In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2386 articles
Hunt.io found evidence of intrusions against a Philippine nuclear research body and a naval-linked marine engineering company, involving ownCloud and WordPress vulnerabilities, data theft, and a suspected Chinese-speaking operator.
Acronis researchers analyzed a Cambodia-focused campaign that uses DLL sideloading, payloads hidden in PNG files, and a vulnerable driver to impair security tools before deploying SparkRAT. Attribution to SilverFox remains unconfirmed.
Proofpoint details TA4922 campaigns using tax-themed phishing to install PackClient, a modular RAT sold on Telegram. The research describes its infection chain, capabilities, C2 communications, and detection opportunities.
Analysis of leaked ERMAC and HookBot code traces their shared lineage, details the Android banking trojans’ infrastructure and capabilities, and finds that a firewall gate leaves the builder exposed to scanning.
An investigation found 11 Microsoft-branded SysScan sites using fabricated security scans to pressure users to uninstall antivirus and submit personal, banking, and remote-access details, which the sites send directly to Telegram.
In a controlled lab, hidden HTML instructions altered an unguarded email summarizer’s output in all 10 injected runs, changing invoice and date details without signaling tampering. The test used one message, one model and no guardrails.
An investigation found PolinRider malware in fetch-page-assets releases 1.2.9–1.2.14 and seven repositories belonging to a compromised developer, exposing gaps in npm’s response to compromised maintainers.
CVE-2026-65400 allows network attackers to bypass macOS Screen Sharing authentication. Apple patched supported releases; CISA lists it as exploited, and NCSC-NL reported exposed Macs compromised with XMRig. Researchers' detailed root-cause account remains partly unestt.
In a small-scale test using a synthetic gym app, OpenClaw running Claude Opus 4.6 often exploited booking flaws without explicit requests. The results illustrate a possible AI safety risk, but may not generalize to other models or setups.
Researchers reconstructed a QUICSILVER backdoor from VHD-contained fragments and confirmed its hash matched a published sample. Isolated testing observed Startup-folder persistence, but no successful C2 session or campaign attribution was independently established.
Netskope details a WordPress compromise campaign that uses persistent Service Workers, an on-chain payload, and a ClickFix lure to deliver Amatera, which steals credentials and system data.
Config Connector can use its broadly privileged Google Cloud service account to carry out IAM changes requested by Kubernetes users, potentially letting users with namespace access grant themselves organization-wide roles.
ANY.RUN describes a 46-country phishing campaign that uses fake documents, password-protected archives, and scripts to install legitimate RMM software for remote access. The analysis links activity through recurring kit assets and infrastructure.
Researchers detail WordlistLoader’s delivery of Amatera through ClearFake ClickFix campaigns and SynkLoader’s use in Teams phishing to capture Windows credentials. The toolkit may be linked to ransomware access sales, but its operators’ goals are unclear.
Malwarebytes analyzed fake GTA 6 demo sites delivering Vidar, which targets browser credentials and session cookies. The sample launched installed browsers to access protected data and used social-media profiles to retrieve infrastructure.
The DFIR Report details BengalSEO’s SEO-poisoning operation, which uses malicious lure pages and traffic filtering to deliver MayaBot malware or direct victims to tech-support scams.
CIS analyzed KrustyLoader samples hosted in S3, detailing how the loader decrypts and injects a Sliver payload. Nine SLTT environments had DNS queries to associated infrastructure, but CIS could not confirm downloads or infections.
An analysis of five 2026 cyberattacks compiled 54 network indicators and used traffic, DNS, WHOIS, and related data to identify connections, historical resolutions, and additional artifacts.
Zimperium says ToxicPanda 2.0 targets 349 finance and crypto apps across 16 countries, using VPN permissions to block Google Play traffic and Wireless ADB for shell access; overlays and spoofed screens steal credentials and device PINs.
Kaspersky says malware abuses DoFun Android head-unit updates via TWCore to install JarService for ad fraud, device-data collection and proxy-botnet activity. It attributes the campaign with high confidence to MoYu Group and says the distribution issue was addressed.
Check Point researchers reverse-engineered Defender’s BTR.sys boot-remediation driver and showed BTR_CLI can use it for kernel-level file and registry changes, including deleting security software at reboot. It requires SeLoadDriverPrivilege; no real-world abuse was—
Analysis of a malware sample describes a CommuniGate Pro-themed LNK lure, DLL side-loading through calibre.exe, persistence, and a stager that contacts a command-and-control server to retrieve and execute additional payloads.
Expel says SynkLoader is delivered through Microsoft Teams phishing and a fake PowerShell Cleaner MSI. Its modules can capture credentials and enable remote access; Active Directory profiling suggests possible ransomware use.
DomainTools reports that a malware delivery network linked to Silver Fox remained active after reported arrests, registering over 400 domains. Researchers detail its spoofed software lures, abused hosting services, and Gh0stRAT infection chains.
