In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2386 articles
Unit 42 reports that XCSSET v40 infects developers who build compromised Xcode projects, then spreads through shared source code. New modules hijack Chrome and replace Telegram Desktop, while the malware adds evasion tactics and attempts to disable macOS protections.
Netskope analyzed 28 malicious npm package versions across four namespaces. Their stealer downloads Bun, harvests developer and CI/CD credentials, and resolves its exfiltration host through an Ethereum smart contract.
ChainDrop spread through compromised npm packages after a maintainer’s GitHub account was breached. The worm uses GitHub Actions releases and Bun-based payloads to steal developer and cloud credentials and propagate to more packages.
Unit 42 analyzed more than 4 million dynamic reports and found 45.32% of malware samples with C2 activity made at least one direct-to-IP connection, exposing limits in DNS-based defenses. The research details Phorpiex, SectopRAT, Mozi and Boatnet activity and proposes Z
Aqua describes a multistage XMRig cryptojacking campaign in containerized Node.js applications, including memory-based execution, persistence and mining traffic. The exact initial exploit was not determined, and Aqua found no evidence of access to customer secrets.
FortiGuard Labs detailed a QuickFox supply-chain compromise that delivered an FDMTP implant to selected Windows users. QuickFox removed the malicious components from its Windows installer in version 3.59.6 after Fortinet's notification.
Wiz says attackers used a compromised maintainer account to publish malicious npm packages that spread to more than 400 packages. The malware steals credentials and secrets, establishes persistence, and retrieves C2 domains from an Ethereum contract.
A malicious npm preinstall hook in Keyv, Cacheable, and other packages steals developer and CI credentials, spreads by republishing trojanized packages, and installs persistence. The investigation remains ongoing.
Talos analyzed AI-related artifacts from adversaries and found models helping with malicious software, fraud, credential theft and vulnerability research. Simple claims of authorization and task-splitting often bypassed safeguards.
Netskope analyzed a campaign delivering infostealers through ClickFix and trojanized GitHub repositories impersonating AI and developer resources. Its two-stage SmartLoader chain uses EtherHiding on Polygon to resolve C2 at runtime.
SOCRadar says DOUBLECUP has been active since early June 2026, using fake CAPTCHA ClickFix pages and PNG steganography to deliver CountLoader on Windows and macOS and the DeviceManager RAT on Windows.
Unit 42 says malware already running on Windows can abuse Google Password Manager’s synced passkeys through three Pass-ta-key attacks, bypassing user verification or extracting private keys. Google removed one log exposure, and eBay fixed a validation flaw.
Aikido reports that a Shai-Hulud supply-chain worm compromised Keyv and related npm packages, using install scripts to steal credentials and spread through npm packages and GitHub repositories; at least 444 packages were affected.
Analysis of Coruna and Predator shows how spyware checks device and browser signals to avoid unsuitable targets and research environments. Tests found that Coruna’s IndexedDB probe can indicate private browsing and its checks can detect Lockdown Mode.
Netskope analyzed 28 malicious npm package versions across four namespaces. Their stealer collected developer and CI/CD credentials, then sent encrypted data to a C2 domain resolved at runtime through an Ethereum contract.
Netskope traced more than 12,700 FakeCaptcha PDFs on Webflow’s CDN to an active traffic-distribution network that filters visitors and routes them to malware, ad landers, or a premium-SMS scam.
A fake Bank of America alert leads Windows users to a multi-stage script chain that bypasses UAC, installs and hides ScreenConnect, and connects to attacker infrastructure. Mac users are directed to pages harvesting banking credentials and personal data.
A worm dubbed ChainDrop compromised hundreds of npm packages, including widely used projects. Its payload can collect credentials and cloud secrets, exfiltrate data, and spread through npm packages and GitHub repositories.
Hunt.io researchers analyzed files from an exposed directory, detailing a Windows intrusion attributed to The Gentlemen. The toolkit used EtherRAT, which retrieves rotating C2 domains from an Ethereum smart contract, alongside other tools for persistence and access.
Unit 42 describes three post-compromise attacks against Chrome’s Google Password Manager on Windows that could expose passkey accounts or keys. The article says they require existing malware and that current exploitability and remediation remain unclear.
Researchers describe malicious npm packages impersonating Alibaba private packages to deliver a cross-platform RAT to developers. The article also reports a poisoned mrmustard release capable of stealing developer and cloud credentials.
ASEC links Larva-26005’s current Xctdoor activity in Korea to earlier CRAT attacks, detailing delivery through disguised installers and LNK files, malware behavior, and suspected ties to North Korean actors.
Bitdefender researchers detail a multi-stage Java malware campaign spread as fake Xeno Roblox cheats. The final payload steals accounts and financial data, spies on victims, and enables remote control of infected Windows systems.
K7 researchers analyzed Octagon, an Android threat impersonating Bahrain’s BH Alert app. It decrypts and dynamically loads payloads, abuses VPN and Accessibility services, and uses fake accounts for persistence; the child app captures lock-screen credentials.
