In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2384 articles
Researchers analyzed AWS CloudTrail activity from more than 40,000 identities across 125 cloud environments, using behavioral clustering to identify functional roles and lightweight classifiers to support scalable identity detection.
Silent Push investigated a Discord job ad seeking Western and Latin American proxies for remote tech interviews and payments, assessing the recruiter with high confidence as a North Korean IT worker based on technical, financial, and infrastructure indicators.
KTH researchers trained an agent on traffic from a repeatedly attacked industrial network replica. Packet-count belief tracking nearly matched a full-visibility baseline, but the study did not test generalization and flags operational-safety concerns.
An exposed directory revealed an intrusion targeting 3BB, including exploitation of FortiGate CVE-2024-21762, MeshCentral persistence, connected agents, credential-harvesting tools, and evidence of root-level access.
Acronis researchers detail Red Heron’s exploitation of vulnerable Gitea servers to steal source code, collect credentials and move into victim networks, alongside analysis of the JITTERLY implant and embedded SIXZUT rootkit.
Researchers link a RubyGems package campaign to OpenAI agents, describing code execution on RubyDoc.info servers and data scraping. OpenAI and Ruby Central disputed or qualified the attribution; RubyGems said it found no evidence the attempts succeeded.
CYFIRMA reports a tax-themed campaign using ten fraudulent .shop domains to deliver a VHDX containing a loader and DLL. The malware injected into Runtimebroke.exe and attempted, unsuccessfully, to contact xvcbvgfr[.]com; no C2 session was established.
Researchers say the Twitch Enhanced Viewer extension stole session tokens from more than 31,000 users by routing authenticated requests through external proxies, where credentials could be recorded in cleartext logs.
Microsoft says actors linked to ShinyHunters, Helix, and others use passkey-themed social engineering, AiTM phishing, and device-code flows to hijack Microsoft 365 accounts, add MFA methods, and steal cloud data.
Anthropic says ShinyHunters-linked actors used Claude-assisted pipelines to scan 1.8 million Android apps for secrets, while Russian- and Chinese-linked groups used the AI in espionage and cyberattacks. Anthropic banned accounts and strengthened safeguards.
DomainTools analyzes leaked Bauman University records, saying Department No. 4 trained roughly 250 students in military intelligence, cyber effects and information protection, with reported links to GRU units associated with APT28 and Sandworm.
A Censys scan-based investigation identified AI-built education apps collecting student data, including homework photos, essays, voice, and screen activity. Some lacked privacy policies; one exposed default demo credentials and shared a host with tunneling services.
Socket found a Twitch extension forwarding OAuth session tokens for about 31,000 Chrome and Firefox users to JeetBot proxies. Fixed versions are now available; users should revoke existing Twitch sessions.
Rapid7 describes how fraud marketplaces such as Xleet, Blackpass, Infodig, and Styx sell stolen accounts, infrastructure, and cashout services, while activity shifts toward smaller shops and alternative channels.
Researchers demonstrated that weak carrier identity and ownership checks, IMEI leaks, and block-list sharing gaps can let attackers disable phones and connected devices. They proposed stronger identity checks, device certification, and improved data sharing.
Sysdig TRT traced a marimo CVE-2026-39987 intrusion: an operator used a hand-built toolkit and harvested AWS credentials to retrieve an SSH key and reach a bastion in eight seconds. The report details the attack chain, detection signals and mitigations.
An analysis of 96 SourTrade domain IoCs found related typosquatting domains, malicious email-connected domains and IP addresses, and historical DNS activity. SourTrade has reportedly used malvertising to distribute unfinished malware targeting retail traders and crypto-
Sophos researchers analyzed a Cyclops Blink variant found on compromised Cisco FMC devices. The x86-64 Linux implant adds generic SysV persistence, network scanning, packet surveillance, and expanded file-transfer and payload-execution capabilities.
Proofpoint and Volexity report that multiple cyber-espionage groups used BlueMoon to chain Chrome and Windows zero-days, targeting NGOs, U.S. aerospace and defense firms, and Vietnamese manufacturers.
Cisco Talos says three threat clusters exploited CVE-2026-20079 and CVE-2026-20316 in Cisco FMC devices, deploying Qilin ransomware, Cyclops Blink, web shells and credential-theft tools. Cisco released hot fixes and urges customers to install them.
Researchers say UNC3569 exploited CVE-2026-51990 in Sogou Input Method to deliver GRAYRABBIT via a crafted link. Tencent patched the exploit path in version 16.3.0.3498, though the embedded browser remains outdated and insecurely configured.
Microsoft reports attackers impersonating IT staff by phone and text to steal Microsoft 365 access, add their own MFA methods, and quietly extract files and email through Microsoft Graph and cloud services.
Check Point researchers found that crafted prose could make tested LLM gatekeepers miss embedded instructions, while a more capable target model recovered and acted on them in 17 of 18 trials.
FortiGuard describes a Casbaneiro campaign targeting Latin American users with phishing lures and a multi-stage Windows infection chain. The malware steals email data and delays command-and-control activity until victims visit targeted banking sites.
