In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2385 articles
Huntress reports phishing lures that trick victims into installing Faronics Deploy, which attackers use to run PowerShell and install ScreenConnect. It observed more than 457 endpoints encountering lures in a month and a sharp decline in activity after August 21.
Morphisec researchers describe RevStealer, a Windows infostealer delivered through trojanized Electron apps. It uses anti-analysis checks, indirect system calls and Polygon-based C2 failover to steal sensitive data and evade detection.
Microsoft detailed TerminalFix, a ClickFix campaign that uses fake Cloudflare CAPTCHAs to trick Windows users into running PowerShell. Its reported chain includes DLL sideloading, PNG-hidden payloads, Active Directory reconnaissance and a persistent reverse-tunnel back
Unit 42 researchers introduce perturbation probing, a two-pass method that identifies neurons linked to LLM behaviors. Tests found that changing a small number of neurons could alter refusal behavior, highlighting risks from concentrated safety mechanisms.
Ten malicious versions of @7nohe/openapi-react-query-codegen were published through an abused GitHub Actions workflow. The package’s install-time payload steals credentials and can propagate through developer and CI environments.
Censys traced a campaign using PowerShell loaders and unplayable MP4 carriers to deliver NetSupport clients. The analysis identified 18 builds across 40 live endpoints and describes the infection chain, persistence, C2 infrastructure, and detection clues.
ReliaQuest details Gryxa, a financially motivated toolkit linked to a console listing 324 hosts. It uses RMM access, layered persistence, credential theft and endpoint-protection tampering, while collecting logs after defenders remove its visible implant.
Researchers linked a GitHub loader account to a workstation exposed in an infostealer log, uncovering Blind Eagle RAT builds, phishing materials, delivery infrastructure, and a multi-stage malware execution chain.
Aikido reports that Trinitite compromised 10 versions of an npm code generator, using a binding.gyp sandbox escape to run a credential-stealing worm that spreads through package registries and GitHub repositories.
StepSecurity reports that an issue-comment-triggered GitHub Actions workflow let an external contributor publish 10 malicious releases of @7nohe/openapi-react-query-codegen. Installation hooks ran an obfuscated payload that probed for credentials.
Researchers analyzed 290 indicators linked to a Microsoft 365 device-code phishing campaign, finding coordinated redirector and impersonation domains, 87 malicious IP addresses, and evidence that much of the infrastructure remained active.
Morphisec describes TeamPCP/UNC6780’s Hades supply-chain campaign, which uses Python startup hooks and malicious instructions in AI coding-tool configurations to run payloads, persist beyond package removal, and steal developer credentials.
Censys found Moobot source code, DDoS tooling, attack records, and a fraudulent identity-verification service in an exposed directory. The recovered code contains dormant download-and-execute functionality, and monitoring indicates ongoing Moobot activity.
Wiz says honeypots observed attackers exploiting exposed AI services, using blind prompt injection against agents, and adapting post-exploitation to steal AI credentials and deploy cryptominers.
Socket analyzed 19 malicious Chrome and Edge extensions linked to the Superior campaign. Their C2-controlled malware can steal wallet secrets, credentials, session data and browsing history; one Edge extension was still active when reported.
Huntress describes campaigns using public AI content and sponsored search results to lure users into running commands that install SectopRAT, MacSync, and AMOS malware, and outlines steps defenders and users can take to reduce risk.
Recorded Future details BlueDelta campaigns from September 2025 to April 2026 that used macro-enabled Word documents to deploy HOOKEDGE against government and diplomatic targets in Romania, Spain, and Türkiye.
CloudSek says an exposed directory revealed an Aurora affiliate’s activity against more than 20 organizations, including Active Directory compromises, Zig ransomware, AI-assisted planning, and payments traced through shared laundering infrastructure.
Researchers uncovered DragonDoll, a previously undocumented Android spyware family distributed through phishing pages posing as Chrome updates. It can remotely control devices, steal messages and collect extensive device data.
University of Toronto researchers say GPUThor evades TRR on tested NVIDIA Ampere GPUs, producing ECC errors, denial of service and a claimed root-level privilege escalation. NVIDIA recommends ECC, IOMMU/DMA isolation and workload restrictions.
BHIS ActiveSOC describes an Aur0ra-attributed intrusion involving vishing after email bombing, disguised Xray-core C2, noisy lateral movement, log clearing and in-place encryption. The report includes Sigma detections and remediation steps.
Netskope found a Python NodeStealer variant with keylogging, clipboard monitoring, screenshots, expanded credential theft, and two Telegram C2 bots. It queries more than 20 Facebook Graph API endpoints; researchers suspect some additions were AI-assisted.
Huntress describes investigations identifying five suspected DPRK workers across partner organizations, detailing identity, network, endpoint, and hardware indicators, including PiKVM devices, VPNs and proxies, altered documents, and unusual work patterns.
Validin analyzes domains and hosting linked to Russian cyber espionage clusters, using historical DNS, registration data, HTTP responses, certificates, and other pivots to identify candidate infrastructure and explain confidence limits.
