Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Unmasking SparkRAT: Detection & macOS Campaign Insights

hunt.io | blog | #threat-hunting | #macos | #dprk | #rat | #sparkrat | #c2-detection

Summary

Hunt.io details how to spot SparkRAT servers via default port 8000 and HTTP Basic auth banners, and examines a suspected DPRK macOS campaign tied to the Golang RAT's WebSocket C2 traffic.
Published
Collected

original ↗

Related coverage

blog · hunt.io
Spotting SparkRAT: Detection Tactics & Sandbox Findings
Hunt profiles SparkRAT, the Go-based RAT behind attacks tracked by Microsoft and AhnLab, with detection tips for its default port 8000 and login-page fingerprints.
incident · hunt.io
Breaking Down the Axios Supply Chain Attack: Dropper, Cross-Platform RATs, and BlueNoroff/TA444
Axios's npm maintainer account was hijacked to ship trojanized 1.14.1 and 0.30.4: an obfuscated dropper installed RATs for macOS, Windows and Linux, with C2 linked to DPRK's BlueNoroff/TA444.
blog · hunt.io
Malicious VSCode Extension Launches Multi-Stage Attack Chain with Anivia Loader and OctoRAT
A fake 'prettier-vscode-plus' extension on the official VSCode Marketplace delivered the Anivia loader and OctoRAT—a RAT with 70+ commands—in a supply-chain attack that rotated payloads.
blog · hunt.io
Odyssey Stealer & AMOS Hit macOS Developers with Fake Homebrew Sites
A macOS campaign targeting developers via fake Homebrew, TradingView and LogMeIn download portals delivered Odyssey Stealer and AMOS, with 85+ phishing domains tied to multi-year infrastructure.
blog · hunt.io
Clickfix on macOS: AppleScript Stealer, Terminal Phishing, and C2 Infrastructure
A macOS ClickFix campaign uses fake security prompts to push victims into running AppleScript via Terminal, stealing browser data, crypto wallets, and documents without any download.
blog · hunt.io
URLx Just Got Bigger: 10.6B URLs for Recon and Malicious Infrastructure Hunting
URLx expands to 10.6 billion URLs with richer SQL and domain-search filters; a walkthrough maps DPRK-linked compromised WordPress paths using API and SQL queries.
back