows links to other North Korean cyber operations through shared malware like Tropidoor and AkdoorTea. The analysis also explores the activities of North Korean IT workers, who use stolen identities and AI-generated content to secure remote jobs, highlighting the interconnected nature of these cyber threats.
A new Android banking trojan named RatOn has emerged, combining NFC relay attacks with remote access and automated transfer capabilities. Discovered by analysts monitoring the NFSkate threat group, RatOn targets cryptocurrency wallets and banking applications, particularly in the Czech Republic and Slovakia. The malware is distributed through adult-themed websites and employs a multi-stage infection process. RatOn features overlay attacks, automated money transfers, and cryptocurrency wallet takeovers. It demonstrates sophisticated capabilities, including screen casting, PIN interception, and extensive bot commands. The trojan's evolution from a basic NFC relay tool to a complex RAT with ATS functionality makes it a significant threat in the mobile malware landscape.
Salat Stealer, a sophisticated Go-based infostealer targeting Windows systems, has been identified. It exfiltrates browser credentials, cryptocurrency wallet data, and session information while employing advanced evasion techniques. The malware uses UPX packing, process masquerading, registry run keys, and scheduled tasks for persistence and evasion. Operated under a Malware-as-a-Service model by Russian-speaking actors, it leverages resilient C2 infrastructure. The stealer targets multiple browsers, cryptocurrency wallets, and Telegram sessions. It communicates with its C2 server using UDP and HTTPS, with multiple fallback domains for redundancy. The control panel supports real-time interaction through WebSockets and includes features for remote command execution and system manipulation.
The Contagious Interview campaign is a coordinated cyber espionage operation by North Korean threat actors, notably linked to the Lazarus group, targeting the cryptocurrency sector. These actors actively monitor cyber threat intelligence platforms such as Validin, VirusTotal, and Maltrail to identify exposed infrastructure and new targets. They prioritize rapid deployment of malicious infrastructure over stealth and use social engineering techniques, including the ClickFix method, to trick victims into executing malware. Between January and March 2025, over 230 victims were engaged, demonstrating the campaign's scale and sophistication. Although no known exploits for CVE-2023-42793 have been observed in the wild, the campaign poses a medium severity threat. European cryptocurrency organizations, especially in countries with significant crypto markets and financial sectors, are at risk. Mitigation requires targeted monitoring of threat intelligence platforms, enhanced user training against social engineering, and rapid incident response capabilities.
A novel technique utilizing Ethereum smart contracts was discovered in two npm packages to conceal malicious commands for installing downloader malware. The packages, colortoolsv2 and mimelib2, are part of a larger campaign targeting npm and GitHub. The attackers created sophisticated GitHub repositories with fake popularity metrics to lure developers. The campaign focused on cryptocurrency-related projects, using blockchain technology to evade detection. This incident highlights the evolving strategies of malicious actors in compromising open-source repositories and the need for developers to carefully assess third-party packages before implementation.
This report analyzes three remote access trojans (RATs) used by a Lazarus subgroup targeting financial and cryptocurrency organizations. The RATs, named PondRAT, ThemeForestRAT, and RemotePE, were observed during incident response cases. PondRAT is a simple RAT used as an initial payload, while ThemeForestRAT offers more functionality and operates in-memory. RemotePE is a more advanced RAT deployed in later attack stages. The actor uses social engineering for initial access and employs various tools for network discovery. The report details the RATs' capabilities, command and control mechanisms, and similarities to previously known malware families. It highlights the actor's persistent threat and evolving tactics in targeting high-value financial targets.
A sophisticated task scam cluster has been discovered, exploiting major brands like Delta Airlines, AMC Theatres, and Universal Studios. The scam uses API-driven templates and cryptocurrency payments, with over $1 million in attributable transactions. Victims are lured into 'earning' money by completing tasks such as booking flights. The scam requires initial cryptocurrency deposits to become a 'VIP' member. The infrastructure utilizes domains registered through Dominet, Alibaba Cloud's registrar, with a distinct registrant pattern. Multiple wallet addresses across different cryptocurrencies have been identified. The scam's configuration files reveal its adaptability across various brands and industries.
Anatsa, an Android banking malware first discovered in 2020, has evolved with new capabilities and targets. The latest variant now affects over 831 financial institutions worldwide, including new countries and cryptocurrency platforms. Anatsa has streamlined its payload delivery, implemented DES runtime decryption, and added device-specific restrictions. The malware uses decoy applications in the Google Play Store, some exceeding 50,000 downloads. Alongside Anatsa, 77 other malicious apps from various families were identified, totaling over 19 million installs. Anatsa's evasion techniques include emulation checks, device model verification, and the use of malformed archives to hide malicious code. The malware primarily steals credentials through fake banking login pages tailored to detected financial apps on the user's device.
Cybercriminals are exploiting an AI-powered website creation platform called Lovable to generate fraudulent websites for credential phishing and malware delivery. The threat actors create or clone sites impersonating well-known brands, use CAPTCHA for filtering, and post stolen credentials to Telegram. Campaigns observed include Tycoon phishing, payment and personal data theft, cryptocurrency wallet draining, and malware distribution. The ease of use of such AI tools significantly lowers the barrier to entry for cybercriminals, allowing them to quickly create convincing phishing pages. While Lovable has implemented new security measures, organizations are advised to consider allow-listing policies for frequently abused tools.
A Ukrainian Web3 team's interview process involved cloning a GitHub repository containing malicious components. Analysis revealed the project replaced a legitimate dependency with a malicious NPM package, rtk-logger@1.11.5. This package collected sensitive data, including cryptocurrency wallet information, from popular browsers and uploaded it to an attacker-controlled server. The malware also implemented keylogging, screen capture, and clipboard monitoring. Two other GitHub accounts were found using a similar malicious package. The scam aimed to trick interviewees into executing malicious code, potentially leading to data leaks and asset theft. Developers are advised to exercise caution when handling unknown GitHub projects and to use isolated environments for execution.
A malware campaign utilizing malvertising has been distributing PS1Bot, a sophisticated multi-stage framework implemented in PowerShell and C#. PS1Bot features modular design, enabling information theft, keylogging, reconnaissance, and persistent system access. The malware minimizes artifacts and uses in-memory execution techniques for stealth. Active since early 2025, PS1Bot's information stealer targets cryptocurrency wallets and employs wordlists to identify files containing passwords and seed phrases. The campaign overlaps with previously reported Skitnet activities and uses similar C2 infrastructure. Delivery involves compressed archives with obfuscated scripts, leading to PowerShell modules for antivirus detection, screen capture, data theft, keylogging, and system information collection. Persistence is established through startup directory manipulation.
