Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: Windows users visiting compromised websites
Incident: A malware delivery campaign using social engineering and blockchain-obfuscated JavaScript.
Impact: Theft of sensitive credentials and full remote system compromise via RAT modules.
Attacker: Unidentified threat actors (likely Initial Access Brokers)
Analysis: Threat actors are leveraging the ‘ClickFix’ technique, where users are tricked into executing malicious PowerShell commands via the Windows Run dialog. This infection chain utilizes ‘EtherHiding’ via smart contracts to obfuscate delivery and abuses legitimate CDNs to avoid detection. The final stage deploys Amatera Stealer or the SynkLoader toolkit to harvest credentials and establish remote control.
Recommendations: Educate users never to copy and paste commands from a browser into the Windows Run dialog or PowerShell.; Implement strict egress filtering to block unauthorized WebDAV connections and suspicious CDN-hosted scripts.; Configure EDR tools to alert on headless conhost.exe processes and rundll32.exe loading remote DLLs.
Source: The Hacker News / Gen Digital
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source