Tag

#amsi-bypass

3 posts0 followers

UAT-11795: Trojanized WebEx, Zoom and MobaXterm Installers Deliver Starland RAT and the WLDR Implant

Campaign Summary A Russian-speaking criminal group tracked by Cisco Talos as UAT-11795 has been running a continuous campaign since at least June 2025, distributing malware inside trojanized installer

blog.fiscybersec.com

Vũ Nhật LâmJun 23 · 13 min read

From Malspam to a Fileless .NET Loader: Abusing Google DoubleClick and a Five-Stage Evasion Chain

A German-language "purchase order" email with an HTML attachment is the opening move of a five-stage attack chain in which the malicious link routes through ad.doubleclick[.]net — a high-reputation Go

blog.fiscybersec.com

Vũ Nhật LâmApr 29 · 18 min read

Trojanized Google Antigravity: When the Real Installer Is the Attacker's Best Weapon

Executive Summary On April 21, 2026, Malwarebytes documented a campaign distributing an infostealer disguised as the Google Antigravity installer — an AI coding tool launched in November 2025 that qui

blog.fiscybersec.com

Search Hashnode

Trending tags this week

UAT-11795: Trojanized WebEx, Zoom and MobaXterm Installers Deliver Starland RAT and the WLDR Implant

From Malspam to a Fileless .NET Loader: Abusing Google DoubleClick and a Five-Stage Evasion Chain

Trojanized Google Antigravity: When the Real Installer Is the Attacker's Best Weapon