PhishingWeLiveSecurity·5 months ago
A cunning predator: How Silver Fox preys on Japanese firms this tax season
Silver Fox is back in Japan, spoofing tax and HR emails timed to the one season when no one thinks twice about opening them
← Back
MalwareThe Hacker News·5 hours ago
ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions
Silver Fox threat actors are distributing the ValleyRAT backdoor disguised as QN Wallpaper, a legitimate Chinese desktop-wallpaper application, which users often add to antivirus exclusions due to its signed status. By running the malware under this trusted process, attackers can evade detection on systems where users have already whitelisted the application. Kaspersky identified this distribution method as part of the group's campaign to establish backdoor access while bypassing security controls.
Read full article at The Hacker News ↗Related Articles
MalwareCheck Point Research·3 hours ago
Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode
Check Point Research has analyzed JSCeal, a stealer malware distributed as compiled V8 bytecode and executed through a bundled Node.js runtime, which has been actively targeting cryptocurrency applications since March 2024 under various names including WEEVILPROXY and MeadowLocust. The research demonstrates static deobfuscation techniques for reversing JSCeal's compiled bytecode, providing visibility into the malware's obfuscation mechanisms and operational details.
MalwareSecurityWeek·5 hours ago
Anthropic Warns Claude Users of Infostealer Malware Infections
Anthropic has detected infostealer malware infections among Claude users and is responding by forcing account logouts and removing stored payment information to prevent unauthorized access to compromised accounts. The company is taking these protective measures to limit potential misuse of affected user accounts while infections are remediated.
MalwareHelp Net Security·5 hours ago
Anthropic locks out Claude users after infostealers hijack login sessions
Anthropic has begun locking Claude users out of their accounts after detecting compromised login sessions caused by infostealer malware infections on users' devices. The campaign leverages multiple infostealers including Vidar, Lumma, StealC, RedLine, and Acreed on Windows systems, as well as Atomic Stealer on a limited number of Macs, with these general-purpose malware typically arriving through unofficial downloads or malicious applications. Affected users received notification emails explaining the account lockouts as a protective measure against the credential theft campaign.