Tag

Remote Access Trojan

All articles tagged with #remote access trojan

technology1 month ago•14 min saved

RedHook Android malware hijacks phones through wireless debugging

Security researchers warn that the RedHook Android malware hijacks phones by social engineering users to sideload a malicious app and enable Accessibility, then exploits Wireless Debugging to gain shell-level access, allowing it to monitor the screen, log keystrokes, install or remove apps, and control settings with overlays—without full root access—making it harder to remove; users should avoid unknown APKs, verify callers, keep Play Protect enabled, and apply updates or factory resets if infected.

via Fox News|

#accessibility-permissions #android #malware

technology3 months ago•3 min saved

Stealthy Python RAT Uses Hidden C2 Tunnel to Harvest Browser and Cloud Credentials

Security researchers uncovered DEEP#DOOR, a Python-based backdoor that embeds its payload in a dropper and gains persistence via Startup scripts, Run keys, Scheduled Tasks, and optional WMI subscriptions. It uses a Rust-based tunneling service (bore.pub) for C2 and offers full RAT capabilities—reverse shell, reconnaissance, keylogging, screen/audio capture, webcam access, and credential theft from browsers, cloud services, and Windows Credential Manager—while employing anti-analysis and defense-evasion techniques. Distribution appears phishing-based and targeted, with a modular, fileless design; it could be repurposed by different actors.

via The Hacker News|

#backdoor #cybersecurity #phishing

security4 months ago•6 min saved

Axios supply-chain breach delivers cross-platform RAT through fake dependency

Axios was hit by a supply-chain attack after attackers used compromised maintainer credentials to publish axios v1.14.1 and v0.30.4, which inject the fake dependency [email protected]. The postinstall script in that dependency drops a cross-platform RAT on macOS, Windows, and Linux, contacting a C2 server and delivering platform-specific payloads before self-deleting. Users should downgrade to 1.14.0 or 0.30.3, rotate credentials, remove plain-crypto-js from node_modules, audit CI/CD for the affected installs, and block egress to the C2 domain sfrclak.com. Axios itself wasn’t modified; the malicious behavior resided entirely in a transitive dependency, with additional vendored packages also distributing the malware.

via The Hacker News|

#axios #malware #npm

cybersecurity2 years ago•1 min saved

"Quasar RAT: Flying Under the Radar with DLL Side-Loading"

The Quasar RAT, an open-source remote access trojan, has been observed using DLL side-loading to evade detection and steal data from compromised Windows hosts. The malware disguises itself as legitimate files, such as ctfmon.exe and calc.exe, to exploit the trust placed in them by the Windows environment. By leveraging DLL side-loading, the trojan executes its own payloads by planting spoofed DLL files. The attack begins with an ISO image file containing renamed binaries, which initiate the loading of malicious code concealed within a disguised DLL file. The trojan establishes connections with a remote server to send system information and enables remote access to the compromised endpoint. The initial access vector used by the threat actor is unclear, but phishing emails are a likely dissemination method. Users are advised to be cautious of suspicious emails, links, and attachments.

via The Hacker News|

#cybersecurity #data-exfiltration #dll-side-loading

cybersecurity3 years ago•2 min saved

QwixxRAT: A New Windows RAT Spreads Through Telegram and Discord

A new remote access trojan (RAT) called QwixxRAT is being sold on Telegram and Discord platforms. The malware stealthily collects sensitive data from Windows machines and sends it to the attacker's Telegram bot, providing unauthorized access to the victim's information. QwixxRAT is designed to harvest various data, including web browser histories, credit card information, and files. It incorporates anti-analysis features and a clipper to access sensitive information from the clipboard. The RAT's command-and-control is facilitated through a Telegram bot, allowing for additional data collection and control over the infected host. This discovery follows the disclosure of other RAT strains and a campaign using compromised sites to distribute a remote administration software tool.

via The Hacker News|

#cybersecurity #data-theft #discord

cybersecurity3 years ago•2 min saved

Beware: Android App Secretly Records Users' Lives.

An Android app called "iRecorder - Screen Recorder" was found to have been secretly recording audio and sending it to an unknown location after being "trojanized" with malicious software during an update. The malware, known as AhRat, is a remote access trojan that can be used to remotely access victims' phone data and send it to outside developers. While it's unclear who or what was controlling this latest version of AhMyth, past generations have been used for cyberespionage. The app has since been removed from Google Play.

via Futurism|

#android #cybersecurity #espionage