FROM MOSTERERAT TO CLICKFIX: NEW MALWARE CAMPAIGNS HIGHLIGHT RISING AI AND PHISHING RISKS

Summary from the TLDR InfoSec newsletter

Fortinet researchers have disclosed a sophisticated phishing campaign delivering MostereRAT, a banking malware-turned-RAT that uses the obscure Easy Programming Language (EPL), disables Windows security mechanisms, and deploys remote access tools like AnyDesk and TightVNC to maintain persistent access on compromised systems. A separate ClickFix campaign targets users searching for AnyDesk by serving fake Cloudflare verification pages that ultimately deliver MetaStealer through social engineering tactics involving Windows File Explorer and malicious LNK files disguised as PDFs. Security researchers also revealed a novel adaptation of ClickFix using CSS-based obfuscation to weaponize AI summarizers through "prompt overdose" attacks that overwhelm AI context windows to produce malicious step-by-step instructions, demonstrating how threat actors are exploiting user trust in AI-generated content.