Beware of phishing emails disguised as quote requests (SnakeKeylogger)
The AhnLab SEcurity intelligence Center (ASEC) recently confirmed that phishing emails disguised as requests for quotes are being circulated. The email body is disguised as a request from a representative of the Materials Management Division in the Purchasing Department asking the recipient to review a quote, and it prompts the
Beware of phishing emails disguised as purchase order confirmation requests (Xloader)
Recently, the AhnLab SEcurity intelligence Center (ASEC) identified a case of phishing emails that disguise themselves as requests to confirm purchase orders. The email body prompts recipients to open a malicious DOCX file disguised as a purchase order to verify the order. [Figure 1] Phishing email body When
Analysis of Wpcdoor Attack Cases Spread via Korea-Based DVR Management Software
On October 27, 2026, Huntress disclosed a case of malware distribution that exploited DVR management software. [1] The company targeted in this incident was a Korean firm that develops products such as CCTV and DVR systems, and according to the company’s ASD logs, infection logs were also confirmed in Korea.
September 2026 Infostealer Trend Report
Content This Infostealer Trend Report summarizes the distribution channels, number of malware samples, number of detections, and information on companies targeted by new Infostealers (malware designed to steal information) collected during the month of September 2026. The data was compiled based on detection logs from AhnLab SEcurity intelligence Center (ASEC)
The Weak Link Identified by AI: October 2026, When the Outer Contact Point Collapsed
Security Blind Spots Identified by AI The large-scale data breaches disclosed in quick succession in South Korea and Japan in October 2026 mostly originated not from internal core systems, but from peripheral entry points such as externally exposed web services, app backend APIs, and outsourced SaaS (services provided by third-party
RATatouille: Today’s Special: Impersonating Companies in Korea, Payments in Cryptocurrency
While tracking infrastructure related to ValleyRAT, numerous suspicious websites were identified that impersonated companies and brands from Korea such as Doosan Robotics and Cheonjeong. The identified sites used the actual companies’ logos, promotional videos, and descriptions to disguise themselves as official websites. The websites offered features such as invitation-code-based registration,
Does It Stop When Someone Is Watching? The Suspicious Behavior of a New Type of Infostealer
It is already well known that illegal software and cracked programs can be exploited for malware distribution. Recently, AhnLab identified a new type of information theft malware (Infostealer) disguised as an illegal program. This malware was first detected in mid-August and, after altering its execution method, began spreading widely in
Analysis of the Infrastructure of ARTEX, a Chinese AI Penetration Testing Tool #4 – The Birth of Copy Cat
Key Summary Since the original ARTEX GitHub repository disappeared, there has been an increase in independent distributions and customized instances based on the existing ARTEX codebase. These distributions are being redistributed with the product name, UI, filesystem structure, agent settings, and language modified, while retaining traces of ARTEX. Key Observations
The Threat of AI-Driven Autonomous Penetration Testing, as Examined by ARTEX
Overview AI is being used for various tasks that were previously performed manually, such as research, document writing, and code analysis. A 2026 corporate survey also showed that the scope of AI adoption among organizations had expanded compared to the previous year. Recently, there has been a trend toward automating
Case of AgentTesla Malware Distribution Disguised as a Business Proposal Email
Recently, the AhnLab SEcurity intelligence Center (ASEC) identified instances of phishing emails being circulated that disguise themselves as requests to review a business proposal. The email body asks recipients to review the attached product list and reply with their feedback on inventory and pricing, thereby prompting users to download and
