In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2387 articles
Wiz describes Atlas, an AI system that maps code attack surfaces, investigates and adversarially validates vulnerability candidates, and tests them dynamically. Wiz reports more than 200 previously unknown findings and says it is working with maintainers on disclosure.
BlackFog analyzed MedusaHVNC, a RAT with a hidden virtual desktop module. Its five-stage infection chain decrypts a payload that uses legitimate Windows functions for covert browser interaction, screen capture, and clipboard access.
Darktrace details a customer intrusion involving compromised VPN credentials, reconnaissance, privilege escalation, Sliver C2, potential data exfiltration, and ransomware encryption. Incomplete response coverage allowed the attack to reach deployment.
ThreatLabz describes campaigns using Microsoft Teams vishing and Quick Assist for access, followed by PowerShell staging and evolving GoGRPC backdoors, data-theft tools, and SOCKS proxies, with growing focus on corporate targets.
Fake Steam troubleshooting posts reportedly trick users into running PowerShell commands that install XMRig. The script adds a Microsoft Defender exclusion, downloads the miner from msfconfig[.]icu, and creates a persistent scheduled task.
Confiant says SourTrade uses cloaked ads and browser workers to assemble session-specific Windows executables from a Bun runtime and attacker-controlled material. The final files’ payload capabilities are not established.
A malvertising campaign linked to SourTrade uses fake Solana, Luno, and TradingView pages to assemble malware in browsers. Confiant says randomized, session-specific builds and same-origin delivery help evade static detection; the current payload is undisclosed.
CTM360 reports that insurance phishing operators use sponsored Google ads and the InsureOTP Kit to relay credentials and OTPs to legitimate portals in real time, targeting providers across Saudi Arabia, Europe, the U.S. and India.
depthfirst published a working exploit for a patched GitLab flaw that lets authenticated users with project push access run commands as git on unpatched self-managed instances. The chain abuses two Oj parser memory-corruption bugs.
Proofpoint reports that actors are developing and advertising tools to place indirect prompt injections in emails, PDFs, calendar invites, and malvertising. The techniques are experimental, but the researchers say defenders should prepare for their use.
JUMPSEC says BlueNoroff’s Zoom and Teams phishing kit abuses trusted Telegram contacts, profiles browser wallet extensions, and uses fake meetings and ClickFix lures to deliver Windows and macOS malware. Researchers found five kit versions from May to July 2026.
AhnLab details attacks on MS-SQL servers attributed to Larva-26009, involving web shells, credential-theft tools, remote access and backdoors, XMRig mining, and SoftEther VPN infrastructure.
A fake Corepack site targets developers with downloads that install an infostealer and proxyware, while a separate path delivers adware-style software. Node.js contributors warned users, and OpenJS says the ISP was given 24 hours to address the abuse.
Recorded Future reports four new Golden Chickens malware families, detailing TinyEgg’s delivery and behavior, ChonkyChicken’s capabilities, and a modular variant that retrieves 14 capability modules from C2 infrastructure.
Hunt.io and Bob Diachenko report that an operator already inside Thailand’s Finance Ministry network used Hermes in YOLO mode for scans and file crawls. Exposed logs revealed attack tooling, but no evidence showed data leaving the network.
A campaign tracked as TA488 and CL-STA-1114 exploited CVE-2025-66376 in Zimbra Classic UI from at least July 2025, using crafted emails to steal mail, passwords and 2FA recovery codes. Zimbra patched the flaw in November 2025.
CERT-UA attributes a malware campaign targeting Ukrainian organizations to UAC-0099. A disguised script installs Notepad++ with the LunchPoke plugin, which creates scheduled tasks and deploys further loaders. CERT-UA recommends updating Notepad++, 7-Zip, and WinRAR.
Huntress says a Bing malvertising campaign used a fake Claude desktop installer to deliver SectopRAT, compromising at least 29 organizations. The chain used DLL sideloading and anti-analysis checks; the malware retrieves C2 addresses via Ethereum transactions.
StepSecurity says a malicious PyPI-only mrmustard 0.7.4 release stole CI publishing tokens and, on import, harvested credentials and installed three persistence mechanisms; sandbox testing observed the behavior.
Researchers found that flaws in email-to-SMS translation and message-client identity handling could place spoofed texts in trusted conversation threads under specific conditions. Carriers largely mitigated the issues before public release.
Trend Micro analyzes JADEPUFFER, an AI agent that reportedly exploited a live system, adapted through the intrusion, and encrypted and deleted database records. The attempt caused damage but lacked working extortion infrastructure.
A joint advisory details how Russian state-supported LAUNDRY BEAR exploits CVE-2025-66376 in Zimbra webmail to collect emails and account data, using Ulej and Flowerbed infrastructure for exfiltration.
Unit 42 reports that CL-STA-1114 uses CVE-2025-66376 to target Zimbra webmail with HTML-delivered JavaScript that exfiltrates credentials, 2FA scratch codes, session data and email history.
Cisco Talos describes msaRAT, a Rust RAT attributed to Chaos, which uses Chrome or Edge via CDP to establish WebRTC C2 through Cloudflare Workers signaling and Twilio TURN relaying, with ChaCha-Poly1305 encryption layered over DTLS.
