Threats Tagged 'screenshot exfiltration'

Eleven malicious NuGet packages masquerade as game cheat tools for popular games, acting as first-stage downloaders that evade detection using DNS-over-HTTPS and request UAC elevation. They fetch a second-stage PyInstaller payload named pepesoft.exe from GitHub and Hugging Face, which binds to hardware fingerprints, enforces licensing via Google Sheets telemetry, and supports remote ban-lists. Some variants enable remote control and screenshot capture through Telegram bot commands. These packages share AWS credentials and mutex identifiers, linking them to a single Russian-speaking operator marketing a commercial game-automation service.

A Windows-based cryptocurrency clipper has been actively targeting users since February 2026, employing sophisticated techniques to steal digital assets. The malware propagates through malicious shortcut files on USB devices, creating a worm-like infection chain. Once deployed, it utilizes Windows Script Host and ActiveX to launch a bundled Tor proxy client, enabling anonymous communication with hidden-service command and control servers. The clipper performs high-frequency clipboard monitoring to intercept cryptocurrency wallet addresses, seed phrases, and private keys, replacing them with attacker-controlled alternatives. Additionally, it captures screenshots for context and maintains persistent access through scheduled tasks. The threat demonstrates advanced capabilities including remote code execution, making it more than a simple stealer by functioning as a lightweight backdoor. The malware employs multiple defense evasion techniques including multi-layer obfuscation, anti-analysis checks, and local S...