Commodity malware steals authenticated sessions, letting thieves freeload on victims' paid usage
Read full article at The Register ↗A new wave of ClickFix attacks employs a sophisticated multi-stage infection chain that conceals malware within PNG image files before deploying a custom reverse tunnel to compromised systems. The technique represents an escalation in complexity for ClickFix campaigns, moving beyond simple fake support scams to establish persistent remote access on victim machines.
Check Point Research has analyzed JSCeal, a stealer malware distributed as compiled V8 bytecode and executed through a bundled Node.js runtime, which has been actively targeting cryptocurrency applications since March 2024 under various names including WEEVILPROXY and MeadowLocust. The research demonstrates static deobfuscation techniques for reversing JSCeal's compiled bytecode, providing visibility into the malware's obfuscation mechanisms and operational details.
Silver Fox threat actors are distributing the ValleyRAT backdoor disguised as QN Wallpaper, a legitimate Chinese desktop-wallpaper application, which users often add to antivirus exclusions due to its signed status. By running the malware under this trusted process, attackers can evade detection on systems where users have already whitelisted the application. Kaspersky identified this distribution method as part of the group's campaign to establish backdoor access while bypassing security controls.
Anthropic has detected infostealer malware infections among Claude users and is responding by forcing account logouts and removing stored payment information to prevent unauthorized access to compromised accounts. The company is taking these protective measures to limit potential misuse of affected user accounts while infections are remediated.