A recent in-depth analysis from Cyfirma has shed light on the alarming capabilities of Raven Stealer, a lightweight yet powerful information-stealing malware rapidly gaining traction across the cy…

Cyfirma reveals Raven Stealer, a new, lightweight MaaS infostealer built in Delphi/C++, using reflective process hollowing and Telegram bots for stealthy data exfiltration from browsers.

> By: grisun0, White Hat Blogger & Professional Overthinker of Suspiciously Suspended Processes

Researchers from Fortinet’s FortiGuard Labs detected a new DarkCloud campaign deploying a stealthy, fileless payload through a sophisticated phishing and PowerShell-based attack chain. DarkCloud —…

Hello back! I hope you’re doing just fine. Today’s topic is going to be a fun evasion technique (after all, that is in great part what…

MissionEvasion is a powerful new tool for Windows that uses advanced process hollowing and overwriting techniques to bypass defenses and inject code.

Unit 42 exposed PhantomVAI Loader, a stealthy MaaS tool that uses steganography (hiding DLL in images) and VM detection to deploy Katz Stealer in MSBuild.exe and exfiltrate crypto credentials globally.

A sophisticated Lumma Infostealer MaaS campaign targets users with pirated software installers. It uses NSIS/AutoIt scripts, Process Hollowing, and MEGA cloud to steal credentials from browsers and crypto wallets.

As tax season approaches, a sophisticated cyber-espionage campaign is targeting Indian organizations with highly convincing phishing lures. While initially mistaken for a familiar adversary, a new…

A sophisticated new phishing campaign has been detected in the wild, leveraging a fileless variant of the notorious Remcos RAT (Remote Access Trojan) to evade detection and seize control of victim…

Attackers use fake DHL invoices to sideload Phantom Stealer v3.5.0 via a signed Java utility. Malware hides in AddInProcess32.exe. Watch out.

New "PhantomVAI" malware recycles old Hackforums "RunPE" code to bypass modern EDR. Campaigns use task scheduler masquerading to deliver infostealers.

Analysts at Intrinsec have documented a surge in offensives leveraging the PhantomVAI loader, a utility architected upon the

Phishing emails use malicious Excel files to deploy XWorm RAT. The fileless attack exploits CVE-2018-0802 to steal data & control systems.