SecuriTricks - socks5 proxy

New TrickMo Variant: Device Take Over malware targeting Banking, Fintech, Wallet & Auth apps

A new variant of the TrickMo Android banking trojan was identified between January and February 2026, representing a substantial platform redesign rather than new capabilities. The malware has migrated its command-and-control infrastructure entirely onto The Open Network (TON) using .adnl endpoints…

android

banking trojan

Published: May 11, 2026

Downloadable IOCs: 6

MIMICRAT: ClickFix Campaign Delivers Custom RAT via Compromised Legitimate Websites

A sophisticated ClickFix campaign has been uncovered, compromising legitimate websites to deliver a multi-stage malware chain. The attack culminates in MIMICRAT, a custom remote access trojan with advanced capabilities. The campaign uses compromised sites across industries and geographies for deliv…

Published: February 20, 2026

Downloadable IOCs: 8

When Hackers Call: Social Engineering, Abusing Brave Support, and EncryptHub's Expanding Arsenal

EncryptHub, an emerging threat group, has launched a campaign combining social engineering with exploitation of CVE-2025-26633 to deliver malicious payloads. The attackers impersonate IT support staff, use remote desktop sessions, and execute PowerShell commands to deploy malware. The campaign abus…

Published: August 14, 2025

Linked vulnerabilities : CVE-2025-26633 (CVSS 7.0)

Downloadable IOCs: 16

Yet Another NodeJS Backdoor (YaNB): A Modern Challenge

A resurgence in malicious campaigns exploiting deceptive CAPTCHA verifications has been observed, tricking users into executing NodeJS-based backdoors and deploying sophisticated Remote Access Trojans. The attack begins with a malicious NodeJS script connecting to attacker-controlled infrastructure…

system reconnaissance

Published: May 16, 2025

Downloadable IOCs: 11

Tag: socks5 proxy

Attack reports

New TrickMo Variant: Device Take Over malware targeting Banking, Fintech, Wallet & Auth apps

MIMICRAT: ClickFix Campaign Delivers Custom RAT via Compromised Legitimate Websites

When Hackers Call: Social Engineering, Abusing Brave Support, and EncryptHub's Expanding Arsenal

Yet Another NodeJS Backdoor (YaNB): A Modern Challenge