Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

This analysis delves into the HijackLoader malware campaign, which has gained prominence since 2023 for its sophisticated payload delivery and evasion techniques. The campaign initiates with a CAPTCHA-based phishing attack, progressing through multiple stages of obfuscated PowerShell scripts. It employs advanced anti-analysis methods, including anti-VM checks and registry manipulation. The final payload, typically an infostealer like NekoStealer or Lumma, is delivered via a multi-stage process involving packed .NET executables and protected DLLs. The loader's evolution and its role in the broader malware-as-a-service ecosystem underscore the need for organizations to focus on detecting initial access and intermediate stages rather than just final payloads.

The Clickfix HijackLoader phishing campaign is a sophisticated malware distribution operation that has been active since 2023. It begins with a CAPTCHA-based phishing attack designed to bypass automated detection and lure victims into executing malicious content. The campaign employs multiple stages of obfuscated PowerShell scripts, which complicate detection and analysis efforts. These scripts incorporate advanced anti-analysis techniques such as anti-virtual machine (anti-VM) checks and registry manipulation to evade sandbox environments and forensic tools. The multi-stage infection chain culminates in the delivery of infostealer malware, primarily variants like NekoStealer or Lumma, which are known for harvesting sensitive information such as credentials, cookies, and system details. The payload delivery involves packed .NET executables and protected DLLs, adding layers of complexity to reverse engineering and detection. This campaign exemplifies the malware-as-a-service model, where loaders like HijackLoader facilitate the distribution of various payloads for different threat actors. The campaign’s sophistication and modularity highlight the importance of detecting early-stage indicators such as phishing attempts and intermediate script execution, rather than focusing solely on the final payload. Indicators of compromise include numerous file hashes, suspicious domains, and an IP address linked to the campaign infrastructure. The campaign leverages multiple MITRE ATT&CK techniques, including T1566.002 (phishing), T1497.001 (virtualization/sandbox evasion), T1059.001 (PowerShell), and T1071.001 (application layer protocol), among others, underscoring its complexity and evasive capabilities.

Detailed information about Deconstructing a Cyber Deception: An Analysis of the Clickfix HijackLoader Phishing Campaign. Get real-time updates, technical detail

Deconstructing a Cyber Deception: An Analysis of the Clickfix HijackLoader Phishing Campaign - Live Threat Intelligence - Threat Radar | OffSeq.com

Deconstructing a Cyber Deception: An Analysis of the Clickfix HijackLoader Phishing Campaign

Threats Tagged 'nekostealer'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'nekostealer'

Lead Pen Test Professional