In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2486 articles
Researchers analyzed 191 DNS, domain, IP and WHOIS indicators linked to eight Iran-affiliated APT groups, identifying historical resolutions, likely malicious registrations, look-alike domains and infrastructure assessed as part of an impersonation campaign.
Static analysis of a GitHub repository attributed to TeamPCP describes a modular framework for stealing credentials, exfiltrating data, and poisoning repositories and npm packages, including through developer-tool hooks and forged provenance.
CloudSEK identified more than 600 fake IPL ticket domains and 400-plus streaming sites. Some streaming redirects deliver SHub Stealer, which targets macOS credentials, browser data, crypto wallets and other files, and establishes persistence.
Trend Micro analyzes two TeamPCP supply-chain attacks that abused CI/CD and release workflows to distribute credential stealers, compromise downstream software, and access cloud secrets.
The Mini Shai-Hulud campaign reportedly compromised hundreds of packages through manipulated GitHub Actions pipelines, targeting developer and cloud credentials. TanStack says affected versions were removed; researchers reported limited community spread and no evidence
Sysdig says a scanner probed PraisonAI’s unauthenticated legacy API 3 hours 44 minutes after CVE-2026-44338 was disclosed. The flaw can trigger configured workflows; upgrade to 4.6.34 or later and restrict exposure.
ReversingLabs says it identified 163 samples tied to Linux CVE-2026-31431, including ELF, Python and PyPI variants, with samples dating to April 29, 2026. It released YARA rules and hunting queries; Ubuntu fixes are available.
A Shai-Hulud campaign attributed to TeamPCP used stolen OIDC tokens and CI/CD credentials to publish malicious packages across npm, PyPI and Composer, stealing developer secrets and establishing persistence.
A technical report details a Seedworm espionage campaign targeting at least nine organizations across four continents in early 2026, including a South Korean electronics maker, using DLL sideloading, credential theft and public-service data staging.
Reports link TeamPCP’s Mini Shai-Hulud worm to compromised npm and PyPI packages. The malware steals credentials, abuses GitHub Actions and OIDC tokens, persists in developer IDEs, and propagates through package publishing.
ReliaQuest investigated an April 2026 ClickFix intrusion that paired scheduled-task persistence and PowerShell C2 with PySoxy proxying. Endpoint controls blocked both channels, but the task kept trying to restart the activity.
TeamPCP compromised npm and PyPI packages using a credential-stealing worm. The report details a GitHub Actions cache-poisoning attack, exfiltration methods, destructive persistence, affected packages, and recommended response steps.
eSentire analyzes a Tycoon 2FA campaign that uses a multi-layer phishing chain to trick victims into authorizing OAuth device codes, giving operators Microsoft 365 tokens despite successful MFA.
Hunt.io says attackers exploited KACE SMA's CVSS 10.0 authentication bypass to compromise HIQ, exposing a database tied to 60+ client organizations and a 308 MB post-exploitation toolkit. More than 12,000 internet-facing appliances reportedly show pre-patch versions.
Socket reports malicious npm and PyPI package releases linked to Mini Shai-Hulud. The malware targets CI, cloud, and developer credentials, can propagate through package publishing, and prompted TanStack to remove affected versions and harden workflows.
QiAnXin XLab links Mr_Rot13 to active exploitation of cPanel CVE-2026-41940. The reported chain uses SSH persistence, a web shell, credential theft, and the cross-platform Filemanager backdoor.
ThreatFabric reports that Trickmo.C, delivered through fake TikTok and streaming apps, targets banking and crypto-wallet users in France, Italy, and Austria. It uses TON .ADNL addresses for C2 and adds networking and tunneling commands.
A DFIR investigation details an intrusion that began with a malicious MSI, used EtherRAT and TukTuk for access and C2, exfiltrated data to Wasabi, and ended in domain-wide The Gentlemen ransomware deployment.
An analysis of recent supply-chain campaigns finds a recurring pattern: attackers compromise trusted people or components, abuse release and automation workflows, steal secrets, and propagate through connected software ecosystems.
Varonis Threat Labs found that Azure Cosmos for PostgreSQL’s management API validation could be bypassed with control characters to inject PostgreSQL settings and enable potential RCE via archive_command. Microsoft confirmed the issue and fixed it in summer 2025.
StepSecurity analyzes Mini Shai-Hulud's npm supply-chain campaign, detailing runner-memory credential theft, self-propagation and malicious releases with valid provenance. TanStack confirmed 84 malicious versions across 42 packages.
A new TrickMo variant targeting banking and wallet users in France, Italy, and Austria moves C2 to TON and adds SSH tunnelling and SOCKS5 proxying, turning infected Android devices into network pivots.
Trend Micro details two campaigns using agentic AI to support intrusions against government and financial organizations in Latin America, including reconnaissance, lateral movement, backdoor deployment, and data exfiltration.
Genians details a suspected APT37-linked spear-phishing campaign that uses ZIP-delivered LNK files, obfuscated scripts, and a disguised Python bytecode payload to install a persistent backdoor for remote command execution.
