That “job brief” on Google Forms could infect your device Attackers are using malicious Google Forms linking to business-themed ZIP files (job interviews, project briefs, financial documents) to distribute a multi-stage infection chain that ultimately installs the PureHVNC .NET RAT. The campaign employs DLL hijacking, obfuscated Python/Donut shellcode, scheduled tasks and process injection (into SearchUI.exe) while using services like Dropbox and...

Attackers use malicious Google Forms to distribute multi-stage PureHVNC RAT infections disguised as job briefs or financial files. Techniques include DLL hijacking, process injection, and cloud hosting. #PureHVNC #RATAttack #InfoSec

#xworm #asyncrat #purehvnc at:

https:// locale-respondent-realtor-excellent.trycloudflare\\.com

Cybercriminals are exploiting judicial documents to deploy PureHVNC RAT in Latin America. Stay vigilant against phishing emails impersonating legal authorities. #CyberSecurity #Phishing #PureHVNC Link: thedailytechfeed.com/hackers-targ...

Developers of PureHVNC RAT Leverage GitHub to Host Source Code for the Pure Malware Family Cybersecurity researchers at Check Point have uncovered a sophisticated malware ecosystem where threat act...

#Cyber #Security #News #PureHVNC #RAT

Origin | Interest | Match

FortiGuard scopre campagna phishing con UpCrypter che distribuisce RAT e colpisce aziende con allegati HTML e tecniche avanzate di offuscamento.

#babylonrat #dcrat #FortiGuardLabs #PureHVNC #RAT #UpCrypter #windows
www.matricedigitale.it/2025/08/26/c...

📖 Full breakdown:
www.technadu.com/upcrypter-ph...

❓ Discussion: Do you think enterprises are prioritizing RAT-focused phishing defenses enough, or still too email-filter centric?
#UpCrypter #Phishing #DCRat #BabylonRAT #PureHVNC #Steganography #MalwareCampaign #CyberThreats

Guess we're back to these...:
episode-windsor-subdivision-delivery.trycloudflare\\.com
lol-julian-impossible-bermuda.trycloudflare\\.com
italia-committees-practical-violence.trycloudflare\\.com

#asyncrat #purehvnc #quasarrat

jskeywon […]

[Original post on infosec.exchange]

@netresec

>PureRAT is the exact same malware as what Morphisec and others call ResolverRAT. PureHVNC, on the other hand, is the predecessor to PureRAT.
IOCs:
👾 193.26.115.125:8883
👾 purebase.ddns[.]net:8883
👾 45.74.10.38:56001
👾 139.99.83.25:56001
https://netresec.com/?b=2589522

PureHVNC RAT Remove PureHVNC RAT - Stealthy Remote Access Trojan Exploiting AI-Themed Social Engi...

www.rivitmedia.com/cyberthreats/malware/pur...

#Malware #Trojans #hVNC #malware #PureHVNC #cryptocurrency #theft #PureHVNC #cybersecurity #PureHVNC #damage

Result Details