An updated version of a malware loader, known as Hijack Loader, has been discovered with new features aimed at evading detection and maintaining persistence. The information-stealing malware uses methods including call stack spoofing to hide the origin of function calls and perform anti-VM checks to detect malware analysis environments. Cybersecurity community is keeping track of Hijack Loader’s evolution, which had previously used legitimate code-signing certificates and a now infamous ClickFix strategy for distribution.
New Triada comes preinstalled on Android devices
A new variant of the Triada Trojan has been discovered pre-installed on Android devices, enabling data theft from the moment the device is set up,
