In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2484 articles
Socket reports 639 compromised npm package versions across 323 packages in a Mini Shai-Hulud wave. The obfuscated install-time payload targets developer secrets, exfiltrates data, and can republish malicious packages using stolen npm tokens.
StepSecurity details a Mini Shai-Hulud campaign that it says poisoned npm packages across AntV and related projects, stealing CI/CD credentials. Its analysis traces package-install execution, credential theft and exfiltration, persistence, and runner defenses.
Microsoft confirmed malicious durabletask PyPI versions 1.4.1–1.4.3 were uploaded and yanked; analysis traced a credential-stealing cloud framework. The article also reports a June 5 Azure/durabletask commit that added malware triggered by AI coding tools and VS Code.
Trend Micro researchers mapped Banana RAT’s delivery infrastructure and victim-side execution, detailing its polymorphic PowerShell payloads, remote-control capabilities, Pix QR interception, and targeting of Brazilian financial institutions.
SentinelOne describes Reaper, a SHub macOS infostealer that uses a fake Apple update and malicious AppleScript to steal credentials, wallet and browser data, and files, while establishing LaunchAgent persistence and enabling additional payloads.
Forcepoint traces how TeamPCP used a compromised Trivy build tool to publish malicious LiteLLM versions that stole AI, cloud and developer credentials, exfiltrated data, and installed a persistent backdoor.
Check Point Research analyzed a reported 16 GB leak of The Gentlemen’s Rocket database, detailing the group’s structure, tools, edge-device exploitation, NTLM relay workflows, AI use, and an alleged UK-to-Turkey intrusion.
StepSecurity reports that all tags for actions-cool/issues-helper and actions-cool/maintain-one-comment were moved to malicious commits. The payload reads Runner.Worker memory to harvest secrets and attempts exfiltration to t[.]m-kosche[.]com.
Step Security details how malicious Nx Console v18.95.0 used a stolen contributor token and hidden orphan commit to run a payload targeting developer secrets and persistence. It recommends rotating all accessible credentials and rebuilding affected machines.
Microsoft researchers say a recent Kazuar variant uses kernel, bridge, and worker modules in a leader-based P2P botnet. It collects data and uses configurable defense bypasses, with non-leader systems staying silent to reduce visibility.
Researchers say Fast16, whose components may date to around 2005, used tailored hooks to alter LS-DYNA and AUTODYN high-explosive and uranium simulation outputs. It spread within networks through services, IFEO persistence and remote shares.
ESET reports that FrostyNeighbor targeted Ukrainian government organizations from March 2026 with spearphishing PDF lures, a JavaScript PicassoLoader chain, server-side victim checks, and a Cobalt Strike payload.
FortiGuard Labs details a Windows phishing chain using an invoice-themed TXZ attachment, hidden JavaScript commands and the PawsRunner loader to deploy PureLogs, which collects browser, wallet and app data and exfiltrates it over HTTPS.
Google GTIG details UNC6671’s vishing and AiTM attacks against Microsoft 365 and Okta, scripted SaaS data theft, and extortion tactics. It also shares forensic indicators and defensive guidance; the BlackFile leak site’s shutdown may signal a rebrand.
Researchers identified malicious node-ipc versions 9.1.6, 9.2.3 and 12.0.1 that reportedly steal developer and cloud credentials and exfiltrate archives through DNS TXT queries after a maintainer account was compromised.
Microsoft reports that Turla evolved Kazuar into a modular P2P botnet. Its Kernel, Bridge, and Worker modules coordinate tasks, communicate with command-and-control infrastructure, collect data, and support stealthy persistence.
Unit 42 compares Gremlin Stealer variants, detailing .NET resource and XOR payload concealment, virtualization and staged loading, plus theft of browser credentials, Discord tokens and clipboard data, crypto clipping, and live-session hijacking.
An analysis of Qilin’s growth as a ransomware-as-a-service operation details its Windows, Linux, and ESXi capabilities, intrusion techniques, extortion methods, targeted sectors, and recommended defenses.
Socket and StepSecurity report that node-ipc versions 9.1.6, 9.2.3, and 12.0.1 contain credential-stealing code, with version 12.0.1 gated by a system fingerprint. The malware uses HTTPS and DNS exfiltration.
A six-month review found IP, CSS and favicon pivots from a YouTube DMCA phishing campaign quickly went stale, while C2 banner/header hashes and newer title-tag and redirect patterns exposed related infrastructure.
Beazley Security details a CMD Organization intrusion involving an SEO-poisoned lure, a 25-day dwell, backdoor persistence and GPO/SYSVOL ransomware deployment; the group’s leak site also offers crypto bidding for stolen data.
Three malicious node-ipc versions execute a credential-stealing payload when loaded through CommonJS. The malware collects developer and CI secrets and exfiltrates them via DNS TXT queries; developers are urged to remove affected versions and rotate exposed credentials.
ReliaQuest reports that KongTuke uses Microsoft Teams social engineering to deliver ModeloRAT via PowerShell. The campaign can establish persistent access in under five minutes and uses multiple access paths and persistence mechanisms.
Proofpoint reports a surge in device code phishing using public kits and PhaaS offerings to abuse OAuth 2.0 and steal account tokens. Campaigns target mainly Microsoft 365, with Google-themed activity also observed; recommended defenses include blocking device code flow
