SmartLoaderMalware
Last reported 8 days ago, by Help Net Security2 reports
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1036Masquerading
“CL-STA-1178: An Iranian state-aligned threat actor has been masquerading as the Dubai Airports IT department to deliver trojanized coding challenges to high-value targets.”
- T1110.004Credential Stuffing
“…omino's Pizza cred-stuffing attack: Domino's Pizza is contacting users and urging them to change their password after suffering a credential-stuffing attack that compromised their accounts this month.”
- T1552.004Private Keys
“GoBalance bug exposes onion private keys: A vulnerability in the GoBalance load balancer can allow hackers to retrieve the private keys of Onion dark web services.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Stolen AI API keys are paying for hackers’ autonomous scans“… are dissecting FakeGit, a campaign attributed to the actor Water Kurita in which roughly 7,600 fraudulent GitHub repositories spread SmartLoader malware.”
-
Risky Bulletin: ShinyHunters suspects arrested in US and Jordan“FakeGit returns: Security researchers have found 17,610 GitHub repositories that are infecting users with the SmartLoader malware.”
Indicators in its reports
named in the reports above- sonechkoflea.bsky[.]socialin 1 report
- angrystaffer.bsky[.]socialin 1 report
- eliothiggins.bsky[.]socialin 1 report
- specialkhersoncat.bsky[.]socialin 1 report
- hxxps://bsky[.]app/profile/bsky.realhackhistory.org/post/3mxe77s6jpc23in 1 report
Copy these 5 indicators · defanged
Thanks — we review every report.