In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2495 articles
Microsoft researchers describe campaigns abusing OAuth error redirects to bypass phishing protections and deliver credential theft or malware. The article details EvilProxy phishing and a malware chain involving LNK files, PowerShell, and DLL side-loading.
Unit 42 reports in-the-wild web-based indirect prompt injection (IDPI), identifying 22 payload techniques and intents including ad-review evasion, data destruction and unauthorized transactions; successful bypass of deployed ad-review agents was not confirmed.
Huntress traced fake OpenClaw installers promoted in Bing AI results to GitHub repositories distributing Windows information stealers and GhostSocks, and macOS AMOS. GitHub removed the reported repositories; updated XProtect detects the analyzed macOS sample.
Hunt.io describes infrastructure-clustering research on Iranian-linked actors, using hosting, file hashes, certificates, and web fingerprints to identify additional servers and domains associated with MuddyWater and Dark Scepter.
DomainTools analyzes the Doppelgänger/RRN influence network, finding coordinated media-impersonation domains, scripted provisioning, TLD migration, CDN/cloud hosting and segmented WordPress operations designed to sustain campaigns amid enforcement.
Microsoft researchers describe campaigns abusing silent OAuth flows and error redirects to send government and public-sector users to phishing or malware pages. One observed chain used a ZIP, LNK, PowerShell and DLL side-loading; Microsoft provides detection and mitig
Arctic Wolf reports that SloppyLemming targeted organizations in Pakistan and Bangladesh from January 2025 to January 2026, using phishing and two malware chains to deploy the BurrowShell backdoor and a Rust-based keylogger.
An analysis of 46 IoCs tied to seven malware families reported 145 client IPs contacting eight IoC domains and 359 email-connected domains, 25 of which threat-intelligence checks found had been weaponized.
A fake site distributes a trojanized FileZilla 3.69.5 archive with a malicious version.dll that hijacks DLL search order, runs inside filezilla.exe, and can access saved FTP credentials. Analysis observed sandbox evasion and DoH/C2 activity.
Socket reports that OpenVSX versions 1.8.12 and 1.8.13 of Aqua’s Trivy VS Code extension injected code that launched local AI assistants for reconnaissance and attempted exfiltration. No successful exfiltration is confirmed; the affected releases were removed.
Researchers say LummaC2 logs from a machine linked to a suspected DPRK IT worker exposed an Indonesian proxy node and evidence of synthetic identities, crypto scams and a likely infection after GTA V cheat downloads.
CloudSek analyzes a trojanized Israeli Red Alert app distributed by SMS links. The Android malware disguises itself as the legitimate alert app, collects SMS, contacts and GPS data, and sends it to attacker-controlled infrastructure.
Researchers attribute 26 malicious npm packages in the StegaBin campaign to Famous Chollima. Their loader decodes C2 domains hidden in Pastebin essays, then delivers cross-platform malware for credential theft, persistence, remote control, and developer-secret exfiltr.
Zscaler ThreatLabz documented APT37’s Ruby Jumper campaign, which uses malicious LNK files and USB-propagated tools to reach air-gapped systems and stage data for delayed exfiltration.
Zscaler reports that APT37’s Ruby Jumper campaign uses new malware to target air-gapped systems. ThumbsBD and VirusTask use removable drives to exfiltrate data and spread malware, while FootWine provides Android surveillance capabilities.
Huntress reports intrusions at five partner organizations involving fake IT support, credential harvesting, DLL sideloading and modified Havoc payloads. In one environment, attackers spread to nine additional endpoints using scheduled tasks and RMM tools.
Zscaler researchers detail two attack chains targeting Iraqi government officials, using four previously undocumented .NET malware tools. They assess with medium-to-high confidence that the campaign was conducted by an Iran-nexus actor tracked as Dust Specter.
Step Security says hackerbot-claw exploited GitHub Actions workflows at seven repositories through untrusted pull-request code and shell, branch-name and AI prompt injection. It reports stolen Trivy credentials enabled a repository takeover and malicious VS CodeS
Socket analyzed 26 typosquatted npm packages that use Pastebin steganography and Vercel routing to install a RAT and nine data-stealing modules targeting developer secrets. The activity is consistent with FAMOUS CHOLLIMA, but attribution is not confirmed.
Malwarebytes analyzed a fake Google security-check site that abuses PWA and service-worker features to collect data and proxy traffic; an optional Android APK adds keylogging and device monitoring. The article also provides removal guidance.
CISA’s updated analysis says RESURGE can remain dormant on compromised Ivanti Connect Secure devices, activating only for inbound TLS traffic matching a CRC32 fingerprint and forged Ivanti certificate. It also details persistence and log-tampering components.
Zscaler researchers link APT37’s Ruby Jumper campaign to a five-tool toolkit that uses LNK/PowerShell, Zoho WorkDrive C2, and removable drives to relay commands and data across air-gapped systems and support surveillance.
Datadog researchers traced 1Phish through four versions (September 2025–February 2026), documenting its shift to an API-driven kit that fingerprints victims and captures 1Password credentials, OTPs, and recovery codes. No reverse-proxy infrastructure was observed.
Socket researchers traced a backdoored Go module that captures ReadPassword input, fetches shell commands through a GitHub-hosted pointer, and deploys a Rekoobe Linux backdoor. The Go module proxy now blocks it after a report.
