Cyberattackers are using MSIX, a Windows application packaging format, to infect PCs and evade detection by encrypting malware, titled Ghostpulse. Researchers at Elastic Security Labs suspect users are prompted to download malicious MSIX packages via breached websites or misleading adverts. By exploiting vulnerabilities in Notepad++, the attackers initiate a staged process in order to download Ghostpulse and other infostealers. The loader overwrites executed instructions to complicate analysis, and can establish persistence.
A division of United Healthcare, Change Healthcare, is dealing with the fallout of a cyber attack. This has heavily impacted the healthcare industry, affecting transactions