Pawb.Social Reports @transparency

0 posts0 participants0 posts today

Kevin Karhan :verified:<a href="https://infosec.exchange/@SecurityWriter" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@SecurityWriter</a> <a href="https://infosec.space/tags/Malvertising" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Malvertising</a> is a real problem and <a href="https://infosec.space/tags/AdBlocjing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AdBlocjing</a> is an act of <a href="https://infosec.space/tags/SelfDefense" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SelfDefense</a> and <a href="https://infosec.space/tags/MutualDefense" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#MutualDefense</a> against <a href="https://infosec.space/tags/Malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Malware</a>!

The New OilFake <a href="https://mastodon.thenewoil.org/tags/Semrush" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Semrush</a> ads used to steal <a href="https://mastodon.thenewoil.org/tags/SEO" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SEO</a> professionals’ <a href="https://mastodon.thenewoil.org/tags/Google" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Google</a> accounts<a href="https://www.bleepingcomputer.com/news/security/fake-semrush-ads-used-to-steal-seo-professionals-google-accounts/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.bleepingcomputer.com/news/security/fake-semrush-ads-used-to-steal-seo-professionals-google-accounts/</a><a href="https://mastodon.thenewoil.org/tags/malvertising" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malvertising</a> <a href="https://mastodon.thenewoil.org/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://mastodon.thenewoil.org/tags/advertising" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#advertising</a>

The New OilDragon Hacks: Slay Browser Ads<a href="https://firewallsdontstopdragons.com/dragon-hacks-slay-browser-ads/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://firewallsdontstopdragons.com/dragon-hacks-slay-browser-ads/</a><a href="https://mastodon.thenewoil.org/tags/advertising" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#advertising</a> <a href="https://mastodon.thenewoil.org/tags/privacy" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#privacy</a> <a href="https://mastodon.thenewoil.org/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://mastodon.thenewoil.org/tags/malvertising" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malvertising</a> <a href="https://mastodon.thenewoil.org/tags/AdBlocking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AdBlocking</a> <a href="https://mastodon.thenewoil.org/tags/AdBlocker" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AdBlocker</a>

The New Oil<a href="https://mastodon.thenewoil.org/tags/Microsoft" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Microsoft</a> says <a href="https://mastodon.thenewoil.org/tags/malvertising" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malvertising</a> campaign impacted 1 million PCs<a href="https://www.bleepingcomputer.com/news/security/microsoft-says-malvertising-campaign-impacted-1-million-pcs/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.bleepingcomputer.com/news/security/microsoft-says-malvertising-campaign-impacted-1-million-pcs/</a><a href="https://mastodon.thenewoil.org/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a>

Quad9DNSOur latest Cyber Insights for H2 2024 is live! <a href="https://www.quad9.net/news/blog/trends-h2-2024-cyber-insights" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.quad9.net/news/blog/trends-h2-2024-cyber-insights</a><a href="https://mastodon.social/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatintel</a> <a href="https://mastodon.social/tags/DNS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNS</a> <a href="https://mastodon.social/tags/malvertising" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malvertising</a> <a href="https://mastodon.social/tags/ransomware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ransomware</a> <a href="https://mastodon.social/tags/supplychain" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#supplychain</a>

Infoblox Threat IntelHave you ever wondered what happens if you say yes to every request to receive push notifications from sketchy websites? For the past few months we have done exactly that, exposing an old phone to an endless barrage of scareware and malicious ads. Find out more here: <a href="https://blogs.infoblox.com/threat-intelligence/pushed-down-the-rabbit-hole/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://blogs.infoblox.com/threat-intelligence/pushed-down-the-rabbit-hole/</a> <a href="https://infosec.exchange/tags/dns" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#dns</a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatintel</a> <a href="https://infosec.exchange/tags/adtech" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#adtech</a> <a href="https://infosec.exchange/tags/adware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#adware</a> <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malware</a> <a href="https://infosec.exchange/tags/scam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#scam</a> <a href="https://infosec.exchange/tags/phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#phishing</a> <a href="https://infosec.exchange/tags/cybercrime" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybercrime</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/vextrio" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#vextrio</a> <a href="https://infosec.exchange/tags/infoblox" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infoblox</a> <a href="https://infosec.exchange/tags/infobloxthreatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infobloxthreatintel</a> <a href="https://infosec.exchange/tags/malvertising" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malvertising</a> <a href="https://infosec.exchange/tags/tds" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#tds</a>

Renée BurtonCricket and Matt asked me to join them for the Ask Mr DNS podcast last week. It's a great show that i've listened to for years. We talked about securing networks by blocking bad things in DNS and how our research group <a href="https://infosec.exchange/@InfobloxThreatIntel" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@InfobloxThreatIntel</a> does that work. I talk a bit about malicious adtech like <a href="https://infosec.exchange/tags/VexTrio" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#VexTrio</a> .... This whole show is completely unrehearsed and i had no real idea what we were going to cover lol... so fingers crossed it makes sense to folks. There are some great episodes about the Dyn attacks in 2015 that you should listen to if you have an interest in DDOS attacks. <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatintel</a> <a href="https://infosec.exchange/tags/dns" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#dns</a> <a href="https://infosec.exchange/tags/cybercrime" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybercrime</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/infoblox" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infoblox</a> <a href="https://infosec.exchange/tags/phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#phishing</a> <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malware</a> <a href="https://infosec.exchange/tags/malvertising" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malvertising</a> <a href="https://ask-mrdns.com/2025/01/episode-64/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://ask-mrdns.com/2025/01/episode-64/</a>

The New OilFake <a href="https://mastodon.thenewoil.org/tags/Homebrew" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Homebrew</a> <a href="https://mastodon.thenewoil.org/tags/Google" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Google</a> ads target <a href="https://mastodon.thenewoil.org/tags/Mac" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Mac</a> users with <a href="https://mastodon.thenewoil.org/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malware</a><a href="https://www.bleepingcomputer.com/news/security/fake-homebrew-google-ads-target-mac-users-with-malware/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.bleepingcomputer.com/news/security/fake-homebrew-google-ads-target-mac-users-with-malware/</a><a href="https://mastodon.thenewoil.org/tags/malvertising" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malvertising</a> <a href="https://mastodon.thenewoil.org/tags/advertising" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#advertising</a> <a href="https://mastodon.thenewoil.org/tags/Apple" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Apple</a> <a href="https://mastodon.thenewoil.org/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a>

Infoblox Threat IntelVexTrio User Experience 4/N <a href="https://infosec.exchange/@knitcode" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@knitcode</a> decided it was time to get crypto-scammed by VexTrio.....here's the story... Unfortunately, when i got to the final scam to steal my funds i landed at a page that unavailable.. so my money wasn't stolen. I did capture 16 minutes of screen recording while they mined my device and tried to interact with their fake online users, so that was fun. Imgur won't let me load that long of a video so I've got screenshots to the highlights. Here's how the scam works: * Somehow you end up visiting a VexTrio crypto scam domain. Since we track their movements, I just collected one from our detectors. * You get a "welcome back" with some amazing bitcoin balance.. mine was $113k! and a continue button... if you click that... * You get a threatening "your account will be deleted in one day" for inactivity, but you have the option to log in now! excellent. click. * but what about the password? No problem. the site has remembered your password for you. ;) * When you login, you are asked if you want to withdraw your funds. Of course! * It's been 364 days since you were here, so the site needs to "verify" each of your mining transactions. It takes about 10 minutes to do this while it seemingly mines your device. ;) * users are "chatting" away talking about ethics and mining strategies. you can add comments but they won't answer you. * Finally you get the chance to withdraw your funds... first you have to get approval from your account manager and fill out a withdrawal form. .. she doesn't have a record of you, but that's ok. you are approved to withdraw $113k. * You need to give a credit card or paypal account in order to pay their "official" partner Binance to do the conversion. what is $64 fee for $113k? ! sign me up! * Click the final button to pay Binance and receive your payout.... unfortunately, for me this is where I hit the oops can't display... after 16 minutes! peqemynite[.]top was not working. * This domain was previously behind cloudflare caching but starting Nov 11th, it started resolving as Russian IP in Prospero (which interestingly shared IP with keitarotds[.]top) and then Unitel also Russia. So that's fun. * To recap... VexTrio domain -> cryptoscam -> Binance fraud -> Russian IP. Attached are screenshots. i have a few urlscan images of this too but the process takes so long that getting the full user experience is hard. here's some more IOCs. There are bunch of domains on: 91.212.166[.]95. I started at globalminingbit[.]top (after the TDS) and ended at peqemynite[.]top. Here's some current domains: qegymiewo[.]top,ditosoydi[.]top,keziryevo[.]top,xujodyaza[.]top,vupahoawy[.]top,rycozaaqi[.]top,zupahayja[.]top,mafaweewa[.]top,pesaraafy[.]top. globalminingbit[.]top is also out of the CF cover now and at Proton66 (also Russia) 193.143.1(.)195<a href="https://infosec.exchange/tags/dns" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#dns</a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatintel</a> <a href="https://infosec.exchange/tags/cybercrime" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybercrime</a> <a href="https://infosec.exchange/tags/scam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#scam</a> <a href="https://infosec.exchange/tags/malvertising" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malvertising</a> <a href="https://infosec.exchange/tags/infobloxthreatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infobloxthreatintel</a> <a href="https://infosec.exchange/tags/infoblox" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infoblox</a> <a href="https://infosec.exchange/tags/vextrio" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#vextrio</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#phishing</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/crypto" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#crypto</a> <a href="https://infosec.exchange/tags/cryptoscam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cryptoscam</a>

@infosec_jcp 🐈🃏 done differently<a href="https://infosec.exchange/@SwiftOnSecurity" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@SwiftOnSecurity</a> Even ic3.gov recommend this. Go for the eZ win! <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/ublock" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ublock</a> <a href="https://infosec.exchange/tags/malvertising" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malvertising</a> ✋

RandyFake Slack via <a href="https://infosec.exchange/tags/malvertising" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malvertising</a>. Google search was for "slack.coml" (user was on the right track, type the domain instead of searching, but they typoed it and then clicked on the malvertisement). There's a whole bunch of other bad stuff in the git repos.<pre><code>Google ad -> tradkingview.onelink[.]me/3nFZ -> slack.aerodrame[.]finance/ -> slack.workmeetingsapp[.]com/ -> github[.]com/fewefwfewfew/dwqfqwe/releases/download/fecfewwefewf3/Slack_Setup.exe 2b587ca6eb1af162951ade0e214b856f558cc859ae1a8674646f853661704211 Slack_Setup.exe </code></pre>

AI6YR BenAxios: Russian hackers use fake luxury car ads to target diplomats <a href="https://www.axios.com/2024/08/02/russian-hackers-diplomats-fake-car-phishing?utm_medium=social&utm_source=mastodon&utm_campaign=editorial" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.axios.com/2024/08/02/russian-hackers-diplomats-fake-car-phishing?utm_medium=social&utm_source=mastodon&utm_campaign=editorial</a><a href="https://m.ai6yr.org/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malware</a> <a href="https://m.ai6yr.org/tags/advertising" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#advertising</a> <a href="https://m.ai6yr.org/tags/malvertising" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malvertising</a> <a href="https://m.ai6yr.org/tags/luxurycars" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#luxurycars</a> <a href="https://m.ai6yr.org/tags/Russia" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Russia</a>

Jérôme SeguraFake Microsoft Teams for Mac delivers Atomic Stealer <a href="https://www.malwarebytes.com/blog/threat-intelligence/2024/07/fake-microsoft-teams-for-mac-delivers-atomic-stealer" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.malwarebytes.com/blog/threat-intelligence/2024/07/fake-microsoft-teams-for-mac-delivers-atomic-stealer</a>Cloaking domain: voipfaqs[.]comDecoy site: teamsbusiness[.]orgDownload URL: locallyhyped[.]com/kurkum/script_66902619887998[.]92077775[.]phpAtomic Stealer payload: 7120703c25575607c396391964814c0bd10811db47957750e11b97b9f3c36b5dAtomic Stealer C2: 147.45.43[.]136<a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatintel</a> <a href="https://infosec.exchange/tags/macos" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#macos</a> <a href="https://infosec.exchange/tags/malvertising" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malvertising</a>

BillAgain with the "No you can't use adblockers, how else will we serve you malware?"<a href="https://arstechnica.com/?p=2034101" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://arstechnica.com/?p=2034101</a><a href="https://infosec.exchange/tags/malvertising" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malvertising</a> <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malware</a> <a href="https://infosec.exchange/tags/google" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#google</a>

Jérôme SeguraMalicious ad for Arc browser -> <a href="https://infosec.exchange/tags/AtomicStealer" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AtomicStealer</a> arcthost[.]org arc-download[.]com zestyahhdog[.]com/Arc12645413[.]dmgC2: 79.137.192[.]4/p2p<a href="https://infosec.exchange/tags/malvertising" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malvertising</a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatintel</a>

RandyHopefully everybody here is blocking all remote support tools you don't specifically use. We had a user call a TSS who coached them to try several different ones. Our tools blocked each of them, but for different reasons. The first is a classic and is on our block list (but of course!), the second got caught in geo blocking, the third was new to me, but our user typoed the domain.<pre><code>www.anydesk[.]com helpout[.]live www.screenleap[.]com </code></pre>Oh, did I mention they got to the TSS via <a href="https://infosec.exchange/tags/malvertising" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malvertising</a>? Yup, malvertisement led to here.<pre><code>valuedpost[.]com </code></pre><a href="https://urlscan.io/result/6baa089c-9e64-408e-9440-fdef079a723a/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://urlscan.io/result/6baa089c-9e64-408e-9440-fdef079a723a/</a>Which after clicking on any part of the fake "Want to remove ads" led to the TSS as shown here.<a href="https://urlscan.io/result/ba64fbf5-e7b9-4699-a59f-7746dd42e5e0/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://urlscan.io/result/ba64fbf5-e7b9-4699-a59f-7746dd42e5e0/</a>

Jérôme Segura⚠️ Malicious Google ad for inkscape leads to <a href="https://infosec.exchange/tags/FakeBat" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FakeBat</a>➡️ Impostor site: inkckape[.]org ➡️ Payload: hxxps[://]planbooknfly[.]com/data/Inkscape-x86[.]msix dc471b087413ea64f7693b27e38ac568dea00ec1c7f699e48a6ef96b9cb4e30e ➡️ C2: utm-adschuk[.]com<a href="https://infosec.exchange/tags/malvertising" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malvertising</a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatintel</a>

Jérôme SeguraMalicious ad for Advanced IP Scanner -> Nitrogensaltysour[.]com advanced-ip-scan[.]org giaoanso[.]com/wp-includes/IP_Scanner_v.3.5.2.1.zip 91.92.249[.]89<a href="https://www.threatdown.com/blog/nitrogen/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.threatdown.com/blog/nitrogen/</a><a href="https://infosec.exchange/tags/malvertising" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malvertising</a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatintel</a>

Jérôme SeguraMalicious ad for Cisco Anyconnect -> NetSupport RAThxxps[://]anyconnect[.]digital/main[.]html?gad_source=1&gclid=EAIaIQobChMIqvTmkL3hhQMVPCWtBh0NiQqwEAAYAiAAEgLpVfD_BwEhxxps[://]www[.]dropbox[.]com/scl/fi/rd9a0nuuo5y3ty8jtmfd9/ClientCiscoInstaller[.]exe?rlkey=9xt5unakd2cac2bzohrr7vk55&st=5rw7hpe6&dl=1<a href="https://infosec.exchange/tags/malvertising" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malvertising</a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatintel</a>

Jérôme SeguraMalicious ad for Bitbucket -> FakeBathxxps[://]bitbucket[.]workforteams[.]net/ hxxps[://]kimworkfiles[.]com/Bitbucket[.]msix<a href="https://infosec.exchange/tags/malvertising" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malvertising</a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatintel</a>

Recent searches

Search options

Administered by:

Server stats:

#malvertising