ShadowOpCode

🚨 New #JavaStealer “MaksStealer” uncovered! Fully in-memory, FUD, DES–Blowfish runtime decryption, WebSockets on 4025/4028/6662. Author “Max, 17yo” left his signature in the payload 🤯 Full report & IoCs 👉 github.com/ShadowOpCode/M… #infosec #malware #ThreatIntel @malwrhunterteam

⚠️ A new ClickFix variant abuses Win+R to mount a remote WebDAV drive and run malware. It launches a trojanized WorkFlowy Electron app that beacons to C2 every 2 seconds. @Atos says it bypassed Microsoft Defender and surfaced only through threat hunting. 🔗 Inside: WebDAV trick + ASAR injection → thehackernews.com/2026/03/invest…

🚨NEW MALWARE UNCOVERED🚨 DesckVB RAT v2.9 is NOT “just another RAT”. 5-stage intrusion chain unraveled (WSH JS → obf PS → in-memory .NET loaders → RAT). C2 + plugin ecosystem rebuilt from historical PCAP. 🕵️Hard links to #Pjoao1578. 📄Full report: github.com/ShadowOpCode/D… 🧵👇

@D3LabIT UpCrypter is injecting two malwares inside InstallUtil.exe and MSBuild.exe. The one in MSBuild (and at this stage is no more UpCrypter) is doing connections to webdot[.]ddns[.]net which was already pointed out by FORTINET in this report: fortinet.com/blog/threat-re…