4 posts
PHANTOMPULSE is a sophisticated RAT attributed to DPRK-aligned actors that utilizes hardware breakpoints to bypass AMSI, WLDP, and ETW. It establishes a resilient, sinkhole-able command and control channel by resolving C2 URLs from blockchain transaction inputs and employs multiple process injection and UAC bypass techniques.
Threat actor REF6598 is targeting the financial and cryptocurrency sectors using social engineering to trick victims into opening a malicious Obsidian vault. The attack leverages Obsidian's community plugins to execute cross-platform attack chains, culminating in the deployment of the PHANTOMPULSE RAT on Windows and an AppleScript dropper on macOS.
A supply chain attack campaign utilizing five typosquatted npm packages targets Solana and Ethereum developers. The packages silently intercept private keys during routine cryptographic operations and exfiltrate them to a Telegram bot, leveraging transitive dependencies and obfuscation to evade detection.
Trail of Bits identified six common vulnerability patterns in ERC-4337 smart accounts during their audits. These vulnerabilities, ranging from incorrect access controls and incomplete signature validation to state modification issues and replay attacks, can allow attackers to drain funds or hijack account ownership.
