Reddit NetSec

AlienVault OTX General

CVE Database V5

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A new botnet called NightshadeC2 has been identified, employing sophisticated techniques to bypass malware analysis sandboxes and exclude itself from Windows Defender. It uses a 'UAC Prompt Bombing' technique and has both C and Python variants. The botnet's capabilities include reverse shell, file execution, self-deletion, remote control, screen capture, hidden web browsers, and keylogging. It's being distributed through ClickFix attacks and trojanized legitimate software. The botnet uses encryption for C2 communication and gathers victim information. It also employs various persistence mechanisms and can bypass certain sandbox environments. The discovery highlights the evolving sophistication of malware and the need for advanced detection and response capabilities.

NightshadeC2 is a newly identified botnet campaign exhibiting advanced evasion and persistence techniques that significantly complicate detection and mitigation efforts. It employs sophisticated sandbox evasion methods, including the novel 'UAC Prompt Bombing' technique, which attempts to bypass Windows User Account Control (UAC) prompts to escalate privileges without user consent. The botnet is implemented in both C and Python variants, indicating modularity and adaptability across different environments. Its capabilities are extensive, including establishing reverse shells for remote command execution, executing arbitrary files, self-deletion to cover tracks, remote control functionalities, screen capture, hidden web browser instances, and keylogging to harvest sensitive user input. Distribution vectors include ClickFix attacks—likely leveraging social engineering or malicious redirects—and trojanized legitimate software, which increases the likelihood of successful infection by exploiting user trust in known applications. Communication with the command and control (C2) servers is encrypted, enhancing stealth and complicating network-based detection. NightshadeC2 also collects victim system information to tailor its operations and employs multiple persistence mechanisms to maintain footholds on infected systems. The botnet’s ability to bypass Windows Defender and evade sandbox environments highlights its advanced design aimed at long-term undetected presence. This threat underscores the evolving sophistication of malware campaigns, emphasizing the need for enhanced detection capabilities beyond traditional antivirus and sandboxing solutions.

Detailed information about New Botnet Emerges from the Shadows: NightshadeC2. Get real-time updates, technical details, and mitigation strategies.

New Botnet Emerges from the Shadows: NightshadeC2 - Live Threat Intelligence - Threat Radar | OffSeq.com

New Botnet Emerges from the Shadows: NightshadeC2

A large cybercrime campaign has been observed involving multiple fraudulent websites promoted through Google advertising. The campaign aims to trick users into downloading and installing a trojanized PDF editor containing the TamperedChef information-stealing malware. The malware harvests sensitive data, including credentials and web cookies. The campaign began on June 26, 2025, with the PDF editor initially appearing harmless but later activating malicious capabilities. The threat actor used Google advertising to promote the PDF editor, with at least 5 different campaign IDs observed. The malware's activation occurred 56 days after the campaign's start, coinciding with a typical Google ad campaign duration. The threat actor has a history of distributing malicious code disguised as free utility tools, and this campaign has successfully affected several European organizations.

The threat involves a widespread cybercrime campaign distributing a trojanized PDF editor named Appsuite PDF Editor, which is a vector for the TamperedChef malware. This campaign leverages fraudulent websites promoted via Google advertising to lure victims into downloading what appears to be a legitimate PDF editing tool. The malware is an information stealer designed to harvest sensitive data such as user credentials and web cookies, enabling attackers to gain unauthorized access to victim accounts and systems. The campaign began on June 26, 2025, and notably, the malicious payload activates 56 days after the initial download, aligning with typical Google ad campaign durations to evade early detection. The threat actor behind this campaign has a history of distributing malware disguised as free utility software, indicating a persistent and evolving modus operandi. The malware employs multiple advanced techniques, including obfuscation and various tactics mapped to MITRE ATT&CK techniques such as credential dumping (T1555), process injection (T1055), command execution (T1059), and persistence mechanisms (T1547.001). The campaign has successfully compromised several European organizations, highlighting its effectiveness and reach. No known exploits in the wild have been reported, but the stealthy activation delay and use of trusted advertising platforms increase the risk of widespread infection.

Detailed information about Malicious Appsuite PDF Editor Spreads Tamperedchef Malware. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'trojanized software'

Filter Threats

Threats Tagged 'trojanized software'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility