ESET Research

2300 articles

Malware

Win32/Cridex: Java pushes Cyprus into a Blackhole

Malware

Win32/Cridex: Java pushes Cyprus into a Blackhole

Banking crisis in Cyprus is now being used in a spam campaign promoting the Blackhole exploit kit and the Win32/Cridex Trojan.

David Harley • 20 Mar 2013

Malware

Gapz and Redyms droppers based on Power Loader code

Malware

Gapz and Redyms droppers based on Power Loader code

Technical analysis of Power Loader, a special bot builder for making downloaders for other malware families and yet another example of specialization and modularity in malware production.

Aleksandr Matrosov • 19 Mar 2013

Adobe and Microsoft release critical patches for March

Adobe and Microsoft have both released patches this week to address vulnerabilities in respective software applications and advise all users to apply the patches as soon as possible, if applicable to them.

Rob Waugh • 14 Mar 2013

Scams

Phishbait: not so much a Smile as a rictus

Scams

Phishbait: not so much a Smile as a rictus

David Harley • 13 Mar 2013

Malware

How Theola malware uses a Chrome plugin for banking fraud

Malware

How Theola malware uses a Chrome plugin for banking fraud

A deep dive into Win32/Theola, one of the most malicious components of the notorious bootkit family, Win32/Mebroot.FX. Theola uses malicious Chrome browser plugins to steal money.

Aleksandr Matrosov • 13 Mar 2013

Malware

Sinkholing of Trojan Downloader Zortob.B reveals fast growing malware threat

Malware

Sinkholing of Trojan Downloader Zortob.B reveals fast growing malware threat

Malware infecting 25,000 computers, mostly in the United States, pumping out 80 million spam messages per hour? ESET researchers sinkhole to investigate Win32/TrojanDownloader.Zortob.B

Sébastien Duquette • 08 Mar 2013

Scams

Hundreds of thousands of Facebook likes can certainly be wrong

Scams

Hundreds of thousands of Facebook likes can certainly be wrong

David Harley • 06 Mar 2013

Malware

Caphaw attacking major European banks using webinject plugin

Malware

Caphaw attacking major European banks using webinject plugin

Analysis of malicious code dubbed Win32/Caphaw (a.k.a. Shylock) attacking major European banks, with ability to automatically steal money when the user is actively accessing his banking account.

Aleksandr Matrosov • 25 Feb 2013

Malware

Code certificate laissez-faire leads to banking Trojans

Malware

Code certificate laissez-faire leads to banking Trojans

Technical analysis of malware that abuses code signing certificates normally used to positively identify a software publisher and to guarantee code is unchanged.

Jean-Ian Boutin • 21 Feb 2013