fp-3a - Page 3

Job Hunters Alert: Vampire Bot Malware Hides in Fake Job Offer Emails

Posted: October 09, 2025

Categories: Malware Alerts, Email And Password

Tags: fp-3b, fp-3a, fp-2e, fp-2d, fp-2c, fp-2b, fp-2a, fp-1b, fp-1a

Author: Npav Lab

Vampire Bot spyware targets job seekers via deceptive ZIP attachments in recruiter emails, stealing screenshots and data. Linked to BatShadow hackers, it evades detection—stay safe by verifying offers and using EDR tools to avoid digital traps.

OpenAI Bans ChatGPT Accounts of Chinese Hackers Using AI for Malware Refinement and Phishing Attacks

Posted: October 08, 2025

Categories: Malware Alerts, Phishing, Hacker, AI

Tags: fp-3b, fp-3a, fp-1a

Author: Npav Lab

OpenAI's October 2025 report reveals bans on ChatGPT accounts linked to PRC-affiliated groups like UNKDROPPITCH, who leveraged AI to debug malware (GOVERSHELL, HealthKick), craft targeted phishing, and build surveillance tools—disrupting 40+ networks; models block direct threats but highlight efficiency risks in cyber ops.

Hackers Silently Weaponize WordPress Sites with Malicious PHP Injections for Malvertising and Redirects

Posted: October 08, 2025

Categories: Malware Alerts, Data Breach, Hacker

Tags: fp-3b, fp-3a, fp-1b, fp-1a

Author: Npav Lab

Sucuri uncovers stealthy PHP code injections in WordPress theme files (functions.php) exploiting weak permissions and outdated plugins to fetch obfuscated JS from brazilc[.]com, enabling pop-ups, redirects, and Cloudflare-mimicking iframes—update themes, tighten permissions, and monitor scripts to secure sites.

Microsoft Warns: Hackers Exploit Teams Features Across Attack Chain for Malware and Ransomware Delivery

Posted: October 08, 2025

Categories: Ransomware, Malware Alerts, Cyber Attack, Hacker, Microsoft

Tags: fp-6d, fp-6a, fp-4a, fp-3b, fp-3a, fp-1b

Author: Npav Lab

Microsoft alerts on cybercriminals and state actors abusing Teams' messaging, calls, and sharing for full attack lifecycle—from reconnaissance with TeamsEnum to exfiltration via GraphRunner and extortion by Octo Tempest. Harden identities, monitor anomalies, and train users to mitigate.

CometJacking: New Attack Hijacks Perplexity’s Comet AI Browser for Covert Data Exfiltration

Posted: October 06, 2025

Categories: Cyber Attack, Data Breach, Browser Hijack, AI

Tags: fp-3b, fp-3a, fp-1b, fp-1a

Author: Npav Lab

LayerX uncovers CometJacking, exploiting Perplexity’s AI browser via malicious URLs to steal Gmail/Calendar data—tricks AI into Base64-encoded exfiltration, bypassing safeguards. Urgent call for AI security-by-design amid rising agentic threats.

Malicious Postmark-MCP Server Steals Emails via Hidden BCC in AI-Powered Workflows

Posted: September 29, 2025

Categories: Malware Alerts, Data Breach, Email And Password, AI

Tags: fp-3b, fp-3a, fp-1b

Author: Npav Lab

A malicious update to the postmark-mcp server injects a hidden BCC to exfiltrate sensitive emails from thousands of organizations. Koi’s risk engine uncovered the attack, highlighting risks in AI-driven MCP tools. Remove version 1.0.16+ and audit MCP servers now.

Evolved XCSSET Malware Targets macOS Developers: Clipboard Hijacking, Firefox Theft, and Xcode Infections

Posted: September 26, 2025

Categories: Malware Alerts, Data Breach

Tags: fp-6a, fp-4c, fp-3b, fp-3a, fp-1a

Author: Npav Lab

Microsoft uncovers advanced XCSSET variant infecting Xcode projects for macOS devs—adds Firefox data exfiltration, crypto wallet clipboard swaps via AES-encrypted AppleScripts, and LaunchDaemon persistence. Mitigate with updates, Defender for Endpoint, and domain blocks.

Hackers Weaponize AI-Generated Code to Obfuscate Phishing Payloads in SVG Files, Bypassing Traditional Defenses

Posted: September 26, 2025

Categories: Phishing, Hacker, AI

Tags: fp-3b, fp-3a, fp-1b, fp-1a

Author: Npav Lab

Microsoft exposes AI-driven phishing campaign targeting US organizations: attackers use AI to craft verbose, business-jargon code in SVG attachments disguised as PDFs, hiding credential-stealing payloads behind invisible dashboards and evading antivirus detection.

Hackers Bypass EDR with In-Memory PE Loader: Fileless Execution in Trusted Processes

Posted: September 25, 2025

Categories: Hacker, AI

Tags: fp-6d, fp-6a, fp-3b, fp-3a, fp-1b, fp-1a

Author: Npav Lab

Threat actors use in-memory PE loaders to download and run malicious executables (e.g., RATs) via Windows APIs like VirtualAlloc and LoadLibraryA, evading file-based EDR like Microsoft Defender/Sophos. Learn the technique's steps, red team success, and need for memory/behavioral defenses.

Banking Trojans Disguise as Government Apps to Target Android Users in Indonesia and Vietnam

Posted: September 24, 2025

Categories: Android Security, Banking Trojan

Tags: fp-3b, fp-3a, fp-2c, fp-2a, fp-1b

Author: Npav Lab

Since August 2024, BankBot.Remo variants use WebSocket chunked downloads on spoofed Google Play pages to deliver malware as fake payment/identity apps like IdentitasKependudukanDigital.apk; over 100 Alibaba/Gname domains evade filters—monitor WebSockets and block C2 for defense.