Tag: mshta

2 Attack Reports | 0 Vulnerabilities

Attack reports

APT36-Style ClickFix Attack Spoofs Indian Ministry to Target Windows & Linux

A recent campaign attributed to APT36 has been observed spoofing India's Ministry of Defence to deliver cross-platform malware. The attackers used a ClickFix-style infection chain, mimicking government press releases and leveraging a compromised .in domain for payload staging. The campaign targeted…
obfuscation
social engineering
cross-platform
spoofing
clickfix
mshta
2025-05-06
ministry of defence
clipboard-based execution
Published: May 6, 2025
Downloadable IOCs: 7

Analysis: SmokeLoader malware distribution

A malicious campaign targeting First Ukrainian International Bank has been observed using the Emmenhtal loader to distribute SmokeLoader malware. The infection chain begins with a deceptive email containing a 7z archive, which extracts to reveal a bait PDF and a shortcut file. The shortcut download…
obfuscation
powershell
cryptbot
infostealers
banking
smokeloader
lumma
emmenhtal
lolbas
2025-03-31
mshta
Published: March 31, 2025
Downloadable IOCs: 0
Click here to see more Attack Reports