In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2499 articles
A proof of concept showed that CSS-hidden instructions repeated in HTML could steer tested AI summarizers to present ClickFix steps, including a benign test command. The article describes the technique, risks, limitations, and possible defenses.
Wiz analyzes Bedrock’s long- and short-term API keys, their creation and logging, and risks from long-lived credentials. AWS says it added the keys to secrets scanning and quarantined previously exposed keys it found.
Huntress analyzed two Cephalus ransomware incidents involving RDP access through accounts without MFA, likely data exfiltration via MEGA, and DLL sideloading through a legitimate SentinelOne executable. One deployment was stopped by Microsoft Defender.
CloudSek details an APT36-attributed campaign that disguises a malicious Linux .desktop file as a PDF, downloads a Go payload from Google Drive, and uses persistence, anti-analysis checks, and WebSocket C2.
CloudSEK details TA-NATALSTATUS’s use of exposed, unauthenticated Redis servers to install persistent cryptominers, evade detection, and scan for more victims. The report includes indicators, investigation steps, and remediation guidance.
Darktrace describes suspicious SaaS activity across two customer environments, including rare VPS logins, inbox-rule manipulation, email deletion, and phishing-related behavior. The investigation suggests attackers used hijacked sessions to maintain access and conceal
Talos reports that Russian state-sponsored group Static Tundra exploits unpatched Cisco devices, including through CVE-2018-0171, to steal configurations and maintain long-term access. It recommends patching the flaw or disabling Smart Install.
A vendor analysis describes DBatLoader as a Delphi-compiled Windows malware sample with obfuscation, anti-analysis and import-hiding techniques, plus capabilities associated with persistence, surveillance and system manipulation.
Researchers detail a multi-stage phishing campaign targeting finance executives with fake recruiter and Google Drive lures. VBS payloads install NetBird and OpenSSH, create hidden administrator access, and enable RDP; infrastructure and tool overlaps suggest a MuddyW...
Huntress analysts describe attackers staging and exfiltrating data with tools such as WinRAR, RClone, backup utilities and s5cmd, and explain detection challenges, including a Qilin incident involving exposed RDP and disabled Defender protections.
Huntress traced a KawaLocker attack that began with RDP access using a compromised account. Attackers disabled security tools, attempted to enable RDP on other endpoints, and encrypted files; Huntress response prevented further access.
ThreatFabric describes PhantomCard, an Android Trojan distributed through fake card-protection app pages in Brazil. It relays EMV card data and PINs to enable remote payment or ATM fraud, and is reportedly a customized NFU Pay malware-as-a-service product.
Analysis of leaked ERMAC 3.0 source code details an Android banking trojan targeting more than 700 apps, its command-and-control infrastructure, data theft capabilities, and security weaknesses defenders can use to detect and disrupt it.
Huntress details SonicWall VPN intrusions involving credential theft, lateral movement, defense evasion and Akira ransomware. SonicWall says activity correlates with CVE-2024-40766, not a zero-day; Huntress also observed vulnerable-driver abuse.
Darktrace reports observing exploitation of Ivanti EPMM vulnerabilities CVE-2025-4427 and CVE-2025-4428 across customer environments, including OAST-based validation, AWS-hosted payloads, and KrustyLoader delivery.
Hunt.io researchers linked 28 Chinese-, English-, and Japanese-language phishing pages across three clusters, finding shared templates, scripts, hosting patterns, and ZIP/RAR lures themed around government, tax, and financial documents.
A July 2025 SEO-poisoning campaign delivered Bumblebee through trojanized IT-tool installers, enabling attackers to steal credentials, exfiltrate data, and deploy Akira ransomware across enterprise domains.
Wiz describes how flaws in Triton’s Python backend could let an unauthenticated remote attacker access internal shared memory and potentially take over a server. NVIDIA patched the issues in version 25.07.
Huntress describes a ransomware intrusion using a modified script based on a 2021 playbook to disable Microsoft Defender and impair monitoring. Its SOC intervened before file encryption.
Researchers detail APT36 infection chains using Linux .desktop files disguised as PDFs, cron-based persistence, Mythic-based Poseidon malware, and more than 100 phishing domains impersonating Indian government organizations.
Wiz says unauthenticated Base44 registration and OTP endpoints let attackers use public app IDs to bypass SSO and access private apps. Wix fixed the flaw within 24 hours; it reported no evidence of exploitation.
CloudSEK investigated a scam using deepfake influencer videos and social-media ads to lure victims into Telegram investment schemes, where scammers withheld funds and demanded further payments. It identified over 120 ads across 20 Facebook accounts.
Wiz examines TraderTraitor, a North Korean-linked cluster attributed to major crypto thefts, and details its use of social engineering, trojanized software, supply-chain compromises and cloud access to steal digital assets.
CloudSEK found a ClickFix campaign using fake verification pages and ActiveX to silently download and run Epsilon Red. Related lures impersonate Discord, streaming services, and dating sites.
