Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

SEO Poisoning Campaigns Target Browser Installers and Crypto Sites, Spreading Poseidon, GhostRAT & More

hunt.io | blog | #macos | #malvertising | #signal | #seo-poisoning | #tradingview | #ghostrat | #poseidon

Summary

Hunt.io exposes SEO-poisoned lookalike sites pushing trojanized installers for Sleipnir, Signal and TradingView—including a macOS DMG with a Poseidon stealer and GhostRAT on a crypto-themed portal.
Published
Collected

original ↗

Related coverage

blog · hunt.io
Odyssey Stealer & AMOS Hit macOS Developers with Fake Homebrew Sites
A macOS campaign targeting developers via fake Homebrew, TradingView and LogMeIn download portals delivered Odyssey Stealer and AMOS, with 85+ phishing domains tied to multi-year infrastructure.
blog · hunt.io
Clickfix on macOS: AppleScript Stealer, Terminal Phishing, and C2 Infrastructure
A macOS ClickFix campaign uses fake security prompts to push victims into running AppleScript via Terminal, stealing browser data, crypto wallets, and documents without any download.
blog · hunt.io
630K gov.br Subdomains Abused in SEO Poisoning Attack
Over 630,000 hijacked .gov.br URLs funnel search traffic to gambling and scam pages in a black hat SEO campaign run from a single server with templated HTML and automation scripts.
blog · hunt.io
Malicious Signal, Line, and Gmail Installers Target Chinese-Speaking Users with Backdoors
Fake download pages on a Hong Kong server distribute backdoored Signal, Line, and Gmail installers to Chinese-speaking users, relying on search engine manipulation rather than lookalike URLs.
blog · hunt.io
Unmasking SparkRAT: Detection & macOS Campaign Insights
Hunt.io details how to spot SparkRAT servers via default port 8000 and HTTP Basic auth banners, and examines a suspected DPRK macOS campaign tied to the Golang RAT's WebSocket C2 traffic.
blog · hunt.io
Rekoobe Backdoor Discovered in Open Directory, Possibly Targeting TradingView Users
Hunt.io unearths APT31-linked Rekoobe backdoor samples in an open directory, pivoting via shared SSH keys to TradingView-lookalike domains that suggest the trading community is in the crosshairs.
back