May 28, 05:36 PM

Venom RAT Spread via Fake Antivirus Site Uses Corrupted Headers, Fortinet Finds Session Hijacking on Microsoft 365, AWS, Slack

Cybersecurity researchers have identified a new wave of sophisticated malware campaigns targeting users through deceptive methods. A fake antivirus website has been used to distribute the Venom Remote Access Trojan (RAT) alongside other malware strains. This RAT employs corrupted DOS and PE file headers to evade detection, allowing it to operate unnoticed for weeks. Fortinet and other security analysts have highlighted that this malware can convert infected PCs into remote access hubs supporting multiple attacker sessions. Additionally, attackers have shifted tactics from traditional password theft to session hijacking, enabling them to gain live access to platforms such as Microsoft 365, AWS, and Slack without needing passwords or multi-factor authentication. Analysis of over 20 million stealer logs by Flare reveals the rapid pace and evolving nature of these attacks, underscoring the need for enhanced cybersecurity measures to counter these emerging threats.

#Venom Remote Access Trojan #RAT #DOS #PE #Fortinet #Microsoft 365 #AWS #Slack #Flare

Written with ChatGPT (GPT-4).

Sources

Additional media

Image #1 for story venom-rat-spread-via-fake-antivirus-site-uses-corrupted-headers-fortinet-finds-73ef6c11