New ROMULUS Platform Turns Fake ‘Verification’ Prompts Into a Reusable Malware Delivery Backend
Forescout researchers have identified ROMULUS, a previously undocumented ClickFix delivery platform that tricks users into running malicious commands themselves, then routes them toward either the LegionLoader malware or...
ClickFix Campaign Deploys Stealthy Python Tunnels Ahead of Ransomware Attacks
A investigated Windows intrusion used ClickFix social engineering, DLL sideloading and encrypted Python tunnels to establish durable remote access. Researchers stopped the attack before encryption, but its tooling...
CastleStealer Malware Adds Remote Shell Access After Cracking Chrome’s Cookie Protection
CastleStealer, a C#-based information stealer first spotted in April, has gained the ability to bypass Chrome's App-Bound Encryption and hand its operators a remote shell on infected Windows...
Warden Stealer-as-a-Service Expands to Target Browser Vaults, Crypto Wallets, and AI Agent Tokens
A fast-growing Rust-based information stealer called Warden Stealer is spreading through ClickFix lures, malicious ads, cracked software, and fake game cheats. Sold as a malware-as-a-service kit, it bypasses...
Fake Cloudflare Verification Pages Used to Push LUNEXSTEALER Malware on 100+ Hacked Sites
Ukraine's CERT-UA is tracking a campaign, dubbed UAC-0277, that has compromised more than 100 legitimate websites to show visitors a convincing but fake Cloudflare verification screen. Clicking through...
Fake CAPTCHA Prompts Are Hiding Malware in Your Browser Cache, Microsoft Warns
Microsoft Threat Intelligence has uncovered a ClickFix variant that pre-stages a disguised VBScript payload inside the browser cache before a victim ever pastes a command into the Windows...
For $250 a Month, Anyone Can Rent a Fully Featured Windows Spy Tool Called VectraRAT
Researchers have uncovered VectraRAT, a subscription-based remote access trojan renting for as little as $250 a month that gives buyers keylogging, hidden-desktop control, and credential theft on infected...
ClearFake CAPTCHA Campaign Disables EDR to Deploy Crypto Stealer
ClearFake has expanded its fake CAPTCHA operation with a vulnerable-driver technique that terminates endpoint defenses before deploying a cryptocurrency stealer. The campaign combines compromised sites, blockchain-hosted instructions, WebDAV...