Angler Attempts to Slip the Hook
Summary: Cisco Talos documented changes to the Angler exploit kit, including new landing page file names such as view.php and viewthread.php and altered parameters like "keyword=" replacing "keywords=" and "mod=" replacing "action=". Talos also described a new gate that returns a Flash file via GET request and then redirects to the exploit kit, with gate domains hosted on IP 85.93.0.33, many using free .tk domains, and one actor using the registrant name "MAYKO EVGENIY" who registered 737 domains since February 11, more than 95% in the .top TLD.
Why it matters: Talos notes these organizations generate millions of dollars monthly, and that exploit kits remain an effective conduit for compromising users and dropping ransomware, so small syntax changes like "keyword=" versus "keywords=" can break detection while the infrastructure keeps scaling.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026