NewApp Digest
search bot

detection methods

Android malware Albiriox abuses 400+ financial apps in on-device fraud and screen manipulation attacks
AppWizard
December 1, 2025

Android malware Albiriox abuses 400+ financial apps in on-device fraud and screen manipulation attacks

A new malware-as-a-service (MaaS) called Albiriox has emerged, targeting banking and cryptocurrency applications, particularly focusing on Austrian users. It is marketed on the dark web and employs deceptive tactics, such as mimicking legitimate businesses and creating fake landing pages and app listings on the Google Play Store. Victims are tricked into providing their phone numbers, leading to the delivery of a malicious APK file via SMS or WhatsApp. This APK acts as a dropper, designed to bypass detection methods and requests permissions under the guise of a “software update” to download the actual malicious payload. Once installed, it can take control of the device or function as an infostealer, extracting sensitive information like phone numbers and passwords, which is sent to a Telegram channel. Cleafy researchers suggest that the Albiriox campaign is linked to Russian cyber actors based on their activities on cybercrime forums and communication style.
Why Aren’t Antivirus Programs Enough To Protect Crypto?
Tech Optimizer
October 24, 2025

Why Aren’t Antivirus Programs Enough To Protect Crypto?

Cryptocurrency has introduced a decentralized approach to financial transactions, but it faces significant security challenges, including vulnerability to cyberattacks, theft, and fraud. Traditional antivirus software has limitations, such as reliance on signature-based detection, which struggles against emerging and polymorphic malware. Behavioral detection methods also have shortcomings, as stealth malware can disguise itself and conditional activation can evade detection. Fileless malware techniques and human error, such as phishing and weak password hygiene, further complicate security. To enhance security, cryptocurrency users should adopt a multi-layered strategy that includes using hardware wallets for offline storage of private keys, implementing multi-factor authentication (MFA), and utilizing dedicated anti-malware tools. Safe browsing habits and regular software patches are also essential, along with securely backing up private keys.
Luma Infostealer Malware Launches Attacks to Steal Browser Cookies, Cryptocurrency, and Remote Access Accounts
Tech Optimizer
October 21, 2025

Luma Infostealer Malware Launches Attacks to Steal Browser Cookies, Cryptocurrency, and Remote Access Accounts

Lumma Infostealer is a sophisticated information-stealing malware that targets high-value credentials and sensitive assets on Windows systems. It is distributed through a Malware-as-a-Service (MaaS) model, allowing inexperienced attackers to conduct data theft campaigns. Lumma is primarily deployed via phishing campaigns disguised as cracked or pirated software, often hosted on legitimate platforms like MEGA Cloud. Upon execution, Lumma uses a multi-stage decryption process and process injection techniques to activate its payload while evading detection. The latest samples utilize the Nullsoft Scriptable Install System (NSIS) as a deceptive installer, extracting malicious payloads into the %Temp% directory and launching a counterfeit document that triggers a sequence of commands to deploy Lumma’s core. Once activated, Lumma communicates with command-and-control servers (including rhussois[.]su, diadtuky[.]su, and todoexy[.]su) to gather stored browser credentials, session cookies, Telegram data, remote access configuration files, and cryptocurrency wallet information, which is then exfiltrated for exploitation. The malware avoids detection by checking for security solutions and has a modular architecture that complicates signature-based detection. Effective detection requires behavior-based Endpoint Detection and Response (EDR) systems that monitor real-time activities. To mitigate exposure, security professionals recommend avoiding storing credentials in browsers, enforcing multi-factor authentication (MFA), and monitoring suspicious processes. Indicators of Compromise (IoC) include: - E6252824BE8FF46E9A56993EEECE0DE6 - E1726693C85E59F14548658A0D82C7E8 - 19259D9575D229B0412077753C6EF9E7 - 2832B640E80731D229C8068A2F0BCC39 Command-and-control domains include: - diadtuky[.]su - rhussois[.]su - todoexy[.]su
Prelude: $16 Million Raised For Endpoint Security Technology
Tech Optimizer
October 1, 2025

Prelude: $16 Million Raised For Endpoint Security Technology

Prelude Security has secured a significant funding round led by Brightmind Partners, with participation from Sequoia Capital and Insight Partners, bringing its total funding to an impressive amount. The funding will primarily focus on launching Prelude's runtime memory protection technology, which aims to detect and neutralize malicious code during execution. This technology addresses vulnerabilities in current cybersecurity defenses, as around 75% of advanced cyberattacks operate within memory, bypassing traditional detection methods. Prelude's solution utilizes hardware-level telemetry to monitor out-of-context code execution in user mode, aligning with Microsoft’s Windows Resiliency Initiative. The company’s existing capabilities support customers in monitoring and validating endpoint security tools, enhancing resilience against malware. The technology aims to reduce response times to ransomware attacks and improve defense against modern cybercriminal tactics.
New type of ransomware created with AI shows how easy it is to evade antivirus detection now
Tech Optimizer
August 29, 2025

New type of ransomware created with AI shows how easy it is to evade antivirus detection now

Researchers from SlashNext have revealed a new ransomware variant developed using artificial intelligence, which was discussed at the Black Hat USA conference. This ransomware can be created quickly using generative AI platforms, allowing attackers to bypass traditional coding methods and evade detection by standard antivirus solutions. In tests, the AI-generated ransomware successfully circumvented most major security suites, posing significant threats to financial institutions, businesses, and everyday users. The malware can modify its structure with each execution, complicating traditional detection methods. Unlike previous ransomware, this variant can be assembled in hours or days. The accessibility of AI tools enables individuals with limited coding skills to create sophisticated malware, challenging the belief that technical barriers deter attackers. Companies and IT teams are urged to reevaluate their cybersecurity strategies, as conventional antivirus tools may no longer suffice. Security professionals should monitor for unusual behaviors and invest in automated detection systems that utilize machine learning.
AI Boosts Ransomware Attacks 70%, Fueling Cybersecurity Arms Race
Tech Optimizer
August 27, 2025

AI Boosts Ransomware Attacks 70%, Fueling Cybersecurity Arms Race

Ransomware is being enhanced by artificial intelligence, with cybercriminals using generative AI tools to create sophisticated malware. A notable example is PromptLock, identified as the first fully AI-driven ransomware, discovered on August 27, 2025. It utilizes OpenAI’s gpt-oss-20b model to dynamically generate malicious code, complicating detection efforts. ESET's analysis indicates that PromptLock processes operations locally on the victim's device, minimizing external communications and reducing its digital footprint. The first half of 2025 saw a 70% increase in ransomware victims, largely due to AI-enhanced phishing campaigns. Akamai Technologies reported a 37% increase in ransomware incidents in 2024, fueled by generative AI. Governments are beginning to respond with regulations for quicker breach disclosures, and cybersecurity experts emphasize the need for continuous monitoring and adaptive defenses.
Understanding polymorphic malware: A comprehensive guide
Tech Optimizer
August 8, 2025

Understanding polymorphic malware: A comprehensive guide

Polymorphic malware is a type of malicious software that can change its code structure while maintaining its core functionality, making it difficult for traditional signature-based antivirus solutions to detect. It uses a mutation engine to create new variants by altering its code through techniques like code obfuscation, encryption, and junk code insertion. There are several categories of polymorphic malware, including polymorphic viruses, trojans, rootkits, and ransomware, each with unique characteristics. Detection of polymorphic malware is challenging due to its ability to evade conventional methods, prompting the use of behavioral analysis and machine learning for identification. To protect against such threats, a multi-layered security approach is recommended, including regular software updates, network segmentation, and employee training. Real-world examples like the Storm Worm and Conficker worm illustrate the significant impact of polymorphic malware, which has caused substantial financial losses. As cybersecurity measures advance, polymorphic malware continues to evolve, incorporating artificial intelligence and machine learning, leading to new challenges for security professionals. Cloud-based security solutions are emerging as effective tools to combat these threats.
North Korea Hiding Malware Within JPEG Files to Attack Windows Systems Bypassing Detections
Winsage
August 4, 2025

North Korea Hiding Malware Within JPEG Files to Attack Windows Systems Bypassing Detections

Security researchers at Genians Security Center discovered a new variant of the RoKRAT malware linked to the North Korean APT37 threat group. This malware uses steganography to hide malicious payloads within JPEG files, allowing it to evade traditional antivirus detection. It is typically distributed through malicious shortcut files within ZIP archives, often disguised as legitimate documents. The malware employs a two-stage encrypted shellcode injection method, utilizing PowerShell and batch scripts to execute its payloads in memory. It collects system information, documents, and screenshots, exfiltrating data via compromised cloud APIs. The command and control accounts associated with the malware are linked to Russian email services. Variants of RoKRAT have evolved to include different injection methods and reference specific PDB paths. Indicators of compromise include various MD5 hashes associated with the malware.
Search