Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Kaspersky Security Blog

Check Point Research

CVE Database V5

AlienVault OTX General

SANS ISC Handlers Diary

SecurityWeek

Threatpost

The Hacker News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit NetSec

Reddit InfoSec News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

This analysis details a sophisticated DPRK-linked operation called Contagious Interview, which uses a fake job platform to target U.S. AI talent. The campaign mimics legitimate recruitment processes, offering job listings from well-known tech companies to lure victims. The platform, hosted at lenvny[.]com, is designed to appear as a legitimate AI-powered interview tool. It employs various techniques to establish credibility, including professional design, fake testimonials, and comparisons with real companies. The attack culminates in a malware delivery through a clipboard hijacking technique, triggered when victims attempt to record a video introduction. This operation specifically targets high-value professionals in AI and cryptocurrency sectors, aiming to gain access to strategic information and financial assets.

The Contagious Interview campaign is a DPRK-linked cyber espionage and financial theft operation leveraging a fake job platform to target high-value AI and cryptocurrency professionals, primarily in the U.S. The platform, hosted at lenvny.com and related domains, is designed to appear as a legitimate AI-powered interview tool, complete with professional UI, fake testimonials, and references to well-known tech companies to establish credibility. Victims are lured into engaging with the platform under the guise of job interviews, where they are prompted to record video introductions. This user action triggers a clipboard hijacking malware delivery mechanism that captures sensitive data and executes malicious payloads. The malware employs techniques such as code obfuscation (T1027), persistence via registry run keys (T1547.001, T1547.009), masquerading (T1036), and command execution through scripting (T1059.001, T1059.005). The campaign also uses social engineering (T1566) and remote access tools (T1105) to maintain control and exfiltrate data. Although no CVE or known exploits are reported, the operation’s complexity and targeted nature indicate a well-resourced adversary aiming to steal intellectual property and cryptocurrency assets. Indicators of compromise include specific IP addresses (69.62.86.78, 72.61.9.45) and domains (advisorflux.com, assureeval.com, carrerlilla.com, lenvny.com). The campaign’s focus on AI and cryptocurrency sectors highlights the strategic intent to access cutting-edge technology and financial resources.

Detailed information about Inside DPRK's Fake Job Platform Targeting U.S. AI Talent. Get real-time updates, technical details, and mitigation strategies.

Inside DPRK's Fake Job Platform Targeting U.S. AI Talent - Live Threat Intelligence - Threat Radar | OffSeq.com

Inside DPRK's Fake Job Platform Targeting U.S. AI Talent

This analysis reveals the resurgence of SpyNote, a potent Android RAT, distributed through deceptive websites mimicking Google Play Store. The malware employs sophisticated techniques for surveillance, data exfiltration, and remote control. Recent changes include minor IP resolution adjustments and enhanced anti-analysis measures in the APK dropper. SpyNote's capabilities include keylogging, camera and microphone control, and abuse of Android's Accessibility Services. The threat actor demonstrates persistence and limited technical adaptability, targeting consumers broadly with lures mimicking popular applications. Key technique changes involve dynamic payload decryption, DEX element injection, and obfuscation of C2 logic. The campaign underscores the ongoing threat of mobile RATs and the need for vigilance against social engineering tactics.

SpyNote is a sophisticated Android Remote Access Trojan (RAT) that has resurfaced as a significant mobile malware threat. It is distributed primarily through deceptive websites that impersonate the legitimate Google Play Store, tricking users into downloading malicious APK files. The malware's architecture enables extensive surveillance and remote control capabilities on infected devices. Key functionalities include keylogging to capture user input, unauthorized access to the device's camera and microphone for covert monitoring, and exploitation of Android's Accessibility Services to bypass security restrictions and enhance control. Recent technical enhancements in SpyNote include dynamic payload decryption, which allows the malware to evade static detection by decrypting its malicious components only at runtime, and DEX element injection, a technique that inserts malicious code into legitimate Android executable files to further obfuscate its presence. Additionally, the command and control (C2) logic has been obfuscated to hinder reverse engineering and analysis efforts. The APK dropper component has been updated with minor IP resolution changes and improved anti-analysis features, making it more resilient against sandboxing and automated detection tools. Despite these advancements, the threat actor behind SpyNote shows limited technical adaptability, relying heavily on social engineering tactics such as mimicking popular applications to lure a broad consumer base into installing the malware. This campaign highlights the persistent threat posed by mobile RATs, especially in the Android ecosystem, where sideloading from unofficial sources remains a common infection vector.

Detailed information about SpyNote Malware Analysis. Get real-time updates, technical details, and mitigation strategies.

SpyNote Malware Analysis - Live Threat Intelligence - Threat Radar | OffSeq.com

SpyNote Malware Analysis

Cybercriminals are exploiting an AI-powered website creation platform called Lovable to generate fraudulent websites for credential phishing and malware delivery. The threat actors create or clone sites impersonating well-known brands, use CAPTCHA for filtering, and post stolen credentials to Telegram. Campaigns observed include Tycoon phishing, payment and personal data theft, cryptocurrency wallet draining, and malware distribution. The ease of use of such AI tools significantly lowers the barrier to entry for cybercriminals, allowing them to quickly create convincing phishing pages. While Lovable has implemented new security measures, organizations are advised to consider allow-listing policies for frequently abused tools.

This threat involves cybercriminals exploiting an AI-powered website creation platform named Lovable to rapidly generate fraudulent websites used for phishing and malware distribution. Attackers leverage the platform's ease of use to create or clone websites impersonating well-known brands, thereby increasing the credibility of their phishing campaigns. These fake sites are designed to steal credentials, payment information, personal data, and cryptocurrency wallet details. Additionally, the threat actors employ CAPTCHA mechanisms on these phishing sites to filter out automated bots and ensure interaction with real victims. Stolen credentials and data are then posted to Telegram channels, facilitating further criminal activities. Campaigns observed include Tycoon phishing (a known phishing kit), payment and personal data theft, cryptocurrency wallet draining, and malware delivery using loaders such as Doiloader and Zgrat. The attack techniques align with several MITRE ATT&CK tactics and techniques including command and scripting interpreter abuse (T1059), remote file copy (T1102), user execution (T1204), phishing (T1566), and credential dumping (T1056). Although Lovable has implemented new security measures to mitigate abuse, the threat remains significant due to the lowered barrier to entry for attackers using AI tools to create convincing phishing pages quickly. Indicators of compromise include specific malicious IP addresses, URLs, and domains associated with these campaigns. The threat does not currently have known exploits in the wild but represents a growing trend in leveraging AI for malicious purposes.

Detailed information about Cybercriminals Abuse AI Website Creation App For Phishing. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'malware delivery'

Stop chasing alerts. Route them.

Filter Threats

Threats Tagged 'malware delivery'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility