#windows

Latest campaign underscores wide-ranging functionality and staying power of a decade-old piece of information-stealing malware.

Threat actors are luring victims to a fake NordVPN website that installs a Remote Access Trojan.

WordPress Membership for WooCommerce plugin versions prior to 2.1.7 suffer from a remote shell upload vulnerability.

Cisco Talos discovered a new threat actor we’re calling “CoralRaider” that we believe is of Vietnamese origin and financially motivated. CoralRaider has been operating since at least 2023, targeting victims in several Asian and Southeast Asian countries.

Roughly nine years ago, KrebsOnSecurity profiled a Pakistan-based cybercrime group called "The Manipulaters," a sprawling web hosting network of phishing and spam delivery platforms. In January 2024, The Manipulaters pleaded with this author to unpublish previous stories about their work, claiming the group had turned over a new leaf and gone legitimate. But new research suggests that while they have improved the quality of their products and services, these nitwits still fail spectacularly at hiding their illegal activities.

DLL Proxy Loading is a technique which an arbitrary DLL exports the same functions as the legitimate DLL and forwards the calls to the legitimate… Continue reading → Persistence – DLL Proxy Loading

UNAPIMON works by meticulously disabling hooks in Windows APIs for detecting malicious processes.

Campaign distributes malware disguised as legitimate installers for popular workplace collaboration apps by abusing a traffic-tracking feature.

Computer Laboratory Management System version 1.0 suffers from a persistent cross site scripting vulnerability.

Computer Laboratory Management System version 1.0 suffers from an insecure direct object reference vulnerability.