A targeted phishing campaign delivering the Ousaban banking Trojan to users in Spain and Portugal, notable for its use of geofenced webpages, layered evasion techniques, and a modular delivery chain. The threat actor repurposes a playbook seen previously in Brazil but has refined access controls and server-side checks to ensure malware reaches only the intended […]

The post Hackers Use Geofenced Webpages to Deliver Ousaban Banking Trojan in Spain and Portugal appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A recent surge in ValleyRAT activity that combines RC4-encrypted payloads, Donut-generated shellcode, and in-memory execution via suspended rundll32 processes to evade detection. First named by Proofpoint in 2023, ValleyRAT continues to evolve: LevelBlue’s telemetry shows a marked increase in successful detections beginning May 2025 and accelerating into 2026. The threat now presents through two primary […]

The post ValleyRAT Uses RC4 Encryption, Donut Shellcode, and rundll32 Injection for Stealth appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

An incident that began with innocuous enumeration commands but quickly escalated into a focused, multi-stage effort to impair detection and extract credentials. The intruder uploaded a steganographic webshell to an IIS server, used the process w3wp.exe to run OS reconnaissance such as whoami, and then deployed an extensive defence-impairment script (i.bat) that prefaced a credential-dump […]

The post Attackers Downgrade WDigest Protection to Dump Plaintext Credentials With Mimikatz appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.