In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2385 articles
GTIG and Mandiant describe Breeze Comet intrusions into Brazilian organizations, using phishing, RMM tools, vulnerable JBoss servers and custom malware to reach payment systems. The group has executed hundreds of fraudulent transactions; expansion abroad may be underway
Researchers traced an unsigned, GlobalProtect-themed MSI through Myanmar geofencing and Google Sheets tasking to a follow-on payload. The evidence supports malware activity but does not establish attribution to SideWinder or another actor.
ThreatFabric details StreamRat, an Android banking trojan promoted through ads targeting Spanish-speaking users. Its dropper installs the malware, which abuses Accessibility Services and screen capture for remote control, credential theft, and data collection.
Huntress traced a Microsoft 365 AiTM phishing attack to the Knight Office kit, which captured session tokens and enabled unauthorized device registration and Windows Hello credentials. Telemetry linked at least nine token-replay attacks to the kit.
Malwarebytes analyzed a fake GTA 6 leaked-copy site that profiles connected wallets and can seek transfers or token and NFT approvals across seven blockchains. The article explains the code and advises users to reject suspicious wallet requests.
CIS reports an active phishing campaign targeting U.S. state, local, tribal, and territorial networks with a PowerShell WebSocket RAT and ScreenConnect and Pulseway RMM tools for persistent access.
AhnLab analyzes a malicious LNK disguised as a seafood purchase request that displays a decoy HWP document, runs scripts on a 14-minute schedule, sends system data through Backblaze B2, and retrieves follow-up commands.
AhnLab details MoiClient, a backdoor delivered in an invoice-themed VHDX that uses DLL side-loading, an RPC-based UAC bypass, and a vulnerable driver to disable security tools, persist, and deploy a browser-information stealer.
Forescout researchers used Claude Code to port a CVE-2021-31886-based RCE exploit from a WAGO 750-852 to a 750-831, requiring extensive oversight and over $500 for the final RCE stage; a C2 follow-up permanently bricked the PLC.
Kaspersky details Mirage Kitten’s use of NodeRabbit and PollCat, cross-platform RATs delivered in trojanized coding challenges to targets in the Middle East and Africa.
Huntress traced malicious activity at three MSP customers to a compromised Atera RMM instance. The actor created local administrator accounts and installed Cloudflared tunnels; Huntress isolated affected endpoints before the attacks progressed further.
Huntress details a campaign using fake documents and software updates to install a trojanized Exodus wallet that loads a modular RAT, enabling hidden remote access, browser credential theft, and SOCKS proxying.
Mandiant details BREEZE COMET’s intrusions into Brazilian financial and related organizations, including custom malware, compromised websites, credential theft, and fraudulent transfers, and provides indicators and defensive recommendations.
Sophos researchers analyzed 15 incidents linked to The Gentlemen ransomware operation, detailing how affiliates gain access, escalate privileges, evade defenses, exfiltrate data and deploy ransomware—sometimes within 24 hours of observed post-compromise activity.
Kaspersky says Silver Fox likely distributed ValleyRAT through signed QN Wallpaper adware, using DLL sideloading to run the backdoor in a trusted process. Its analysis was based on one submitted installer and gave no victim count for this route.
Microsoft details TerminalFix, a ClickFix campaign using fake Cloudflare CAPTCHA prompts to run PowerShell, deploy in-memory payloads, persist, conduct reconnaissance and provide a Python reverse tunnel. Microsoft saw no hands-on activity.
A detailed analysis links Clop’s Windchill data-theft campaign to CVE-2026-12569, describing custom JSP implants that can steal files and decrypt stored credentials, along with indicators, scoping advice, and defensive measures.
Netskope reports an EtherHiding campaign using BSC testnet contracts to deliver malware through more than 5,400 compromised sites. A newer variant forges a WebRTC answer to open a covert C2 channel without signaling traffic.
Sygnia reports that Fire Ant compromised Cisco routers and related systems to capture network traffic and reach connected high-value environments, using hidden GRE tunnels, custom malware and a disguised backdoor called BridgeAgent.
GreyNoise identified 824 IPs spoofing AI-crawler identities to scan for exposed credentials and configuration files. None matched published vendor ranges; it could not confirm that any files were accessed or secrets stolen.
Socket found 13 trojanized Composer themes that inject gambling redirects and, on vulnerable iPhones, a WebKit-to-kernel exploit chain delivering spyware that steals device data and cryptocurrency wallet seeds.
Check Point researchers developed a static pipeline to deobfuscate JSCeal’s compiled V8 bytecode, revealing credential theft, keylogging, surveillance, and HTTPS interception. They also document newer payload encryption, V8 version changes, and macOS targeting.
Unit 42 reports that Spring Ring operators used Microsoft Teams help-desk impersonation and voice phishing to target over 150 employees at 10+ companies, delivering malware and attempting an NTLM relay attack; defenses blocked the observed activity.
Researchers found installers posing as adware that deploy the ValleyRAT backdoor through DLL sideloading, disable Windows Defender, and collect keystrokes, clipboard data, screenshots, and system information.
