Xiaopeng Zhang [at] Fortinet @xpzhang_

A new DarkCloud campaign targeting Windows users involves phishing emails with malicious RAR archives containing obfuscated JavaScript. It employs fileless payloads, process hollowing, and anti-analysis to steal credentials, payment info, and contacts. #… ift.tt/gsix9RQ

🧬 New Malware Alert: Hides Using Broken File Headers! Fortinet just uncovered a remote access trojan (RAT) that ran unnoticed for weeks—using corrupted DOS & PE headers to avoid detection. 🖥️ Turns your PC into a remote access hub 🔁 Supports multiple attacker sessions 🔐 Uses…

Fortinet spots new malware that corrupts its own headers to block forensic analysis, hide behavior, and communicate with its C2 server. hackread.com/new-malware-co…

#FortiGuardLabs captured a phishing campaign sending a PowerPoint document as an email attachment to spread a new variant of #FormBook #malware. Learn more in our research analysis: ftnt.net/6015HFHfl

🚨🎣 New #Phishing Alert! Our #FortiGuardLabs team has spotted a new Agent Tesla variant targeting Spanish speakers. This .Net-based RAT steals sensitive info like hardware details, login credentials, keystrokes, email contacts, browser cookies, & more: ftnt.net/60105zSV0

Fortinet's Xiaopeng Zhang shows how a malspam campaign targeting Spanish-speaking users works to load Agent Tesla onto a victim’s computer, how it starts, what sensitive data it is able to collect, and the way it sends stolen data to the attacker. fortinet.com/blog/threat-re…

I’m using Rakuten to get Cash Back at my favorite stores. Hate for you to miss out, so I'm inviting you to join. Use my invite and get an exclusive reward.* rakuten.com/r/1827537?eeid…

New: Beware, an already fixed vulnerability is still being exploited by threat actors to spread a new variant of #AgentTesla malware against Windows devices. #CyberSecurity #Malware #Vulnerability #Windows #Phishing Read: hackread.com/agent-tesla-va…

#FortiGuardLabs conducts an in-depth analysis of a #phishing campaign that continues to exploit a known vulnerability spreading a new Agent Tesla variant. 🎣 Learn more 👉 ftnt.net/6014PxdLO

Fortinet's Xiaopeng Zhang analyses a phishing campaign that spreads a new Agent Tesla variant. This well-known malware family uses a .Net-based Remote Access Trojan (RAT) and data stealer to gain initial access. fortinet.com/blog/threat-re…

The #FortiGuardLabs team recently analyzed a #phishing campaign utilizing a Microsoft OneNote file. 🎣 👩‍💻 🔎 Learn more about the contents of this malicious attack and how it executes, evades detection, and fully controls a victim's device: ftnt.net/60123fame

#FortiGuardLabs discovered an Excel document with an embedded and randomized file, which exploits CVE-2017-11882, to deliver and execute malware on a victim’s device. Read our blog to learn what malware it can download and what actions it can conduct: ftnt.net/6017Mp6HL

#FortiGuardLabs discovered a #phishing campaign spreading a new variant of the information stealer and banking Trojan #QakBot. Read our analysis blog to learn how the HTML file can lead to executing the QakBot variant, what actions it takes, and more: ftnt.net/6017zvUgR

This phishing attack delivers three forms of malware. And they all want to steal your data zd.net/3FN3mzQ by @dannyjpalmer

Fortinet’s Xiaopeng Zhang describes a malspam campaign delivering 3 fileless malware: AveMariaRAT/BitRAT/PandoraHVNC, including how it transfers malware to the victim device, the mechanism to load, deploy &execute the malware & how it maintains persistence fortinet.com/blog/threat-re…

#FortiGuardLabs discovered a #phishing campaign delivering fileless #malware #AveMariaRAT, #BitRAT, and #PandoraHVNC to steal sensitive information from a victim’s device. Read our analysis to find out more about how the campaign executes. ftnt.net/6011zJxQP

Fortinet researchers analyse how Remcos RAT is delivered and executed, what sensitive information it could steal, how it connects to its C2 server and what commands Remcos provides to the victim’s device. fortinet.com/blog/threat-re…

#FortiGuardLabs analyzes how a #phishing campaign delivers the #RemcosRAT onto a victim’s device, how it executes on the device, the sensitive information it steals from the victim, and the commands this RemcosRAT uses to control the victim's device. ftnt.net/6017KIlEz

#FortiGuardLabs recently discovered a fresh variant of the #SnakeKeylogger #malware. Learn how it’s downloaded and executed through Excel, what techniques this variant uses to protect it from being analyzed, and what sensitive information it steals: ftnt.net/6015JXFUF

#FortiGuardLabs discovered new phishing email campaigns, which use an Excel attachment to attempt to trigger the download of a new variant of Dridex #malware. Read our analysis to learn how it runs and what sensitive information it collects: ftnt.net/6011y2rl1