| ThreatDown

CARBONATO: a botnet built around an AI agent

ThreatDown researchers uncovered CARBONATO, a Docker botnet built around an AI agent that compromises exposed Docker daemons, spreads across reachable…

11 minutes

Fake Booking.com emails target hotels

A new phishing campaign is using a famous brand to compromise hotels.

1 minute

Phishers go “interplanetary” to get company login credentials

An ongoing campaign to harvest company login credentials is using IPFS to host its phishing pages.

1 minute

“Enhanced Bonus” QR code phish steals Microsoft credentials

A personalized phishing attack could lead to a catastrophic loss of credentials.

2 minutes

USB worms: Still wriggling on to under-protected computers after all these years

Malware doesn't care if it's being talked about or not.

2 minutes

Analyzing a Mispadu Trojan’s attack chain

We tracked a Mispadu banking Trojan infection from the email attachment to the payload.

1 minute

How a clipboard hijacker delivers Lumma Stealer

The use of fake Captcha websites has doubled in only a few months.

3 minutes

Web shop spreads SocGolish malware and steals credit cards

A web shop selling jewelry was found with code belonging to two web skimmers and the SocGolish Trojan downloader.

2 minutes

Clipboard hijacker tries to install a Trojan

Criminals are attempting to get users to install malware from the clipboard.

2 minutes

A visit to a print shop put a password stealer on a co-worker’s laptop

Old-school malware distribution methods have a habit of hanging around long after people stop talking about them.

2 minutes

Watch out! Mobidash Android adware spread through phishing and online links

ThreatDown has uncovered a new campaign spreading the MobiDash adware for Android.

1 minute

New phishing campaign uses Discord for payload delivery

A new phishing campaign uses two Discord CDN's to host malicious executables.

3 minutes

SmartApeSG walkthrough

In this walkthrough, we test SmartApeSG, a malware campaign distributed via compromised sites.

5 minutes

ClearFake walkthrough

4 minutes

Gootloader walkthrough

2 minutes

FakeBat

Malicious Google ad redirects to FakeBat, dropping zgRAT.

3 minutes

Nitrogen

Nitrogen via Google ad for Advanced IP Scanner

3 minutes

LockBit Black

LockBit Black via zipped attachment in email

2 minutes

Medusa ransomware: What organizations need to know

Organizations beware: the Medusa ransomware gang is on the rise.

3 minutes

Threat Walkthroughs index

List of threats encountered in the wild with their indicators of compromise.

0 minutes

Products

Services

Features

Platforms

Cover story

Why ThreatDown

Threat Walkthroughs

CARBONATO: a botnet built around an AI agent

Fake Booking.com emails target hotels

Phishers go “interplanetary” to get company login credentials

“Enhanced Bonus” QR code phish steals Microsoft credentials

USB worms: Still wriggling on to under-protected computers after all these years

Analyzing a Mispadu Trojan’s attack chain

How a clipboard hijacker delivers Lumma Stealer

Web shop spreads SocGolish malware and steals credit cards

Clipboard hijacker tries to install a Trojan

A visit to a print shop put a password stealer on a co-worker’s laptop

New phishing campaign uses Discord for payload delivery

SmartApeSG walkthrough

ClearFake walkthrough

Gootloader walkthrough

FakeBat

Nitrogen

LockBit Black

Medusa ransomware: What organizations need to know

Threat Walkthroughs index

Products & Services

Partners

Managed Services Terms & Conditions

Resources

Support

Company

Privacy and Consent

Get in Touch

Products

Services

Features

Platforms

Cover story

Why ThreatDown

Threat Walkthroughs

Categories