Remove Download Remove Social Engineering Remove Spyware
article thumbnail

Sophisticated Android spyware PhoneSpy infected thousands of Korean phones

Security Affairs

South Korean users have been targeted with a new sophisticated Android spyware, tracked as PhoneSpy, as part of an ongoing campaign. Researchers from Zimperium zLabs uncovered an ongoing campaign aimed at infecting the mobile phones of South Korean users with new sophisticated android spyware dubbed PhoneSpy. Zimperium concludes.

Spyware 145
article thumbnail

Hermit spyware is deployed with the help of a victim’s ISP

Malwarebytes

Google’s Threat Analysis Group (TAG) has revealed a sophisticated spyware activity involving ISPs (internet service providers) aiding in downloading powerful commercial spyware onto users’ mobile devices. The spyware, dubbed Hermit, is reported to have government clients much like Pegasus.

Spyware 112
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

APT C-23 group targets Middle East with an enhanced Android spyware variant

Security Affairs

A threat actor, tracked as APT C-23, is using new powerful Android spyware in attacks aimed at targets in the Middle East. The APT C-23 cyberespionage group (also known as GnatSpy, FrozenCell, or VAMP) continues to target entities in the Middle East with enhanced Android spyware masqueraded as seemingly harmless app updates (i.e.

Spyware 119
article thumbnail

APT trends report Q3 2024

SecureList

Except for the first-stage loader and the PipeShell plugin, all plugins are downloaded from the C2 and then loaded into memory, leaving no trace on disk. Each time the system restarts, or as required by the operation, P8 downloads additional plugins from the C2 or loads them from disk into memory.

Malware 117
article thumbnail

New Coronavirus-themed malspam campaign delivers FormBook Malware

Security Affairs

Experts uncovered a new Coronavirus (COVID-19 ) -themed campaign that is distributing a malware downloader that delivers the FormBook information-stealing Trojan. ’ The executable employed in this campaign is a strain of the GuLoader malware downloader. The malware can also execute commands from a command and control (C2) server.

Malware 145
article thumbnail

Story of the Year: global IT outages and supply chain attacks

SecureList

This case underscores the serious risk that social engineering and supply chain attacks pose to open-source projects. The breach allowed the threat actor to download SMS message logs. The packages imitated libraries for LLMs, whereas in fact they downloaded the JarkaStealer malware to the victim’s system.

Internet 109
article thumbnail

Campaigns abusing corporate trusted infrastructure hunt for corporate credentials on ICS networks

SecureList

Kaspersky ICS CERT has uncovered a number of spyware campaigns targeting industrial enterprises. The attackers use off-the-shelf spyware, but limit the scope and lifetime of each sample to the bare minimum. The attackers use off-the-shelf spyware, but limit the scope and lifetime of each sample to the bare minimum.

Spyware 105