HellCat Ransomware Hits 4 Firms using Infostealer-Stolen Jira Credentials https://hackread.com/hellcat-ransomware-firms-infostealer-stolen-jira-credentials/ #Cybersecurity #CyberAttacks #LummaStealer #CyberAttack #Infostealer #Ransomware #Security #Malware #HellCat #Raccoon #Redline #Stealc #Jira

NEW: HellCat ransomware hits 4 companies across the US and Europe by exploiting Jira credentials stolen through infostealer malware.

Read: https://hackread.com/hellcat-ransomware-firms-infostealer-stolen-jira-credentials/

The Wagmi Manual: Copy, Paste, and Profit

The Wagmi traffer group, operating since early 2023, specializes in NFT scams and cryptocurrency theft. They utilize sophisticated social engineering tactics, fake web3-themed games, and impersonation of legitimate projects to lure victims. Their operations have allegedly earned over $2.4 million between June 2023 and March 2025. The group employs various techniques, including seed phrase phishing and automated wallet address scraping from social media. They target users of NFT marketplaces and the Web3 community, using fake job offers and enticing game promotions. The group also engages in code signing certificate abuse to bypass security measures and increase infection rates. Their malware payloads include HijackLoader, Lumma C2 infostealer, Rhadamanthys stealer, and AMOS stealer for MacOS.

Pulse ID: 67f4faa0ced84c07a0fad6d8
Pulse Link: https://otx.alienvault.com/pulse/67f4faa0ced84c07a0fad6d8
Pulse Author: AlienVault
Created: 2025-04-08 10:29:52

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

Vidar Stealer: Infostealer malware discovered in Steam game

A recent analysis uncovered a sophisticated deployment of Vidar Stealer, an infamous information-stealing malware, disguised as a legitimate Microsoft Sysinternals tool, BGInfo.exe. The malware, found with an expired Microsoft signature, was significantly larger than the original file and contained modified initialization routines. It creates virtual memory allocations to execute its malicious code, ultimately extracting and running Vidar Stealer. This variant maintains its core functionalities, including credential theft, cryptocurrency wallet targeting, session hijacking, and cloud data theft. The incident highlights the evolving tactics of cybercriminals, emphasizing the need for vigilant threat hunting and proactive security measures.

Pulse ID: 67f42a4eca9270b211468d90
Pulse Link: https://otx.alienvault.com/pulse/67f42a4eca9270b211468d90
Pulse Author: AlienVault
Created: 2025-04-07 19:41:02

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#RANSOMFEED

#HellCat ransomware group has exploited stolen Jira credentials from #infostealer malware to target new four organizations

https://ransomfeed.it/stats.php?page=group-profile&group=hellcat

BeaverTail and Tropidoor Malware Distributed via Recruitment Emails

A sophisticated malware campaign has been uncovered, involving the distribution of BeaverTail and Tropidoor malware through fake recruitment emails. The attackers, suspected to be of North Korean origin, impersonated a developer community to lure victims into downloading malicious code. The campaign utilizes a downloader disguised as 'car.dll' and BeaverTail malware masquerading as 'tailwind.config.js'. BeaverTail functions as an infostealer and downloader, targeting web browsers and cryptocurrency wallets. Tropidoor, a backdoor malware, establishes communication with command and control servers, allowing remote execution of various commands. The attack methodology shares similarities with previous North Korean campaigns, including the use of techniques reminiscent of the Lazarus group's LightlessCan malware.

Pulse ID: 67ef0692d6ed151e2be71213
Pulse Link: https://otx.alienvault.com/pulse/67ef0692d6ed151e2be71213
Pulse Author: AlienVault
Created: 2025-04-03 22:07:14

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

https://www.forbes.com/sites/daveywinder/2025/03/28/these-hackers-use-your-gpu-to-load-password-stealing-malware/
#cybersecurity #GPU #infostealer #CoffeeLoader #malware

#Infostealer campaign compromises 10 #npm packages, targets devs

https://www.bleepingcomputer.com/news/security/infostealer-campaign-compromises-10-npm-packages-targets-devs/

malicious npm packages (again) targeting cryptocurrency projects, CEOs cranky over CVEs, and BlackLock gets pantsed - here's your Friday wrap up in Infosec News

https://opalsec.io/daily-news-update-friday-march-28-2025-australia-melbourne/

Here's a quick rundown of what's inside:

npm Package Nightmare: 10 packages compromised by an infostealer campaign targeting developer environments. Sensitive data was siphoned off to a remote host. Most of the packages are still available on npm, so be careful!
Firefox Flaw: A critical sandbox escape vulnerability (CVE-2025-2857) patched in Firefox 136.0.4. Windows users, update ASAP! This one's similar to a Chrome zero-day used in espionage campaigns.
Ransomware Reckoning: Advanced, a UK healthcare IT provider, slapped with a £3.1 million fine after a LockBit ransomware attack. Lack of vulnerability scanning and poor patch management were key factors.
Extension Exploitation: Browser extensions can be bought and repurposed, posing a sneaky threat to enterprises. An extension was bought for $50 and was quickly repurposed to redirect traffic.
Solar Scare: Dozens of vulnerabilities in solar inverters could let attackers disrupt power grids. Remote code execution, device takeover, and more are possible.
CrushFTP Clash: CEO responds aggressively to VulnCheck after critical unauthenticated access vulnerability (CVE-2025-2825) is released. Vulnerability disclosure and patching processes need to be improved!
Pegasus in Serbia: Journalists targeted with Pegasus spyware, marking the third time in two years that Amnesty has found Pegasus deployed against Serbian civil society.
Mamont Malware: Russian authorities arrest three for developing the Mamont Android banking trojan. This malware steals financial data and spreads through Telegram.
Ransomware Reverse: Resecurity infiltrates the BlackLock ransomware gang, gathering intel to help victims. LFI vulnerability exploited, and data shared with authorities.

Stay vigilant out there, folks!

Infostealer campaign compromises 10 npm packages, targets devs

#Cybersecurity #Infostealer #Malware #Security #SoftwareDevelopment #npm #JavaScript

https://www.bleepingcomputer.com/news/security/infostealer-campaign-compromises-10-npm-packages-targets-devs/

Arkana Security claimed responsibility for a breach at WideOpenWest (WoW), with Huston Rock researchers citing an infostealer infection.

#cybersecurity #databreach #infostealer #hacking #infosec

https://cnews.link/wideopenwest-allegedly-breached-hackers-threaten-data-release-1/

Valve’s Steam game platform was exploited to push malware—twice in 2 months.

Valve has removed “Sniper: Phantom’s Resolution” from Steam. Last month it banned “PirateFi”—both reportedly contained infostealer malware.

Read @theJoshMeister’s report: https://www.intego.com/mac-security-blog/steam-game-store-exploited-to-push-malware-twice-in-2-months/

https://www.businessinsider.com/roleplay-pretend-chatgpt-writes-password-stealing-malware-google-chrome-2025-3
#cybersecurity #ChatGPT #LLMs #malware #infostealer

Flashpoint GTIR 2025 enthüllt: 33 % mehr gestohlene Logins – Infostealer im Höhenflug
#Cyberangriffe #Hintergrundberichte #Cybercrime #darknet #Flashpoint #GTIR2025 #Infostealer #Ransomware https://sc.tarnkappe.info/5ca938

https://www.businessinsider.com/roleplay-pretend-chatgpt-writes-password-stealing-malware-google-chrome-2025-3
#cybersecurity #ChatGPT #LLMs #malware #infostealer #GooglePasswordManager

Security researchers jailbroke AI chatbots to create a Chrome infostealer using a novel technique called "Immersive World." This method requires no prior malware coding knowledge, lowering the barrier for cybercriminals. Read more on TechRadar! https://www.techradar.com/pro/security/ai-chatbots-jailbroken-to-create-a-chrome-infostealer #AI #security #cybersecurity #infostealer #newz

NEW: Researchers use AI jailbreak on top LLMs, including ChatGPT, DeepSeek, and Copilot, to create functional Google Chrome infostealers.

Read: https://hackread.com/ai-jailbreak-on-top-llms-to-create-chrome-infostealer/

Beware, Reddit users! Cybercriminals are targeting crypto traders with fake, cracked versions of TradingView, loaded with AMOS & Lumma Stealer malware. Don't let them drain your wallets! Stay safe, download software only from trusted sources!
https://cyberinsider.com/reddit-users-targeted-with-infostealer-malware-disguised-as-tradingview/ #cybersecurity #malware #reddit #tradingview #cryptocurrency #infostealer #newz

Data Breaches Surge by 6%: 16.8 Billion Records Exposed - https://www.redpacketsecurity.com/over-16-8-billion-records-exposed-as-data-breaches-increase-6/

Ransomware Hits Record High: 126% Surge in Attacks in February 2025 – Source:hackread.com https://ciso2ciso.com/ransomware-hits-record-high-126-surge-in-attacks-in-february-2025-sourcehackread-com/ #1CyberSecurityNewsPost #CyberSecurityNews #cybersecurity #bitdefender #CyberAttack #Infostealer #CyberCrime #Ransomware #February #Hackread #Cl0p