In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2497 articles
CloudSEK says it infiltrated Gunra’s newly launched affiliate program and analyzed a Windows ransomware sample that uses ChaCha20 and RSA-4096, encrypts selected files offline, and leaves R3ADM3.txt ransom notes.
Researchers found 40 trojanized ClawHub skills directing users to a lookalike OpenClawCLI site, which served an obfuscated command to download and run malware. The site was offline as of February 9.
Researchers detail XPACK, a campaign using malicious npm packages to collect GitHub usernames and device fingerprints, then block installation with a cryptocurrency payment demand. Nine packages were identified; the C2 was reported active during analysis.
Zscaler researchers detail how GuLoader uses polymorphic code, exception-based control flow, encrypted strings, and cloud-hosted payloads to hinder analysis and evade detection, and describe scripts for deobfuscating samples.
Huntress observed SolarWinds Web Help Desk exploitation across three customers, documenting attackers’ use of remote-access tools, Velociraptor, Cloudflare tunnels, Elastic Cloud for system data, and QEMU persistence. It urges organizations to update and review exposed
Bitdefender researchers found malicious OpenClaw skills that disguise shell commands, download payloads, and steal credentials. About 17% of skills analyzed in the first week of February 2026 showed malicious behavior.
Zscaler ThreatLabz analyzes Marco Stealer, an information-stealing malware first observed in June 2025 that targets browser data, cryptocurrency wallets, clipboard contents, screenshots, and sensitive local and cloud files.
Researchers detail a macOS phishing campaign that uses AppleScript to steal credentials, attempt to forge TCC permissions, and install a persistent Node.js loader. TCC manipulation may fail on newer macOS versions.
Huntress says attackers used compromised SonicWall SSLVPN credentials, then deployed an EDR killer that abused an EnCase driver to terminate security processes. Huntress disrupted the intrusion before ransomware was deployed.
CloudSEK describes ZHGUI as a cross-border crypto investment scam targeting Southeast Asian investors through messaging groups, fake trading dashboards and misleading regulatory claims, and traces suspected funds through TRON wallets to major exchanges.
Zscaler researchers detail an APT28 campaign targeting Central and Eastern Europe with malicious RTF files exploiting CVE-2026-21509 to deliver MiniDoor email-stealing malware or a Covenant Grunt implant.
Researchers report 386 malicious ClawHub skills that use social engineering to deliver information stealers targeting macOS and Windows. They describe credential theft techniques and say most skills remained available when the article was updated.
Bitdefender researchers detail an Android RAT campaign that uses deceptive apps and Hugging Face to deliver frequently rebuilt payloads. The malware abuses Accessibility Services to spy on users, steal credentials, and send data to its operators.
OpenSourceMalware describes a campaign targeting developers with fake coding assessments and malicious VS Code tasks. Its analysis of 14 repositories found 11 payload variants, including loaders that deliver the InvisibleFerret backdoor.
Researchers found an exposed directory on an active BYOB command-and-control server and analyzed a multistage malware deployment with cross-platform persistence, surveillance capabilities, and infrastructure also hosting XMRig miners.
CloudSEK links PayTool-style traffic-fine scams with phishing impersonating Canadian tax, postal and airline services. The campaigns use SMS, malicious ads and typosquatted domains to steal personal and payment data, with kits also advertised on underground forums.
Zscaler details the Sheet Attack campaign targeting Indian government entities with SHEETCREEP, FIREPOWER and MAILCREEP backdoors, malicious PDFs and LNK files, and command-and-control over legitimate Google and Microsoft services.
ThreatLabz details the Gopher Strike campaign targeting Indian government entities with phishing PDFs, a Golang downloader and backdoor using private GitHub repositories, and a loader that deploys Cobalt Strike.
Researchers detail a MacSync campaign that uses a ClickFix lure to install a macOS stealer, harvest credentials and wallet data, and trojanize Ledger and Trezor apps to phish PINs and recovery phrases.
Darktrace describes a campaign targeting South Korea that uses government-themed decoys and JSE scripts to establish VS Code tunnels for remote access. The activity is assessed as DPRK-aligned, though attribution is not definitive.
A multi-stage Facebook phishing campaign tricks creators into submitting session cookies, backup codes, and passwords. Researchers identified 115 pages, eight collection endpoints, and reused infrastructure supporting the account-takeover workflow.
Static analysis traces a fake-recruiter campaign from a malicious npm package to OtterCookie and a PyInstaller-compiled InvisibleFerret payload, documenting credential theft, cloud-data collection, remote access and persistence.
Genians analyzes a Konni-attributed spear-phishing campaign that abuses advertising redirects and compromised WordPress sites to deliver EndRAT via LNK files and AutoIt scripts, and recommends behavior-based detection and layered defenses.
Huntress details KongTuke’s NexShield extension, which crashes browsers and tricks users into running malicious commands. The campaign uses staged PowerShell payloads and delivers ModeloRAT to domain-joined hosts.
