An Exploit Kit Was Sent To You
Summary: Cisco Talos described a spam campaign that impersonated an automated scanner notification, using a sample email claiming a document was sent from a "XEROX CORPORACE FSX43949461" with one JPEG image. Clicking the link led to heavily obfuscated JavaScript that displayed a "Loading...Please Wait..." page, then contacted a host in Russia over HTTP on port 8801 and downloaded files including "yrkrktxzfniq.exe," identified on VirusTotal as Worm.Cridex.
What you should know: The payload was a known worm, Worm.Cridex, pulled from a Russian host on port 8801, and Talos notes the kit was easy to detect with signature SID 21108 only because its obfuscation was blatant - the more complex kits like Blackhole are still being worked.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026