In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2380 articles
Bitdefender researchers detail Midnight Mimosa, malware preinstalled on low-cost Android devices that silently deploys payloads for ad fraud and proxy botnets. They also found related apps on Google Play and observed the campaign on thousands of devices.
Black Lotus Labs says the PoeLLM campaign has compromised over 3,400 servers since April 2026, using a GitHub poem to encode C2 addresses and infected systems to mine cryptocurrency and scan for new targets.
A joint advisory details how actors linked to China and Integrity Technology Group target organizations worldwide using automated scanning, exploitation, credential attacks, VPN persistence, and data exfiltration.
Analysis of a signed Windows installer found two back doors: a SYSTEM-level service and a user-level program. The installer uses fake verification and failure screens; the back doors fetch instructions from servers, and one reports activity to Telegram.
Analysis of a signed Windows loader found it unpacks a Cobalt Strike Beacon configured to imitate CrowdStrike traffic. The Beacon did not contact its server in the sandbox, and delivery method and operational context remain unknown.
BlueMoon campaigns use spearphishing links and a Chrome/V8-to-Windows kernel exploit chain to run malware outside the browser sandbox. Four espionage-focused clusters delivered payloads including GemStone and ShadowPad.
Tensorlake npm version 0.5.144 contained a worm that steals credentials, propagates through packages linked to a victim’s publishing identity, establishes persistence, and can execute attacker-supplied code. Users should remove it and rotate credentials.
Socket reports that [email protected] runs malware during npm installation to steal credentials, exfiltrate secrets, persist, execute remote code, and spread to other packages. A token monitor may wipe a host if its GitHub token is revoked.
Aikido reports that Tensorlake npm 0.5.144, published after a repository compromise, carried a Shai-Hulud variant that steals secrets, targets browser-wallet data and can spread through connected supply chains.
StepSecurity says [email protected] steals credentials, spreads through npm packages and GitHub repositories, and can delete a user's home directory if its stolen GitHub token is revoked while a monitor is active.
Huntress observed attackers exploiting chained AhsayCBS authentication-bypass and RCE flaws against five organizations, deploying JSP webshells, XMRig miners and persistence tools. Ahsay released hotfixes; Huntress recommends restricting access and reimaging compromised
CloudSEK links seven fake NebulaAI npm packages to a Windows RAT delivered through obfuscated install hooks. Two packages remained downloadable; the report details the payload, capabilities, and recommended defenses.
Zscaler details a suspected TraderTraitor campaign that uses a trojanized Terraform provider to deploy FLATROOF and ROOFDECK across Windows, macOS, and Linux, stealing sensitive data and enabling persistent remote access.
ReversingLabs says it identified rebuilt malware variants two months before Anthropic’s report. Its telemetry found that AI can accelerate changes to hashes, but the malware’s behaviors and links to infrastructure remain useful detection signals.
ESET analyzes MATCHBOIL samples from 2024 to 2026, detailing how the UAC-0099 downloader evolved its obfuscation, persistence, sandbox checks, and delivery behavior. The group used it in campaigns targeting organizations in Ukraine.
ESET says UAC-0099, a group likely linked to Russian interests, is using an increasingly sophisticated MatchBoil downloader against Ukrainian organizations, delivering a backdoor and adding obfuscation, sandbox checks, and changing persistence methods.
Bitdefender found Midnight Mimosa malware embedded in low-cost Android phone firmware, enabling silent app installation, ad fraud, and residential proxy activity. The campaign affected thousands of devices in more than 150 countries.
Unit 42 describes ChainDrop and PolinRider supply-chain campaigns that steal developer and cloud credentials, persist in build workflows, and use smart contracts or blockchain transactions to update command-and-control infrastructure.
Researchers say the MALFEX campaign used eight malicious npm packages, downloaded 40,767 times, to deliver Overlord RAT loaders and information stealers through install hooks and package dependencies.
Censys uncovered live DarkSword/Coruna infrastructure, iOS wallet-theft modules, and evidence of a distinct Chinese-speaking operator. An iOS 26 exploit chain is under development but not deployed.
LevelBlue details a campaign that uses compromised sites, a blockchain-based loader and ClickFix lures to deliver Remus Stealer, which collects credentials, browser and wallet data, and system information.
Socket researchers found 16 Firefox extensions that steal wallet recovery phrases and private keys, sending them to attacker-controlled Cloudflare Workers. Mozilla unpublished the extensions by October 5; affected users should move assets to a new wallet.
SOCRadar details NetScaler C2, a framework exploiting CVE-2026-88771 to find vulnerable Citrix appliances, inject commands, and deploy a polling agent. It reports no confirmed victim count and recommends upgrading, isolating, and checking for compromise.
ReliaQuest details an incident in which an attacker used an unauthenticated job-submission feature to steal credentials and take full control of a server, with evidence suggesting LLM-driven agents carried out much of the attack.
