In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2386 articles
Unit 42 analyzed ChainDrop, an npm worm reported in over 400 packages. It steals developer and CI credentials, spreads through stolen publishing tokens and resolves C2 through Ethereum. Its operators remain unattributed.
MIT CSAIL researchers demonstrated TONTOU, an interrupt-injection technique that re-poisons branch predictor state after Spectre v2 neutralization, leaking Linux kernel memory on tested AMD Zen 2 systems. Intel exploitation is possible but more complex.
Huntress analyzed a Go-based macOS infostealer delivered through ClickFix. It targets credentials and Apple Keychain data, and can alter cryptocurrency transactions to divert a configurable portion of funds.
Gen Threat Labs describes two H1 2026 campaigns: banking malware delivered through compromised business mailboxes manipulated proxies and browsers, while a Rust clipper replaced crypto addresses and used Binance Smart Chain for C2 pointers. The report also offers dete
Varonis researchers say a crafted link could seed instructions into Atlassian Rovo and, using its access to connected services and agent capabilities, expose organizational data. Atlassian was notified and fixed the issue.
Researchers analyzed an npm campaign involving more than 700 malicious packages that execute malware when imported. The downloader targets Windows, Linux, and macOS, uses HTTPS and DNS TXT records for payload delivery, and can establish macOS persistence.
Check Point researchers detail five workerd vulnerabilities, including a cross-tenant secret-read exploit and a Code Mode sandbox escape. Cloudflare says managed Workers are fixed; self-hosted deployments should update to workerd v1.20260619.1.
DarkOwl profiles ExfilSquad, which claims breaches of 15 organizations. The UK Police National Legal Database confirmed that contact information affecting more than 100,000 police officers and staff was compromised and published; other claims remain unverified.
Elastic Security Labs describes a Shai-Hulud campaign that reportedly compromised more than 400 npm packages. Its CHAINDROP worm uses preinstall hooks to spread, steals developer credentials, and resolves C2 through an Ethereum smart contract.
Zenity’s PleaseFix research demonstrated zero-click prompt-injection attacks against ChatGPT Atlas and Claude in Chrome, enabling phishing, account takeovers, data exfiltration and unauthorized purchases. OpenAI acknowledged the findings; Anthropic classified them as ““
VulnCheck found the ENDLESSDOORS backdoor in firmware for at least 20 Zbtlink router models. The boot-starting implant uses an unauthenticated command channel that can be hijacked to obtain a root shell.
Jamf Threat Labs analyzed a fake Zoom installer that uses a .NET downloader to deliver Overlord RAT on macOS. The researchers describe its execution, C2 configuration and capabilities; they do not attribute the campaign to a specific actor.
Huntress analyzed a ClickFix infection that delivered a Go-based macOS stealer. It targets Keychain and browser credentials and can siphon cryptocurrency to attacker-controlled wallets; the campaign used infrastructure linked to sanctioned Aeza Group.
Google GTIG links UNC6671 activity across BlackFile, Redact, Pink, Helix, and Falcon, detailing helpdesk vishing, AiTM credential theft, SaaS data exfiltration, changing targets, and defenses.
Huntress reports that attackers used SQL injection in a public-facing Java application to install khunt in an Oracle database and run commands with SYSTEM privileges. Registry-hive theft was suspected, but successful exfiltration was not confirmed.
Microsoft tracked more than 250 domains using server-side fingerprinting to hide fake macOS download lures from crawlers and sandboxes. The analyzed command-driven chain delivered AMOS; the wider cluster also distributed MacSync.
Proofpoint found a campaign impersonating COLDCARD and exploiting concern over a suspected $88.6 million Bitcoin theft. A fake audit tool prompts for elevated access and installs ScreenConnect, potentially giving attackers remote access.
Palo Alto Networks researchers describe Pass-ta-key techniques in which Windows/Chrome malware can use Google-synced passkeys without user interaction. Variants can register an attacker key or extract a master secret; Google was notified and reportedly rolled out some m
Resecurity reports exploitation of CVE-2026-15409 and CVE-2026-15410 to gain root access on SonicWall SMA 1000 appliances, linking activity to UTA0533 and INC Ransomware and detailing persistent implants and credential harvesting.
ChainDrop reportedly infected 440 NPM packages with 2,212 malicious versions. The malware steals developer credentials, propagates through NPM and GitHub, and uses Ethereum for command-and-control. Developers are advised to rebuild affected systems and rotate secrets.
Netskope traced more than 12,700 similar FakeCaptcha PDFs on Webflow’s CDN to a traffic-distribution network that routes visitors to malware, reseller infrastructure, or scams. Its analysis describes the gate’s filters and more durable detection signals.
A Mini Shai-Hulud npm worm has spread to at least 444 packages, stealing developer and CI credentials, exfiltrating data, and using compromised accounts to poison packages and repositories.
Huntress traced an attack on a public-facing Tomcat application to SQL injection, which let attackers install the khunt toolkit in Oracle, reach Windows SYSTEM-level execution, and copy registry hives containing credential hashes.
Team Cymru used passive network telemetry to identify two Mevspace IPs and more than 40 victim-themed domains consistent with Push Security’s Cluster A phishing infrastructure reporting, while noting the findings do not independently attribute the activity.
