SecuriTricks

Actionable threat hunting with Threat Intelligence (I) - Hunting malicious desktop files

This analysis explores the detection of malicious .desktop files used by threat actors to infect Linux systems. It explains the structure of these files and how they are manipulated to obfuscate malicious content. The report details the execution process of these files, which often involve opening …

linux

obfuscation

google threat intelligence

gnome

Published: May 16, 2025

Downloadable IOCs: 3

Emerging Phishing Techniques: New Threats and Attack Vectors

This analysis delves into four sophisticated phishing techniques observed in 2025. These include embedding Base64-encoded JavaScript in SVG files, hiding malicious URLs in PDF annotations, using OneDrive links to deliver dynamic phishing content, and nesting MHT files within OpenXML documents. Thes…

Published: April 28, 2025

Downloadable IOCs: 0

Winos 4.0 Spreads via Impersonation of Official Email to Target Users in Taiwan

An advanced malware framework known as Winos4.0 was used to target companies in Taiwan in January 2025.

Published: March 5, 2025

Downloadable IOCs: 55

Hidden in Plain Sight: PDF Mishing Attack

A sophisticated phishing campaign targeting mobile devices has been discovered, impersonating the United States Postal Service (USPS). The campaign uses a novel obfuscation technique in PDF files to hide malicious links, making detection difficult for many security solutions. The attack exploits us…

Published: January 27, 2025

Downloadable IOCs: 654

Beware of phishing emails impersonating major domestic entertainment agencies

ASEC (AhnLab Security Intelligence Center) has recently confirmed that phishing emails impersonating large domestic entertainment agencies are being distributed domestically.

Published: October 16, 2024

Downloadable IOCs: 0

Rivers of Phish: Sophisticated Phishing Targets Russia's Perceived Enemies Around the Globe

An extensive investigation uncovered an elaborate phishing campaign conducted by a Russia-based threat actor known as COLDRIVER, attributed to Russia's Federal Security Service. The campaign employed personalized social engineering tactics to target civil society groups, NGOs, journalists, and gove…

Published: August 14, 2024

Downloadable IOCs: 28

Exploiting CVE-2024-21412: A Stealer Campaign Unleashed

This report details a malicious campaign exploiting the CVE-2024-21412 vulnerability in Microsoft Windows SmartScreen to bypass security warnings and deliver malware. Attackers employ crafted links, LNK files, and HTA scripts to download decoy PDFs and shell code injectors, ultimately injecting ste…

Published: July 24, 2024

Linked vulnerabilities : CVE-2024-21412

Downloadable IOCs: 27

PDF “Flawed Design” Exploitation

Check Point Research identified an unusual pattern involving PDF exploitation, mainly targeting users of Foxit Reader. This exploit triggers security warnings that could deceive users into executing harmful commands. The exploitation occurs through a flawed design in Foxit Reader, showing 'OK' as t…

Published: May 14, 2024

Downloadable IOCs: 40

Tag: pdf

Attack reports

Fake Dropbox Phishing Campaign via PDF and Cloud Storage

Email-Delivered RMM: Abusing PDFs for Silent Initial Access

Phishing Campaign Targets Indian Defense Using Credential-Stealing Malware

Cyber Attacks on Government Agencies: Detect and Investigate

Actionable threat hunting with Threat Intelligence (I) - Hunting malicious desktop files

Emerging Phishing Techniques: New Threats and Attack Vectors

Winos 4.0 Spreads via Impersonation of Official Email to Target Users in Taiwan

Hidden in Plain Sight: PDF Mishing Attack

Beware of phishing emails impersonating major domestic entertainment agencies

Rivers of Phish: Sophisticated Phishing Targets Russia's Perceived Enemies Around the Globe

Exploiting CVE-2024-21412: A Stealer Campaign Unleashed

PDF “Flawed Design” Exploitation