In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2382 articles
Huntress details a campaign that used attacker-created ChatGPT Custom GPTs to direct victims to a ClickFix lure, leading to a multi-stage RAT infection. Researchers linked the domain to at least 40 incidents and confirmed two Custom GPT-driven infections.
eSentire details an intrusion exploiting two PaperCut MF zero-days to deploy a web shell and AdaptixC2, move from an education customer’s print server to a domain controller, and extract Active Directory password hashes.
A WhoisXML API analysis expands on reports of Jewelbug campaigns targeting the Middle East and Asia, examining network indicators and related domains. Researchers found potential victim connections and additional malicious infrastructure.
AhnLab describes a quote-request phishing campaign that uses an obfuscated VBScript and PowerShell chain to bypass UAC and install Remcos RAT, which can remotely control systems and collect user data.
AhnLab reports phishing emails impersonating employees of a Korean company. A disguised XLS exploits CVE-2017-0199 to run a chain that ultimately installs Remcos RAT, which can collect information and execute remote commands.
AhnLab traces SEO-poisoned fake KakaoTalk installers using evolving loading techniques to deliver ValleyRAT and Ghost. Similarity to known C2 infrastructure suggests a possible SilverFox/UTG-Q-1000 link, but does not confirm attribution.
AhnLab details two attacks exploiting CVE-2019-18935 on unpatched Telerik servers: one installed a memory-based web shell after running a reverse shell, while another deployed a scanner for exposed WordPress configuration pages.
Google reports renewed exploitation of Oracle PeopleSoft CVE-2026-35273, with UNC6240-linked attackers using an encoded path to bypass WAFs, deploy web shells, and steal data across multiple sectors.
Researchers describe Lunex’s ClickFix campaign targeting Ukrainian-speaking users with Psychedelic Stealer, which abuses a vulnerable AMD driver to evade defenses, steal browser and wallet data, and maintain remote access.
Google says ShinyHunters is encoding PeopleSoft endpoint paths to bypass WAF rules and exploit unpatched CVE-2026-35273 servers, deploying web shells and backdoors. Mandiant urges patching and checking logs for encoded requests.
Researchers traced PolinRider across three development repositories, documenting changing payload names, paths, and extensions, plus repeated force-pushes that restored malware after cleanup. They say the variants appear to be tested in parallel.
Researchers link Kothamine RAT to malicious npm packages. The Windows malware can control infected systems and steal data; recent versions use tailcat for encrypted command traffic, while earlier builds used Tailscale.
A new PamStealer macOS variant uses a fake Wavel wallet site, server-assisted payload decryption, and multiple persistence methods. Its Swift stealer targets passwords, keychain items, browser credentials, and system data.
Microsoft details Storm-3168 activity in which compromised Azure service principals deleted cloud resources, targeted recovery protections, and retrieved storage keys. Microsoft found no confirmed data exfiltration or ransom note.
Wiz analyzes how infostealers harvest credentials, session tokens, and API keys from developer devices, potentially enabling access to cloud platforms, code repositories, and AI services.
Researchers showed that file-change notifications can expose user activity across Linux, Android, Windows, and macOS. Attacks can reveal keystroke timing, visited websites, and app activity; most require local code execution, while Android examples needed no app-per
Researchers found fake desktop-app pages for three payroll and HR platforms delivered ScreenConnect with unattended access. Shared accounts and a server linked the campaign to one operator; how victims found the pages is unknown.
Kaspersky details a MacSync campaign distributed through a fake crypto wallet app. The malware uses multi-stage loaders, steals credentials and other data, and installs a persistent backdoor disguised as Finder.
Analysis of a nested archive uncovered a Python-based MaaS builder and Windows infostealer. The payload evades analysis, persists through a registry key and scheduled task, steals credentials and other data, and exfiltrates it via webhook.
StealthMole says it linked ImLupin’s UK credential-dump listings to a rebranded Telegram storefront, two account shops and a historical Telegram ID. Evidence suggests an Indonesian connection, but the seller’s real-world identity remains unresolved.
Malwarebytes researchers report that Carbonato targets unauthenticated Docker APIs, installs Hermes Agent, and uses Telegram commands, persistence mechanisms, and network scanning to control hosts and spread.
Researchers detail ClickFix campaigns using fake Cloudflare pages on Ukrainian business sites to deliver Psychedelic Stealer, and a separate chain deploying RemotePanel and BoundSiphon for persistent access and data theft.
A detailed analysis explains how an oversized Authorization header can overflow a heap buffer in F5 BIG-IP APM’s OAuth UserInfo handler, corrupt a callback, and enable unauthenticated remote code execution.
Arctic Wolf describes a ClickFix campaign using injected iframes on legitimate Ukrainian websites to deliver Psychedelic Stealer. The malware targets browser credentials, tokens and wallet data; lure-panel interactions do not confirm execution or compromise.
