Malware

Threat intel | 12 min read

ClearFake gets more evasive with new living off the land (LOTL) techniques

ClearFake's latest campaign uses fake CAPTCHAs and social engineering trick victims into installing malware, and it's getting more evasive.

Threat intel | 12 min read

Planned failure: Gootloader’s malformed ZIP actually works perfectly

Gootloader malware contains a deliberately malformed ZIP archive to bypass detection, but can also be identified by its unique formatting.

Threat intel | 6 min read

Certified OysterLoader: Tracking Rhysida ransomware gang activity via code-signing certificates

Rhysida ransomware gang has been using code-signing certificates to validate their malware campaigns repeatedly. Here's the latest.