In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2394 articles
Morphisec reports that a new BabaDeda-linked campaign targets education and financial organizations using ClickFix, staged PowerShell, DLL sideloading, and in-memory execution to deploy information stealers and RATs.
ESET analyzed two Windows variants of FishMonger’s SprySOCKS backdoor, active from 2023 to 2024 against government victims in four countries. One variant uses a kernel driver to hide activity and redirect TCP traffic.
Socket researchers found TinyGo-compiled WebAssembly malware in two impersonated Open VSX extensions. It decrypts strings at runtime, uses Solana transaction memos to retrieve rotating C2 hosts, and launches OS-specific second-stage scripts.
Varonis Threat Labs described SearchLeak, a one-click flaw in Microsoft 365 Copilot Enterprise Search that could expose emails, MFA codes, calendar data and indexed files. Microsoft mitigated it; researchers presented a proof of concept, with no observed exploitation.
SOCRadar profiles Iranian state-linked Fox Kitten, describing exploitation of VPN and firewall flaws, credential theft, tunneling and custom backdoors, alongside espionage and access brokering for ransomware affiliates. It also outlines defensive measures.
Google Threat Intelligence Group attributes a year-plus campaign against exposed REDCap servers at a North American medical institution to China-linked UNC6508, which deployed InfiniteRed and used a compliance rule to exfiltrate matching data by email.
Group-IB linked Sniper Dz to Facebook impersonation scams targeting MENA users. The reported funnel abuses browser notifications, history manipulation and tab-under redirects to route victims to premium-rate, SMS and investment scams.
Varonis Threat Labs says SearchLeak chained Copilot prompt injection, an HTML-rendering race condition and Bing SSRF to exfiltrate data available to a Microsoft 365 user after one click. Microsoft patched it as critical CVE-2026-42824.
Huntress traced attackers’ use of stolen credentials to access an exposed terminal server, stage bulk-mail software and 8.9 million addresses, and run a Boots phishing campaign hosted on a compromised Bolivian government site.
Datadog Security Labs details four ways attackers could make Azure Blob data inaccessible, including two methods reported in the wild. The article explains permissions, logging gaps, Key Vault protections, and defensive monitoring.
Google says UNC6508 compromised North American research organizations through REDCap servers, using custom INFINITERED malware to steal credentials and maintain access before exfiltrating email through covert compliance rules.
Hunt.io found an open staging server holding about 5 GB of data linked to the Ababil of Minab campaign, including LA Metro backups and sensitive records from other organizations. The investigation details the operator’s tools, infrastructure, and exfiltration methods.
Genians details a Korea-focused NarwhalRAT infection chain launched through Microsoft-themed phishing and malicious LNK files, with Python-based in-memory payloads, extensive surveillance capabilities, and relay/pCloud C2. Its TTPs resemble prior APT37-linked activity.
SOCRadar profiles Tengu, a RaaS operation that claimed about 50 victims before rebranding as Shisa in March 2026. It details credential-based access, LOLBins, ZeroLogon exploitation, data theft before intermittent encryption, infrastructure, and defenses.
Sygnia reports that Velvet Ant began targeting internet-facing servers in 2016 and built access into an isolated network, using a custom proxy and Nginx/FastCGI path before backdooring PAM and OpenSSH to steal credentials and monitor administrative activity.
SOCRadar profiles The Quarry, a Rock-operated MaaS/PhaaS ecosystem whose affiliates use tax-themed phishing, cloaking, VBS droppers and legitimate RMM tools. The report describes its campaign methods, victimology and ongoing activity.
Sygnia reports that China-nexus group Velvet Ant altered Linux PAM and OpenSSH components to steal credentials and maintain access to isolated networks. The activity dates to at least 2016; defenders are advised to verify system files and remove backdoors before resets.
Atomic Arch attackers hijacked more than 400 AUR packages with malicious build scripts delivering a Rust credential stealer. Researchers detailed its persistence and optional root-level eBPF rootkit; a second wave used js-digest.
Zimperium details three World Cup 2026 phishing operations using fake ticket, merchandise and FIFA jobs sites. One active job portal relays Google Workspace credentials and MFA to hijack sessions; Zimperium says its mobile defense blocks the links.
Cyble reports that attackers used abandoned cloud DNS delegations to serve Thai gambling pages on subdomains of 163 organizations across 30+ countries, linking delivery infrastructure to a 103-node backend fleet and outlining detection and remediation steps.
The Atomic Arch campaign altered more than 400 AUR packages to run credential-stealing payloads during builds. Researchers describe an optional eBPF rootkit requiring root access; users are advised to check affected packages, rotate secrets, and reinstall if the payload
Validin researchers identified 6,113 suspected domains associated with GHOST STADIUM and found 3,079 resolving and not parked at analysis time. Shared page fingerprints and paths suggest kit reuse; the domains are not all confirmed malicious.
ReversingLabs analyzes an active campaign targeting corporate Microsoft 365 users. Business-themed lures trick victims into using OAuth device authorization to approve an attacker-controlled device.
Huntress reconstructed an Akira attack in which an affiliate created a VM on the victim’s hypervisor, disabled Microsoft Defender, staged files with WinRAR, and likely used Easyupload[.]io to exfiltrate data before deploying ransomware.
