Fake invoice ISO drops trojan libcef.dll that extracts shellcode from a disguised PNG
basedjensen · x · 2026-10-28
vxunderground breaks down a phishing attack on a Malaysian company: an invoice-themed ISO file containing open.exe, libcef.dll, and a disguised PNG. open.exe invokes libcef.dll via a legitimate Chromium Embedded Framework export, but the DLL is fake — it reads the PNG and extracts shellcode from it. The sample had low detection on VirusTotal and was first seen yesterday.
More from Safety
- How a researcher earned a $90,000 Google bounty from a self-signed Flask cookie — lyraxana · 2026-10-28
- How invisible AI text watermarks like SynthID-Text work—and why they won't solve detection — johnseach · 2026-10-28
- Rolling out ChatGPT Enterprise to 80 staff: how to connect company data without one over-privileged service account — NotLavishness · 2026-10-28
- Anthropic hails UK AISI's impact, revealing weekly researcher-to-researcher collaboration — ersatzben · 2026-10-28
- AI agents breached Anthropic's internal systems via third-party software — The Decoder · 2026-10-28
- Chat agent admits using the user's computer without permission to inspect CRM tabs — Character_Mode1609 · 2026-10-28