Exploring FBot | Python-Based Malware Targeting Cloud and Payment Services
Executive Summary Overview The cloud hacktool scene is highly intertwined, with many tools relying on one another’s code. This is particularly true for malware families like AlienFox, Greenbot, Legion, and Predator, which share code from a credential scraping module called Androxgh0st. We identified a tool that is related but distinct from these families. FBot is a Python-based […]
Atomic Stealer rings in the new year with updated version
Last year, we documented malware distribution campaigns both via malvertising and compromised sites delivering Atomic Stealer (AMOS) onto Mac users. This stealer has proven to be quite popular in the criminal underground and its developers have been adding new features to justify its hefty $3000/month rental fee. It looks like Atomic Stealer was updated around mid to late December […]
Deceptive Cracked Software Spreads Lumma Variant on YouTube
FortiGuard Labs recently discovered a threat group using YouTube channels to distribute a Lumma Stealer variant…
Approaching Stealers Devs (7 parts series)
To completely understand what’s going on in the info stealers market which has been growing in the last years…
Infostealer infection of an Orange employee results in BGP disruptions
Using the stolen account, the threat actor modified the AS number belonging to Orange’s IP address, resulting in major disruptions…
Key Learnings from Files Present on the C2 Server of an Infamous Infostealer Malware
This method can be applied to multiple other C2 servers that we come across on a daily basis to check for any security misconfigurations…
From LNK Payload to Infostealer Source Code
A ZIP/LNK payload and, with some luck, we will end up identifying the infostealer that is being dropped and its source code…
Infostealer – Trends and how to detect them before it’s too late
Infostealers are a type of malware designed to steal information from the victim system in order to send it to the attacker…
Mysterious hacker strikes Iran with major cyberattacks against industry leading companies
A hacker who goes by the username “irleaks” posted a thread in which they attempt to sell over 160,000,000 records of Iranians…
Unmasking RedLine Stealer
RedLine Stealer is a dangerous type of malware that can cause serious harm to both individuals and organizations…
Evilginx Phishing Proxy
Learn about the threat of free Adversary-in-the-Middle (AiTM) phishing proxy Evilginx and how to mitigate it…
New Version Of Meduza Stealer Released In Dark Web
Resecurity’s HUNTER (HUMINT) spotted the author of perspective password stealer Medusa has released a new version…
