Malware - 1

2026 (7)

March (5)

security: WhatsApp malware campaign delivers VBS payloads and MSI backdoors

Microsoft Security Blog

2026-03-31

Microsoft describes a malware campaign distributed through WhatsApp messages that uses VBS scripts to start a multi-stage infection chain. The attackers use renamed Windows tools and cloud-hosted payloads to deploy MSI backdoors and keep persistent access on infected systems.

security: When tax season becomes cyberattack season: Phishing and malware campaigns using tax-related lures

Microsoft Security Blog

2026-03-19

Microsoft says threat actors are using tax-season urgency to deliver phishing and malware via refund notices, payroll forms, filing reminders, and fake tax-professional requests. The lures can include malicious attachments, links, and QR codes.

security: Contagious Interview: Malware delivered through fake developer job interviews

Microsoft Security Blog

2026-03-11

Microsoft describes the Contagious Interview campaign, where attackers impersonate recruiters from crypto and AI firms to target developers with fake coding assessments. The delivered malware installs backdoors and steals API tokens, cloud credentials, crypto wallets, and source code.

security: Signed malware impersonating workplace apps deploys RMM backdoors

Microsoft Security Blog

2026-03-03

Signed malware using a stolen EV code-signing certificate impersonated workplace apps to install legitimate remote monitoring and management (RMM) tools for persistent enterprise access. The post advises tightening certificate controls and monitoring RMM tool usage to reduce risk.

security: OAuth redirection abuse enables phishing and malware delivery

Microsoft Security Blog

2026-03-02

Microsoft reports attackers abusing OAuth redirect behavior to move users from legitimate sign-in pages to attacker-controlled sites, enabling phishing and malware delivery via trusted authentication flows.

February (2)

security: Developer-targeting campaign using malicious Next.js repositories

Microsoft Security Blog

2026-02-24

Microsoft reports a developer-targeting campaign that used malicious Next.js repositories to achieve remote code execution and establish command-and-control via normal build workflows, aiming to blend into routine development activity.

security: New Clickfix variant ‘CrashFix’ deploying Python Remote Access Trojan

Microsoft Security Blog

2026-02-05

Microsoft reports a new ClickFix variant, “CrashFix,” that intentionally crashes browsers to trick users into running commands that install a Python-based remote access trojan (RAT). The campaign abuses built-in utilities (finger.exe) and a portable Python runtime to reduce detection and maintain persistence on targeted systems.

2025 (1)

September (1)

security: XCSSET evolves again: Analyzing the latest updates to XCSSET’s inventory

Microsoft Security Blog

2025-09-25

Microsoft Threat Intelligence has identified a new variant of the XCSSET malware that targets Xcode projects used by developers building Apple and macOS applications, detailed in a Microsoft Security Blog post.