In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2489 articles
Trend Micro reports that Void Dokkaebi uses fake coding interviews, malicious VS Code tasks, and injected code to spread malware through developer repositories. Its March 2026 scan found more than 750 infected public repositories.
Analysis of two DinDoor samples details their Deno-based execution, victim fingerprinting, and C2 behavior. A query of HTTP response characteristics identified 20 servers active within the week before publication.
Positive Technologies details CapFix campaigns targeting Russian industrial and aviation organizations with phishing lures, compromised infrastructure and evolving CapDoor malware capable of executing commands, downloading payloads and capturing screenshots.
Check Point Research reconstructs an intrusion involving an affiliate of The Gentlemen RaaS, describing Cobalt Strike, a blocked SystemBC attempt, lateral movement and GPO-based ransomware deployment, and analyzing the locker’s evasion, persistence and encryption.
Check Point researchers linked a SystemBC botnet of more than 1,570 hosts to a Gentlemen ransomware affiliate, detailing its use for covert payload delivery and an attack chain involving Cobalt Strike, Mimikatz and GPO-based deployment.
Microsoft describes intrusions using external Teams chats to impersonate helpdesk staff, gain access via Quick Assist, move laterally with WinRM, and collect data with Rclone. It recommends treating external contacts as untrusted and monitoring remote-access tools.
Netskope details a ClickFix campaign that tricks macOS users into running a command, then uses a persistent fake password prompt to steal credentials, keychain and browser data, extension contents, and cryptocurrency wallet files.
Researchers identified 26 App Store phishing apps that redirect users to trojanized wallets. FakeWallet variants hijack wallet screens or display phishing prompts to capture recovery phrases and send them to command-and-control servers.
Hudson Rock says a February 2026 Lumma infection on a Context.ai vendor employee may have exposed credentials later used in the Vercel breach. It cites browser history and access records and recommends checking Google Workspace for a suspicious OAuth app.
Huntress details an intrusion involving Nightmare-Eclipse tools, suspicious FortiGate VPN access, reconnaissance and a tunneling agent. The tools appeared unsuccessful; Huntress isolated the organization and recommends reviewing endpoint and VPN telemetry.
A Lumma Stealer infection at Context.ai led attackers to use stolen OAuth tokens to access Vercel systems and enumerate environment variables in a limited subset of customer projects. The article details the attack chain, risks and defensive steps.
Microsoft describes a human-operated intrusion chain using cross-tenant Teams helpdesk impersonation to gain Quick Assist access, sideload payloads, pivot with WinRM and exfiltrate data via Rclone. It also provides hunting queries and defenses.
CYFIRMA analyzes Operation PhantomCLR, a campaign targeting Middle East and EMEA financial organizations. It details AppDomainManager hijacking, JIT-based shellcode execution, reflective loading, sandbox evasion and CloudFront-fronted command-and-control.
Researchers identified 109 fake GitHub repositories across 103 accounts distributing SmartLoader and StealC. The loader hides execution, collects and exfiltrates host data, resolves C2 through a Polygon contract, and persists with scheduled tasks.
Sophos describes two campaigns using hidden Alpine Linux VMs in QEMU to evade host defenses, harvest credentials and enable remote access. One is linked to Payouts King; another exploits CitrixBleed 2. Zscaler says Payouts King is likely tied to former BlackBasta oper
Unit 42 found observed Mirai-like botnet attempts against end-of-life TP-Link routers were flawed, but firmware analysis confirmed authenticated command injection via ssid1 in CVE-2023-33538; default credentials may enable exploitation.
eSentire describes a multi-stage Kong RAT campaign that used SEO-poisoned software download sites to target Chinese-speaking developers. Its analysis details the malware’s evasion, persistence, keylogging and modular C2 capabilities.
Zimperium zLabs investigated RecruitRat, SaferRat, Astrinox, and Massiv, four Android banking trojan campaigns targeting over 800 banking, cryptocurrency, and social media apps. The research details their delivery, evasion, credential theft, and C2 techniques.
Huntress says a Linux host targeted by multiple threat actors had a Monero miner, credential theft and data exfiltration. The user’s Codex troubleshooting masked the miner and generated commands that complicated SOC triage.
Huntress reports a rise in Bomgar incidents likely exploiting CVE-2026-1731. Attackers used compromised instances for downstream access, persistence, reconnaissance and, in some cases, LockBit ransomware.
RedSun exploits a missing reparse-point check in Windows Defender’s remediation process, allowing a local unprivileged user to redirect a file write into System32 and run code as SYSTEM. The article reports that no patch was available at publication.
Darktrace analyzed ZionSiphon, malware designed to manipulate water-treatment systems. A flawed XOR-based country check currently triggers self-destruction, though the sample includes chlorine-control changes, partial Modbus code, and USB propagation.
Cyble researchers detail MiningDropper, a modular Android framework that uses obfuscation, staged payload loading and configuration-driven delivery to deploy cryptocurrency miners, infostealers or BTMOB RAT.
Rapid7 traced a ClickFix campaign impersonating Claude: an MSIX-like archive delivered an HTA that launched staged PowerShell, bypassed AMSI and injected shellcode. Rapid7 detected activity via RunMRU and recommends monitoring it and containing hosts.
