Thousands of ordinary small-business websites became malware delivery nodes. The next stage lived on a free blockchain testnet, and a newer variant hid its command channel inside WebRTC.
A fake verification prompt led to DLL sideloading, Active Directory reconnaissance and a reverse tunnel that turned one Windows endpoint into an internal network pivot.
Cruciferra combines ClickFix delivery, a signed vulnerable driver, signed Microsoft binaries and process hollowing to disable endpoint security and deploy an infostealer.
Attackers used npm packages as storage for fake verification pages rendered through trusted mirrors, turning legitimate CDN domains into phishing infrastructure.
AmnesiaStealer clones an authenticated Chromium profile, launches it in a hidden process and gives a remote operator live control from inside the infected Mac.
