CYFIRMA identified a multi-stage intrusion that used a weaponized PowerShell payload disguised as sysupdate.jpeg to deploy a trojanized ConnectWise ScreenConnect instance for covert remote access. The campaign relied on AMSI bypass, on-host .NET compilation, a fileless UAC bypass, and encrypted command-and-control through legitserver.theworkpc[.]com and 45.138.16[.]64. #ConnectWiseScreenConnect #ComputerDefaults.exe #legitserver.theworkpc.com #sysupdate.jpeg #OneDriveServers

ReliaQuest has observed an in-the-wild campaign distributing a new malware family called DeepLoad that steals credentials and intercepts browser interactions. The campaign uses the ClickFix technique to trick users into running a persistent PowerShell loader that compiles evasive DLLs, injects into LockAppHost.exe, and facilitates real-time cryptocurrency theft. #DeepLoad #ClickFix...

Cato CTRL researchers observed a vishing-driven delivery that used Microsoft Teams helpdesk impersonation and screen sharing to coax a victim into executing staged PowerShell, which loaded an in-memory payload and established a WebSocket-based backdoor. Defenders are advised to treat collaboration tools as attack surfaces and apply controls such as ticket validation, restricting external Teams access, and PowerShell hardening. #PhantomBackdoor #MicrosoftTeams

installed on the compromised computers read more about Fake DocuSign Gitcode Sites Spread NetSupport RAT via Multi-Stage PowerShell Attack