In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2386 articles
Adversa AI researchers describe Cryptographic Context Injection, which uses encrypted prompts to evade AI safety filters. Their examples target Grok and Gemini; they say the attack’s success against Gemini had declined but may still be possible.
Abnormal researchers say iAuthFlow V2 may relay phishing authentication through an attacker-controlled browser and register a passkey, potentially preserving Gmail access after password resets. Their analysis is based on seller material, not malware testing.
SOCRadar reports that attackers use FTP server banners as dead-drop resolvers to deliver E4del and PINHOLE RATs. The report details their infection routes, capabilities and evasion techniques, and says the activity continued through August 2026.
zLabs says ToxicPanda 2.0 targets financial apps across 16 countries, using Accessibility overlays to steal credentials. Its analysis details Wireless Debugging/ADB shell access, lock-screen credential theft, and delivery through Amazon AWS-hosted buckets.
Researchers traced a multi-stage Android malware infection to DoFun head-unit update software. Attributed with high confidence to MoYu Group, the malware enables ad fraud and proxy-botnet activity; the vendor says it fixed the distribution issues.
Positive Technologies details FamousSparrow attacks in 2026 using new SquawkDoor and updated SparrowDoor backdoors, delivered through malicious LNK files and compromised websites displaying fake certificate prompts.
Bitdefender reports that SilkParasite targeted government bodies across Central Asia for nearly a year, using seven malware families. Its investigation found spearphishing delivery, DriveSilkRAT’s Google Drive command channel, and evidence of AI-assisted development.
Google and other researchers describe suspected Russian clusters using OAuth, app-password and WhatsApp device-linking lures, alongside infostealers and malware, to steal tokens and expand access across academia, defense and government targets.
Three malicious Rust crate releases added a typosquatted dependency whose build script downloaded and ran a payload during compilation. The releases were removed within 86–107 minutes; RustSec reported no evidence they were used.
Three hijacked Rust crates introduced a typosquatted dependency whose build script downloads and runs a platform-specific backdoor. The crates were removed, and researchers report infrastructure overlap with campaigns attributed to North Korean actors.
A supply-chain attack compromised three Rust crates, adding a typosquatted dependency that ran malware during Cargo builds. The backdoor targeted Linux, macOS and Windows; Rust removed the releases, and affected build hosts should be treated as compromised.
Hunt.io reports that Operation CameraSwarm compromised 14,530 Dahua cameras in Ukraine and Russia, using brute force and authentication bypasses to deploy a persistent backdoor. The report does not establish the operator’s motivation.
Check Point researchers reverse-engineered Microsoft’s signed BTR.sys remediation driver and demonstrated that attackers with load-driver privileges can use it for kernel-level file and registry operations, including disabling security tools. No real-world abuse was||||
LevelBlue says it reproduced ShieldBreak on patched Windows 11 24H2 and Server 2025: a PoC that redirects Defender cleanup through a timing race to plant phoneinfo.dll, then triggers SYSTEM execution via QueueReporting.
Silent Push researchers confirmed Astroproxy resells Peer2Profit bandwidth and found its proxy network could reach internal resources when a DNS name resolved to an internal IP, despite a filter blocking direct internal-IP requests.
Researchers demonstrated a remote Spectre attack that recovered a deliberately planted JWT from a co-located Cloudflare Worker at up to 12 bits/s and 99.16% accuracy. Cloudflare says mitigations are deployed and it found no signs of exploitation.
Aikido reports that malicious dependency proc-macro1 compromised append-only-vec, arrayref and internment, using build-time payloads to target browser credentials and wallet data and establish macOS persistence; the C2 uses 23.254.165.112.
A compromised maintainer account published poisoned arrayref, internment and append-only-vec releases that pulled in typosquatted Rust droppers, enabling code execution during builds. Step Security traced the attack and reproduced its outbound connection; the malicious1
ThreatFabric details Manic, an Android malware family focused on Ukraine that steals credentials, spies on victims and remotely controls devices. It can also relay encrypted data through nearby infected phones when direct internet access is unavailable.
CloudSEK analyzed 40 removed npm typosquatting packages that used WSL to deliver a Windows stealer targeting crypto wallets, browser data and Telegram sessions. The payload host was removed, but the C2 was still responding at the time of analysis.
Datadog’s analysis of N4D’s 33.8-go-titan agent confirms MCP command-tool abuse, broad autonomous scanning, multiple Linux persistence methods, and controller reporting. The researchers provide indicators and defensive guidance.
Google tracks three suspected Russian espionage clusters targeting academics, diplomats, and defense-related individuals through app-password and OAuth phishing, device linking, and infostealer malware. It reports disrupting infrastructure and offers mitigation guidance
Malwarebytes found 41 fake game and software download sites using JavaScript click handlers and affiliate redirects to deliver a signed Download Studio installer. The installer was not shown to be malware, but its updater was abused in 2020.
Hunt.io says the 35-day CameraSwarm campaign compromised 14,530 Dahua cameras using brute force, two vulnerabilities, and recovery codes. Attackers installed persistent p2pwn accounts; owners are advised to check devices and update firmware.
