TF-MAL-php.ps1bot

Description

ThreatFox malware family `php.ps1bot`. Printable name: PS1Bot. Aliases: Bossnet.

Indicators of Compromise (0)

No indicators of compromise on this threat.

References (1)

• ThreatFox: IOCs for this family ThreatFox Malwares

• Malvertising campaign leads to PS1Bot, a multi-stage malware framework
  web:blog.talosintelligence.com

  Cisco Talos has observed an ongoing malware campaign that seeks to infect victims with a multi-stage malware framework, implemented in PowerShell and C#, which we are referring to as " PS1Bot ." PS1Bot features a modular design, with several modules delivered used to perform a variety of malicious activities on infected systems, including information theft, keylogging, reconnaissance and the ...

  2026-05-22 05:30 UTC
• Malvertising Campaign Leads to PS1Bot, a Multi-stage Malware Framework
  web:community.gurucul.com

  An ongoing 2025 malvertising campaign is delivering a multi-stage malware framework dubbed PS1Bot , developed using PowerShell and C#. The malware supports in-memory execution, persistence, and modular capabilities including info-stealing, keylogging, and screen capturing. It minimizes forensic artifacts by avoiding disk writes.

  2026-05-22 05:30 UTC
• PS1Bot: The Modular Malware Lurking Behind Malvertising
  web:hivepro.com

  PS1Bot is an ongoing malware campaign in 2025 that uses a multi-stage framework built in PowerShell and C#. Designed for stealth, it relies on in-memory execution to avoid leaving traces on disk while delivering follow-on payloads. Its modular architecture gives attackers a wide range of capabilities, from stealing information and logging keystrokes to conducting reconnaissance and maintaining ...

  2026-05-22 05:30 UTC
• Malvertising campaign leads to PS1Bot, a multi-stage malw ...
  web:imtr.net

  Cisco Talos has observed an ongoing malware campaign that seeks to infect victims with a multi-stage malware framework, implemented in PowerShell and C#, which we are referring to as " PS1Bot ." Analysis Summary # Tool/Technique: PS1Bot ## Overview PS1Bot is a multi-stage malware framework implemented in PowerShell and C#.

  2026-05-22 05:30 UTC
• PS1Bot (Malware Family)
  web:malpedia.caad.fkie.fraunhofer.de

  According to Cisco Talos, this is multi-stage malware framework, implemented in PowerShell and C#, that possesses robust functionality, including the ability to deliver follow-on modules including an information stealer, keylogger, screen capture collector and more. It also establishes persistence to continue operations following system reboots. The design of this malware framework appears to ...

  2026-05-22 05:30 UTC
• New PS1Bot Malware Campaign Uses Malvertising to Deploy Multi-Stage In ...
  web:thehackernews.com

  Cybersecurity researchers have discovered a new malvertising campaign that's designed to infect victims with a multi-stage malware framework called PS1Bot . " PS1Bot features a modular design, with several modules delivered used to perform a variety of malicious activities on infected systems ...

  2026-05-22 05:30 UTC
• Malvertising campaign leads to PS1Bot, a multi-stage malware ...
  web:vulners.com

  Malvertising drives PS1Bot , a multi-stage PowerShell and CSharp malware ; modular, in-memory; info stealer and keylogger.

  2026-05-22 05:30 UTC
• New malicious campaign delivering PS1Bot malware
  web:www.broadcom.com

  A new malicious operation delivering PowerShell-based malware variant dubbed PS1Bot has been reported by the researchers from Cisco Talos. The attackers leverage malvertising and search engine optimization (SEO) poisoning techniques to deliver the malicious loaders to unsuspecting victims.

  2026-05-22 05:30 UTC
• PDF PS1Bot Loader: Malvertising Meets Memory - cyberstash.com
  web:www.cyberstash.com

  Context In August 2025, researchers uncovered a sophisticated malvertising campaign distributing the PS1Bot loader through search engine ads and compromised ad networks. Unsuspecting users searching for popular software were diverted to attacker-controlled domains hosting trojanized installers that mimicked legitimate applications. Once executed, these installers trigger a multi-stage, in ...

  2026-05-22 05:30 UTC
• PS1Bot Malware - Malware removal instructions (updated) - PCrisk
  web:www.pcrisk.com

  PS1Bot's data-targeting modules have the ability to take screenshots, monitor keyboard and mouse input, record keystrokes (keylogging), and steal clipboard (copy-paste buffer) content. This malware also uses additions for downloading files that contain vulnerable data, such as passwords, cryptowallet passphrases, and similar.

  2026-05-22 05:30 UTC

Only Available for Registered Users. Sign in to view.