Crypto

20 posts

$Sandbox process tree for the Underground loader, showing an injected dllhost.exe launching chrome.exe and msedge.exe and staging stolen cookies under C:\ProgramData\Underground, before a second dllhost.exe deletes that folder.$

Malware Credential Theft

$100k in Crypto Drained by the Underground Operation

October 1, 20268 min read

Shared beacon code that fingerprints the visitor (browser, OS, device, country), encrypts the record with ECDH P-256 and AES-GCM, and posts it to the collect endpoint

Malware Social Engineering

EtherHiding in the Browser: ClickFix Chain Ends in Amatera

August 25, 202612 min read

macOS ClickFix Lures Deploy AppleScript Stealer & Persistent RAT

Malware Credential Theft

macOS ClickFix Lures Deploy AppleScript Stealer & Persistent RAT

June 17, 202611 min read

OpenClaw's Hologram: Fake Installer Ships Rust Infostealer

Malware Credential Theft

OpenClaw's Hologram: Fake Installer Ships Rust Infostealer

May 7, 202615 min read

macOS ClickFix Campaign: AppleScript Stealers & New Terminal Protections

Malware Credential Theft

macOS ClickFix Campaign: AppleScript Stealers & New Terminal Protections

April 20, 20266 min read

From ClickFix to MaaS: Exposing a Modular Windows RAT and Its Admin Panel

From ClickFix to MaaS: Exposing a Modular Windows RAT and Its Admin Panel

April 6, 20268 min read

New DOGE Big Balls Ransomware Tools in the Wild

Ransomware Crypto

New DOGE Big Balls Ransomware Tools in the Wild

May 7, 20259 min read

Attackers Target Crypto Wallets Using Codeless Webflow Phishing Pages

Phishing Crypto

Attackers Target Crypto Wallets Using Codeless Webflow Phishing Pages

October 23, 20244 min read

Netskope Threat Coverage: BlackSnake Ransomware

Ransomware Malware

Netskope Threat Coverage: BlackSnake Ransomware

March 16, 20236 min read

New Phishing Technique Targeting Over 20 Crypto Wallets

Phishing Credential Theft

New Phishing Technique Targeting Over 20 Crypto Wallets

November 10, 20223 min read

Cloud Threats Memo: Hard Statistics About Poorly Secured Cloud Accounts

December 8, 20212 min read

Cryptojackers on the hunt for your IaaS resources

Cryptojackers on the hunt for your IaaS resources

June 14, 20185 min read

Technical Analysis of Xbooster parasitic Monero Miner

Crypto Ransomware

Technical Analysis of Xbooster parasitic Monero Miner

May 21, 20187 min read

Xbooster Parasitic Monero Mining Campaign

Crypto Ransomware

Xbooster Parasitic Monero Mining Campaign

May 9, 20185 min read

Pony Malware - How to Protect User and Wallet Data

Pony Malware - How to Protect User and Wallet Data

January 24, 20186 min read

The modern Gold Mine Rush - Office 365 as a crypto miner’s paradise

The modern Gold Mine Rush - Office 365 as a crypto miner’s paradise

November 7, 20175 min read

Ongoing email campaign spreading GlobeImposter Ransomware

Ongoing email campaign spreading GlobeImposter Ransomware

September 5, 20176 min read

Coin mining malware heads to the cloud with Zminer

Coin mining malware heads to the cloud with Zminer

August 24, 20177 min read

Petya Wormed Ransomware Causes Havoc

Petya Wormed Ransomware Causes Havoc

June 27, 20172 min read

Cloud CRM Services as a Malware Attack Vector

Cloud CRM Services as a Malware Attack Vector

February 9, 20176 min read