Check Point Research succeeded in understanding the infamous malware family, Xloader, by leveraging Generative AI

The Sublime Threat Research Team has uncovered a malicious SharePoint impersonation campaign delivering Xloader malware, also known as Formbook, through an intricate link-based attack. This sophisticated operation relied on brand... The post Xloader Malware Delivered via Sophisticated SharePoint Attack appeared first on Cybersecurity News.

A new malware loader called JinxLoader is being used by threat actors to deliver payloads such as Formbook and XLoader.

XLoader malware is spreading via Eclipse Jarsigner using DLL side-loading, evading detection with encrypted decoys and advanced obfuscation.

Through the use of XLoader and impersonating SharePoint notifications, researchers were able to identify a sophisticated malware delivery

sideloaded in order for the malware to run read more about Cybercriminals Use Eclipse Jarsigner to Deploy XLoader Malware via ZIP Archives

A malware campaign distributing the XLoader malware has been observed using the DLL side-loading technique by making use of a legitimate application associated with the Eclipse Foundation. "The legitimate application used in the attack, jarsigner, is a file created during the installation of the IDE package distributed by the Eclipse Foundation," the AhnLab SEcurity Intelligence Center (ASEC)

A previous macOS-oriented version of XLoader had some limitations. Researchers say the info-stealer now can run on more machines while potentially dodging detection.

チェック・ポイント・リサーチが、情報窃取型マルウェア「XLoader 8.0」の解析レポートを発表。AIを駆使した新しい分析手法で、迅速な脅威検知を実現した。詳細をお伝えします。