Collaborate Disseminate
WE still see loads of AgentTesla keylogger/ Info-stealer malware campaigns hitting the UK most days. Today is no exception with quite a few so far. I don’t always post them here, unless there is something slightly different or unusual about eithe… Continue reading Another Agenttesla campaign using a compromised Iraq Government site
Every now and again we see a phishing scam that stops you in your tracks and you think ” I really don’t believe it”. this is another one of them. I am absolutely gobsmacked by the amount of so called web developers, SEO experts… Continue reading Wechat phishing via another compromised web developer
Every now and again we see a phishing scam that stops you in your tracks and you think WTF. this is one of them. It starts with a fake Docusign email that contains a link to a bit.ly short url. What makes this one so bad is that the bit.ly short… Continue reading Docusign phishing scam using a compromised law firm webspace
We see lots of phishing attempts for email credentials. This one is quite strange and weird, It pretends to be a message from Barclays Bank to update card details. I don’t know what is happening but several times I tried, I get redirected to t… Continue reading Very strange Barclays bank Phishing Scam
It looks like we are seeing a few changes to the Remcos RAT install & persistence method. Over the last couple of weeks I have noticed a few tweaks to the persistence & auto start of several Remcos Rat versions. Today it has changed again to tr… Continue reading Some changes to Remcos Rat persistence method
We don’t see a lot of malware at weekends in UK, so it was a bit of a surprise to get a whole swathe on emails overnight pretending to be an invoice from indofuels. The keylogger and info / credential stealer the criminals are using this weekend … Continue reading Keybase keylogger via fake indofuels invoice
It seems to be the week for harder to analyse & dodgy delivery systems that more carefully target specific countries / regions or even specific isps. Yesterday we saw a fake e-fax notification in German language that eventually led to a Buran rans… Continue reading Fake TNT delivery drops WSHRAT via DiscordApp
This is a strange & slightly more difficult than usual to analyse malware, mainly because the bad actor appears to have made a total mess of the distribution. I do not know if this will actually run on a proper computer, it obviously doesn’t… Continue reading Fake invoice tries to deliver Remcos RAT
It looks like Friday the 13th is unlucky for this malware bad actor, trying to deliver yet another AgentTesla keylogger / info-stealer because as far as I can tell this malware chain is broken so the victim should not get the payload. WE still see lo… Continue reading A Friday the 13th failure for Agenttesla campaign
WE still see loads of AgentTesla keylogger/ Info-stealer malware campaigns hitting the UK most days. Today is no exception with quite a few so far. I don’t always post them here, unless there is something slightly different or unusual about eithe… Continue reading More AgentTesla keylogger campaigns