Phishing campaign targets Ukraine, delivering sLoad malware through fake PDF links in .rar files, with advanced obfuscation and reconnaissance tactics.

In Part 1 of our series on Lumma Stealer, we explored the initial attack vector through a fake CAPTCHA page. We observed how the malware deceives users into downloading and executing malicious payloads. In this second series, we delve deeper into the technical details of the Lumma Stealer’s loader,

ASYNC RAT (Remote Access Trojan) is a malware designed for remote control of infected systems. The malware is commonly used to steal sensitive information, deploy additional malware, and maintain persistent access to compromised networks. Once installed on a target machine, ASYNC RAT can perform various malicious activities, including keylogging, screen

Malware distribution through infected documents, especially Microsoft Word files containing malicious macros, is a common threat. This article explores the process of reversing malware found in a Windows Word document, highlighting the techniques used by attackers and ways to mitigate such threats. The sample has been download from Malware Bazaar

The analyzed sample is part of the notorious malware family known as 'Agent Tesla,' classified as a Remote Access Trojan (RAT). This particular variant, encapsulated in a compiled .exe file, unfolds a complex web of functions and methods designed to gather sensitive data from the infected device. Throughout