In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2395 articles
Socket researchers say 37 malicious releases across 19 PyPI packages used Python startup hooks and a JavaScript payload to steal developer secrets, with persistence and evasion mechanisms also observed.
Researchers identified 23 new malicious PyPI artifacts using startup hooks, trojanized native extensions, and staged JavaScript payloads to target developer and CI/CD secrets.
Bishop Fox researchers validated a chain of three UniFi OS Server flaws that enables unauthenticated remote code execution and root access. Upgrade to version 5.0.8 or later; a detection script checks vulnerability status but not prior compromise.
The analysis tracks four Grixba samples from 2022–2024, describing shifts from a .NET infostealer to modular reconnaissance and a smaller staged loader, while WMI/WinRM enumeration and an RDP drop path remain detection opportunities.
OpenSourceMalware analyzes January–May 2026 campaigns targeting developers, software packages, and CI systems, detailing malware delivery, credential theft, propagation, and attribution limits.
Proofpoint details UNK_DeadDrop phishing targeting developers at nearly 100 organizations. Malicious repositories abuse IDE automation and VSIX extensions to steal credentials and crypto wallets across Windows, macOS, and Linux; attribution to North Korea is assessed as
Step Security reports malicious PyPI packages in the Hades campaign. Their import-time Bun payload scrapes CI runner memory, steals secrets, spreads via SSH and publishing credentials, abuses GitHub Actions, and adds a token-revocation-triggered wiper.
StepSecurity reports that ruff CI checks blocked two force-push attempts adding a Shai-Hulud credential stealer to Pythagora’s gpt-pilot repository on June 8, 2026. The payload targeted developer credentials and used GitHub-based C2 and persistence hooks.
Two Russia-aligned campaigns continued exploiting WinRAR CVE-2025-8088 against Ukrainian organizations through April 2026, delivering an evolved information stealer or espionage tools. The report details their techniques and recommends patching WinRAR and hunting for IО
Fortinet researchers say C0XMO, a modular Gafgyt variant, exploits CVE-2021-27137 and weak SSH/Telnet credentials to spread across routers and other devices. It supports 19 DDoS methods and removes competing tools and botnet clients.
Socket reports 37 malicious PyPI wheel artifacts across 19 packages that use executable .pth files to launch a Bun-powered JavaScript stealer targeting developer and CI/CD credentials.
Include Security and researcher Buchodi say Bright Data’s SDK can route scraping through users’ home connections; iOS traffic may bypass VPNs and run in the background. Smart-TV exposure is suggested by platform and partner evidence, not confirmed for each app.
A researcher analyzed an ISO containing a .NET dropper and a previously unseen RAT dubbed PulseRAT. The RAT uses Google Sheets for command and control, collects system information, and executes attacker-supplied PowerShell commands.
Volexity says UNC5221 (VerdantBamboo) accessed a victim’s network and Microsoft 365 environment for at least 18 months, also compromising its MSP and deploying Brickstorm, Plenet, and AgentPSD as backdoors.
Mandiant describes a Jan–May 2026 UNC3753 campaign against dozens of U.S. legal, professional and financial organizations, using vishing and remote-support tools to steal sensitive files for extortion; it also details possible physical intrusions and defenses.
ReliaQuest describes OP-512 targeting a legacy IIS server with a custom three-web-shell framework. The cluster used timestomping and automated reporting; ReliaQuest assesses its China link with moderate to high confidence.
Analysis of ZionSiphon finds a Windows implant with Israeli water-sector targeting and host-level persistence, but a geographic-validation bug prevents its sabotage logic from activating. Attribution remains unconfirmed, and no C2 activity was observed.
A technical profile details Vect’s Windows, Linux and ESXi ransomware, reported links to TeamPCP supply-chain compromises, and a nonce-handling flaw that can leave three-quarters of large files unrecoverable; it also gives defensive guidance.
Sysdig TRT says an agentic actor exploited CVE-2026-39987 in a marimo notebook, used a mounted Docker socket to access the host, and replayed a Kubernetes service-account token to read Secrets in the default namespace.
LevelBlue describes a ClickFix campaign using fake job-site CAPTCHA pages and the Finger protocol to stage CastleLoader and a Python RAT through fileless execution and encrypted C2.
FortiGuard Labs details a phishing chain that uses JavaScript, PowerShell and process hollowing to load a fileless PureLogs plugin, which can collect browser, Discord, crypto wallet and application data from Windows systems.
FortiGuard Labs analyzes C0XMO, a Gafgyt variant that exploits a DD-WRT UPnP flaw and uses a separate Python scanner to target Linux and IoT devices. The report details its persistence, C2, and DDoS capabilities.
Step Security reports that a June 5 malicious commit added hooks triggering a credential-stealing payload when affected Microsoft repositories were opened in IDEs or AI coding tools. GitHub disabled 73 repositories; Azure/functions-action outages disrupted CI/CD.
Volexity details an 18-month VerdantBamboo intrusion involving compromised appliances, BRICKSTORM and two other backdoors, stolen credentials, and access through an MSP. Egnyte fixed a privilege escalation issue in Storage Sync v13.13.
