In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2381 articles
Researchers found that a hard-coded cookie-signing secret and publicly exposed user IDs let them forge sessions for 95 of 241 tested accounts, including administrators, in an authorized staging assessment, bypassing application-level SSO and MFA.
Netskope researchers detail a Windows malware operation that injects a Vidar-class stealer into browsers, drains cryptocurrency exchange accounts, and swaps copied wallet addresses. They estimate at least 350–430 paying victims and about $100,000 in proceeds.
Symantec observed Warlock ransomware attacks on four organizations in Spanish- and Portuguese-speaking countries. The group exploits Microsoft SharePoint for access and uses techniques including DLL sideloading, vulnerable drivers, and Active Directory replication to, [
Symantec attributes recent attacks on at least four organizations to Longlegs, which it tracks as Storm-2603. The group exploited SharePoint, disabled security tools and deployed Warlock ransomware across victim networks.
Microsoft says Star Blizzard’s RedFlick campaign uses phishing and malicious archives to install the CosmicPulse backdoor, targeting more than 100 organizations, including groups supporting Ukraine.
LevelBlue observed attackers exploiting CVE-2026-88771 against NetScaler appliances, with commands and payloads targeting configuration data, privileged access, reverse shells, and web shells. It provides behavioral indicators for investigation.
Unit 42 details in-the-wild exploitation of two critical NetScaler vulnerabilities, including attack chains that deploy web shells for command execution and persistence. Its telemetry found 50,277 potentially exposed instances as of Sept. 27, 2026.
Microsoft detailed July 2026 phishing campaigns that used deceptive MSP360 or Faronics installers to deploy ScreenConnect, establish persistent remote access, and support credential collection and additional post-compromise activity.
Microsoft reports attackers exploited Zimbra CVE-2026-73570 to deploy web shells, move laterally, and collect mailbox and authentication data. Zimbra patched the flaw in version 10.1.20; Microsoft recommends patching and hunting for persistence.
AhnLab details a Kimsuky-linked campaign that uses a malicious Hangul resume document to deliver Quasar RAT and Funhouse ransomware, a variant of Endpoint ransomware, through a multi-stage script-based infection chain.
AhnLab details phishing campaigns distributing ScreenConnect, FleetDeck, Datto, SimpleHelp, JumpCloud, and N-able installers to enable threat actors to remotely control targeted systems.
Microsoft details exploitation of unauthenticated command injection in Zimbra’s SNMP notification path, describing web shells, persistence, credential and mailbox collection, and an exfiltration attempt. Zimbra 10.1.20 or later fixes the flaw.
Mandiant and GTIG say attackers exploited NetScaler zero-days since at least early September, gaining root access and using web shells and a tunneling tool for reconnaissance, lateral movement, and credential theft.
Proofpoint reports that China-aligned TA419 used impersonation and multi-stage adversary-in-the-middle phishing to target U.S. AI policy experts, stealing Microsoft 365 credentials and session cookies through a customized Browser-in-the-Browser tool.
K7 Labs describes a multi-stage intrusion beginning with KMS Auto, followed by XMRig, ScreenConnect, MeshAgent and scareware that did not encrypt files. APT36/Transparent Tribe attribution remains inconclusive.
Microsoft says Star Blizzard has used RedFlick in attacks against Ukraine-linked targets and others. The chain delivers malware through phishing attachments, with scripts and scheduled tasks enabling payload execution and persistence.
Researchers describe how a DTLS fragment-length parsing flaw in Citrix NetScaler ADC and Gateway can cause a buffer overflow. The flaw is reportedly under active exploitation and can enable remote code execution or denial of service.
Huntress says malicious custom ChatGPTs promoted in sponsored Google results led users to a fake backup page and ClickFix PowerShell commands that installed a RAT. The malware used Windows Run keys and scheduled tasks for persistence.
Microsoft says FSB-linked Star Blizzard has shifted to larger-scale phishing, targeting over 100 organizations, especially Ukraine-linked groups and supporters. RedFlick delivers the CosmicPulse backdoor via scheduled tasks.
Jamf Threat Labs analyzes CloudSyncD, a two-stage macOS backdoor delivered in a fake Zoom installer. It validates a phished password locally, hides it in a configuration file, and launches an embedded implant that beacons to operator infrastructure.
Huntress traced compromises of three recreation-platform servers to abuse of a member-file upload function. The attacker deployed webshells, targeted payment data, evaded detection, and later injected a credential-stealing browser trojan.
Huntress explains how attackers use Microsoft Defender Antivirus exclusions to evade scans, including a registry setting that can hide exclusions from PowerShell queries, and describes the telemetry and detections it added.
Huntress describes a campaign using malicious Custom GPTs on the real ChatGPT domain to direct victims to fake verification pages, where ClickFix prompts lead to a PowerShell-driven infection chain and RAT deployment.
A retrospective examines S1ngularity, Shai-Hulud and TeamPCP supply-chain attacks, detailing how stolen credentials and malicious package updates spread malware, steal secrets and compromise downstream projects.
