Malware

DarkMe

Indicators of Compromise 7

Domain adminmenueditor[.]com Filename dist/node/payload.js Filename dist/node/utils.js Filename wp-user-consent.php Package js-logger-pack Package terminal-logger-utils Package ulid-xyz

MITRE ATT&CK TTPs 9

T1059.001
PowerShell
Execution
 T1071.001
Web Protocols
Command And Control
 T1078
Valid Accounts
Defense Evasion
 T1134
Access Token Manipulation
Defense Evasion
 T1202
Indirect Command Execution
Defense Evasion
 T1211
Exploitation for Defense Evasion
Defense Evasion
 T1566
Phishing
Initial Access
 T1574.002
DLL Side-Loading
Persistence
 T1574.010
Services File Permissions Weakness
Persistence

Source Articles

ThreatsDay: AI Search Poisoning, AI Coding Tool Leaking Repos, One-Click Code Execution and 13 More Stories
The article details multiple active cyber threats, including the RemControl Android banking trojan targeting users in Western Europe, the Middle East, and Canada via fake Google Play Store pages distributed through Meta ads. The malware abuses Android Accessibility Services to perform screen streaming, keystroke logging, and remote control, with command-and-control infrastructure dynamically resolved through encrypted Telegram dead-drops. Phishing overlays and operator panels show signs of AI-assisted development, and Russian-language code comments suggest Russian-speaking involvement. The campaign shares infrastructure and tactics with the Medusa UNKN affiliate botnet, indicating a coordinated threat operation.
hacker-news ·4h ago