In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2486 articles
Trend Micro reports that SHADOW-EARTH-053 has targeted government, critical infrastructure, and related organizations across at least eight countries, exploiting unpatched Exchange and IIS vulnerabilities to deploy web shells and ShadowPad.
DarkOwl analyzes Handala’s rebrand, unverified data-exposure claims and insider-recruitment effort, alongside rapid Telegram amplification of an attack attributed to Ashab al-Yamin. Direct coordination between the actors remains unverified.
A campaign dubbed mini Shai-Hulud compromised four SAP-related npm releases, using a Bun-based payload to steal developer and cloud credentials, exfiltrate them to GitHub, and spread through GitHub Actions and AI/IDE hooks.
WhoisXML API’s analysis expanded Cisco Talos’s UAT-8099 indicators to 10 domains and 17 subdomains, linking them through DNS and WHOIS records to 12,787 email-connected domains; four were classified as malicious. UAT-8099 reportedly targeted IIS servers in Thailand and
Malicious versions 2.0.4–2.0.7 of the unscoped npm package tanstack used postinstall scripts to exfiltrate environment files and, in some versions, README.md or AGENTS.md. Developers who installed them should rotate secrets.
Wiz details a TeamPCP-linked campaign that trojanized SAP-related npm packages to steal developer and CI/CD secrets, spread through repositories, and exfiltrate data via GitHub and attacker infrastructure.
Socket analyzed four compromised npm package versions linked to SAP development workflows. Their install scripts deploy a credential-stealing payload that targets developer machines and CI runners, exfiltrates data through GitHub, and can propagate through npm packages.
Check Point Research says VECT 2.0’s Windows, Linux and ESXi lockers discard three required encryption nonces, irreversibly destroying files over 131,072 bytes; operators cannot decrypt them. The analysis also details platform-specific evasion and spread features.
StepSecurity reports four compromised SAP-related npm packages carrying a Bun-based credential stealer. Its analysis details npm worm propagation, GitHub Actions secret theft, encrypted exfiltration and persistence through Claude Code and VS Code hooks.
Attackers used a compromised vendor mailbox to send phishing links to a blurred Markdown document hosted on Kuse.ai, which redirected users to a fake Microsoft login page to steal credentials.
Researchers reverse-engineered xlabs_v1 after finding its toolkit in an unauthenticated directory. The Mirai-derived botnet targets internet-exposed ADB devices and offers 21 DDoS methods aimed at game servers.
Check Point researchers say VECT 2.0 overwrites encryption nonces when processing file chunks, leaving only the final 25% of large files recoverable. The flaw reportedly affects Windows, Linux, and ESXi variants.
Hudson Rock says its analysis linked about 80% of 164 Coinbase Cartel victims to prior infostealer infections. The group is described as using old credentials to access cloud and file-sharing services for data theft and extortion.
Check Point Research says VECT 2.0 stores only one of four nonces used to encrypt files larger than 131,072 bytes, making three chunks unrecoverable across its Windows, Linux, and ESXi variants.
Wiz disclosed CVE-2026-3854, an X-Stat injection flaw that enabled RCE on GitHub.com and GitHub Enterprise Server. GitHub fixed GitHub.com and patched supported GHES versions; Wiz said 88% of instances remained vulnerable at publication.
ReversingLabs describes PromptMink, a malicious npm and PyPI supply-chain campaign attributed to Famous Chollima, tracing its evolving payloads from obfuscated JavaScript to Rust add-ons and detailing secret theft, project exfiltration and SSH backdoors.
An analysis traces a Vietnam-uploaded trojanized CHM through a multi-stage infection chain to a Rebex-based Telegram RAT, detailing its persistence, command capabilities and limited attribution.
Forcepoint X-Labs analyzed a DHL-themed phishing campaign that uses a locally generated fake OTP to build trust, then steals passwords and victim telemetry through a spoofed login page and exfiltrates the data via EmailJS.
GTIG and Mandiant say UNC6692 used email flooding and Teams help-desk impersonation to deliver malware via AWS S3, steal credentials from LSASS, and move laterally with pass-the-hash. They published IOCs and YARA rules.
Sysdig TRT observed targeted pre-auth SQL injection attempts against LiteLLM 36 hours after disclosure of CVE-2026-42208, with UNION payloads probing credential tables. No authenticated follow-on or confirmed extraction was observed; Sysdig recommends patching and key-
Analysis of a Windows Go-based M3rx sample details its X25519/AES encryption, 0x400-byte file footer and limited recovery conditions. Leak-site victim entries are actor claims; researchers found insufficient public evidence to link M3rx to a known crew or intrusion path
Google Threat Intelligence Group reports that UNC6692 used email bombing and fake IT support to deploy Snow malware, move through a victim’s network, harvest credentials, and collect data from a domain controller.
Mandiant says UNC6692 used email bombing and Microsoft Teams helpdesk impersonation to deliver the Snow malware suite, then used credential theft and lateral movement to reach domain controllers and exfiltrate Active Directory data.
ESET describes GopherWhisper’s Go-heavy toolset targeting a Mongolian government entity, including backdoors using Slack, Discord and Outlook for C2 and file[.]io for exfiltration. Recovered messages and draft emails revealed operator activity.
