#remote-access-trojan
#remote-access-trojan
[ follow ]
#cybersecurity #malware #phishing #android-malware #malware-as-a-service #react2shell #kswapdoor #zndoor #pystorerat
fromThe Hacker News
4 days agoFake OSINT and GPT Utility GitHub Repos Spread PyStoreRAT Malware Payloads
Cybersecurity researchers are calling attention to a new campaign that's leveraging GitHub-hosted Python repositories to distribute a previously undocumented JavaScript-based Remote Access Trojan (RAT) dubbed PyStoreRAT. "These repositories, often themed as development utilities or OSINT tools, contain only a few lines of code responsible for silently downloading a remote HTA file and executing it via 'mshta.exe,'" Morphisec researcher Yonatan Edri said in a report shared with The Hacker News.
Information security
Information security
fromThe Hacker News
1 month agoUkraine Aid Groups Targeted Through Fake Zoom Meetings and Weaponized PDF Files
A coordinated spear-phishing campaign named PhantomCaptcha used fake Zoom and Cloudflare CAPTCHA pages to deliver a WebSocket-based remote access trojan to Ukraine-related organizations.
fromThe Hacker News
3 months agoTAG-150 Develops CastleRAT in Python and C, Expanding CastleLoader Malware Operations
Available in both Python and C variants, CastleRAT's core functionality consists of collecting system information, downloading and executing additional payloads, and executing commands via CMD and PowerShell," Recorded Future Insikt Group said.
Information security
fromThe Hacker News
3 months agoPhishing Campaign Uses UpCrypter in Fake Voicemail Emails to Deliver RAT Payloads
The campaign leverages "carefully crafted emails to deliver malicious URLs linked to convincing phishing pages," Fortinet FortiGuard Labs researcher Cara Lin said. "These pages are designed to entice recipients into downloading JavaScript files that act as droppers for UpCrypter." Attacks propagating the malware have been primarily targeting manufacturing, technology, healthcare, construction, and retail/hospitality sectors across the world since the start of August 2025. The vast majority of the infections have been observed in Austria, Belarus, Canada, Egypt, India, and Pakistan, among others.
Information security
[ Load more ]