VexTrio Uses 70,000 Hijacked Websites to Spread Malware

by Ophtek, LLC | Mar 26, 2024 | ClearFake, Hijacked websites, Malicious traffic distribution system, malvertising, malware, Ophtek, Phishing, SocGholish, TDS, VixTrio

Threat actors have compromised 70,000 previously legitimate websites and created a powerful network capable of distributing malware. Named VexTrio, this network of compromised websites appears to have started in 2017, but it’s only more recently that details around...

HeadCrab Attacks Servers with Advanced Malware

by Ophtek, LLC | Mar 19, 2024 | authentication, Hackers, HeadCrab, malware, Ophtek, Redis Servers, runtime monitoring, security scans

A new strain of malware, which contains several different attack methods and is considered a severe threat, has been discovered and named HeadCrab. The attack focuses its efforts on Redis servers, an open source, in-memory data structure store. In simpler terms, Redis...

The Dangers of Malware on GitHub

by Ophtek, LLC | Mar 5, 2024 | GitHub, malicious code, malware, Open Source Malware, Ophtek

GitHub is a wildly popular website for developers to create, share, and store their code, but it’s also being increasingly used to spread malware. Launched in 2008, GitHub quickly became the number one destination for developers. Packed full of features – such...

DarkGate and NetSupport Malware is Surging 

by Ophtek, LLC | Feb 13, 2024 | anti-malware tools, BattleRoyal, DarkGate, install updates, malicious websites, malware, NetSupport, Ophtek, Phishing Email, Windows SmartScreen

A new threat actor has spent the last few months ramping up attacks involving the DarkGate and NetSupport malware, and this is set to increase further.  The name of this new threat actor is BattleRoyal, and between September and November 2023, they launched numerous...

Agent Raccoon Malware Strikes Targets Across the Globe

by Ophtek, LLC | Jan 23, 2024 | Agent Raccoon, backdoor attack, malware, network traffic, Ophtek, Phishing Email, trusted updates

A new strain of malware called Agent Raccoon has been discovered, and it appears to have been launched by nation-state threat actors. A wide range of different organizations – based in sectors such as education, government, non-profit, and telecommunications – have...

Facebook Ads Used to Deliver NodeStealer Malware 

by Ophtek, LLC | Dec 26, 2023 | block social media, Facebook Ads, malware, NodeStealer, Ophtek, Phishing, Suspicious links

  Threat actors have turned to Facebook ads to unleash NodeStealer on unsuspecting victims, and they’re using scantily clad women to achieve this.  Facebook is no stranger to finding its ad network compromised to spread malware, but what’s interesting about this...