other

BoundSiphon

.NET credential and cryptocurrency stealer that runs primarily from memory and targets Chromium and Firefox browser data, password manager material and selected documents, including secrets held under Chromium App-Bound Encryption.

Current clusters

security2 publishers

Compromised Ukrainian business sites are serving a ClickFix lure that installs through msiexec

Arctic Wolf Labs found injected iframes on real Ukrainian business sites showing a Ukrainian-language fake Cloudflare check that copies a Windows Installer command for the visitor to paste into Run. Its exposed panel logged 557 views.

Publishers:arcticwolf.comthehackernews.com

Reality

Evidence70
Adoption42
Hype gap+5
Incentives62
Confidence66