SecuriTricks - javascript

Cooking up trouble: How TamperedChef uses signed apps to deliver stealthy payloads

The TamperedChef campaign is a global malvertising and SEO operation that distributes seemingly legitimate software with valid code signing to trick users into executing malicious installers. These fake applications mimic common software and establish persistence through scheduled tasks, delivering…

social engineering

malvertising

code-signing certificates

signed applications

Published: November 26, 2025

Downloadable IOCs: 0

ClearFake’s New Widespread Variant: Increased Web3 Exploitation for Malware Delivery

ClearFake is a malicious JavaScript framework deployed on compromised websites to deliver malware through drive-by downloads. Threat Actors compromise legitimate websites, injecting malicious JavaScript code that redirects users to convincing fake update pages for browsers like Chrome and Edge. Th…

Published: March 18, 2025

Downloadable IOCs: 30

Credit Card Skimmer and Backdoor on WordPress E-commerce Site

A sophisticated malware attack targeting WordPress WooCommerce sites was discovered, involving multiple components: a credit card skimmer, a hidden backdoor file manager, and a reconnaissance script. The attack focused on financial gain and long-term control. The skimmer, injected into the checkout…

Published: March 15, 2025

Downloadable IOCs: 0

SocGholish's Intrusion Techniques Facilitate Distribution of RansomHub Ransomware

SocGholish, a malware-as-a-service framework, is being used to deploy RansomHub ransomware. It compromises legitimate websites, redirecting visitors to fake browser updates that deliver malicious payloads. The highly obfuscated JavaScript loader evades detection and executes various tasks, includin…

Published: March 14, 2025

Downloadable IOCs: 0

SideWinder targets the maritime and nuclear sectors with an updated toolset

The SideWinder APT group intensified its activities in the second half of 2024, targeting maritime infrastructures, logistics companies, and nuclear sectors across Asia, the Middle East, and Africa. The group updated its toolset, including improvements to its RTF exploit, JavaScript loader, and Bac…

Published: March 10, 2025

Linked vulnerabilities : CVE-2017-11882

Downloadable IOCs: 38

GetSmoked: UAC-0006 Returns With SmokeLoader Targeting Ukraine's Largest State-Owned Bank

UAC-0006, a financially motivated cyber threat group, has resurfaced with a sophisticated phishing campaign targeting customers of Ukraine’s largest state-owned bank, PrivatBank.

Published: February 10, 2025

Downloadable IOCs: 62

Proxyware Being Distributed Through Ad Pages

Security researchers have confirmed the unauthorized installation of proxyware on systems through advertisement pages from freeware software sites. The proxyware, identified as DigitalPulse, allows threat actors to share a portion of the system's Internet bandwidth for financial gain without user c…

Published: January 21, 2025

Downloadable IOCs: 3

A Look Back: The Evolution of Latin American eCrime Malware in 2024

Latin American cybercrime continues to evolve as adversaries refine their tactics and techniques. Key developments in 2024 include the adoption of Rust for improved evasion, consistent use of multi-stage infection chains and malspam campaigns, and evidence of collaboration among threat actors. Nota…

Published: December 18, 2024

Downloadable IOCs: 32

Analyzing FLUX#CONSOLE: Using Tax-Themed Lures, Threat Actors Exploit Windows Management Console to Deliver Backdoor Payloads

The FLUX#CONSOLE campaign involves a sophisticated tax-themed phishing attack that exploits Microsoft Management Console (MSC) files to deliver a stealthy backdoor payload. Threat actors use tax-related lures to trick users into executing malicious code. The attack leverages MSC files, which are no…

Published: December 18, 2024

Downloadable IOCs: 5

Bengal cat lovers in Australia get psspsspss’d in Google-driven Gootloader campaign

A new Gootloader variant has been discovered using search engine optimization (SEO) poisoning to target Australian Bengal cat enthusiasts. The campaign uses Google search results for 'Are Bengal Cats legal in Australia?' to deliver malicious payloads. When users click on compromised links, a zip fi…

Published: November 6, 2024

Downloadable IOCs: 14

Inside the Latrodectus Malware Campaign

The Latrodectus malware campaign employs a combination of traditional phishing techniques and innovative payload delivery methods to target financial, automotive, and healthcare sectors. The attack chain begins with compromised emails containing malicious PDF or HTML attachments, which redirect use…

Published: October 21, 2024

Downloadable IOCs: 20

North Korea Still Attacking Developers via npm

Recent weeks have seen a resurgence of North Korean-aligned groups targeting developers through npm packages. The campaign, which began on August 12, 2024, involves multiple groups using various publication patterns and attack types. The malicious packages contain obfuscated JavaScript that downloa…

Published: September 30, 2024

Downloadable IOCs: 12

AppDomainManager Injection Technique Used to Execute Malware on Windows

Cybersecurity specialists have observed an escalation in attacks employing the AppDomainManager Injection technique, which exploits the .NET Framework's version redirection feature to manipulate legitimate EXE files and load malicious DLLs. These attacks commonly begin with a ZIP file containing a …

Published: August 26, 2024

Downloadable IOCs: 9

Decoding the Stealthy Memory-Only Malware

This intelligence report provides an in-depth analysis of a complex, multi-stage malware campaign called PEAKLIGHT. It details the infection chain, starting with movie lure ZIP files containing malicious LNK files that initiate a JavaScript dropper. This dropper then executes a PowerShell downloade…

Published: August 23, 2024

Downloadable IOCs: 23

Rivers of Phish: Sophisticated Phishing Targets Russia's Perceived Enemies Around the Globe

An extensive investigation uncovered an elaborate phishing campaign conducted by a Russia-based threat actor known as COLDRIVER, attributed to Russia's Federal Security Service. The campaign employed personalized social engineering tactics to target civil society groups, NGOs, journalists, and gove…

Published: August 14, 2024

Downloadable IOCs: 28

SideWinder Utilizes New Infrastructure to Target Ports and Maritime Facilities in the Mediterranean Sea

BlackBerry's researchers have uncovered a new campaign by the nation-state threat actor SideWinder. The group employs sophisticated techniques, such as utilizing carefully crafted phishing emails with visual lures designed to target specific organizations. The campaign aims to compromise ports and …

Published: July 30, 2024

Linked vulnerabilities : CVE-2017-11882, CVE-2017-0199

Downloadable IOCs: 47

Dissecting GootLoader With Node.js

This article demonstrates how to circumvent anti-analysis techniques employed by GootLoader malware while utilizing Node.js debugging in Visual Studio Code. GootLoader JavaScript files employ an evasion technique that can pose a formidable challenge for sandboxes attempting to analyze the malware. …

Published: July 4, 2024

Downloadable IOCs: 2

StrelaStealer Resurgence: Tracking a JavaScript-Driven Credential Stealer Targeting Europe

Recent observations indicate a surge in JavaScript spreading StrelaStealer, a credential stealer specifically targeting Outlook and Thunderbird email credentials. While the infection chain resembles previous versions, additional checks have been implemented to avoid compromising systems in Russia. …

Published: June 25, 2024

Downloadable IOCs: 5

Wineloader - Analysis of the Infection Chain

The analysis examines the Wineloader backdoor, a modular malware attributed to the APT29 threat group, which allows further tools or modules to be downloaded through an encrypted command and control channel. It starts with a phishing email luring targets with a wine tasting event invitation. Execut…

Published: June 6, 2024

Downloadable IOCs: 9

Gootloader walkthrough

The analysis delves into the intricate workings of the Gootloader malware campaign. Through a meticulously crafted social engineering scheme involving SEO poisoning and fake forums, threat actors lure unsuspecting victims into downloading a malicious JavaScript file disguised as a legitimate resour…

Published: May 24, 2024

Downloadable IOCs: 12

Surge of JavaScript Malware in sites with vulnerable versions of LiteSpeed Cache Plugin

A recent surge of malicious JavaScript code has been observed targeting websites using vulnerable versions of the LiteSpeed Cache plugin for WordPress. The malware injects code into critical WordPress files or the database, creating unauthorized admin users like 'wpsupp-user.' It exploits the vulne…

Published: May 9, 2024

Downloadable IOCs: 6

Distribution of Infostealer Made With Electron

AhnLab Security Intelligence Center (ASEC) has discovered an Infostealer malware strain developed using the Electron framework, which allows the creation of applications using JavaScript, HTML, and CSS. The malware is distributed through Nullsoft Scriptable Install System (NSIS) installer format. O…

Published: April 30, 2024

Downloadable IOCs: 1

Tag: javascript

Attack reports

Cooking up trouble: How TamperedChef uses signed apps to deliver stealthy payloads

The Tsundere botnet uses the Ethereum blockchain to infect its targets

Gootloader Returns: What Goodies Did They Bring?

XWorm V6: Exploring Pivotal Plugins

From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion

Artificial Intelligence Exposes the Homoglyph Hustle

"Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack

New malware campaign discovered via ManualFinder

Proxyware Malware Being Distributed on YouTube Video Download Site

Malicious JavaScript Injects Fullscreen Iframe On a WordPress Website

Unmasking the SVG Threat: How Hackers Use Vector Graphics for Phishing Attacks

SVG Smuggling - Image Embedded JavaScript Redirect Attacks

Pixel-Perfect Trap: The Surge of SVG-Borne Phishing Attacks

Iranian Cyber Actors Impersonate Model Agency in Suspected Espionage Operation

Venom Spider Uses Server-Side Polymorphism to Weave a Web Around Victims

Gootloader Returns: Malware Hidden in Google Ads for Legal Documents

Over 150K websites hit by full-page hijack linking to Chinese gambling sites

Malware found on npm infecting local package with reverse shell

ClearFake’s New Widespread Variant: Increased Web3 Exploitation for Malware Delivery

Credit Card Skimmer and Backdoor on WordPress E-commerce Site

SocGholish's Intrusion Techniques Facilitate Distribution of RansomHub Ransomware

SideWinder targets the maritime and nuclear sectors with an updated toolset

GetSmoked: UAC-0006 Returns With SmokeLoader Targeting Ukraine's Largest State-Owned Bank

Proxyware Being Distributed Through Ad Pages

A Look Back: The Evolution of Latin American eCrime Malware in 2024

Analyzing FLUX#CONSOLE: Using Tax-Themed Lures, Threat Actors Exploit Windows Management Console to Deliver Backdoor Payloads

Bengal cat lovers in Australia get psspsspss’d in Google-driven Gootloader campaign

Inside the Latrodectus Malware Campaign

North Korea Still Attacking Developers via npm

AppDomainManager Injection Technique Used to Execute Malware on Windows

Decoding the Stealthy Memory-Only Malware

Rivers of Phish: Sophisticated Phishing Targets Russia's Perceived Enemies Around the Globe

SideWinder Utilizes New Infrastructure to Target Ports and Maritime Facilities in the Mediterranean Sea

Dissecting GootLoader With Node.js

StrelaStealer Resurgence: Tracking a JavaScript-Driven Credential Stealer Targeting Europe

Wineloader - Analysis of the Infection Chain

Gootloader walkthrough

Surge of JavaScript Malware in sites with vulnerable versions of LiteSpeed Cache Plugin

Distribution of Infostealer Made With Electron