Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A new variant of the XCSSET malware, designed to infect Xcode projects, has been identified with key changes in browser targeting, clipboard hijacking, and persistence mechanisms. This variant employs sophisticated encryption and obfuscation techniques, uses run-only compiled AppleScripts for stealthy execution, and expands its data exfiltration capabilities to include Firefox browser data. It also adds another persistence mechanism through LaunchDaemon entries. The malware features a submodule for monitoring the clipboard and substituting wallet addresses. The infection chain consists of four stages, with modifications to the boot function and introduction of new modules. Changes include additional checks for Firefox browser, modified logic for Telegram existence check, and new info-stealer modules targeting Firefox data.

The XCSSET malware is a sophisticated threat targeting macOS environments, specifically focusing on infecting Xcode projects, which are used by developers to build applications for Apple platforms. The latest variant of XCSSET introduces several advanced features and modifications that enhance its stealth, persistence, and data exfiltration capabilities. This variant employs complex encryption and obfuscation techniques to evade detection by security tools. It uses run-only compiled AppleScripts, which execute stealthily without exposing source code, making analysis and detection more difficult. The infection chain consists of four stages, including modifications to the boot function and the introduction of new modules. Notably, the malware expands its browser targeting to include Firefox, in addition to previously targeted browsers, and introduces new info-stealer modules specifically designed to extract sensitive data from Firefox profiles. It also adds a submodule that monitors the clipboard to hijack and substitute cryptocurrency wallet addresses, a tactic aimed at redirecting financial transactions to attacker-controlled wallets. For persistence, the malware now leverages LaunchDaemon entries, a macOS mechanism that allows malware to maintain execution across system reboots. Additional logic changes include enhanced checks for the presence of Telegram, indicating targeted data theft or reconnaissance from this messaging platform. The malware communicates with multiple command and control domains, many with Russian TLDs, indicating possible infrastructure or origin. Indicators of compromise include several file hashes and domain names associated with the malware's infrastructure. Overall, this variant represents an evolution of XCSSET with increased stealth, persistence, and expanded data theft capabilities, particularly targeting developers and users of macOS who use Xcode and Firefox.

Detailed information about XCSSET evolves again: Analyzing the latest updates to XCSSET's inventory. Get real-time updates, technical details, and mitigation st

XCSSET evolves again: Analyzing the latest updates to XCSSET's inventory - Live Threat Intelligence - Threat Radar | OffSeq.com

XCSSET evolves again: Analyzing the latest updates to XCSSET's inventory

Threats Tagged 'launchdaemon'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'launchdaemon'

Lead Pen Test Professional