In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2393 articles
StepSecurity reports that an attacker used compromised Mastra organization credentials to add the easy-day-js typosquat to 140+ packages; its postinstall dropper fetched a second-stage payload. A controlled Harden Runner test blocked the download; credential theft was a
CloudSek researchers analyzed BlueKit, a commercial phishing platform with 87 kits, P2P page rendering, anti-detection features, and automated account-takeover workflows targeting financial, cloud, and cryptocurrency services.
CloudSEK analyzes artifacts from a threat actor’s staging server, describing a 2025–2026 campaign using vulnerability exploits, stolen credentials, webshells, and tunnels to access systems and extract data across Latin America.
ThreatLabz reports that attackers used an AI-generated page impersonating a Brazilian bank and a ClickFix lure to deliver SmartRAT, a PowerShell RAT capable of remote control and financial data theft.
Researchers tracked a malvertising campaign that used Google Ads and GitLab Pages, then Claude shared chats, to trick victims into running commands that install MacSync and steal credentials, cookies, SSH keys, and cryptocurrency wallets.
Hunt.io analyzed a campaign of cloned FIFA World Cup ticket sites designed to harvest fan credentials and payment details. Shared code and infrastructure fingerprints help identify the sites; Chinese-language clues support, but do not prove, attribution.
Socket researchers analyzed an npm package that uses prompt-injection comments, token flooding, and obfuscated JavaScript to disrupt AI malware review. They found no evidence it carries the credential-stealing payload seen in related campaigns.
Zimperium researchers describe Rokarolla, an Android banking trojan spread via fake app sites. It abuses Accessibility and overlays to steal credentials and device data, intercept SMS and calls, and target 217 financial apps using 137 commands.
Incident responders found a WordPress infection combining a fake PBN plugin, a live command-and-control server, and two unauthenticated PHP web shells stored in the database, enabling unrestricted filesystem access.
Varonis describes GhostTree, which uses branching NTFS junction loops to create vast recursive paths that can hang Windows and EDR folder scans, leaving malware unexamined. The article says Microsoft was notified and later patched the issue.
Symantec describes a DragonForce intrusion using Backdoor.Turn to route command-and-control setup through Microsoft Teams relays, plus DLL sideloading and vulnerable drivers to evade defenses. The initial access method is unknown.
Symantec reports that DragonForce used the Go-based Backdoor.Turn to route C2 through Microsoft Teams TURN relays. The campaign also used vulnerable drivers to evade defenses before exfiltrating data and encrypting a victim’s systems.
Kaspersky found dozens of malicious Wallpaper Engine packages on Steam Workshop. One investigated chain deploys malware and uses a modified AggregatorHost.dll to steal Steam credentials and hijack active sessions.
ESET found Windows SprySOCKS variants used against government organizations in four countries and attributed the activity with high confidence to Earth Lusca. The variants add kernel-level stealth and TCP traffic diversion; a possible UEFI bootkit link remains unsubst
Genians reports that ScarCruft used fake Microsoft Account alerts to deliver NarwhalRAT via a ZIP containing a malicious LNK. The multi-stage infection uses in-memory execution, scheduled-task persistence, and Korean websites and pCloud for C2.
Sysdig TRT reports multiple operators used CTF/CVE-hunting framing to get their own LLMs to generate exploit code, with the framing appearing in User-Agents and account and cloud fields. It recommends gateway detection and sanitizing telemetry sent to LLM-based analysis
Researchers say FakeWallet used over 20 trojanized crypto-wallet apps to steal recovery phrases and private keys. Their infrastructure analysis identified 28 network IoCs and linked additional domains and IPs to malicious activity.
Researchers traced EtherRAT through MSI and PowerShell loaders to a broader infrastructure hosting malware and phishing pages. The Node.js RAT uses Ethereum smart-contract queries to resolve C2 and can execute attacker-supplied JavaScript.
Google attributes a campaign to UNC6508 with high confidence: the group used INFINITERED in compromised REDCap servers and abused Google Workspace rules to copy targeted emails. Google says it notified affected organizations and disrupted the group’s infrastructure.
Resecurity describes CVE-2026-20253 as a pre-authentication RCE in Splunk Enterprise’s PostgreSQL Sidecar Service, chaining unauthenticated recovery endpoints, path traversal and PostgreSQL restore behavior; fixes are listed for affected releases.
Sekoia's investigation links ErrTraffic, a ClickFix malware-as-a-service framework, to two clusters using Polygon smart contracts to resolve C2. Forensic analysis details WordPress compromises, backdoors, malware campaigns, AI-themed lures and detection options.
A ClickFix infection on an unmonitored endpoint led to Potemkin and RMMProject deployment, EtherRAT persistence and hands-on lateral movement across more than 11 hosts. Huntress says monitoring began after the intrusion was underway.
Sekoia analyzed ErrTraffic, a ClickFix malware distribution framework used in campaigns that compromise WordPress sites and impersonate AI platforms. Its two clusters use Polygon smart contracts to resolve C2 infrastructure and deliver multiple malware families.
Morphisec reports that a new BabaDeda-linked campaign targets education and financial organizations using ClickFix, staged PowerShell, DLL sideloading, and in-memory execution to deploy information stealers and RATs.
