Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A malicious campaign exploits user trust through deceptive websites, including spoofed Gitcodes and fake Docusign verification pages. Victims are tricked into running malicious PowerShell scripts on their Windows machines, leading to the installation of NetSupport RAT. The multi-stage attack uses clipboard poisoning and fake CAPTCHAs to deliver the malware. The campaign involves multiple domains, uses ROT13 encoding, and creates persistent infections. Similar techniques were observed in other spoofed content, including Okta and popular media apps. The attack capitalizes on user familiarity with common online interactions, emphasizing the need for vigilance and skepticism in online activities.

The described threat is a sophisticated social engineering and malware campaign that leverages human trust to infect Windows systems with the NetSupport Remote Access Trojan (RAT). The attack begins with threat actors setting up deceptive websites that mimic legitimate services such as Gitcodes and DocuSign verification pages. These spoofed sites employ fake CAPTCHA challenges and clipboard poisoning techniques to trick users into executing malicious PowerShell scripts. The use of ROT13 encoding and multiple domains adds obfuscation layers, complicating detection and analysis. The multi-stage infection chain involves initial user interaction to run scripts, which then download and install the NetSupport RAT, a well-known remote access tool often abused for unauthorized control and data exfiltration. The campaign also uses persistence mechanisms to maintain long-term access on compromised machines. Similar tactics have been observed targeting other widely used platforms like Okta and popular media applications, indicating a broad and adaptable attack methodology. The campaign exploits common user behaviors and trusted online interactions, making it particularly effective against less security-aware individuals. The attack techniques correspond to several MITRE ATT&CK tactics and techniques, including spearphishing via service (T1566.002), masquerading (T1036), PowerShell execution (T1059.001), persistence (T1547.001), and user execution (T1204.001), among others.

Detailed information about How Threat Actors Exploit Human Trust: A Breakdown of the 'Prove You Are Human' Malware Scheme. Get real-time updates, technical deta

Title	Severity	Type	Source	Date

Threats Tagged 'clipboard poisoning'

Filter Threats

Threats Tagged 'clipboard poisoning'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility