Zero-Dwell Threat Intelligence Reports

Spreader-Enabled Lumma/Stealc Dropper Persists to ProgramData ADS.exe

64bits long-sleeps idle spreader persistence

AgentTesla Variant Performing IP Recon via checkip.dyndns.org.exe

signed executes-dropped-file bobsoft revoked-cert

Browser-Focused Stealer Uses PowerShell Exclusions and Shellcode.exe

shellcode

64-bit Keylogger Using Telegram/Smtp Indicators and Temp SFX Paths.exe

64bits

Confuser-Protected ClipBanker Injects into Browsers to Capture Clipboard.exe

assembly

MSIL/Formbook Hybrid Communicating Through Telegram and checkip.dyndns.org.exe

spreader assembly

Overlay-Packed SFX Drops Secondary Payloads and Modifies Autorun.exe

signed overlay

Spreader-Enabled Lumma Binary Using WMI Calls and DPAPI Access.exe

calls-wmi spreader executes-dropped-file persistence

Heracles/Mardom Dropper Harvests Clipboard and Browser Credentials.exe

long-sleeps calls-wmi spreader checks-bios clipboard

Courier-Themed Installer Executes FormBook Payload and Contacts C2.exe

upx

Convagent Variant Harvests Browser Credentials and Exfiltrates Over C2.exe

long-sleeps calls-wmi spreader assembly checks-bios

Game-Crack Installer Adds Defender Exclusions and Beacons to IP Lookup APIs.exe

checks-user-input executes-dropped-file obfuscated