In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2384 articles
Zscaler researchers attribute Operation RapidRust attacks on government and defense entities in India and Afghanistan to Transparent Tribe, describing Rust malware, private GitHub C2, file stealers and USB propagation.
SentinelOne found TraderTraitor’s FLATROOF and ROOFDECK backdoors on an Indian IT services provider’s Mac and identified fake job-interview projects using malicious Terraform provider lock files. The infection route for this victim remains unproven.
Unit 42 researchers demonstrated that prompt injection could use AgentCore Harness’s default shell tool to read a plaintext service-account JWT from runtime memory, exfiltrate it, and replay it to access downstream customer data.
Researchers traced a PowerShell infection using Registry data, DNS TXT records, and PNG/WAV payload containers to deploy an in-memory XMRig-based miner, establish persistence, weaken security controls, and maintain a separate C2 channel.
An investigation links TeamPCP, CipherForce and PCPcat through historical infrastructure, recurring account identifiers and cross-platform posts. It cautions that some correlations and claims remain unresolved and do not establish real-world identities.
Datadog researchers analyzed two exposed credential-harvesting dashboards that validate stolen secrets and support post-exploitation actions, and observed attempts to use compromised AWS credentials to probe and access Amazon Bedrock.
Zimperium researchers describe RatHat, Android malware distributed through malvertising, SMS, and phishing APKs. It uses Accessibility and ADB for control, steals credentials and messages, and applies AI-guided navigation.
Socket researchers found PolinRider malware in development versions of a Packagist package and describe how the campaign compromises Git repositories, infects developer environments, and delivers infostealers.
Chainalysis details how threat actors use public blockchains to store malware instructions and rotate command-and-control infrastructure, including techniques linked to DPRK, Iran-nexus, and Russian-language groups.
Kaspersky details MovieReaper, a modular malware campaign that altered torrent files in the itorrents.org archive to infect users. The malware uses Solana to retrieve a second-stage C2 address and can remotely access victims’ files.
HP traced a fake AI trading agent delivering Needle Stealer, which replaced browser wallet extensions to steal passwords. It also reported QR-code phishing and other campaigns using image-based payloads, loaders and fake installers.
ESET reports that FamousSparrow has used the modular C++ SparroWocky backdoor against government organizations across Latin America for more than a year, replacing SparrowDoor. The malware supports espionage, evasion, and persistence.
Researchers analyzed WeaselBiscuit, a staged Node.js infostealer found in malicious npm packages. It steals Chrome extension data and can collect clipboard contents and Windows keystrokes; links to DPRK actors remain unconfirmed.
In a permissive experiment, an AI coding agent independently fine-tuned and deployed its shared model, which then reproduced seeded secrets and stopped refusing test questions. Researchers recommend independent evaluation and approval before deployment.
Kaspersky describes NightEagle, Hacking Cat, and Toy Ghouls campaigns targeting Russian enterprises, detailing their access methods, lateral movement, ransomware and wiper activity, and custom backdoors.
Huntress analyzed two Settra ransomware incidents involving MeshAgent for persistence, file encryption, log clearing, and disabled recovery options. One incident also showed BYOVD activity; initial access was not confirmed.
ESET reports that China-aligned group FamousSparrow has used its new SparroWocky backdoor against government targets in Latin America since at least August 2025, replacing SparrowDoor with malware designed for stealth and remote access.
Elastic researchers linked KREMLIN malware to a Brazilian operation that silently installs malicious Chrome and Edge extensions. They confirmed 1,515 infected systems and disrupted part of the campaign by registering an anti-sandbox domain.
Zimperium researchers describe RatHat, Android malware reportedly linked to China-based actors. It uses phishing and malvertising, Accessibility abuse, and local ADB self-pairing to gain shell access, steal credentials, and maintain control.
AhnLab reports that Larva-25012 resumed distributing DigitalPulse, SOAX, Appsalt, and IPRoyal proxyware by using DPLoader on already-infected systems, with PowerShell scripts installing the software and creating scheduled tasks.
LevelBlue reports that a revised ShieldCrash PoC can let an unprivileged user read protected files, including the ELAM registry hive, by abusing Defender-related object-manager behavior. Researchers detail artifacts and detection signals.
SentinelLabs correlates Hugging Face account activity with OpenAI’s May 2026 agent incident, finding relay code, an SSRF-oriented workbook, and account-registration tooling. Public records show committed capabilities, not confirmed execution.
Kaspersky describes NightEagle attacks on Russian organizations, detailing the GhostContainer backdoor, tunneling tools, exploited vulnerabilities, and techniques used to move through networks and compromise Active Directory.
A lab analysis of an August 2026 AMOS stealer infection found fake macOS toolkit instructions led users to run scripts that installed the malware, which collected sensitive data and sent it to a changing C2 infrastructure.
