Zscaler Cloud Security Logo
Company > Blog

News and views from the leading voice in secure digital transformation

Hero Panel Image
Security Research
Gmail phishing attack
Insights and Research
6 Min read

AiTM phishing attack targeting enterprise users of Gmail

Summary This blog is a follow-up to our recent publication which described the details of a large-scale phishing campaign targeting enterprise users of Microsoft email services. Beginning in mid-July 2022, ThreatLabz started observing instances of adversary-in-the-middle (AiTM) phishing attacks targeted towards enterprise users of Gmail. U...
An analysis and comparison study of X-files stealer variants.
Insights and Research
6 Min read

X-FILES Stealer Evolution - An Analysis and Comparison Study

Introduction Zscaler’s ThreatLabz threat research team recently has spotted a new variant of the emerging X-FILES infostealer attack with enhanced features to exfiltrate sensitive information. X-FILES is a stealer that aims to steal sensitive information, including logins and financial data. This blog will walk through the differences between...
phishing attack
Insights and Research
20 Min read

Large-Scale AiTM Attack targeting enterprise users of Microsoft email services

Summary ThreatLabz has discovered a new strain of a large-scale phishing campaign, which uses adversary-in-the-middle (AiTM) techniques along with several evasion tactics. Similar AiTM phishing techniques were used in another phishing campaign described by Microsoft recently here. In June 2022, researchers at ThreatLabz observed an incr...
Analysis of Adobe Acrobat Reader Javascript Doc.print() Use-After-Free Vulnerability (CVE-2022-34233)
Insights and Research
3 Min read

Analysis of Adobe Acrobat Reader Javascript Doc.print() Use-After-Free Vulnerability (CVE-2022-34233)

In July 2022, Adobe released a security update for vulnerabilities in Adobe Acrobat and Reader. The update fixed a vulnerability that is identified as CVE-2022-34233 discovered by the Zscaler ThreatLabz research team. In this blog, we present our analysis of CVE-2022-34233, ​​a Use-After-Free vulnerability in Adobe Acrobat and Reader. Vulne...
Ransomware
Ransomware
8 Min read

Technical Analysis of Industrial Spy Ransomware

Industrial Spy is a relatively new ransomware group that emerged in April 2022. In some instances, the threat group appears to only exfiltrate and ransom data, while in other cases they encrypt, exfiltrate and ransom data. Industrial Spy started as a data extortion marketplace where criminals could buy large companies' internal data; they promoted ...
insight and research
Insights and Research
9 Min read

Raccoon Stealer v2: The Latest Generation of the Raccoon Family

Introduction Raccoon is a malware family that has been sold as malware-as-a-service on underground forums since early 2019. In early July 2022, a new variant of this malware was released. The new variant, popularly known as Raccoon Stealer v2, is written in C unlike previous versions which were mainly written in C++. The Raccoon Malware is a ...
A digital network
Insights and Research
4 Min read

AWS IAM Roles Anywhere ~ IAM Risks Anywhere?

AWS recently announced a new revolutionary Identity and Access Management (IAM) feature - IAM Roles Anywhere. This feature allows workloads (or any certificate holding entity, for that matter) outside the AWS account (on-prem or in other clouds), to assume a role (obtain temporary credentials for a role) in your AWS account and access AWS resources...
/blogs/security-research/joker-playing-hide-and-seek-google-play
Insights and Research
11 Min read

Joker, Facestealer and Coper banking malwares on Google Play store

Google Play Store is typically considered to be one of the safest sources for users to find and install android apps. However, threat actors continue to evolve their tactics and are able to successfully upload dangerous apps laced with malware on the Google play store. Recently, the Zscaler ThreatLabz team discovered apps involving multiple ins...
malware designed to steal passwords.
Insights and Research
11 Min read

Rise in Qakbot attacks traced to evolving threat techniques

Active since 2008, Qakbot, also known as QBot, QuackBot and Pinkslipbot, is a common trojan malware designed to steal passwords. This pervasive threat spreads using an email-driven botnet that inserts replies in active email threads. Qakbot threat actors are also known to target bank customers and use the access they gain through compromised creden...
Advanced Persistent Threats
Insights and Research
15 Min read

Return of the Evilnum APT with updated TTPs and new targets

Summary Since the beginning of 2022, ThreatLabz has been closely monitoring the activities of the Evilnum APT group. We identified several instances of their low-volume targeted attack campaigns launched against our customers in the UK and Europe region. The new instances of the campaign use updated tactics, techniques, and procedures. In ear...

Explore More Topics