Search This Blog
Powered by Blogger.

Blog Archive

Labels

About Me

Load More
Trendy Right Now

Popular Posts

Showing posts with label Trojan. Show all posts
Trojan
cryptocurrency Cyberattack Hacking malware printing Ransomware remoteaccess Security Software Trojan

Malware Discovered in Procolored Printer Software, Users Advised to Update Immediately

 

For at least six months, the official software bundled with Procolored printers reportedly included malicious code, including a remote access trojan (RAT) and a cryptocurrency-stealing malware.

Procolored, a Shenzhen-based manufacturer known for its affordable Direct-to-Film (DTF), UV DTF, UV, and Direct-to-Garment (DTG) printers, has built a strong reputation in the digital printing market. Since its founding in 2018, the company has expanded to over 31 countries and developed a considerable footprint in the United States.

The issue was first identified by Cameron Coward, a tech YouTuber behind the channel Serial Hobbyism. He was installing the driver and companion software for a $7,000 Procolored UV printer when his security tool flagged a threat: the Floxif USB worm.

After further investigation, cybersecurity firm G Data confirmed that malware was being distributed through Procolored’s official software packages—potentially impacting customers for over half a year.

Initially dismissed by Procolored as a “false positive,” Coward found that every time he attempted to download or unzip the printer software, his system immediately quarantined the files.

“If I try to download the files from their website or unzip the files on the USB drive they gave me, my computer immediately quarantines them,” said the YouTuber.

Coward turned to Reddit for support in analyzing the malware before publishing a critical review. G Data researcher Karsten Hahn responded and discovered that six printer models—F8, F13, F13 Pro, V6, V11 Pro, and VF13 Pro—came with software downloads hosted on Mega that were infected with malware.

Mega.nz is the file-sharing platform Procolored uses to distribute printer software via its official website.

Hahn found 39 infected files, including:

  • XRedRAT: A RAT with capabilities such as keylogging, taking screenshots, accessing the remote shell, and file manipulation. Its hardcoded command-and-control (C2) URLs were consistent with previously analyzed samples.
  • SnipVex: A newly identified clipper malware that infects .EXE files and hijacks Bitcoin addresses copied to the clipboard. This malware is believed to have compromised the developer’s machine or software build environment.

According to G Data, the SnipVex malware was used to steal around 9.308 BTC (worth nearly $1 million at current exchange rates).

Company Response and Security Measures

Though Procolored initially denied any wrongdoing, the compromised software was removed from its website on May 8, and the company launched an internal probe.

In communication with G Data, Procolored explained that the infected files had been uploaded via a USB drive possibly infected with the Floxif worm.

“As a precaution, all software has been temporarily removed from the Procolored official website,” explained Procolored to G Data.

“We are conducting a comprehensive malware scan of every file. Only after passing stringent virus and security checks will the software be re-uploaded.”

G Data later confirmed that the newly uploaded software packages are clean and safe to install.

Customers who previously downloaded Procolored software are urged to update to the new versions and perform a system scan to remove remnants of XRedRAT and SnipVex. Given the nature of SnipVex's binary tampering, experts recommend a thorough system cleaning.

In a comment to BleepingComputer, Procolored emphasized that all of its software has now been verified and is secure:

“Procolored confirms that its software is completely safe, clean, and has no connection whatsoever to any cryptocurrency-related incidents. All software packages have been thoroughly scanned and verified by third-party tools including VirusTotal and G Data, with no threats detected. Users can purchase and use Procolored products with complete confidence, as there is no risk of Bitcoin or other cryptocurrency theft linked to their software.”

“To further reassure customers, Procolored has provided third-party certifications and conducted strict technical checks to prove its software is secure.”

“In particular, the hash values of the key ‘PrintExp.exe’ file were verified and confirmed to match the official values published on Procolored’s website, proving the file is authentic, untampered, and free of any viruses or malware.”

“The company remains fully committed to customer care — no matter the issue, whether software or hardware, Procolored promises to resolve it to customer satisfaction, supported by their dedicated after-sales team and U.S.-based service resources.”


Read more »
Trojan
AItools CapCut Cybersecurity Darkweb Infostealer malware Noodlophile phishing Ransomware RAT Spyware Telegrambot Trojan

New AI Video Tool Scam Delivers Noodlophile Malware to Steal Your Data

 

Cybercriminals are using fake AI-powered video generation tools to spread a newly discovered malware strain called ‘Noodlophile’, disguised as downloadable media content.

Fraudulent websites with names like "Dream Machine" are being promoted in high-visibility Facebook groups, pretending to be advanced AI tools that can generate videos from user-uploaded files. However, these platforms are actually fronts for distributing information-stealing malware.

While cybercriminals leveraging AI for malware distribution isn't new, Morphisec researchers have uncovered a fresh campaign that introduces this new infostealer. “Noodlophile” is currently being sold on dark web forums, frequently bundled with services like "Get Cookie + Pass," indicating it's part of a malware-as-a-service operation linked to Vietnamese-speaking threat actors.

Once a victim uploads their file to the fake site, they receive a ZIP archive that supposedly contains the generated video. Instead, the archive includes a misleading executable named "Video Dream MachineAI.mp4.exe" and a hidden folder housing essential files for subsequent malware stages. On systems with file extensions hidden, the file could appear to be a harmless video.

"The file Video Dream MachineAI.mp4.exe is a 32-bit C++ application signed using a certificate created via Winauth," explains Morphisec.

This executable is actually a modified version of CapCut, a legitimate video editing software (version 445.0), and the naming and certificate are used to deceive both users and antivirus software.

Once run, the file executes a sequence of commands that launch a batch script (Document.docx/install.bat). This script then uses the Windows tool 'certutil.exe' to decode and extract a base64-encoded, password-protected RAR file that mimics a PDF. It also adds a registry key to maintain persistence on the system.

The batch script then runs srchost.exe, which executes an obfuscated Python script (randomuser2025.txt) from a hardcoded remote server. This leads to the in-memory execution of the Noodlophile stealer.

If Avast antivirus is found on the system, the malware uses PE hollowing to inject its code into RegAsm.exe. If not, it resorts to shellcode injection.

"Noodlophile Stealer represents a new addition to the malware ecosystem. Previously undocumented in public malware trackers or reports, this stealer combines browser credential theft, wallet exfiltration, and optional remote access deployment," explains the Morphisec researchers.

The malware targets data like browser credentials, session cookies, tokens, and cryptocurrency wallets. Stolen information is sent through a Telegram bot, acting as a stealthy command and control (C2) channel. In some cases, Noodlophile is also packaged with XWorm, a remote access trojan (RAT), enabling more aggressive data theft.

How to Stay Safe:
  • Avoid downloading files from unverified websites.
  • Double-check file extensions—don’t trust names alone.
  • Always run downloads through a reliable, up-to-date antivirus tool before executing.


Read more »
Trojan
Aikido Attack Backdoor Cyber Security DevSecOps JavaScript NPM npmregistry obfuscatedcode Opensource randuseragent RAT Security Supplychain Trojan

Compromised npm Package 'rand-user-agent' Used to Spread Remote Access Trojan

 

A widely-used npm package, rand-user-agent, has fallen victim to a supply chain attack, where cybercriminals injected obfuscated code designed to install a Remote Access Trojan (RAT) on users’ systems.

Originally developed to generate randomized user-agent strings—helpful in web scraping, automation, and cybersecurity research—the package was deprecated but remained in use, logging approximately 45,000 downloads per week.

Security experts at Aikido uncovered the compromise on May 5, 2025, when their malware detection tools flagged version 1.0.110 of rand-user-agent. A deeper investigation revealed hidden malicious code in the dist/index.js file. This code was deliberately obscured and only viewable with horizontal scrolling on the npm website.

Researchers confirmed that the last legitimate release was version 2.0.82, uploaded seven months ago. The malicious code appeared in unauthorized versions 2.0.83, 2.0.84, and 1.0.110, none of which corresponded with updates on the project's GitHub repository—an indicator of foul play.

Once installed, the malicious versions create a hidden directory in the user’s home path (~/.node_modules) and modify the module loading path to prioritize this directory. They then load specific dependencies such as axios and socket.io-client, and establish a persistent connection to the attacker’s command and control (C2) server at http://85.239.62[.]36:3306.

Through this connection, the attacker retrieves critical system data—such as hostname, OS type, username, and a generated UUID. Once activated, the RAT listens for the following commands:
  • cd <path>: Change directory
  • ss_dir: Reset directory to script path
  • ss_fcd:<path>: Force change to a new directory
  • ss_upf:f,d: Upload single file
  • ss_upd:d,dest: Upload all files in a directory
  • ss_stop: Stop ongoing upload
  • Any other input is executed via child_process.exec()

Currently, the malicious versions have been removed from the npm repository. Developers are urged to revert to the latest clean version. However, users who installed versions 2.0.83, 2.0.84, or 1.0.110 are advised to run a full malware scan, as downgrading the package does not eliminate the RAT.

For continued use, it’s recommended to switch to a forked and actively maintained alternative of rand-user-agent.

The original developer responded to BleepingComputer with the following statement:

“On 5 May 2025 (16:00 UTC) we were alerted that three unauthorized versions of rand-user-agent had been published to the npm registry (1.0.110, 2.0.83, 2.0.84). The malicious code was never present in our GitHub repository; it was introduced only in the npm artifacts, making this a classic supply-chain attack.

Our investigation (still ongoing) shows that the adversary obtained an outdated automation token from an employee and used it to publish releases to npm. That token had not been scoped with 2-factor authentication, allowing the attacker to: Publish versions that did not exist in GitHub, Increment the version numbers to appear legitimate, Deprecate nothing, hoping the new releases would propagate before anyone noticed.

There is no evidence of a breach in our source-code repository, build pipeline, or corporate network. The incident was limited to the npm registry.

We apologize to every developer and organization impacted by this incident. Protecting the open-source ecosystem is a responsibility we take seriously, and we are committed to full transparency as we close every gap that allowed this attack to occur.”
Read more »
Trojan
Android Banking Trojan malware Malware Attack News Trojan

New Android Banking Trojan 'Crocodilus' Emerges as Sophisticated Threat in Spain and Turkey

 

A newly identified Android banking malware named Crocodilus is making waves in the cybersecurity world, with experts warning about its advanced capabilities and targeted attacks in Spain and Turkey. Discovered by Dutch mobile security firm ThreatFabric, the malware represents a major leap in sophistication, emerging not as a prototype but as a fully-developed threat capable of device takeover, remote control, and stealth data harvesting through accessibility services. 

Unlike many early-stage banking trojans, Crocodilus comes armed with a broad range of functionalities from its inception. Masquerading as Google Chrome via a misleading package name ("quizzical.washbowl.calamity"), the malware bypasses Android 13+ restrictions and initiates its attack by requesting accessibility permissions. Once granted, it connects to a command-and-control (C2) server to receive a list of targeted financial applications and corresponding HTML overlays to steal login credentials. 

The malware also targets cryptocurrency users with a unique social engineering strategy. Instead of spoofing wallet login pages, it pushes alarming messages urging users to back up their seed phrases within 12 hours or risk losing access. This manipulative tactic prompts victims to expose their seed phrases, which are then harvested via accessibility logging—giving attackers full access to the wallets. 

Crocodilus operates continuously in the background, monitoring app launches, capturing screen elements, and even intercepting one-time passwords from apps like Google Authenticator. It conceals its malicious activity by muting sounds and deploying a black screen overlay to keep users unaware. Key features include launching apps, removing itself from devices, sending SMS messages, retrieving contacts, requesting device admin rights, enabling keylogging, and modifying SMS management privileges. The malware’s ability to dynamically update C2 server settings further enhances its adaptability. 

ThreatFabric notes that the malware’s sophistication, especially in its initial version, suggests a seasoned developer behind its creation—likely Turkish-speaking, based on code analysis. The emergence of Crocodilus underscores the evolving threat landscape of mobile banking malware, where adversaries are deploying complex and evasive techniques earlier in development cycles. In a related development, Forcepoint reported a separate phishing campaign using tax-themed emails to spread the Grandoreiro banking trojan in Latin America and Spain, indicating a broader uptick in banking malware activity across platforms and regions.
Read more »
Trojan
Cybersecurity Exploit malware backdoor NPM Reverse Shell Trojan

Malicious npm Packages Plant Persistent Reverse Shell Backdoors

 

Security researchers have uncovered two malicious npm packages that stealthily modify legitimate, locally installed libraries to embed a persistent reverse shell backdoor—even after the original malicious code is deleted.

The stealthy threat was identified by cybersecurity experts at Reversing Labs, who emphasized the potential risk despite the packages not seeing widespread downloads.

"It's not unusual to encounter downloaders on npm; they are maybe not as common as infostealers, but they are far from uncommon," explains Reversing Labs.

"However, this downloader is worth discussing because of the exceptional strategies employed by the attackers to hide the malicious payload it delivered."

The malicious packages—'ethers-provider2' and 'ethers-providerz'—were found during Reversing Labs’ routine inspections of the open-source supply chain.

The 'ethers-provider2' package, still available on npm at the time of reporting, is built off the popular 'ssh2' npm package. However, its install.js script is altered to fetch a second-stage payload from a remote server. Once executed, this payload is deleted to avoid detection.

It then looks for the legitimate 'ethers' package, and if present, replaces its provider-jsonrpc.js file with a trojanized version. This new file contacts a remote server to download a third-stage payload, effectively establishing a reverse shell using a tampered SSH client that imitates the real SSH2 module.

The alarming part? Uninstalling the original malicious package does not remove the infected ethers package, leaving the backdoor in place.

Similarly, 'ethers-providerz' mirrors this behavior but targets the @ethersproject/providers package. Its goal, based on code analysis, is the same: to patch the library and create a reverse shell pointing to the malicious IP (5[.]199[.]166[.]1:31337).

Earlier versions of this package had path errors, making them ineffective, but the author has since removed it from npm, potentially to re-upload a corrected version later.

Researchers also flagged two additional packages, 'reproduction-hardhat' and '@theoretical123/providers', as likely part of the same coordinated attack.

To help developers detect such threats, Reversing Labs has released a YARA rule targeting the known malware associated with this campaign. They strongly advise developers to regularly scan their environments and inspect packages for suspicious activity.

As a general rule, it’s critical to verify package integrity and authorship when downloading from platforms like npm or PyPI, and to watch for red flags such as obfuscated code or connections to external servers.
Read more »
Trojan
Cyber Security Google AMP Phishing Attacks RATs Russia TikTok Trojan

Hackers Use Russian Domains for Phishing Attacks

Hackers Use Russian Domains for Phishing Attacks

The latest research has found a sharp rise in suspicious email activities and a change in attack tactics. If you are someone who communicates via email regularly, keep a lookout for malicious or unusual activities, it might be a scam. The blog covers the latest attack tactics threat actors are using.

Malicious email escapes SEGs

Daily, at least one suspicious email escapes Secure Email Getaways (SEGs), like Powerpoint and Microsoft, every 45 seconds, showing a significant rise from last year’s attack rate of one of every 57 seconds, according to the insights from Cofense Intelligence’s third-quarter report.

A sudden increase in the use of remote access Trojans (RATs) allows hackers to gain illegal access to the target’s system, which leads to further abuse, theft, and data exploitation.

Increase in Remote Access Trojan (RAT) use

Remcos RAT, a frequently used tool among hackers, is a key factor contributing to the surge in RAT attacks. It allows the attacker to remotely manipulate infected systems, exfiltrate data, deploy other malware, and obtain persistent access to vulnerable networks.

According to the data, the use of open redirects in phishing attempts has increased by 627%. These attacks use legitimate website functionality to redirect users to malicious URLs, frequently disguised as well-known and reputable domains.

Using TikTok and Google AMP

TikTok and Google AMP are frequently used to carry out these attacks, leveraging their worldwide reach and widespread use by unknowing users.

The use of malicious Office documents, particularly those in.docx format, increased by roughly 600%. These documents frequently include phishing links or QR codes that lead people to malicious websites.

Microsoft Office documents are an important attack vector due to their extensive use in commercial contexts, making them perfect for targeting enterprises via spear-phishing operations.

Furthermore, there has been a substantial shift in data exfiltration strategies, with a rise in the use of.ru and.su top-level domains (TLDs). Domains with the.ru (Russia) and.su (Soviet Union) extensions saw usage spikes of more than fourfold and twelvefold, respectively, indicating cybercriminals are turning to less common and geographically associated domains to evade detection and make it more difficult for victims and security teams to track data theft activities.

Read more »
Trojan
Backoor Malvertising malware Smokedham Trojan

Smokedham: Malicious Backdoor for Surveillance and Ransomware Campaigns

Smokedham: Malicious Backdoor for Surveillance and Ransomware Campaigns

A study by TRAC Labs reveals details about a backdoor called “SMOKEDHAM”, a malicious tool used by hacker UNC2465. The financially motivated attacker has been in action since 2019, the SMOKEDHAM tool plays a main role in sophisticated extortion and launching ransomware attacks, making UNC2465 the most adaptive and persistent threat group in the cybersecurity environment.

About Smokedham malware

SMOKEDHAM is a highly adaptable backdoor planted through trojanized software installers and strives via malvertising campaigns. “UNC2465 has leveraged trojanized installers disguised as legitimate tools, such as KeyStore Explorer and Angry IP Scanner, to deliver SMOKEDHAM payloads,” says TRAC Labs.

Once deployed, SMOKEDHAM allows hackers initial entry to a victim’s device, making way for network surveillance, later movements, and deploying ransomware. If we look back, SMOKEDHAM has links with DARKSIDE ransomware, and UNC2465 has now shifted focus to Lockbit ransomware.

When infecting the target system, SMOKEDHAM uses stealthy techniques, this includes DLL side-loading and PowerShell obfuscation. 

Important steps in the infection process include: 

Manipulating Service: The backdoor changes configurations of Windows services like MSDTC to maintain presence and exploit privileges. “The purpose of running these commands is to later DLL side-load the binary named oci.dll retrieved from the C2 server.”

Trojanized Installers: Distributed through famous platforms like Google Ads, these trojan installers may look legit but contain a malicious SMOKEDHAM payload.

Registry and Batch Script Modifications: Infected scripts run payloads, and configure registry keys for maintaining presence, and also make PowerShell commands for obfuscation. 

For post-campaign activities, the attacker uses:

1. Using tools such as Advanced IP Scanner and Bloodhound to track valuable targets in a compromised network. 

2. Credential Harvesting: Extracting login credentials for future exploitation. 

3. Escaping Firewall: Using NGROK to leak internal services like RDP to the web, evading network defenses. 

“Approximately 6 hours after the execution of the malicious binary on the beachhead host, the threat actors moved laterally to the Domain Controller using WMI,” says TRAC labs.

The SMOKEDHAM backdoor is a living example of sophisticated cyber threats corrupting the cybersecurity industry, with its advanced tools for surveillance, network infiltration, and persistence.

Read more »
Trojan
CVE-2024-38213 Cyber Security CyberCrime DarkGate operators Microsoft security patch Ransomware SmartScreen vulnerability Spyware Trojan

Microsoft Patches Critical SmartScreen Vulnerability Exploited by Attackers

 


Microsoft's SmartScreen feature, a cornerstone of Windows security, faced a significant setback when a critical vulnerability, CVE-2024-38213, was exploited by cybercriminals. This vulnerability allowed attackers to circumvent SmartScreen's protective mechanisms and deliver malicious code to unsuspecting users.

The vulnerability exploited a weakness in SmartScreen's ability to identify and block potentially harmful files. By exploiting this flaw, attackers were able to disguise malware as legitimate software, tricking users into downloading and executing harmful files. This deceptive tactic, known as social engineering, is a common strategy employed by cybercriminals.

The consequences of this breach were severe. Cybercriminals were able to deploy various types of malware, including ransomware, spyware, and trojans. These malicious payloads could steal sensitive data, encrypt files for ransom, or even take control of infected systems. The potential impact on individuals and organizations was significant, ranging from financial loss to data breaches and disruption of critical operations.

Several threat groups were implicated in the exploitation of CVE-2024-38213. Notable among them were the DarkGate operators, who used the vulnerability to distribute malware through copy-and-paste operations. These attackers often targeted popular software, such as Apple iTunes, Notion, and NVIDIA, to lure victims into downloading malicious files.

Upon discovering the vulnerability, Microsoft's security teams worked diligently to develop a patch to address the issue. The patch was included in the June 2024 Patch Tuesday update. However, the company initially failed to provide a public advisory, leaving users unaware of the potential threat. This oversight highlighted the importance of timely communication and proactive security measures.

The exploitation of CVE-2024-38213 serves as a stark reminder of the constant threat posed by cybercriminals. It underscores the need for robust security measures, both at the individual and organizational level. Users must remain vigilant, exercise caution when downloading files, and keep their systems up-to-date with the latest security patches.

For organizations, the incident emphasizes the importance of a comprehensive security strategy that includes vulnerability management, incident response planning, and employee training. By investing in these areas, businesses can better protect themselves against cyber threats and minimize the potential damage from successful attacks.

As the cyber threat landscape continues to evolve, it is essential for both individuals and organizations to stay informed about emerging threats and best practices for cybersecurity. By working together, we can help create a safer digital environment for everyone.

Read more »
Subscribe to: Posts (Atom)