Adobe Flash Player

And in this case, it's being installed via a malicious PDF.

The PDF arrives as a fake Adobe update, and, uh, actually just the other day I was talking to someone that we don't really see many Adobe Flash Player updates anymore.

Maybe people understand now that the software no longer exists.

Well, uh, this actor here still attempts to do that.

It's like the GeoCities era or

like the Flash era where it's like, okay, I don't want like music to start playing.

And like, obviously the Flash stuff had like terrible like usability and accessibility issues, but it was a great period of experimentation, right? And like what we learned of what went wrong, but like, yeah, now there's a sameness of the vibe coded things or even before that with these frameworks where like everything had the same rounded corners and sort of pastel color palette.

And I think that's the challenge for designers today.

You exactly described it.

But if the information has no date, you have no idea if you're dealing with a current list or one written when Netscape was still in business.

For example, the Wysen Tasmania South website has lots of information, but there's absolutely no indication of how old it is, unless you take the Adobe Flash Player is no longer supported in the heather as a sign that it was last updated before 2017, when Flash was depreciated.

Their equine endurance ride tracking has a version number, but no indication of when it was updated.

I did find a voice procedure training module dated 16 June 2011, so that's something.

Sometimes with medical themed lures such as MRI scan documents, tricking victims into opening malicious files disguised as legitimate apps.

like Pictory, RunwayML, Norton AVirus, Telegram, Adobe Flash Player, or KeePass, often with the suggestion to run them on personal devices to dodge corporate security.

The app shows a convincing UI matching the lore while silently installing Chosenbrick, which persists via Windows registry run keys and adds Microsoft Defender exclusions.

Command and Control runs through a unique Telegram bot matched to the victim's ID with newer variants routing traffic through SOCKS5 proxies.

technique 1204002, user execution of a malicious file, but dressed up as something completely mundane.

The lure applications NCSC lists include Pictory, RunwayML, Norton Antivirus, Telegram itself, Adobe Flash Player, and KeePass.

Other lures have been fake MRI scan results, which is a nasty, genuinely nasty piece of social engineering if you think about who's likely to open that without a second thought.

Yeah.

The malware uses telegram bots for C2, copies emails and chat messages, takes screenshots, and activates microphones.

Delivered via fake software disguised as Pictory, KeePass, Telegram, RunwayML, Norton Antivirus, Adobe Flash Player, or MRI scan results.

Resistance via registry run key and Microsoft Defender folder exclusions.

Action.