Cyberattackers are using MSIX, a Windows application packaging format, to infect PCs and evade detection by encrypting malware, titled Ghostpulse. Researchers at Elastic Security Labs suspect users are prompted to download malicious MSIX packages via breached websites or misleading adverts. By exploiting vulnerabilities in Notepad++, the attackers initiate a staged process in order to download Ghostpulse and other infostealers. The loader overwrites executed instructions to complicate analysis, and can establish persistence.
FBI removed PlugX malware from U.S. computers
The FBI, in collaboration with international partners, successfully deleted “PlugX” malware from infected computers globally. The Chinese government-funded hacking group, “Mustang Panda,” that used a
