Zscaler Cloud Security Logo
Company > Blog

News and views from the leading voice in secure digital transformation

More From This Author

Profile picture for user Tarun Dewan

Tarun Dewan

Ducktail PHP infostealer
Insights and Research
10 Min read

New PHP Variant of Ducktail Infostealer Targeting Facebook Business Accounts

Introduction In evaluating the spate of info-stealing malware being distributed over past couple of months, the Zscaler ThreatLabz research team has come across an interesting campaign. The PHP version of Ducktail Inf...
malware designed to steal passwords.
Insights and Research
11 Min read

Rise in Qakbot attacks traced to evolving threat techniques

Active since 2008, Qakbot, also known as QBot, QuackBot and Pinkslipbot, is a common trojan malware designed to steal passwords. This pervasive threat spreads using an email-driven botnet that inserts replies in active e...
Malware delivered via Microsoft Teams
Insights and Research
2 Min read

Malware delivered via Microsoft Teams

Background Recently, Avanan released a blog post mentioning the interest of adversaries in Microsoft Teams as a launchpad for their malicious attacks. Attackers have always targeted online collaboration tools like Sla...
New Trickbot and BazarLoader campaigns use multiple delivery vectors
Insights and Research
6 Min read

New Trickbot and BazarLoader campaigns use multiple delivery vectors

The Zscaler ThreatLabz research team monitors thousands of files daily tracking new and pervasive threats, including one of the most prominent banking trojans of the last five years: Trickbot. Trickbot has been active s...
Malware campaign
Insights and Research
11 Min read

A look at HydroJiin campaign

Zscaler ThreatLabZ recently came across an interesting campaign involving multiple infostealer RAT families and miner malware. We’ve dubbed the campaign “HydroJiin” based on aliases used by the threat actor. The threat a...
Resurgence of the QakBot Stealer from Newly Registered Domains
Insights and Research
7 Min read

Resurgence of the QakBot Stealer from Newly Registered Domains

The Zscaler ThreatLabZ team is constantly on the lookout for trending and evolving techniques used by malware authors to infiltrate victims' machines, steal information, and carry out other malicious activities. Recently...
Felipe, a new infostealer Trojan
Insights and Research
5 Min read

Felipe, a new infostealer Trojan

The Zscaler ThreatLabZ team came across a new strain of infostealer Trojan called Felipe, which silently installs itself onto a user’s system and connects to a command-and-control (C&C) server to send system informat...
Murkios bot drops files and controls system remotely
Insights and Research
4 Min read

Murkios bot drops files and controls system remotely

The Zscaler ThreatLabZ team came across the Murkios bot, which silently installs itself onto a user’s system and connects to a command-and-control (C&C) server by opening Secure Shell (SSH) terminals from the comprom...
Independence Day greeting campaign delivers Emotet
Insights and Research
3 Min read

Independence Day greeting campaign delivers Emotet

Recently, Zscaler's research team, ThreatLabZ, came across malicious Microsoft Office documents delivering Emotet malware via attachments using "Greeting Card" as the document name. The malware author leveraged the popul...
njRAT pushes Lime ransomware and Bitcoin wallet stealer
Ransomware
4 Min read

njRAT pushes Lime ransomware and Bitcoin wallet stealer

Updated - April 1, 2018 Updated - April 3, 2018 (added IOCs) njRAT, also known as Bladabindi, is a remote access Trojan (RAT) that was first seen in 2013 and continues to be one of the most prevalent malware family...
Yet Another Signed Malware - Spymel
Insights and Research
4 Min read

Yet Another Signed Malware - Spymel

Introduction ThreatLabZ came across yet another malware family where the authors are using compromised digital certificates to evade detection. The malware family in this case is the information stealing Trojan S...
Dridex Activity Continues
Insights and Research
3 Min read

Dridex Activity Continues

Dridex, a banking malware which attempts to steal the victim's banking credentials and system information, continues to remain active in the wild after the recent takedown attempt. Dridex activity went down sig...
Signed Dridex Campaign
Insights and Research
3 Min read

Signed Dridex Campaign

Introduction Malware authors use various means to make their malware look similar to legitimate software. One such approach involves signing a malware sample with a digital certificate. Recently we saw Dridex malwar...

Related Articles

Explore More Topics