Welcome Spelevo: New exploit kit full of old tricks
Summary: Cisco Talos detailed a new exploit kit called Spelevo, delivered through a compromised business-to-business website where attackers added only four lines of code that redirected visitors through a gate at ezylifebags[.]com[.]au to a landing page probing for vulnerable Flash and Internet Explorer versions. The kit exploited CVE-2018-15982 for Flash or CVE-2018-8174, a VBScript use-after-free patched since May 2018, then delivered IcedID and Dridex banking trojans and redirected victims to Google after compromise.
Bottom line: The entire infection chain hinged on one unpatched system running Internet Explorer, and the post-compromise redirect to Google was designed to keep victims from noticing they had been compromised at all.
Read the original at Cisco Talos ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026