Pawb.Social Reports @transparency

16 posts12 participants0 posts today

The New OilPopular <a href="https://mastodon.thenewoil.org/tags/Chrome" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Chrome</a> extensions, including ad blockers, got hijacked. Learn how to protect yourself<a href="https://adguard.com/en/blog/popular-chrome-extensions-including-ad-blockers-hijacked.html" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://adguard.com/en/blog/popular-chrome-extensions-including-ad-blockers-hijacked.html</a><a href="https://mastodon.thenewoil.org/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://mastodon.thenewoil.org/tags/guide" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#guide</a> <a href="https://mastodon.thenewoil.org/tags/AdBlocker" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AdBlocker</a> <a href="https://mastodon.thenewoil.org/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malware</a>

The New Oil<a href="https://mastodon.thenewoil.org/tags/Steam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Steam</a> pulls game demo infecting <a href="https://mastodon.thenewoil.org/tags/Windows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Windows</a> with info-stealing <a href="https://mastodon.thenewoil.org/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malware</a><a href="https://www.bleepingcomputer.com/news/security/steam-pulls-game-demo-infecting-windows-with-info-stealing-malware/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.bleepingcomputer.com/news/security/steam-pulls-game-demo-infecting-windows-with-info-stealing-malware/</a><a href="https://mastodon.thenewoil.org/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a>

The New Oil<a href="https://mastodon.thenewoil.org/tags/Malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Malware</a> campaign '<a href="https://mastodon.thenewoil.org/tags/DollyWay" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DollyWay</a>' breached 20,000 <a href="https://mastodon.thenewoil.org/tags/WordPress" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WordPress</a> sites<a href="https://www.bleepingcomputer.com/news/security/malware-campaign-dollyway-breached-20-000-wordpress-sites/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.bleepingcomputer.com/news/security/malware-campaign-dollyway-breached-20-000-wordpress-sites/</a><a href="https://mastodon.thenewoil.org/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a>

OTX BotOperation FishMedley targeting governments, NGOs, and think tanksESET researchers have uncovered a global espionage operation called Operation FishMedley, conducted by the FishMonger APT group, which is operated by the Chinese contractor I-SOON. The campaign targeted governments, NGOs, and think tanks across Asia, Europe, and the United States during 2022. The attackers used implants like ShadowPad, SodaMaster, and Spyder, which are common or exclusive to China-aligned threat actors. The operation involved sophisticated tactics including lateral movement, credential theft, and custom malware deployment. Seven victims were identified across various countries and sectors. The analysis provides technical details on the malware used, initial access methods, and command and control infrastructure.Pulse ID: 67dd406f6ba9eecd280aa95e Pulse Link: <a href="https://otx.alienvault.com/pulse/67dd406f6ba9eecd280aa95e" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://otx.alienvault.com/pulse/67dd406f6ba9eecd280aa95e</a> Pulse Author: AlienVault Created: 2025-03-21 10:33:19Be advised, this data is unverified and should be considered preliminary. Always do further verification.<a href="https://social.raytec.co/tags/Asia" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Asia</a> <a href="https://social.raytec.co/tags/China" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#China</a> <a href="https://social.raytec.co/tags/Chinese" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Chinese</a> <a href="https://social.raytec.co/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberSecurity</a> <a href="https://social.raytec.co/tags/ESET" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ESET</a> <a href="https://social.raytec.co/tags/Espionage" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Espionage</a> <a href="https://social.raytec.co/tags/Europe" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Europe</a> <a href="https://social.raytec.co/tags/Government" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Government</a> <a href="https://social.raytec.co/tags/ICS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ICS</a> <a href="https://social.raytec.co/tags/ISoon" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ISoon</a> <a href="https://social.raytec.co/tags/InfoSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#InfoSec</a> <a href="https://social.raytec.co/tags/Malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Malware</a> <a href="https://social.raytec.co/tags/OTX" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OTX</a> <a href="https://social.raytec.co/tags/OpenThreatExchange" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenThreatExchange</a> <a href="https://social.raytec.co/tags/RAT" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#RAT</a> <a href="https://social.raytec.co/tags/ShadowPad" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ShadowPad</a> <a href="https://social.raytec.co/tags/UnitedStates" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#UnitedStates</a> <a href="https://social.raytec.co/tags/bot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#bot</a> <a href="https://social.raytec.co/tags/AlienVault" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AlienVault</a>

The New OilNew <a href="https://mastodon.thenewoil.org/tags/Arcane" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Arcane</a> infostealer infects <a href="https://mastodon.thenewoil.org/tags/YouTube" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#YouTube</a>, <a href="https://mastodon.thenewoil.org/tags/Discord" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Discord</a> users via game cheats<a href="https://www.bleepingcomputer.com/news/security/new-arcane-infostealer-infects-youtube-discord-users-via-game-cheats/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.bleepingcomputer.com/news/security/new-arcane-infostealer-infects-youtube-discord-users-via-game-cheats/</a><a href="https://mastodon.thenewoil.org/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://mastodon.thenewoil.org/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malware</a>

The New OilHow a researcher with no <a href="https://mastodon.thenewoil.org/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malware</a>-coding skills tricked <a href="https://mastodon.thenewoil.org/tags/AI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AI</a> into creating <a href="https://mastodon.thenewoil.org/tags/Chrome" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Chrome</a> infostealers<a href="https://www.zdnet.com/article/how-a-researcher-with-no-malware-coding-skills-tricked-ai-into-creating-chrome-infostealers/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.zdnet.com/article/how-a-researcher-with-no-malware-coding-skills-tricked-ai-into-creating-chrome-infostealers/</a><a href="https://mastodon.thenewoil.org/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a>

WinFuture.deSicherheitsforscher decken massive <a href="https://mastodon.social/tags/Malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Malware</a>-Kampagne im Google Play Store auf. Schädliche Apps umgehen Android-13-Schutzfunktionen und stehlen sensible Daten. Kampagne seit Q3 2024 aktiv. <a href="https://winfuture.de/news,149724.html?utm_source=Mastodon&utm_medium=ManualStatus&utm_campaign=SocialMedia" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://winfuture.de/news,149724.html?utm_source=Mastodon&utm_medium=ManualStatus&utm_campaign=SocialMedia</a>

BillWell, no matter what you think about CISA there was indeed a malicious bug compiled into tj-actions that is scary considered alone but terrifying as part of a very real trend.<a href="https://github.com/tj-actions/changed-files/issues/2463" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/tj-actions/changed-files/issues/2463</a>I'm going to look at that project to detect undocumented code I boosted earlier today.<a href="https://infosec.exchange/tags/github" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#github</a> <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malware</a>

The New OilMalicious <a href="https://mastodon.thenewoil.org/tags/Android" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Android</a> #'Vapor' apps on <a href="https://mastodon.thenewoil.org/tags/GooglePlay" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GooglePlay</a> installed 60 million times<a href="https://www.bleepingcomputer.com/news/security/malicious-android-vapor-apps-on-google-play-installed-60-million-times/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.bleepingcomputer.com/news/security/malicious-android-vapor-apps-on-google-play-installed-60-million-times/</a><a href="https://mastodon.thenewoil.org/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://mastodon.thenewoil.org/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malware</a> <a href="https://mastodon.thenewoil.org/tags/Google" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Google</a>

The New Oil<a href="https://mastodon.thenewoil.org/tags/Microsoft" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Microsoft</a>: New RAT <a href="https://mastodon.thenewoil.org/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malware</a> used for <a href="https://mastodon.thenewoil.org/tags/crypto" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#crypto</a> theft, reconnaissance<a href="https://www.bleepingcomputer.com/news/security/microsoft-new-rat-malware-used-for-crypto-theft-reconnaissance/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.bleepingcomputer.com/news/security/microsoft-new-rat-malware-used-for-crypto-theft-reconnaissance/</a><a href="https://mastodon.thenewoil.org/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://mastodon.thenewoil.org/tags/StilachiRAT" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#StilachiRAT</a>

Alexandre BorgesTo date, I have published 15 articles (1045 pages) with the strict goal of helping the cybersecurity community.ERS (439 pages, so far): [+] ERS 05: <a href="https://exploitreversing.com/2025/03/12/exploiting-reversing-er-series-article-05/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://exploitreversing.com/2025/03/12/exploiting-reversing-er-series-article-05/</a> [+] ERS 04: <a href="https://exploitreversing.com/2025/02/04/exploiting-reversing-er-series-article-04/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://exploitreversing.com/2025/02/04/exploiting-reversing-er-series-article-04/</a> [+] ERS 03: <a href="https://exploitreversing.com/2025/01/22/exploiting-reversing-er-series-article-03/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://exploitreversing.com/2025/01/22/exploiting-reversing-er-series-article-03/</a> [+] ERS 02: <a href="https://exploitreversing.com/2024/01/03/exploiting-reversing-er-series-article-02/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://exploitreversing.com/2024/01/03/exploiting-reversing-er-series-article-02/</a> [+] ERS 01: <a href="https://exploitreversing.com/2023/04/11/exploiting-reversing-er-series/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://exploitreversing.com/2023/04/11/exploiting-reversing-er-series/</a>MAS (606 pages -- finished): [+] MAS 10: <a href="https://exploitreversing.com/2025/01/15/malware-analysis-series-mas-article-10/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://exploitreversing.com/2025/01/15/malware-analysis-series-mas-article-10/</a> [+] MAS 09: <a href="https://exploitreversing.com/2025/01/08/malware-analysis-series-mas-article-09/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://exploitreversing.com/2025/01/08/malware-analysis-series-mas-article-09/</a> [+] MAS 09: <a href="https://exploitreversing.com/2024/08/07/malware-analysis-series-mas-article-08/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://exploitreversing.com/2024/08/07/malware-analysis-series-mas-article-08/</a> [+] MAS 07: <a href="https://exploitreversing.com/2023/01/05/malware-analysis-series-mas-article-7/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://exploitreversing.com/2023/01/05/malware-analysis-series-mas-article-7/</a> [+] MAS 06: <a href="https://exploitreversing.com/2022/11/24/malware-analysis-series-mas-article-6/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://exploitreversing.com/2022/11/24/malware-analysis-series-mas-article-6/</a> [+] MAS 05: <a href="https://exploitreversing.com/2022/09/14/malware-analysis-series-mas-article-5/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://exploitreversing.com/2022/09/14/malware-analysis-series-mas-article-5/</a> [+] MAS 04: <a href="https://exploitreversing.com/2022/05/12/malware-analysis-series-mas-article-4/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://exploitreversing.com/2022/05/12/malware-analysis-series-mas-article-4/</a> [+] MAS 03: <a href="https://exploitreversing.com/2022/05/05/malware-analysis-series-mas-article-3/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://exploitreversing.com/2022/05/05/malware-analysis-series-mas-article-3/</a> [+] MAS 02: <a href="https://exploitreversing.com/2022/02/03/malware-analysis-series-mas-article-2/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://exploitreversing.com/2022/02/03/malware-analysis-series-mas-article-2/</a> [+] MAS 01: <a href="https://exploitreversing.com/2021/12/03/malware-analysis-series-mas-article-1/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://exploitreversing.com/2021/12/03/malware-analysis-series-mas-article-1/</a>The blog home page is: <a href="https://exploitreversing.com/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://exploitreversing.com/</a>I will be back in a few months with the next articles in the Exploiting Reversing series, which will focus on vulnerability and exploitation, once I have laid all the necessary groundwork. I'm currently taking a break from writing to focus on research.Enjoy reading and have an excellent day.<a href="https://infosec.exchange/tags/windows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#windows</a> <a href="https://infosec.exchange/tags/iOS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#iOS</a> <a href="https://infosec.exchange/tags/macOS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#macOS</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/chrome" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#chrome</a> <a href="https://infosec.exchange/tags/kernel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#kernel</a> <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malware</a> <a href="https://infosec.exchange/tags/reverseengineering" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#reverseengineering</a> <a href="https://infosec.exchange/tags/vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#vulnerability</a> <a href="https://infosec.exchange/tags/research" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#research</a> <a href="https://infosec.exchange/tags/hypervisor" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hypervisor</a>

WinFuture.deFBI warnt: Vorsicht bei kostenlosen Online-Dateikonvertern! Viele dieser scheinbar harmlosen Tools dienen als Einfallstor für <a href="https://mastodon.social/tags/Malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Malware</a>. Besser auf vertrauenswürdige Software setzen. <a href="https://mastodon.social/tags/Cybersicherheit" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Cybersicherheit</a> <a href="https://winfuture.de/news,149661.html?utm_source=Mastodon&utm_medium=ManualStatus&utm_campaign=SocialMedia" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://winfuture.de/news,149661.html?utm_source=Mastodon&utm_medium=ManualStatus&utm_campaign=SocialMedia</a>

heise SecurityMalwareverteiler: FBI warnt vor betrügerischen Online-DateikonverternWer kostenlose Onlinedienste zum Umwandeln von etwa Textdateien nutzt, kann sich Malware einfangen. Darauf weist das FBI hin.<a href="https://www.heise.de/news/Malwareverteiler-FBI-warnt-vor-betruegerischen-Online-Dateikonvertern-10319049.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.heise.de/news/Malwareverteiler-FBI-warnt-vor-betruegerischen-Online-Dateikonvertern-10319049.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon</a><a href="https://social.heise.de/tags/Malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Malware</a> <a href="https://social.heise.de/tags/Security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Security</a> <a href="https://social.heise.de/tags/Trojaner" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Trojaner</a> <a href="https://social.heise.de/tags/news" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#news</a>

benzogaga33 :verified:Des apps OAuth malveillantes se font passer pour Adobe et DocuSign pour cibler Microsoft 365 <a href="https://www.it-connect.fr/des-apps-oauth-malveillantes-se-font-passer-pour-adobe-et-docusign-pour-cibler-microsoft-365/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.it-connect.fr/des-apps-oauth-malveillantes-se-font-passer-pour-adobe-et-docusign-pour-cibler-microsoft-365/</a> <a href="https://mamot.fr/tags/ActuCybers%C3%A9curit%C3%A9" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ActuCybersécurité</a> <a href="https://mamot.fr/tags/Cybers%C3%A9curit%C3%A9" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Cybersécurité</a> <a href="https://mamot.fr/tags/Microsoft365" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Microsoft365</a> <a href="https://mamot.fr/tags/Phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Phishing</a> <a href="https://mamot.fr/tags/Malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Malware</a>

OTX BotOff the Beaten Path: Recent Unusual MalwareThe article examines three unusual malware samples: a C++/CLI IIS backdoor enabling stealthy remote command execution, a bootkit leveraging the GRUB 2 bootloader to gain early system control and persistence, and a cross-platform post-exploitation framework developed in C++. These cases highlight evolving attacker techniques that prioritize stealth, persistence, and unconventional execution methods to evade detection.Pulse ID: 67d7ee24c094f5f32b058b48 Pulse Link: <a href="https://otx.alienvault.com/pulse/67d7ee24c094f5f32b058b48" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://otx.alienvault.com/pulse/67d7ee24c094f5f32b058b48</a> Pulse Author: AlienVault Created: 2025-03-17 09:40:52Be advised, this data is unverified and should be considered preliminary. Always do further verification.<a href="https://social.raytec.co/tags/BackDoor" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#BackDoor</a> <a href="https://social.raytec.co/tags/Bootkit" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Bootkit</a> <a href="https://social.raytec.co/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberSecurity</a> <a href="https://social.raytec.co/tags/InfoSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#InfoSec</a> <a href="https://social.raytec.co/tags/Malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Malware</a> <a href="https://social.raytec.co/tags/OTX" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OTX</a> <a href="https://social.raytec.co/tags/OpenThreatExchange" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenThreatExchange</a> <a href="https://social.raytec.co/tags/RemoteCommandExecution" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#RemoteCommandExecution</a> <a href="https://social.raytec.co/tags/bot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#bot</a> <a href="https://social.raytec.co/tags/AlienVault" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AlienVault</a>

OTX BotCredit Card Skimmer and Backdoor on WordPress E-commerce SiteA sophisticated malware attack targeting WordPress WooCommerce sites was discovered, involving multiple components: a credit card skimmer, a hidden backdoor file manager, and a reconnaissance script. The attack focused on financial gain and long-term control. The skimmer, injected into the checkout page, collected payment and billing information, sending it to a malicious server. A PHP backdoor allowed remote system command execution, while a reconnaissance script gathered server information. The attack demonstrates the evolving complexity of e-commerce platform threats, emphasizing the need for strict security measures, regular scans, proper access controls, and timely updates to prevent such exploits.Pulse ID: 67d52aad906732f7bad24dfa Pulse Link: <a href="https://otx.alienvault.com/pulse/67d52aad906732f7bad24dfa" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://otx.alienvault.com/pulse/67d52aad906732f7bad24dfa</a> Pulse Author: AlienVault Created: 2025-03-15 07:22:21Be advised, this data is unverified and should be considered preliminary. Always do further verification.<a href="https://social.raytec.co/tags/BackDoor" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#BackDoor</a> <a href="https://social.raytec.co/tags/CreditCard" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CreditCard</a> <a href="https://social.raytec.co/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberSecurity</a> <a href="https://social.raytec.co/tags/InfoSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#InfoSec</a> <a href="https://social.raytec.co/tags/Malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Malware</a> <a href="https://social.raytec.co/tags/OTX" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OTX</a> <a href="https://social.raytec.co/tags/OpenThreatExchange" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenThreatExchange</a> <a href="https://social.raytec.co/tags/PHP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PHP</a> <a href="https://social.raytec.co/tags/RAT" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#RAT</a> <a href="https://social.raytec.co/tags/RCE" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#RCE</a> <a href="https://social.raytec.co/tags/RDP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#RDP</a> <a href="https://social.raytec.co/tags/Word" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Word</a> <a href="https://social.raytec.co/tags/Wordpress" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Wordpress</a> <a href="https://social.raytec.co/tags/bot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#bot</a> <a href="https://social.raytec.co/tags/AlienVault" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AlienVault</a>

AskUbuntuHahm Invitation Code : zybcyhbmqa (Earn $7 at sign up) #1404 <a href="https://ubuntu.social/tags/server" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#server</a> <a href="https://ubuntu.social/tags/mouse" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#mouse</a> <a href="https://ubuntu.social/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malware</a> <a href="https://ubuntu.social/tags/username" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#username</a><a href="https://askubuntu.com/q/1543829/612" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://askubuntu.com/q/1543829/612</a>

Xavier «X» Santolaria :verified_paw: :donor:📨 Latest issue of my curated <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> and <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> list of resources for week #11/2025 is out!It includes the following and much more:➝ Alleged Co-Founder of <a href="https://infosec.exchange/tags/Garantex" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Garantex</a> Arrested in India;➝ X Suffered a <a href="https://infosec.exchange/tags/DDoS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DDoS</a> Attack;➝ Microsoft <a href="https://infosec.exchange/tags/PatchTuesday" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PatchTuesday</a> Fixes 7 Zero-days;➝ UK Hospital Discovered 5,000 to 10,000 Unknown Devices Connected to its Network;➝ <a href="https://infosec.exchange/tags/NVIDIA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NVIDIA</a> Chips Smugglers Granted Bail in Singapore;➝ <a href="https://infosec.exchange/tags/Tenable" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Tenable</a> tested <a href="https://infosec.exchange/tags/DeepSeek" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DeepSeek</a>'s Ability to Generate <a href="https://infosec.exchange/tags/Malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Malware</a>;➝ <a href="https://infosec.exchange/tags/OpenAI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenAI</a> labelling DeepSeek as "state-controlled";➝ New <a href="https://infosec.exchange/tags/Jailbreak" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Jailbreak</a> Method called Context Compliance Attack (CCA) Works Against Most <a href="https://infosec.exchange/tags/AI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AI</a> ModelsSubscribe to the <a href="https://infosec.exchange/tags/infosecMASHUP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosecMASHUP</a> newsletter to have it piping hot in your inbox every week-end ⬇️<a href="https://infosec-mashup.santolaria.net/p/template-infosec-mashup-xx-2025-7eb9e43f2aebd47f?utm_source=beehiiv&utm_medium=mastodon" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://infosec-mashup.santolaria.net/p/template-infosec-mashup-xx-2025-7eb9e43f2aebd47f?utm_source=beehiiv&utm_medium=mastodon</a>

The New Oil<a href="https://mastodon.thenewoil.org/tags/ClickFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ClickFix</a>: How to Infect Your <a href="https://mastodon.thenewoil.org/tags/PC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PC</a> in Three Easy Steps<a href="https://krebsonsecurity.com/2025/03/clickfix-how-to-infect-your-pc-in-three-easy-steps/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://krebsonsecurity.com/2025/03/clickfix-how-to-infect-your-pc-in-three-easy-steps/</a><a href="https://mastodon.thenewoil.org/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malware</a> <a href="https://mastodon.thenewoil.org/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://mastodon.thenewoil.org/tags/Windows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Windows</a>

Kevin Karhan :verified:<a href="https://infosec.exchange/@briankrebs" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@briankrebs</a> why am I not surprised at this?<ul><li>I wounder if the <a href="https://infosec.space/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malware</a> is clever enough to filter by <a href="https://infosec.space/tags/UserAgent" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#UserAgent</a> and not try to infect <a href="https://infosec.space/tags/macOS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#macOS</a> & <a href="https://infosec.space/tags/Linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Linux</a> machines with keyboard combinations that don't work there...</li></ul>Needless to say, it was only a matter of time till we see auto-copying <a href="https://infosec.space/tags/JavaScript" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#JavaScript</a> to be weaponized for that...

Recent searches

Search options

Administered by:

Server stats:

#malware