{"type":"rich","version":"1.0","provider_name":"Transistor","provider_url":"https://transistor.fm","author_name":"Daily Security Review","title":"Bumblebee Malware Returns: IT Pros Targeted Through SEO Poisoning and Typosquatting","html":"","width":"100%","height":180,"duration":1728,"description":"In this episode, we break down the resurgence of the Bumblebee malware loader and its latest distribution method: blackhat SEO campaigns and trojanized software installers. By mimicking legitimate download pages through typosquatted domains and poisoning Bing search results, attackers are tricking IT professionals into unknowingly infecting their own networks.\nWe explore how malware is being embedded into fake versions of tools like Milestone XProtect, RVTools, WinMTR, and Zenmap—critical software often run with administrative privileges. Once executed, these installers silently load Bumblebee, enabling attackers to deploy ransomware, infostealers, or Cobalt Strike payloads.\nYou’ll also hear about:\nWhy Bumblebee’s return fills the gap left by QBot’s takedown\nThe anatomy of the campaign’s DLL side-loading and use of legitimate Windows binaries\nReal-world indicators of compromise (IoCs) and typosquatted domains to watch out for\nHow a DDoS attack on the real RVTools website added to the confusion\nWhat security teams must do now to mitigate and respond\nIf your IT department uses any of the targeted tools, don’t miss this urgent discussion on one of the most deceptive malware delivery strategies we’ve seen this year.","thumbnail_url":"https://img.transistorcdn.com/pL79_MJFeJHamQ_ztImsGmDSMdl27VMk_30TAkieujE/rs:fill:0:0:1/w:400/h:400/q:60/mb:500000/aHR0cHM6Ly9pbWct/dXBsb2FkLXByb2R1/Y3Rpb24udHJhbnNp/c3Rvci5mbS8yNzg5/ZjlhNzM5Y2M4Njli/NjkxNzgyODA2Nzhi/MDI2ZC5wbmc.webp","thumbnail_width":300,"thumbnail_height":300}