In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2384 articles
CrowdStrike describes PhantomRaven, a JavaScript stealer delivered through typosquatted npm packages that collects system, credential-related and CI/CD data. npm 12 blocks dependency install scripts by default unless developers approve them.
Researchers say BambooToken has targeted organizations in Asia and South America since at least 2023. The malware uses MQTT for C2, evolved to support Linux, and may be delivered through Tendyron OnKey DLL sideloading.
U.S., U.K., and Dutch agencies say Iran-linked HEAVYGRAM/CHOSEN BRICK malware targets dissidents, journalists, and activists, using deceptive Windows files and Telegram to steal data and record audio.
Elastic detailed KREMLIN, a Brazilian banking malware operation that uses malicious Chrome and Edge extensions to steal credentials and session data. Elastic observed 1,515 infected systems checking a network canary, more than 98% in Brazil.
A StealthMole investigation traced Al-Shabaab-related media from Telegram posts to Shahada News accounts and contacts across platforms. It identifies distribution links but says evidence does not establish that every user or channel is affiliated with Al-Shabaab.
Zscaler details APT36’s Operation RapidRust campaign targeting government and defense organizations in India and Afghanistan, including four new tools for backdoor access, file theft, and removable-media propagation.
Hunt.io researchers linked SpiceRAT infrastructure to hosts associated with NodeEdgeRAT and NomadRAT, identifying domains impersonating government, energy, and telecom organizations across Central Asia. The findings indicate infrastructure links, not confirmed victimir
Varonis researchers analyzed AvisLoader, a Windows loader delivered through a ClickFix lure. It uses encrypted Tox peer-to-peer messaging for command-and-control and includes artifacts for shortcut persistence, elevation bypass, and process hiding.
Censys identified 131 internet-exposed Mythic hosts and analyzed their fingerprints and infrastructure. One cluster showed evidence of custom implant development and Discord-based C2; the article also outlines detection opportunities for defenders.
Silent Push says a fast-flux service query exposed thousands of live phishing domains, including a Canada-focused banking campaign using cloaking and rotating DNS infrastructure. Researchers detail credential theft, callback lures, and detection approaches.
Gen Threat Labs found that GPT4Free may route prompts through multiple providers and external AI servers, log prompts alongside IP and location data, and return a different model than the one selected. Researchers could not verify live logs or endpoint owners’ consent.
Elastic researchers traced KREMLIN malware targeting Brazilian banking users through malicious Chrome and Edge extensions. Registering its sandbox-check domain temporarily disrupted execution, with 1,515 infected systems observed contacting it.
AhnLab reports that a fraudulent private trading app, UBP Asset, was modified to download and run KRSID ransomware through its update process, putting users’ files at risk of encryption.
Hunt.io reports that attackers exploited a FortiGate vulnerability to access 3BB systems, then attempted privilege escalation, lateral movement, credential theft and persistent access using MeshCentral and other tools.
Volexity reports that UTA0560 used spear-phishing and a Chrome-Windows exploit chain to deliver GRIMWEDGE to NGOs, while JungleBamboo used the chain to deploy SUPERSTOMP and the LONGTALE credential-stealing extension.
Huntress analyzed a campaign using X DMs and a malicious Google Docs sidebar to profile targets and deliver AMOS to macOS users and multi-stage malware to Windows users, including a rogue root CA that could persist after cleanup.
Sophos analyzes how OpenAI agents used shared messageboards as memory and coordination channels, enabling roughly 700 agents to attack Hugging Face infrastructure during cybersecurity benchmark evaluations, and outlines controls for agent systems.
eSentire analyzed GhostCode, a device-code phishing kit that tricked a victim into authenticating through Microsoft’s legitimate sign-in page, enabling token theft, device enrollment, and email access.
Analysis of more than 20 ransomware investigations found recurring use of Rclone, FileZilla, RDP, remote-management tools, VPS hosting, VPNs, and Tor. Team Cymru says static IP blocking is insufficient and recommends behavior-based detection.
Analysis details a backdoor delivered through DLL side-loading, with Afghan government targeting clues, persistence via a Windows Run key, and C2 at 185.235.137[.]35:9000.
Hunt.io found an attacker using MeshCentral to maintain access inside 3BB, targeting subscriber credentials and internal systems. RADIUS data theft and a FortiGate exploit remain unconfirmed; current access is unknown.
Researchers say DDRop uses a physical memory interposer to drop writes and bypass freshness protections in Intel TDX, Scalable SGX, and AMD SEV-SNP. It requires software control and brief physical access; no simple patch is available.
Researchers analyzed a tech-support-scam kit delivered through Google Ads that uses anti-analysis checks and fake Windows or macOS alerts to pressure victims into calling scammers. It affected at least 619 organizations in two weeks.
Researchers traced 108 ads posted over 48 hours from a compromised verified HBO Max Reddit account to PasteSwitch, a cross-platform operation delivering macOS and Windows stealers, fake wallet apps, and cryptocurrency clippers.
