In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2395 articles
CYFIRMA analyzes Operation TaxShadow, a tax-themed phishing campaign delivering staged Windows malware via a fake portal and ZIP archive. It details DLL hijacking, token manipulation, in-memory loading and WebSocket C2; attribution remains moderate-confidence.
SOCRadar's profile details BlindEagle's Latin American espionage and credential-theft operations, including geofenced phishing, changing commodity RATs, multi-stage payload delivery, and reported use of a CVE-2024-43451 variant six days after patch release.
LevelBlue SpiderLabs details a Brazilian NF-e-themed campaign in which an unsigned, Microsoft-branded MSI installs an endpointdlp.dll stager that fetches Havoc at runtime. Analysis links nine stager variants and provides a YARA rule and hunting guidance.
Researchers report a phishing campaign that routes victims through Google DoubleClick before delivering DesckVB RAT. The infection chain uses multiple loaders, process hollowing, security-tool evasion, and persistence.
SafeBreach researcher Or Yair described Fake Context Alignment, a technique using Android notifications to bypass Gemini safeguards and trigger actions or poison memory. Google says server-side mitigations are in place; there is no evidence it was used in the wild.
Sekoia researchers analyze Gamaredon’s GammaSteel stealer, describing DPAPI-encrypted PowerShell functions stored in the Windows registry, document collection from drives and USB devices, and exfiltration through cloud storage with C2 and Dead Drop Resolver fallbacks.
Threat Fabric reports that fake RojaDirecta-style Android IPTV apps promoted around major football events have distributed banking malware in Spain and Italy, exploiting sideloading and permissions such as Accessibility Services.
Sekoia researchers detail Gamaredon’s GammaSteel stealer, which stages encrypted PowerShell functions in the Windows registry, collects files from drives and USB devices, and exfiltrates them through cloud storage and fallback infrastructure.
Check Point Research found 100+ fake software-project sites that intercept download clicks and route users through a gated TDS, which delivered SessionGate, RemusStealer, and AnimateClipper in observed chains.
Investigators detailed a five-month intrusion targeting a stock exchange executive’s Outlook mailbox, with incremental OST extraction and exfiltration via Dropbox and OneDrive Personal. The initial infection vector and attacker identity remain unknown.
Proofpoint reports TA4922 expanded from East Asia into Europe and Africa, using localized business lures to deliver Atlas RAT, RomulusLoader, SilentRunLoader and RMM tools. The analysis details sideloading, process injection and Chrome-data theft.
Kaspersky details Argamal, a RAT delivered in trojanized hentai games via websites and torrents. Its staged PowerShell loader uses COM hijacking and scheduled tasks; Kaspersky telemetry indicates hundreds of infections, mainly in four countries.
Sekoia linked Gamaredon activity targeting Ukraine to exploitation of WinRAR CVE-2025-8088. The reported chain uses GammaPhish and GammaLoad to deliver malware for persistence, propagation and file theft; GammaWorm's deployment path remains unclear.
Sekoia analyzes Gamaredon’s three-stage GammaLoad chain, which caches C2 URLs in the Windows registry, falls back to dead drop resolvers on legitimate services, uses a scheduled task, and loads the GammaSteel stealer in memory.
StepSecurity reports that Miasma compromised 57 npm packages across 286+ versions using binding.gyp to execute during installs and steal CI/CD credentials. Controlled analysis observed runner-memory scraping and GitHub-based exfiltration.
Huntress details a malspam infection chain that uses personalized lures and multi-stage PowerShell and .NET loaders to evade analysis, tamper with Windows defenses, persist, and inject payloads. The malware attribution was corrected to an unidentified .NET loader.
Sekoia analyzes Gamaredon’s three-stage GammaLoad chain, which uses registry-cached C2 addresses and trusted services to retrieve payloads, establish scheduled-task execution, and load the GammaSteel stealer in memory.
Hunt.io found exposed PCPJack infrastructure and deployment files showing 230 Sliver beacons were used to deploy Chisel SOCKS5 tunnels, qualify SMTP proxies, and sync verified proxies to a downstream server.
Sophos says a human-driven toolkit used Cursor and Claude Opus to automate Active Directory discovery and iteratively develop payloads tested against major EDR products. Researchers linked the framework to ransomware-related cybercrime.
Unit 42 reports that CL-CRI-1089 used hundreds of Google-verified ads and shell companies to distribute FlutterShell, a macOS backdoor disguised as apps. Its remote JavaScript bridge enables command execution, Chrome hijacking and document exfiltration through AI summar
ESET researchers describe evidence that Gamaredon tooling enabled Turla to deploy its Kazuar backdoor and restore access to high-value Ukrainian targets between February and June 2025.
Operation Dragon Weave uses spear-phishing ZIPs and a Rust-based chain to deliver AdaptixC2 against targets in the Czech Republic and Taiwan. The article also details TencShell activity and other China-aligned campaigns and toolkits.
Researchers report that the Miasma campaign used compromised Red Hat npm packages to steal developer credentials and cloud secrets, abuse CI/CD workflows, and persist in developer tools. Evidence points to a compromised employee GitHub account; attribution remains incon
ANY.RUN researchers detail JS.MonoGlyphRAT, a JavaScript RAT and loader delivered through business-themed phishing attachments. It persists via the Windows registry, communicates over HTTP, and can run PowerShell commands and additional payloads.
