Cyberattackers Spoof Palo Alto VPNs to Spread WikiLoader Variant

Cybercriminals are selling a variant of WikiLoader malware, masquerading as GlobalProtect VPN software, using SEO poisoning techniques. The malware is primarily impacting the US education and transportation sectors, and Italian organizations. The attack method, which prioritizes attacker-controlled webpages in search results, allows a wider reach of potential victims than traditional phishing.