In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2388 articles
Pillar Security demonstrated sandbox escapes in Cursor, Codex CLI, Gemini CLI and Antigravity using workspace files that trusted host tools later executed or scanned. Several flaws were patched; Google downgraded two Antigravity findings.
Group-IB says HollowGraph uses compromised Microsoft 365 calendars and Graph API traffic for tasking and encrypted file exfiltration, refreshes Entra ID credentials over DNS, and is linked to Cavern; the campaign’s operator remains unattributed.
Rapid7 says an exposed server held 1,048 files documenting an apparently AI-assisted phishing toolkit and an active Mexico campaign using a fake CURP site and WebDAV delivery tied to CVE-2025-33053. Recorded launch events do not confirm infections.
Group-IB says HollowGraph uses compromised Microsoft 365 calendars for covert C2 and data theft, with DNS tunneling to refresh Entra ID credentials. Researchers link it to Cavern but say evidence is insufficient to attribute it to Lyceum.
ThreatLabz analyzes a July 2026 campaign targeting Middle East government entities, detailing the TELESHIM backdoor’s Telegram-based C2, post-compromise activity, and the MIXEDKEY loader that decrypts and loads BINDCLOAK.
Researchers found an exposed server hosting exploits and target lists spanning 11 countries. Scripts used DNS callbacks to check execution, but recovered evidence did not confirm successful compromises.
Aikido reports that malicious RubyGems releases used git_credential_manager to fetch and run binaries, with a load-time trigger and CI-environment checks. The dependency also appeared in Dendreo; another affected release belonged to a separate maintainer.
StepSecurity analyzed three RubyGems packages in the SleeperGem campaign, finding CI-evasion checks and a loader that downloads a daemon, installs systemd and cron persistence, and may attempt privilege escalation. The article provides cleanup and credential-rotation 步骤
Microsoft reports a surge in ACR Stealer attacks targeting enterprise customers. The campaigns use ClickFix, WebDAV and MSHTA to deliver malware that collects browser credentials, tokens and sensitive files.
Checkmarx identified seven malicious npm packages targeting Vite as part of ViteVenom, an expansion of ChainVeil attributed to SuccessKey. The malware uses blockchain infrastructure to retrieve payloads and deliver a RAT.
The article says CISA confirmed active exploitation of three of six flaws in on-premises SharePoint Server. It describes web-shell and machine-key theft techniques, lists affected builds and patches, and recommends AMSI scanning, threat hunting, and network hardening.
Elastic details REF9403, a Contagious Interview campaign using fake coding challenges and SVG steganography to target developers. Startup-triggered payloads steal credentials, wallet data, files and clipboard contents and provide a Socket.IO RAT.
OpenSourceMalware links the ChainVeil and ViteVenom npm campaigns to PolinRider, citing identical blockchain wallets and XOR keys, shared markers, and overlapping targeting of developer tools.
Volexity traced UTA0533’s compromise of SonicWall SMA 1000 appliances to two zero-days, detailing the exploit chain, malware, post-compromise activity, indicators, and available patches.
Seqrite analyzed a GST-themed phishing campaign targeting Indian businesses and taxpayers. Its multi-stage .NET chain concealed payloads in bitmap pixels and delivered Remcos RAT, with fileless execution and persistence techniques.
LevelBlue researchers report new Blind Eagle loader techniques and a customized AsyncRAT build featuring WNF injection and browser profile cloning. Shared Photo Studio artifacts link multiple toolchains.
Researchers describe GoSerpent activity targeting Southeast Asian government and diplomatic entities, using RATs, credential-dumping and file-collection tools, then Stowaway and TmcLoader/TmcPayload for configured network-share exfiltration. A possible TetrisPhantom tie
A ReversingLabs investigation details ClickFix attacks using fake verification pages and clipboard-injected commands. One university site reportedly exposed 5–10 students’ browser data; researchers matched 4,000+ samples and recommend behavior-based detection and system
LevelBlue researchers report finding hundreds of compromised WordPress sites used in a ClickFix campaign. They describe Polygon-based C2 resolution and a macOS infostealer that collects sensitive data and sends it to genomicsforge[.]com.
Kudelski Security uses public data and stealer logs to map changes in DPRK fake IT worker infrastructure, identify VPN exit nodes and internal network clusters, and assess possible organizational links with varying levels of confidence.
Huntress analyzes two SafePay ransomware incidents, detailing RDP access with valid credentials, data archiving, network-share encryption, malware behavior, and detection opportunities.
Group-IB reports that ClickLock uses fake verification and repeated password prompts to steal macOS credentials and other data. Researchers say it affected at least 100 systems in 33 countries and can install a persistent GSocket backdoor.
Proofpoint analyzes Cruciferra, a crypter used by multiple threat actors to deliver RATs and infostealers. The service employs techniques including BYOVD, indirect syscalls, custom encryption, and modified Process Ghosting to evade defenses.
Researchers describe an active campaign since at least May 2026 that abuses the ViPNet update system to deploy five malicious modules, including a Rust backdoor. They link it with low confidence to an unknown Chinese-speaking APT group.
