AhnLab reports that Facebook ads impersonating a cryptocurrency exchange distributed JSCEAL to Windows and macOS users in Korea. About 1,500 PC infections were confirmed over August and September 2026.
AhnLab describes a quote-request phishing campaign that uses an obfuscated VBScript and PowerShell chain to bypass UAC and install Remcos RAT, which can remotely control systems and collect user data.
AhnLab reports phishing emails impersonating employees of a Korean company. A disguised XLS exploits CVE-2017-0199 to run a chain that ultimately installs Remcos RAT, which can collect information and execute remote commands.
AhnLab details two attacks exploiting CVE-2019-18935 on unpatched Telerik servers: one installed a memory-based web shell after running a reverse shell, while another deployed a scanner for exposed WordPress configuration pages.