Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A malicious campaign exploits user trust through deceptive websites, including spoofed Gitcodes and fake Docusign verification pages. Victims are tricked into running malicious PowerShell scripts on their Windows machines, leading to the installation of NetSupport RAT. The multi-stage attack uses clipboard poisoning and fake CAPTCHAs to deliver the malware. The campaign involves multiple domains, uses ROT13 encoding, and creates persistent infections. Similar techniques were observed in other spoofed content, including Okta and popular media apps. The attack capitalizes on user familiarity with common online interactions, emphasizing the need for vigilance and skepticism in online activities.

The described threat is a sophisticated social engineering and malware campaign that leverages human trust to infect Windows systems with the NetSupport Remote Access Trojan (RAT). The attack begins with threat actors setting up deceptive websites that mimic legitimate services such as Gitcodes and DocuSign verification pages. These spoofed sites employ fake CAPTCHA challenges and clipboard poisoning techniques to trick users into executing malicious PowerShell scripts. The use of ROT13 encoding and multiple domains adds obfuscation layers, complicating detection and analysis. The multi-stage infection chain involves initial user interaction to run scripts, which then download and install the NetSupport RAT, a well-known remote access tool often abused for unauthorized control and data exfiltration. The campaign also uses persistence mechanisms to maintain long-term access on compromised machines. Similar tactics have been observed targeting other widely used platforms like Okta and popular media applications, indicating a broad and adaptable attack methodology. The campaign exploits common user behaviors and trusted online interactions, making it particularly effective against less security-aware individuals. The attack techniques correspond to several MITRE ATT&CK tactics and techniques, including spearphishing via service (T1566.002), masquerading (T1036), PowerShell execution (T1059.001), persistence (T1547.001), and user execution (T1204.001), among others.

Detailed information about How Threat Actors Exploit Human Trust: A Breakdown of the 'Prove You Are Human' Malware Scheme. Get real-time updates, technical deta

How Threat Actors Exploit Human Trust: A Breakdown of the 'Prove You Are Human' Malware Scheme - Live Threat Intelligence - Threat Radar | OffSeq.com

How Threat Actors Exploit Human Trust: A Breakdown of the 'Prove You Are Human' Malware Scheme

Threats Tagged 'clipboard poisoning'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'clipboard poisoning'

Lead Pen Test Professional