In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2377 articles
Attackers published trojanized LiteLLM 1.107.0 packages and Docker images, apparently using stolen maintainer tokens. The payload stole credentials and enabled follow-on AWS reconnaissance; artifacts were removed, and users are advised to rebuild affected hosts and
Analysis found signed WindowsDefender.msi and DefenderUpdate.msi installers deploying a Rust remote-shell agent. It executes attacker commands over HTTPS, and later builds used a new server; sandbox runs received no real orders.
Microsoft says China-aligned Storm-0940 used ARTEX to automate attacks targeting hundreds of organizations and assesses the actor was responsible for the ConnectWise multi-tenant application compromise. Some attacks reached privileged cloud access in under three hours.
Sonatype tests found that Java rejected listed eMudhra intermediate certificate encodings but accepted re-encoded versions with different SHA-256 fingerprints in the tested JDK and trust-store configurations.
Unit 42 traced BUGSTER’s AI-assisted operations against Indian organizations, including a confirmed university intrusion that exposed more than 5,200 records, plus credential attacks, Wi-Fi cracking, and VoIP fraud planning.
Wiz researchers describe PHP memory-safety flaws affecting versions back to 5.4, enabling unauthenticated RCE and process-memory disclosure. PHP released patches on October 21, 2026; AI models helped develop and adapt exploits.
A trojanized LiteLLM 1.107.0 package and Docker images stole credentials via Python startup hooks. The stealer targeted cloud, browser, AI and other secrets; the malicious release and images were removed, and involved tokens revoked.
Socket traced credential-stealing Python startup hooks in LiteLLM 1.107.0 wheels and container images. The investigation linked the payload to a lookalike source recorded in build provenance, while noting the workflow’s authorization and wheel-upload path remain unest
Analysis of the LiteLLM 1.107.0 macOS wheel found Python startup hooks that steal credentials and run a persistent remote-code loader. Upwind reported the payload in all seven wheels; the second stage remains unresolved.
Qualys details BlueHammer, an eight-stage Windows Defender local privilege-escalation chain that reached SYSTEM in lab testing. It requires prior standard-user code execution; Defender platform 4.18.26030.3011 or later closes the vulnerable path.
A phishing campaign uses personalized YouTube channel data and a fake Amazon Music offer to steal Google passwords and MFA codes through a sign-in form hosted on a second domain.
Sophos researchers describe Bronze Sandcastle, a China-aligned cluster targeting organizations in Asia and Africa since mid-2025, using Sandboxie DLL sideloading to run encrypted backdoors and collect system and user data.
Analysis traces five CrocoRAT builds hidden in signed fake software installers. The malware can run commands, steal browser and wallet data, and phish credentials; researchers note the October stealer may not run because of an installer check.
Attackers altered more than 300 Tor exits in early October to redirect SSH connections. Passwords were exposed only when users accepted an interception server's host key and logged in by password; Tor removed the affected relays by October 5.
Hirundo tested 1,840 apps generated by Alibaba’s Qwen3-Coder and found higher hackability for a US defense contractor than a Chinese one. The company says a modified model removed the disparity.
Researchers discuss GlassWorm's compromise of four OVH CLI versions, malware split across packages, and GhostAction's use of fake-font credential stealers that persist beyond removal of malicious GitHub workflows.
Kaspersky links Operation FlashHole to Lazarus, identifying at least three affected South Korean firms. Its investigation details suspected phishing lures, CrossWeb EX abuse, GitHub-based command and control, and post-quantum-encrypted payload delivery.
Aikido reports that compromised LiteLLM 1.107.0 PyPI wheels and Docker images contained an infostealer and RAT. It details the build-time injection and credential theft; affected users are urged to rotate credentials after the release was removed and the incident was re
StepSecurity found credential-stealing and remote-code-loader payloads in LiteLLM 1.107.0 PyPI wheels and Docker images. The stealer targeted developer, cloud and AI credentials; BerriAI removed affected artifacts and advised treating hosts as compromised.
StealthMole used indexed Telegram records to trace YY520CN’s underground activity, advertised services, financial records and response after CrowdStrike reporting. It documents associations and claims but says key operations and attribution remain unverified.
Google says UNC7017 tampered with AOMEI update configurations in 2026 to deliver the CROSSROAD downloader and SHINYROAD backdoor, and later used a WebDAV resource to collect NTLM hashes. The article also outlines exposure checks and mitigations.
A malicious LiteLLM 1.107.0 release on PyPI and Docker images ran a Python-startup credential stealer and RAT loader. Attackers reportedly used stolen GitHub CLI OAuth tokens; the release was removed, and Datadog urges affected users to clean environments and rotate
Datadog analyzes two critical PHP RCE flaws, their request-processing and stale-state mechanisms, and exploitation. AWS reported attempts as early as Oct. 17, before disclosure; PHP fixed releases are available, and patching is the only complete remedy.
Zscaler ThreatLabz analyzed a global campaign combining customized ARTEX, AI assistants and automation. Recovered configurations and prompts show coordinated investigations targeting organizations across sectors and regions, with apparent focus on monetizing personal,
