In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2499 articles
Huntress details a 10-stage phishing infection chain that progressed from Python loaders and an infostealer to PureRAT, explaining its persistence, evasion, host fingerprinting and encrypted C2. SOC remediation stopped deployment of additional plugins.
CloudSEK analyzed six months of exposed botnet logs showing attacks on routers, IoT devices and enterprise applications, including command injection, default-credential attempts and delivery of RondoDoX, Mirai and Morte payloads.
An analysis of two malicious WordPress files found them creating and restoring a hidden administrator account, concealing the account and plugin, and sending credentials to an attacker-controlled server. The article lists indicators and cleanup steps.
Talos analyzed a campaign active since 2022 targeting telecom and manufacturing organizations in Central and South Asia. Its new PlugX variant shares loader techniques and configuration traits with RainyDay and Turian; Talos assesses a Naikon link with medium confidence
Darktrace analyzes ShadowV2, a campaign using a Python spreader and Go-based RAT to infect exposed Docker daemons, control compromised systems through an API, and launch HTTP flood and HTTP/2 rapid reset attacks.
Wiz researchers describe hunting for anomalous cloud metadata access that uncovered exploitation of a Pandoc zero-day (CVE-2025-51591) and SSRF abuse in ClickHouse. IMDSv2 and limited instance privileges reduced impact.
A malicious August 30 BlockBlasters patch used scripts to steal Steam, browser, and crypto-wallet data and install StealC and a backdoor. The game was removed from Steam after more than 100 downloads were reported.
Hunt.io researchers traced AsyncRAT and a custom PowerShell RAT delivery campaign through trojanized ScreenConnect installers, open directories, ClickOnce redirects, and adaptable loaders with scheduled-task persistence and rotating C2 infrastructure.
Wiz details how malicious npm packages stole secrets and used npm tokens to spread. Researchers found exposed credentials and publicized private repositories, and recommend removing affected versions, auditing GitHub, and rotating secrets.
Darktrace analyzed a campaign that used fake PuTTY download sites promoted through search results to deliver the Oyster backdoor, observing persistence, command-and-control traffic, possible data exfiltration, and unusual RDP activity.
Huntress used browser history and EDR telemetry to investigate an attacker who installed its agent, documenting reconnaissance, automated workflows, and identity-related activity. The company later clarified its analysts removed the agent after 84 minutes.
ThreatFabric analysts describe RatOn, an Android trojan that combines remote control, NFC relay, automated transfers through a Czech bank app, and cryptocurrency wallet theft. They assess its campaign as targeting Czech users, with Slovakia possibly next.
Researchers detail PhantomCore’s espionage campaign against Russian organizations, reporting 181 compromised hosts, a varied malware toolkit and segmented infrastructure. They also identify evidence suggesting a lower-skilled splinter group.
An intrusion began with a fake EarthTime installer that delivered SectopRAT. The attacker used SystemBC and Betruger, stole credentials, and exfiltrated files over unencrypted FTP before being evicted; no ransomware was deployed.
Analysis of a Silver Fox campaign found fake installers dropping a signed kernel driver that terminates targeted security processes. The report details the driver-loading and termination mechanisms, detection guidance, and containment considerations.
CloudSEK reports a ClickFix campaign using a fake Microsoft Teams download site to deliver Odyssey, which steals credentials, browser data, Apple Notes, and crypto-wallet files before exfiltrating them and establishing persistence.
Wiz traced a May 2025 campaign from compromised AWS keys to SES production-mode access and phishing setup. Multi-region API activity and rapid sender configuration provided indicators for detection; the credential theft campaign’s operator remains unattributed.
Wiz reports that malicious Nx packages exposed secrets and private repositories through a three-phase attack. Its analysis found AI-assisted file discovery succeeded in under a quarter of cases, while many leaked credentials remained valid.
Huntress analyzed a previously unseen ransomware variant found across a victim organization’s hosts. Its investigation details deployment through a domain controller’s NETLOGON share, security-process termination, recovery deletion, and file encryption; initial access
An investigation maps TinyLoader infrastructure and details how the loader delivers Redline Stealer and DCRat, persists and spreads through USB drives and network shares, and replaces copied cryptocurrency addresses.
Huntress traced a fake AnyDesk lure through a Cloudflare Turnstile page, Windows File Explorer and an SMB share to an MSI package that collected the victim’s hostname and dropped MetaStealer.
A technical analysis describes an Android malware campaign impersonating Indonesia’s TASPEN pension fund to steal credentials, SMS OTPs, contacts and facial video. The malware uses phishing, encrypted C2 and anti-analysis techniques.
Bitdefender reports an active Facebook malvertising campaign that uses fake TradingView Android ads to deliver a Brokewell-based RAT capable of stealing crypto and credentials, intercepting SMS, and remotely controlling infected devices.
ThreatFabric reports that Android droppers are increasingly used to deliver even basic spyware and SMS stealers, concealing payloads until after installation to evade Google Play Protect’s Pilot Program checks.
