In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2492 articles
Researchers linked more than 20,000 fake shops through shared Sellvia-powered WordPress templates and 36 IP addresses. The stores are described as harvesting payment and personal data; the article also offers consumer safety guidance.
Cyble researchers describe a phishing framework hosted mainly on edgeone[.]app that uses browser-permission prompts to collect images, audio, video, device data and selected contacts, then sends data via Telegram bots. Script annotations suggest—but do not prove—AI use.
SOCRadar profiles DieNet’s DDoS operations, reporting 59 attack claims in two days during the March 2026 escalation. It describes the group’s rented infrastructure and attack methods, while noting that its ransomware and OT/ICS claims remain unverified.
Seqrite Labs reports that Operation GhostMail used Zimbra CVE-2025-66376 to steal account data and 90 days of mail from a Ukrainian government agency. It assesses APT28 attribution with medium confidence.
Team Cymru analyzed files from an exposed Beast ransomware server, mapping tools across the intrusion lifecycle. Artifacts included credential-theft utilities, exfiltration tools, backup-disabling scripts, and Windows and Linux ransomware binaries.
A campaign uses a fake Ramadan coupon document to deliver a Windows RAT. Its multi-stage infection chain uses a VBA macro and C# loader, while the RAT routes file exfiltration through AWS S3 presigned URLs.
Researchers detail a macOS malware chain that uses poisoned search results and fake verification prompts to trick users into running a Terminal command, steal sensitive data, and tamper with Ledger Live.
ThreatLabz analyzed SnappyClient, a HijackLoader-delivered malware implant with remote-access and data-theft capabilities. Its observed activity targets cryptocurrency users, including browser credentials, wallet data, and clipboard contents.
Lookout researchers detail DarkSword, an iOS exploit chain used through compromised Ukrainian websites to steal personal data and cryptocurrency-related information from targeted iPhones, then quickly erase its files and exit.
Acronis TRU analyzed campaigns using fake game cheats to deliver Vidar Stealer 2.0. The investigation details the infection chains, evasion and persistence methods, data targeted, and Telegram- and Steam-based C2 discovery.
ReliaQuest reports LeakNet uses ClickFix on compromised websites to deliver commands, followed by a Deno-based in-memory loader and a repeatable chain involving DLL side-loading, PsExec, S3 exfiltration, and encryption.
CIS details a ZPHP campaign targeting U.S. state, local, tribal, and territorial organizations with fake CAPTCHA and ClickFix lures that can deliver Remcos RAT, enabling surveillance, credential theft, and remote control.
K7 researchers analyzed a fake Telegram download campaign using a typosquatted site to deliver a staged loader that adds Windows Defender exclusions, reconstructs a PE from XML in memory, and contacts a C2 server for commands and payload updates.
Proofpoint researchers demonstrated in controlled tests how social engineering and user approval of a Cursor MCP deeplink could enable command execution or installation of a malicious remote MCP server. The tests did not show a default zero-click path.
ReliaQuest reports that LeakNet is using ClickFix lures and a Deno-based in-memory loader, followed by recurring jli.dll sideloading, PsExec lateral movement, and S3 staging. A similar Deno-loader incident had inconclusive attribution.
Unit 42 reports Boggy Serpens shifted toward hijacked trusted accounts and tailored phishing, detailing four campaign waves against a UAE marine and energy company and malware including Rust-based BlackBeard and LampoRAT.
Researchers traced a ClickFix campaign from fake CAPTCHA pages on compromised WordPress sites through an obfuscated HTA, malicious MSI, and Go loader to Vidar, which targets credentials, tokens, wallet data, and files.
Step Security reports that compromised PyPI package bittensor-wallet 4.0.2 was available for about 48 hours. Its analysis and controlled test describe a Rust backdoor triggered by key decryption that used multiple C2 methods to exfiltrate encrypted key data.
CloudSek describes an Android threat that uses LSPosed to spoof phone identity, intercept registration SMS and inject fake sent-message records, enabling attackers to bypass SIM-binding checks in Indian mobile payment apps.
Researchers traced an exposed Iranian-hosted directory to a 15-node relay network and an SSH-driven botnet that compiled DDoS tools on recruited hosts. The operator also used the infrastructure for censorship-bypass tunneling.
Kaspersky researchers detail GoPix, a Brazilian banking trojan delivered through malvertising. It uses obfuscated PowerShell and in-memory browser implants to manipulate Pix, Boleto and cryptocurrency transactions and intercept HTTPS traffic.
Cofense PDC describes phishing campaigns abusing LiveChat pages to impersonate PayPal and Amazon. Chat flows harvest credentials, MFA codes, card data and PII; the report details redirect and form stages but does not report confirmed victim compromise.
Specops says a phishing attempt targeting an Outpost24 C-level executive was blocked before compromising systems or affecting users. The chain used trusted Cisco and Nylas redirects and a Microsoft 365 credential-harvesting page; attribution remains unclear.
Researchers identified at least 72 additional malicious Open VSX extensions linked to GlassWorm, including transitive delivery via extensionPack and extensionDependencies. The loader retains Solana memo dead drops and adds RC4/base64 obfuscation and header-based keys.
