Blog Post
Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware
A single X DM split into two malware chains: AMOS stealer on Mac, NetSupport Manager on Windows, see the Huntress SOC analyst breakdown.
Blog Posts By This Author
All Categories
- Read more about Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware
- Read more about Post-DEF CON Phishing Uses Google Doc Apps Script to Deliver MalwareBlog Post
Post-DEF CON Phishing Uses Google Doc Apps Script to Deliver Malware
Huntress researcher uncovers post-Black Hat & DEF CON phishing campaign using X DMs & malicious documents to deliver AMOS, NetSupport RAT, and other malware.
- Read more about Latest macOS Update Patches Pre-Auth Remote Code Execution Screen Sharing VulnerabilityBlog Post
Latest macOS Update Patches Pre-Auth Remote Code Execution Screen Sharing Vulnerability
Apple’s latest macOS update addresses two vulnerabilities in its Screen Sharing server, including one that enables pre-authenticated remote code execution.
- Read more about When PUPs Grow Fangs: Dragon Boss Solutions Left an Open Door on 25,000+ EndpointsBlog Post
When PUPs Grow Fangs: Dragon Boss Solutions Left an Open Door on 25,000+ Endpoints
Understand a malware operation using a signed Potentially Unwanted Program (PUP) from Dragon Boss Solutions LLC to silently deploy a PowerShell-based AV killer with SYSTEM privileges. The most critical finding was that the malware's primary update domain, chromsterabrowser[.]com, was unregistered, creating a supply-chain risk where anyone could've registered the domain to push ransomware or other payloads to the 23,565 compromised endpoints.
- Read more about “Malware, from the Outside!”: How a Threat Actor Used Fake OpenClaw Installers to Infect Systems with GhostSocks and Information StealersBlog Post
“Malware, from the Outside!”: How a Threat Actor Used Fake OpenClaw Installers to Infect Systems with GhostSocks and Information Stealers
Fake OpenClaw installers sat quietly on GitHub for over a week, loading GhostSocks and information stealers onto every system that downloaded them. Here's what Huntress found.
