In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2381 articles
Researchers say Cling botnet operators are exploiting the patched Realtek Jungle SDK flaw CVE-2021-35394 and other device vulnerabilities. The malware uses STUN traffic for command-and-control, persistence, proxying, tunneling, propagation, and DoS attacks.
Researchers identified 42 malicious RubyGems packages that use reverse shells or a toolkit to hijack cryptocurrency transactions and steal wallet data. The article details the malware’s delivery, persistence, and operation.
StepSecurity reports that @subql/[email protected] contains a payload that runs on install or import, collects credentials, and supports exfiltration and remote commands via ci-artifacts[.]dev. Its analysis found no evidence of execution on victim systems.
CloudSEK reports that Gentlemen affiliate Azazel used stolen CI/CD secrets and other techniques to compromise more than two dozen organizations, steal about 6TB of data, and operate a separate extortion site. Exposed servers revealed the operation.
Researchers detail FLEXRAT, a stealer and remote-access tool delivered through fake ChilloutVR mod sites and Dropbox downloads. It steals browser credentials and Discord data, captures screens, enables remote control, and establishes persistence.
China-aligned TA419 targeted U.S. AI policy experts with phishing that used impersonation, shortened links, redirects, and a Frameless BitB adversary-in-the-middle page to steal Microsoft credentials and session cookies.
Warlock has exploited SharePoint flaws in attacks on organizations across Europe, Africa, and Latin America, using web shells, BYOVD, and SYSVOL staging to disable security tools and deploy ransomware.
Researchers detail Warlock attacks that exploited SharePoint flaws, used a vulnerable driver to disable protection on at least 40 hosts, and deployed ransomware across organizations in Europe, Africa, and Latin America.
Cisco Talos reports that UAT-11587 targeted government and policy organizations in Asia and Syria with Antino, a Rust backdoor delivered through spear-phishing and using Outlook and OneDrive for command-and-control.
Proofpoint says China-aligned TA419 impersonated policy figures to phish US AI experts, using fake OneDrive pages and browser-in-the-browser techniques to steal Microsoft credentials, MFA codes, and session cookies.
PolicyMgr.exe impersonates a German Windows Update prompt, saves every entered password in a local text file before checking it, and has no built-in upload capability. Researchers link it to another tool signed with the same certificate.
Researchers report CloudSyncD, a persistent macOS backdoor delivered through a fake Zoom installer. It profiles infected Macs and exfiltrates system and user details; deployment-stage builds have been observed.
Rapid7 analyzes BPFDoor, Rekoobe, and AVERAT samples targeting telecom and mail-security appliances in South Korea and Taiwan, detailing SMTP-based command-and-control, stealth techniques, compromised-device relays, and detection opportunities.
Symantec says Storm-2603 continues exploiting SharePoint flaws in attacks on critical infrastructure and other organizations, deploying webshells, tools to disable security software, and Warlock ransomware.
Socket links a cluster of VS Code themes across Visual Studio Marketplace and Open VSX to two confirmed malicious extensions, including one assessed as GlassWorm with high confidence. Reported Marketplace extensions were removed.
Researchers describe SC, a WordPress backdoor that restores itself from files, the database, plugins, and shared memory, and uses Ethereum for C2. Separately, attackers are exploiting the wpForo plugin’s CVE-2026-1581 flaw.
Researchers describe Linux backdoors that mimic Asian mail-security appliances, use stealthy command-and-control over SMTP port 25, and exploit compromised edge devices as relays. Suggested detection includes checking for deleted executables and unexpected raw packetส.
Researchers analyzed indicators from a Microsoft-tracked fake-installer campaign assessed with moderate confidence as consistent with prior Silver Fox activity, finding related domains and other artifacts. No nation-state attribution has been made.
Netskope details an Aotera/Tedy loader delivering a Vidar-class stealer that hijacks browser sessions to drain crypto accounts and replace copied wallet addresses. Researchers estimate about $100,000 stolen from at least 350–430 victims.
CIS CTI traced Remus infostealer activity from March to September 2026 and analyzed three delivery chains. Remus targets browser credentials and sessions, which can help attackers bypass MFA, and supports blockchain-based C2 rotation.
Malwarebytes found 70 fake crypto-project websites that lure users with rewards votes, then prompt them to connect wallets—potentially leading to malicious signatures or token approvals.
Leaked Spetsvuzavtomatika documents describe tools for reconnaissance, network access, credential theft, data collection and covert operations. The files appear authentic, but do not prove that every capability was deployed or identify how the leak occurred.
LevelBlue analyzes TIKTOUK, a toolkit that probes WordPress, retrieves exposed configuration and plugin settings to recover email credentials, and scans JavaScript for secrets. Telemetry and a leaked panel indicate active, large-scale credential collection.
Researchers analyzed SC malware that keeps reinfecting WordPress sites through mutually restoring files, database copies, and shared memory. Its backdoor hides an admin account, disables security plugins, and retrieves instructions via public Ethereum RPC gateways.
