MuddyWater is linked to a broad 2026 espionage campaign that hit at least nine organizations across nine countries, using DLL side-loading, Node.js, PowerShell, and ChromElevator to steal credentials and browser data. Separately, Iran-linked operations tied to Emennet Pasargad, Shahid Shushtari, and MOIS targeted organizations in the U.S., Israel, Saudi Arabia, Turkey,...

A new C# malware family called AgingFly has been used in Ukraine against local governments and hospitals to steal authentication data from Chromium-based browsers and the WhatsApp Windows client. CERT-UA attributes the campaign to UAC-0247 and describes a complex LNK→HTA→scheduled-task attack chain that stages payloads, uses open-source tools like ChromElevator and ZAPiDESK to exfiltrate credentials, and dynamically compiles command handlers received from a C2 server. #AgingFly #CERT-UA

Introduction: Chromium's App-Bound Encryption is designed to be the last line of defense for sensitive browser data, tying decryption keys to a specific process on a specific device. However, the emergence of tools like ChromElevator demonstrates a sophisticated in-memory attack that bypasses these protections entirely. This article deconstructs the post-exploitation technique of Direct Syscall-based Reflective Process Hollowing, revealing how attackers can perform fileless, user-mode extraction of cookies, passwords, and payment data from Chrome, Edge, and Brave without triggering traditional security alarms.

サイバーディフェンス研究所のスレットインテリジェンスアナリスト、川上です。 弊社は2026年6月、日本語の請求書通知を装ったメールを起点に、Google Sites、短縮URL、Google Driveを経て悪意のあるVHDファイルが配布された事例を解析しました。…

Curate Feeds | Make Collections | Customize Email Briefs