Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A sophisticated phishing campaign targeting macOS users employs a technique called Clickfix, which tricks victims into running terminal commands that execute malicious AppleScript. This script steals sensitive data including browser profiles, crypto wallets, and personal files. The attackers use fake security prompts and CAPTCHA pages on domains like cryptoinfo-news.com to appear legitimate. The stolen data is exfiltrated to command and control servers, some of which run on unusual ports. The campaign's infrastructure spans multiple regions, with several C2 servers hosted in Russia. The analysis uncovered over 50 related servers with similar configurations, suggesting a financially motivated and globally distributed operation.

The Clickfix campaign is a sophisticated phishing attack targeting macOS users by leveraging social engineering to trick victims into executing malicious terminal commands. These commands run AppleScript code designed to steal sensitive data such as browser profiles, cryptocurrency wallets, and personal files. The attackers employ deceptive tactics including fake security prompts and CAPTCHA pages hosted on domains mimicking legitimate cryptocurrency news sites (e.g., cryptoinfo-news.com) to increase credibility and lure victims into executing the malicious commands. Once executed, the AppleScript stealer collects valuable information and exfiltrates it to a distributed command and control (C2) infrastructure. This infrastructure spans multiple regions, with a notable presence of C2 servers hosted in Russia, operating on unusual ports to evade detection. The campaign is financially motivated, targeting cryptocurrency assets and personal data for monetization. Over 50 related servers with similar configurations have been identified, indicating a large-scale, globally distributed operation. The attack chain involves multiple MITRE ATT&CK techniques such as T1560.001 (Archive Collected Data), T1074.001 (Data Staged), T1059.002 (AppleScript), T1005 (Data from Local System), T1555 (Credentials from Password Stores), T1219 (Remote Access Software), T1020 (Automated Exfiltration), T1102.003 (Web Service), T1048 (Exfiltration Over Alternative Protocol), T1056.002 (Input Capture), T1027 (Obfuscated Files or Information), T1102.002 (Web Protocols), T1070.004 (Indicator Removal on Host), T1071.001 (Application Layer Protocol), and T1105 (Ingress Tool Transfer). The absence of known exploits in the wild suggests this is a targeted phishing campaign rather than an automated exploit. The use of terminal commands and AppleScript on macOS highlights the attackers’ focus on exploiting user trust and macOS-specific scripting capabilities rather than software vulnerabilities.

Detailed information about Clickfix on macOS: AppleScript Stealer, Terminal Phishing, and C2 Infrastructure. Get real-time updates, technical details, and mitig

Clickfix on macOS: AppleScript Stealer, Terminal Phishing, and C2 Infrastructure - Live Threat Intelligence - Threat Radar | OffSeq.com

Clickfix on macOS: AppleScript Stealer, Terminal Phishing, and C2 Infrastructure

Threats Tagged 'cryptowallet'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cryptowallet'

Lead Pen Test Professional