Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A sophisticated malware campaign called JSCEAL is targeting cryptocurrency users through fake apps impersonating popular trading platforms. The attackers use malicious ads to lure victims into downloading installers that deploy a multi-stage infection chain. This includes PowerShell scripts for profiling and a final payload of compiled JavaScript (JSC) files executed via Node.js. The JSCEAL malware steals crypto-related data and credentials while employing advanced evasion techniques. The campaign has potentially reached millions of users across multiple countries, primarily targeting the cryptocurrency and financial sectors.

The JSCEAL malware campaign represents a sophisticated multi-stage attack targeting cryptocurrency users by leveraging fake applications that impersonate legitimate and popular cryptocurrency trading platforms. The attackers employ malvertising techniques to distribute malicious installers, which initiate a complex infection chain. This chain begins with PowerShell scripts used for system profiling and reconnaissance, gathering detailed information about the victim's environment. The final payload consists of compiled JavaScript files executed via Node.js, a runtime environment that allows JavaScript to run outside a browser. This approach enables the malware to perform stealthy operations and evade traditional detection mechanisms. JSCEAL is designed to steal sensitive cryptocurrency-related data, including wallet credentials and private keys, thereby compromising the confidentiality and integrity of users' digital assets. The malware also incorporates advanced evasion techniques such as obfuscation, anti-debugging, and persistence mechanisms to maintain long-term access and avoid detection. Although no known exploits are currently reported in the wild, the campaign has potentially affected millions of users worldwide, primarily focusing on the cryptocurrency and financial sectors. The use of Node.js for executing malicious JavaScript payloads is notable, as it allows attackers to blend in with legitimate development environments and complicates detection efforts. The campaign's reliance on fake apps and malvertising highlights the importance of user vigilance and robust application vetting processes.

Detailed information about Sealed Chain of Deception: Actors leveraging Node.JS to Launch JSCeal. Get real-time updates, technical details, and mitigation strat

Sealed Chain of Deception: Actors leveraging Node.JS to Launch JSCeal - Live Threat Intelligence - Threat Radar | OffSeq.com

Sealed Chain of Deception: Actors leveraging Node.JS to Launch JSCeal

Threats Tagged 'fake apps'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'fake apps'

Lead Pen Test Professional