LausivLoader analysis, or how to pass data between malware stages, (Thu, Sep 17th)
2026-09-22T13:23:41Z•3b1c711fc534f44e46a55aae6b987f627f82d6f94b0660761f771133bdcfcae0
HTTP QUERYLausivLoaderPNG steganographyTerminalFixcommand and controlhospitality applicationsinitial accessmacOSmalspammultistage malwarephishingreverse tunnelthreat intelligenceweb scanning
What happened
SANS Internet Storm Center feed containing a LausivLoader malspam and multistage malware analysis, a TerminalFix campaign using PNG steganography and reverse tunneling, scans targeting hospitality applications, and related security research and monitoring posts. The content describes phishing-delivered malware and covert multistage payload transfer, but provides no specific CVE identifiers.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 3b1c711fc534f44e46a55aae6b987f627f82d6f94b0660761f771133bdcfcae0
- Enrichment time
- 2026-09-22T13:23:41Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.