307 matches found
At long last, Microsoft is disabling Excel 4.0 macros by default
Sometimes good news in the security world comes unexpectedly. This is one of those times. After three decades of macro viruses, and three decades of trying to convince every single Excel user individually to disable macros, Microsoft is going disable Excel 4.0 macros for everyone. Better late tha...
FIN7 Capitalizes on Windows 11 Release in Latest Gambit
The FIN7 financial cybercrime gang is back, delivering JavaScript backdoors using Word documents themed around the next version of Windows. That’s according to researchers at Anomali, who observed a recent campaign from the group that leveraged six different docs, all referencing “Windows 11 Alph...
NK Hackers Deploy Browser Exploits on South Korean Sites to Spread Malware
A North Korean threat actor has been discovered taking advantage of two exploits in Internet Explorer to infect victims with a custom implant as part of a strategic web compromise SWC targeting a South Korean online newspaper. Cybersecurity firm Volexity attributed the watering hole attacks to a...
A week in security (July 26 – August 1)
Last week on Malwarebytes Labs: OSX.XLoader hides little except its main purpose: What we learned in the installation process. The Clubhouse database “breach” is likely a non-breach. Here’s why. Kaseya Unitrends has unpatched vulnerabilities that could help attackers expand a breach. UDP Technolo...
Hackers Exploit Microsoft Browser Bug to Deploy VBA Malware on Targeted PCs
An unidentified threat actor has been exploiting a now-patched zero-day flaw in Internet Explorer browser to deliver a fully-featured VBA-based remote access trojan RAT capable of accessing files stored in compromised Windows systems, and downloading and executing malicious payloads as part of an...
Crimea “manifesto” deploys VBA Rat using double attack vectors
This blog post was authored by Hossein Jazi. On July 21, 2021, we identified a suspicious document named "Манифест.docx" "Manifest.docx" that downloads and executes two templates: one is macro-enabled and the other is an html object that contains an Internet Explorer exploit. While both technique...
Microsoft Office Users Face Malware-Protection Bypass
Legacy users of Microsoft Excel are being targeted in a malware campaign that uses a novel malware-obfuscation technique to disable Office defenses and deliver the Zloader trojan. The attack, according to research published Thursday by McAfee, marries functions in Microsoft Office Word and Excel ...
Description of the security update for Office 2016: March 9, 2021 (KB4493225)
None None...
XLM + AMSI: New runtime defense against Excel 4.0 macro malware
We have recently expanded the integration of Antimalware Scan Interface AMSI with Office 365 to include the runtime scanning of Excel 4.0 XLM macros, to help antivirus solutions tackle the increase in attacks that use malicious XLM macros. This integration, an example of the many security feature...
March 2, 2021, update for Office 2016 (KB4493153)
None None...
March 2, 2021, update for Access 2016 (KB4493188)
None None...
How to Use Excel to Scrape a Website
By Owais Sultan There are two ways to use Excel as a scraper: the web queries method and the VBA method. Here is how to use Excel to scrape a website using each. This is a post from HackRead.com Read the original post: How to Use Excel to Scrape a Website...
ALERT: North Korean hackers targeting South Korea with RokRat Trojan
A North Korean hacking group has been found deploying the RokRat Trojan in a new spear-phishing campaign targeting the South Korean government. Attributing the attack to APT37 aka Starcruft, Ricochet Chollima, or Reaper, Malwarebytes said it identified a malicious document last December that, whe...
ALERT: North Korean hackers targeting South Korea with RokRat Trojan
A North Korean hacking group has been found deploying the RokRat Trojan in a new spear-phishing campaign targeting the South Korean government. Attributing the attack to APT37 aka Starcruft, Ricochet Chollima, or Reaper, Malwarebytes said it identified a malicious document last December that, whe...
Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat
This post was authored by Hossein Jazi On December 7 2020 we identified a malicious document uploaded to Virus Total which was purporting to be a meeting request likely used to target the government of South Korea. The meeting date mentioned in the document was 23 Jan 2020, which aligns with the...
January 5, 2021, update for Office 2016 (KB4493157)
None None...
January 5, 2021, update for Access 2016 (KB4484509)
None None...
Description of the security update for Excel 2016: December 8, 2020
None None...