Ankura CTIX FLASH Update - March 4, 2025

Malware Activity

Rising Tide of Cyber Threats: The VO1D Botnet, Clickfix and Phishing Attacks on the Rise

The new variant of the notorious VO1D botnet has grown to an alarming 1.6 million compromised Android TV boxes globally. The new variant botnet has evolved to enable hackers to exploit these devices for various malicious activities. This effectively transforms everyday tech into pawns of their operations. Meanwhile, cybersecurity experts are on high alert as a series of sophisticated hacking techniques that include the "Clickfix" attack to deploy malicious payloads like the Havoc command-and-control (C2) infrastructure via Microsoft SharePoint. This technique exploits users' trust in familiar platforms to bypass traditional security measures. The threat actors are blending this into their attacks by hiding it among legitimate documents and workflows. In a parallel concern, approximately 5,000 phishing PDFs were identified spanning across 260 different