Tag

DLL sideloading

3 stories

Signed AI app campaign delivers Yoba malware and evades detection

Fake ChatGPT and Claude downloads are being used to distribute Yoba malware through legitimate, digitally signed applications paired with malicious libraries. The campaign uses trusted software and GitHub hosting to make the installers look credible, and it ends with a cryptocurrency miner running on compromised Windows computers. Signed installers mask Yoba’s delivery chain The attack does not require compromising OpenAI or Anthropic. Instead, criminals place malicious files beside authentic executables…

Saugata DattaNov 3, 20263 min read76

Data Breach

Mustang Panda Turns Its Gaze on Indian Banks: Espionage Dressed as Help Desk Support

China’s Mustang Panda APT — also tracked as TA416, Bronze President, or Stately Taurus — is best known for adaptable tradecraft and a steady focus on geopolitical intelligence collection. In its most recent campaign, researchers tied to Acronis observed the group shifting some of that attention toward India’s financial sector. The attacks are notable less for technical sophistication than for persistence: relatively unsophisticated lures and a tried-and-true DLL sideloading technique…

Saugata DattaApr 21, 20264 min read483

Microsoft

How Attackers Abuse Microsoft Teams and Quick Assist: Inside the Helpdesk Impersonation Playbook

A new wave of attacks is quietly abusing everyday collaboration tools to bypass user suspicion and gain hands-on control of corporate endpoints. Threat actors are impersonating internal IT helpdesk staff inside Microsoft Teams, convincing employees to grant remote access via Quick Assist, and then using that live access to deploy stealthy persistence mechanisms and move laterally through enterprise networks. Because the attack uses trusted, signed applications and normal business channels,…

Saugata DattaApr 20, 20265 min read557

Signed AI app campaign delivers Yoba malware and evades detection

Mustang Panda Turns Its Gaze on Indian Banks: Espionage Dressed as Help Desk Support

How Attackers Abuse Microsoft Teams and Quick Assist: Inside the Helpdesk Impersonation Playbook

Free Tools: IP, DNS, SSL