In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2391 articles
Check Point researchers found that an AI-generated malware sample pointed to a practical browser-only attack: a deceptive site can use Chrome’s File System Access API to access, exfiltrate, or encrypt files after a user grants folder access.
Cyble analyzed Glitch SPY, an Android RAT delivered through a fake Polish rental app by the Brokewell Android Loader. It abuses Accessibility for control and data theft, and includes crypto-clipping and hidden browser capabilities; distribution appears early-stage.
Unit 42 says attackers are registering LLM-hallucinated domains for phishing and malware delivery. Its research found 13,229 URLs flagged as malicious, about 250,000 unregistered phantom domains, and cases involving Montana Empire and a postal-service APK.
Checkmarx reports that Operation Navy Ghost published at least eight trojanized Pyrogram forks on PyPI. Their secret.py backdoor can run Python or shell commands with an infected bot’s permissions and access files, secrets, and Telegram data.
Recorded Future links TAG-182 to MarkiRAT malware distributed through fake VPN and media apps, likely targeting Iranians at home and abroad. The report details infrastructure, malware behavior, possible overlap with Ferocious Kitten, and detection rules.
A technical analysis details an ELF backdoor that appears to target iKuai routers, beaconing to a command-and-control server and supporting shell commands, file exfiltration, and payload execution.
A WhoisXML API analysis of Proofpoint-reported TA416 activity examined 91 network indicators, identifying 122 client IPs, 45,197 email-connected domains and 15 domains reported weaponized for phishing or malware distribution.
Trend Micro observed a March 27–April 15, 2026 campaign exploiting Langflow CVE-2026-33017 for unauthenticated RCE and deploying a Monero miner via lambsys, which disables defenses, persists, removes logs and spreads over SSH.
QiAnXin’s XLab says RustDuck targets routers, cameras, Android boxes and exposed servers for DDoS, using a two-stage loader, a Rust core, sandbox checks and encrypted command traffic. It spreads through weak credentials and known flaws.
Kaspersky researchers detail ToddyCat’s Umbrij tool, which sideloads through legitimate Windows apps, reuses copied Chrome and Edge profiles, and uses remote debugging to obtain Google OAuth codes for corporate Gmail API access.
Acronis reports Mustang Panda campaigns targeting Indian government and hydropower organizations, detailing three tools that use signed-binary sideloading and Zoho WorkDrive for command delivery and data exfiltration.
Kudelski researchers describe how DPRK-linked operators use fake developer interviews and a trojanized GitHub project to install a backdoor that collects system data, exposes environment secrets, and enables remote commands.
Huntress found a password-spraying campaign that compromised 78 Microsoft accounts across 64 organizations using Azure CLI’s OAuth ROPC flow. Attackers later shifted providers; Huntress recommends properly scoped MFA and restricting Azure CLI access.
Socket researchers found Chrome and Firefox VPN Go extensions added clipboard-stealing code in later versions, sending copied data to hardcoded servers. The extensions were reported to Google and Mozilla for review.
Kaspersky details The Gentlemen’s ransomware operations, including exposed-service and credential-based access, reconnaissance, BYOVD defense evasion, a custom Go backdoor for command execution and SOCKS proxying, and Go and C-based ransomware variants.
Mozilla 0Din researchers describe an attack in which Claude Code follows an installation error’s recovery command, leading a script to fetch and execute a command from a DNS TXT record and open a reverse shell on the developer’s machine.
A DFIR investigation details two July 2025 intrusions linked to a BumbleBee SEO-poisoning campaign, tracing trojanized software downloads through AdaptixC2, credential theft and data exfiltration to Akira ransomware deployment.
Wiz says its Red Agent autonomously exploited a BOLA flaw in an airline’s GraphQL API, accessing passenger records and gaining the ability to modify or delete bookings. The company says it validated access using 20 sequential booking IDs.
Microsoft removed 119 Edge extensions linked to StegoAd, which hid payloads in PNG, WebP and WOFF2 files and used delayed execution to evade analysis. Microsoft says they stole credentials and cookies; installs reached 2.6 million, but the number compromised is unknown.
Huntress details a webshell intrusion in which an attacker disabled logging and security tools, weakened WDigest protection, and dumped credentials. A server was re-compromised after being restored before remediation was complete.
Trend Micro details a phishing campaign targeting Japanese Booking.com partner hotels. TONResolver runs through Node.js and retrieves its command server from a TON smart contract, allowing attackers to change destinations; observed follow-on activity involved browser-st
Acronis researchers detail two Mustang Panda campaigns targeting Indian government and hydropower entities with SHARDLOADER, MINIRECON and ZOHOMURK, which uses Zoho WorkDrive for command-and-control and data exfiltration.
Kaspersky reports that StrikeShark uses SharkLoader to deploy Cobalt Strike Beacon after exploiting public-facing applications or using malicious droppers. The campaign targets organizations in multiple countries; no active data exfiltration has been observed.
Sysdig says it observed the first known active exploitation of Langflow’s CVE-2026-55255 IDOR: an operator enumerated flow IDs and attempted to extract API keys while repeatedly trying CVE-2026-33017 RCE; the second-stage loader did not land.
