Styx Exploit Pack: Domo Arigato, PC Roboto

Summary: The Styx exploit pack, a malware-as-a-service kit priced at $3,000 with a 24-hour help desk and public marketing at styx-crypt[dot]com, was examined in an installation set up on June 24, 2013 that infected roughly 13,300 Windows PCs at a rate of about one in ten visitors. That installation used just four exploits - numbered 11, 12, 13 and 32, mapped by blogger Kafeine to Java flaws CVE-2013-1493, CVE-2013-2423 and CVE-2013-0422 plus the Microsoft font flaw CVE-2011-3402 - and reported infections on Internet Explorer users overwhelmingly, a handful of Firefox users, and not a single Chrome user.
What's compelling: A kit that infects one in ten visitors while its author openly states it does not work against Chrome shows that browser choice and patch currency, not perimeter defenses, decided who got hit here - and the Gameover ZeuS crew Kafeine describes simply redirects Chrome users to a fake browser-update page instead.

Read the original at Krebs on Security ↗

Topics: Data Breaches
Mentions: CVE-2011-3402 CVE-2013-0422 CVE-2013-1493 CVE-2013-2423
Related: CVE-2011-3402: Microsoft Windows Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Oct 06, 2025
CVE-2013-0422: Oracle JRE Remote Code Execution Vulnerability Known Exploited Vulnerabilities · May 25, 2022
CVE-2013-2423: Oracle JRE Unspecified Vulnerability Known Exploited Vulnerabilities · May 25, 2022