Threats Tagged 'campaign'

This analysis covers a Windows-targeted cyber campaign involving social engineering via fake interviews leading to cryptocurrency theft. The campaign notably did not use DPRK malware but leveraged known malware-as-a-service (MaaS) tools and unidentified Go and Rust-based stealers and remote access trojans (RATs). The threat actor may be using DPRK tradecraft as a false flag to confuse attribution, possibly indicating Russian operators. The campaign targets web3 organizations and involves a multi-stage payload delivery chain using signed ClickOnce applications.

A large-scale adware campaign involving over 700 Chrome extensions linked to the operators Ovkas, Gameograf, and Kidswallpapers/Owhit has been identified. These extensions, primarily wallpaper-related, engage in ad fraud by generating unauthorized ad impressions and exhibit malicious behaviors such as deleting browser IndexedDB data and injecting unsanitized HTML popups. The campaign has over 30,000 installs, with most extensions still active on the Chrome Web Store and distributed via grayware websites employing bot protection. The extensions also track uninstall events to enable retargeting. Evidence suggests the extensions were likely authored using AI coding agents. Only a few extensions have been removed so far, indicating ongoing risk to users.