FBI Warns of Androxgh0st Malware Botnet Stealing Cloud Credentials

The FBI and CISA have issued a warning about the Androxgh0st malware, which is being used to build a botnet focused on stealing cloud credentials, particularly from AWS and Microsoft. The malware targets vulnerabilities in popular web frameworks and servers, such as Laravel, Apache HTTP Server, and PHPUnit, to steal sensitive information. Threat actors are using the stolen credentials to conduct spam campaigns and deploy additional malicious tools. Network defenders are advised to implement mitigation measures to limit the impact of Androxgh0st malware attacks. CISA has added the CVE-2018-15133 Laravel vulnerability to its Known Exploited Vulnerabilities Catalog and ordered federal agencies to secure their systems against these attacks.