CuraSec

tag: Malware-Campaign · 2 items

Act archived TerminalFix Campaign Uses PNG Steganography to Deploy Reverse Tunnel
2026-09-21 · SANS ISC · source ↗ #steganography#malware-campaign#threat-intel
  • Engineer — Learn: PNG steganography as a payload delivery mechanism is a technique worth understanding for detection design, but there is no vulnerability to patch or misconfiguration to fix — no direct engineering action required today.
  • SOC/IR — Act: IOCs for the steganographic PNG files have been published; sweep file transfer and web proxy logs for these IOCs and consider building a detection for suspicious outbound reverse tunnel activity paired with PNG downloads in multistage intrusion chains.
  • Leader — Skip
Act archived 5,400 Hacked Sites Deliver ClickFix Payloads via Blockchain Smart Contracts
2026-09-06 · BleepingComputer · source ↗ #clickfix#supply-chain#malware-campaign
  • Engineer — Plan: If you manage any public-facing web properties, audit them for injected ClickFix loader scripts; the blockchain storage makes payload URLs resilient to takedown, so perimeter blocklists alone won’t suffice.
  • SOC/IR — Act: Active campaign at scale — tune detections for ClickFix behavior patterns: browser-spawned mshta or PowerShell, clipboard-manipulation sequences, and outbound calls to BNB Chain RPC endpoints from endpoints since this campaign began.
  • Leader — Learn: The use of blockchain smart contracts as an abuse-resistant payload store is a meaningful evasion evolution worth noting; no immediate leadership action needed unless an internal investigation reveals your web presence among the 5,400 compromised sites.