In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2379 articles
Citizen Lab linked targeted ads to Candiru spyware attacks against at least 45 Al Jazeera devices in 2024–2025, describing how ad code selected targets and tracing network activity to spyware infrastructure.
Unit 42 describes CL-UNK-1211 activity targeting government Linux infrastructure from October 2025 to April 2026, including web shells, credential theft, a custom RAT and attempted data exfiltration. AI-generated code is suggested, not confirmed.
Citizen Lab says targeted ads delivered zero-click Candiru spyware to at least 45 Al Jazeera devices in 2024 and 2025. Google and ad platforms removed or restricted Discover-Tech after the findings.
Researchers attribute attacks on government organizations across the CIS to Silent Lynx, describing phishing and other delivery methods, including crafted WinRAR archives exploiting CVE-2025-8088 to deploy custom reverse shells.
Infoblox links Help TDS to Hotejka, which it suspects succeeded ROI777. Since April 2026, the operation has reportedly used more than 20,000 Cloudflare Pages domains to route users to tech support scams and other affiliate content.
Infoblox researchers link Hotejka to the Help TDS tech-support scam operation and describe detecting its Cloudflare Pages domains about seven days before use, reducing exposure among their cloud customers.
Darktrace reports a campaign delivering the Rust-based CikaBika RAT through document-themed lures. The malware uses Discord for command and control and can collect system data, execute commands, and exfiltrate files via Ngrok.
ThreatFabric describes Hirudo, an Android banking RAT that replaces targeted Indonesian banking apps with modified copies designed to hide security checks while stealing credentials and enabling remote device control.
GitGuardian reports that a GhostAction wave targeted over 30,000 repositories, using compromised GitHub accounts to deploy workflows that scan for secrets. GitHub began blocking the workflow on October 9, 2026.
Cyble reports that GhostBat RAT targets Android users in India through mParivahan- and eChallan-themed campaigns. Its latest variant uses Accessibility Service overlays to capture financial-app PINs and Firebase Remote Config to manage malware capabilities and C2.
Hornet Security identified over 150,000 messages and more than 40 callback numbers from September 18 to October 2, 2026. Its calls found operators following transaction scripts; the numbers were associated with Onoff, but the users were not identified.
Google Threat Intelligence Group and Mandiant detail UNC7017’s brief tampering of AOMEI update configurations, which redirected some clients to malware and enabled WebDAV NTLM credential coercion. AOMEI says it took corrective action.
Mandiant reports ARMORY CASTLE exploited CVE-2026-102764 as a zero-day, using custom malware to gain persistent root access, target credentials and move through BeyondTrust Remote Support environments. It urges patching and investigation.
Symantec researchers say newer Aoki infostealer samples target credentials and session files for AI coding assistants, alongside data from browsers, wallets, password managers and other apps. Stolen tokens could expose connected developer services.
ReversingLabs traced two Anthropic-published malware hashes to additional stagers, delivery shortcuts and infrastructure. Its analysis found the staging server still serving malware on October 5, while noting that some links to the campaign remain uncertain.
Datadog researchers found that prepending counterfeit policies to untrusted content sharply reduced Jev’s prompt-injection detection and lowered LangChain tool-risk scores in a test scenario. The benchmark did not test downstream agent compromise.
Researchers analyzed exposed attacker directories tied to a PaperCut campaign, uncovering a second XML-RPC RCE path, credential theft and persistent SOCKS5 pivots. Actor files documented 1,005 hosts across 45+ countries and 45 live pivots.
Unit 42 says attackers exploited FortiManager and FortiOS flaws to steal configurations and credentials for 500+ firewalls, then used PEERSTITCH, a memory-resident implant, to intercept traffic and maintain access.
Volexity traced active exploitation of Ivanti Connect Secure CVE-2026-104935, chained with a separate privilege-escalation zero-day. The observed actor reached root access and targeted credentials and Active Directory data; Ivanti has issued fixes for CVE-2026-104935.
Researchers analyzed a signed loader that activates only under specific filenames, installs persistence, and retrieves the Zalmoxis stealer. The malware targets browser data, crypto wallets, and Chrome’s App-Bound Encryption key.
AhnLab researchers found ARTEX-derived tools distributed under altered names and analyzed a Bob Research Labs environment containing CVE-2026-75650 exploit artifacts and an IRC implant. They also found exposed source code, credentials, logs, and attack tools.
Rapid7 analyzes five Zimbra flaws that enable unauthenticated password guessing, sender impersonation, cross-user mailbox reads and persistent email exfiltration. Fixes are available for three; no public fix is listed for two.
Microsoft describes a Chinese-language phishing ecosystem that enabled over one billion phishing emails and SMS messages targeting more than 75,000 organizations since January 2026. Its investigation also helped disrupt key developers and infrastructure.
Malwarebytes describes fake Meta interview-booking pages that steal Facebook and Google credentials, 2FA codes, and personal details, then relay them to attackers attempting real-time account access.
