Hello, a new specifically covered exploit kit
Summary: Cisco Talos reports an exploit kit, named HelloEk, that fingerprints Windows systems by checking a hard-coded list of installed fonts, MD5 hashing that list, and submitting the hash to a server that then selects among six exploits. The kit is appearing on compromised WordPress sites, verifies its JavaScript MD5 routine by hashing the string "hello", and has been formerly detected as the "LightsOut" exploit kit.
Why it matters: The kit's six exploit branches target Java below 1.7.17, Java below 1.6.32, and Internet Explorer 6, 7, and 8 on Windows versions below Vista - so any estate still carrying those versions is in the direct path of a kit that is actively spreading through compromised WordPress installs.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026