In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2382 articles
Sophos details STAC4924, a campaign using TerminalFix lures and Lorem Ipsum Loader to install a Python-based reverse-tunneling implant, following an earlier phase that distributed trojanized Teams installers.
ThreatLabz analyzes 2CLoader, a Windows malware loader found delivering Vidar and Remus. The loader uses anti-analysis checks, persistence, process injection, API hooks, and encrypted HTTP command-and-control.
CloudSek links a set of malicious npm packages to one operator and two delivery arms, including active packages that remained available after a related package was seized. The campaign steals credentials and data from Windows systems.
Microsoft reports phishing campaigns that delivered a disguised MSP360 installer, which installed ScreenConnect as a second remote-access channel. Attackers used the tools for persistence, credential access, information collection, and follow-on activity.
Mandiant and GreyNoise report exploitation of two Citrix NetScaler zero-days to gain root access, steal credentials, and tunnel into internal networks using web shells and WHIPSHOT and SLAPSHOT malware. Citrix has released security updates.
Researchers describe Branch Target Reuse, a Spectre v2 variant that can exploit stale branch predictions to leak memory. They demonstrated Linux kernel exploits and reported mitigations are being implemented in software.
Microsoft details Star Blizzard’s 2026 shift to larger phishing campaigns and RedFlick delivery, using scheduled tasks, VHDX files, and payloads hidden in PDFs to install the CosmicPulse backdoor against more than 100 organizations.
AhnLab reports that Facebook ads impersonating a cryptocurrency exchange distributed JSCEAL to Windows and macOS users in Korea. About 1,500 PC infections were confirmed over August and September 2026.
A technical investigation reports that Acer System Monitor’s SYSTEM service accepts commands from standard users over a named pipe, enabling arbitrary registry writes and local privilege escalation to SYSTEM.
Palo Alto Networks’ OperTraitor analysis found excessive permissions in Kubernetes operators, including cluster-wide secret access in IBM’s Prometurbo operator, patched under CVE-2026-6389. Researchers warn outdated OperatorHub components and agentic AI could amplify RB
A fake iPhone Duo preorder page attempts to exploit vulnerable iPhones through the DarkSword chain and steal sensitive data. Researchers analyzed the code but did not test it on an iPhone or observe data being sent.
Microsoft describes NeedyMantis intrusions affecting organizations across several sectors, detailing DLL sideloading, malware behavior and indicators. Links to Storm-3069 and the DAEMON Tools incident remain uncertain.
Microsoft reported at least 13 Star Blizzard campaigns affecting more than 100 organizations in 2026. The activity used conversation-based phishing and password-protected archives to deliver RedFlick and, in at least one incident, the CosmicPulse backdoor.
CloudSEK says one npm account published 85 scoped typosquat packages carrying a command agent that fingerprints hosts and polls a C2 server. The server also hosts a separate GPU-cryptojacking panel; no successful compromise or link between the operations is established.
Analysis of an in-the-wild Intel x86_64 PamStealer sample finds credential and browser-data theft, crypto clipboard substitution, dual persistence, Ethereum-based C2 resolution, and anti-analysis checks. Attribution to Russian/CIS-linked cybercriminals is moderate-conf
CloudSek analyzes VHX Harvester, a live operation targeting Vast.ai GPU instances through npm typosquats. It reports 25 deployed bridge agents and one confirmed root shell; the operator remains active, but no miners have been planted.
Mandiant and Google GTIG describe active exploitation of two Citrix NetScaler zero-days, including custom web shells and a tunneler used for persistence, internal reconnaissance, and credential theft, with detection and remediation guidance.
ANY.RUN describes five September campaigns targeting US and EU users and organizations, involving Microsoft 365 session and token theft, remote-access tools, payment-card and OTP theft, evasive phishing, and multi-stage payload delivery.
Microsoft analyzes NeedyMantis, a modular malware family observed in targeted intrusions. It describes DLL sideloading, custom loaders and archives, WebSocket command-and-control, affected sectors, indicators, and defensive guidance.
Proofpoint describes a campaign that harvests university credentials and personal information through online forms, then uses compromised accounts to promote fraudulent jobs and advance-fee scams.
UNSW Sydney researchers found that prompting or fine-tuning five AI models to act drunk increased privacy breaches and compliance with harmful requests; some jailbreak defenses were less effective against fine-tuned models.
Graz University of Technology researchers found that file notifications can expose activity across user accounts on Windows, Linux, macOS, and Android, including browsing traces, keystroke timing, and device events. Mitigations are partial.
Google says ShinyHunters is modifying a PeopleSoft exploit to bypass WAF rules, deploying web shells and other tools. It advises customers to patch CVE-2026-35273, investigate for compromise and data theft, and prepare for possible extortion.
Tests of six email variants found fabricated dates and totals in every test summary. Explicit instructions consistently removed true facts, but hidden text was not required. The results were limited to one email client and viewport.
