🎯 Masquerading

The items that name it 24

• Inside a malicious Claude Code-branded extension and its persistent SSH backdoor
  writeup2026-10-31

  Persistence objects named SysMon and com.apple.sysmond resemble monitoring components.

• From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
  writeup2026-10-30It is written here as T1036.

  Update-themed staging and a renamed Bun executable.

• Trojanized Claude Code Extension Plants an SSH Backdoor
  writeup2026-10-30

  Names such as com.apple.sysmond, SysMon, sysmon.cmd and svc-telemetry mimic system components

• Backdoor in Claude Code for VS Code extension on the Cursor Marketplace
  writeup2026-10-30

  LaunchAgent uses an Apple-style com.apple.* label, and files are hidden with dot-prefixed names (.smt, .smtk, /tmp/.stk_*).

• Hugging Face malware campaign returns to hijack GPUs for crypto mining
  article2026-10-29

  Miner disguised as a Linux system process; models posed as small Qwen2 test checkpoints

• Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN
  writeup2026-10-28It is written here as Masquerading: packed aaamgrd ELF posing as the legitimate Python-based aaamgr service.
• Managed for Malice: How Attackers Turn MDM into Remote Access
  writeup2026-10-28It is written here as Masquerading: MSI named to mimic a DocuSign installer (eD0cuSign_Installer.msi) that actually installs Hexnode MDM.

  eD0cuSign_Installer.msi

• GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font File
  writeup2026-10-16It is written here as Masquerading: Node.js infostealer disguised as public/fonts/fa-solid-400.woff2 font file.
• AI-Powered Espionage Campaign Targets Government Linux Infrastructure
  article2026-10-15

  Used benign names such as plesk_sys_driver.php, sys-control-client, pip2.7, ea_install, ./semanage, Solarwinds.StatusLog.txt, [kcached] and gs-dbus

• Investigating Ephemeral Supply Chain Tampering
  writeup2026-10-15

  Payloads posed as Radmin components, a Radmin blank screen driver library and Nitro PDF tools

• Unpatched AhsayCBS Vulnerabilities Exploited in the Wild
  article2026-10-09

  Disguising the XMRig cryptominer as Microsoft Edge, and disguising a persistence service/binary as Microsoft Edge Update / msedge.exe

• Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer
  writeup2026-10-08

  XMRig miner renamed edge.exe/msedge.exe to pose as Microsoft Edge; NSSM-based binary disguised as Microsoft Edge Update; Windows service named MicrosoftEdgeUpdateSvc created to resemble the legitimate edgeupdate service.

• Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)
  advisory2026-09-30

  Web shell served as receiver.min.css and cookie named NSC_TASS to blend with normal traffic

• Phishing Abuses RMM Tools for Persistent Access
  writeup2026-09-29

  Legitimate MSP360 software distributed under filenames designed to resemble meeting applications, invitations, PDFs, and business documents.

• Socket: Malicious Extensions Drain Axiom Trade and Padre Crypto Sessions
  writeup2026-09-12

  GhostApe brandjacks legitimate MockApe extension, retaining its API references, identifiers, and Chrome Web Store ID

• Socket: Operation Muck and Load
  writeup2026-07-16It is written here as Masquerading: Match Legitimate Resource Name or Location.

  Payload extracted to C:\ProgramData\Windows.Microsoft.Photos\ and executable named Microsoft.exe to mimic legitimate Microsoft paths.

• Socket: Chrome and Firefox VPN Extensions Add Clipboard Stealers via Malicious Updates
  writeup2026-06-30

  Extensions present themselves as privacy-focused free VPN tools while a misleading privacy policy claims no data collection, logging, or sharing.

• Socket: 141 Mastra npm Packages Compromised via Typosquatted Dependency
  writeup2026-06-20

  persistence artifacts and drop names disguised as Node/NVM tooling (protocal.cjs, NodePackages directory, NvmProtocal, com.nvm.protocal, nvmconf.service) to blend into developer machines

• Socket: 152 Chrome Live Wallpaper Extensions Hid Ad Tracking and Faked Google Search Traffic
  writeup2026-06-13

  Extensions forge utm_source=google&utm_medium=organic attribution and wrap uninstall pings in a fake google.com/url redirect with fabricated ved/usg tokens to disguise extension-driven traffic as genuine Google organic search clicks

• Socket: Malicious NuGet Package Impersonates Sicoob Banking SDK
  writeup2026-05-29It is written here as Masquerading: Match Legitimate Resource Name or Location.

  Package and GitHub organization impersonate Sicoob branding and claim 'SDK Oficial' status

• The Gentleman Ransomware | Defense Evasion TTPs Uncovered | Huntress
  writeup2026-05-21

  Malicious binary svchost32.exe disguised as legitimate Windows process svchost.exe

• BufferZoneCorp Malicious Gems & Go Modules
  writeup2026-05-06It is written here as Masquerading: Match Legitimate Resource Name or Location.
• [s|l]trace - Linux Malware Analysis
  writeup2024-02-01It is written here as Masquerading (process name spoofing).

  BPFDoor uses prctl(PR_SET_NAME) and strcpy to rename its forked process to one of several hardcoded fake service names (e.g. /sbin/udevd -d, dbus-daemon --system, hald-runner, /usr/sbin/console-kit-daemon --no-daemon, etc.) to blend in with legitimate system processes

• MITRE ATLAS v2026.09 data release
  repo

  Updated technique (v2026.07)