Kaspersky, UltraViewer ve AutoCAD gibi popüler yazılımları taklit eden sahte sitelerle yayılan TookPS Truva Atı tehdidine karşı kullanıcıları uyardı.

Novel fake websites campaign advertises free downloads for apps such as remote desktop services, 3D modeling, and more to disseminate malware.

Your printer shouldn't be delivering ransom notes. 🖨️🚨 The XEntry Team is taking ransomware to the physical world, hijacking network printers in Latin America to print out extortion demands after loc

At a Glance Malware family OkoBot framework (TookPS lineage; 20+ payloads and implants) Threat actor Unattributed; suspected Russian-speaking operator Targets Hundreds of victims in 25+ countries, led by Brazil and Vietnam Delivery vector ClickFix lures and fake software on GitHub Key capabilities Seed phrase phishing, keylogging, screen recording, RDP access Source Kaspersky (Securelist) TL;DR Kaspersky identified attacks in January 2026 that captured the contents of cryptocurrency…

Sinds januari 2026 waarschuwen beveiligingsonderzoekers voor de malware OkoBot. Deze malware wordt beschouwd als een doorontwikkeling van de TookPS-campagne, die in 2025 werd ontdekt. TookPS verspreidde schadelijke software via nepwebsites, waarmee andere virussen werden geïnstalleerd. OkoBot is echter geavanceerder en makkelijker te hergebruiken, waardoor andere hackers het 'framework' kunnen kopiëren voor hun eigen aanvallen. Een besmetting met OkoBot kan beginnen met het uitvoeren van schadelijke opdrachten. Besmette apps die via platforms zoals GitHub worden verspreid, kunnen een 'achterdeur' op een computer installeren. OkoBot kan vervolgens schadelijke browser-extensies installeren en...

OkoBot is a malicious framework that uses ClickFix attacks and fake GitHub software repositories to deliver more than 20 payloads aimed at stealing cryptocurrency wallet seed phrases, credentials, and other sensitive data. Kaspersky says the campaign evolved from TookPS, uses multiple stages including an SSH bot, and has heavily targeted users in Brazil while remaining active globally. #OkoBot #TookPS #Kaspersky #SeedHunter #Rilide

Kaspersky identified the active OkoBot campaign, a multi-stage framework that uses TookPS, SSH tunneling, browser extension theft, keylogging, and spyware to steal cryptocurrency wallets and other credentials. The operation has evolved since 2025, now distributing over 20 payloads and targeting victims in more than 25 countries while remaining active. #TookPS #OkoBot #TeviRAT #Rilide #Volume2 #SeedHunter #OkoSpyware

Kaspersky GReAT experts dissect the new OkoBot campaign targeting cryptocurrency users. This complex framework employs TookPS, exfiltrates seed phrases, monitors Chromium-based browsers, and installs various malware strains, including the Rilide stealer.

Hackers spread TookPS malware via fake software sites, targeting users with backdoors for remote access under popular brand disguises.

Cybercriminals exploit SourceForge’s open platform, using projects like officepackage to distribute crypto theft malware. Sophisticated malware like ClipBanker and TookPS is delivered through pirated software via redirects and nested files. SourceForge maintains its position as a thriving center for developers and user as an open-source software platform. The hosting platform provides software distribution alongside project services, which draws multiple types of users to its platform. Open platforms like SourceForge and GitHub make software development accessible but expose users to potential security dangers. Kaspersky researchers found proof that cybercriminals have perfected their methods to steal cryptocurrencies while hijacking systems through the “officepackage” project on SourceForge.

Malware peddlers are saddling users with the TookPS downloader and the Lapmon and TeviRat backdoors via malicious sites that mimic official ones and ostensibly offer legitimate software for download, Kaspersky researchers have warned. Malicious websites (Source: Kaspersky) The list of impersonated software includes: UltraViewer (remote desktop software) AutoCAD (2D and 3D computer-aided design software app) SketchUp (3D modeling software) Ableton (music production software) Quicken (personal finance app) “To protect against these attacks, users are advised …

April 11, 2025 at 02:59AM Aplikasi, Kaspersky Temukan Malware Baru, Menyamar Jadi Aplikasi 3D Populer!  Gadget Jumat, 11 April 2025 - 01:00 WIB Gadget – Serangan siber kembali mengintai pengguna perangkat lunak dengan metode yang semakin canggih. Kaspersky baru-baru ini menemukan situs web palsu yang menyebarkan malware berbahaya berkedok perangkat lunak desain 3D populer. Malware yang diberi nama Trojan-Downloader Tookps ini mulai terdeteksi sejak Maret 2025, dan telah menargetkan pengguna individu hingga organisasi bisnis.

Uncover the threat posed by the TookPS downloader, a malware strain exploiting popular software and fraudulent websites.

Hackers spread TookPS malware via fake software sites, targeting users with backdoors for remote access under popular brand disguises.

Ahli Kaspersky menemukan Trojan-Downloader baru bernama TookPS yang disebarkan melalui situs web palsu yang meniru perangkat lunak 3D populer seperti UltraViewer, AutoCAD, dan SketchUp.

El cargador malicioso TookPS no solo se distribuye bajo la apariencia de DeepSeek, sino que también se camufla como UltraViewer, AutoCAD, SketchUp, Ableton y otros programas populares.