Reddit NetSec

AlienVault OTX General

CVE Database V5

Reddit InfoSec News

Exploit-DB RSS Feed

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

An unidentified spyware called Batavia has been targeting Russian industrial organizations since July 2024 through a sophisticated phishing operation. The campaign uses bait emails disguised as contract agreements to trick employees into downloading malicious scripts, initiating a multi-stage infection process. The spyware's ultimate goal is to exfiltrate sensitive internal documents and system data. The attack involves multiple stages, including downloading encrypted VBS scripts, executing Delphi-written executables, and deploying C++-based malware for expanded data theft. Batavia employs advanced evasion tactics and persistence mechanisms, making it a significant threat to organizational security. The campaign remains active, with potential for further damage due to its ability to download additional payloads.

The Batavia spyware campaign represents a sophisticated multi-stage malware attack primarily targeting Russian industrial organizations since July 2024. The attack vector begins with a phishing campaign that delivers weaponized Microsoft Word documents disguised as contract agreements. When an employee opens the malicious document, it triggers the download of encrypted Visual Basic Script (VBS) files. These scripts then execute Delphi-written executables, which subsequently deploy C++-based malware components designed for extensive data theft. This multi-layered infection chain leverages advanced evasion techniques to avoid detection by security solutions and incorporates persistence mechanisms to maintain long-term access within compromised systems. The spyware's main objective is to exfiltrate sensitive internal documents and system data, potentially causing significant intellectual property loss and operational disruption. The campaign remains active and is capable of downloading additional payloads, increasing the risk of further damage or lateral movement within targeted networks. Indicators of compromise include specific file hashes and domains such as oblast-ru.com and ru-exchange.com, which are associated with command and control infrastructure. The attack techniques align with several MITRE ATT&CK tactics and techniques, including phishing (T1566), data from local system (T1005), process injection (T1055), persistence (T1547.001), and obfuscated files or information (T1027). No CVE or known exploits in the wild have been reported for this threat, indicating it relies on social engineering and custom malware rather than exploiting publicly known vulnerabilities.

Detailed information about Spyware Targets Employees via Weaponized Word Documents Delivering Malware Payloads. Get real-time updates, technical details, and mi

Spyware Targets Employees via Weaponized Word Documents Delivering Malware Payloads - Live Threat Intelligence - Threat Radar | OffSeq.com

Spyware Targets Employees via Weaponized Word Documents Delivering Malware Payloads

Cybercriminals are exploiting Discord's invite system and content delivery features to distribute malware and steal sensitive data. They use fake invite links, expired codes, and vanity URLs to redirect users to malicious servers. The attack chain involves a sophisticated combination of social engineering, multi-stage loaders, and time-based evasion tactics. Victims are tricked into authorizing a fake bot, which leads to the deployment of AsyncRAT and a customized Skuld Stealer. These malware variants target browser credentials, Discord tokens, and cryptocurrency wallets. The campaign uses trusted platforms like GitHub and Bitbucket to host encrypted payloads, and employs advanced techniques to bypass security measures and maintain persistence.

The Discord Invite Hijacking campaign is a sophisticated multi-stage attack leveraging Discord's invite system and content delivery mechanisms to distribute malware aimed at stealing sensitive information. Attackers craft fake Discord invite links, expired invite codes, and vanity URLs to redirect users to malicious Discord servers. The attack chain begins with social engineering tactics that trick victims into authorizing a malicious bot within Discord. Once authorized, this bot facilitates the deployment of two primary malware payloads: AsyncRAT, a remote access trojan capable of extensive system control, and a customized variant of Skuld Stealer, which targets browser credentials, Discord authentication tokens, and cryptocurrency wallets. The campaign employs advanced evasion techniques including time-based payload delivery and encrypted multi-stage loaders hosted on trusted platforms such as GitHub and Bitbucket, which help bypass traditional security controls and maintain persistence on infected systems. The malware leverages techniques such as credential dumping (T1005), process injection (T1055), persistence mechanisms (T1547.001), and command and control communication over standard protocols (T1071.001). The use of wallet injection techniques and targeting of cryptocurrency assets highlights a financial motivation. This campaign does not require exploitation of software vulnerabilities but relies heavily on social engineering and user interaction to initiate the infection chain. No known exploits in the wild have been reported yet, but the campaign’s use of trusted infrastructure and sophisticated evasion tactics make it a credible threat vector for users of Discord and related platforms.

Detailed information about Discord Invite Hijacking: How Fake Links Are Delivering Infostealers. Get real-time updates, technical details, and mitigation strate

Discord Invite Hijacking: How Fake Links Are Delivering Infostealers - Live Threat Intelligence - Threat Radar | OffSeq.com

Discord Invite Hijacking: How Fake Links Are Delivering Infostealers

The article describes a surge in ClickFix campaigns using GHOSTPULSE to deploy Remote Access Trojans and data-stealing malware. It analyzes a multi-stage attack that begins with ClickFix social engineering, deploys GHOSTPULSE loader, and ultimately delivers ARECHCLIENT2, a potent remote access trojan and infostealer. The campaign exploits user psychology, bypasses traditional defenses, and has seen increased activity in 2025. The analysis covers the infection chain, technical details of GHOSTPULSE and ARECHCLIENT2, and the associated infrastructure. The attack targets a wide range of sensitive user data and system information, including cryptocurrency wallets, browser data, and system details.

The threat described involves a sophisticated multi-stage malware campaign that leverages social engineering and advanced malware loaders to deploy a potent Remote Access Trojan (RAT) and information stealer. The attack begins with a deceptive social engineering tactic known as ClickFix, which manipulates users into executing malicious payloads. This initial deception is critical as it bypasses traditional security defenses by exploiting user psychology rather than relying solely on technical vulnerabilities. Once the user is compromised, the GHOSTPULSE loader is deployed. GHOSTPULSE acts as a sophisticated delivery mechanism that loads subsequent malicious components onto the victim's system. The final payload is ARECHCLIENT2, a powerful RAT and infostealer that targets a broad spectrum of sensitive data. This includes cryptocurrency wallets, browser-stored credentials and data, and detailed system information. The campaign's multi-stage nature allows it to evade detection by segmenting the attack into smaller, less suspicious steps, complicating incident response and forensic analysis. The technical details highlight the use of various tactics and techniques mapped to MITRE ATT&CK, such as T1539 (stealing application access tokens), T1566.002 (spearphishing link), T1082 (system information discovery), T1140 (deobfuscate/decode files or information), T1059 (command and scripting interpreter), T1204 (user execution), T1057 (process discovery), T1059.001 (PowerShell), T1574.002 (DLL side-loading), T1105 (ingress tool transfer), and T1204.001 (malicious file execution). These techniques indicate a highly versatile and evasive malware campaign that leverages both social engineering and technical exploitation to achieve persistence, data exfiltration, and remote control. The campaign has seen increased activity in 2025, signaling an evolving threat landscape. The associated infrastructure and malware components are actively analyzed by security researchers, with references such as Elastic Security Labs providing in-depth technical insights.

Detailed information about From ClickFix deception to information stealer deployment. Get real-time updates, technical details, and mitigation strategies.

From ClickFix deception to information stealer deployment - Live Threat Intelligence - Threat Radar | OffSeq.com

From ClickFix deception to information stealer deployment

A sophisticated multi-stage carding attack on a Magento eCommerce website has been uncovered. The malware used a fake gif image file, local browser sessionStorage data, and a malicious reverse-proxy server to steal credit card data, login details, cookies, and other sensitive information. The attack targeted an outdated Magento 1.9.2.4 installation, exploiting its lack of support and security vulnerabilities. The malware injected JavaScript code disguised as Bing tracking code and utilized a tampered payment file to create a user-specific attack. This advanced technique allowed the attackers to intercept and manipulate all website traffic while remaining undetected by victims and administrators.

This threat describes a sophisticated multi-stage card skimming attack targeting Magento eCommerce websites, specifically exploiting an outdated Magento 1.9.2.4 installation. The attackers leverage a combination of advanced techniques to stealthily intercept and exfiltrate sensitive customer data, including credit card details, login credentials, cookies, and other session information. The attack begins with the injection of malicious JavaScript code disguised as legitimate Bing tracking code embedded into the compromised Magento site. This code interacts with the local browser's sessionStorage to harvest session-specific data, enabling the attackers to tailor the attack to individual users. A fake GIF image file is used as a decoy or delivery mechanism, likely to evade detection by security tools and administrators. The core of the attack involves a malicious reverse-proxy server that intercepts and manipulates all website traffic between the user and the legitimate Magento server. This reverse proxy setup allows attackers to transparently capture sensitive data during the checkout process without alerting users or site administrators. The use of a tampered payment file further personalizes the attack, ensuring the malicious payload is delivered only to targeted users, thereby reducing the risk of detection. The attack exploits the lack of security updates and support for Magento 1.9.2.4, which contains known vulnerabilities facilitating code injection and unauthorized access. Indicators of compromise include suspicious URLs such as http://217.12.207.38/positions/02/, associated with the malicious reverse proxy infrastructure. Although no known exploits are currently reported in the wild, the complexity and stealth of this campaign indicate a high level of attacker sophistication and persistence. Overall, this attack represents a novel combination of reverse-proxy interception, sessionStorage exploitation, and obfuscated JavaScript injection to conduct card skimming on eCommerce platforms.

Detailed information about Fake GIF Leveraged in Multi-Stage Reverse-Proxy Card Skimming Attack. Get real-time updates, technical details, and mitigation strate

Fake GIF Leveraged in Multi-Stage Reverse-Proxy Card Skimming Attack - Live Threat Intelligence - Threat Radar | OffSeq.com

Fake GIF Leveraged in Multi-Stage Reverse-Proxy Card Skimming Attack

A newly discovered APT campaign dubbed Swan Vector is targeting educational institutes and mechanical engineering industries in Taiwan and Japan. The attack uses a sophisticated multi-stage infection chain involving malicious LNK files, DLL implants (Pterois and Isurus), and Cobalt Strike payloads. The threat actor employs various evasion techniques including API hashing, direct syscalls, DLL sideloading, and self-deletion. Google Drive is abused as a command-and-control server. While attribution remains uncertain, similarities with Winnti, Lazarus, and APT10 techniques have been observed. The campaign has been active since December 2024 and is expected to continue with new implants targeting additional applications.

The Swan Vector campaign is a sophisticated Advanced Persistent Threat (APT) operation targeting educational institutions and mechanical engineering sectors primarily in Taiwan and Japan. The attack employs a multi-stage infection chain beginning with malicious LNK (Windows shortcut) files that serve as the initial infection vector. Upon execution, these LNK files trigger the loading of DLL implants named Pterois and Isurus. These implants leverage advanced evasion techniques such as API hashing, which obfuscates API calls to avoid detection by security tools; direct syscalls, which bypass user-mode hooks; DLL sideloading, where malicious DLLs are loaded by legitimate applications to evade detection; and self-deletion to remove traces post-execution. The implants facilitate the deployment of Cobalt Strike payloads, a well-known post-exploitation framework used for lateral movement, persistence, and command and control (C2). Notably, the threat actor abuses Google Drive as a C2 server, leveraging a trusted cloud service to evade network-based detection and filtering. Although attribution is uncertain, the tactics, techniques, and procedures (TTPs) share similarities with known APT groups such as Winnti, Lazarus, and APT10, indicating a high level of sophistication and potential state-sponsored backing. Active since December 2024, the campaign is expected to evolve with new implants targeting additional applications, suggesting ongoing and adaptive threat activity.

Detailed information about Targeting Taiwan & Japan with DLL Implants. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'multi-stage attack'

Filter Threats

Threats Tagged 'multi-stage attack'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility