In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2377 articles
A bug bounty assessment of an unnamed cloud provider chained Kubernetes, control-plane and managed-service flaws to bypass tenant isolation. The researchers say the provider fixed all reported issues.
Kaspersky attributes Operation FlashHole to Lazarus, targeting at least three South Korean organizations. The campaign abuses INISAFE CrossWeb EX to deliver multi-stage malware; its initial access vector remains unclear, and its latest malware uses ML-KEM-1024 for an,
DarkOwl’s investigation describes ZeroForums’ forum structure, administrator, and linked Telegram channels, including 96 files of alleged breaches. It reports that the forum’s apparent hosting IP was identified; advertised breach claims remain unverified.
Bay Area Labs reports that 37 of 60 OffiDocs-linked Chrome extensions (2.3 million installs) encode and send visited URLs to linked servers; it also describes server-directed redirects and privacy risks in VPNOnline. OffiDocs and Google had not responded.
Huntress describes multiple incidents it linked to compromised camera-management software used for initial access. Attackers dropped rs.win32.exe, sideloaded DLLs through WpcMon.exe, added Run-key persistence and beaconed to a C2; the software vendor remains uncertain.
Cofense details a phishing campaign that uses a fake bid invitation and password-protected PDF to evade content scanning, then leads recipients through a fake document drive to a Microsoft login page that captures credentials.
A DNS and WHOIS investigation into RatHat, an Android malware campaign spread via smishing and malvertising, identified 33 network IoCs, 240 communicating client IPs, and additional potentially malicious domains.
Cloudflare disclosed a confirmed cross-tenant data exposure in GLM-5.3 Workers AI: 155 responses to prompts over 681,280 tokens included data from other customers’ requests. A KV-pool mismatch and SGLang bug caused it; fixes are deployed, with no deliberate exploitation
Gen Digital details macOS and Windows campaigns that abused Claude sharing pages and Google Ads to deliver ClickFix malware, including AMOS, credential and wallet theft, and a Windows remote-access payload.
Arctic Wolf describes attackers exploiting external Microsoft Teams chats to impersonate IT support and gain remote access. In one observed chain, a Python implant queried Active Directory; Sophos says some related attacks deployed Chaos ransomware.
GitHub’s 2026 protections make common Pwn requests harder, but older checkout versions, unprotected triggers, script injection, artifact poisoning, and persistent runner state leave attack paths open. The article explains the risks and recommends workflow audits and key
Infoblox investigated two unrelated operations that used unauthorized DNS changes to host illegal gambling pages beneath school and government domains. It details CNAME and delegated-subzone methods, observed infrastructure, and DNS monitoring and remediation steps.
Arctic Wolf analyzed 400+ incidents of attackers abusing Teams external chat for impersonation and initial access. It details a PowerShell-based payload chain and recommends restricting external access and monitoring chat and endpoint activity.
Researchers found the rentable uCreator Android kit can steal Telegram 2FA passwords and clone WeChat accounts through tampered apps or a container. Its code exposes a multi-customer backend; victim impact and some operator links remain unconfirmed.
Wiz says Gheist planted 13,500+ branches across 850+ compromised accounts, using stolen GitHub tokens to expose secrets in Actions logs. GitHub’s approval hold stopped checked public runs but does not cover private repositories or GitHub Enterprise Server.
Forever Security says it stopped a malicious AGENTS.md file on a customer machine before code ran. Tests showed how silently downloaded instructions could target Codex and Claude Code; the file’s arrival route in the customer case is unknown.
Huntress says telemetry shows ConnectWise application-credential abuse targeting Microsoft 365 tenants, with scripted and operator-adapted activity. It assesses LLM involvement at low-to-medium confidence; Microsoft attributes the activity to Storm-0940 using ARTEX.
Wiz says the active Gheist campaign used stolen GitHub tokens to add Actions workflows that exposed repository secrets in logs, affecting more than 850 accounts and 13,500 branches, including private repositories and enterprise environments.
Wiz Research reports that Gheist used compromised GitHub tokens to plant workflows and expose repository secrets, recovering more than 13,500 branches across 850+ accounts. Public runs were held for approval, but private and enterprise runs executed.
A researcher reports lab-tested Tailscale SSH flaws that could turn a compromised, permitted device into root access on reachable servers. Tailscale says it is investigating; the specific claims remain unconfirmed and no fix is available.
Picus’s overview describes Famous Chollima’s fake-recruiter coding tests, malicious npm, VS Code and Git-hook execution, malware capabilities, and fraudulent IT-worker scheme, drawing on cited research.
Kaspersky researchers detail BlackX, a UEFI bootkit used in an early-2026 espionage campaign targeting Central Asian diplomatic agencies. It exploited Baton Drop to bypass Secure Boot; the report describes its security-disabling driver, espionage payloads and manual-rev
Socket says two malicious GitHub Actions workflows ran in the LiteLLM repository on October 10 and 12, targeting organization and environment secrets. The runs succeeded, but successful exfiltration is unconfirmed; LiteLLM says audit logs link the first workflow’s GH\_\
Kaspersky reports that BlackX, a suspected BlackLotus copycat, targeted diplomatic organizations in Central Asia. It can exploit CVE-2022-21894 on patched Windows systems when required Secure Boot revocations have not been applied.
