Threat
alerts

Palo Alto’s Unit 42 team has uncovered a WikiLoader loader variant delivered via SEO poisoning and spoofing their GlobalProtect VPN tool. Threat actors exploit users’ trust when downloading software by closely mimicking the legitimate download page. SEO poisoning and malicious ads are increasingly becoming a technique used by attackers to effectively deliver loaders to endpoints. The sophisticated campaign employs two stages: the infection process and leveraging advanced command-and-control (C&C) infrastructure.