In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2486 articles
Trend Micro details InstallFix, a campaign using Google Ads and fake Claude Code installation pages to trick users into running commands that launch multi-stage malware with evasion, persistence, and data-collection capabilities.
A deceptive OpenClaw skill identified in March 2026 used installation instructions to deliver Remcos RAT on Windows and GhostLoader across platforms, stealing credentials and other sensitive data from developer environments.
An exposed server revealed tooling and logs from an intrusion targeting Omani government entities. Evidence shows access to the Ministry of Justice and Legal Affairs and extraction of more than 26,000 user records, judicial data, and registry hives.
Microsoft analyzed an April 2026 phishing campaign that targeted more than 35,000 users with compliance-themed emails and PDF lures, leading to an AiTM flow designed to capture authentication tokens. Microsoft recommends email, browser, and phishing-resistant MFA mitig
Securonix reports that VENOMOUS#HELPER has affected 80+ organizations, mostly in the U.S. SSA-themed phishing delivers SimpleHelp with persistent access and SYSTEM-level privileges, then installs ScreenConnect as a fallback; the actor is unknown.
Researchers describe Ouroboros, an Active Directory technique that uses a planted Shadow Credential and dMSA self-enrollment to extract a superseded account’s NT hash, persisting through password rotation and attacker-account deletion.
Trend Micro analyzes QLNX, a previously undocumented Linux RAT that uses stealth, multiple persistence methods, rootkit and PAM backdoor capabilities, and credential harvesting to target developer and cloud access.
ConsentFix v3 automates OAuth authorization-code phishing using pre-consented Microsoft apps and Pipedream to capture refresh tokens; the article says the variant's uptake among cybercriminals remains unclear.
Securonix describes Deep#Door, a Python-based Windows backdoor that disables security controls, establishes layered persistence, evades analysis, and supports espionage and destructive actions.
Unit 42 analyzed 18 GenAI-themed Chrome extensions and found RAT, data-theft, search-hijacking and spyware behaviors, including email and API-key theft. Google removed extensions or warned owners; researchers recommend least-privilege controls and runtime monitoring.
Acronis TRU reports 575 malicious OpenClaw skills across 13 developer accounts and analyzes trojanized Hugging Face artifacts delivering Windows and macOS payloads, including AMOS Stealer. It details indirect prompt injection, staged execution, evasion and defenses.
Socket researchers detail a BufferZoneCorp campaign using malicious Ruby gems and Go modules to steal developer credentials, tamper with CI dependency settings, intercept Go execution, and establish SSH persistence.
A compromised intercom/intercom-php 5.0.2 artifact used a Composer plugin to download Bun and run credential-stealing malware during installation or updates. Packagist removed the artifact; affected users should investigate hosts and rotate exposed credentials.
Intercom TypeScript Library version 7.0.4 runs an install-time infostealer that harvests GitHub credentials and retrieves C2 instructions through GitHub commit search. Users are advised to check for suspicious activity and rotate credentials.
SpiderLabs analyzes Vect RaaS payloads for Windows, Linux and ESXi, detailing lateral movement, credential use, ChaCha20 encryption and process/VM termination. It reports links to TeamPCP and assesses a possible Devman connection that remains uncertain.
Socket reports that malicious lightning versions 2.6.2 and 2.6.3 run an obfuscated payload on import, stealing credentials and attempting to poison GitHub repositories and infect npm packages.
Wiz researchers found permission-check bypasses and prompt-injection paths to expose local credentials in AI-powered GitHub Actions. OpenAI changed bot controls, Anthropic updated its documentation, and Wiz reported vulnerable workflows to maintainers.
Mini Shai-Hulud spread through four SAP CAP npm packages, using VS Code tasks and Claude Code hooks to execute payloads and propagate across repositories. The article details its links to PolinRider and recommends hunting and credential rotation.
Researchers attribute tax-themed phishing campaigns in India and Russia to Silver Fox, detailing modified RustSL loaders, ValleyRAT delivery and the ABCDoor Python backdoor, which they traced in the group's arsenal to at least late 2024.
StepSecurity reports that lightning 2.6.2 and 2.6.3 contain an import-triggered, obfuscated JavaScript payload that steals credentials, abuses GitHub to exfiltrate data, and infects npm tarballs. Full payload analysis is ongoing.
Step Security reports [email protected] was published with a Shai-Hulud payload that runs through a new preinstall hook, targets GitHub/npm and AWS, GCP and Azure credentials, and uses private GitHub repositories for exfiltration and npm tokens to propagate.
Huntress details an intrusion using stolen VPN credentials and Impacket to install Komari as a persistent SYSTEM-level backdoor. The partner network was isolated before the operator issued Komari commands; no data loss was reported.
Huntress details a fake image-background remover campaign that uses ClickFix to deliver CastleLoader, NetSupport RAT and a .NET stealer targeting browser credentials, wallet data and Telegram sessions. The analysis also describes the malware chain and defensive controls
Kudelski Security reports that the TeamPCP-attributed Mini Shai Hulud campaign compromised npm and PyPI packages to steal developer and CI/CD credentials, with propagation through maintainer accounts and automated workflows.
