Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

CyberEye is a modular, .NET-based Remote Access Trojan that utilizes Telegram for Command and Control, eliminating the need for attackers to maintain their own infrastructure. It offers a wide array of surveillance and data theft capabilities, including keylogging, file grabbing, and clipboard hijacking. The malware employs advanced defense evasion techniques, disabling Windows Defender through PowerShell and registry manipulations. Its modules harvest browser credentials, Wi-Fi passwords, gaming profiles, and session data from various applications. The builder framework allows adversaries to customize payloads, making it accessible to less technically skilled threat actors. CyberEye's persistence mechanisms, anti-analysis features, and use of public messaging platforms for C2 make it a significant threat to both consumers and enterprises.

CyberEye is a modular Remote Access Trojan (RAT) developed using the .NET framework, notable for its use of Telegram as a Command and Control (C2) channel. This design choice allows attackers to leverage a public messaging platform, eliminating the need to maintain dedicated C2 infrastructure, thereby increasing operational stealth and reducing costs. The RAT provides extensive surveillance and data theft capabilities, including keylogging to capture keystrokes, file grabbing to exfiltrate files, and clipboard hijacking to intercept copied data. It also harvests sensitive credentials such as browser-stored passwords, Wi-Fi keys, gaming profiles, and session information from various applications, enabling broad access to victim data. 

CyberEye employs advanced defense evasion techniques, notably disabling Windows Defender via PowerShell scripts and registry modifications, which complicates detection and removal. Its persistence mechanisms ensure the malware remains active across system reboots, while anti-analysis features hinder reverse engineering and forensic investigations. The RAT builder framework allows adversaries to customize payloads, lowering the technical barrier for less skilled threat actors to deploy sophisticated malware. The use of Telegram for C2 communications (leveraging techniques mapped to MITRE ATT&CK techniques such as T1102.002) also helps evade traditional network-based detection methods. Overall, CyberEye represents a versatile and stealthy threat capable of extensive data exfiltration and system control, targeting both consumer and enterprise Windows environments.

Detailed information about Understanding CyberEYE RAT Builder: Capabilities and Implications. Get real-time updates, technical details, and mitigation strategie

Understanding CyberEYE RAT Builder: Capabilities and Implications - Live Threat Intelligence - Threat Radar | OffSeq.com

Understanding CyberEYE RAT Builder: Capabilities and Implications

Cybercriminals are exploiting the US tax season to deploy Stealerium malware, targeting citizens through sophisticated phishing campaigns. The attack utilizes deceptive email attachments with malicious LNK files, leading to the execution of PowerShell scripts and the download of a PyInstaller-packaged executable. This payload injects into mstsc.exe and deploys Stealerium, an information-stealing malware that exfiltrates sensitive data from browsers, cryptocurrency wallets, and popular applications. The malware employs anti-analysis techniques, creates a hidden directory, and registers with a command and control server. It steals credentials from various sources, including browsers, gaming platforms, and messaging apps, while also capturing webcam images and Wi-Fi passwords.

The Stealerium-infostealer campaign represents a sophisticated malware threat exploiting the US tax season to target individuals via phishing emails containing malicious LNK (Windows shortcut) files. Upon opening these attachments, a PowerShell script is executed, which downloads a PyInstaller-packaged executable. This executable performs process injection into mstsc.exe (Microsoft Terminal Services Client), a legitimate Windows process, to evade detection and persist on the system. The deployed Stealerium malware is an information stealer designed to exfiltrate a wide range of sensitive data, including browser-stored credentials, cryptocurrency wallets, gaming platform credentials, messaging app data, Wi-Fi passwords, and even webcam images. The malware employs anti-analysis techniques to hinder forensic investigation and detection, creates hidden directories to conceal its components, and communicates with a command and control (C2) server to receive instructions and exfiltrate stolen data. The attack chain leverages social engineering tied to the US tax season, increasing the likelihood of victim interaction. Although no specific affected software versions are listed, the infection vector relies on user interaction with phishing emails and execution of malicious attachments. There are no known public exploits or patches, and the campaign is currently observed targeting US citizens primarily. Indicators of compromise include multiple file hashes associated with the malware components.

Detailed information about Threat Actors are Targeting US Tax-Session with new Tactics of Stealerium-infostealer. Get real-time updates, technical details, and 

Threat Actors are Targeting US Tax-Session with new Tactics of Stealerium-infostealer - Live Threat Intelligence - Threat Radar | OffSeq.com

Threat Actors are Targeting US Tax-Session with new Tactics of Stealerium-infostealer

TransferLoader is a newly identified malware loader active since February 2025. It comprises multiple components including a downloader, backdoor, and specialized loader. The malware employs various anti-analysis techniques and code obfuscation to hinder reverse engineering. TransferLoader has been observed delivering Morpheus ransomware. Its backdoor module enables execution of arbitrary commands on compromised systems and uses the InterPlanetary File System as a fallback for C2 server updates. The malware utilizes both HTTPS and raw TCP communication methods, with a unique encryption process for network packets. TransferLoader's consistent use in deploying additional payloads suggests it will continue to be a threat in future attacks.

TransferLoader is a sophisticated malware loader first identified in February 2025. It is composed of multiple modular components, including a downloader, a backdoor, and a specialized loader designed to facilitate the deployment of additional malicious payloads. The malware employs advanced anti-analysis techniques such as code obfuscation and evasion methods to hinder reverse engineering and detection by security researchers and automated tools. TransferLoader’s backdoor module enables attackers to execute arbitrary commands on compromised systems, providing extensive control over infected hosts. Notably, it uses the InterPlanetary File System (IPFS) as a fallback mechanism for command and control (C2) server updates, which is an uncommon and innovative approach that leverages decentralized file storage to increase resilience and evade takedown efforts. Communication with C2 servers occurs over both HTTPS and raw TCP protocols, with a unique encryption scheme applied to network packets, complicating network traffic analysis and detection. TransferLoader has been observed delivering the Morpheus ransomware, indicating its role as a loader for high-impact ransomware campaigns. Given its modular design and consistent use in deploying additional payloads, TransferLoader is expected to remain an active threat vector in future cyberattacks. Indicators of compromise include specific file hashes and URLs associated with its distribution infrastructure. Despite the medium severity rating and no known exploits in the wild targeting specific software vulnerabilities, its operational capabilities and use of advanced evasion techniques make it a significant concern for cybersecurity defenses.

Detailed information about Technical Analysis of TransferLoader. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'anti-analysis'

Filter Threats

Threats Tagged 'anti-analysis'