Threats Tagged 'msi'

A sophisticated malware campaign targeting WhatsApp users has been observed since February 2026. The attack chain begins with malicious Visual Basic Script files sent via WhatsApp messages, which, when executed, initiate a multi-stage infection process. The malware uses renamed Windows utilities, retrieves payloads from trusted cloud services, and installs malicious MSI packages. The campaign employs social engineering, stealth techniques, and cloud-based payload hosting to establish persistence and escalate privileges on victim systems. The attackers utilize legitimate tools and trusted platforms to reduce visibility and increase the likelihood of successful execution. The final stage involves the delivery of unsigned MSI installers that enable remote access to compromised systems.

MediumCampaignUnited StatesIndiaBrazil+10#cloud-based#social-engineering#uac-bypass

The Tsundere botnet, discovered in mid-2025, is an active threat targeting Windows users. It utilizes the Ethereum blockchain to retrieve C2 addresses and employs Node.js for its operations. The botnet spreads through MSI installers and PowerShell scripts, often disguised as popular games. It uses AES-256 CBC encryption for communication and can execute dynamic JavaScript code received from the C2 server. The botnet features a marketplace and control panel, allowing users to create and sell customized bots. Attributed to a Russian-speaking actor known as 'koneko', Tsundere is linked to the 123 Stealer and represents an evolution of previous attacks. Its use of smart contracts for C2 infrastructure enhances its resilience, making it a significant emerging threat.

MediumMalwareGermanyFranceUnited Kingdom+4#ethereum#123 stealer#websocket