Tuesday April 01, 2025

Details

A new variant of StopCrypt ransomware (aka STOP) was spotted in the wild, employing a multi-stage execution process that involves shellcodes to evade security tools. 

While you constantly hear how big some ransomware operations are, such as LockBit, BlackCat, and Clop, you rarely hear security researchers discussing STOP.

That is because this ransomware operation does not typically target businesses but rather consumers, hoping to generate tens of thousands small $400 to $1,000 ransom payments instead of one large multi-million-dollar demand.

The ransomware is commonly distributed via malvertising and shady sites distributing adware bundles disguised as free software, game cheats and software cracks.

However, when these programs are installed, the users become infected with a variety of malware, including password stealing trojans and STOP ransomware.

This leads infected users to desperately reach out to security researchers, ransomware experts, and our 807-page STOP ransomware forum topic to try and receive help. Read More..

Details

Apart from ChatGPT and Gemini AI which are the most popular Artificial Intelligence systems available to the public, there are several other standalone chatbot applications that are available for users to deploy and use for their own personal customization. 

These standalone applications also provide the feature to plug in and test different AI models and can also bypass IP block restrictions.

One of the most popular standalone Gen AI chatbot applications available for users is the NextChat, a.k.a ChatGPT-Next-Web. Read More..

Details

Hackread reports that widely used software-as-a-service platforms are having their customers targeted by a novel Dropbox phishing attack that circumvents multifactor authentication to facilitate malware deployment and credential exfiltration activities since the end of January.

Attackers leveraging the 'no-reply@dropbox[.]com' domain sent emails with a Dropbox-hosted PDF to employees using the Darktrace SaaS environment, which when opened established a connection with a malicious endpoint redirecting to a fraudulent Microsoft 365 login page, according to a report from Darktrace. Aside from leveraging ExpressVPN-related endpoints to obfuscate their locations, threat actors also tapped valid tokens and fulfilled MFA requirements to avert the targeted organization's MFA policy, researchers said. Read More..

Details

Cybersecurity researchers at Fortinet’s FortiGuard Labs have discovered a new threat called Vcurms malware targeting popular browsers and apps for login and data theft. They urge security updates and caution with emails.

Fortinet’s FortiGuard Labs recently uncovered a new cybersecurity threat: a malware known dubbed “Vcurms.” The attackers behind Vcurms malware have employed sophisticated tactics, using email as their command and control center and leveraging public services such as AWS and GitHub to store the malicious software. Additionally, they have employed a commercial protector to evade detection, indicating a concerted effort to maximize the malware’s impact. Read More..

Details

As the shift of IT infrastructure to cloud-based solutions celebrates its 10-year anniversary, it becomes clear that traditional on-premises approaches to data security are becoming obsolete. Rather than protecting the endpoint, DLP solutions need to refocus their efforts to where corporate data resides - in the browser.

A new guide by LayerX titled "On-Prem is Dead. Have You Adjusted Your Web DLP Plan?" (download here) dives into this transition, detailing its root cause, possible solution paths forward and actionable implementation examples. After reading the guide, security and IT professionals will be equipped with the relevant information they need to update and upgrade their DLP solutions. Read More..

  1. Malware Families Adapting To COM Hijacking Technique For Persistence
  2. Beware of Fake Trading Apps on Google Play & App Store that Steal Your Money
  3. Hackers Exploit Wordpress Plugin Flaw to Infect 3,300 Sites with Malware
  4. Hackers Exploiting iOS 0-day To Attack iPhones
  5. Hackers Steal Windows NTLM Authentication Hashes in Phishing Attacks

Page 7 of 31