SecuriTricks

Potentially Unwanted Applications (PUAs) weaponized for covert delivery

A malware distribution campaign leveraging digitally signed binaries, deceptive packaging, and browser hijackers has been uncovered. The campaign centers around two malicious applications, ImageLooker.exe and Calendaromatic.exe, delivered via self-extracting 7-Zip archives. These artifacts align wi…

malvertising

seo-poisoning

trojanized-productivity-tools

code-signing-abuse

calendaromatic

browser-hijacker

Published: September 29, 2025

Linked vulnerabilities : CVE-2025-0411 (CVSS 7.0)

Downloadable IOCs: 6

New FIN7-Linked Infrastructure, PowerNet Loader, and Fake Update Attacks

Insikt Group uncovered new infrastructure linked to GrayAlpha, a threat actor associated with FIN7. They identified a custom PowerShell loader named PowerNet that deploys NetSupport RAT, and another loader called MaskBat. Three main infection vectors were discovered: fake browser updates, fake 7-Zi…

Published: June 13, 2025

Downloadable IOCs: 0

CVE-2025-0411: Ukrainian Organizations Targeted in Zero-Day Campaign and Homoglyph Attacks

A zero-day vulnerability in 7-Zip (CVE-2025-0411) was exploited by Russian cybercrime groups to target Ukrainian organizations. The vulnerability allows bypassing Windows Mark-of-the-Web protections through double archiving, enabling execution of malicious content. The campaign involved spear-phish…

mark-of-the-web bypass

Published: February 4, 2025

Downloadable IOCs: 0

Tag: 7-zip

Attack reports

Potentially Unwanted Applications (PUAs) weaponized for covert delivery

New FIN7-Linked Infrastructure, PowerNet Loader, and Fake Update Attacks

CVE-2025-0411: Ukrainian Organizations Targeted in Zero-Day Campaign and Homoglyph Attacks