Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

GCP Compute Engine Security

JVN Japan

AWS Security Bulletins

GCP Kubernetes Security

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

An analysis of several Windows applications masquerading as legitimate utilities reveals a covert malware operation. These apps, including fake speed testers and AI search tools, install a Node.js runtime and execute obfuscated JavaScript via scheduled tasks. The malware communicates with a command and control server, potentially allowing arbitrary code execution. The operation's sophistication lies in its use of seemingly benign applications as cover for persistent background processes. The malware's capabilities include encoded network communications and the ability to receive and execute remote commands. This technique significantly expands the attack surface, as the malicious component operates independently from the visible application.

This threat involves a malware campaign leveraging fake Windows applications that masquerade as legitimate utilities such as online speed test tools and AI search applications. These deceptive applications install a Node.js runtime environment on the victim's machine and execute obfuscated JavaScript code via scheduled tasks, enabling persistent and covert execution. The malware establishes communication with a command and control (C2) server using encoded network protocols, allowing attackers to remotely issue commands and execute arbitrary code on the compromised system. The use of scheduled tasks (T1053.005) ensures persistence by automatically running the malicious payload at predefined intervals without user interaction. The obfuscation of JavaScript payloads (T1027) and encoded network communications (T1573.001) complicate detection and analysis. Additionally, the malware collects system information (T1082), performs credential dumping or reconnaissance (T1057), and can download and execute additional payloads (T1105), expanding its capabilities and attack surface. The campaign's sophistication lies in its ability to operate independently from the visible fake applications, making it difficult for users and traditional security tools to detect malicious activity. This technique effectively hides the malware's presence under the guise of benign utilities, increasing the likelihood of infection and persistence on targeted systems.

Detailed information about Fake Online Speedtest Application. Get real-time updates, technical details, and mitigation strategies.

Fake Online Speedtest Application - Live Threat Intelligence - Threat Radar | OffSeq.com

Fake Online Speedtest Application

Threats Tagged 'javascript payload'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'javascript payload'

Lead Pen Test Professional