In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2491 articles
CIS details a MacSync Stealer campaign targeting U.S. SLTT macOS users through SEO-poisoned fake CAPTCHAs. The malware can steal credentials, system data and crypto assets, and trojanize Ledger apps to capture seed phrases.
The analysis details JanelaRAT’s evolving infection chain and its use of overlays, input injection and remote control to hijack banking sessions. 2025 telemetry recorded thousands of detections in Brazil and Mexico.
Varonis Threat Labs analyzes agentic-browser architectures and reports how trusted-origin flaws could expose privileged browser tools. Tests also examined defenses against URL-triggered agent actions and prompt injection.
Genians analyzes an APT37-attributed campaign that used Facebook reconnaissance and military-document lures to deliver a tampered PDFelement installer, deploy memory-resident malware, and abuse legitimate websites and Zoho WorkDrive for C2 and data theft.
Researchers identified 1,951 compromised repositories and 1,047 owners linked to PolinRider, and estimate the true scope may reach 2,000–3,000 repos. They report shared tooling with TasksJacker and provide hunting and cleanup guidance.
eSentire says two compromised Axios npm releases delivered SILKBELL and the WAVESHAPER RAT across Windows, macOS and Linux. It identified 19 affected customers; UNC1069 attribution is reported, and follow-on activity remains unconfirmed.
A fake Claude installer delivered a working app alongside a PlugX sideloading chain using signed G DATA updater NOVUpdate.exe and malicious avk.dll. Sandbox telemetry recorded an outbound connection to 8.217.190.58:443.
A DNS/WHOIS investigation of Group-IB IoCs for the MuddyWater-attributed Operation Olalampo linked 10 potential victim IPs, 2,530 email-associated domains, six additional malicious IPs and 55 string-connected domains; the authors urge corroboration.
Analysis details a trojanized CPUID HWMonitor installer that uses PowerShell, MSBuild and regsvr32 to run scriptlets, reconstruct a .NET payload from fake IPv6 strings, and execute it in memory.
A malicious Open VSX extension impersonating WakaTime uses Zig-compiled Node.js addons to install a second-stage extension across VS Code-compatible IDEs. Researchers say it retrieves C2 via Solana, deploys a RAT and Chrome data stealer, and advise exposed users to
AhnLab explains how attackers abuse signed MSBuild.exe to run inline C# code, download payloads and enable DLL sideloading. It describes a reported phishing campaign and recommends behavior- and context-based detection.
Infoblox and Chong Lua Dao analyzed an active Android banking-trojan MaaS operation linked by technical and insider evidence to Cambodia’s K99 Triumph City compound. The malware steals credentials and biometrics and enables banking fraud.
Researchers say TotalRecall Reloaded can inject into Windows Recall’s less-protected AIXHost.exe as the current user, extracting decrypted screenshots and indexed data after Windows Hello authentication; Microsoft closed the report as “Not a Vulnerability.”
eSentire TRU analyzed STX RAT after observing attempted delivery to a finance customer in February 2026. The RAT uses staged in-memory loading, encrypted C2, anti-analysis, HVNC, and C2-gated credential theft; TRU released YARA rules and defensive guidance.
LevelBlue reports malicious Axios versions 1.14.1 and 0.30.4 used a hidden postinstall dependency to fetch a payload and deploy a RAT on customer systems. It observed suspicious npm/node process chains; large-scale data exfiltration remains unconfirmed.
Researchers say VENOM targets senior executives with personalized SharePoint lures, Unicode QR codes and filtered phishing pages that use AiTM or device-code flows to capture Microsoft credentials, MFA codes and session tokens.
A detailed profile traces TeamPCP’s 2026 campaign from a Trivy CI/CD compromise through credential theft and propagation across package registries and developer tools, detailing its C2, persistence, exfiltration, and reported impacts.
Cisco Talos says UAT-10362 used LucidRook in October 2025 phishing campaigns against Taiwanese NGOs and universities. The Lua-based backdoor supports bytecode payloads; Talos could not recover a decryptable payload, so post-infection actions remain unknown.
ReversingLabs reports that the revived Graphalgo campaign targets crypto developers through fake recruiting and malicious GitHub dependencies, delivering an encrypted downloader and RAT. Researchers cite reused payloads, timestamps and rewritten Git histories as support
Cisco Talos attributes campaigns targeting Taiwanese NGOs and suspected universities to UAT-10362. The group uses archive lures and DLL side-loading to deploy LucidRook, a Lua-based stager, with geofencing and compromised infrastructure.
Microsoft details Storm-2755’s Canada-focused campaign using SEO poisoning and malvertising to steal Microsoft 365 credentials and tokens, hijack sessions, and target payroll. Microsoft reports one payment was redirected through Workday.
LevelBlue’s analysis details an ErrTraffic V3 WordPress backdoor, obfuscated scripts and EtherHiding-based C2 resolution for OS-specific ClickFix lures. Reused hardcoded keys may help defenders decrypt traffic and identify related infrastructure.
Kaspersky researchers traced a trojanized Proxifier installer on GitHub through staged PowerShell, process injection and Defender exclusions to a ClipBanker that replaces copied cryptocurrency addresses. Kaspersky detected over 2,000 affected users, mainly in India and
CERT-AgID says it has evidence that an automated device-code phishing campaign targets Italian public administration. Dynamic codes and redirect chains help attackers obtain Microsoft access tokens, bypass MFA and take over accounts.
