In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2396 articles
A Huntress researcher found that a Windows search: URI can trigger an NTLMv2 hash leak with one click. Microsoft rated the issue Moderate but closed it without a CVE or fix; mitigations include blocking outbound SMB and restricting NTLM.
ReversingLabs says 32 malicious @redhat-cloud-services npm versions were published in 72 seconds on June 1, 2026. Its analysis found an obfuscated preinstall credential stealer; clean versions were published and the malicious versions removed.
DomainTools reports that a suspected campaign used more than 1,100 spoofed domains to collect user data and selectively deliver malware, including ValleyRAT and Gh0stRAT, primarily to Chinese-speaking users.
GoDaddy researchers found the campaign’s malware on about 1,980 WordPress sites. It hides C2 data in invisible Unicode characters in Steam comments to retrieve JavaScript and install a backdoor; the initial infection vector is unclear.
A fake BlueWallet site tricks Mac users into running an AppleScript that installs a data-stealing implant. It targets browser, wallet and other credentials, can replace copied crypto addresses, persists via LaunchAgent, and uses Telegram for command-and-control and exфl
Seqrite Labs details Operation XENOFISCAL, a SideCopy-linked spear-phishing campaign targeting Afghanistan’s Ministry of Finance. A Pashto-named LNK launches a multi-stage loader that deploys XenoRAT; attribution is assessed with medium-to-high confidence.
Socket reports compromised @redhat-cloud-services npm packages that run an obfuscated payload during installation, harvest credentials and CI secrets, and exfiltrate data. The article details the malware’s behavior and recommends exposure review, containment, and secret
Wiz found 32 compromised Red Hat npm package releases. A hijacked employee account used GitHub Actions and OIDC to publish malware that steals developer secrets and collects GCP and Azure identities; most malicious versions were revoked.
Sekoia reconstructed a January 2026 Gamaredon chain using a CVE-2025-8088 WinRAR archive to deploy GammaPhish and GammaWorm, which persists in NTFS alternate data streams, spreads via USB and network drives, and operates as a backdoor.
StepSecurity reports malicious npm releases that execute at install time, harvest credentials, and can republish backdoored packages. Its analysis describes the malware’s techniques, affected versions, and remediation advice.
Socket researchers found an obfuscated JavaScript loader in an installable development branch of a PHP package. It retrieves encrypted payloads through blockchain infrastructure; Packagist removed the version after notification.
Rapid7 observed exploitation of CVE-2026-0257 across multiple customers, using forged GlobalProtect authentication-override cookies to bypass login on specially configured PAN-OS and Prisma Access systems. No successful lateral movement was observed.
Seqrite details a spearphishing campaign targeting the Czech Republic and Taiwan that delivers AZUREVEIL, an Adaptix C2 agent using Azure Blob Storage. The researchers assess a China-based link with moderate confidence.
Sysdig reported that an unknown actor exploited Marimo CVE-2026-39987, used AWS credentials and an SSH key to reach a bastion, and exfiltrated an internal PostgreSQL database. It cited command patterns and other evidence of LLM-agent use.
Silent Push researchers identify DriveSurge, a suspected initial-access broker using zTDS to redirect visitors from thousands of compromised sites to ClickFix and fake-update lures. The analysis details infrastructure fingerprints and a macOS clipboard-hijacking payload
WithSecure links GREYVIBE to attacks targeting Ukraine since at least August 2025, detailing phishing and fake-site delivery chains, custom malware, and evidence of AI assistance. The group’s relationship with the Russian state remains unclear.
ENKI described Kimsuky campaigns targeting South Korean organizations with fake security-software and Webex lures that delivered HTTPSpy and other payloads. Kaspersky also reported expanded use of malware, remote-access tools and VS Code tunneling.
An analysis of the March 31, 2026 Axios npm supply-chain attack combined 22 IoCs from GTIG, Elastic Security Labs and GitHub, using DNS, WHOIS and related data to map suspected phishing infrastructure and connected artifacts.
Token Security researchers chained five Zapier flaws, using a free account to reach credentials, private software images and browser code, potentially enabling actions across users’ connected services. Zapier patched the flaws and reports no evidence of exploitation.
Socket analyzed Sicoob.Sdk versions 2.0.0–2.0.4, which sent client IDs, PFX passwords, and encoded certificates to a hardcoded Sentry endpoint. NuGet blocked the package after a report.
Sysdig TRT reports an intrusion that began with CVE-2026-39987 in an internet-facing marimo notebook and reached an internal PostgreSQL database. It presents command-stream evidence for real-time LLM-agent execution and recommends patching and rotating exposed secrets.
LevelBlue describes a Sapphire Sleet campaign targeting macOS users in financial, Web3, and cryptocurrency sectors. A fake Zoom SDK update delivered AppleScript payloads that abused TCC permissions, established persistence, and collected credentials and sensitive data.
A malicious MSI impersonating RVTools, signed with a subsequently revoked Sectigo certificate, uses embedded VBScript and hidden PowerShell to download a WinPython bundle and deploy a modular Python RAT with AD reconnaissance, persistence and encrypted C2.
Researchers detail a campaign active since at least 2022 that uses fake player updates on pirated streaming and library sites to install a SilentCryptoMiner fork and RAT, with DNS-based system checks, persistence, defense evasion and rotating C2.
