Tommy Madjar @ffforward.bsky.social · 20/06/2026Heads up, Gizmodo has been compromised by some #ErrTraffic #ClickFix -as-a-Service affiliate. 040
Reposted by Tommy MadjarThreatInsight @threatinsight.proofpoint.com · 19/02/2026Proofpoint threat researchers identified a new malware-as-a-service named #TrustConnect. Notably, it masquerades as a legitimate remote monitoring and management tool, marking an evolution in how attackers weaponize trust around enterprise tooling. See our blog for details: brnw.ch/21x05Vh.brnw.ch(Don't) TrustConnect: It's a RAT in an RMM hat | Proofpoint USKey findings Proofpoint observed a new malware-as-a-service (MaaS) masquerading as a legitimate remote monitoring and management (RMM) tool. It calls itself TrustConnect. 143
Tommy Madjar @ffforward.bsky.social · 19/02/2026Would you run AdobeReader.exe from a days-old company called "TrustConnect Software PTY LTD" because they managed to purchase an Extended Validation certificate? Blog w. @selenalarson.bsky.social and @proofpoint.com @threatinsight.proofpoint.com team out now! www.proofpoint.com/us/blog/thre... 010
Reposted by Tommy MadjarThreatInsight @threatinsight.proofpoint.com · 20/10/2025Since 14 October, we’ve tracked a high volume XWorm campaign targeting Germany. The activity is attributed to TA584, a sophisticated #cybercrime group tracked since 2020. Messages are sent from hundreds of compromised sender accounts impersonating ELSTER and contain malicious URLs. 122
Reposted by Tommy MadjarThreatInsight @threatinsight.proofpoint.com · 16/06/2025New ecrime insights: TA4557, known for distributing More_eggs malware, notably expanded to an international audience in recent campaigns. Per our data, the recruiter-focused TA was seen targeting orgs in France, England & Ireland, in addition to typical North America-targeted threats. 122
Tommy Madjar @ffforward.bsky.social · 19/05/2025This article that starts getting traction claims that the official RVTools website was distributing a malicious installer leading to Bumblebee. I see zero evidence of this actually being the case. 1/2 111
Reposted by Tommy MadjarThreatInsight @threatinsight.proofpoint.com · 31/03/2025Proofpoint also recently observed this activity delivering GootLoader. Google Ads for a fake document creation app (lawliner[.]com) led to a malicious document creation website, on which users are directed to enter their email address. 142
Tommy Madjar @ffforward.bsky.social · 31/03/2025Great research on that #GootLoader is now including email in their delivery chain. Please don't download NDAs and other contract templates from free sites without any history. 010
Tommy Madjar @ffforward.bsky.social · 18/11/2024New blog drop with @selenalarson.bsky.social and the rest of the team. This one covers a lot of threats using the #ClickFix technique to lure targets to infect themselves by pasting malicious CMD/PS code. My "fave" is the chumbox #malvertising on major tech sites. www.proofpoint.com/us/blog/thre... 0104
Tommy Madjar @ffforward.bsky.social · 16/11/2024Well I guess it's time to try this platform too 😅 130
