In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2388 articles
Hudson Rock researchers report that stolen WordPress credentials enabled a ClickFix campaign on an Artlist subdomain. They detail EtherHiding via Polygon, a DLL-sideloading chain and an in-memory RAT; Artlist had not commented at publication.
Socket researchers analyzed 11 NuGet game-tool packages that download and execute Windows payloads. The malware collects host and hardware data; three variants also support Telegram screenshots and remote commands.
SOCRadar profiles Krybit’s RaaS model, double-extortion activity and 2026 feud with 0APT. Data attributed to an April panel leak showed plaintext credentials, 20 victims in negotiation and no transactions on five wallets at the time.
Seqrite researchers detail a multi-stage campaign targeting Indian government job seekers with a fake recruitment lure, ControlR remote access, and a .NET RAT using Google Sheets and Drive for command-and-control. They assess an APT36 link with moderate confidence.
An attacker abused a vulnerable GitHub Actions workflow to steal an AsyncAPI service-account token and publish malicious npm packages. The packages deliver multi-stage malware capable of persistence, remote commands, and credential theft.
Socket researchers found compromised AsyncAPI npm releases that run an obfuscated loader when imported, fetch Miasma from IPFS, and can enable remote tasking and persistence. The poisoned source commit was published through GitHub Actions.
Researchers found a dormant browsing-history collector and active metadata tracking in the genuine ModHeader extension. Its empty allow-list prevented the collector from running, and there is no evidence it uploaded browsing domains. Google and Microsoft removed it.
Jamf Threat Labs describes CrashStealer, a native C++ macOS stealer delivered through a signed, notarized dropper. It collects credentials and other sensitive files, encrypts them with AES-GCM, and exfiltrates them to an attacker-controlled server.
An investigation traces five trojanized AsyncAPI npm releases to a vulnerable GitHub Actions workflow. Importing affected modules downloaded an IPFS loader that installed a persistent implant with remote shell capability; the article also details remediation.
Attackers pushed commits to two AsyncAPI repositories, triggering GitHub Actions to publish five npm versions with a Miasma RAT dropper that runs when packages are loaded. No npm token was stolen; all versions were unpublished, but existing lockfiles may retain them.
Datadog traced malicious code in five AsyncAPI npm package versions to stolen CI credentials, linking the compromise to a vulnerable GitHub Actions workflow and detailing the malware, attack path, and indicators of compromise.
ANY.RUN researchers analyzed Kratos, a Microsoft 365 phishing service targeting organizations in the US, Europe, and elsewhere, and detailed its attack chain, infrastructure, indicators, and detection and response guidance.
Trend Micro analyzed more than 200 session logs showing a Russian-speaking actor using Gemini CLI to migrate and operate a botnet targeting eight dental-clinic computers, alongside credential attacks and fraud planning.
Hunt.io researchers uncovered suspected China-linked intrusions against government systems in Afghanistan, Thailand and Taiwan, alongside financial-sector targeting. Exposed logs show Claude Code and DeepSeek-v4-pro supporting reconnaissance, exploit development and, in
ESET researchers found 11 outdated, Microsoft-signed UEFI shims that can let attackers run untrusted code at boot and bypass Secure Boot. Microsoft revoked the vulnerable binaries in its June 9, 2026 update.
Jamf researchers describe CrashStealer, a macOS infostealer delivered through a signed, notarized installer. It impersonates CrashReporter.app, targets credentials and wallet data, and encrypts stolen files before sending them to a C2 server.
Proofpoint says attackers used spoofed OAuth client IDs to enumerate Microsoft Entra ID accounts and infer credential validity without successful sign-ins. One campaign targeted over 1 million accounts; another targeted over 2 million users. Blank app fields and AADSTS7
AhnLab ASEC describes payment-themed phishing emails that deliver an XLS exploiting CVE-2017-0199. A WMI-launched PowerShell chain extracts a loader from a steganographic PNG and installs Remcos RAT.
Huntress details an incident in which attackers exploited SQL injection to access an endpoint, establish remote persistence, install BadIIS modules and an XMRig miner, and evade detection.
Group-IB says a new RedHook Android variant tricks users into enabling Wireless Debugging, pairs over loopback, and uses Shizuku for shell-level commands. It retains RAT capabilities and is spread through impersonation and fake app sites.
JPCERT/CC describes APT-C-60 spear-phishing attacks using RAR-delivered LNK files, mshta.exe, and legitimate developer services to deploy SpyGlace, and publishes related IoCs.
Genians analyzed a spear-phishing campaign that delivered RokRAT through a PDF-disguised PIF inside a Dropbox-hosted ISO. The multi-stage loader used shellcode and process injection; researchers assess APT37 was highly likely responsible.
Hudson Rock says an infostealer infection on an AFA developer’s computer likely exposed administrative credentials later used to access databases and send emails from AFA systems. Its analysis cites telemetry, recovered logs and leaked samples.
SentinelLABS reported espionage targeting Pakistani law enforcement from 2024 to 2026. Researchers linked four malware clusters to compromised systems, including a Balochistan Police portal used to host implants; China- and India-aligned actors are suspected.
