In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2384 articles
Huntress analyzed two phishing attacks using fake Adobe Browser-in-the-Browser pages to trick users into installing rogue ScreenConnect clients. The clients established persistent remote access and deployed cursor-hiding tools before Huntress stopped the attacks.
Huntress analyzed a fake GTA VI ISO distributed through search results, forums, social media, and torrents. It installs multiple RATs, an infostealer, and ransomware used as a wiper, while displaying a fake license error.
CrowdStrike says Slim Spider has targeted Brazilian financial institutions since at least March 2026, stealing cloud credentials and crypto-custody secrets. Separately, Breeze Comet has infiltrated financial systems to carry out fraudulent payments.
Sophos analyzed a Linux rootkit found in F5 BIG-IP APM environments that hooks Apache and PHP to inject a fileless web shell. Researchers say it was likely deployed after exploitation of CVE-2025-53521; ESET calls the malware PoisonedRefresh.
Barracuda Research describes a phishing campaign that uses a personalized DocuSign lure, CAPTCHA gating and an Adobe-themed prompt before a fake in-page Microsoft sign-in window harvests credentials.
Gen Digital reports that multiple infostealer families now target local data from AI coding agents, potentially exposing tokens, connected-service credentials, and conversation history. The company recommends protecting credentials, limiting access, and including agent,
Check Point researchers found that ChatGPT code containers across accounts could exchange data through shared Artifactory metadata, enabling hidden tasks to access a victim’s connected Gmail. OpenAI decommissioned the identified instance after disclosure.
Cisco Talos traced two ClearFake-related WebDAV infection chains delivering Amatera stealer. Follow-on payloads included ZigCryptoStealer, a reverse proxy, and an unauthorized NetSupport Manager installation.
A joint advisory says Russian state-supported LAUNDRY BEAR has exploited CVE-2025-66376 in Zimbra webmail since 2025, using the Ulej payload and Flowerbed infrastructure to collect emails and account data.
Aikido reports finding XCSSET in universal_file_viewer 0.1.5 on pub[.]dev. Malicious hooks are confined to the package's example projects, so the reported risk is to users who clone and build the example.
Part 1 examines AD RMS architecture and shows how ordinary domain users can discover clusters, inspect templates, and identify protected files, while AD RMS Service Group membership exposes the administrative surface tied to the cluster’s long-lived root key.
Researchers analyzed 84 network indicators linked to LockBit, Cl0p, Akira, Medusa, and Qilin, examining DNS traffic and historical resolutions to identify potentially malicious domains, IPs, and other connected artifacts.
Analysis of an exposed operator directory and campaign logs found 3,562 Redis servers compromised through unauthenticated rogue replication and used to run XMRig for Monero mining.
Researchers detail a phishing campaign targeting Latin American financial organizations with fake DocuSign and tax-document lures that install a custom HVNC backdoor for hidden remote access, data theft, and persistence.
SOCRadar describes PEEP, a post-compromise toolkit that disguises itself as a Chrome and Edge bookmarks extension, steals browser data, and uses a native-messaging bridge for host commands. Its operators and targets remain unknown.
CloudSEK found BigBear 2.0 used an Evilginx2-based AiTM framework to bypass MFA at 258 organizations and steal more than 5,000 Microsoft 365 credentials. The researchers said the operation was still active, though its phishing infrastructure had been offline for nearly
Rapid7 describes a Linux espionage toolkit targeting South Korean automotive and media organizations, combining a custom HAProxy backdoor, CurlRAT, and an SSH keylogger. Artifacts suggest possible links to North Korean actors.
Huntress says attackers used social engineering to install rogue ScreenConnect clients that ran VBScript and PowerShell payloads, established persistence, and spread to other connected instances. ConnectWise separately advised disabling file transfers pending a fix for,
A campaign uses spam comments on legitimate Itch.io games to direct users to fake Patreon game updates that install LummaStealer. The malware uses extensive anti-analysis checks, and new malicious accounts continue appearing after some were removed.
Kudelski Security and Sekoia analyze how North Korea organizes cyber operations across state agencies, threat clusters and overseas IT workers, using them for espionage, revenue generation and sanctions evasion.
CloudSEK says BigBear 2.0 stole 5,137 Microsoft 365 credential records, including 474 MFA-bypassed sessions, using Evilginx2, residential proxies, and Telegram exfiltration. The report includes infrastructure indicators and mitigation advice.
Sophos analyzed a Linux implant targeting BIG-IP APM webtop environments. It uses custom loading and runtime hooks to inject a PHP web shell into memory, while a local UNIX socket provides another route to an interactive shell.
Genians analyzed 13 malicious LNKs linked to Kimsuky’s Operation GitPower, finding obfuscated PowerShell, GitHub PAT-based payload retrieval, hidden scheduled tasks, Pastebin fallback C2, anti-analysis checks, and decoys bearing opencode metadata.
Elastic Security Labs documented REVSTEALER and four associated Windows programs, including one that disables updates and Defender before running a miner. The report details their capabilities, delivery, technical links, and response steps.
