Threats tagged 'browser fingerprinting'

A phishing campaign exploited legitimate Microsoft Power BI domains to distribute rogue ScreenConnect remote monitoring tools. Attackers sent phishing emails with links redirecting victims to fake reference documents hosted on Power BI infrastructure. Clicking the download link led to attacker-controlled sites that fingerprinted victims' systems before downloading malicious ScreenConnect installers. Multiple ScreenConnect instances were deployed for persistent remote access, with scheduled tasks created to maintain persistence. The campaign used browser fingerprinting and Telegram bots to filter victims and track infections, leveraging trusted Microsoft domains to bypass email security and increase credibility.

Lumma Stealer malware has resurged since October 2025, now incorporating adaptive browser fingerprinting to enhance its command-and-control (C&C) operations. It collects detailed system, network, hardware, and browser information via JavaScript payloads and stealthy HTTP communications, enabling it to assess victim environments and evade detection. The malware continues to use process injection and maintains its core C&C communication structure while adding these new evasion and targeting capabilities. This hybrid approach improves operational continuity, targeting precision, and detection avoidance. Although no known exploits are currently reported in the wild, the malware’s stealth and data exfiltration capabilities pose a medium-level threat. European organizations should be aware of this evolving infostealer, especially those with high-value data and browser-based workflows. Mitigation requires advanced endpoint detection, network monitoring for stealthy HTTP traffic, and browser security hardening. Countries with significant digital economies and high adoption of targeted software are at greater risk.

Malware#evasion techniques#browser fingerprintingGermany+6

Threat actors are exploiting the popularity of AI tools by using Black Hat SEO techniques to poison search engine rankings for AI-related keywords. These malicious websites redirect users through multiple layers to deliver malware such as Vidar, Lumma, and Legion Loader. The attackers employ sophisticated JavaScript to collect browser data, perform fingerprinting, and evade detection. The malware payloads are often packaged in large installer files to bypass sandboxes. The campaign uses trusted platforms like WordPress and AWS CloudFront to appear legitimate. Victims are lured through high-ranking search results for AI topics, leading to infection chains involving stealer malware and cryptocurrency-stealing browser extensions.

Malware#vidar#search engine poisoningUnited Kingdom+5