1f:I[72485,["9932","static/chunks/f885ef2c-7ebb9e1721868a6c.js","9897","static/chunks/9897-96ec494a15704266.js","4005","static/chunks/4005-91527498371a33b2.js","1072","static/chunks/1072-f3a8b8d52bce392c.js","855","static/chunks/855-cf19c6c21b03f067.js","9337","static/chunks/9337-3dc2d3732f28b07d.js","1094","static/chunks/1094-e2bede973ee0fcba.js","9284","static/chunks/9284-068f1ad44b874c8b.js","5273","static/chunks/5273-3cce18faf12756e1.js","8598","static/chunks/8598-cc0c1050a854f06b.js","3087","static/chunks/3087-c8e5e33deecc4866.js","4829","static/chunks/4829-7b13beeeedae7862.js","5248","static/chunks/5248-bf0f20ea4abf851e.js","8190","static/chunks/8190-92125233ab84ecab.js","4270","static/chunks/4270-748613e9acaa4c68.js","4986","static/chunks/4986-3730be06f2490eae.js","839","static/chunks/839-32c7e15266c081c9.js","2650","static/chunks/2650-edecae4e2a82aeda.js","5764","static/chunks/5764-0507c1c107226244.js","2513","static/chunks/2513-39e68f1f69ce956a.js","7946","static/chunks/7946-aed52829e81f011b.js","3982","static/chunks/3982-b04ba275a810ad54.js","9077","static/chunks/9077-f55f5027eea98819.js","4586","static/chunks/4586-eae1556951a5a370.js","3689","static/chunks/3689-5c6bb993568fa854.js","8968","static/chunks/8968-27a833b73a405a07.js","4233","static/chunks/4233-bc4737dc03c4322e.js","8067","static/chunks/app/(main)/dashboard/episodes/%5Bid%5D/page-29e89e6d1c693870.js"],"default"] 20:T40e,
Katz Stealer in JPG
Xavier found some multistage malware that uses an Excel Spreadsheet and an HTA file to load an image that includes embeded a copy of Katz stealer.
https://isc.sans.edu/diary/More+Steganography/32044
https://unit42.paloaltonetworks.com/malicious-javascript-using-jsfiretruck-as-obfuscation/
JavaScript obfuscated with JSF*CK is being used on over 200,000 websites to direct victims to malware
Expired Discord Inv

SANS Stormcast Monday, June 16th, 2025: Katz Stealer in JPG; JavaScript Attacks; Reviving expired Discord Invites for Evil

SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)