Exploit kits, they sure do like to change ports
Summary: Following the arrest of the author of the Blackhole and Cool exploit kits, Cisco Talos reports that Magnitude, also known as Popads, appears to be the leading exploit kit, having recently been used in the php.net hack where an embedded iframe pointed visitors to a Magnitude/Popads instance. Over the past week, Talos observed Magnitude/Popads running on ports 56712, 44440, 51423, and 33300.
Bottom line: The kit rotates its ports frequently, so a firewall or proxy rule pinned to a single port will miss it; Talos lists four ports from just the past week for defenders to search in outbound logs.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026