In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2499 articles
A technical investigation of WordPress casino-spam malware found payloads hidden in the database and a .dat file, redundant execution code in theme and plugin files, and a separate script that restores removed infection code.
Huntress observed three Gootloader infections since Oct. 27; two led to hands-on intrusions and Domain Controller compromise within 17 hours, with one partner-observed case under an hour. The loader uses WOFF2 glyph substitution and encrypted ZIP delivery.
Hunt.io researchers linked 28 Chinese-, English-, and Japanese-language phishing pages targeting organizations across Asia, finding shared templates, scripts, and ZIP/RAR lures themed around tax, finance, and government documents.
Researchers describe Herodotus, an Android banking Trojan active in Italy and Brazil. It uses remote control, overlays and SMS theft, and randomizes text-entry delays to imitate human behavior and potentially evade fraud detection.
Cisco Talos analyzes multiple 2025 Qilin incidents, detailing possible VPN access using exposed credentials, credential theft, cloud exfiltration, defense evasion, and ransomware deployment across Windows and virtualized environments.
Huntress analysts used Windows logs and compatibility records to reconstruct a Qilin ransomware incident despite post-incident, single-endpoint visibility, tracing rogue remote access, attempted payload execution, and ransom-note activity.
Darktrace reports that attackers exploited CVE-2025-5777 to access a European telecom, deployed the SNAPPYBEE backdoor through DLL sideloading, and used multiple C2 channels. The activity was detected and remediated early; attribution to Salt Typhoon is assessed with “/
Cisco Talos details how a trojanized Chessfi Node.js application delivered merged BeaverTail and OtterCookie malware, including a new module that captures keystrokes and screenshots, and examines a possibly related malicious VS Code extension.
Huntress analysts describe ransomware deployment methods observed in incidents, including manual launches, remote network shares, PsExec-based tools, and Active Directory servers, and explain how monitoring can help detect activity.
Researchers detail a campaign targeting macOS users with fake software download sites that use clipboard-injected Terminal commands to install Odyssey Stealer or AMOS. They identified more than 85 related phishing domains and mapped shared infrastructure.
Huntress traced an August 2025 intrusion using exposed phpMyAdmin, MariaDB log poisoning, a web shell, Nezha and Ghost RAT across 100+ potential victims. A China-nexus attribution was later questioned by an unverified tip.
Aqua researchers analyzed a Kaiji infection on a weak-password SSH honeypot, documenting its DDoS and proxy capabilities, persistence and evasion methods, and campaign infrastructure, including a server with more than 70,000 collective malware downloads.
CloudSek analyzes documents it attributes to APT35/Charming Kitten, detailing two Windows RATs, custom ASP webshells, operational tooling, targeting claims, and behavioral detection guidance.
Hunt.io analyzes AdaptixC2’s beacon, evasion and pivoting features, and reports 102 active servers found through its telemetry, including 56 returning an AdaptixC2 HTTP header. The article shares hunting indicators and defensive measures.
Volexity details UTA0388’s multilingual spear-phishing campaigns, rapport-building tactics, and five GOVERSHELL backdoor variants, assessing with high confidence that the China-aligned actor used LLMs to support its operations.
CloudSEK analyzes alleged internal APT35 documents describing phishing, rapid vulnerability exploitation, router manipulation, custom malware, EDR evasion, supply-chain attacks, and extensive data theft across government, legal, education, and other sectors.
An injected function in a WordPress theme’s functions.php file fetched attacker-controlled JavaScript, enabling redirects and pop-ups. The researchers found the script loading on at least 17 websites and shared two indicators of compromise.
Hunt.io links extensive phishing infrastructure, credential-harvesting portals and malware staging to SideWinder activity targeting government, military and maritime organizations across South Asia.
ThreatFabric analyzed Datzbro, an Android Trojan distributed through fake senior-event promotions. Its remote control, overlays, keylogging, and credential theft capabilities can enable financial fraud; researchers also found a leaked C2 application and builder.
Darktrace describes four vendor-compromise campaigns targeting one customer in two weeks, using trusted senders, hijacked email threads, and legitimate file-sharing services to deliver fake Microsoft login pages and steal credentials.
A DFIR investigation details a nearly two-month intrusion that began with a tax-themed JavaScript file and involved multiple malware families, credential theft, lateral movement, and data exfiltration. No ransomware deployment was observed.
Huntress reports a 631% increase in ClickFix-related incidents over six months and explains ClickFix, FileFix, TerminalFix and DownloadFix, their execution traces, and telemetry chokepoints defenders can monitor.
Positive Technologies researchers analyzed Goffee attacks on Russian organizations, detailing new malware and tools, including the Sauropsida Linux rootkit, and the group’s phishing, tunneling, evasion, and infrastructure techniques.
Bitdefender researchers detail a campaign using hijacked Google and YouTube accounts and TradingView-themed ads to deliver malware. The infection chain leads to a stealer with credential theft, keylogging, and remote-access capabilities.
