In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2377 articles
Huntress traced an Amazon-themed ClickFix campaign affecting at least three customers: a fake login and CAPTCHA used finger.exe to launch a multi-stage chain delivering Doina, allegedly Lumma Stealer, and pirated NetSupport. Google removed the ad, but infrastructure was
Symantec researchers used an AI honeypot to capture instructions for an autonomous agent targeting exposed LLMs, plus a separate mining script. The agent was designed to exploit systems, steal data and credentials, and mine cryptocurrency.
Kaspersky says Lazarus’s FlashHole campaign targeted South Korean organizations using a malware chain that included LPEClient and ML-KEM-1024 to secure payload delivery; researchers identified at least three affected companies.
A joint U.S., U.K. and German advisory says SafePay has compromised at least 600 victims since August 2024, using stolen credentials and exploited vulnerabilities to steal data and encrypt systems.
Push and other researchers report growing ClickFix activity, including fake AI-tool installers and malicious chatbot content. Attackers use search ads, compromised sites, deceptive clipboard commands, and conditional delivery to evade defenses.
Acronis researchers analyze The Gentlemen RaaS, detailing its cross-platform ransomware, data-theft extortion, persistence, evasion, encryption and network propagation, plus an EDR killer that abuses vulnerable Safetica and Lenovo drivers.
Wiz CIRT describes GCP intrusions in which attackers phished privileged users, linked attacker-controlled projects to victims’ billing accounts, and drove unauthorized Gemini API charges reaching tens to hundreds of thousands of dollars.
A joint U.S., U.K., and German advisory says SafePay ransomware has affected at least 600 victims. It details credential-based access, vulnerability exploitation, data theft, backup destruction, and encryption, alongside mitigation guidance.
LevelBlue SpiderLabs traced Wazza phishing campaigns active since at least July 2026. The kit uses PDF lures, layered redirects, browser checks and Microsoft device code authentication to seek access to Microsoft 365 accounts.
AhnLab reports a Rust infostealer distributed as pirated software that uses sandbox evasion and process injection, steals data based on C2 instructions, and can download additional malware.
JPCERT/CC traced servers linked to attacks on organizations and web services, finding AI-assisted vulnerability scanning, APK analysis and API testing. A separate server contained web shells and EDR-evasion evidence; it was not directly linked to the attacks.
Check Point Research examines how Kameleo, AdsPower, and MultiLogin use fingerprint spoofing, proxies, and AI automation to support fraud, account takeovers, phishing, and influence operations, and recommends detection measures.
Researchers report that UNC7017 used brief AOMEI Backupper server-tampering windows to deliver CrossRoad and ShinyRoad malware, compromise organizations across multiple sectors, and steal NetNTLMv2 authentication hashes.
A joint advisory from CISA, the FBI and international partners says SafePay ransomware has affected at least 600 victims. It details credential-based intrusions, vulnerability exploitation, data theft, backup destruction and encryption.
Analysis traces a signed Windows installer that waits until a hard-coded date, then uses DLL sideloading to deploy PackClient RAT. Its plugin adds persistence and a signed antivirus-killing driver, which failed to load in three sandbox runs.
Kaspersky examines how warehouse scanners, printers, wireless networks and management systems can expose logistics operations to compromise, potentially enabling inventory manipulation, unauthorized shipments and disruption.
Symantec traced Swallowtail activity against targets in two NATO countries, including a naval shipbuilder. Its investigation details Hookedge delivery, credential theft, a persistent SSH tunnel and an undocumented loader; the final payload was not recovered.
SOCRadar says seven exposed servers revealed AI-assisted operations linked to INC and The Gentlemen, including Phantom source code and 46 staged INC encryptors. Operator-reported exploitation counts are unverified; a screenshot showed encryption in progress.
Sophos researchers detail BRONZE SANDCASTLE’s DLL sideloading, obfuscated in-memory backdoor, C2 behavior, and credential-theft activity across victims in Asia and Africa. They recommend behavioral, endpoint, and memory-based detection.
Lab539 reports an active phone-led fraud campaign using cloned bank support pages to trick customers into installing remote-access tools. The researchers say the campaign has used more than 380 domains and report that two abused signing certificates were revoked.
Hunt.io researchers traced a Russian-speaking operator’s Graylog Log4Shell activity against Ukrainian organizations, documenting execution on at least two hosts and no observed exfiltration from one data-exchange logging cluster. The operator was not attributed to a
On Oct. 19, an attacker using a hijacked OVH contributor account replaced assets in five OVHcloud CLI releases with a secret-stealing build. OVH removed them and issued immutable v0.16.0; whether March GlassWorm-linked activity shared the same actor is unconfirmed.
Rapid7 traced a NetScaler intrusion that chained CVE-2026-88771 and CVE-2026-88779 to gain root execution, maintain access, map internal systems, and exfiltrate configuration data. The investigation provides technical findings and defensive guidance.
OpenSourceMalware says GhostAction attackers used OAuth phishing and a VS Code-triggered stealer in 94 GitHub repositories. The stealer persists on developer machines; researchers recommend revoking access, rotating credentials, and auditing repositories.
