Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Check Point Research

Kaspersky Security Blog

CVE Database V5

Reddit NetSec

AlienVault OTX General

Reddit InfoSec News

SecurityWeek

SANS ISC Handlers Diary

Threatpost

Dark Reading

The Hacker News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Shuyal Stealer is a sophisticated infostealer malware targeting 19 different browsers. It conducts deep system reconnaissance, collecting detailed hardware information and user data. The malware disables Windows Task Manager, ensures persistence through startup folder insertion, and exfiltrates stolen data via a Telegram bot. Shuyal's capabilities include credential harvesting from multiple browsers, clipboard capture, screenshot taking, and Discord token theft. It employs evasion techniques like self-deletion and uses PowerShell for data compression. The malware's wide-ranging browser targets and extensive data collection make it a significant threat to user privacy and system security.

Shuyal Stealer is an advanced infostealer malware designed to target 19 different web browsers, enabling it to harvest a wide range of sensitive user data. It conducts comprehensive system reconnaissance, gathering detailed hardware information and user-specific data to tailor its operations and evade detection. The malware disables Windows Task Manager, preventing users and administrators from easily terminating its processes. Persistence is achieved by inserting itself into the Windows startup folder, ensuring execution upon system reboot. Shuyal Stealer collects credentials stored in multiple browsers, captures clipboard contents, takes screenshots, and steals Discord authentication tokens, thereby compromising both personal and organizational accounts. Data exfiltration is performed covertly via a Telegram bot, which receives compressed data using PowerShell scripts, enhancing stealth and reducing forensic footprints. The malware also employs self-deletion techniques to remove traces after execution, complicating incident response efforts. Despite the lack of a CVE identifier or known exploits in the wild, its extensive capabilities and evasion tactics make it a significant threat. The malware’s targeting of a broad spectrum of browsers increases its attack surface, affecting users across various platforms and increasing the likelihood of successful data theft. The use of Telegram for data exfiltration is notable for its difficulty to block without impacting legitimate communications. The malware’s tactics align with multiple MITRE ATT&CK techniques, including credential access, persistence, defense evasion, and command and control communications.

Detailed information about Shuyal Stealer: Advanced Infostealer Targeting 19 Browsers. Get real-time updates, technical details, and mitigation strategies.

Shuyal Stealer: Advanced Infostealer Targeting 19 Browsers - Live Threat Intelligence - Threat Radar | OffSeq.com

Shuyal Stealer: Advanced Infostealer Targeting 19 Browsers

A new variant of the XCSSET malware, designed to infect Xcode projects, has been identified with key changes in browser targeting, clipboard hijacking, and persistence mechanisms. This variant employs sophisticated encryption and obfuscation techniques, uses run-only compiled AppleScripts for stealthy execution, and expands its data exfiltration capabilities to include Firefox browser data. It also adds another persistence mechanism through LaunchDaemon entries. The malware features a submodule for monitoring the clipboard and substituting wallet addresses. The infection chain consists of four stages, with modifications to the boot function and introduction of new modules. Changes include additional checks for Firefox browser, modified logic for Telegram existence check, and new info-stealer modules targeting Firefox data.

The XCSSET malware is a sophisticated threat targeting macOS environments, specifically focusing on infecting Xcode projects, which are used by developers to build applications for Apple platforms. The latest variant of XCSSET introduces several advanced features and modifications that enhance its stealth, persistence, and data exfiltration capabilities. This variant employs complex encryption and obfuscation techniques to evade detection by security tools. It uses run-only compiled AppleScripts, which execute stealthily without exposing source code, making analysis and detection more difficult. The infection chain consists of four stages, including modifications to the boot function and the introduction of new modules. Notably, the malware expands its browser targeting to include Firefox, in addition to previously targeted browsers, and introduces new info-stealer modules specifically designed to extract sensitive data from Firefox profiles. It also adds a submodule that monitors the clipboard to hijack and substitute cryptocurrency wallet addresses, a tactic aimed at redirecting financial transactions to attacker-controlled wallets. For persistence, the malware now leverages LaunchDaemon entries, a macOS mechanism that allows malware to maintain execution across system reboots. Additional logic changes include enhanced checks for the presence of Telegram, indicating targeted data theft or reconnaissance from this messaging platform. The malware communicates with multiple command and control domains, many with Russian TLDs, indicating possible infrastructure or origin. Indicators of compromise include several file hashes and domain names associated with the malware's infrastructure. Overall, this variant represents an evolution of XCSSET with increased stealth, persistence, and expanded data theft capabilities, particularly targeting developers and users of macOS who use Xcode and Firefox.

Detailed information about XCSSET evolves again: Analyzing the latest updates to XCSSET's inventory. Get real-time updates, technical details, and mitigation st

Title	Severity	Type	Source	Date

Threats Tagged 'browser targeting'

Filter Threats

Scan a website for live threats in under a minute

Threats Tagged 'browser targeting'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility