Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Hannibal Stealer: A Deep Technical Analysis

netlas.io | research | #malware | #credential-theft | #threat-analysis | #infostealer | #dotnet | #hannibal

Summary

A deep technical analysis of Hannibal Stealer based on leaked source: its lineage from Sharp and TX Stealers, modular design, expanded data targeting and configurable exfiltration.
Published
Collected

original ↗

Related coverage

blog · crowdstrike.com
PhantomRaven: An LLM-Generated Information Stealer Developed for Bug Bounty Hunting
CrowdStrike identified a financially motivated threat actor who works as a bug bounty hunter and who developed and distributed the JavaScript-based information stealer PhantomRaven.
blog · wiz.io
durabletask: TeamPCP's Latest PyPi Compromise
TeamPCP hit durabletask 1.4.1-1.4.3, Microsoft's Durable Task client: a hijacked account dumped a GitHub-stored PyPI token to push malware that steals credentials, spreading via AWS SSM.
blog · wiz.io
The Worm That Keeps on Digging: TeamPCP Hits @antv in Latest Wave
Wiz attributes the cross-ecosystem campaign to TeamPCP: @antv npm packages, actions-cool/issues-helper GitHub Action, and a VS Code extension steal credentials and drop a GitHub-polled backdoor.
blog · wiz.io
Supply Chain Campaign Targets SAP npm Packages with Credential-Stealing Malware
TeamPCP's 'Mini Shai Hulud' campaign trojanized SAP-related npm packages with preinstall scripts, later hitting intercom-client and lightning, harvesting Kubernetes, Vault, and cloud credentials.
blog · wiz.io
Three’s a Crowd: TeamPCP trojanizes LiteLLM in Continuation of Campaign
TeamPCP trojanized LiteLLM with malicious PyPI versions 1.82.7 and 1.82.8: the payloads abuse Python's .pth mechanism to run base64 payloads at startup, exfiltrating cloud and CI/CD credentials.
research · blog.quarkslab.com
How malware authors play with the LNK file format
A study of how malware abuses Windows LNK shortcut files for delivery, from Stuxnet's CVE-2010-2568 to today's macro-replacement campaigns by Qakbot, IcedID and Emotet.
back