In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2392 articles
ESET shared malware analysis, indicators, and affiliate-clustering data with Operation Endgame, which targeted about 50 domains and nearly 200 active command-and-control IPs used by Amadey and Stealc.
Researchers describe FortiBleed, a campaign active since February 2026 that reportedly brute-forces exposed devices and uses FortigateSniffer to capture credentials. The operation is estimated to have identified over 110 million credentials.
Researchers analyzed macOS.Gaslight, a Rust implant linked with high confidence to DPRK-aligned activity. It combines data theft and interactive access over Telegram C2 with fabricated system messages designed to mislead LLM-assisted triage.
Analysis of leaked spreadsheets, payment records, and infrastructure data links APT35 procurement practices to Moses Staff, while exposing credentials and operational details left accessible after the leak.
SOCRadar describes FortiBleed as an ongoing campaign using FortigateSniffer to harvest credentials from compromised FortiGate firewalls. Researchers report 659 harvesting pipelines and more than 110 million stolen credentials.
Kaspersky reports a WhatsApp campaign using disguised VBScript attachments to install ManageEngine RMM Central. The infection chain varies by WhatsApp Web or Desktop; account compromise is suspected, but the method is unclear.
EvilTokens hides phishing content with AES-GCM encryption and uses Microsoft’s device login flow to gain account access. The analysis traces its browser requests and shows how investigators can uncover related activity.
Recorded Future describes scammers compromising legitimate websites to redirect search visitors to unindexed purchase-scam domains. The tactic uses cloaking, rotating domains, and multiple merchant accounts, and is appearing in World Cup-themed fraud.
ThreatLabz reports that a Payouts King-linked initial access broker uses fake IT update prompts to install a hidden Edge extension and Python backdoor, enabling C2-driven system access and command execution.
Trend Micro analyzed a campaign exploiting unauthenticated Langflow RCE to deploy a Monero miner, disable Linux security controls, establish persistence, and spread using SSH keys. It recommends updating Langflow and restricting public access.
Elastic Security Labs described REF8372, a campaign using malicious Google Ads and a fake Node.js download site to deliver CastleStealer via OXLOADER. The loader uses obfuscation, anti-sandbox checks, Storj staging and DLL side-loading.
A June 2026 campaign used financial-themed VBScript attachments sent via WhatsApp to install ManageEngine Endpoint Central for remote access. Victims were observed in multiple countries, with 80% in Malaysia; attribution remains uncertain.
ThreatDown analyzes Prinz Eugen, a Go ransomware sample observed on an infected customer, detailing recursive encryption, suspected RDP access, RemotePC-assisted payload staging, and self-deletion. The report links activity to ROOTBOY but notes attribution caveats.
Elastic Security Labs details OXLOADER, a Windows loader delivered through malicious Google Ads and Storj-hosted files to deploy CASTLESTEALER. Analysis describes its obfuscation, environment checks, .reloc shellcode staging, and in-memory payload execution.
The article describes Hudson Rock’s FortiBleed reporting: credentials exposed from nearly 75,000 FortiGate firewalls across 21,632 domains, and attackers reportedly using rented GPU clusters and Hashtopolis to crack hashes and pursue access to internal networks.
ThreatDown researchers describe Prinz Eugen ransomware’s file-prioritizing encryption, likely stolen-RDP access, and use of legitimate tools. The malware leaves no ransom note; researchers identified at least five victims.
Seqrite TRU describes a healthcare-themed phishing campaign using obfuscated batch loaders, Startup-folder persistence and a Python stealer to harvest browser data. Attempts to exfiltrate data through the Telegram Bot API failed due to connectivity timeouts.
A DNS/WHOIS investigation of the China-aligned Shadow-Earth-053 campaigns examined 31 core indicators and related infrastructure, alongside reported Exchange and IIS exploitation, GODZILLA persistence, and ShadowPad DLL sideloading.
AutoJack chains localhost trust, skipped authentication, and unauthenticated command execution in AutoGen Studio prereleases to let a page loaded by an AI browsing agent trigger host code execution. Stable 0.4.2.2 is unaffected; a fix is in the main branch.
Paradigm Shift published usbliter8, a physical DFU-mode USB exploit for Apple A12/A13 SecureROM. It requires an RP2350-based board, can boot unsigned iBoot images, and cannot be fixed by software updates; no in-the-wild use had been publicly reported.
CYFIRMA describes a Teams-themed phishing campaign delivering a signed installer for a legitimate remote-access tool. It reports compromised websites and Cloudflare-hosted lures, MSI execution, credential-theft capabilities and layered Windows persistence.
Microsoft reports that the Windows-based CryptoBandits malware steals cryptocurrency wallet data, substitutes clipboard addresses, and uses a bundled Tor client for command-and-control and remote tasking.
Cyble’s CRIL investigation describes nearly 4,000 FIFA-themed domains linked to ticket and VIP scams, phishing, and streaming lures, plus fraud conducted through messaging platforms. Football-sector identity leak claims remain unverified.
ESET says the Gentlemen ransomware group uses GentleKiller and other tools to disable EDR defenses. Its analysis describes BYOVD-based privilege escalation, targeting of more than 400 processes, and multiple tool variants.
