In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2477 articles
ENKI described Kimsuky campaigns targeting South Korean organizations with fake security-software and Webex lures that delivered HTTPSpy and other payloads. Kaspersky also reported expanded use of malware, remote-access tools and VS Code tunneling.
An analysis of the March 31, 2026 Axios npm supply-chain attack combined 22 IoCs from GTIG, Elastic Security Labs and GitHub, using DNS, WHOIS and related data to map suspected phishing infrastructure and connected artifacts.
Token Security researchers chained five Zapier flaws, using a free account to reach credentials, private software images and browser code, potentially enabling actions across users’ connected services. Zapier patched the flaws and reports no evidence of exploitation.
Socket analyzed Sicoob.Sdk versions 2.0.0–2.0.4, which sent client IDs, PFX passwords, and encoded certificates to a hardcoded Sentry endpoint. NuGet blocked the package after a report.
Sysdig TRT reports an intrusion that began with CVE-2026-39987 in an internet-facing marimo notebook and reached an internal PostgreSQL database. It presents command-stream evidence for real-time LLM-agent execution and recommends patching and rotating exposed secrets.
LevelBlue describes a Sapphire Sleet campaign targeting macOS users in financial, Web3, and cryptocurrency sectors. A fake Zoom SDK update delivered AppleScript payloads that abused TCC permissions, established persistence, and collected credentials and sensitive data.
A malicious MSI impersonating RVTools, signed with a subsequently revoked Sectigo certificate, uses embedded VBScript and hidden PowerShell to download a WinPython bundle and deploy a modular Python RAT with AD reconnaissance, persistence and encrypted C2.
Researchers detail a campaign active since at least 2022 that uses fake player updates on pirated streaming and library sites to install a SilentCryptoMiner fork and RAT, with DNS-based system checks, persistence, defense evasion and rotating C2.
A log-based reconstruction of an Akira-attributed intrusion traced SSLVPN brute force, Kerberoasting, RDP movement and pre-encryption actions. Joining firewall and Windows logs exposed the sequence and informed practical detection and retention guidance.
Cyble researchers detail OverlayPhantom, an Android banking trojan distributed through app-impersonating URLs. It abuses Accessibility Service, targets more than 180 financial apps in 10 countries, steals credentials through overlays and streams screens to operators.
eSentire investigated a Teams-vishing intrusion that used inbox flooding and Quick Assist to deploy Nimbus RAT. The Java malware uses Google Drive for C2 and can steal credentials; telemetry showed 1,540 suspicious Teams events across 172 customer environments.
Microsoft researchers describe a campaign that uses SEO-poisoned utility downloads—and, in some reported cases, AI chatbot recommendations—to install ScreenConnect, evade detection, and deploy GPU miners on Windows systems.
AhnLab describes a malicious LNK campaign disguised as security emails from a Korean credit card company. Payload delivery varies with Windows Defender status; resulting malware can steal browser and mail data, log keystrokes, collect clipboard data, and enable remote C
Wiz describes JINX-0164 campaigns targeting cryptocurrency developers with social engineering, macOS malware, credential theft and CI/CD compromise, including a trojanized npm package used to deliver a backdoor.
The article describes NightSpire’s use of remote-access tools, file discovery and archiving utilities, and MEGAsync for data theft before encryption. Its Go encryptor appends .nspire, while ransom notes also claim OneDrive files were encrypted.
FortiGuard Labs reports persistent P2Pinfect infections in GKE clusters traced to exposed Redis. Telemetry links peers and binaries to Metro4Shell exploitation; RediShell use is a low-confidence possibility. No second-stage payload ran in observed cases.
Hunt.io traced a multi-country smishing campaign using 1,628 URLs to impersonate government, postal, telecom, and other services. Fake payment pages harvest card details; shared page fingerprints link the infrastructure.
Malwarebytes describes fake software promoted through GitHub, SourceForge, and compromised YouTube channels. The campaign installs DinDoor and an unnamed Deno-based RAT that steals data and uses Edge for peer-to-peer streaming.
Hexastrike attributes an AtlasCross RAT campaign using look-alike domains impersonating software brands to Silver Fox APT. Its infrastructure analysis identified 13 network IoCs and used DNS and WHOIS pivots to map potential victim connections and related domains.
Researchers linked MuddyWater to a Q1 2026 espionage campaign targeting at least nine organizations, using DLL side-loading, Node.js and PowerShell to steal browser data and credentials. Separate Iran-linked operations used FileFiend and other exfiltration methods.
A technical analysis says Payload ransomware uses per-file Curve25519 ECDH-derived ChaCha20 encryption, an RC4-protected file footer, and ETW, VSS and event-log tampering. It reports 50 organizations listed on the group’s leak site by March 24, 2026.
Mandiant linked a KnowledgeDeliver compromise to shared ASP.NET machine keys enabling unauthenticated RCE. The actor deployed BLUEBEAM and tampered with JavaScript to deliver Cobalt Strike BEACON; the report provides hunting and mitigation guidance.
Trend Micro analyzed a ClearFake campaign that used BNB Smart Chain testnet contracts to route ClickFix lures to Windows and macOS victims, delivering SectopRAT and ACRStealer and tracking successful executions on-chain.
QiAnXin XLab reports that attackers used Ghost CMS CVE-2026-26980 to steal admin API keys and inject ClickFix loaders across 700+ sites, delivering Windows malware. Ghost fixed the flaw in version 6.19.1.
