PowerShell

A sophisticated ClickFix campaign is leveraging the Polygon blockchain to implement 'EtherHiding,' allowing attackers to rotate C2 servers via smart contracts. This technique makes traditional IP and domain blocking ineffective by using a distributed ledger as an attacker-controlled command center.

This technical report details multiple methods for abusing Windows Services to achieve persistence and elevated privileges. It covers everything from traditional binary path modification to advanced techniques involving SDDL manipulation and service recovery hijacking.

Cybersecurity researchers from Microsoft and Trend Micro have uncovered sophisticated phishing campaigns targeting hospitality organizations in Europe and Asia. These attacks leverage malicious archives to deploy persistent malware like Node.js implants and blockchain-based RATs to maintain long-term access.

Attackers compromised legitimate DAEMON Tools installers to distribute trojanized, digitally signed binaries that execute malicious code upon system startup. The campaign utilizes an initial information collector to profile victims before deploying advanced payloads like the QUIC RAT for targeted exploitation.