Latest Security News

Webworm has shifted from the McRat and Trochilus remote access trojans to lightweight proxy infrastructure and cloud-based C&C mechanisms.

The intrusion chain involved attackers delivering a legitimate executable, a matching .config file, and a malicious DLL designed for sideloading into the trusted process.

The service abused Microsoft Artifact Signing to generate short-term certificates that allowed malware to appear as legitimate software.