Tag: dll hijacking

7 Attack Reports | 0 Vulnerabilities

Attack reports

Investigation of email-based attack delivering MediaFire ZIP file with execution chain analysis

An investigation revealed a malicious email campaign directing victims to download a ZIP file from MediaFire. The infection chain began with a Python setup executable (Setu.exe) that side-loaded a malicious 400 MB python37.dll containing repeated byte padding. The DLL performed process injection in…

process injection

scheduled task persistence

python side-loading

Published: June 16, 2026

Downloadable IOCs: 2

Operation TaxShadow: Multi-Region Tax Phishing & In-Memory Malware Campaign

A sophisticated multi-stage malware campaign targets victims through tax-themed phishing emails impersonating Indian and Japanese government authorities. The operation leverages social engineering, fraudulent tax notifications, and trusted third-party email delivery services to distribute ZIP archi…

in-memory execution

reflective loading

government impersonation

multi-stage payload

token manipulation

Published: June 4, 2026

Downloadable IOCs: 5

From fake Proton VPN sites to gaming mods, this Windows infostealer is everywhere

Multiple campaigns are distributing NWHStealer through diverse delivery methods including fake VPN downloads, hardware utilities, and gaming modifications. The malware collects browser data, saved passwords, and cryptocurrency wallet information. Distribution occurs via fake websites impersonating …

cryptocurrency theft

process injection

browser data theft

cryptocurrency wallet theft

Published: April 17, 2026

Downloadable IOCs: 3

Silver Fox Targeting India Using Tax Themed Phishing Lures

A sophisticated campaign by the Chinese APT group Silver Fox is targeting Indian entities with authentic-looking Income Tax phishing lures. The attack leverages a complex kill chain involving DLL hijacking and the modular Valley RAT to ensure persistence. The campaign uses a multi-stage infection p…

c2 communication

multi-stage attack

chinese threat actor

Published: December 24, 2025

Downloadable IOCs: 8

How a new PlugX variant abuses DLL search order hijacking

A new campaign targeting telecommunications and manufacturing sectors in Central and South Asian countries has been discovered, delivering a new variant of PlugX. The campaign, active since 2022, shows overlaps between RainyDay and Turian backdoors, including the abuse of legitimate applications fo…

telecommunications

backdoordiplomacy

Published: September 25, 2025

Downloadable IOCs: 53

Targeted attacks leverage accounts on popular online platforms as C2 servers

A sophisticated cyberattack campaign targeted the Russian IT industry and other entities globally in late 2024. The attackers used social media profiles and popular websites to deliver payload information, bypassing detection methods. They employed spear phishing emails with malicious RAR archives,…

cobalt strike beacon

targeted attacks

c2 communication

api obfuscation

Published: July 30, 2025

Downloadable IOCs: 2

Stealers on the rise: Kral, AMOS, Vidar and ACR

This intelligence report analyzes the increasing prevalence of information stealers, focusing on Kral, AMOS, Vidar, and ACR. Kral, delivered by its downloader, targets cryptocurrency wallets and browser data. AMOS, a macOS stealer, spreads through malvertising impersonating Homebrew. Vidar distribu…

credential theft

data exfiltration

information stealers

Published: October 21, 2024

Downloadable IOCs: 0

Click here to see more Attack Reports