Malware
GHOSTPULSE Evolves to Pixel‑Level Stealth – New Detection Requires Updated YARA
The latest GHOSTPULSE loader hides its encrypted configuration and payload inside PNG pixel data, replacing the old IDAT chunk method. Defenders should update Elastic Security YARA rules, use the new extractor, and monitor for single‑file executables that embed PNGs and for keyboard‑shortcut abuse in CAPTCHA flows.
What happened
GHOSTPULSE’s latest stage 2 update replaces the IDAT‑chunk technique with a pixel‑level embedding of encrypted configuration and payload inside PNG images.
Impact
The change makes traditional file‑based detection harder and allows the loader to ship as a single, seemingly benign executable that contains the malicious PNG.
What to do
Update Elastic Security YARA rules and the configuration‑extractor tool to recognize the new pixel‑based format. Scan for single‑file executables that embed PNG data and watch for suspicious keyboard‑shortcut abuse triggered by CAPTCHA pages. Monitor PowerShell activity that pulls a payload from an embedded PNG.
Detection guidance
- Use the new YARA rules that flag PNGs with non‑standard pixel data.
- Run the updated extractor on suspicious executables to pull out the hidden configuration.
- Inspect clipboard activity for commands copied during CAPTCHA validation.
Related articles
YARA‑X 1.21.0 Adds stdin Support for --scan‑list and Fixes 4 Bugs
The latest YARA‑X 1.21.0 release introduces stdin support for the --scan-list CLI option, enabling piping of folder lists for scanning. It also includes five improvements and four bug fixes. Defenders should upgrade to take advantage of the new feature and review the changelog for potential impact on existing automation.
Read briefing
GoldPickaxe iOS Trojan: Face‑ID Stealer and How to Detect It
GoldPickaxe is a new iOS Trojan that harvests Face‑ID data and exfiltrates it to remote servers. The malware targets iOS 14+ devices, exploiting a flaw in the biometric framework. Defenders should enforce strict app vetting, monitor for unauthorized biometric usage, and keep devices updated.
Read briefing
ClickFix Campaign in Ukraine Deploys Lunex Infostealer via Fake Cloudflare Pages
Over 100 Ukrainian websites were hijacked to serve a counterfeit Cloudflare verification page that prompted users to run a PowerShell command. The command installed Lunex Stealer, an infostealer that also installs the LunarAxe browser extension and NaiveMess component, giving attackers credential theft and remote control. Defenders should block malicious domains, monitor for Lunex signatures, and educate users against executing unknown scripts.
Read briefing
Macfinger ClickFix delivers architecture‑specific info‑stealer via shell‑script loader
A macOS 27.0 machine was infected by the Macfinger ClickFix campaign, which uses a shell script to download an architecture‑specific binary that steals credentials and persists in the user cache. The payload runs as com.apple.periodic and can survive reboots. Defenders should block the attacker IP, monitor the cache directory, and terminate any com.apple.periodic processes.
Read briefing