Product
QuickBooks
- First Reported
- May 24, 2022
- Latest Reported
- Jan 12, 2026
Reported Context (2)
- The actor had previously deployed “qb_check.ps1” on other hosts, targeting QuickBooks credentials, but the script claimed it would exfiltrate to Telegram while containing no Telegram functionality at all. Huntress Finds AI-Assisted Scripts and a Browser RAT Reusing Familiar Attack Techniques
- We had a case brought to our attention by a partner. The threat actor compromised a machine, planted a number of insidious persistence roots, masqueraded as accounting software QuickBooks….all to end up with a pop up: Huntress Details Seven Ways Attackers Evade Security Defenses
Malware (1)
People (9)
MITRE ATT&CK (21)
Vendors (3)
Products (9)
Tools (5)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.