In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2394 articles
Zscaler describes Shai-Hulud’s spread from npm to PyPI and its use of CI/CD abuse, IDE configuration hooks, credential theft and prompt injection. The worm’s source code became public on May 12, 2026, making its techniques reusable.
Check Point researchers detail three LangGraph checkpointer vulnerabilities, including SQL injection flaws and unsafe MessagePack deserialization that can chain to remote code execution under specific conditions. LangChain has patched the issues.
RoguePlanet is a Windows local privilege escalation PoC that exploits a TOCTOU flaw in Defender’s remediation process to place and run an attacker-controlled executable as SYSTEM. It reportedly works on fully updated Windows 10 and 11 systems.
Gen Threat Labs describes GoFlateLoader, a Go loader that manually maps payloads in memory and uses 700–950 MB PE overlays to hinder scanning. It is distributed via cracked software and a malicious TDS to deliver several infostealers.
Fortinet describes a Windows malware campaign using AI-themed document lures and staged scripts to install AsyncRAT and another .NET RAT, establish persistence, evade defenses, and communicate with attacker-controlled servers.
CYFIRMA analyzed 11 malicious or highly suspicious npm packages targeting Web3 developers; moralis-sdk had over 2.7 million downloads. The report details wallet and credential theft, staged payloads, blockchain-based C2, and on-chain exfiltration.
HUMAN’s Satori team linked Pushpaganda’s Google Discovery feed abuse, SEO manipulation and AI-generated lures to scareware and scams. A DNS/WHOIS review of 90 domains found 162 associated IPs (101 confirmed malicious) and 1,055 email-connected domains.
Huntress analyzed Kali365/Octopi365, a phishing-as-a-service kit that steals Microsoft 365 tokens through device-code and AiTM attacks, then enables mailbox access, persistence, and follow-on fraud.
Datadog explains how Entra Agent ID blueprints authenticate associated identities and how a compromised blueprint could expose their permissions across multiple identities and tenants.
Mandiant and Google say ShinyHunters exploited CVE-2026-35273 in Oracle PeopleSoft from May 27 to June 9, 2026, using MeshCentral agents for reconnaissance and lateral movement before data was published on the group’s leak site.
CloudSEK reports a multi-tenant operation using FIFA ticket-site clones to harvest card data and potentially relay OTPs. The researchers identified dozens of impersonation domains but could not verify victim totals or financial losses.
ESET researchers detail two OceanLotus campaigns from 2024–2026: a FireAnt MetaKit supply-chain compromise that delivered SPECTRALVIPER to some investors and a prolonged intrusion at a Vietnamese construction company.
SafeDep says Miasma’s source code was deliberately posted to GitHub through compromised developer accounts. Its analysis describes credential theft, GitHub-based propagation, destructive token-revocation behavior, and obfuscated payload builds.
Lumen's Black Lotus Labs says the JDY botnet has grown beyond 1,500 compromised SOHO/IoT devices, using layered C2 and targeted service fingerprinting to provide reconnaissance data to China-linked threat actors.
KrebsOnSecurity details an OSINT investigation linking The Gentlemen ransomware administrator aliases Hastalamuerte and Zeta88 to Alexander Andreevich Yapaev in Izhevsk, based on account, phone and email records. Yapaev did not respond.
Black Lotus Labs reports that the JDY botnet has grown to more than 1,500 SOHO and IoT devices, focusing on U.S. military-related targets and scanning for newly disclosed vulnerabilities. Its operators use Tor-based command-and-control.
CloudSEK analyzes an obfuscated skimmer targeting WooCommerce Payments that overlays fake Stripe fields, captures card details and customer emails during real purchases, and sends the data to an attacker-controlled endpoint.
Acronis details two espionage campaigns targeting Cambodian government entities. The Khmer Shadow cluster used SFX lures and a DLL-sideloaded NIGHTFORGE loader to deploy Havoc Demon, employing evasion techniques and reusing infrastructure.
Reco reports that its autonomous agent found and exploited access-control and SOQL injection flaws in Salesforce Experience Cloud sites, exposing personal data and confidential files. The affected organizations were given fictional names, and the findings were disclosed
ReversingLabs describes two short-form video phishing campaigns offering free premium software. One fake Spotify tutorial led to a Vidarstealer download; researchers could not confirm a payload from the second campaign’s lure sites.
A DOJ indictment alleges that Kata’ib Hezbollah operative Mohammad Baqer al-Saadi coordinated HAYI attacks and propaganda. DarkOwl’s Telegram monitoring highlights how attack footage and messaging were distributed through affiliated channels.
Varonis Threat Labs tested OpenClaw agent Pinchy in four phishing simulations using synthetic business data. It sent credentials and a customer export externally after plausible requests, but blocked a malicious OAuth flow; researchers recommend outbound controls and a
ThreatLabz details MLTBackdoor, a backdoor delivered through a ClickFix infection chain and likely linked to ransomware activity. It supports file operations and Beacon Object Files, and uses heavy obfuscation, anti-analysis checks, encrypted communications, and a DGA.
Socket researchers say 37 malicious releases across 19 PyPI packages used Python startup hooks and a JavaScript payload to steal developer secrets, with persistence and evasion mechanisms also observed.
