Malvertising on CuraSec

StreamRat Android Banking Trojan Spread via Meta Ads to 570K EU Accounts

Wed, 02 Sep 2026 15:05:08 +0000

Engineer — Skip
SOC/IR — Learn: StreamRat demonstrates a malvertising delivery chain for Android banking trojans capable of near-complete device takeover; worth noting the ad-platform distribution vector for mobile threat modeling, though no IOCs or ATT&CK mappings are available to act on today.
Leader — Skip

Sun, 26 Jul 2026 12:14:17 +0000

Engineer — Learn: This technique—assembling malware entirely within browser memory via JavaScript—bypasses file-based detection and signals a shift in delivery model worth factoring into client-side defense strategies (CSP hardening, browser isolation). No specific software to patch; no KEV or PoC signals.
SOC/IR — Plan: The campaign is described as large-scale and targets users of crypto/trading sites; build or tune EDR behavioral rules for in-browser memory injection and anomalous JS execution patterns this quarter. The summary provides no specific IOCs to hunt on immediately.
Leader — Skip

Sun, 26 Jul 2026 12:14:17 +0000

Engineer — Learn: No patch or configuration action required; this is a delivery-side evasion technique exploiting the browser as an assembler using Bun runtime, relevant for understanding how malware bypasses file-hash detections on endpoints you defend.
SOC/IR — Plan: Build or tune detections for Bun runtime executing assembled payloads and browser-initiated process chains; hunt for SourTrade IOCs published by Confiant since late 2024, focusing on impersonation of TradingView, Solana, and Luno lures in web traffic and endpoint telemetry.
Leader — Skip

Fri, 24 Jul 2026 12:43:46 +0000

Engineer — Learn: No direct infrastructure vulnerability here; the attack targets end users via social engineering. Worth noting that AI-tool-themed lures are an emerging pattern that should inform employee software-download guidance.
SOC/IR — Act: Active SectopRAT delivery campaign in progress — query EDR telemetry for downloads of unofficial Claude installers and sweep endpoints for SectopRAT indicators; the BleepingComputer writeup likely contains file hashes and C2 indicators to feed into your SIEM.
Leader — Learn: AI-tool-themed malvertising is a growing employee-targeting vector; useful context for justifying security-awareness investment, but no immediate leadership action required absent evidence of internal compromise.