Fake AV Copycat?
ID: a26d1f7b-56c4-5bca-9d5b-e0acb7664711
STIX ID: report--a26d1f7b-56c4-5bca-9d5b-e0acb7664711
Feed Name: Zscaler Security Research Blog
Threat Score
The report describes a fake antivirus (fake AV) campaign that serves malicious executables via landing pages: older samples use a simple HTML page that loads external JavaScript, while newer variants embed base64-obfuscated inline JavaScript; many samples were hosted on subdomains (notably xorg.pl) and exhibited very low VirusTotal detection (as few as 2–6 vendors), indicating active distribution and evasion attempts.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.