CYFIRMA Research

CYFIRMA
  • 0.0 (0)
  • 科技新聞
  • 每星期更新

Cyber defenders, listen up! The CYFIRMA Research podcast has some juicy intel on the latest cyber threats that are lurking in the shadows. Tune in to this security briefing to stay on top of emerging threats and be ready to tackle digital risk like never before.

  1. 1日前

    CYFIRMA Research- LTX Stealer: Analysis of a Node.js–Based Credential Stealer

    Malware Spotlight: LTX Stealer  CYFIRMA researchers uncovered a sophisticated Windows info-stealer hidden in a legit Inno Setup installer. Key takeaways:  🔹 Node.js stealer with Bytenode bytecode obfuscation  🔹 Targets Chromium browsers & crypto wallets  🔹 Persists in hidden/system folders under Program Files(x86)   🔹 Uses Supabase for operator auth + Cloudflare to mask backend  🔹 Commercial-grade Malware-as-a-Service (MaaS) Modern attackers are using trusted installers + runtime decryption to evade detection. Stay vigilant!  Link to the Research Report: LTX Stealer : Analysis of a Node.js–Based Credential Stealer - CYFIRMA #CyberSecurity #MalwareAnalysis #Infostealer #NodeJS #ThreatIntel #MaaS  #CYFIRMA #CYFIRMAresearch #ExternalThreatLandscapeManagement #ETLM https://www.cyfirma.com/

    9 分鐘

  2. 4日前

    CYFIRMA Research- Re-Emerging Telegram Phishing Campaign Targeting User Authorization Prompts

    CYFIRMA has identified an active Telegram phishing campaign that abuses Telegram’s legitimate login and in-app authorization workflows to fully compromise user accounts without malware or exploits. By leveraging QR codes and manual login flows tied to attacker-controlled Telegram API credentials, victims are tricked into approving genuine authorization prompts inside the Telegram app under false security pretexts. This abuse-of-function approach increases victim trust, enables large-scale global targeting through rapidly rotating domains, and reflects a continued shift toward leveraging legitimate platform features as a primary account takeover vector. Stay vigilant. Authentication prompts are only safe when you initiate the action. Link to the Research Report: Re-Emerging Telegram Phishing Campaign Targeting User Authorization Prompts - CYFIRMA #ThreatIntelligence #Telegram #Phishing #AccountTakeover #CyberSecurity  #SocialEngineering #CYFIRMA #CYFIRMAresearch #ETLM  #ExternalThreatLandscapeManagement https://www.cyfirma.com/

    3 分鐘

  3. 3月5日

    CYFIRMA Research: CVE-2026-23760 – SmarterTools SmarterMail Authentication Bypass Vulnerability

    Critical Alert: CVE-2026-23760 – SmarterMail Pre-Auth Bypass Leading to Full System Compromise Organizations running SmarterTools SmarterMail email servers—widely deployed across SMBs, MSPs, educational institutions, and healthcare environments—must take immediate action. This actively exploited authentication bypass vulnerability allows unauthenticated attackers to reset system administrator passwords and gain complete control over email infrastructure without any credentials. ACTIVE EXPLOITATION CONFIRMED – Attacks began just 2 DAYS after patch release ~10000+ vulnerable instances identified globally Added to CISA's Known Exploited Vulnerabilities (KEV) catalog CVSS 9.8 Critical – Direct path to SYSTEM/root-level RCE Link to the Research Report: CVE-2026-23760 – SmarterTools SmarterMail Authentication Bypass Vulnerability - CYFIRMA #CyberSecurity #CVE202623760 #SmarterMail #AuthenticationBypass #ThreatIntel #ExternalThreatLandscapeManagement #VulnerabilityAlert #EmailSecurity #CriticalInfrastructure #CYFIRMA #CISA_KEV #RCE #PreAuthExploit https://www.cyfirma.com/

    8 分鐘

  4. 3月3日

    CYFIRMA Research- PlayCloak: A Play Store–Distributed Travel Utility Covertly Operating as a Financial Fraud and Cybercrime Platform

    Threat Research Alert | Android Loan Scam Our analysis uncovered an Android application, Hicas, distributed via the Google Play Store and marketed as a Smart Travel Packing Companion, which covertly operates as a region-targeted fraudulent loan platform. Key Findings: • Play Store app masquerading as a travel utility • Region-based cloaking activates loan flow on IN devices • Remote WebView delivers full lending workflow • Runtime behavior controlled via external JSON config • No app update required to alter logic or UI • Heavy obfuscation + XOR-based string decryption • Firebase FCM used for remote triggers/content • Excessive perms incl. contacts, camera, notifications • Explicit contact enumeration logic observed • Coercive repayment UI (urgency banners, coupons) • Offshore infra consistent with CN-linked loan ops • 500,000+ downloads, high potential user impact Link to the Research Report: PlayCloak: A Play Store–Distributed Travel Utility Covertly Operating as a Financial Fraud and Cybercrime Platform - CYFIRMA #CyberSecurity #MobileSecurity #AndroidMalware #LoanScam #PlayStore  #ThreatIntelligence #SeedSnatcher #ThreatAlert #CYFIRMA #CYFIRMAresearch https://www.cyfirma.com/

    5 分鐘

  5. 2月20日

    CYFIRMA Research- Weaponized WinRAR Exploitation and Stealth Deployment of Fileless .NET RAT

    WinRAR CVE-2025-8088 is a path validation vulnerability that allows a crafted RAR archive to write files outside the intended extraction directory during unpacking. In the observed attack chain, this behavior is abused to silently drop a malicious script into the Windows Startup folder, establishing persistence without requiring administrative privileges or explicit execution by the user. Once triggered, execution continues through an obfuscated Batch script and a PowerShell loader, ultimately leading to in-memory execution of a .NET RAT, using process injection.  The key takeaway is that trusted software and normal user actions can be enough to achieve compromise. Monitoring archive extraction behavior and unexpected Startup folder writes is becoming increasingly important for detection. Link to the Research Report: Weaponized WinRAR Exploitation and Stealth Deployment of Fileless .NET RAT - CYFIRMA #CYFIRMA #CYFIRMAResearch #CyberSecurity #ThreatResearch  #MalwareAnalysis #CTI #WinRAR #CVE #ETLM  #ExternalThreatLandscapeManagement https://www.cyfirma.com/

    8 分鐘

  6. 2月9日

    CYFIRMA Research- Mamba Phishing-as-a-Service Kit: How Modern adversary-in-the-middle (AiTM) Attacks Operate

    Mamba 2FA illustrates the evolution of phishing into highly automated adversary-in-the-middle attacks that can bypass traditional MFA by closely emulating legitimate cloud authentication experiences. As part of a broader phishing-as-a-service ecosystem, these tools enable scalable, low-effort campaigns with high impact across cloud environments. Addressing this threat requires MFA-resistant authentication, layered identity controls, and continuous monitoring of emerging phishing techniques. Link to the Research Report: Mamba Phishing-as-a-Service Kit: How Modern adversary-in-the-middle (AiTM) Attacks Operate - CYFIRMA #CyberSecurity #ThreatIntelligence #Phishing #AiTM #CloudSecurity  #MFABypass #DigitalRisk #CYFIRMA #CYFIRMAresearch  #ExternalThreatLandscapeManagement #ETLM https://www.cyfirma.com/

    6 分鐘

  7. 1月28日

    CYFIRMA Research- SOLYXIMMORTAL: PYTHON MALWARE ANALYSIS

    Emerging Threat Model: SOLYXIMMORTAL Malware Recent analysis highlights how modern commodity malware continues to evolve by abusing legitimate system functionality rather than relying on exploits or vulnerabilities. The malware demonstrates how attackers can achieve persistent access, credential theft, and user surveillance entirely within the user space, leveraging trusted operating system features and third-party services. Key observations: User-level persistence via AppData and registry Run keysCredential extraction from browser stores using native OS APIsContext-aware surveillance through active window monitoring and screenshotsData exfiltration over legitimate platforms (e.g., Discord webhooks)No exploit chains or privilege escalation required Why this matters: These techniques evade many traditional security controls by blending into normal system behavior and trusted network traffic. When malware relies on standard scripting runtimes, user permissions, and widely used cloud services, detection becomes a behavioral problem, not a signature one. Effective defense requires visibility into user-space execution, browser credential access, and abuse of legitimate third-party services, alongside strong behavioral analytics. Link to the Research Report: SOLYXIMMORTAL : PYTHON MALWARE ANALYSIS - CYFIRMA #ThreatIntelligence #MalwareAnalysis #CyberSecurity #BlueTeam  #DetectionEngineering #OSINT #InfoSec #CYFIRMA #CYFIRMAresearch #ETLM #ExternalThreatLandscapeManagement https://www.cyfirma.com/

    7 分鐘

  8. 1月16日

    CYFIRMA Research- Tracking Ransomware – December 2025

    Stay ahead with CYFIRMA’s December 2025 Ransomware Report. December marked the most active month of 2025 with 801 global ransomware victims, signaling a strong year-end escalation. Qilin surged to 175 victims, reinforcing its dominance, while Safepay and Sinobi posted sharp month-over-month growth, highlighting shifting group momentum. Ransomware operations increasingly adopted cartel-style, access-driven models, abusing trusted security tools, hypervisors, and enterprise file-sharing platforms to accelerate encryption and data-theft-only extortion.  The United States remained the primary target, followed by Western Europe, with expanding activity across Asia-Pacific and the Middle East. Professional services, manufacturing, IT, healthcare, and real estate were the most impacted sectors. Emerging groups like Nova continued to scale through data-centric extortion, signaling sustained threat expansion into 2026. Link to the Research Report: TRACKING RANSOMWARE : DEC 2025 - CYFIRMA #CyberSecurity #Ransomware #ThreatIntel #ETLM #CYFIRMA #Qilin #Safepay   #Sinobi #Nova #DataExtortion #ExternalThreatLandscapeManagement https://www.cyfirma.com/

    3 分鐘
查看全部 (284)

關於

Cyber defenders, listen up! The CYFIRMA Research podcast has some juicy intel on the latest cyber threats that are lurking in the shadows. Tune in to this security briefing to stay on top of emerging threats and be ready to tackle digital risk like never before.

資料

  • 創作者
    CYFIRMA
  • 活躍年份
    2023年 - 2026年
  • 單集
    284
  • 分級
    兒童適宜
  • 版權
    © 2026 CYFIRMA Research
  • 節目網站
    CYFIRMA Research