Threat Source newsletter (July 29, 2021)
Summary: Cisco Talos reports that Trickbot has re-emerged with increased command and control traffic after an attempted takedown, and now carries a new version of its "vncDll" module that creates a virtual desktop mirroring the target's screen to steal information. Talos also notes that Shlayer, which has targeted macOS users for at least three years, still lures victims with fake Flash Player update notifications and installs adware before fetching additional payloads.
What you should know: Trickbot's operators are actively patching and extending a module built to watch a victim's screen in real time, so a botnet that survived a takedown attempt is now better at intelligence gathering than it was before.
Read the original at Cisco Talos ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026