Welcome to the January 2025 edition of the HP Wolf Security Threat Insights Report. In the report, we review notable malware campaigns, trends and techniques identified from HP Wolf Security’s customer telemetry in calendar Q3 2024.

Key Findings

• In Q3, HP Sure Click caught campaigns spreading VIP Keylogger and 0bj3ctivityStealer malware that relied on the same techniques and loaders to infect PCs. In both campaigns, attackers hid malicious code in images (T1027.009) they uploaded to archive.org, a file hosting website, and used the same .NET loader to install their final payloads.4 By hiding malicous code in images and hosting them on legitimate websites (T1102), the attackers were more likely to bypass network security like web proxies that rely on reputation checks.
• One of the techniques we see threat actors using to infect PCs is HTML smuggling (T1027.006), where victims are tricked into opening HTML files containing malware. In Q3, HP Sure Click stopped an HTML smuggling campaign delivering the XWorm remote access trojan (RAT). The activity resembled campaigns delivering AsyncRAT seen in Q2 2024. Notably, the HTML files bore hallmarks suggesting that they had been written with the help of GenAI. The activity points to the growing use of GenAI in the initial access and malware delivery stages of the attack chain. Indeed, threat actors stand to gain numerous benefits from GenAI, from scaling attacks and creating variations that could increase their infection rates, to making attribution by network defenders more difficult.
• In Q3, the HP Threat Research team identified a campaign stopped by HP Sure Click where threat actors uploaded information-stealing malware to code repositories on GitHub for video game cheat and modification tools. The malware, Lumma Stealer, scrapes victims’ passwords, cryptocurrency wallets and browser data.

Read the Report

Download the report: HP Wolf Security Threat Insights Report: January 2025

Download (PDF)

You can download and read our previous Threat Insights Reports here.