Threats Tagged 'spam'

A sophisticated malware campaign is increasingly targeting WordPress websites to inject online casino spam content. This malware uses multiple redundancy and reinfection techniques, storing payloads in databases and non-standard file extensions to evade detection and maintain persistence. The campaign exploits the popularity of online gambling and leverages the decline of other spam sources, such as essay writing services, to focus on lucrative casino spam. Although primarily noted in Indonesia due to strict gambling laws, the campaign has international reach. The malware's complexity and persistence mechanisms pose risks to website integrity, SEO rankings, and user trust. European organizations running WordPress sites could be targeted, especially those with lax security or outdated plugins. Mitigation requires advanced detection, continuous monitoring, and tailored cleanup strategies. The threat is assessed as medium severity due to its impact on website integrity and SEO rather than direct data breach or system compromise.

MediumCampaignGermanyFranceNetherlands+5#gambling#spam#malware

VexTrio, a cybercriminal organization, has been exposed for running a vast online fraud empire involving scams, spam, and malicious apps. Their operations include fake dating sites, cryptocurrency scams, and deceptive apps that have been downloaded millions of times. VexTrio uses sophisticated traffic distribution systems to deliver their scams, often infringing on well-known brands and celebrities. They also operate extensive spam networks, using lookalike domains of reputable email services. The group's activities extend beyond their core fraud business, with connections to seemingly legitimate enterprises in various industries. Despite operating for 15 years, VexTrio has managed to avoid legal consequences, highlighting the challenges in combating such large-scale online fraud operations.

MediumCampaignSwitzerlandGermanyFrance+5#cryptocurrency fraud#scams#traffic distribution

A spam campaign targeting Brazilian users, particularly C-level executives and financial/HR accounts, has been identified since January 2025. The campaign exploits commercial remote monitoring and management (RMM) tools, specifically PDQ Connect and N-able remote access tools. Attackers use Brazilian electronic invoice system (NF-e) as bait, leading victims to malicious content on Dropbox. The threat actor, likely an initial access broker, abuses free trial periods of RMM tools to gain complete control of target machines. The campaign's objective is to create a network of compromised machines for potential sale to third parties, including ransomware operators and state-sponsored actors. The abuse of commercial RMM tools is increasing due to their digital signatures, full backdoor capabilities, and low cost.

MediumCampaignPortugalSpainItaly+3#initial access broker#nf-e#n-able