Tag: telegram exfiltration

6 Attack Reports | 0 Vulnerabilities

Attack reports

Uncovering a Global Android Carrier Billing Fraud Campaign

A sophisticated Android malware campaign has been identified conducting carrier billing fraud through premium SMS abuse across Malaysia, Thailand, Romania, and Croatia. The operation comprises nearly 250 malicious applications that selectively target users based on their mobile operators, silently …
android
otp interception
southeast asia
telegram exfiltration
2026-05-20
carrier billing fraud
premium sms
sms retriever api
webview manipulation
Published: May 20, 2026
Downloadable IOCs: 0

Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files

This analysis examines new obfuscation techniques employed by Gremlin stealer malware to conceal malicious payloads within embedded resources. A variant protected by sophisticated commercial packing utility uses instruction virtualization, transforming code into custom bytecode executed by a privat…
infostealer
quasar rat
credential harvesting
guloader
agent tesla
obfuscation techniques
gremlin stealer
session hijacking
telegram exfiltration
2026-05-15
cryptocurrency clipper
discord token theft
lokibot
Published: May 15, 2026
Downloadable IOCs: 12

Mysterious hacker organization operating secretly for 6 years is exploiting critical cPanel vulnerability to deploy backdoor trojans

A previously unknown threat group designated Mr_Rot13 has been exploiting CVE-2026-41940, a critical authentication bypass vulnerability in cPanel & WHM, to compromise Linux servers globally. Active since at least 2020, the group deploys a Go-based payload installer that plants SSH keys, PHP webshe…
credential theft
ssh backdoor
southeast asia
telegram exfiltration
CVE-2026-41940
2026-05-11
cpanel exploitation
cpanel-python
filemanager
filemanager rat
wordpress targeting
Published: May 11, 2026
Linked vulnerabilities : CVE-2026-41940 (CVSS 9.3)
Downloadable IOCs: 1

Mach-O Man Malware: What CISOs Need to Know

Lazarus Group is conducting an active campaign targeting businesses through ClickFix attacks, distributing a newly identified macOS malware kit called "Mach-O Man". The attack begins with fake meeting invitations via Telegram, redirecting victims to fraudulent collaboration platforms impersonating …
social engineering
macos
credential theft
clickfix
telegram exfiltration
2026-04-22
browser stealing
fintech targeting
mach-o binaries
mach-o man
pylangghostrat
Published: April 22, 2026
Downloadable IOCs: 15

Fake Dropbox Phishing Campaign via PDF and Cloud Storage

A sophisticated phishing campaign has been detected that utilizes a multi-stage approach to evade detection. The attack begins with a procurement-themed email containing a PDF attachment. This PDF redirects victims to another PDF hosted on trusted cloud storage, which then leads to a fake Dropbox l…
phishing
credential theft
pdf
multi-stage attack
telegram exfiltration
cloud storage
2026-02-02
dropbox impersonation
Published: February 2, 2026
Downloadable IOCs: 2

OCTALYN STEALER UNMASKED

The Octalyn Forensic Toolkit, a publicly available GitHub project, presents itself as a research tool but functions as a sophisticated credential stealer. It consists of a C++ payload module and a Delphi-based builder interface, allowing even low-skilled actors to generate functional binaries. The …
credential stealer
2025-07-16
octalyn
octalyn stealer
telegram exfiltration
Published: July 16, 2025
Downloadable IOCs: 7
Click here to see more Attack Reports