In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2388 articles
AhnLab details Kimsuky spear-phishing attacks targeting foreign-affairs personnel with malicious LNK files that deploy PebbleDash, PrxClient, RDP tools, keyloggers and other malware to control systems and steal information.
Fortinet details a global phishing campaign using obfuscated JScript droppers and disguised Lua or AutoIt loaders to deploy RATs and infostealers, including Remcos, Agent Tesla, XWorm, and a Snake Keylogger variant.
Symantec describes Spirals ransomware compromising a South Asian IT services firm through an exposed IIS server, then stealing data and encrypting systems in under 24 hours. The actor was observed in one case.
Cisco Talos reports that UAT-11795 has used trojanized installers since at least June 2025 to deploy Starland RAT, steal sensitive data, and deliver CastleStealer or Remcos. The infection vector is unconfirmed; ClickFix is a suspected possibility.
Elastic researchers describe TELEPUZ, a modular Windows malware delivered through ClickFix and VIDAR. The actively developed threat uses WebSocket command-and-control and downloadable modules; researchers say it may be malware-as-a-service.
Talos details UAT-11795’s campaign targeting users in the U.S. and Europe with trojanized installers that deliver Starland RAT, a custom PowerShell C2 implant, and other malware to steal credentials and cryptocurrency assets.
Kaspersky details OkoBot, a Windows framework active since April 2025 that injects fake recovery prompts into Ledger and Trezor apps to capture seed phrases. Its toolkit also enables SSH tunneling, RDP access and surveillance; the report does not say how many users gave
A previously unseen Rust-based ransomware called Spirals was deployed against a South Asian IT company in June 2026 after attackers compromised an internet-facing IIS server. The actor is unknown; the attack involved data-theft threats and file encryption.
Researchers analyzed a low-detection, statically linked Linux backdoor delivered as a PNG-named ELF. It profiles hosts, communicates with C2, executes commands, transfers files, and supports reverse tunnels; later analysis noted similarities to Adaptix Agent.
Unit 42 analyzed TuxBot v3 Evolution, an IoT botnet framework with a multi-architecture agent, Go C2, Telnet brute forcing, IoT exploits, and fallback channels. Researchers found signs of LLM assistance and linked its operator to the Keksec ecosystem.
Trend Micro says the actor bandcampro used Gemini CLI to operate a botnet controlling eight systems at a dental clinic, migrate its C2 infrastructure, and access the OpenDental database. The AI also assisted with troubleshooting and password guessing.
Researchers analyzed TuxBot v3 Evolution, an IoT botnet with working brute-force and DDoS capabilities. Recovered code suggests LLM-assisted development, while implementation bugs disable several exploit and fallback command channels.
A July hunt found 2,417 newly compromised repositories linked to PolinRider, bringing the reported total to 4,367 across 2,152 owners. The campaign primarily injects payloads into project config files and also uses malicious font files.
Kaspersky traced OkoBot, an active malware framework that uses TookPS and SSH tunneling to deploy credential theft, spyware and cryptocurrency wallet phishing modules. The campaign has affected hundreds of users in more than 25 countries.
Proofpoint details TA458’s use of half-click exploits against webmail platforms to steal credentials, contacts, and emails. SpyPress can also establish persistent access on Roundcube, while a SOGo zero-day was patched as CVE-2026-8496.
Proofpoint details how Russia-aligned TA488 exploited CVE-2025-66376 in Zimbra webmail to steal credentials and emails from government and defense targets, establish persistent access, and exfiltrate data.
A security agent found that a B2B platform’s API accepted a client-controlled flag to reveal paywalled contact data without checking account entitlements. The platform fixed the flaw within two hours of triage.
Bitdefender researchers describe three Windows bind-link techniques that can hide attacker-controlled files from EDR tools, including silo-binding. Microsoft rated the findings low severity because they require administrator access.
Arctic Wolf researchers found 292 fake GitHub repositories distributing a BoryptGrab variant. A trojanized DLL sideloaded by a signed updater steals sensitive data and can bypass Chrome App-Bound Encryption through code injection.
Intruder describes an AI-assisted Joern pipeline that identified CVE-2026-3985, a blind SQL injection in Creative Mail requiring WooCommerce. The plugin was pulled pending review; users are advised to disable it until a patch is available.
Zscaler describes a ClickFix campaign that used Google ads and shared Claude chats to deliver MacSync Stealer to Mac users, where it could steal credentials, files, and cryptocurrency data. The shared chats were inaccessible by publication.
Researchers found Daxin and a previously unknown backdoor, Stupig, on a compromised Taiwanese manufacturer’s host. Stupig can run commands as SYSTEM from the Windows logon screen; a link between the tools is suspected but unconfirmed.
eSentire describes a TAG-150 infection at a finance customer, tracing a ClickFix command through DinDoor and DenoRAT to NightshadeC2, and reports that its analysts isolated the affected host.
Sysdig says an attacker used a leaked Azure service-principal secret to gain Global Administrator and root-level access, harvest keys, and add credentials to 26 app registrations, exposing visibility gaps across five Azure permission planes.
