In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2390 articles
Kaspersky reports that Armored Likho targets government and electric power organizations in multiple countries. Its tools include BusySnake Stealer, which can collect credentials and other data, capture screenshots, and provide remote access.
Check Point analyzes Cavern, a modular .NET C2 framework used by Iran-linked Cavern Manticore against Israeli organizations. The malware supports reconnaissance, data access, credential attacks and tunneling; intrusions abused RMM tools and trusted IT-provider access.
Microsoft reports a campaign targeting hospitality organizations in Europe and Asia with fake image shortcuts and a Node.js implant. Phishing messages abuse Calendly and Google redirects; the actor and ultimate objective remain unknown.
Microsoft says a malicious Chromium extension impersonating Perplexity AI routed Omnibox searches and typed suggestions through attacker infrastructure, where its server code logged requests and headers. Google removed it after Microsoft's report; credential theft was未t
STORESOCKS distributes signed, trojanized Microsoft Store utilities that install a Go proxy with startup persistence. The campaign remained active in June 2026, using infected hosts for encrypted TCP and UDP relays.
Sysdig researchers say JadePuffer used an LLM agent across a ransomware attack, from exploiting CVE-2025-3248 in Langflow to encrypting 1,342 Alibaba Nacos configuration items. They call it the first documented operation of its kind.
Researchers link PolinRider, tied to North Korea-aligned Contagious Interview, to 108 malicious packages and extensions. The campaign abuses developer tooling and repositories to deliver BeaverTail variants and payloads including DEV#POPPER RAT and OmniStealer.
Kaspersky details Armored Likho campaigns against government and power-sector targets in Russia, Brazil and Kazakhstan, including spear-phishing chains and BusySnake Stealer capabilities for stealing credentials, documents, screenshots and Telegram data.
JFrog identified fake Rollup polyfill npm packages that use staged payloads to provide remote access and steal developer credentials, files, browser data, and cryptocurrency wallet information. The packages have been removed from npm.
Researchers detail campaigns attributed with medium confidence to Armored Likho against government and power-sector targets in Russia, Brazil and Kazakhstan, and analyze BusySnake Stealer’s credential theft, persistence, C2 tasking and reverse-SSH capabilities.
Cisco Talos reverse-engineered ARToken, a Microsoft 365 phishing platform that appears linked to EvilTokens. The toolkit steals authentication tokens, supports persistent access, and enables mailbox and cloud-file access.
K7 analysis describes Boss Scam lures that deliver a signed executable and malicious DLL, which sideloads malware to persist, collect Chromium browser artifacts, and send them over TCP—potentially enabling WhatsApp Web session hijacking and internal impersonation.
Sysdig reports that JadePuffer exploited CVE-2025-3248 in an exposed Langflow instance, using an LLM to find credentials, move to a production server, exploit Nacos, and encrypt 1,342 service configuration items.
LevelBlue SpiderLabs traced a global phishing campaign using macro-enabled Excel files, obfuscated HTA and PNG stages, and rotating infrastructure to deliver Remcos and AsyncRAT; FormBook and Lumma may also be involved.
Reports describe Anubis affiliates exploiting Citrix CVE-2025-5777 and using VPN credentials, The Gentlemen’s Go backdoor and BYOVD activity, and VECT-TeamPCP’s supply-chain-to-ransomware partnership.
Arctic Wolf’s review of multiple Anubis intrusions found initial access via valid VPN credentials or CitrixBleed 2 (CVE-2025-5777), followed by RMM abuse, credential access and pre-encryption exfiltration activity. Logs did not confirm a usable Cloudflare Tunnel.
YesWeHack and Sekoia found ChocoPoC RAT hidden in dependencies of at least seven fake GitHub Python PoCs. It steals browser data and files, enables remote commands, and uses Mapbox and DNS-over-HTTPS for C2; downloads do not confirm infections.
Sysdig TRT says JADEPUFFER used CVE-2025-3248 to access Langflow, harvest credentials and reach a production MySQL/Nacos server, where it encrypted and deleted configuration data. The team assesses the campaign was LLM-driven; claimed exfiltration was not verified.
Zscaler ThreatLabz describes two campaigns using hidden website instructions and SEO poisoning to manipulate AI agents, and reports that some of 26 tested LLMs mishandled the sites.
eSentire analyzed a campaign that used email bombing and Microsoft Teams helpdesk impersonation to trick a retail customer into installing DenoGate, a Deno-based backdoor capable of command execution, persistence, and TCP tunneling.
Sekoia found GitHub PoC repositories delivering the ChocoPoC RAT through malicious PyPI dependencies. The malware can run commands and collect files and browser data; researchers say the campaign likely used compromised accounts.
Kaspersky MDR traced a campaign using fake freeware sites to sideload ScreenConnect and deploy AsyncRAT. Its investigation describes the multi-stage infection chain, persistence methods, and more than 90 localized domains.
FortiGuard details an Ousaban campaign targeting Spain and Portugal through phishing PDFs and a staged payload, with geofencing, evasion, persistence, and daily changing C2 domains.
Researchers identified a campaign using malicious GitHub PoCs and trojanized PyPI dependencies to infect vulnerability researchers and pentesters with ChocoPoC, a persistent Python RAT that steals credentials and files and executes commands.
