Spear-Phishing-Kampagne mit In-Memory-Infostealer
@AWNetworks #ArcticWolf #Cybersecurity #Cybersicherheit #Donutloader #Excel #Infostealer #Phishing #SpearPhishing
@ralf-ladner.bsky.social
@ralf-ladner.bsky.socialSpear-Phishing-Kampagne mit In-Memory-Infostealer
@AWNetworks #ArcticWolf #Cybersecurity #Cybersicherheit #Donutloader #Excel #Infostealer #Phishing #SpearPhishing
@threadlinqs.bsky.socialKREMLIN malware forges Chrome's own tamper checks to sneak in a spy extension that steals your bank logins. https://intel.threadlinqs.com/threat/TL-2026-2525 #ThreatIntel #PULSAR #REMCOS #DonutLoader
@bomccss.bsky.socialwww.virustotal.com/gui/file/ba0...
tria.ge/260915-hmt48...
app.any.run/tasks/59aad6...
マルウェア #DonutLoader -> #Overlord
■通信先
hxxps[:]//devin-us[.]com/api/file-share/5a3c7c4c-41e0-4cdb-b800-4588b5a594cc/download
(103.59.101[.]28:443)
■C2
hxxps[:]//devin-us[.]com
(103.59.101[.]28:443)
@bomccss.bsky.socialGST_Filing_Overdue_GSTR-8B_GSTIN33LMNOP9012G1Z5_Due_20082026.zip
www.virustotal.com/gui/file/25e...
tria.ge/260910-m16gm...
app.any.run/tasks/8e49cc...
-> badata_x64.dll, .exe
マルウェア #DonutLoader -> #Overlord
■通信先
hxxps[:]//devin-us[.]com/api/file-share/8e907edc-874f-47c4-9738-dd600a8e31de/download