Threat Research

Our researchers recently identified AI-themed websites being used to distribute malware. Threat actors are leveraging the popularity of tools like ChatGPT and Luma AI to lure users. These malicious sites, often built on WordPress, are optimized to rank in search engines and attract traffic....

A stealthy web campaign is hijacking users' clipboards to trick them into executing MSI files tied to Legion Loader malware. These MSI files are disguised as "Klio Verfair Tools," a known alias for Legion Loader. The technique, known as "pastejacking" or "clipboard hijacking," instructs users to paste malicious content into the Run window....