In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2479 articles
Google GTIG analyzed a mature Chinese-language PhaaS ecosystem using RCS and iMessage delivery, live OTP interception and digital-wallet provisioning to monetize stolen payment data. Darcula and YY Lai Yu illustrate AI-assisted, localized operations, including Japan.
Socket researchers identified TrapDoor, a cross-registry campaign involving more than 34 malicious packages and 384+ versions and artifacts that steal developer credentials, crypto wallet data and other secrets.
ESET reports that China-aligned Webworm has shifted toward European government targets and introduced EchoCreep, using Discord for C2, and GraphWorm, using Microsoft Graph and OneDrive. Its initial access vector remains unclear.
A compromise of Laravel Lang packages introduced an automatically executed PHP backdoor and a cross-platform stealer targeting credentials and secrets. The article details the attack chain, affected packages, indicators, and recommended response.
SOCRadar profiles CoinbaseCartel, an extortion actor reported to steal data using reused credentials and cloud access rather than encrypt systems. Researchers describe its tactics and defenses; proposed links to ShinyHunters, Scattered Spider and Lapsus$ remain ununfirm
LevelBlue’s technical analysis explains how the YellowKey PoC abuses WinRE TxF replay to bypass BitLocker on TPM-only systems, and examines GreenPlasma and MiniPlasma privilege-escalation techniques, detection signals and Microsoft mitigation guidance.
CERT-UA reports that Ghostwriter has targeted Ukrainian government organizations since spring 2026 with phishing that deploys OYSTER malware and a final payload assessed to be Cobalt Strike. It advises restricting wscript.exe for standard users.
Check Point says IRGC-affiliated Nimbus Manticore (UNC1549) used phishing, a trojanized Zoom installer and SEO-poisoned SQL Developer site to deliver MiniFast. Researchers detail its AppDomain hijacking, scheduled-task persistence and HTTP C2.
Analyst1 profiles DragonForce’s evolution from RaaS into a cartel-style platform combining affiliates, access brokers and shared services, with cross-platform ransomware, double extortion and an 80/20 payment model. It describes links with Qilin, LockBit and Scatteredsp
Unit 42 attributes 2026 espionage campaigns to Screening Serpens, detailing six MiniUpdate and MiniJunk V2 RAT variants, tailored lures, DLL sideloading and AppDomainManager hijacking that disables .NET security telemetry.
The analysis shows how emulated devices, spoofed hardware IDs, filter restacking and forced binding can expose some Windows PnP driver code without its intended hardware, potentially expanding BYOVD risk. Generic hardware-probe bypasses may still require kernel or hyper
Kaspersky attributes campaigns targeting organizations in Russia and Belarus to Cloud Atlas with high confidence. Its investigation details phishing and malware chains, credential theft, and backup access through SSH tunnels, RevSocks, and Tor.
NetSPI used Qiling to emulate a UEFI PNG decoder and observed an out-of-bounds read when a PNG’s IDAT length was spoofed. The flaw could expose boot-time memory, but actual sensitive-data leakage was not demonstrated.
Step Security reports that Megalodon injected malicious workflows into 5,561 GitHub repositories; payloads harvested CI, cloud and source-code secrets and sent them to a listed C2 IP. Tiledesk repositories and npm packages were among those affected.
Step Security reports four Laravel-Lang Composer packages had all Git tags rewritten to point to malicious commits. A detonation of one package confirmed payload execution and an outbound exfiltration request to flipboxstudio[.]info; three others were not tested.
Void Dokkaebi has shifted InvisibleFerret to Cython-compiled Windows and macOS modules, complicating script-based detection. The malware retains credential- and wallet-stealing capabilities, while binary artifacts and runtime scripts can aid analysis.
Researchers link the Showboat Linux post-exploitation framework, used since at least mid-2022, to attacks on a Middle East telecom provider and other possible victims. It supports remote shell, file transfer and SOCKS5 proxy functions.
EclecticIQ details an ongoing campaign using SEO-poisoned fake developer-tool pages to deliver a fileless PowerShell infostealer that steals credentials, tokens, cookies and files, then exfiltrates data and can run follow-on payloads.
Lumen and PwC researchers describe a Calypso-attributed campaign targeting telecom providers in Asia Pacific and the Middle East since at least mid-2022, using Linux Showboat and Windows JFMBackdoor implants. The initial infection vector is unknown.
Flare analyzed about 700 underground posts to document how Lucifer DaaS uses affiliates, wallet approvals, website cloning, and automated deployment. The article also lists warning signs of malicious wallet requests.
A Gen Digital analysis details trojanized JDownloader installers delivered through compromised download links on May 6–7, 2026. The payload included an r77 rootkit, a Python bot and a WDAC policy that blocked security tools.
zLabs reports that nearly 250 Android apps targeted users in four countries for carrier-billing and premium SMS fraud. Its analysis describes three malware variants using WebViews, OTP interception, cookie theft and Telegram reporting.
ESET researchers describe Webworm’s 2025 shift toward European targets, detail its EchoCreep and GraphWorm backdoors and custom proxy tools, and report GitHub staging plus a compromised S3 bucket used for configuration retrieval and data exfiltration.
Huntress analyzed two Gentlemen ransomware incidents involving scheduled tasks, PowerShell, Windows log clearing, and attempts to disable Microsoft Defender. One incident included a SOCKS proxy connecting to attacker-controlled IP addresses.
