In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2499 articles
An analysis describes three browser-hijacking methods: altering browser preferences, using simulated keystrokes to control browsing, and deploying scripts that disable updates and load a malicious extension.
Bitdefender researchers detail a fake One Battle After Another torrent that uses hidden scripts, disguised archives and scheduled-task persistence to deliver Agent Tesla to Windows systems, with its final payload executed in memory.
Huntress reports observing React2Shell exploitation across customer organizations, with attackers attempting to deploy miners and several Linux malware families. It details the malware’s capabilities and recommends patching CVE-2025-55182.
An investigation links APT31 to prolonged attacks on Russian IT firms in 2024–2025, detailing phishing, credential theft, lateral movement, new malware, and abuse of cloud services for command-and-control and data exfiltration.
Wiz CIRT describes incidents where attackers used compromised GitHub PATs to find Actions secrets, run malicious workflows, obtain cloud credentials, move into cloud environments and delete evidence. The article also highlights audit-log gaps and investigation steps.
Huntress traced an AMOS infection to a malicious Terminal command in AI-style troubleshooting chats surfaced by Google. The malware stole credentials and other data, gained root access, and persisted on the victim’s Mac.
Wiz describes in-the-wild exploitation of React’s CVE-2025-55182, including credential harvesting, cryptomining and Sliver backdoors in cloud workloads, and explains the exploit mechanics and exposure beyond Next.js.
Volexity attributes campaigns impersonating European security events to Russian threat actor UTA0355. Fake registration sites and rapport-building phishing led targets to OAuth or device-code workflows, enabling access to Microsoft 365 accounts.
Deep Instinct’s analysis describes Nimbus Manticore as a 64-bit Windows malware sample with obfuscation, sandbox-evasion indicators, and potential RPC-based privilege escalation and lateral-movement capabilities.
Huntress investigated three intrusions involving Velociraptor for command-and-control, including SharePoint ToolShell exploitation, web shells, and tunnels using Cloudflare and VS Code. One incident involved Warlock ransomware; its initial access vector was undetermined
Researchers analyzed a fake Prettier VS Code extension that delivered Anivia and OctoRAT through a multi-stage chain, enabling remote control, credential and data theft, persistence, and evasion. The extension was removed after several installs.
Researchers analyzed Arkanix, a stealer advertised on Discord that can collect browser, wallet, VPN and other data. Its C++ version uses process injection to bypass Chrome App-Bound Encryption; the command server was unavailable during analysis.
Researchers describe a Contagious Interview campaign that uses VS Code tasks in cloned repositories for infection and persistence, delivering BeaverTail and Invisible Ferret malware that steals credentials, browser data and crypto-wallet information.
CloudSek describes two clusters of holiday-themed fake stores that impersonate consumer brands, reuse shared templates, and harvest billing and payment details. More than 750 domains were linked in one cluster; over 200,000 .shop results were potential matches, not all-
Positive Technologies details attacks involving QuietCrabs and Thor, including rapid exploitation of SharePoint and Ivanti flaws, KrustyLoader and Sliver deployment, and telemetry indicating about 110 potential Russian company victims of Thor.
Bitdefender analyzed three fake Battlefield 6 downloads: a trainer that steals browser, wallet, and Discord data; an evasive sample with possible credential-theft aims; and an ISO that installs a persistent C2 agent.
Wiz reports a Shai-Hulud-linked npm campaign that trojanized roughly 700 packages, stole developer and cloud secrets, and spread data to 25,000+ GitHub repositories. GitHub revoked tokens and restricted malicious repositories; teams are urged to rotate credentials.
Huntress traced ClickFix lures to a multi-stage .NET loader that extracts Donut-packed shellcode hidden in PNG pixel data, then injects infostealers including LummaC2 and Rhadamanthys. Lures mimic verification checks or Windows Update.
Huntress traced an intrusion likely involving exploitation of WSUS flaw CVE-2025-59287, followed by Velociraptor installation and host discovery. Analysts contained the activity.
Researchers describe Sturnus, an Android banking trojan that steals credentials, remotely controls devices, and reads messages from WhatsApp, Telegram, and Signal after decryption. Activity appears limited as operators test the malware.
An analysis reports that the IndonesianFoods worm used 60 npm accounts to publish at least 86,583 packages, polluting the registry and allegedly manipulating TEA Protocol rewards. The payload reportedly publishes a new package every seven seconds.
Cisco Talos analyzes Kraken, a ransomware group linked possibly to HelloKitty, describing its SMB-based access, credential theft, Cloudflared persistence, data exfiltration, and Windows, Linux, and ESXi encryptors.
Hunt.io describes finding Cobalt Strike infrastructure and payloads in exposed directories, linking hosts through certificates, and analyzing PowerShell loaders, shellcode, and beacon behavior. It also shares indicators and defensive hunting recommendations.
Darktrace reports a surge in Vo1d botnet activity across customer environments, mainly in South Africa, and describes detecting DGA-generated domains, rare cloud-hosted endpoints, and outbound connections on unusual TCP ports.
