Visual Basic Script

Researchers have spotted a new twist on the ClickFix scam, which tricks people into pasting malicious commands into the Windows run box.

This version stashes a VBScript payload inside the browser's cache to slip past the run box's character limit, letting attackers deliver a far larger and more capable payload than the trick usually allows.

Red Hat, now an IBM subsidiary, says its Lightwell project has remediated four hundred vulnerabilities across open source software, with the fixes pushed back to the upstream project that countless companies rely on.

Red Hat also opened its Lightwell clearing house to all customers, giving them one place to see which patches are ready to deploy.

Exactly.

But with browser cache smuggling, the attackers compromise a legitimate website, and they configure it to prefetch a malicious script, usually like a VBScript payload.

Okay.

But they serve that script disguised with a .png image mime type.

Researchers at Securonix have uncovered TaskStomp, a Windows backdoor campaign designed to steal business documents and maintain resilient remote access.

The malware uses VBScript, PowerShell, Task Scheduler, and the Windows startup folder to establish multiple persistence mechanisms that can restore one another if disrupted.

It also alters file timestamps to make malicious components appear older.

Its PowerShell payloads run in memory, search drives for documents and archives, and upload them to attacker-controlled infrastructure.

A second payload provides a redundant command and control channel.

Securonix hasn't identified the initial infection vector or attributed the campaign to a known threat group.

Researchers recommend watching for combinations of unusual PowerShell, VBScript, and scheduled task activity.

A joint advisory from Japan, the US, Australia, and Germany has attributed a global fake recruiting campaign to the North Korean group Water Plum, also known as Contagious Interview.

Exactly.

Once that runtime is established, the installer launches the main Chainscript agent through a series of hidden PowerShell and VBScript stages.

Sneaky.

Very

And so, I mean, unfortunately, this Green Connect, you could basically pass it files for execution.

And they were using VBScript to move laterally.

They would find connections and active sessions and take them over.

And Huntress wrote a really interesting blog about this.