SecuriTricks - danabot

Downloader Malware Written in JPHP Interpreter

A newly discovered malware utilizes JPHP, a PHP interpreter running on Java Virtual Machine, to create a downloader. The malware is distributed in a ZIP file containing Java Runtime Environment and libraries, enabling execution without a separate Java environment. It communicates with a C2 server, …

danabot

strrat

php

jphp

2025-04-17

Published: April 17, 2025

Downloadable IOCs: 4

Phishing campaign impersonates Booking.com, delivers a suite of credential-stealing malware

A phishing campaign targeting organizations in the hospitality industry has been identified, impersonating Booking.com and using the ClickFix social engineering technique to deliver multiple credential-stealing malware. The campaign, tracked as Storm-1865, targets individuals likely to work with Bo…

Published: April 13, 2025

Downloadable IOCs: 0

Security Brief: ClickFix Social Engineering Technique Floods Threat Landscape

Proofpoint researchers have identified a surge in the ClickFix social engineering technique across the threat landscape. This technique uses dialogue boxes with fake error messages to trick users into copying, pasting, and running malicious content on their computers. Multiple threat actors are emp…

Published: November 18, 2024

Downloadable IOCs: 0

Security Brief: Actor Uses Compromised Accounts, Customized Social Engineering to Target Transport and Logistics Firms with Malware

A threat actor is targeting transportation and logistics companies in North America with malware campaigns. The actor uses compromised email accounts to inject malicious content into existing conversations, making messages appear legitimate. Campaigns primarily deliver Lumma Stealer, StealC, NetSup…

Published: September 24, 2024

Downloadable IOCs: 23

Tag: danabot

Attack reports

Downloader Malware Written in JPHP Interpreter

Phishing campaign impersonates Booking.com, delivers a suite of credential-stealing malware

Security Brief: ClickFix Social Engineering Technique Floods Threat Landscape

Security Brief: Actor Uses Compromised Accounts, Customized Social Engineering to Target Transport and Logistics Firms with Malware

Exploring the D3F@ck Malware-as-a-Service Loader

Campaign uses infostealers and clippers for financial gain

D3F@ck Loader, the New MaaS Loader

Distribution of DanaBot Malware via Word Files Detected