In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2491 articles
A reported ClickFix-style macOS campaign uses an Apple-themed webpage and applescript:// workflow to launch an obfuscated script in Script Editor, download a Mach-O binary, and run an Atomic Stealer variant.
Socket's investigation links Contagious Interview packages across npm, PyPI, Go Modules, crates.io and Packagist. The loaders hide in routine APIs and fetch second-stage payloads; a Windows variant includes RAT capabilities. Some packages were removed after reporting.
Rapid7’s incident response team reports that attackers exploited CVE-2025-59718 to bypass FortiGate SSO, create accounts, download configurations, and enter an internal network. The investigation traces credential theft, lateral movement, and detection opportunities.
Microsoft reports that Forest Blizzard and Storm-2754 compromised SOHO routers to hijack DNS and selectively conduct TLS AiTM attacks. The activity affected over 200 organizations and 5,000 consumer devices; Microsoft also shared detection and mitigation guidance.
CloudSek describes alleged APT35 access across several Gulf networks, outlines Iranian-linked actors, malware and exploited vulnerabilities, and recommends urgent patching, IOC blocking, credential rotation and compromise assessments.
Zscaler ThreatLabz details a February 2026 attack using a fake Acrobat download to deliver ScreenConnect through obfuscated scripts, in-memory .NET execution, process masquerading, and a COM-based UAC bypass.
Gen Threat Labs attributes the 64-bit Remus infostealer to Lumma based on shared code and techniques, including an Application-Bound Encryption bypass. The analysis details Remus’s EtherHiding C2 resolution and added anti-analysis checks.
Trellix details Masjesu, an IoT botnet active since at least 2023. It spreads by scanning for vulnerable devices, uses process masquerading and cron jobs for persistence, and supports multiple DDoS attack types.
An analysis found that @velora-dex/sdk 9.4.1 runs an obfuscated payload on import, downloading and executing a shell script from 89.36.224.5. The article says versions 9.4.2 and later are clean.
Hunt.io researchers found an exposed, unauthenticated C2 and source code for Canis, a cross-platform surveillance framework delivered through Japanese-themed phishing. Its API was secured on March 21, while related phishing infrastructure appeared afterward.
Lookout and Access Now describe a campaign targeting Middle Eastern civil society members since at least 2022, using spearphishing, credential theft and Android spyware called ProSpy. Lookout assesses links to BITTER with moderate confidence.
Sekoia analyzes EvilTokens, a Microsoft device-code phishing service that uses harvested tokens for mailbox access and Graph reconnaissance, then applies chained LLMs to identify financial threads and draft tailored BEC scenarios.
Microsoft describes Storm-1175 exploiting web-facing vulnerabilities, using remote-management and credential-theft tools, and deploying Medusa ransomware. The report details observed attack techniques and recommends perimeter, credential, and endpoint defenses.
NCSC details how APT28 exploited SOHO routers, including TP-Link devices, to redirect DNS queries and conduct adversary-in-the-middle attacks aimed at stealing passwords and authentication tokens.
Netskope Threat Labs details a ClickFix campaign using a silently installed Node.js payload on Windows. Dynamic modules, gRPC-over-Tor C2 and leaked protocol files expose RAT capabilities and a multi-operator MaaS backend.
Microsoft describes Storm-2372’s device-code phishing campaign, detailing how dynamic code generation enabled token theft and how attackers used compromised accounts for reconnaissance, persistence and email exfiltration.
Unit 42 reports a 282% year-over-year rise in Kubernetes-related token-theft activity and details two attack cases involving service-account token abuse and React2Shell. The article explains cloud-pivot techniques and defensive controls.
StepSecurity analyzed malicious @velora-dex/sdk 9.4.1, which runs on import and contacts a C2 server. Its macOS payload drops an architecture-specific binary and registers launchctl persistence; the article provides investigation findings and recovery steps.
Huntress compares two NightSpire ransomware incidents, detailing RDP access and attacker tools used for persistence, file collection and likely exfiltration. Different tactics and ransom-note files leave NightSpire’s RaaS status uncertain.
Researchers identified a traffic-broker operation using hundreds of short-lived, localized promotional sites that impersonate familiar brands to attract mobile users and route traffic to downstream scams, including pig-butchering schemes and Telegram account hacking.
The assessment links Homeland Justice, Karma and Handala to a unified MOIS-aligned ecosystem combining low-complexity intrusions, surveillance, data leaks and coordinated messaging to magnify psychological and reputational impact.
CIS analyzed a phishing campaign targeting U.S. SLTT entities with Vimeo-themed lures to harvest personal and banking data, alongside related tax-themed infrastructure delivering Datto RMM. CIS shared indicators and blocked associated domains.
A threat actor used Reddit posts promoting cracked TradingView builds to distribute Vidar on Windows and AMOS on macOS. The active campaign used hijacked websites, password-protected archives, and social engineering to steal credentials and other data.
SafeDep identified 36 malicious npm packages impersonating Strapi plugins. Their install hooks attempted Redis and PostgreSQL exploitation, credential theft, and persistent access, with cryptocurrency-related data among the targets. Users who installed them are advised,
