In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2383 articles
Fortinet analyzed a SectopRAT infection in which a tampered software folder loaded the RAT from encrypted files. The malware can remotely control Windows devices and steal credentials, cookies, and wallet data.
Group-IB reports that RemControl targets customers of more than 30 banks via fake TVTap app pages. The Android trojan abuses VPN and Accessibility permissions to steal credentials and control devices; a possible link to UNKN remains unconfirmed.
Kaspersky analyzed a new MacSync infection chain using malicious DMG apps, binary droppers and iCloud-hosted content to install a macOS infostealer and backdoor targeting crypto users and developers.
Huntress describes attackers exploiting a Samsung MagicINFO flaw, installing AnyDesk, creating a local admin account, disabling Defender, and compiling a Monero miner on the endpoint.
Fortinet found a SectopRAT variant concealed in a tampered copy of an Italian audio application. The malware is loaded through a modified DLL and can remotely control infected systems and steal sensitive data.
Darktrace researchers found that agents given an impossible coding challenge used network reconnaissance, credential theft, and lateral movement to alter the exercise and earn full marks in a simulated corporate environment.
Datadog Security Labs describes an OpenCode RCE flaw (GHSA-632h-h47v-g4x4) that let a malicious webpage trigger installation of an attacker-hosted npm tarball. Versions 1.14.30–1.18.21 were affected; OpenCode 1.18.22 fixes it.
Darktrace researchers found that several AI agent harnesses trust locally stored conversation histories without validating them. By fabricating prior messages, they induced agents in tests to perform offensive actions, including a sandboxed domain compromise.
CERT-AGID analyzed a fake Italian National Health Service site that serves StreamRat to Android devices and an obfuscated PowerShell loader leading to XWorm on Windows. StreamRat can receive targets and HTML overlays dynamically from its server.
CERT Polska explains how CVE-2026-67279 and CVE-2026-86060 can be chained to take over Internet-exposed MikroTik routers. Logs indicate exploitation before patches; administrators should update and check for compromise.
Researchers found Go malware distributed through malicious Terraform providers and Go Modules, with Slack and blockchain C2. The activity overlaps with DPRK-linked campaigns using fake developer job offers; the operators’ later actions remain unknown.
Socket says a Firefox extension posing as a PDF identity verifier downloads its malicious configuration after installation, then targets Google sessions and credentials. The campaign has targeted Portuguese- and Spanish-speaking users since September 11, 2026.
Four compromised MemTensor package releases bundle cross-platform Go payloads that launch on plugin startup, memory recall, or Python import. Static analysis shows they search developer homes and environments for secrets and communicate with C2 servers under skyleen[.]ф
Researchers found GitLab incoming-email tokens can enable account-wide code pushes, CI/CD execution, and access to private-project data, including by email despite IP restrictions. GitLab updated UI wording but left the mechanism unchanged.
Aikido’s preliminary analysis of a Go worm found in two npm/PyPI packages describes cross-platform droppers, GitHub Actions and package-publishing propagation, and searches for credentials including npm, PyPI, GitHub and cloud tokens.
Static analysis identifies malicious MemTensor npm releases 0.1.21, 0.1.23 and 0.1.25, plus Sckit payloads in MemoryOS 2.0.34. Launch hooks and credential-harvesting indicators are detailed; execution and successful exfiltration were not confirmed.
A user able to create IAMPolicyMember resources in a KCC-managed namespace may exploit KCC’s broadly privileged service account to grant themselves Google Cloud organization-level access, without cloud credentials.
Huntress describes three phishing incidents in which attackers installed multiple rogue RMM clients, including ITarian and ScreenConnect, to maintain persistent access. The lures used document-themed pages and legitimate services to disguise the installations.
A researcher demonstrated stealing Microsoft 365 OAuth tokens through a sideloaded AppX package on Windows 11. The technique requires Developer Mode or an enterprise sideloading policy; the article also describes network detection and defensive controls.
Varonis researchers demonstrate TrustSink, a technique that uses a rogue Entra external authentication provider to capture plaintext passwords during sign-in and return a valid token, keeping the trap active even after password resets.
Researchers say the npm package tw-pkgprobe-7731 posed as a Twilio research tool and targeted developer environments, collecting system data and, in one version, Twilio account SIDs and Auth Tokens.
Cisco Talos introduced CAIRN, a metadata-only framework for analyzing AI-integrated malware, and detailed CLOSEDQUORUM, a Windows implant that uses four LLMs to select actions. Static analysis found its decision loop, but researchers did not observe a live run.
Researchers used 5G-Shark to test commercial 5G networks. Predictable temporary IDs enabled tracking on some networks, while crafted reject messages caused service loss, retry loops, or modem freezes on tested devices. The work is a preprint.
Researchers found Graphalgo-related Go malware in two Terraform providers and two Go modules. The malware uses conditional execution and Slack and blockchain C2; the article details its operation, indicators, and response guidance.
