Cyberattackers are using MSIX, a Windows application packaging format, to infect PCs and evade detection by encrypting malware, titled Ghostpulse. Researchers at Elastic Security Labs suspect users are prompted to download malicious MSIX packages via breached websites or misleading adverts. By exploiting vulnerabilities in Notepad++, the attackers initiate a staged process in order to download Ghostpulse and other infostealers. The loader overwrites executed instructions to complicate analysis, and can establish persistence.
North Korean Hackers Use Fake U.S. Companies to Spread Malware in Crypto Industry: Report
North Korean hackers reportedly set up shell companies in the US to penetrate the crypto sector and target developers via fake job offers, according to
