In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2498 articles
Huntress details KongTuke’s NexShield extension, which crashes browsers and tricks users into running malicious commands. The campaign uses staged PowerShell payloads and delivers ModeloRAT to domain-joined hosts.
Wiz researchers say an unanchored CodeBuild filter let them bypass trusted-user checks, steal a GitHub token, and gain admin access to AWS repositories. AWS remediated the issue and says it found no customer or service impact.
CloudSEK reports that the RedLineCyber actor used Discord relationships to distribute a Python-based Windows clipper that replaces copied wallet addresses for six cryptocurrencies. It persists through a Registry Run key and operates without network communication.
A WordPress infection checks Google-related User-Agents and IP ranges before fetching remote content for crawlers, while showing regular visitors the legitimate site. The article describes its behavior, impact, indicators, and remediation steps.
Huntress describes four cases where attackers used apparently AI-assisted scripts and a malicious Chrome extension for credential theft and data collection, concluding AI sped up familiar tradecraft rather than creating fundamentally new attack methods.
Team Cymru says its July–December 2025 analysis identified 28 IP addresses and 85 domains hosting carding markets or forums, using scans, passive DNS, certificate data and NetFlow. It cautions that not all identified sites were confirmed operational.
A PHP implant fetched gambling spam from fugthatshit[.]baby and served it to search engine crawlers while showing normal content to visitors. The article details its behavior, indicators, and remediation steps.
A malicious WordPress plugin injects fake update alerts into the admin dashboard on Windows systems and downloads JavaScript from an attacker-controlled domain. The alerts aim to trick administrators into downloading malware.
CloudSEK analyzes a MuddyWater-attributed spearphishing campaign targeting Middle Eastern sectors with malicious Word documents that deliver a Rust implant featuring registry persistence, asynchronous C2, evasion, and process injection.
Darktrace describes Medusa ransomware activity across its customers, detailing how attackers abused RMM tools for access, persistence, lateral movement and data theft, including a 2025 compromise that exfiltrated about 70 GiB.
Huntress analyzes an ESXi escape toolkit observed in a December 2025 intrusion, detailing its suspected use of three VMware vulnerabilities, a VSOCK backdoor, and the response that stopped the attack before ransomware deployment.
ThreatLabz found three malicious npm packages that install NodeCordRAT, a RAT using Discord for command-and-control and targeting Chrome credentials, secrets, and MetaMask data. The packages have been removed from npm.
Wiz reports that cached packages and a malicious OpenVSX extension prolonged Shai-Hulud infections. A clean extension update sharply reduced new infections; leaked credentials remain, and a possible link to Trust Wallet’s $7 million theft is under investigation.
CloudSEK analyzed nine months of C2 logs showing RondoDoX targeting web applications and IoT devices, with Next.js Server Actions exploitation and botnet deployments surging in December 2025.
CloudSEK analyzes a Silver Fox campaign targeting India with tax-themed phishing emails that deliver Valley RAT through a multi-stage infection chain, DLL hijacking, process injection, and tiered command-and-control infrastructure.
OpenSourceMalware describes a Contagious Interview campaign variant using VS Code tasks and an obfuscated dictionary file to install a persistent Node.js backdoor that retrieves code from ip-regions-check[.]vercel[.]app.
Huntress analyzed three IIS-linked incidents, using endpoint and Windows logs to trace attempted malware execution, Windows Defender changes, and failed persistence. Similar tactics and infrastructure suggest the incidents may share an actor.
Genians analyzes an APT37 campaign that used spear-phishing HWP documents, OLE objects, DLL side-loading and RoKRAT payloads, with Yandex Cloud infrastructure for C2. The report details the attack chain and recommends behavior-based EDR monitoring.
Positive Technologies details Phantom Enigma’s updated phishing campaigns, which target Brazilian users with credential-stealing browser extensions and organizations with RMM tools, including Syncro. Attackers manipulate browser windows to install extensions.
Hunt.io and Acronis mapped DPRK-linked infrastructure, detailing a new Linux Badcall variant, credential-theft tool staging, repeated FRP deployments, and certificate-linked hosts associated with Lazarus and related activity.
ThreatLabz details a BlindEagle spear-phishing campaign against a Colombian government agency, using a likely compromised email account, a fake judicial portal, obfuscated scripts, Caminho, and DCRAT.
ThreatLabz analyzes BlackForce, a phishing kit that steals credentials and MFA codes through real-time Man-in-the-Browser attacks, evades scanners, and sends stolen data through C2 and Telegram channels.
Wiz researchers traced attacks exploiting Gogs CVE-2025-8110 to a symlink bypass that enables remote code execution, finding more than 700 compromised instances. Gogs fixed the vulnerability in v0.13.4.
An analysis describes three browser-hijacking methods: altering browser preferences, using simulated keystrokes to control browsing, and deploying scripts that disable updates and load a malicious extension.
