ThreatsDay: Ransomware Affiliate Betrayal, WhatsApp RAT, Exposed Hacker Tools and 12 More Stories
Multiple threats emerge: malicious VS Code extensions, a new Windows RAT via WhatsApp, and exposed hacker tools.
This week's ThreatsDay bulletin highlights several security concerns, including malicious VS Code extensions like 'Coca-Cola Christmas' and 'Aurora Borealis Studio Theme' that hide Windows downloaders and use Solana transaction memos for C2. A new Windows RAT, VulcanRAT207.A, is being distributed via WhatsApp using a financial document lure and employs a BYOVD technique to disable security software. Additionally, the BraZetsu malware framework's C2 infrastructure was mapped, revealing its connection to the Infected Marketplace.
AI summary of the linked source. Not reviewed by an editor. How this works
Run VS Code?
Get an email when a new story names VS Code, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers are increasingly weaponizing trusted developer tools and consumer platforms — such as VS Code extensions and WhatsApp — to deliver malware, bypassing traditional perimeter defenses by exploiting implicit user trust. The use of Solana blockchain transaction memos for command-and-control represents a sophisticated evasion technique that subverts conventional network monitoring. The BYOVD (Bring Your Own Vulnerable Driver) technique employed by VulcanRAT207.A demonstrates how threat actors actively disable security tooling before operating, reducing detection chances significantly. Organizations that treat software extensions and messaging apps as low-risk vectors remain especially exposed to these blended attack chains.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — c2.installscenter[.]com
- domain — painel.installscenter[.]com
- ip — 80.78.27[.]252
- malware — GlassWorm
- malware — BraZetsu
- malware — VulcanRAT207.A
- mitre_attack — T1204.002
- mitre_attack — T1071.001
- mitre_attack — T1055.012
- mitre_attack — T1574.002
- mitre_attack — T1555.003
- mitre_attack — T1027
- mitre_attack — T1140
- mitre_attack — T1211
- mitre_attack — T1562.001