In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2375 articles
Hexastrike reconstructs a Qilin intrusion at a German company, detailing S5PIVOT, a Python-based SOCKS5 backconnect proxy, credential-led access, evidence of cloud exfiltration and encryption, and defensive lessons. The total data transferred remains unknown.
CTM360 says it identified 1,000+ incidents in fake gift-card campaigns impersonating major brands. The portals use deceptive verification loops to drive surveys, app installs and paid subscriptions; CTM360 says no rewards were delivered in tested flows.
CIS CTI reports device code phishing activity rising against U.S. SLTTs as PhaaS kits automate OAuth 2.0 account takeovers. It describes token persistence and post-compromise abuse, and advises revoking tokens and removing rogue device registrations.
Socket analyzed malicious RubyGem strutil-core 1.0.1, whose install hook runs a worm that steals credentials, spreads across package registries and poisons AI coding tools. Sandbox and code analysis found no confirmed victims or downstream infections.
Cloudflare examines MOLE, a proposed framework for post-quantum anonymous web credentials that can hide which trusted anchor issued an endorsement. Its VOLE-in-the-Head and multivariate constructions remain under development.
Forever Security researchers demonstrated that a script-running browser extension on claude[.]ai could use an authenticated Claude Dispatch session to prompt Claude Desktop to install an npm package; they report no real-world attacks.
Analysis of AbeAgent.exe found a signed modular RAT that can clone Chrome and Edge profiles for hidden-browser control and steal browser data, including Chrome cookies via an App-Bound Encryption bypass. Operators sent no commands during sandboxing; delivery is unknown.
Kaspersky GERT details two ransomware investigations: reused ESXi root credentials accessible through monitoring, and Proxmox credentials stored in plain-text notes. The cases show how privileged access enabled encryption without a VM escape.
QiAnXin’s XLab says cwpdoor is a modified cwpsrv web server that executes commands from specially signed, timestamped requests without logging them. Its installer needs root access; researchers do not know how attackers obtain it.
A Telegram-based investigation maps Dark Storm Team’s account and channel changes, claimed attacks, DDoS services and group relationships. It cautions that availability checks do not prove attacks and that some affiliations remain unclear.
Varonis Threat Labs presents NotC2, a proof-of-concept using SQS, Lambda, SNS and Amazon Bedrock for post-compromise AWS command and control, detailing its permissions, cloud-log detection signals and defensive controls.
Step Security reproduced CVE-2026-123158 on an Alpine VM and container: vulnerable OpenSSH on musl without PAM can accept an overlong password for an eligible passwordless account after a failed attempt. Upgrade to OpenSSH 10.6p2 or patched Alpine packages.
Dr. Web says a campaign using fake GitHub security projects has compromised more than 2,000 Windows systems. Its Electron loader deploys AsyncRAT, clipper malware and an infostealer while evading security tools.
Microsoft reports that threat actors used agentic AI tooling to find exposed GitHub secrets and abuse application credentials across Azure and Microsoft 365; in one case, an agent moved from secret scanning to Azure Key Vault data exfiltration in five minutes.
Censys counted 1,465 exposed ARTEX consoles and found open directories exposing post-exploitation tools. The report examines reported ARTEX use in campaigns targeting South Korean finance and ConnectWise customers, and offers host-level hunting pivots.
Check Point Research analyzed 10 exposed ARTEX databases and found operators using largely autonomous AI agents in opportunistic campaigns, including certificate and game-account credential theft and an attempted crypto-service supply-chain compromise.
Check Point researchers described a ChatGPT HTML-preview sandbox flaw that bypassed Lockdown Mode, enabling chat-data exfiltration, phishing, and malware delivery. OpenAI removed permissive popup settings; researchers retested and confirmed the technique no longer works
Infoblox researchers describe two operations that used unauthorized DNS changes to place illegal gambling pages beneath school and government domains, using CNAME mappings or delegated subzones. The access method remains unknown; one operation’s delegations were later,
Infoblox researchers attribute Help TDS to Hotejka, linking it to ROI777, and describe its tech-support scam call centers. They reverse-engineered its domain-generation algorithms to detect Cloudflare Pages domains about seven days before use.
Infoblox researchers describe Noir, a wallet drainer that uses DNS TXT records queried over public DoH to locate backend pools. It tailors approval requests to wallets, then uses captured permissions to transfer assets.
Infoblox details three “Squirrel” actors that acquire expired domains embedded in compromised sites and redirect inherited traffic to ads, scams or malware. It describes cloaking and injection chains, including Shady Squirrel’s reported traffic to SocGholish.
SOCRadar profiles Nova (formerly RALord), combining leak-site trend data with analysis of Rust encryptor samples that interfere with defenses, clear logs, delete shadow copies and encrypt files. It also outlines defensive measures.
Sekoia reports that suspected Midnight Blizzard operators used compromised or cloned sites and a Plerdy supply-chain compromise to deliver three iOS and Android exploit chains targeting patched vulnerabilities and harvesting device data.
Researchers traced a QuickBooks phishing campaign using more than 350 lookalike domains and UltraMailer tracking to trojanized UltraMailer and UltraViewer installers carrying njRAT and DarkKometa. They found no evidence the software developers participated.
