In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2486 articles
Cyble describes a campaign using Russian-language humanitarian-aid lures and malicious LNK files to deploy a persistent Python implant. Analysis found credential and data theft, surveillance, and covert remote-access capabilities; attribution remains inconclusive.
SEQRITE Labs describes a spear-phishing campaign targeting Eurasian aviation professionals with Russian-language lures. Its Rust malware profiles systems, sends data to cdn[.]kleymarket[.]ru, and downloads a second-stage payload; no actor attribution is established.
HiddenLayer found a typosquatted Hugging Face repository impersonating OpenAI’s Privacy Filter. Its loader deployed the Sefirah infostealer against Windows users; the repo reached 244,000 downloads, a count researchers said may have been inflated.
CYFIRMA details Operation SilentCanvas, a multi-stage intrusion using a PowerShell payload disguised as a JPEG, on-host .NET compilation, a fileless UAC bypass and trojanized ScreenConnect for persistent encrypted remote access.
FortiGuard Labs analyzes a campaign exploiting CVE-2024-3721 in TBK DVR devices to install Nexcorium, a Mirai variant with multiple persistence methods, brute-force capabilities and DDoS functions. A link to “Nexus Team” is suspected.
ESET identified 28 CallPhantom Android apps with more than 7.3 million downloads. The apps fabricated call and message histories, charged users for fake results, and were removed from Google Play after ESET reported them.
LevelBlue GSOC demonstrates how modifying Electron app files can deliver a Meterpreter payload for persistence or hollow Microsoft Teams to run Loki C2 despite WDAC. The report details detection indicators and defensive measures.
Elastic Security Labs describes TCLBANKER, a Brazilian banking trojan targeting 59 financial platforms. It uses anti-analysis checks, browser monitoring and credential overlays, and spreads through hijacked WhatsApp sessions and Outlook accounts.
Seqrite Labs describes Operation GriefLure, a spear-phishing campaign targeting Viettel-linked personnel in Vietnam and St. Luke’s Medical Center in the Philippines, and analyzes its LNK/ftp.exe loader, DLL sideloading, RAT capabilities and C2.
SentinelLABS analyzed PCPJack, a modular worm that removes TeamPCP artifacts, harvests cloud and developer credentials, and propagates through exposed services. A separate toolset deploys Sliver beacons and steals credentials from more than 30 services.
Unit 42 reports limited exploitation of PAN-OS CVE-2026-0300, an unauthenticated root-code-execution flaw, by likely state-sponsored cluster CL-STA-1132. Observed activity included shellcode injection, tunneling tools, Active Directory enumeration and log cleanup.
CYFIRMA describes Trusted Infrastructure Phishing campaigns abusing legitimate cloud services for delivery, hosting, token theft and persistence, including browser-memory phishing and OAuth device-code abuse, and recommends identity-focused monitoring and stronger than
SentinelOne reports that PCPJack removes artifacts from TeamPCP infections, steals credentials across cloud and other services, and attempts to spread through vulnerable web applications and exposed deployments.
LevelBlue traced a Windows infection chain from MicrosoftToolkit.exe through a disguised script and AutoIt loader to communications associated with Vidar. The analysis found anti-analysis and cleanup behavior; credential theft was a potential outcome, not confirmed.
SentinelLabs says PCPJack targets exposed cloud systems, steals credentials, and removes TeamPCP artifacts. The malware spreads through vulnerable services, moves laterally, establishes persistence, and sends encrypted, chunked data to Telegram.
Elastic Security Labs describes TCLBanker, a banking trojan delivered through a trojanized Logitech AI Prompt Builder installer. It targets 59 financial and crypto platforms and can spread through victims’ WhatsApp and Outlook accounts.
Netskope details three waves of a fake OpenClaw installer campaign delivering Rust malware that evades sandboxes, steals credentials from more than 250 browser extensions, and uses layered C2 infrastructure. Hookdeck disabled an abused relay endpoint.
Huntress analyzed phishing incidents using Tiflux to install additional remote-access tools, collect system information and screenshots, and establish persistence. The installer also contained outdated components and a driver previously abused for privilege escalation.
Socket researchers found five malicious NuGet packages impersonating Chinese .NET libraries. The packages deliver an infostealer targeting browser credentials, crypto wallets, SSH keys, and files; about 65,000 downloads are reported, and the packages remain available.
OpenSourceMalware reports that Lazarus-linked fake coding-assessment repositories use Git hooks to fetch OS-specific payloads, potentially leading to credential and crypto-wallet theft. It shares infrastructure and a GitHub hunt query.
Trend Micro describes QLNX, a Linux implant targeting developer and DevOps environments with fileless execution, multiple persistence methods, a dual-layer rootkit, and credential theft. Its deployment scale and attribution are unknown.
ESET details a ScarCruft supply-chain campaign targeting a Yanbian gaming platform: trojanized Windows updates delivered RokRAT and BirdCall, while Android games carried a newly analyzed BirdCall variant built for surveillance and data theft.
Censys reports that cPanel/WHM hosts accounted for nearly 80% of newly malicious hosts on May 1, alongside Mirai deployments and a possible ransomware campaign marked by exposed files renamed “.sorry”; the campaign’s full scope remains unclear.
Kaspersky reports that trojanized DAEMON Tools versions 12.5.0.2421–12.5.0.2434 have distributed malware since April 8, 2026. The active campaign uses compromised installers to deliver targeted payloads and communicate with env-check[.]daemontools[.]cc.
