SecuriTricks - evasion techniques

The HoneyMyte APT now protects malware with a kernel-mode rootkit

In mid-2025, a malicious driver file was discovered on Asian computer systems, signed with a compromised digital certificate. This driver injects a backdoor Trojan and protects malicious files, processes, and registry keys. The final payload is a new variant of the ToneShell backdoor, associated wi…

apt

rootkit

Published: December 29, 2025

Downloadable IOCs: 0

Technical Analysis of the BlackForce Phishing Kit

The BlackForce phishing kit, first observed in August 2025, has evolved through multiple versions and is capable of stealing credentials and performing Man-in-the-Browser attacks to bypass multi-factor authentication. It impersonates various brands and uses sophisticated evasion techniques, includi…

Published: December 12, 2025

Downloadable IOCs: 0

Albiriox Exposed: A New RAT Mobile Malware Targeting Global Finance and Crypto Wallets

Albiriox is a newly identified Android malware offered as Malware-as-a-Service, likely managed by Russian-speaking threat actors. It employs a two-stage deployment chain using dropper applications and packing techniques to evade detection. The malware exhibits advanced On-Device Fraud capabilities,…

Published: December 3, 2025

Downloadable IOCs: 4

EVALUSION Campaign Delivers Amatera Stealer and NetSupport...

The eSentire Threat Response Unit identified a malware campaign using ClickFix as an initial access vector to deploy Amatera Stealer and NetSupport RAT. Amatera Stealer is a rebranded version of ACR Stealer, with advanced evasion techniques like WoW64 SysCalls to bypass security solutions. It targe…

Published: November 18, 2025

Downloadable IOCs: 1

Increase in Lumma Stealer Activity Coincides with Use of Adaptive Browser Fingerprinting Tactics

Trend Research observed a resurgence in Lumma Stealer activity since October 20, 2025, accompanied by new behaviors and C&C techniques. The malware now employs browser fingerprinting as part of its command-and-control tactics, collecting and exfiltrating system, network, hardware, and browser data …

browser fingerprinting

2025-11-14

cybercriminal activity

Published: November 14, 2025

Downloadable IOCs: 3

Malware Campaign Leverages SVGs, Email Attachments, and CDNs to Drop XWorm and Remcos via BAT Scripts

A sophisticated malware campaign has been uncovered that utilizes various techniques to deliver Remote Access Trojans (RATs) such as XWorm and Remcos. The attack chain begins with a ZIP archive, often hosted on trusted platforms like ImgKit, containing obfuscated BAT scripts. These scripts execute …

Published: September 11, 2025

Downloadable IOCs: 2

MostereRAT Deployed AnyDesk/TightVNC for Covert Full Access

A sophisticated phishing campaign targeting Japanese users employs MostereRAT, a Remote Access Trojan that utilizes advanced evasion techniques. The attack chain involves multiple stages, including an Easy Programming Language (EPL) payload, security tool disabling, and mTLS-secured C2 communicatio…

Published: September 9, 2025

Downloadable IOCs: 12

Android Document Readers and Deception: Tracking the Latest Updates to Anatsa

Anatsa, an Android banking malware first discovered in 2020, has evolved with new capabilities and targets. The latest variant now affects over 831 financial institutions worldwide, including new countries and cryptocurrency platforms. Anatsa has streamlined its payload delivery, implemented DES ru…

financial institutions

2025-08-22

harly

facestealer

Published: August 22, 2025

Downloadable IOCs: 0

Unmasking AsyncRAT: Navigating the labyrinth of forks

AsyncRAT, an open-source remote access trojan, has evolved into a sprawling network of forks and variants since its 2019 release. The article explores its origins, tracing influence from Quasar RAT, and maps out the relationships among various forks. DcRat and VenomRAT emerge as the most widely dep…

Published: August 12, 2025

Downloadable IOCs: 22

Powerful MaaS On the Prowl for Credentials and Crypto Assets

Katz Stealer is a sophisticated infostealer marketed as Malware-as-a-Service (MaaS), launched in early 2025. It features robust credential and data theft capabilities, along with modern evasion and anti-analysis techniques. The stealer targets a wide range of personal and sensitive information, inc…

Published: July 17, 2025

Downloadable IOCs: 31

Pay2Key's Resurgence: Iranian Cyber Warfare Targets the West

Pay2Key, an Iranian-backed ransomware-as-a-service operation, has re-emerged as Pay2Key.I2P, targeting Western organizations. Linked to the Fox Kitten APT group and collaborating with Mimic ransomware, the campaign has collected over $4 million in ransom payments in four months. The group offers an…

Published: July 10, 2025

Downloadable IOCs: 25

Fake Spam Plugin Uses Victim's Domain Name to Evade Detection

A sophisticated SEO spam infection was discovered utilizing a cleverly crafted plugin that mimics the infected domain's name to avoid detection. The malware injects spam content into websites, targeting search engine rankings, and only activates under specific conditions like when a crawler is dete…

obfuscation

wordpress

evasion techniques

search engine manipulation

Published: July 6, 2025

Downloadable IOCs: 1

Eggs in a Cloudy Basket: Skeleton Spider's Trusted Cloud Malware Delivery

Skeleton Spider, also known as FIN6, is a financially motivated cybercrime group that has evolved from POS breaches to broader enterprise threats. They employ social engineering tactics, posing as job seekers on platforms like LinkedIn to deliver phishing messages. Their preferred payload is more_e…

Published: June 11, 2025

Downloadable IOCs: 24

Katz Stealer Threat Analysis

Katz Stealer is a sophisticated credential-stealing malware-as-a-service that targets multiple browsers, cryptocurrency wallets, and communication platforms. It employs advanced evasion techniques like geofencing, VM detection, and process hollowing. The infection chain involves obfuscated JavaScri…

Published: May 26, 2025

Downloadable IOCs: 34

Fileless Execution: PowerShell Based Shellcode Loader Executes Remcos RAT

A new PowerShell-based shellcode loader has been discovered, designed to execute a variant of Remcos RAT. The attack chain begins with malicious LNK files in ZIP archives, using mshta.exe for initial execution. The loader employs fileless techniques, executing code directly in memory to evade tradi…

Published: May 15, 2025

Downloadable IOCs: 5

New Stealer on the Horizon

SvcStealer 2025 is a novel information stealer delivered through spear phishing email attachments. It harvests sensitive data including machine information, installed software, user credentials, cryptocurrency wallets, and browser data. The malware creates a unique folder, terminates specific proce…

Published: April 23, 2025

Downloadable IOCs: 4

Detecting Multi-Stage Infection Chains Madness

This analysis examines a complex multi-stage attack exploiting a resilient network infrastructure known as 'Cloudflare tunnel infrastructure to deliver multiple RATs' since February 2024. The infection chain involves multiple steps, including phishing emails with malicious attachments, execution of…

cyber threat intelligence

detection rules

Published: April 22, 2025

Downloadable IOCs: 15

BRICKSTORM Backdoor Analysis: A Persistent Espionage Threat to European Industries

This analysis examines BRICKSTORM, an espionage backdoor linked to China-nexus cluster UNC5221. It details newly identified Windows variants, expanding on previous Linux presence. The backdoor, used in long-term espionage campaigns, targets European industries of strategic interest to China. BRICKS…

Published: April 16, 2025

Downloadable IOCs: 4

ViperSoftX Malware Distributed by Arabic-Speaking Threat Actor

An Arabic-speaking threat actor has been distributing ViperSoftX malware to Korean victims since April 1, 2025. The malware, typically spread through cracked software or torrents, operates as a PowerShell script and communicates with C&C servers. The campaign involves downloading additional malware…

Published: April 10, 2025

Downloadable IOCs: 0

Silent Credit Card Thief Uncovered

A sophisticated credit card skimming campaign dubbed 'RolandSkimmer' has been discovered, targeting users in Bulgaria. The attack utilizes malicious browser extensions across Chrome, Edge, and Firefox, initiated through a deceptive LNK file. The malware employs obfuscated scripts to establish persi…

Published: April 4, 2025

Downloadable IOCs: 0

Delivering Trojans Via ClickFix Captcha

A new social engineering technique exploiting ClickFix Captcha has emerged as an effective method for delivering various types of malware, including Quakbot. This technique deceives users and bypasses security measures by utilizing a seemingly harmless captcha. The process involves redirecting user…

Published: April 1, 2025

Downloadable IOCs: 0

VanHelsing: New RaaS in Town

VanHelsing RaaS, a new ransomware-as-a-service program launched on March 7, 2025, has quickly gained traction in the cybercrime world. With a low $5,000 deposit for affiliates, it offers an 80% cut of ransom payments. The service provides a user-friendly control panel and targets multiple platforms…

encryption

cybercrime

ransomware-as-a-service

Published: March 23, 2025

Downloadable IOCs: 0

SVC New Stealer on the Horizon

SvcStealer 2025 is a newly discovered information stealer malware distributed through spear phishing emails. It targets sensitive data including machine information, installed software, user credentials, cryptocurrency wallets, and browser data. The malware creates a unique folder, terminates speci…

Published: March 21, 2025

Downloadable IOCs: 0

Python Bot Delivered Through DLL Side-Loading

A sophisticated malware campaign employs DLL side-loading to deliver a Python bot. The attack begins with a ZIP archive containing a legitimate PDF reader executable and a hidden malicious DLL. When executed, the malicious DLL is loaded instead of the intended Microsoft one, altering the PDF reader…

Published: March 18, 2025

Downloadable IOCs: 0

Deep Dive Into Allegedly AI-Generated FunkSec Ransomware

A new Rust-based ransomware called FunkSec has emerged, claiming to use artificial intelligence in its development. First appearing in 2024, it demonstrates a mix of sophisticated capabilities and developmental inconsistencies. FunkSec implements advanced features like XChaCha20 encryption and comp…

Published: March 4, 2025

Downloadable IOCs: 1

Scalable Vector Graphics files pose a novel phishing threat

Cybercriminals are exploiting the SVG file format to conduct phishing attacks that bypass existing anti-spam and anti-phishing protection. These attacks involve email messages with .svg file attachments, which open in the default browser on Windows computers. The SVG files contain anchor tags and s…

browser-based attacks

troj/autoit-dhb

email attachments

Published: February 5, 2025

Downloadable IOCs: 0

AsyncRAT Reloaded: Using Python and TryCloudflare for Malware Delivery Again

A new AsyncRAT malware campaign has been identified, utilizing malicious payloads delivered through TryCloudflare quick tunnels and Python packages. The attack chain begins with a phishing email containing a Dropbox URL, leading to a ZIP file with an internet shortcut. This triggers a series of dow…

Published: February 1, 2025

Downloadable IOCs: 0

Stealthy Cyber Attacks: LNK Files & SSH Commands Playbook

This analysis explores a rising trend in cyber attacks where threat actors leverage LNK files and SSH commands as initial infection vectors. The attackers use meticulously crafted shortcut files, often disguised as legitimate documents, to execute commands using Living-off-the-Land Binaries (LOLBin…

living-off-the-land binaries

cyber attacks

ssh commands

Published: December 19, 2024

Linked vulnerabilities : CVE-2024-21887, CVE-2023-46805, CVE-2021-44228, CVE-2017-11882, CVE-2024-21893

Downloadable IOCs: 6

NodeLoader Exposed: The Node.js Malware Evading Detection

Zscaler ThreatLabz discovered a malware campaign using Node.js applications for Windows to distribute cryptocurrency miners and information stealers. Named NodeLoader, this malware family employs Node.js compiled executables to deliver second-stage payloads like XMRig, Lumma, and Phemedrone Stealer…

cryptocurrency miners

nodeloader

Published: December 13, 2024

Downloadable IOCs: 0

BabbleLoader

BabbleLoader is a highly evasive malware loader designed to bypass antivirus and sandbox environments to deliver stealers into memory. It employs sophisticated techniques such as junk code insertion, metamorphic transformations, dynamic API resolution, and anti-sandboxing measures. The loader's fea…

dynamic api resolution

Published: November 19, 2024

Downloadable IOCs: 43

Grandoreiro banking trojan: overview of recent versions and new tricks

Grandoreiro is a Brazilian banking trojan that has evolved into a global financial threat, targeting over 1,700 banks and 276 crypto wallets in 45 countries. Despite law enforcement efforts, the malware remains active, with new versions featuring enhanced evasion techniques like multiple Domain Gen…

Published: October 22, 2024

Downloadable IOCs: 0

Silent Threat: Red Team Tool EDRSilencer Disrupting Endpoint Security Solutions

EDRSilencer, a red team tool designed to interfere with endpoint detection and response (EDR) solutions, has been discovered being abused by threat actors. It leverages the Windows Filtering Platform to block EDR traffic, concealing malicious activity. The tool dynamically identifies running EDR pr…

evasion techniques

2024-10-15

edrsilencer

windows filtering platform

red team tool

endpoint security

Published: October 15, 2024

Downloadable IOCs: 0

Mamba 2FA: A new contender in the AiTM phishing ecosystem

Mamba 2FA is a newly discovered adversary-in-the-middle (AiTM) phishing kit being sold as phishing-as-a-service (PhaaS). It features capabilities similar to other popular AiTM phishing services, including handling two-step verifications for non-phishing-resistant MFA methods, supporting various aut…

multi-factor authentication

mamba 2fa

Published: October 7, 2024

Downloadable IOCs: 0

XWorm: Analysis of Latest Version and Execution Flow

XWorm, a versatile tool discovered in 2022, enables attackers to access sensitive information, gain remote access, and deploy additional malware. The latest version's infection chain begins with a Windows Script File downloading a PowerShell script from paste.ee. This script creates multiple files,…

telegram notification

Published: October 3, 2024

Downloadable IOCs: 8

A Measure of Motive: How Attackers Weaponize Digital Analytics Tools

Threat actors are repurposing digital analytics and advertising tools to evade detection and enhance their malicious campaigns. The report explores how link shorteners, IP geolocation utilities, CAPTCHA systems, and advertising intelligence platforms are being weaponized. It provides insights into …

Published: September 30, 2024

Downloadable IOCs: 10

Tag: evasion techniques

Attack reports

The HoneyMyte APT now protects malware with a kernel-mode rootkit

Technical Analysis of the BlackForce Phishing Kit

Albiriox Exposed: A New RAT Mobile Malware Targeting Global Finance and Crypto Wallets

EVALUSION Campaign Delivers Amatera Stealer and NetSupport...

Increase in Lumma Stealer Activity Coincides with Use of Adaptive Browser Fingerprinting Tactics

Eye of the Storm: Analyzing DarkCloud's Latest Capabilities

Olymp Loader: A new Malware-as-a-Service written in Assembly

Beyond Signatures: Detecting Lumma Stealer with an ML-Powered Sandbox

CountLoader: New Malware Loader Being Served in 3 Different Versions

Technical Analysis of SmokeLoader Version 2025

Malware Campaign Leverages SVGs, Email Attachments, and CDNs to Drop XWorm and Remcos via BAT Scripts

MostereRAT Deployed AnyDesk/TightVNC for Covert Full Access

Android Document Readers and Deception: Tracking the Latest Updates to Anatsa

Unmasking AsyncRAT: Navigating the labyrinth of forks

Powerful MaaS On the Prowl for Credentials and Crypto Assets

Pay2Key's Resurgence: Iranian Cyber Warfare Targets the West

Fake Spam Plugin Uses Victim's Domain Name to Evade Detection

Eggs in a Cloudy Basket: Skeleton Spider's Trusted Cloud Malware Delivery

Katz Stealer Threat Analysis

Fileless Execution: PowerShell Based Shellcode Loader Executes Remcos RAT

New Stealer on the Horizon

Detecting Multi-Stage Infection Chains Madness

BRICKSTORM Backdoor Analysis: A Persistent Espionage Threat to European Industries

ViperSoftX Malware Distributed by Arabic-Speaking Threat Actor

Silent Credit Card Thief Uncovered

Delivering Trojans Via ClickFix Captcha

VanHelsing: New RaaS in Town

SVC New Stealer on the Horizon

Python Bot Delivered Through DLL Side-Loading

Deep Dive Into Allegedly AI-Generated FunkSec Ransomware

Scalable Vector Graphics files pose a novel phishing threat

AsyncRAT Reloaded: Using Python and TryCloudflare for Malware Delivery Again

Stealthy Cyber Attacks: LNK Files & SSH Commands Playbook

NodeLoader Exposed: The Node.js Malware Evading Detection

BabbleLoader

Grandoreiro banking trojan: overview of recent versions and new tricks

Silent Threat: Red Team Tool EDRSilencer Disrupting Endpoint Security Solutions

Mamba 2FA: A new contender in the AiTM phishing ecosystem

XWorm: Analysis of Latest Version and Execution Flow

A Measure of Motive: How Attackers Weaponize Digital Analytics Tools