Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

AlienVault OTX General

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A newly uncovered campaign abuses the Trillion (formerly Trellian) AdTech network, mimicking the flow of a Traffic Direction System (TDS) to trick visitors of typo-squatted domains into downloading Microsoft Store apps that contain browser hijacking malware. While the abuse of AdTech networks to deliver malware isn’t new, this campaign highlights incredibly similar tactics to VexTrio and previous TDS networks; further blurring the line between AdTech and malicious TDS systems.

This threat involves a campaign that abuses the Trillion (formerly Trellian) AdTech network to deliver browser hijacking malware through Microsoft Store applications. The attackers exploit typo-squatted domains—domains that closely resemble legitimate ones but contain slight misspellings—to lure users into downloading malicious apps from the Microsoft Store. The campaign mimics the behavior of Traffic Direction Systems (TDS), which are commonly used in malicious advertising to redirect traffic through a chain of servers to evade detection and deliver payloads. By leveraging this pseudo-TDS approach, the attackers effectively blend malicious activity with legitimate AdTech traffic, complicating detection efforts. The malware delivered primarily hijacks browsers, potentially changing homepage settings, search engines, or injecting ads, thereby compromising user privacy and security. The campaign shares similarities with previous threats like VexTrio, indicating a continued evolution of AdTech abuse techniques. Although no known exploits in the wild have been reported, the campaign's use of legitimate Microsoft Store apps as a delivery vector is notable, as it bypasses some traditional security controls. The attack chain involves social engineering to convince users to install these apps, exploiting trust in the Microsoft Store ecosystem. The campaign is tagged with MITRE ATT&CK techniques such as T1036 (Masquerading), T1102 (Web Service), T1568 (Dynamic Resolution), and T1547 (Boot or Logon Autostart Execution), indicating sophisticated persistence and evasion tactics. Overall, this threat highlights the increasing convergence of advertising technology abuse and malware distribution through trusted platforms.

MD5 of afa2250fb08d3c47b09ee5dca817fd686f4196e22d834993dc8a9ac36630c22e

MD5 of a6023a1eb13286242318383783cb09ca702e40d086403a1521f377aed088d927

MD5 of 930f0039cbc94d9aa39311b4c2f533dc6de67f433ea3f07091b051fab145b3f9

MD5 of 228c316455d5ed69232adcbe9acd033092f200014cfa7ed40d6c382f07b19b82

MD5 of 640088274eee03faab19c4296764a66a3c2efd9023fcf8be677a117d7725df00

MD5 of 06245bdbc4b8ea1c2ec57da25cee8e4f8617ee5b0769de570fab6433c7be579e

MD5 of 59579af118faca431f7b464ad3a8592c467314274ccea7547153ed8d00667d40

MD5 of e6b69a432c63b6268acffae22125cb0a1000cb83b080f75f6072537ac7b51d58

MD5 of 84da4be52c1e1f6729b2dfcd05d84d9f9dc5fef3e906ef38dd88749f2dde9dec

MD5 of 58388c8efbee568b805a80078b789e9c39b4af6d97c1029da902897e77b5ec58

MD5 of f9af137fc8c0232d7b52557f4276ded47f000566231617a0f6955bc28b7b1ebc

MD5 of 24ec63f3976d04f5e7a7f229ae76301bd1ca6099016d65a727d1c33459853847

MD5 of d0b0aaf3bf2a21c6b5b1a899da311f400bbc8fcaa9290e1d2811a5addd5941e9

MD5 of e0b54f6586f85d2902fde5b052e6591f6f5a9fd70319d82483e6656bf3466124

SHA1 of d0b0aaf3bf2a21c6b5b1a899da311f400bbc8fcaa9290e1d2811a5addd5941e9

SHA1 of a6023a1eb13286242318383783cb09ca702e40d086403a1521f377aed088d927

SHA1 of 24ec63f3976d04f5e7a7f229ae76301bd1ca6099016d65a727d1c33459853847

SHA1 of 58388c8efbee568b805a80078b789e9c39b4af6d97c1029da902897e77b5ec58

SHA1 of 84da4be52c1e1f6729b2dfcd05d84d9f9dc5fef3e906ef38dd88749f2dde9dec

SHA1 of 930f0039cbc94d9aa39311b4c2f533dc6de67f433ea3f07091b051fab145b3f9

SHA1 of e0b54f6586f85d2902fde5b052e6591f6f5a9fd70319d82483e6656bf3466124

SHA1 of 228c316455d5ed69232adcbe9acd033092f200014cfa7ed40d6c382f07b19b82

SHA1 of afa2250fb08d3c47b09ee5dca817fd686f4196e22d834993dc8a9ac36630c22e

SHA1 of e6b69a432c63b6268acffae22125cb0a1000cb83b080f75f6072537ac7b51d58

SHA1 of 06245bdbc4b8ea1c2ec57da25cee8e4f8617ee5b0769de570fab6433c7be579e

SHA1 of f9af137fc8c0232d7b52557f4276ded47f000566231617a0f6955bc28b7b1ebc

SHA1 of 640088274eee03faab19c4296764a66a3c2efd9023fcf8be677a117d7725df00

SHA1 of 59579af118faca431f7b464ad3a8592c467314274ccea7547153ed8d00667d40

Detailed information about Blurred Lines: AdTech Abuse Delivers Browser Hijackers Through the Microsoft Store. Get real-time updates, technical details, and mit

Threats Tagged 'phantomjack'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'phantomjack'

Lead Pen Test Professional