SecuriTricks - websocket

APT36 Malware Campaign Using Desktop Entry Files and Google Drive Payload Delivery

Pakistan-linked APT36 (Transparent Tribe) launched a new cyber-espionage campaign targeting Indian government and defense entities. Active in August 2025, the group used phishing ZIP files containing malicious Linux “.desktop” shortcuts that downloaded payloads from Google Drive.

persistence

stealth

Published: August 21, 2025

Downloadable IOCs: 6

RedHook: A New Android Banking Trojan Targeting Users In Vietnam

A sophisticated Android banking trojan named RedHook has been discovered targeting Vietnamese users through spoofed government and financial websites. The malware uses WebSocket to communicate with its command-and-control server and supports over 30 remote commands, enabling complete control over c…

Published: July 31, 2025

Downloadable IOCs: 13

macOS NimDoor | North Korean Threat Actors Target Web3 and Crypto Platforms with Nim-Based Malware

DPRK threat actors are targeting Web3 and crypto-related businesses using Nim-compiled binaries and multiple attack chains. The malware, dubbed NimDoor, employs unusual techniques for macOS, including process injection and encrypted WebSocket communications. It uses a novel persistence mechanism le…

Published: July 4, 2025

Downloadable IOCs: 9

Analysis of a Malicious WordPress Plugin: The Covert Redirector

A malicious WordPress plugin named 'wordpress-player.php' has been discovered, affecting at least 26 websites. The plugin injects a hidden HTML5 video player and establishes a WebSocket connection to a command and control server. It redirects visitors to suspicious websites after 4-5 seconds, avoid…

Published: June 19, 2025

Downloadable IOCs: 1

TsarBot Trojan Hits 750+ Banking & Crypto Apps!

A newly discovered Android banking Trojan, TsarBot, targets over 750 applications globally, including banking, finance, cryptocurrency, and e-commerce apps. It spreads through phishing sites masquerading as legitimate financial platforms and is installed via a dropper disguised as Google Play Servi…

Published: April 1, 2025

Downloadable IOCs: 0

Tag: websocket

Attack reports

New backdoor targeting Ukrainian entities with possible links to Laundry Bear

NFCShare Android Trojan: NFC card data theft via malicious APK

The Tsundere botnet uses the Ethereum blockchain to infect its targets

APT Meets GPT: Targeted Operations with Untamed LLMs

APT36 Malware Campaign Using Desktop Entry Files and Google Drive Payload Delivery

RedHook: A New Android Banking Trojan Targeting Users In Vietnam

macOS NimDoor | North Korean Threat Actors Target Web3 and Crypto Platforms with Nim-Based Malware

Analysis of a Malicious WordPress Plugin: The Covert Redirector

TsarBot Trojan Hits 750+ Banking & Crypto Apps!