In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2384 articles
Jamf Threat Labs analyzed a PamStealer variant delivered through a fake Wavel wallet installer. Its Swift infostealer steals credentials and user data, while a live server key exchange protects the payload from static decryption.
Huntress analyzed two DarkMe infections delivered through phishing emails and disguised PIF files. The campaign uses a multi-stage VB6 loader, custom protocol-handler persistence, and process hollowing, with technical indicators and detection guidance provided.
ReversingLabs found an npm package posing as a Twilio security probe that collected environment data and attempted to exfiltrate Twilio API credentials. npm removed the package after notification.
Team Cymru found more than 10,000 LLM relay gateways, later reporting over 80,000, that can mask users and bypass providers’ regional controls. Telemetry showed heavy uploads to Anthropic, though researchers could not confirm the prompts or prove model distillation.
Cofense describes a Global Group ransomware campaign delivered through a fake payment-plan email. The attack uses a PDF lure, ISO and executable files, then encrypts data and threatens victims with public leaks.
ANY.RUN researchers detail CSuite, a campaign combining business-themed phishing, Microsoft 365 credential and session theft, device-code attacks, and legitimate remote-management tools to gain access to accounts and endpoints.
Researchers say a fake LastPass Authenticator installer delivered a signed driver that disabled security tools before stealing passwords, wallet files, and session data. LastPass said its systems and customer vaults were not compromised.
Volexity linked Chinese APT actor UTA0565 to phishing campaigns using fake websites and chained Chrome and Windows zero-days to deliver CLEANGULP malware.
A leaked Python framework attributed to Russian firm Okenit automates synthetic persona creation, account verification, and persistent access across platforms. DomainTools found evidence of testing, but not proof of operational use in influence campaigns.
Securonix analyzed TASK#STOMP on one infected machine. The Windows backdoor steals business documents, Wi-Fi passwords, clipboard text, and screenshots, and persists through scheduled tasks and a Startup-folder copy. Its delivery vector and attribution remain unverified
Securonix researchers analyzed TASK#STOMP, a Windows backdoor using VBS, scheduled tasks, and hidden PowerShell to persist, steal documents and credentials, capture screenshots and clipboard data, and execute remote commands through redundant C2 servers.
Zimperium reports that RatHat uses smishing and malvertising to infect Android devices, steal credentials, and gain shell access. It uses generative AI to navigate interfaces and has multiple input-capture and persistence mechanisms.
Sekoia researchers traced Exvicy, a ClickFix malware-as-a-service framework, from a cybercrime forum to active infrastructure. They detail its infection chain and assess with high confidence that it reuses ErrTraffic code.
Unit 42 examines how AWS’s quarantine policy limits exposed IAM credentials, documents a test in which it was attached within 10 seconds of a public GitHub exposure, and explains how teams can monitor AWS and GitHub logs for response events.
Click2Shell uses a crafted theme-preview link opened by a logged-in WordPress administrator to install a theme, then exploits Mobile Repair Zone 2.5.4’s plugin installer to run attacker-controlled PHP.
Huntress reconstructed parts of an INC ransomware attack from post-incident evidence, finding scheduled-task persistence, RDP lateral movement, AnyDesk deployment, and a BYOVD tool used to disable security controls. The initial access vector remains unknown.
An analysis of IoCs linked to three Russian threat groups found potentially victim-associated IP activity and additional domains and IPs, including some assessed as malicious. The findings are based on DNS, WHOIS, and threat-intelligence data.
Zscaler ThreatLabz details how Vidar evolved from XOR and ChaCha-based string obfuscation to a per-build virtual machine and custom stream ciphers designed to hinder analysis.
Checkmarx found indexed-btree and nine related npm packages impersonating legitimate libraries. The malware triggers at runtime, collects system details and uses an Ethereum smart contract for C2; developers are advised to rotate secrets and restore affected systems.
Researchers analyzed a malicious npm release published through a compromised maintainer account and found a separate payload matching PolinRider’s documented method. They report no evidence of successful organizational compromise.
Researcher Gal Weizman demonstrated BragJack attacks against five browser AI assistants, using malicious extensions to access sensitive data or direct agents to act for users. Google and Microsoft fixed their assigned flaws.
Proofpoint researchers report that a TeamFiltration campaign targeted 5,714 accounts across 28 Microsoft 365 tenants, compromising seven dormant service accounts. Post-access activity included VPN probing and access to Azure and SharePoint.
Hacktron researchers used Claude Opus 5 to help exploit a libheif flaw in OpenAI’s forum and chain it with a login weakness, accessing employee ChatGPT and Codex accounts in a controlled test. OpenAI fixed the issue and paid a bounty.
Researchers say SEO-optimized GitHub repos impersonate software brands to deliver Rapuncel, which steals credentials and other data. Its installer also deploys a Microsoft-signed driver reported to terminate 145 security products.
