Solar Spider Spins Up New Malware to Entrap Saudi Arabian Financial Firms

JSOutProx, a highly obfuscated JavaScript remote access Trojan used by the Solar Spider group, has a new modular version targeting financial organizations and some governments across APAC and MENA (including Saudi Arabia). The malware is delivered as JavaScript disguised in PDFs within ZIP archives and pulls plugin modules from repositories (GitHub/GitLab) to exfiltrate payment data and credentials, enable remote control, and manipulate victim environments.