Reddit NetSec

AlienVault OTX General

CVE Database V5

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

OSINT - Kronos Banking Trojan Used to Deliver New Point-of-Sale Malware

The Kronos banking Trojan is a well-known piece of malware primarily designed to steal banking credentials by intercepting user input and network traffic related to online banking sessions. This particular threat intelligence report highlights that the Kronos Trojan has been repurposed or used as a delivery mechanism for new Point-of-Sale (POS) malware. POS malware typically targets retail and hospitality environments to capture payment card data directly from the memory of POS terminals during transaction processing. The combination of Kronos as a delivery vector and new POS malware payloads indicates a shift or expansion in the threat actor's tactics to broaden their data theft capabilities beyond banking credentials to include payment card data. Although the report dates back to 2016 and is marked with low severity, the technical details suggest a multi-stage attack where Kronos compromises a system and subsequently installs POS malware to harvest sensitive financial data. The lack of affected versions or patch information implies this is a malware campaign rather than a software vulnerability. No known exploits in the wild are reported, but the threat remains relevant due to the persistent use of banking Trojans and POS malware in cybercrime. The technical complexity involves initial infection by Kronos, which then downloads and executes the POS malware payload, potentially evading detection by blending banking credential theft with payment card data theft.

EmployeeID-847267.doc downloading payload (Kronos) on Nov 10

EmployeeID-6283.doc downloading payload (Kronos) on Nov 14

Detailed information about OSINT - Kronos Banking Trojan Used to Deliver New Point-of-Sale Malware. Get real-time updates, technical details, and mitigation str

OSINT - Kronos Banking Trojan Used to Deliver New Point-of-Sale Malware - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Trojan downloader found on Google Play by @Maler360

This threat concerns a Trojan downloader malware identified on the Google Play Store, as reported by the security researcher @Maler360 and documented by CIRCL under the ms-caro-malware project. A Trojan downloader is a type of malicious software designed to infiltrate a device and subsequently download additional malicious payloads, potentially leading to further compromise. The malware was discovered in 2019 and classified as a Trojan, indicating its capability to masquerade as legitimate software while performing unauthorized actions. Although specific affected versions or targeted applications are not detailed, the presence on Google Play suggests that the malware was distributed through seemingly legitimate Android applications, exploiting the trust users place in the official app store. The threat level is indicated as 3 (on an unspecified scale), and the severity is marked as low, with a 50% certainty rating, implying moderate confidence in the threat's impact or prevalence. No known exploits in the wild have been reported, and no technical indicators or patches are provided, limiting detailed technical analysis. However, the nature of Trojan downloaders typically involves initial infection vectors that bypass user suspicion, followed by downloading and executing additional malicious components, which can lead to data theft, device control, or further malware propagation.

Detailed information about OSINT - Trojan downloader found on Google Play by @Maler360. Get real-time updates, technical details, and mitigation strategies.

OSINT - Trojan downloader found on Google Play by @Maler360 - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Threat Spotlight: Panda Banker Trojan Targets the US, Canada and Japan

The Panda Banker Trojan is a type of banking malware primarily designed to steal financial information from infected users by employing techniques such as 'man-in-the-browser' (MITB) attacks. This malware intercepts and manipulates web traffic between the user and banking websites, allowing attackers to capture credentials, session cookies, and other sensitive data without the user's knowledge. The Trojan is known to target banking customers in the US, Canada, and Japan, leveraging social engineering and possibly other malware like Emotet and Geodo to propagate. Although the provided information does not specify affected software versions or detailed infection vectors, the association with MITRE ATT&CK technique T1185 indicates that the Trojan operates by injecting malicious code into web browsers to intercept and alter banking transactions in real time. The threat level is indicated as low, and no known exploits in the wild are reported in this dataset, suggesting limited active campaigns or lower sophistication compared to other banking Trojans. However, the presence of multiple malware families and attack patterns in the tags implies a complex threat landscape where Panda Banker may be part of a broader malware ecosystem.

Detailed information about OSINT - Threat Spotlight: Panda Banker Trojan Targets the US, Canada and Japan. Get real-time updates, technical details, and mitigat

OSINT - Threat Spotlight: Panda Banker Trojan Targets the US, Canada and Japan - Live Threat Intelligence - Threat Radar | OffSeq.com

The threat identified as "Kronos Reborn" is a malware classified as a banker Trojan, linked to the Kronos malware family and associated with the Smoke Loader malware delivery framework. Kronos is known for its capability to steal banking credentials by injecting malicious code into web browsers and intercepting user input, primarily targeting online banking sessions. The "Reborn" designation suggests this is a variant or resurgence of the original Kronos malware. While the provided data lacks detailed technical specifics such as affected versions or exploitation vectors, the association with Smoke Loader indicates that the malware is distributed via a loader that facilitates the delivery of additional payloads, enabling modular and persistent infection. The threat level is indicated as low, with no known exploits in the wild at the time of reporting (2018). The malware operates as a trojan, implying it masquerades as legitimate software or is delivered through social engineering tactics. The lack of patch links and CWE identifiers suggests no direct software vulnerability exploitation but rather a malware infection relying on user interaction or phishing. The malware's primary goal is credential theft, which can lead to financial fraud and unauthorized access to sensitive banking information.

Detailed information about OSINT - Kronos Reborn. Get real-time updates, technical details, and mitigation strategies.

OSINT - Kronos Reborn - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Kronos Reborn

The analyzed threat pertains to a collection of Mac malware variants identified around 2017, as documented by CIRCL and aggregated in the MISP Galaxy project. This malware family includes multiple tools and malware types such as Fruitfly, MacDownloader, MacRansom ransomware, MacSpy RAT, Empyre, Proton, Mughthesec, Pwnet, Cpumeaner, Filecoder ransomware, Dok banker malware, XAgentOSX, X-Agent, and Turla. These represent a diverse set of malicious software targeting macOS systems, encompassing remote access trojans (RATs), ransomware, banking trojans, and espionage tools. The malware variants have been linked to espionage campaigns, data theft, and financial fraud, with some tools like Fruitfly and XAgentOSX historically associated with advanced persistent threat (APT) groups. The technical details indicate a moderate threat level (3) and limited analysis depth (2), with no known exploits in the wild at the time of reporting. The malware is categorized primarily as trojans and ransomware, capable of compromising confidentiality, integrity, and availability of affected systems. The lack of affected versions and patch links suggests these malware samples exploit user behavior or social engineering rather than specific software vulnerabilities. The threat is documented as OSINT from blog posts and technical reports, indicating publicly available intelligence rather than classified or zero-day exploits. Overall, this represents a persistent threat to macOS users from multiple malware families with varying capabilities, primarily relying on infection vectors such as phishing, malicious downloads, or compromised websites.

Detailed information about OSINT - Mac Malware of 2017. Get real-time updates, technical details, and mitigation strategies.

OSINT - Mac Malware of 2017 - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Mac Malware of 2017

OSINT - The Emotet Banking Trojan: Analysis of Dropped Malware Morphing at Scale

Emotet is a well-known banking Trojan that has evolved significantly since its initial discovery. This malware primarily targets banking credentials but has expanded its capabilities to include modular payload delivery, enabling it to drop additional malware variants. The key technical characteristic of Emotet highlighted in this analysis is its ability to morph its dropped malware at scale, meaning it frequently changes its payload signatures and behaviors to evade detection by traditional antivirus and endpoint security solutions. This morphing capability complicates signature-based detection and forensic analysis, as each infection instance may differ in code structure and behavior. Emotet typically propagates via phishing campaigns that deliver malicious attachments or links, exploiting social engineering tactics to trick users into executing the payload. Once executed, Emotet establishes persistence on the infected system, communicates with command-and-control (C2) servers to receive instructions, and can download additional modules such as information stealers, ransomware, or other banking Trojans like Geodo. Despite its sophistication, the provided information indicates a low severity rating, possibly reflecting the age of the data (published in 2017) or the specific context of this analysis. However, Emotet remains a significant threat due to its modularity, polymorphic nature, and widespread use in cybercrime campaigns. The lack of known exploits in the wild for this specific morphing technique suggests that while the malware is active, the morphing aspect is more about evasion than exploitation of new vulnerabilities. The technical details show a moderate threat level and analysis score, indicating ongoing monitoring and research interest.

Detailed information about OSINT - The Emotet Banking Trojan: Analysis of Dropped Malware Morphing at Scale. Get real-time updates, technical details, and mitig

OSINT - The Emotet Banking Trojan: Analysis of Dropped Malware Morphing at Scale - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Zeus Panda Banking Trojan Targets Online Holiday Shoppers

The Zeus Panda Banking Trojan is a type of malware specifically designed to target online banking users, with a particular focus on online holiday shoppers. This Trojan operates by infiltrating victim systems, typically through phishing campaigns or malicious downloads, and then intercepting banking credentials and other sensitive financial information. Once installed, Zeus Panda can perform web injection attacks, modifying banking websites in real-time to steal login credentials, two-factor authentication codes, and other personal data. The malware is known for its stealth and persistence, often evading detection by traditional antivirus solutions. Although the provided information does not specify affected versions or detailed technical mechanisms, Zeus Panda is categorized as a banker Trojan, indicating its primary function is financial theft. The targeting of holiday shoppers suggests attackers exploit increased online shopping activity during peak seasons to maximize infection rates and financial gain. Despite being reported in 2017 with a low severity rating and no known exploits in the wild at the time, the Trojan remains a relevant threat due to the ongoing prevalence of online banking and e-commerce.

Detailed information about OSINT - Zeus Panda Banking Trojan Targets Online Holiday Shoppers. Get real-time updates, technical details, and mitigation strategie

OSINT - Zeus Panda Banking Trojan Targets Online Holiday Shoppers - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Emotet Trojan Acts as Loader, Spreads Automatically

Emotet is a well-known Trojan malware that primarily functions as a loader, enabling the delivery and execution of additional malicious payloads on compromised systems. Initially identified around 2017, Emotet has evolved into a sophisticated modular threat that spreads automatically, often leveraging network propagation techniques and malicious email campaigns. Its capability to act as a loader means it can download and install other malware families, such as ransomware or banking trojans, thereby amplifying its impact. The automatic spreading feature allows Emotet to propagate within networks by exploiting weak credentials, leveraging phishing emails with malicious attachments or links, and exploiting vulnerabilities in network protocols or software. This makes it particularly dangerous in enterprise environments where lateral movement can lead to widespread compromise. Although the provided information classifies the severity as low and indicates no known exploits in the wild at the time of the report, Emotet’s historical behavior and modularity have made it a persistent and evolving threat in the cybersecurity landscape. The lack of specific affected versions or patches suggests that Emotet is not tied to a particular software vulnerability but rather exploits human factors and network weaknesses to spread.

Detailed information about OSINT - Emotet Trojan Acts as Loader, Spreads Automatically. Get real-time updates, technical details, and mitigation strategies.

OSINT - Emotet Trojan Acts as Loader, Spreads Automatically - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Ursnif variant found using mouse movement for decryption and evasion

The threat described is a variant of the Ursnif malware, a well-known banking Trojan primarily used to steal sensitive financial information. This particular variant employs an unusual evasion technique by leveraging mouse movement data to decrypt its payload and avoid detection. Typically, malware uses static or predictable decryption routines, but this Ursnif variant requires user interaction—specifically mouse movements—to trigger the decryption process. This approach complicates automated analysis and sandbox detection, as the malware remains encrypted and inert without the mouse movement input, thereby evading many traditional behavioral detection mechanisms. Ursnif malware is known for its modular architecture, enabling it to steal credentials, capture screenshots, log keystrokes, and exfiltrate data. The use of mouse movement as a decryption key or trigger is a sophisticated anti-analysis technique that increases the stealthiness of the malware and reduces the likelihood of early detection by security tools. Although the severity is marked as low in the provided data, the underlying malware family is significant due to its financial theft capabilities and persistence. The lack of known exploits in the wild and absence of specific affected versions suggest this is an intelligence report rather than an active widespread campaign. However, the technique itself represents an evolution in malware evasion tactics, highlighting the need for advanced behavioral detection and user activity simulation in sandbox environments.

Detailed information about OSINT - Ursnif variant found using mouse movement for decryption and evasion. Get real-time updates, technical details, and mitigatio

OSINT - Ursnif variant found using mouse movement for decryption and evasion - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - New Loki Variant Being Spread via PDF File

The threat described involves a new variant of the Loki malware family being distributed via PDF files. Loki is a type of trojan malware known for its capability to steal sensitive information from infected systems, including credentials, browser data, and system information. The distribution vector in this case is a malicious PDF file, which likely exploits social engineering tactics to entice users into opening the file, triggering the malware execution. Once executed, the Loki variant can perform data exfiltration and potentially establish persistence on the infected host. Although the specific technical details of this variant are limited, the use of PDF files as a delivery mechanism is notable because PDFs are commonly used in business communications, making them an effective vector for spreading malware. The threat level is indicated as low, and there are no known exploits in the wild at the time of reporting. The absence of affected versions or patch links suggests this is a newly observed variant rather than a vulnerability in a specific software product. The malware is categorized as a trojan, implying it masquerades as legitimate software or content to deceive users. The information is sourced from CIRCL and tagged under the misp-galaxy project as 'flokibot,' which is associated with Loki malware variants.

Detailed information about OSINT - New Loki Variant Being Spread via PDF File. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'malware_classification:malware-category="trojan"'

Filter Threats

Threats Tagged 'malware_classification:malware-category="trojan"'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility