ESET Research

Two rough and ready phishing emails that nevertheless tell us a great deal about the social engineering underlying more sophisticated, graphic-rich scams.

Win32/Gapz's new bootkit technique modifies just 4 bytes of the original VBR, has an enhanced dropper and complex kernel mode functionality, and evades ELAM.

Win32/Gapz has a new technique for code injection and a new VBR infection method. The dropper has many tricks for bypassing detection by security software.

Apache modules are add-on code taking advantage of the Apache module API to extend the functionality of the standard Apache distro. In this case, the binary's functionality was malicious, but there is no exploitation of a known Apache vulnerability in this case.

Win32/Spy.Ranbyus shows how it is possible to bypass payment transaction signing/authentication with smartcard devices and has started to modify java code in one of the most popular remote banking systems (RBS) in the Ukraine.

More than half of all web servers on the Internet use Apache, so when we discovered a malicious Apache module in the wild last month, we were understandably concerned.

A hoax/chain message claiming that a well-known energy drink poses a serious threat to health, is now spreading on Facebook.