In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2379 articles
Researchers detailed CyberXero’s ongoing campaign targeting WordPress, e-commerce, and Ukrainian infrastructure, with more than 628,000 Ukrainian records reportedly exfiltrated. The article also describes Operation Master, an AI-assisted intrusion and invoice-fraud synd
Researchers describe AvisLoader, a Windows malware loader delivered through a ClickFix lure. It uses encrypted Tox peer-to-peer messaging for commands and payloads, with recovered files showing shortcut-persistence and other endpoint capabilities.
GhostAction used a GitHub lookalike to phish a maintainer, capture credentials, and automate OAuth device authorization for repository and workflow access. A victim was stopped by an additional MFA challenge; successful token theft was not confirmed.
Analysis of a signed Light Alloy installer lure found SnappyClient 0.1.31, which targets crypto wallets, recovery phrases, Telegram sessions and browser data. Researchers decrypted its C2 traffic and identified new capabilities in the malware.
Genians links Operation GitPower to Kimsuky attacks on Ukrainian experts, detailing reply-baiting phishing, malicious LNK files and Zoom installers, Git-based delivery and exfiltration, persistent PowerShell payloads, and credential theft.
Analysis found a signed installer that displays an unwinnable CAPTCHA while silently installing an updater with recurring scheduled tasks. It can download and run files from a Cloudflare R2 bucket; at analysis time, the bucket served only a test file.
Sandbox analysis found that BlackCrypt’s signed Windows agent installs as a service, enables remote control and searches for fake DocuSign, Adobe and other installers to hide them. The report identifies blackcryptknight[.]com as a C2 domain.
GhostAction attackers injected GitHub Actions workflows to steal secrets and scan repository history. A new wave affected 346 repositories; researchers validated 790 repositories overall. my-github[.]com is linked to the collector IP, but operator attribution remains un
Researchers describe P7 DarkSword, an iOS exploit-kit variant that steals keychain and crypto-wallet data and accepts remote commands. Related reporting links DarkSword and Coruna to multiple operators and cryptocurrency-theft activity.
Researchers describe Noir, a crypto wallet drainer that uses DNS TXT records and public DoH services to locate replaceable backend infrastructure, then steals assets through tailored wallet approvals and signatures.
Analysis of a signed QuartzLine PDF viewer found a hidden backdoor that checks in with C2 servers and can run commands or alter browser profiles. Four decrypted sessions showed no tasks; Sectigo has revoked the signing certificate.
Socket found a GhostAction wave that injected malicious GitHub Actions workflows into 346 repositories, stealing Actions secrets and scanning current files and Git history for cloud and other credentials.
A joint government advisory based on FBI investigations details China-linked actors’ use of scanning tools, XSS, password attacks, SoftEther VPNs and custom tools to access and exfiltrate email and Active Directory data, with mitigation guidance.
CISA’s advisory describes how China-linked actors use reconnaissance tools, XSS credential harvesting, password spraying, SoftEther VPNs, and mailbox and Active Directory collection to steal sensitive data from organizations.
Dire Wolf ransomware steals data before encrypting Windows systems, disables logging and recovery options, and threatens to publish stolen data. The article details its techniques and describes Picus simulations for testing defenses.
The episode analyzes a compromised Tensorlake npm SDK, a fake interview repo that redirects installs through an npm mirror, and 42 malicious RubyGems packages targeting crypto developers.
Step Security reports that an Oct. 8 GhostAction wave injected malicious GitHub Actions workflows into 345 repositories, harvesting configured secrets and credentials from working trees and full Git histories. A run log confirmed exfiltration from uber/athenadriver.
Researchers say attackers used Google search ads, Bing redirects and a compromised WordPress site to send macOS users to a fake Claude installer that copied a malicious command to the clipboard. The final payload is unknown.
Analysis of [email protected] found an install hook that could collect credentials, run remote JavaScript, publish data via a public GitHub repository, and modify accessible repos. Publication, downstream impact and broad CI infection remain unconfirmed.
Gen Threat Labs analyzes Warden Stealer, a rapidly spreading Rust infostealer that targets AI agent data, steals browser credentials by bypassing Application-Bound Encryption, and includes a loader and cryptocurrency clipper.
A joint government advisory, based on FBI investigations, describes China-linked actors using scanning, password attacks, XSS, VPNs and scripts to access networks and steal emails and credentials. It recommends patching, MFA and other defenses.
TrendAI attributes ASHVEIN, a .NET infostealer and RAT, to UAC-0099 attacks targeting Ukrainian government personnel. The malware steals credentials, captures screenshots and hides commands in HTML; the actor has also experimented with AI-evasion tactics.
AhnLab describes purchase-order phishing emails that use a malicious DOCX and Equation Editor vulnerability to deliver SnakeKeylogger, which steals credentials and other data.
CrowdStrike says attackers used the ARTEX AI penetration-testing tool to steal data from South Korean financial firms. A separate report details an AI-driven credential-stuffing platform that tested more than 12 million credentials.
