Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit NetSec

Reddit Cybersecurity

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

Bleeping Computer

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The Boto Cor-de-Rosa campaign reveals Astaroth's new strategy of exploiting WhatsApp Web for propagation. This Brazilian banking malware now uses a Python-based worm module to retrieve victims' WhatsApp contact lists and automatically send malicious messages, expanding its infection reach. The attack begins with a malicious ZIP file sent via WhatsApp, containing a Visual Basic script that downloads additional components. The malware then operates two parallel modules: a propagation module for spreading through WhatsApp contacts, and a banking module for credential stealing. This campaign demonstrates Astaroth's evolution, combining traditional malware techniques with sophisticated social engineering and multi-platform propagation, primarily targeting Brazilian users.

The Boto Cor-de-Rosa campaign reveals a new propagation strategy by the Astaroth banking malware family, leveraging WhatsApp Web as a vector for spreading a Python-based worm module. The infection chain begins when a victim receives a malicious ZIP file via WhatsApp containing a Visual Basic script. When executed, this script downloads additional malware components that enable two parallel operations: a propagation module that automatically retrieves the victim's WhatsApp contact list and sends the malicious ZIP file to those contacts, and a banking module designed to steal credentials from infected systems. This dual-module approach allows the malware to rapidly expand its reach through social engineering tactics, exploiting the trust inherent in WhatsApp communications. The use of WhatsApp Web is notable because it enables the malware to operate across platforms where WhatsApp is accessed via browsers, increasing its attack surface. The campaign primarily targets Brazilian users, reflecting Astaroth's historical focus on Brazilian banking institutions and users. The malware employs multiple advanced techniques, including code obfuscation, script execution, and multi-stage payload delivery, to evade detection and maintain persistence. Despite its sophistication, the campaign requires user interaction to open the malicious ZIP file, limiting its automatic spread. No CVEs or patches are currently associated with this threat, and no known exploits are reported outside this campaign. The campaign underscores the evolving threat landscape where traditional banking malware integrates social media and messaging platforms for propagation.

Detailed information about Boto-Cor-de-Rosa campaign reveals Astaroth WhatsApp-based worm activity in Brazil. Get real-time updates, technical details, and miti

Boto-Cor-de-Rosa campaign reveals Astaroth WhatsApp-based worm activity in Brazil - Live Threat Intelligence - Threat Radar | OffSeq.com

Boto-Cor-de-Rosa campaign reveals Astaroth WhatsApp-based worm activity in Brazil

Threats Tagged 'boto cor-de-rosa'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'boto cor-de-rosa'

Lead Pen Test Professional