Gotta be SWIFT for this Spam Campaign!
Summary: Cisco Talos found 3,305 unique malicious JavaScript samples across 137,000 emails in a spam campaign that used a "swift" naming convention, delivered the .js inside .zip archives, and spoofed sender profiles such as 'CEO' or 'VP of Sales' with mail-merged salutations. Once executed, the JavaScript used wscript.exe to send HTTP GET requests to as many as 9 command-and-control domains, downloaded a binary, and encrypted local files with the .zepto extension before presenting _HELP_instructions ransom screens.
What's compelling: The campaign's lure was a spoofed executive title and a personalized greeting, and the payload ran through wscript.exe - a signed Windows component - so the email filter and the endpoint both had to be right for this to be stopped.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026