SVG PHISHING HITS UKRAINE WITH AMATERA STEALER, PUREMINER

Summary from the TLDR InfoSec newsletter

A phishing campaign targeting Ukrainian organizations has emerged using emails disguised as official notices from the country's police. These emails contain SVG attachments that trigger fileless attacks when opened, deploying malware including Amatera Stealer and PureMiner. The SVG initiates a download chain using password-protected files that ultimately execute malicious code via in-memory, process-hollowing techniques. The Amatera Stealer collects sensitive information and credentials, while PureMiner hijacks victim resources for cryptocurrency mining. Both can then install additional malware.