In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2386 articles
Zscaler details ChainDrop, a Shai-Hulud variant that poisoned npm packages, stole credentials, and spread through developer tokens. It uses Ethereum-based C2 and IDE hooks, and may trigger destructive activity when stolen tokens are revoked.
Sophos analyzed four 2026 intrusions in which attackers used malicious MSI installers and script loaders to deploy Deno, then ran obfuscated JavaScript in memory for host fingerprinting and command-and-control.
An investigation traces a ClickFix infection through signed WinWrapIDE.exe, four decoy DLLs and BabaDeda to CNCMachineRMS, a RAT with shell, file, screenshot, persistence and account-backdoor capabilities.
A joint agency advisory details Gunra ransomware’s VPN exploitation, credential theft, MFA bypass and double extortion. It also describes a Linux encryption weakness that may allow recovery and recommends patching, segmentation and isolated backups.
AhnLab details attacks from April to August 2026 in which Larva-26010 targeted Korean web servers and MS-SQL systems, installing SoftEther VPN, web shells, and SqlShell. The initial intrusion method remains unknown.
Wiz researchers reverse engineered an actively exploited Metabase SQL injection flaw affecting versions 1.58 and later. They traced it to an unchecked user-id value in password-reset requests and urged self-hosted users to patch.
CloudSEK details TXTBOOK, a dependency-confusion campaign that published 993 malicious npm packages mimicking T-Bank’s private namespace. The packages can execute a Sliver implant, delivered through DNS TXT records, if resolved inside the bank’s network.
Researchers posed as a DeFi startup to hire suspected Famous Chollima operatives and monitor their work, documenting forged identities, remote-access practices, tools, infrastructure, and risks from trusted insider access.
Zscaler ThreatLabz analyzes Abyssos, a modular Windows RAT with encrypted C2 communications, extensive remote-control and data-theft commands, obfuscation, and optional anti-analysis checks.
Hunt.io analyzed two exposed directories documenting credential theft, SQL injection, camera and router exploitation, and proxy tooling. One cataloged 58 compromised Ukrainian cameras; government and military attacks and exploitation by the second operation were unして
AhnLab describes phishing emails that use fake transaction receipts and a malicious PDF to install ScreenConnect, giving attackers persistent remote access to compromised systems.
Genians’ analysis of Kimsuky-linked Operation GitPower details spear-phishing attacks using malicious LNK files, PowerShell and Git-based C2, and evidence the group is experimenting with local LLMs and AI development tools.
Kaspersky says Head Mare exploited TrueConf Server flaws to replace client installers with PhantomCore backdoors and deploy PhantomGraph for command execution and credential theft. TrueConf patched affected versions in updates released June 18.
Varonis researchers demonstrated that a crafted link could seed prompts into Atlassian Rovo and trigger its ResearchAgent to expose internal data. Atlassian fixed the flaw before publication.
PortSwigger researchers showed how HTML and CSS in email can escape webmail message boundaries to steal credentials and tokens, hijack UI actions, and manipulate AI email tools. Proofs of concept span major providers; some issues were fixed, while others remained.
Elastic analyzed macOS telemetry showing Claude Code-parented credentialed requests to tunnel-hosted URLs, Cloudflare tunneling, and LaunchAgent persistence. The activity may have exposed a local admin app; the evidence did not establish an intrusion.
The episode analyzes an npm worm that compromised 400+ packages and stole credentials, a campaign publishing over 1,000 malicious npm packages, and a DPRK-linked technique that hides C2 IPs in empty Ethereum transfers.
Censys finds Mirai-derived botnets recovering after 2026 takedowns, while exposed ADB services and outdated Boa software persist. The analysis links this resilience to insecure IoT supply chains, weak defaults, and limited consumer ability to update devices.
A ClickFix lure prompts macOS users to run a Terminal command that downloads a Go-based stealer. Huntress says it can collect credentials and redirect some or all funds from supported cryptocurrency wallets to attacker-controlled accounts.
Researchers describe nearly 800 malicious npm packages using WEL1DROPPER to deliver OS-specific payloads, with DNS TXT fallback, platform-specific evasion and persistence, and a Linux chain leading to Sliver.
Genians researchers describe an APT37 campaign using NarwhalRAT, likely delivered through spearphishing and malicious LNK files. Their infrastructure analysis identified network indicators and 77 IP addresses potentially associated with victims.
LevelBlue researchers traced a phishing campaign using fake app stores, meeting pages and document portals to distribute unauthorized ScreenConnect clients. Shared web resources and DNS artifacts linked related infrastructure.
WordPress patched CVE-2026-64638, a pre-auth reflected XSS in its login screen. pwn[.]ai demonstrated a chain to PHP execution, but it requires an administrator to interact with an attacker-controlled page; WordPress says escalation depends on social engineering.
NMFTA says reverse-engineering found serious flaws in Bendix EC80 brake controllers, including potential remote code execution and traction-control disablement. Tests triggered ECU failures; a 2024 recall covered an estimated 450,000 units.
