In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2386 articles
Check Point Research attributes attacks on defense and aerospace targets in four countries to Lazarus Group, reporting exploitation of Windows CVE-2026-68820 in Operation Dream Job to deliver Troy, MISTPEN, ForestTiger and FudModule 3.1.
Jamf Threat Labs analyzed AmnesiaStealer, a three-stage macOS infostealer spread through ClickFix. It collects credentials and data, while a second module enables hidden, operator-controlled browser sessions; several attempted macOS bypasses failed in testing.
Scammers use Shopify’s Shop notifications to send fake order alerts with callback numbers, leading victims into refund scams. Huntress advises users to avoid unfamiliar contact details in orders and report suspicious purchases.
Acronis researchers detail a campaign targeting telecom, government, defense, and energy organizations in South Asia with PATCHCORD, SHEETCORD, and HACKERAI malware, assessing moderate-confidence links to APT36. Campaign infrastructure remained active at publication.
Symantec researchers detail Jewelbug’s espionage and crypto-fraud operations, including its browser and endpoint implants, government webmail watering-hole campaign, and database records of more than one million implant check-ins.
Researchers demonstrated Plug and Pwn attacks that use emulated USB devices or RDP USB redirection to trigger Windows installation of vulnerable vendor packages and gain SYSTEM access, even on fully updated systems.
Analysis of Project CAV3RN, observed targeting Israel, details GoogleService.dll and rnp.dll, DNS-based selection between direct HTTPS and a Google Apps Script relay, and brokered module loading and upgrades.
Check Point reports that a Lazarus-linked campaign targeting defense and aerospace organizations used Windows zero-day CVE-2026-68820 and several backdoors. Microsoft patched the flaw on August 11; CISA added it to its KEV catalog.
A technical investigation found fake CCleaner and other installers using a CScript-based chain to modify Chrome and install GhostDesk, which can capture keystrokes, form data, cookies, and screenshots.
Kudelski Security researchers link stealer-log evidence, gambling operations and infrastructure to DPRK-related actors, and assess that a fake IT worker manager used IPs associated with Emotet delivery. Several attribution and location findings remain uncertain.
Huntress analyzed an Akira intrusion that used an MFA-less SonicWall VPN and Safe Mode to disable EDR. The ransomware failed to encrypt files, but attackers had already exfiltrated credentials and file shares.
Testing found that Entra ID’s legacy WS-Trust autologon endpoint can bypass expected Smart Lockout and standard sign-in logging while revealing valid passwords, including on accounts where MFA or Conditional Access blocks sign-in.
Cofense reports a sustained rise in invitation-themed phishing since early 2025. Campaigns spoof event services to steal credentials or deliver remote-access tools, with some links choosing a payload based on the recipient’s device.
Socket reports that 520 of 522 analyzed extensions routed browser traffic through shared SOCKS5 proxies. The campaign included 274 extensions impersonating 66 brands, and the investigation documented evasion, subscription fraud, and post-review code changes.
CERT-AGID analyzed an INPS-themed phishing site that used AI to check uploaded documents. Tests found it accepted a fake ID and that instructions embedded in images could affect its responses; takedown procedures were initiated.
Kaspersky reports Head Mare exploited two TrueConf Server flaws for SYSTEM-level access, planted a web shell and replaced client installers with PhantomCore; it also deployed PhantomGraph. Targets included Russian organizations; patches were released June 18, 2026.
Check Point researchers detail a Lazarus campaign using job lures, trojanized PDF viewers, and compromised web servers to target defense organizations. The operation exploited Windows AFD.sys CVE-2026-68820, which Microsoft patched on August 11, 2026.
Unit 42 analyzes Kimwolf v7, an Android/IoT botnet targeting TV boxes. It adds HTTP/2 DDoS traffic with browser fingerprints and resilient C2 using ENS, Tor and a local proxy; researchers also detail ADB propagation and infrastructure.
AhnLab details a phishing campaign that delivers PhantomStealer through a malicious quote-review attachment. An injector uses UAC elevation and a vulnerable driver to disable security tools before stealing credentials, cookies, wallet data, and other information.
Netskope reports that a relisted Chrome extension added affiliate redirects triggered by updates and uninstalls after earlier versions stole AI conversations. The extension remains available, and Netskope recommends removing it and restricting extension installs.
Wordfence says attackers poisoned JSON from BdThemes’ cloud storage to exploit XSS in WordPress plugins, create rogue admins, deploy a web shell and persistence modules. WordPress temporarily disabled downloads for seven affected plugins.
Unit 42 analyzes Aeternum’s Polygon-based C2 and related malware deploying XWorm, XMRig and credential theft capabilities. Researchers detail on-chain command retrieval, weak encryption and blockchain infrastructure links.
CYFIRMA details how Lucid Stealer hides encrypted payloads in Node.js SEA and harvests browser credentials, wallet data and Discord tokens. Observed WebSocket and HTTP upload attempts to lucidstealer[.]one failed with HTTP 403 responses.
Netskope says a re-listed Chrome extension added affiliate redirects on updates and uninstalls in version 1.7.3.0. Earlier versions reportedly stole AI conversations; as of August 25, 2026, version 1.7.4 remained available with 200,000 users.
