IronChain Ransomware Threatens Businesses with Permanent Data Loss and Costly Downtime

Source: ANY.RUN
(Published: 10/6/2026)
IronChain ransomware combines destructive encryption behavior, SYSTEM-level persistence, and multiple kernel drivers, creating a significant risk of permanent data loss. Read more.

More RMM Tools In the Wild

Source: SANS Internet Storm Center
(Published: 10/6/2026)
SANS Internet Storm Center published technical research examining the activity described in this report. Read more.

Beyond Valid Credentials: How Exposed AWS Keys Are Tested for Amazon Bedrock Access

Source: Datadog Security Labs
(Published: 10/6/2026)
Datadog Security Labs examined tooling used in the wild to validate exposed AWS credentials and determine whether compromised keys provide access to Amazon Bedrock. Read more.

More Shells Than A Seafood Buffet Tracking Citrix Netscaler Exploitation Activities Cve 2026 88771

Source: eSentire
(Published: 10/6/2026)
Zscaler ThreatLabz analyzed in-the-wild exploitation of critical NetScaler remote-code-execution vulnerability CVE-2026-88771. Read more.

Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack

Source: Huntress
(Published: 10/6/2026)
Huntress analysts reconstructed an Akira ransomware intrusion involving RDP access, antivirus disabling, Rclone data exfiltration, tunneling, and ransomware deployment. Read more.

DarkSword/Coruna Open Directory Finding Report

Source: Censys
(Published: 10/7/2026)
Open directories exposed components of the DarkSword/Coruna iOS exploit-and-harvest platform, including active infrastructure and victim data. Read more.

From Guest Complaints to Malware: Blockchain Abuse Targets Hotels

Source: Cofense
(Published: 10/7/2026)
Cofense Intelligence tracked email campaigns targeting the accommodation industry with fake guest complaints and reviews that deliver blockchain-abusing malware. Read more.

Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance

Source: CrowdStrike
(Published: 10/7/2026)
Researchers investigated ARTEX-linked activity and infrastructure associated with targeting and reconnaissance against financial and critical-infrastructure organizations. Read more.

Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs

Source: Huntress
(Published: 10/7/2026)
Huntress observed a phishing campaign abusing legitimate Microsoft Power BI infrastructure to direct victims toward rogue remote-management tooling. Read more.

Canto Incognito Tracking The Poellm Malware

Source: Lumen
(Published: 10/7/2026)
Lumen researchers tracked PoELLM malware infrastructure and the command-and-control mechanisms supporting the campaign. Read more.

Vulcanrat207 A Intrusion Chain Explained

Source: Morphisec
(Published: 10/7/2026)
Morphisec researchers analyzed a multi-stage intrusion chain delivering VulcanRAT and documented the techniques used across execution and persistence. Read more.

Ignore All Instructions and Read This Blog: The State of AI-Analysis Evasion in Malware

Source: Cisco Talos
(Published: 10/8/2026)
Cisco Talos examined how malware authors are attempting to manipulate or evade AI-assisted analysis workflows. Read more.

UAT-11985: AI-Assisted Event Lures Delivering Real-Time Google AitM Phishing

Source: Cisco Talos
(Published: 10/8/2026)
Cisco Talos analyzed UAT-11985 activity using event-themed lures and adversary-in-the-middle phishing against Google accounts. Read more.

Warden Stealer: The Rapid Rise of an Infostealer with an Appetite for AI Agent Data

Source: Gen Digital
(Published: 10/8/2026)
Gen researchers analyzed Warden Stealer, a Rust-based infostealer that targets traditional credential stores as well as data associated with AI agents. Read more.

Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer

Source: Huntress
(Published: 10/8/2026)
Huntress observed exploitation of critical AhsayCBS vulnerabilities to deploy webshells and XMRig cryptocurrency miners. Read more.

How Bluemoon Exploits Chrome Cve 2026 85046 And Cve 2026 87491

Source: Picus Security
(Published: 10/8/2026)
Picus Security examined BlueMoon exploitation of Chrome vulnerabilities CVE-2026-85046 and CVE-2026-87491. Read more.

Matchboil New Tricks Same Old Evil Intentions

Source: ESET Research
(Published: 10/8/2026)
ESET Research documented the evolution of MATCHBOIL, a C# downloader used by Russia-aligned UAC-0099 against organizations in Ukraine. Read more.

Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware

Source: Zscaler ThreatLabz
(Published: 10/8/2026)
Zscaler ThreatLabz uncovered a suspected TraderTraitor campaign using a trojanized Terraform provider to deliver cross-platform malware. Read more.

Analysing a Novel Malicious Redirect and Cloaking Technique

Source: Push Security
(Published: 10/9/2026)
Push Security analyzed a malicious redirect and cloaking technique that abuses search-engine results as part of a malvertising delivery chain. Read more.

Analyzing AI-Themed ClickFix, InstallFix & LLMshare Attacks

Source: Push Security
(Published: 10/9/2026)
Push Security analyzed recent malware-delivery campaigns using AI-themed ClickFix, InstallFix, and LLMshare social-engineering techniques. Read more.

Insomnia RAT: A Dual-Payload Backdoor

Source: Stairwell
(Published: 10/9/2026)
Stairwell analyzed Insomnia RAT, a backdoor that uses a dual-payload design to establish remote access on compromised systems. Read more.

Artex Ai Linked Infrastructure Observed Scanning Uk Cni Discovery And Associated Services

Source: Bridewell
(Published: 10/9/2026)
Researchers investigated ARTEX-linked activity and infrastructure associated with targeting and reconnaissance against financial and critical-infrastructure organizations. Read more.

DNS as C2 in Noir, an AI-Developed Crypto Wallet Drainer

Source: Infoblox Threat Intel
(Published: 10/9/2026)
Infoblox Threat Intel analyzed the Noir wallet drainer, which uses DNS TXT records over DoH to dynamically locate its active backend infrastructure. Read more.

GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire Git Histories

Source: StepSecurity
(Published: 10/9/2026)
StepSecurity observed compromised maintainer accounts pushing malicious GitHub Actions workflows that steal repository secrets and credentials from Git history. Read more.

Azure30 Nodejs Backdoor Trojanized Msi Clickfix

Source: ThreatHunter.ai
(Published: 10/9/2026)
ThreatHunter.ai analyzed a Node.js backdoor delivered through a trojanized MSI and ClickFix-style social engineering. Read more.

Auditing the Auditor: Unmasking Apex Accelerator

Source: Elastic Security Labs
(Published: 10/12/2026)
Elastic Security Labs uncovered a fake Web3 accelerator using malicious npm packages, attacker-controlled AI infrastructure, and cross-platform malware. Read more.

Detecting AtlasRAT C2

Source: Netresec
(Published: 10/12/2026)
Netresec published technical research examining the activity described in this report. Read more.

RSVP to Disaster: How One Click Installs a RAT

Source: Cofense
(Published: 10/13/2026)
Cofense analyzed a phishing campaign in which a single click ultimately installs remote-access malware on the victim system. Read more.

MALFEX Moves Its npm Loader into a Native Windows DLL

Source: SafeDep
(Published: 10/13/2026)
SafeDep analyzed a MALFEX campaign that moved its npm loader into a native Windows DLL to complicate analysis and detection. Read more.

Vibe Coding Vs Code Extension Monitors Developer Activity

Source: Akamai
(Published: 10/13/2026)
Akamai researchers examined a VS Code extension that monitors developer activity in environments using AI-assisted coding workflows. Read more.

Fake WatchGuard VPN Site Steals Credentials

Source: Huntress
(Published: 10/13/2026)
Huntress investigated a fake WatchGuard VPN site that captures VPN credentials before delivering the genuine signed WatchGuard installer. Read more.

A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days

Source: Volexity
(Published: 10/13/2026)
Volexity identified active exploitation of an Ivanti Connect Secure zero-day chain that provides unauthenticated root-level code execution. Read more.

Fake AI Tools Put US Companies at Risk: Inside Counterfeit Claude, ChatGPT, and Copilot

Source: ANY.RUN
(Published: 10/14/2026)
ANY.RUN analyzed counterfeit Claude, ChatGPT, and Copilot tools used to deliver malware to users at U.S. organizations. Read more.

Break the Silence: Kazakhstan-Nexus UAT-6275 Targets CIS Government Organizations

Source: Cisco Talos
(Published: 10/14/2026)
Cisco Talos analyzed Kazakhstan-nexus UAT-6275 activity targeting government organizations across the Commonwealth of Independent States. Read more.

Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant

Source: Unit 42
(Published: 10/14/2026)
Unit 42 investigated PEERSTITCH, a stealthy FortiGate implant observed after exploitation of a FortiManager appliance. Read more.

DragonForce Ransomware Profile: From Affiliate Program to Cybercrime Cartel

Source: Bitsight
(Published: 10/14/2026)
Bitsight profiled DragonForce ransomware activity, infrastructure, and tactics associated with the group. Read more.

From ClickFix to C2: Comparative Analysis of Two Malware Loaders

Source: Forescout
(Published: 10/14/2026)
Forescout compared two malware loaders delivered through ClickFix-style social engineering and traced their paths from initial execution to command and control. Read more.

KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize

Source: Group-IB
(Published: 10/14/2026)
Group-IB analyzed KGB RAT, a Windows remote-access trojan designed for surveillance, credential theft, and persistent control. Read more.

Fake Calendly Meta Careers Pages Steal Facebook And Google Logins

Source: Malwarebytes
(Published: 10/14/2026)
Malwarebytes investigated fake Calendly and Meta careers pages designed to steal Facebook and Google account credentials. Read more.

Disruption Targets Major Chinese-Language Phishing Kits with Japanese Focus

Source: Proofpoint
(Published: 10/14/2026)
Proofpoint detailed disruption of major Chinese-language phishing kits responsible for high-volume campaigns targeting Japanese organizations. Read more.

Sanctioned Still Connected How Aezas Infrastructure Supply Chain Survived

Source: Qurium
(Published: 10/14/2026)
Qurium traced infrastructure relationships showing how sanctioned Aeza-linked hosting resources continued to support malicious operations. Read more.

Iron Man Yamstore Powering A Global Phishing As A Service Ecosystem

Source: Resecurity
(Published: 10/14/2026)
Resecurity examined Iron Man and YAM Store infrastructure supporting a global phishing-as-a-service ecosystem. Read more.

LegionRelay: Ukraine Targeted by Five Previously Unidentified C2 Servers

Source: Team Cymru
(Published: 10/14/2026)
Team Cymru mapped LegionRelay command-and-control servers and related infrastructure associated with activity targeting Ukraine. Read more.

Hirudo: From Fake Updates to Patched Banking Apps

Source: ThreatFabric
(Published: 10/14/2026)
ThreatFabric identified Hirudo, an Android banking RAT that replaces legitimate banking apps with patched copies designed to bypass built-in security checks. Read more.

Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware

Source: Citizen Lab
(Published: 10/15/2026)
Citizen Lab documented AdFection, a technique that delivered zero-click mercenary spyware through targeted advertising. Read more.

ARMORY CASTLE Exploits BeyondTrust

Source: Google Threat Intelligence Group
(Published: 10/15/2026)
Google Threat Intelligence Group investigated ARMORY CASTLE exploitation of BeyondTrust Remote Support and the activity that followed successful compromise. Read more.

Investigating Ephemeral Supply Chain Tampering

Source: Google Threat Intelligence Group
(Published: 10/15/2026)
Google Threat Intelligence Group investigated ephemeral software supply-chain tampering designed to leave minimal evidence after malicious code execution. Read more.

Cooldown or Compromise: The Three-Day Rule for npm and PyPI

Source: Eye Security
(Published: 10/15/2026)
Eye Security examined how dependency cooldown periods for npm and PyPI can reduce exposure to newly published malicious or compromised packages. Read more.

AI-Powered Espionage Campaign Targets Government Linux Infrastructure

Source: Unit 42
(Published: 10/15/2026)
Unit 42 identified an espionage campaign targeting government and state-affiliated Linux infrastructure with payloads containing signs of AI-assisted development. Read more.

ROMULUS: Analysis of a New Multi-Payload ClickFix Delivery Platform

Source: Forescout
(Published: 10/15/2026)
Forescout analyzed ROMULUS, a multi-payload ClickFix delivery platform used to distribute malware through social-engineering chains. Read more.

Silent Ransom Group Leaked Chats: Key Findings by GRIT

Source: GuidePoint Security
(Published: 10/15/2026)
GuidePoint Security analyzed leaked Silent Ransom Group communications for insight into the group’s operations and extortion tradecraft. Read more.

Inside Help TDS: Hotejka, Cloudflare Pages and Predictive Detection

Source: Infoblox Threat Intel
(Published: 10/15/2026)
Infoblox Threat Intel linked the long-running Help TDS operation to Hotejka and examined its use of Cloudflare Pages and related infrastructure. Read more.

How RL Mapped A Midnight Blizzard Linked Campaign From Two Hashes

Source: ReversingLabs
(Published: 10/15/2026)
ReversingLabs showed how two malware hashes were used to map a broader campaign linked to Midnight Blizzard. Read more.

QuartzLine: A Working PDF Viewer with a Backdoor Inside

Source: Expel
(Published: 10/16/2026)
Expel analyzed QuartzLine, a functional Windows PDF viewer containing a hidden backdoor capable of executing commands and installing additional malware. Read more.

ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks

Source: Huntress
(Published: 10/16/2026)
Huntress investigated unauthorized Microsoft 365 access enabled by compromised vendor credentials associated with ConnectWise Cloud Backup and SkyKick. Read more.

PSA: Malware Found in Some Rank Math SEO PRO 3.0.123 Downloads

Source: Wordfence
(Published: 10/16/2026)
Wordfence investigated malicious code introduced through the Rank Math SEO Pro software supply chain. Read more.

CVE-2026-88771: Inside Exploitation of a Critical NetScaler RCE Vulnerability

Source: Zscaler ThreatLabz
(Published: 10/16/2026)
Zscaler ThreatLabz analyzed in-the-wild exploitation of critical NetScaler remote-code-execution vulnerability CVE-2026-88771. Read more.

A Honeypots Tale Deconstructing An Attack On Genai Infrastructure

Source: Sekoia.io
(Published: 10/19/2026)
Sekoia.io deconstructed an attack observed against generative-AI infrastructure through honeypot telemetry. Read more.

Slaiclind: analyzing a campaign combining ClickFix and EtherHiding

Source: Stormshield
(Published: 10/19/2026)
Stormshield researchers analyzed the SLAICLIND campaign and its payload delivery and execution techniques. Read more.

Forged Commits Push a preinstall Dropper into hugo-paper and mevn-cli

Source: SafeDep
(Published: 10/20/2026)
SafeDep found forged commits used to introduce a preinstall dropper into the hugo-paper and mevn-cli open-source packages. Read more.

Swallowtail: Russian Espionage Group Targets Defense Firms in Two NATO Countries

Source: Security.com
(Published: 10/20/2026)
Security.com researchers analyzed Swallowtail activity targeting organizations connected to Russia and NATO. Read more.

BRONZE SANDCASTLE Deploys Modified Meterpreter Shells

Source: Sophos
(Published: 10/20/2026)
Sophos researchers investigated BRONZE SANDCASTLE incidents characterized by DLL sideloading and modified Meterpreter payloads. Read more.

From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage

Source: Wiz
(Published: 10/20/2026)
Wiz incident responders investigated campaigns that phish privileged cloud users and hijack victim billing accounts to fund unauthorized LLM usage. Read more.

CodeAIAssistant: The VS Code MCP Install Prompt That Hides Its Payload

Source: Yeeth Security
(Published: 10/20/2026)
Yeeth Security examined a malicious CodeAIAssistant installation flow involving MCP-related prompts and developer tooling. Read more.

ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2

Source: Cisco Talos Blog
(September 8, 2026)

Cisco Talos has recently observed a criminal campaign that leveraged an interesting twist on what we refer to as “legitimate service abuse.” In this monthslong… Read more.

HVNC Backdoor Targets LATAM Organizations with Fake Tax Lures

Source: ANY.RUN’s Cybersecurity Blog
(September 8, 2026)

Fake tax documents are being used to target organizations across LATAM, delivering a custom HVNC backdoor built for stealthy, persistent access. Read more.

MacSync: The Evasive macOS Stealer Exploiting ClickFix Lures

Source: Seqrite Labs
(September 8, 2026)

MacSync Stealer is a family of macOS information stealers and remote-access stagers designed to evade detection and sold commercially under a malware-as-a-service (MaaS) model. Read more.

Peeling Back the Layers: Inside Vidar – From Virtualized Code to Stolen Credentials

Source: Splunk
(September 8, 2026)

Vidar has earned a reputation as one of the most persistent information stealers in today’s threat landscape. Read more.

The Job Offer Has Claws: Mirage Kitten Deploys NodeRabbit and PollCat

Source: PolySwarm
(September 8, 2026)

Kaspersky discovered the activity while investigating Mirage Kitten infections and identified an initial NodeRabbit sample on a system in Afghanistan. Read more.

[Op Report] Hands-on-Keyboard Activity from the DPRK “PolinRider” Supply Chain Attack — Deception.Pro Blog

Source: Deception.Pro Blog
(September 9, 2026)

For one week at the end of August 2026, a Fortune 500 enterprise CTI team stood up a decoy corporate workstation and waited. Read more.

Active exploitation of Cisco Secure Firewall Management Center vulnerabilities

Source: Cisco Talos Blog
(September 9, 2026)

Cisco Talos is actively tracking the exploitation of two vulnerabilities in Cisco’s Secure Firewall Management Center (FMC) Software. Read more.

ClearFake 2026

Source: Malware Analysis
(September 9, 2026)

Here I will walk through finding recent ClearFake infected sites and discuss how to extract and follow the code that ultimately copies a malicious command… Read more.

Death by a Thousand PaperCuts: AI-Driven Exploitation at Scale

Source: Blackpoint Cyber
(September 9, 2026)

The Adversary Pursuit Group (APG) uncovered a PaperCut exploitation campaign while investigating malicious activity involving an internet facing PaperCut server. Read more.

Deep-Live-Cam Supply Chain Attack: Technical Analysis

Source: SafeDep – Real-time Open Source Software Supply Chain Security
(September 9, 2026)

On September 8, 2026, an attacker added a malicious source dependency to Deep-Live-Cam, a Python face swapping application with 96,600 GitHub stars. Read more.

Grand Theft Auto VI hype leads to malware | Huntress

Source: Huntress
(September 9, 2026)

There’s still three months until the release of Grand Theft Auto VI (GTA6), but the internet has already reached a fever pitch thanks to a… Read more.

KATARU: IoT Malware Adopts Public LPE Exploits

Source: https://www.nozominetworks.com/
(September 9, 2026)

KATARU is an IoT malware sample observed in a recent honeypot compromise through Telnet credential brute forcing. Read more.

Koktevrat – wieloetapowy Android RAT dystrybuowany pod przykrywk? aplikacji MandatGO

Source: CERT Orange
(September 9, 2026)

Nieistniej?ca aplikacja rz?dowa, reklama na Facebooku i obietnica prostego sposobu na op?acenie mandatu. Read more.

Malicious Chrome and Firefox Extensions Steal Crypto Traders’ Session and Wallet Data

Source: Socket
(September 9, 2026)

Malicious Chrome and Firefox extensions target Axiom Trade and Padre users, stealing session tokens and wallet data. Read more.

Mantax Otax: Indonesian Mobile Ransomware with Spyware Integration

Source: Zimperium, Inc.
(September 9, 2026)

The zLabs research team has discovered a sophisticated and highly aggressive mobile malware strain linked to Indonesian threat actors, that marks a dangerous tactical evolution… Read more.

Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows

Source: Volexity
(September 9, 2026)

On September 1, 2026, Volexity’s Network Security Monitoring (NSM) service detected a spear-phishing campaign from a Chinese threat actor it tracks as UTA0560 targeting customers… Read more.

Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days

Source: Proofpoint
(September 9, 2026)

Beginning in late August and continuing into September 2026, Proofpoint identified multiple espionage-motivated threat actors rapidly adopting the BlueMoon exploit kit in targeted spearphishing campaigns. Read more.

Passkey-themed social engineering leads to identity and cloud compromise 

Source: Microsoft Security Blog
(September 9, 2026)

Microsoft Security Research is tracking active cloud-based intrusions spanning multiple accounts in which unusual sign-ins were followed by threat actor-added authentication methods, high-volume Microsoft Graph… Read more.

Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence | Huntress

Source: Huntress
(September 9, 2026)

The Huntress Security Operations Center (SOC) recently came across two interesting variants of the same attack involving a browser-in-the-browser (BiTB) phishing technique. Read more.

ShieldCrash: Testing the Claimed Microsoft Defender Zero-Day

Source: Cyderes.com
(September 9, 2026)

Nightmare-Eclipse is a single researcher operating under a rotating set of handles. Read more.

Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure

Source: Unit 42
(September 9, 2026)

A recent Unit 42 investigation into seemingly low-priority enterprise infections demonstrates how the most effective camouflage in cybercrime is not necessarily in the use of… Read more.

Vwork: Weaponized Open-source Software as an Addon for Gigabud

Source: Group-IB
(September 9, 2026)

How the Gigabud Android banking trojan abuses Shelter, an open-source app cloner, and what that means for banks, users, and defenders. Read more.  

Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329 | Wiz Blog

Source: wiz.io
(September 10, 2026)

Wiz Research has identified active, in-the-wild exploitation of three critical and high-severity vulnerabilities affecting JFrog Artifactory: CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329. Read more.

Casbaneiro: A Banking Trojan with Distributed Data-Receiving Servers | FortiGuard Labs

Source: Fortinet Blog
(September 10, 2026)

FortiGuard Labs examines how a new Casbaneiro campaign targeting Latin America uses geofencing and distributed servers to evade analysis and detection… Read more.

EquationGroup’s MiniLoader

Source: Exatrack
(September 10, 2026)

In this article, we examine a relatively small, concise, and extremely clean malicious code that we consider very likely linked to an entity belonging to… Read more.

From a Pension-Themed Spear-Phishing Email to a GitHub-Backed Implant: Investigating a SideWinder Connection — Malware INFO Blog

Source: Malwareinfo
(September 10, 2026)

An evidence-led investigation traces a Myanmar pension lure from an encrypted Word attachment to an embedded implant and evaluates its overlap with regional SideWinder reporting. Read more.

Gray Rabbits and the Tale of a One-Click Backdoor

Source: Gen Digital Inc.
(September 10, 2026)

Gen Threat Labs discovered a critical remote code execution vulnerability (CVE-2026-51990) in Sogou Input Method, one of the most widely used Chinese-language input method editors… Read more.

Inside Two Multi-Stage Attack Chains Hiding Behind Job Offers

Source: Cyderes.com
(September 10, 2026)

Job-themed social engineering has become one of the most productive initial access routes in criminal operations, and it is worth being precise about why. Read more.

Malware Melofee: New Versions of Linux Implant

Source: Stormshield
(September 10, 2026)

Melofee came back, and it just evolved! Read more.

Protecting organizations from AI-assisted executive impersonation and invoice fraud | Microsoft Security Blog

Source: Microsoft Security Blog
(September 10, 2026)

Threat actors are increasingly improving their tactics to make suspicious emails look like legitimate email notifications to potential victims, deploying techniques that impersonate internally sent… Read more.

Remus: A New Infostealer Hunting Wallets, Passwords, and AI Credentials

Source: SpyCloud
(September 10, 2026)

Remus is one of several infostealer threats SpyCloud Labs is tracking as criminals adapt their tooling. Read more.

SloppyRAT: A New Tool For Ransomware Attacks | ThreatLabz

Source: Zscaler
(September 10, 2026)

In June 2026, Zscaler ThreatLabz identified a new malware family, tracked as SloppyRAT, that is likely leveraged by a ransomware-related threat actor. Read more.

Analysis of the Liquid Network Cache Key Collision Vulnerability: Nearly 4,000 L-BTC Minted Out of Thin Air

Source: SlowMist
(September 11, 2026)

At 13:52:10 UTC on September 6, two transactions with the same structure appeared in Liquid block 4,050,335. Read more.

BraZetsu: AI-Enhanced Reconnaissance Fuels Exilware’s Access Marketplace

Source: PolySwarm
(September 11, 2026)

Group-IB has identified BraZetsu, a Python-based Windows malware framework attributed with high confidence to the Brazilian threat actor Exilware. Read more.

Machine speed, hold the AI: Hand-rolled marimo CVE-2026-39987 exploit 

Source: Sysdig
(September 11, 2026)

AI is lowering the barrier to entry for attackers; that much is settled. Read more.

Panzer: New Cross-Platform RaaS Claims Global Victims in Its First Month Panzer: New Cross-Platform RaaS Claims Global Victims in Its First Month

Source: Hivepro
(September 11, 2026)

A newly emerged Ransomware-as-a-Service operation listed 20+ victims across 10+ countries in its first month, with an ESXi build that can encrypt an entire hypervisor… Read more.

Twitch Browser Extension Exposes 30,000 Users’ OAuth Tokens to Russian Bot Service

Source: Socket
(September 11, 2026)

A Twitch browser extension on Chrome and Firefox forwards users’ live OAuth session tokens through proxies controlled by a Russian bot service. Read more. 

“Eye” Spy: Cyclops Blink Returns With Extended Capabilities

Source: Sophos
(September 11, 2026)

In August 2026, Counter Threat Unit™ researchers analyzed a malicious 64-bit Linux executable named timezone_check that was discovered on multiple compromised Cisco Firewall Management Center… Read more.

Behind the CAPTCHA: ClickFix, WallStealer and a Hidden Miner

Source: Ctrl-Alt-Intel
(September 12, 2026)

Static analysis of a ClickFix collection reveals WallStealer payloads, Steam-based C2 discovery and an XMRig mining chain sharing the delivery IP. Read more.

Fake Tax-Themed Phishing Campaign Delivers Malware – CYFIRMA

Source: CYFIRMA
(September 12, 2026)

CYFIRMA has identified a multi-domain malware distribution campaign abusing the Indian Income Tax Department theme to deliver a malicious payload. Read more.

Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit

Source: Acronis
(September 13, 2026)

Acronis Threat Research Unit (TRU) uncovered a multinational campaign in which a Chinese-speaking threat actor, tracked as Red Heron, rapidly weaponized CVE-2026-60004 to compromise internet-facing… Read more.

Attackers Actively Exploiting Critical Vulnerability in WooCommerce Wholesale Lead Capture Plugin

Source: Wordfence
(September 14, 2026)

On February 20th, 2026, a critical Unauthenticated Arbitrary File Upload vulnerability was publicly disclosed in WooCommerce Wholesale Lead Capture, a premium WordPress plugin… Read more.

HBO Max ads on a compromised Reddit account exposed a massive PasteSwitch ClickFix operation

Source: InfoStealers
(September 14, 2026)

Through joint research conducted by Hudson Rock and Kirk from ADAMnetworks (with additional thanks to Tuxxin from Whack.sh and Emiliano from The Matrix Project), we… Read more.

Malicious browser extension: inside KREMLIN banking malware

Source: Elastic
(September 14, 2026)

Elastic Security Labs tracked this malicious browser extension across seven campaigns and 15 months, through Brazilian bank lures and the Ethereum smart contracts that hold… Read more. 

GhostCode: Dissecting a Novel Device Code Phishing Kit

Source: eSentire
(September 15, 2026)

eSentire’s TRU uncovers GhostCode, a novel device code phishing kit using AES-256-GCM encryption and triple-layer HTML obfuscation to bypass MFA and hijack Microsoft 365 accounts… Read more.

Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware 

Source: Huntress
(September 15, 2026)

Many Black Hat and DEFCON attendees come home to an inbox full of DMs. Read more.

Illegal Gambling Sites Reveal Three Types of Cybercrime

Source: Infoblox Blog
(September 15, 2026)

Many security teams ignore online gambling and casino domains, especially Chinese-language websites. Read more.

Mythic C2 Activity at Internet Scale – Censys

Source: Censys
(September 15, 2026)

Mythic was created as a successor to an earlier macOS-focused project (Apfell). Read more.

New packages identified in GemStuffer ‘OpenAI Swarm’ malicious RubyGems campaign

Source: JFrog Security Research
(September 15, 2026)

JFrog Security Research is actively monitoring the recent GemStuffer incident, and using our extensive Catalog of RubyGems artifacts, managed to identify 3,022 campaign-associated RubyGems packages… Read more.

PAPERMILL: Tracking an Emerging China-Nexus Malware Factory | JUMPSEC

Source: JUMPSEC
(September 15, 2026)

JUMPSEC’s Detection and Response Team (DART) recently escalated a phishing email after it reached a client’s inbox despite passing standard email authentication checks. Read more.

PhantomRaven: LLM-generated Information Stealer for Bug Bounty Hunting

Source: CrowdStrike.com
(September 15, 2026)

CrowdStrike identified a financially motivated threat actor who works as a bug bounty hunter and who developed and distributed the JavaScript-based information stealer PhantomRaven. Read more.

Proliferation of Coruna and DarkSword

Source: iVerify
(September 15, 2026)

Explore how Coruna and DarkSword iOS exploit kits are evolving, proliferating, and being combined to expand mobile attack capabilities in the wild. Read more.

Silent Push Tracks a Mass Phishing Operation Through Fast Flux

Source: Silent Push
(September 15, 2026)

While the “fast flux” technique of rapidly rotating a domain’s DNS records across many IP addresses and networks to avoid detection is not new, it… Read more.

The banana stand: brokering and managing infections across Asia using MQTT

Source: Lumen
(September 15, 2026)

Black Lotus Labs®, the threat research division at Lumen, uncovered BambooToken, an emerging malware family using the Message Queueing and Telemetry Transport (MQTT) to quietly… Read more.

Brevo supply chain attack hits 100k+ sites with WordPress backdoors and Clickfix malware

Source: Sansec
(September 16, 2026)

The recent Brevo security incident is much larger than reported. Read more.

Discernment Deleted: Inside the Operation Server of BlackHatSect0r && DXQRTXX

Source: SOCRadar
(September 16, 2026)

An operation server belonging to the crew that brands itself BlackHatSect0r && DXQRTXX was left open to the internet. Read more.

Hunting Feral Wolf: New Tools and Techniques

Source: BI.ZONE
(September 16, 2026)

The threat actor uses backdoors that masquerade C2 communications as legitimate MQTT and Matrix traffic, impeding detection and extending dwell time. Read more.

NightEagle APT targets Russian organizations

Source: Securelist
(September 16, 2026)

Over the past year, our Global Emergency Response Team (GERT) has investigated several incidents involving the NightEagle group (also tracked as APT-Q-95) . Read more.

Operation RapidRust: New APT36 Malware Tools 

Source: Zscaler
(September 16, 2026)

In August 2026, Zscaler ThreatLabz observed new activity by the Pakistan-nexus threat actor APT36 in a campaign we’re tracking as Operation RapidRust . Read more.

Private HTS programs that spread ransomware – ASEC

Source: ASEC
(September 16, 2026)

AhnLab SEcurity intelligence Center (ASEC) recently identified a case in which ransomware was distributed through a private home trading system (HTS). Read more.

RatHat: AI-Powered Mobile Threat is Here for Your Credentials & Bank Accounts

Source: Zimperium, Inc.
(September 16, 2026)

The zLabs team has uncovered RatHat , a novel Android malware strain linked to threat actors that appear to be operating in China. Read more.

When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts

Source: Cloudflare Blog
(September 16, 2026)

A modern storefront can look perfectly healthy while malicious JavaScript works underneath: siphoning affiliate revenue, hijacking searches and clicks, tampering with analytics, or asking a… Read more.

Beware the SparroWock: The backdoor that bites, the commands that catch

Source: Welivesecurity
(September 17, 2026)

ESET researchers document SparroWocky, the new flagship backdoor of the FamousSparrow APT group Read more.

Chatbot Conundrum: Phishing Attempts of OpenAI’s ChatGPT

Source: Cofense
(September 17, 2026)

As generative AI tools like OpenAI’s ChatGPT become increasingly common, their large user bases create new opportunities for threat actors. Read more.

EtherHiding Exposed: Inside a Blockchain-powered Malware Campaign Hiding in Plain Sight

Source: GuidePoint Security
(September 17, 2026)

This is our deep dive into how we tracked cybercriminals using cryptocurrency infrastructure to build a bulletproof command-and-control network and how we unraveled… Read more.

HEAVYGRAM: A Telegram-based Surveillance Backdoor Linked to Handala Hack

Source: Group-IB
(September 17, 2026)

Group-IB Threat Intelligence analyzes HEAVYGRAM, a Telegram-based Windows backdoor attributed with moderate confidence to the Iran-linked threat actor Handala Hack. Read more.

How a Malware-as-a-Service Platform Used GitHub as a Distribution Channel

Source: LastPass
(September 17, 2026)

On August 13, 2026, the LastPass TIME Team identified a fraudulent GitHub organization impersonating LastPass Authenticator which redirected visitors to attacker-controlled infrastructure… Read more.

LausivLoader analysis, or how to pass data between malware stages

Source: SANS Internet Storm Center
(September 17, 2026)

At the end of August, a malspam message was caught in the quarantine of a mail gateway operated by one of my customers. Read more.

MovieReaper: Trojan attack via movie torrents, including “The Odyssey”

Source: Securelist
(September 17, 2026)

Torrent trackers have long been abused for distributing malicious software, disguised as popular films, games, and other content. Read more.

PolinRider Spreads Through Compromised GitHub Accounts and Packagist

Source: Socket
(September 17, 2026)

Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads. Read more.

Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM | Huntress

Source: Huntress
(September 17, 2026)

Huntress analysts recently observed two incidents where a newer ransomware variant, Settra, was deployed. Read more.

SideCopy Threat Intel: MSHTA-driven Execution and RAT Deployment

Source: Trellix
(September 17, 2026)

The modern cyber warfare landscape has evolved significantly as threat actors pivot toward simple yet highly effective and evasive malware. Read more.

The Alert Gap: Hunting an Undetected Device Code Phishing Compromise

Source: CyberProof
(September 17, 2026)

Device code phishing bypasses conventional controls because, technically, it is legitimate authentication. Read more.

Threat Snapshot: LabubaRAT

Source: Blackpoint Cyber
(September 17, 2026)

LabubaRAT is a custom, unsigned 64-bit Rust-based remote access trojan (RAT) identified by the Blackpoint Adversary Pursuit Group (APG), designed to masquerade as legitimate NVIDIA… Read more.

WeaselBiscuit Strips BeaverTail and OtterCookie Down to Essentials

Source: OpenSourceMalware
(September 17, 2026)

WeaselBiscuit is a lean new infostealer hiding in npm that we suspect was created by DPRK Read more.

ChainScript: Tracing a Node.js RAT Through the Blockchain

Source: Blackpoint Cyber
(September 18, 2026)

Blackpoint’s Adversary Pursuit Group (APG) identified and analyzed a previously unnamed Node.js remote access trojan, now being tracked as ChainScript . Read more.

From Registry-Stored PowerShell to In-Memory Cryptocurrency Mining: A Multi-Stage Infection Chain – K7 Labs

Source: K7 Labs
(September 18, 2026)

We had an opportunity to analyse a system with frequent detection-alerts over powershell execution. Read more.

Why Does an npm Math Library Need an Encrypted Loader?

Source: SafeDep – Real-time Open Source Software Supply Chain Security
(September 18, 2026)

We found a loader for encrypted code inside [email protected] , an npm mathematics library. Read more.

Threat Intelligence | Analysis of FomoPeek App Store Poisoning and iOS Kernel Exploitation

Source: SlowMist
(September 20, 2026)

Recently, the SlowMist security team received multiple reports of user assets being stolen. Read more.

Dark Caracal Reloaded: New Malware, Same Hunting Grounds

Source: Arctic Wolf Labs
(Published: 8/26/2026)
During a targeted intrusion investigation, Arctic Wolf uncovered GoCaracal, a previously undocumented, modular framework written in Go. Read more.

Built to Blend: Miraak’s Modular Post Exploitation Framework

Source: Blackpoint Cyber
(Published: 8/26/2026)
Blackpoint’s Adversary Pursuit Group identified Miraak, a previously undocumented post exploitation framework, through proactive threat hunting. Read more.

Cambodia-Focused Cluster Uses Multi-Stage Infection Chain With Localized Lures

Source: Acronis
(Published: 8/26/2026)
Acronis’ Threat Research Unit identified a recent campaign focused on Cambodia. Read more.

‘The Gentlemen’ Profile: Why This Ransomware Group Wants In Before It Locks You Out

Source: Bitsight
(Published: 8/26/2026)
The Gentlemen is a financially motivated ransomware group that combines data theft with encryption to increase pressure on victims. Read more.

ClickFix via Cloudflare Zaraz and the BW Panel

Source: DERP
(Published: 8/26/2026)
A malicious JavaScript action served through Cloudflare Zaraz on edgeupstudio[.]com loaded a BW Panel bootstrap used by ErrTraffic ClickFix campaigns. Read more.

Tortoiseshell: New Toolset and Operational Infrastructure Exposed

Source: Group-IB
(Published: 8/26/2026)
Group-IB Threat Intelligence began investigating Tortoiseshell activity following public reporting by Kaspersky. Read more.

The Infrastructure Quartermaster: Inside a China-Nexus State Enablement Model

Source: Lumen Black Lotus Labs
(Published: 8/26/2026)
When advanced threat actors want to stay hidden, the infrastructure they use can matter as much as the tools for gaining access. Read more.

Beware of Fake Indeed Interview Apps Used to Install Spyware

Source: Malwarebytes
(Published: 8/26/2026)
From several independent reports, we’ve seen evidence of scammers using fake Android “interview” apps to target job seekers on the Indeed platform. Read more.

ModeloRAT Malware: How the CrashFix Campaign Delivers a Python RAT

Source: Picus Security
(Published: 8/26/2026)
ModeloRAT is a Python-based Windows Remote Access Trojan first observed in January 2026, delivered only to domain-joined hosts in enterprise environments. Read more.

Inhospitable: Tracking Russian Cyber Espionage Infrastructure

Source: Validin
(Published: 8/26/2026)
On August 20, 2026, the Google Threat Intelligence Group published research on several Russian cyber espionage threat clusters. Read more.

Open Directory Exposes Moobot Source Code and Activity

Source: Censys
(Published: 8/27/2026)
An open web directory, exposed on 30 July 2026, held the source code for Moobot, a variant of the Mirai DDoS malware. Read more.

Caught in 4K: The Aurora Files

Source: CloudSEK
(Published: 8/27/2026)
An exposed open directory revealed months of activity belonging to a Russian-speaking Aurora ransomware affiliate, active against more than twenty organisations. Read more.

The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms

Source: Huntress
(Published: 8/27/2026)
As more people use AI models, threat actors are abusing trusted AI platforms in a variety of ways to trick users into downloading malware. Read more.

Carry-On Compromise: TA4922 Packs PackClient

Source: Proofpoint
(Published: 8/27/2026)
Proofpoint researchers recently discovered a RAT framework we named PackClient. Read more.

Inside SHADOW-WATER-084: A Steganographic Loader-as-a-Service Delivering Remcos, LXBASE, and More

Source: TrendAI Research
(Published: 8/27/2026)
TrendAI Research tracked three campaigns that ship completely different decoy applications and unrelated payloads, all riding one shared toolkit. Read more.

Stolen Creds and Stinging Loaders: An Initial Access Campaign via SEO Poisoning

Source: WithSecure
(Published: 8/27/2026)
WithSecure is tracking an ongoing campaign that leverages SEO poisoning with the goal of gaining initial access into victim environments. Read more.

Inside 90 Days of Attacks on AI Infrastructure

Source: Wiz
(Published: 8/27/2026)
Wiz Threat Research operates honeypots across AI and ML services including LiteLLM, Flowise, LangChain, Langflow, ChromaDB, Ollama, and others. Read more.

The Video That Plays You: Fake MP4 File Carries Malicious Payload

Source: Censys
(Published: 8/28/2026)
On 22 August 2026, Censys ARC observed a Cloudflare-fronted host serving raw PowerShell as text/html over port 80. Read more.

The StealC Info-Stealing Chain Behind the Qwen Impersonation Repository

Source: SlowMist
(Published: 8/28/2026)
When downloading an open-source large model, you usually worry about whether it can run properly and whether the weights are authentic. Read more.

Popular Code Generator for TanStack Query Hit by Supply Chain Worm

Source: Aikido Security
(Published: 8/28/2026)
A supply chain worm was found hiding in @7nohe/openapi-react-query-codegen, a popular code generator for TanStack Query, stealing credentials and spreading itself. Read more.

Mini Shai-Hulud Worm Hits openapi-react-query-codegen, Spreads Across npm, RubyGems, and PyPI

Source: Endor Labs
(Published: 8/28/2026)
A compromised release of @7nohe/openapi-react-query-codegen runs a dropper on install through three separate triggers, then harvests cloud credentials and republishes itself. Read more.

TerminalFix Campaign Deploys Reverse Tunnel Through Multistage Intrusion

Source: Microsoft Security
(Published: 8/28/2026)
Microsoft Threat Intelligence has observed a TerminalFix campaign, a variant of ClickFix, targeting organizations across multiple industries. Read more.

Mini Shai-Hulud Strikes Again: openapi-react-query-codegen

Source: SafeDep
(Published: 8/29/2026)
On August 28, 2026, an attacker published 10 malicious versions of @7nohe/openapi-react-query-codegen to npm. Read more.

Reverse Engineering the Auto-Color Linux Backdoor

Source: Zyad Waleed Elzyat
(Published: 8/30/2026)
Static and dynamic analysis of Auto-Color’s execution flow, C2 communication, and LD_PRELOAD rootkit. Read more.

Fire Ant Evolves: From Hypervisors to Trusted Infrastructure

Source: Sygnia
(Published: 8/30/2026)
Fire Ant, first reported in 2025, remained active in 2026 and expanded its operations beyond hypervisors into trusted infrastructure. Read more.

So Your CFO’s Phone Has Been Pwned: A DFIR Journey

Source: Censys
(Published: 8/31/2026)
Your CFO’s phone has malware on it. Read more.

Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode

Source: Check Point Research
(Published: 8/31/2026)
JSCeal is a stealer delivered as compiled V8 bytecode and executed by a bundled Node.js runtime, targeting cryptocurrency applications. Read more.

ValleyRAT Masquerading as Adware

Source: Kaspersky Securelist
(Published: 8/31/2026)
Attackers typically try to pass off malware as legitimate applications or as potentially unwanted programs that users deliberately search for and download. Read more.

Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams

Source: Palo Alto Networks Unit 42
(Published: 8/31/2026)
Between January and April 2026, we uncovered a coordinated social engineering operation that leveraged external Microsoft Teams accounts to masquerade as IT help desk personnel. Read more.

Anatomy of BraZetsu: How Cybercriminals Fuel the Underground Ecosystem

Source: Group-IB
(Published: 8/31/2026)
The Group-IB Threat Intelligence team has identified BraZetsu, a sophisticated Python-based Windows malware framework. Read more.

Daisy-Chaining Trust: Investigating Faronics Deploy Abuse

Source: Huntress
(Published: 8/31/2026)
Huntress has identified a surge in phishing campaigns that abuse Faronics Deploy, with more than 457 endpoints encountering Faronics-related lures. Read more.

Guildma (Astaroth) Malware Infection From Brazilian Portuguese Email

Source: SANS Internet Storm Center
(Published: 9/1/2026)
On Monday 2026-08-31, I used a link from a malicious Brazilian Portuguese email to infect a Windows host in my lab. Read more.

A Malicious npm Package Hidden Three Dependencies Deep: The ulid-xyz Delivery Chain

Source: SafeDep
(Published: 9/1/2026)
SafeDep malicious package analysis flagged ulid-xyz on npm in June 2026. Read more.

Dual-RMM Phishing and PowerShell RAT Campaign Hits SLTTs

Source: Center for Internet Security
(Published: 9/1/2026)
The CIS Cyber Threat Intelligence team identified an active phishing campaign that is opportunistically targeting multiple U.S. SLTT government networks. Read more.

Peer Pressure: Inside the Sality Botnet Disruption Operation

Source: CrowdStrike
(Published: 9/1/2026)
On August 31, 2026, CrowdStrike’s Counter Adversary Operations team executed a coordinated disruption of the Sality peer-to-peer botnet. Read more.

Counterfeit Installers Lead to System Compromise in Deceptive Software Download Campaign

Source: Microsoft Security
(Published: 9/1/2026)
Microsoft Defender Experts is tracking an active malware campaign that uses counterfeit software-download websites to impersonate trusted vendors and distribute malicious installers. Read more.

Ungentlemanly Behavior: Insights Into a Ransomware Operation

Source: Sophos
(Published: 9/1/2026)
Counter Threat Unit researchers identified a consistent post-exploitation playbook used in The Gentlemen ransomware-as-a-service scheme. Read more.

Gaming the System: How a Chinese-Speaking Actor Turned Brazilian Government Sites Into an SEO Weapon

Source: Check Point Research
(Published: 9/2/2026)
Since mid-2025, Check Point Research has tracked a sustained campaign against Brazilian organizations. Read more.

REVSTEALER Ramps Up: Analysis of an Up-and-Coming Infostealer

Source: Elastic Security Labs
(Published: 9/2/2026)
Elastic Security Labs is tracking an emerging infostealer, REVSTEALER, under REF2859. Read more.

Impersonating IT Support: Threat Actors Turn Remote Session Into Enterprise-Wide Access

Source: Microsoft Security
(Published: 9/2/2026)
Microsoft Threat Intelligence observed a human-operated intrusion campaign that abuses Microsoft Teams external collaboration to impersonate IT support. Read more.

Python NodeStealer: AI-Assisted to Full Spyware

Source: Netskope Threat Labs
(Published: 9/2/2026)
Since 2023, Netskope Threat Labs has been tracking the Python-based NodeStealer, an infostealer targeting sensitive browser data and Facebook accounts. Read more.

Detection and Removal of the Syslogk Rootkit in a Linux Environment

Source: AhnLab ASEC
(Published: 9/3/2026)
The AhnLab SEcurity intelligence Center continuously monitors various threats targeting Linux environments. Read more.

Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America

Source: Palo Alto Networks Unit 42
(Published: 9/3/2026)
We have analyzed two ongoing, multi-stage network intrusion and data-exfiltration campaigns targeting organizations in Latin America. Read more.

Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity

Source: Huntress
(Published: 9/3/2026)
Recently, Huntress observed a strange pattern across unrelated endpoints within several different organizations that we protect. Read more.

Attackers Actively Exploiting Critical Vulnerability in Super Forms Plugin

Source: Wordfence
(Published: 9/3/2026)
On July 9th, 2026, we publicly disclosed a critical Unauthenticated Arbitrary File Upload vulnerability in Super Forms. Read more.

ASCII Smuggling Crosses Over From AI Prompt Injection to Phishing Evasion

Source: Microsoft Security
(Published: 9/3/2026)
Microsoft researchers observed a high-volume phishing campaign using invisible Unicode tag characters, a technique popularized in AI prompt injection research as ASCII Smuggling. Read more.

Contagious Interview Steps Outside the Developer Workflow

Source: Jamf Threat Labs
(Published: 9/3/2026)
Jamf Threat Labs identified a cluster of macOS disk images and installer packages impersonating known Mac applications. Read more.

Analyzing a Go-Based IoT Self-Propagating DDoS Botnet

Source: Akamai
(Published: 9/3/2026)
This Go-based Internet of Things botnet combines an independently operating scanner with a command and control client. Read more.

Angry Birds: Toy Ghouls’ New Toys

Source: Kaspersky Securelist
(Published: 9/4/2026)
We continue tracking the activity of Toy Ghouls, a financially motivated group that has been targeting Russian organizations since 2025. Read more.

Critical Vulnerabilities in MikroTik RouterOS Are Being Actively Exploited

Source: CERT Polska
(Published: 9/5/2026)
The CERT Polska team has identified and coordinated the disclosure of six vulnerabilities in MikroTik RouterOS. Read more.

StyleSmuggler: Magento and Adobe Commerce 0-Day RCE Under Active Attack

Source: Sansec
(Published: 9/5/2026)
Sansec discovered StyleSmuggler, a Magento and Adobe Commerce zero-day that gives unauthenticated attackers remote code execution. Read more.

Chinese Darcula Phishing Kit Harvesting Taiwanese Credit Card Data

Source: TeamT5
(Published: 9/7/2026)
In May, we intercepted a phishing campaign harvesting Taiwanese credit card data. Read more.

Shai-Hulud Rises From the Dead After 111 Days

Source: Aikido Security
(Published: 9/7/2026)
Do you remember the Shai-Hulud attack that hit @AntV on May 19th, 2026? Read more.

Beyond Lazarus: Organization of DPRK Cyber Capabilities

Source: Sekoia
(Published: 9/7/2026)
The Democratic People’s Republic of Korea has established itself as one of the more prominent state actors in cyberspace. Read more.

ClearFake WebDAV Infection Chain Delivers Amatera Stealer, ZigCryptoStealer, and NetSupport Manager

Source: Cisco Talos
(Published: 9/8/2026)
In April 2026, Cisco Talos identified an unusual WebDAV DLL execution in endpoint telemetry from a Ukrainian government organization. Read more.

ClickFix Moves Into the Browser: Cryptocurrency Theft With Google-Hosted C2

Source: Cisco Talos
(Published: 9/8/2026)
Cisco Talos has recently observed a criminal campaign that leveraged an interesting twist on what we refer to as legitimate service abuse. Read more.

CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT

Source: SOCRadar
(Published: 9/8/2026)
One of the most common entry points for attackers is the exploitation of public-facing edge devices such as VPNs, routers, and firewalls. Read more.

MacSync: The Evasive macOS Stealer Exploiting ClickFix Lures

Source: Seqrite
(Published: 9/8/2026)
MacSync Stealer is a family of macOS information stealers and remote-access stagers designed to evade detection and sold commercially under a malware-as-a-service model. Read more.

Top ATT&CK Techniques Observed

T1566 – Phishing: Credential phishing, fake downloads, social engineering, and ClickFix-style lures remained common initial-access methods.

T1071 – Application Layer Protocol: Threat actors continued using legitimate services and unconventional channels, including GitHub, Microsoft 365, DNS, ICMP, and FTP infrastructure for C2.

T1195 – Supply Chain Compromise: Developer ecosystems remained a target, with malicious packages, extensions, and software distribution mechanisms appearing across several campaigns.

What Matters Most

Attackers continued moving C2 and malware delivery into trusted or less-monitored infrastructure. Cloud platforms, developer services, compromised websites, and legitimate remote-access tools repeatedly appeared in the reporting.

Credential and information theft also remained prominent, alongside espionage operations targeting government, telecommunications, and other sensitive organizations.

What Defenders Should Watch

• C2 traffic using legitimate cloud services or unusual protocols
• ClickFix, fake software downloads, and productivity-tool impersonation
• Unexpected packages, extensions, remote-access tools, and software updates
• Credential theft followed by session or account abuse

Key Insight: The recurring theme this period was attackers hiding malicious activity inside infrastructure and services organizations already trust, making context and behavioral detection increasingly important.

Beware of phishing emails disguised as requests to review quotes (PhantomStealer)

Source: AhnLab
(Published: 12 August 2026)
The AhnLab SEcurity intelligence Center (ASEC) recently identified a phishing email campaign that disguised itself as a request to review a quote. Read more.

Gone with the WindRelay: A New Malware Combo Behind a Growing Fraud Scheme

Source: Group-IB
(Published: 12 August 2026)
Group-IB analyzes the threat activity, techniques, and infrastructure described in Gone with the WindRelay: A New Malware Combo Behind a Growing Fraud Scheme. Read more.

Akira Hits Safe Mode: Ransomware Rebooting Around EDR

Source: Huntress
(Published: 12 August 2026)
Huntress analyzes the threat activity, techniques, and infrastructure described in Akira Hits Safe Mode: Ransomware Rebooting Around EDR. Read more.

AmnesiaStealer: macOS Infostealer That Hijacks Browsers

Source: Jamf Threat Labs
(Published: 13 August 2026)
Jamf Threat Labs analyzes the threat activity, techniques, and infrastructure described in AmnesiaStealer: macOS Infostealer That Hijacks Browsers. Read more.

Dissecting the JWR phishing framework

Source: Cisco Talos
(Published: 13 August 2026)
JWR is a phishing framework capable of harvesting complete payment card data, login credentials, and personally identifiable information (PII) documents and images in real time. Read more.

Jewelbug: APT Group Runs Espionage and Crypto Fraud Operations Side by Side

Source: Security.com
(Published: 13 August 2026)
Security.com examines Jewelbug, a China-based threat group linked to government and military espionage as well as cryptocurrency fraud, with both activities tied to shared operational infrastructure. Read more.

Octagon: A New Android Bot Targeting Crypto Wallets and Banking Apps

Source: iVerify
(Published: 13 August 2026)
iVerify analyzes the threat activity, techniques, and infrastructure described in Octagon: A New Android Bot Targeting Crypto Wallets and Banking Apps. Read more.

Multi-Functional Linux Botnet “Evooo1Bot”

Source: Fortinet
(Published: 13 August 2026)
Fortinet analyzes the threat activity, techniques, and infrastructure described in Multi-Functional Linux Botnet “Evooo1Bot”. Read more.

Expired Malicious Domains Bring New Threats to Life

Source: Infoblox
(Published: 13 August 2026)
Infoblox analyzes the threat activity, techniques, and infrastructure described in Expired Malicious Domains Bring New Threats to Life. Read more.

Signed, sealed, injected: The mechanics of DCRat in 2026

Source: Trellix
(Published: 13 August 2026)
Trellix analyzes the threat activity, techniques, and infrastructure described in Signed, sealed, injected: The mechanics of DCRat in 2026. Read more.

When SQL Server Becomes the Initial Launcher: A Deep Dive into Weaxor Ransomware Execution

Source: K7 Labs
(Published: 13 August 2026)
Recent threat intelligence highlights a sophisticated Weaxor Ransomware deployment strategy utilizing high-privilege application abuse and layered in-memory evasion. Read more.

PATCHCORD: New malware cluster targets Afghan telecom and South Asian critical infrastructure

Source: Acronis
(Published: 13 August 2026)
Acronis analyzes the threat activity, techniques, and infrastructure described in PATCHCORD: New malware cluster targets Afghan telecom and South Asian critical infrastructure. Read more.

CoolClient backdoor goes deeper: HoneyMyte adds Windows kernel rootkit

Source: Kaspersky Securelist
(Published: 14 August 2026)
Kaspersky Securelist analyzes the threat activity, techniques, and infrastructure described in CoolClient backdoor goes deeper: HoneyMyte adds Windows kernel rootkit. Read more.

A 12 KB Backdoor Hid Its C2 Domain in desktop.ini Whitespace

Source: Gen Digital
(Published: 14 August 2026)
Gen Digital analyzes the threat activity, techniques, and infrastructure described in A 12 KB Backdoor Hid Its C2 Domain in desktop.ini Whitespace. Read more.

npm Bin Entry Harvesting: A Dependency Confusion Blind Spot

Source: SafeDep
(Published: 14 August 2026)
SafeDep analyzes the threat activity, techniques, and infrastructure described in npm Bin Entry Harvesting: A Dependency Confusion Blind Spot. Read more.

Detect ICMP-Ghost Implant ICMP and DNS Tunnelling C2 Traffic Using PacketSmith Yara-X & ICMP Detection Modules

Source: Netomize
(Published: 14 August 2026)
Netomize analyzes the ICMP-Ghost tunneling framework and develops network detections for its ICMPv4 and DNS command-and-control channels. Read more.

Operation QUICSILVER: China-Nexus Actor Targets Myanmar Diplomats via VHD-Delivered Go Backdoor

Source: Seqrite
(Published: 17 August 2026)
Seqrite analyzes the threat activity, techniques, and infrastructure described in Operation QUICSILVER: China-Nexus Actor Targets Myanmar Diplomats via VHD-Delivered Go Backdoor. Read more.

C2Looper Backdoor Uses GitHub for C2

Source: Zscaler ThreatLabz
(Published: 17 August 2026)
Zscaler ThreatLabz analyzes the threat activity, techniques, and infrastructure described in C2Looper Backdoor Uses GitHub for C2. Read more.

Rapid7 Labs: the Anatomy of a Crypto Fraud Pipeline

Source: Rapid7
(Published: 17 August 2026)
Rapid7 reconstructs Operation ASTERIX from an exposed attacker directory containing lead data, phishing panels, vishing tools, fake cryptocurrency wallet apps, persistence mechanisms, and Telegram exfiltration code. Read more.

Projextor: Malware Disguised as Productivity Software

Source: G DATA
(Published: 17 August 2026)
G DATA analyzes Projextor, a cluster of trojanized Electron productivity applications that conceal malicious functionality behind working PDF converters, meal planners, and similar tools. Read more.

Kimsuky Expands AI Capabilities Through a Local AI Development Environment in Operation GitPower

Source: PolySwarm
(Published: 17 August 2026)
Researchers identified a continuation of the North Korean Kimsuky cyber espionage campaign, designated Operation GitPower, which combines established spear-phishing techniques with emerging artificial intelligence capabilities. Read more.

Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect

Source: Check Point Research
(Published: 18 August 2026)
Check Point Research analyzes StopAndProtect, an operation that uses compromised WordPress sites for malware delivery and C2 while combining data theft with ransomware and other malicious components. Read more.

Inside the Aisuru Botnet: DDoS, ADB and Proxyware

Source: Bitsight
(Published: 18 August 2026)
Bitsight analyzes the threat activity, techniques, and infrastructure described in Inside the Aisuru Botnet: DDoS, ADB and Proxyware. Read more.

Signed Overwolf Binary Sideloads ValleyRAT Malware in India

Source: Forcepoint X-Labs
(Published: 18 August 2026)
Forcepoint X-Labs analyzes the threat activity, techniques, and infrastructure described in Signed Overwolf Binary Sideloads ValleyRAT Malware in India. Read more.

Living Off the Cloud: A Python Implant Hiding Its Entire C2 Inside Microsoft 365 & Azure

Source: Ontinue
(Published: 18 August 2026)
Ontinue analyzes the threat activity, techniques, and infrastructure described in Living Off the Cloud: A Python Implant Hiding Its Entire C2 Inside Microsoft 365 & Azure. Read more.

WordlistLoader Delivering Amatera via ClearFake Campaigns

Source: Gen Digital
(Published: 18 August 2026)
Gen Threat Labs examines WordlistLoader, a loader used in ClearFake campaigns to deliver Amatera Stealer while encoding shellcode as ordinary English words or UUIDs to complicate detection. Read more.

Clop Returns With Custom Implant in Mass Extortion Campaign

Source: ReliaQuest
(Published: 18 August 2026)
ReliaQuest analyzes a custom web shell linked to Clop that targets PTC Windchill, providing built-in credential theft, file discovery, data exfiltration, and extensible in-memory code execution. Read more.

Arsenal Revamped: Core Werewolf Hits Russian Organizations With CoreRAT

Source: BI.ZONE
(Published: 18 August 2026)
BI.ZONE analyzes the threat activity, techniques, and infrastructure described in Arsenal Revamped: Core Werewolf Hits Russian Organizations With CoreRAT. Read more.

Mirage2FA: A Phishing Threat to US Companies with 4K Victims

Source: ANY.RUN
(Published: 18 August 2026)
ANY.RUN analyzes the threat activity, techniques, and infrastructure described in Mirage2FA: A Phishing Threat to US Companies with 4K Victims. Read more.

SilkParasite: Tracking a China-Nexus APT Across Central Asia

Source: Bitdefender
(Published: 19 August 2026)
Bitdefender analyzes the threat activity, techniques, and infrastructure described in SilkParasite: Tracking a China-Nexus APT Across Central Asia. Read more.

Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware

Source: Huntress
(Published: 19 August 2026)
Large industry events like Black Hat and DEF CON create a target-rich environment for bad actors, with attendees exchanging new contacts, documents, invitations, and follow-up plans. Read more.

Balonx Sistema: The Face Behind the PhaaS Affecting Mexican Banking

Source: Group-IB
(Published: 19 August 2026)
Group-IB analyzes the threat activity, techniques, and infrastructure described in Balonx Sistema: The Face Behind the PhaaS Affecting Mexican Banking. Read more.

Malware-as-a-Service Cocktail: ErrTraffic and Cruciferra – Killing Your EDR Since 2025

Source: eSentire
(Published: 19 August 2026)
eSentire analyzes the threat activity, techniques, and infrastructure described in Malware-as-a-Service Cocktail: ErrTraffic and Cruciferra – Killing Your EDR Since 2025. Read more.

Beware of Solidity Pro: A Targeted Poisoning Attack on Web3 Developers

Source: SlowMist
(Published: 19 August 2026)
SlowMist investigates malicious activity tied to the Solidity Pro VS Code extension, including credential harvesting, remote payload execution, and remote extension update capabilities targeting Web3 developers. Read more.

Grandoreiro goes north: From Brazil to Mexico with a new DLL sideloading campaign

Source: Acronis
(Published: 19 August 2026)
Acronis analyzes the threat activity, techniques, and infrastructure described in Grandoreiro goes north: From Brazil to Mexico with a new DLL sideloading campaign. Read more.

AI-Agent-Driven Offensive Operation

Source: CloudSEK
(Published: 19 August 2026)
CloudSEK analyzes the threat activity, techniques, and infrastructure described in AI-Agent-Driven Offensive Operation. Read more.

41 deceptive download sites show a real link, then send you somewhere else

Source: Malwarebytes
(Published: 19 August 2026)
Malwarebytes analyzes the threat activity, techniques, and infrastructure described in 41 deceptive download sites show a real link, then send you somewhere else. Read more.

Trapping a Mustang Panda

Source: IBM X-Force
(Published: 20 August 2026)
IBM X-Force analyzes the threat activity, techniques, and infrastructure described in Trapping a Mustang Panda. Read more.

UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities

Source: Cisco Talos
(Published: 20 August 2026)
In our previous blog, Cisco Talos documented how UAT-10147 operationalized AI-assisted exploitation workflows to compromise internet-facing IIS and Linux servers at scale. Read more.

UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations

Source: Cisco Talos
(Published: 20 August 2026)
Cisco Talos analyzes the threat activity, techniques, and infrastructure described in UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations. Read more.

Compromised Rust crates on crates.io silently execute malware at build time

Source: JFrog
(Published: 20 August 2026)
The JFrog security research team has identified a compromise in 3 widely used Rust crates on crates.io: arrayref@0.3.10, internment@0.8.7, and append-only-vec@0.1.9. Read more.

Manic: Blend between Banking Malware & Spyware

Source: ThreatFabric
(Published: 20 August 2026)
ThreatFabric analyzes the threat activity, techniques, and infrastructure described in Manic: Blend between Banking Malware & Spyware. Read more.

How Peer2Profit and Astroproxy Turn Your Bandwidth Into Someone Else’s Product

Source: Silent Push
(Published: 20 August 2026)
Silent Push investigates the relationship between Peer2Profit and Astroproxy, showing how bandwidth-sharing software can turn residential and corporate IP addresses into commercially resold proxy nodes. Read more.

N4D Mesh Controller: New infrastructure, a UPX-packed agent labeled “go-titan,” and how to hunt for it

Source: Datadog Security Labs
(Published: 20 August 2026)
Datadog Security Labs analyzes the threat activity, techniques, and infrastructure described in N4D Mesh Controller: New infrastructure, a UPX-packed agent labeled “go-titan,” and how to hunt for it. Read more.

Inside Kimsuky’s Abuse of Legitimate Remote Control Tools Across Northeast Asia

Source: ENKI
(Published: 20 August 2026)
ENKI WhiteHat analyzes Kimsuky spear-phishing campaigns targeting South Korean and Japanese victims, including abuse of OneDrive links, PowerShell, Chrome Remote Desktop, AnyDesk, and a malicious Gmail-stealing extension. Read more.

WeedHack Returns: How SEO Poisoning is Leading Minecraft Fans to Malware

Source: McAfee Labs
(Published: 20 August 2026)
McAfee Labs analyzes the threat activity, techniques, and infrastructure described in WeedHack Returns: How SEO Poisoning is Leading Minecraft Fans to Malware. Read more.

SynkLoader: when you throw in everything but the kitchen sink

Source: Expel
(Published: 20 August 2026)
Expel analyzes the threat activity, techniques, and infrastructure described in SynkLoader: when you throw in everything but the kitchen sink. Read more.

First Android malware targeting automotive head units

Source: Kaspersky Securelist
(Published: 21 August 2026)
Kaspersky Securelist analyzes the threat activity, techniques, and infrastructure described in First Android malware targeting automotive head units. Read more.

FireClient Evolves: MSI-Based Deployment in Teams Attacks

Source: BlueVoyant
(Published: 21 August 2026)
BlueVoyant analyzes the threat activity, techniques, and infrastructure described in FireClient Evolves: MSI-Based Deployment in Teams Attacks. Read more.

FTP Banners: The New Dead Drop Resolver Delivering Novel RATs

Source: SOCRadar
(Published: 21 August 2026)
SOCRadar documents threat actors abusing FTP server banners as dead-drop resolvers for malicious commands and links the technique to two previously undocumented RATs. Read more.

Chinese Malware Delivery Domains Part V

Source: DomainTools
(Published: 21 August 2026)
In Parts I-IV of this series, we reported on a large-scale malware delivery network targeting Chinese speaking users. Read more.

AmnesiaStealer Introduces Interactive Browser Session Hijacking to macOS

Source: PolySwarm
(Published: 21 August 2026)
PolySwarm analyzes the threat activity, techniques, and infrastructure described in AmnesiaStealer Introduces Interactive Browser Session Hijacking to macOS. Read more.

CNCMachineRMS C2 Protocol

Source: Netresec
(Published: 21 August 2026)
Netresec analyzes the threat activity, techniques, and infrastructure described in CNCMachineRMS C2 Protocol. Read more.

Tracking PavinLoader across ClickFix and fake download campaigns

Source: Malwarebytes
(Published: 24 August 2026)
In our previous analysis of the malicious RenPy campaigns, we identified an infostealer being deployed through a loader we now track as PavinLoader. Read more.

When Trust Becomes the Payload in a Fake Codex ClickFix Campaign

Source: Cato Networks
(Published: 24 August 2026)
Cato CTRL analyzes a fake Codex download campaign that uses sponsored search results, Google Sites, and ClickFix instructions to trick macOS users into executing a multi-stage malware chain. Read more.

Exposing AnonyMousKIT: AI-Powered PhaaS Supply Chain

Source: SOCRadar
(Published: 24 August 2026)
SOCRadar investigates AnonyMousKIT, an AI-enabled phishing-as-a-service ecosystem built to steal Apple credentials and disable Activation Lock on stolen devices through email, messaging, and AI-assisted vishing. Read more.

Top ATT&CK Techniques Observed

T1566 – Phishing: Credential theft remained one of the primary initial access vectors, with campaigns using device code phishing, adversary-in-the-middle (AiTM) techniques, fake recruiters, Google Ads lures, procurement scams, eCards, and other social engineering methods.

T1071 – Application Layer Protocol: Threat actors increasingly relied on legitimate services and protocols—including Outlook, DNS, browsers, blockchain infrastructure, Telegram, and cloud platforms—for command-and-control to blend malicious traffic with normal network activity.

T1583 / T1584 – Acquire & Compromise Infrastructure: Multiple investigations focused on attacker-controlled infrastructure, compromised government websites, malicious domains, cloud resources, and software repositories used to support phishing, malware delivery, and command-and-control.

T1195 – Supply Chain Compromise: Software supply chain attacks remained highly active, targeting npm packages, PyPI repositories, SDKs, browser extensions, AI tooling, IDE components, and other developer ecosystems.

T1105 / T1059 – Ingress Tool Transfer & Command Execution: Researchers observed widespread use of custom loaders, remote access trojans, malware frameworks, scripting engines, ClickFix techniques, and living-off-the-land methods to establish persistence and evade detection.

What Matters Most

Identity has become the preferred attack surface. Rather than exploiting vulnerabilities, many campaigns focused on stealing credentials through phishing, adversary-in-the-middle attacks, Microsoft 365 abuse, and social engineering.

ClickFix continues to gain momentum. Multiple unrelated threat actors—including financially motivated groups, DPRK operators, and nation-state campaigns—adopted ClickFix techniques, reinforcing its emergence as a mainstream initial access method.

Trusted infrastructure is increasingly abused. Government websites, SaaS platforms, Microsoft 365, GitHub, Telegram, cloud services, and blockchain infrastructure were repeatedly leveraged to host payloads, deliver malware, or conceal command-and-control traffic.

Threat research is shifting toward infrastructure analysis. Many reports focused less on individual malware samples and more on mapping attacker infrastructure, command-and-control architecture, operational ecosystems, and attribution.

What Defenders Should Watch

• Device code phishing, AiTM campaigns, and Microsoft 365 authentication abuse
• ClickFix-style execution chains involving PowerShell, MSBuild, script interpreters, or trusted Windows utilities
• Newly observed domains, DNS tunneling, Outlook- or browser-based C2 channels, and rapidly changing infrastructure
• Unauthorized package updates, developer dependencies, browser extensions, SDKs, and software repositories
• Remote administration tools, custom loaders, and malware communicating through trusted cloud services

Quick Wins

• Strengthen phishing-resistant authentication and monitor for suspicious OAuth, device code, and session activity
• Expand detection coverage for ClickFix techniques and script-based execution from user-accessible directories
• Monitor outbound DNS, Outlook, browser, and cloud-service traffic for unusual command-and-control behavior
• Verify software dependencies, package updates, browser extensions, and developer tooling before deployment
• Continuously enrich detections with current malicious domains, URLs, IPs, and C2 infrastructure to identify emerging campaigns earlier

Key Insight: This reporting period highlighted a continued shift away from traditional exploit-driven intrusions toward attacks that abuse trusted identities, legitimate services, and widely used platforms. At the same time, researchers placed greater emphasis on uncovering attacker infrastructure and command-and-control techniques, giving defenders more opportunities to detect campaigns through behavioral patterns rather than malware signatures alone.

Chaos in Teams: Vishing

Source: Sophos
(Published: 28 July 2026)
Sophos analysts investigated a Microsoft Teams voice phishing (vishing) campaign tracked as STAC4749 that used a consistent set of IT-themed cloud domains and personas… Read more.

SilverFox Evolves

Source: Cato Networks
(Published: 28 July 2026)
SilverFox is expanding its toolkit. Read more.

Phantom Stealer: Shellcode, Steganography and Credential Theft

Source: Splunk
(Published: 28 July 2026)
STRT observed that Phantom Stealer leverages multiple loader variants to deliver its payload. Read more.

Joyfill npm Supply Chain Compromise

Source: StepSecurity
(Published: 28 July 2026)
On July 28, 2026, malicious beta versions of two Joyfill npm packages, @joyfill/components and @joyfill/layouts, were published to the npm registry. Read more.

A New RAT in the Valley: SafeRAT

Source: ExaTrack
(Published: 28 July 2026)
This article details a new malicious code, SafeRat, which we attribute to the APT group Silver Fox. Read more.

ClickFix Keeps Evolving: Rundll32 Ordinal Execution Over WebDAV

Source: CyberProof
(Published: 28 July 2026)
The CyberProof Threat Research Team has tracked a ClickFix variant that pushes execution deep into trusted Windows components. Read more.

SonicWall Credential Stuffing Campaign

Source: Huntress
(Published: 28 July 2026)
Starting on July 25, 2026, at approximately 18:02:21 UTC, the Huntress SOC detected an out-of-the-ordinary spike in successful SonicWall VPN and firewall logins… Read more.

MacSync Stealer RAT Reverse Engineering

Source: Huntress
(Published: 29 July 2026)
In mid-July, Huntress investigated a macOS intrusion in which the victim thought they were installing Claude, but instead ran a full stealer and remote access… Read more.

Inside Astaroth’s New Spambot Component

Source: CrowdStrike
(Published: 29 July 2026)
Established Latin American (LATAM) threat actors are continuously adapting their malware capabilities and attack methodologies to circumvent defensive measures and maintain effectiveness against target environments. Read more.

TA488 Comes for Outlook With Another Half-Click Exploit

Source: Proofpoint
(Published: 29 July 2026)
On 22 July 2026, TA488 initiated a new wave of exploitation abusing a cross-site scripting (XSS) vulnerability, CVE-2026-42897, in Outlook Web Access (OWA). Read more.

Amazon Identifies North Korean Hacker Group Behind Open Source Supply Chain Attacks

Source: AWS
(Published: 29 July 2026)
Amazon is sharing new findings about how a threat actor linked to the Democratic People’s Republic of Korea (DPRK) is targeting open source software libraries… Read more.

Dysphoria Botnet Evolution and Technical Analysis

Source: Qianxin XLab
(Published: 29 July 2026)
Since Q1 2026, XLab has been continuously tracking an emerging botnet family named Dysphoria whose bot population exceeds 200,000. Read more.

WP2Shell WordPress Exploit: Technical Analysis and Real Attack Data

Source: Wordfence
(Published: 29 July 2026)
On July 17th, 2026, the WordPress Security Team released updates to WordPress core addressing a critical vulnerability chain that can be leveraged by unauthenticated attackers… Read more.

Autonomous AI Cyber Attack Campaign

Source: Unit 42
(Published: 30 July 2026)
Unit 42 identified an AI-enabled autonomous hacking campaign carried out by a Chinese-speaking threat actor. Read more.

HollowFrames: Layered Loader and Matryoshka Backdoors

Source: Blackpoint Cyber
(Published: 30 July 2026)
HollowFrame established a durable execution layer by combining persistence with multiple payload launching techniques, while Matryoshka extended… Read more.

XMRig Covert Linux PAM Abuse

Source: Group-IB
(Published: 30 July 2026)
In May 2026, a highly covert Monero (XMR) cryptomining campaign was identified, leveraging advanced stealth techniques to infiltrate and persist within targeted Linux environments. Read more.

GenieLocker Ransomware for Windows, Linux and ESXi

Source: Kaspersky Securelist
(Published: 30 July 2026)
The new GenieLocker ransomware family has been active since March 2026. Read more.

OCTLurk and SilkLurk Backdoors in Central Asia

Source: Kaspersky Securelist
(Published: 30 July 2026)
We have been tracking two new backdoors, OctLurk and SilkLurk, observed in attacks against government organizations primarily in Central Asia since January 2025. Read more.

Cl0p Targets Windchill

Source: Censys
(Published: 30 July 2026)
On July 22, 2026, ReliaQuest reported observations of a threat actor exploiting CVE-2026-12569, a critical remote code execution vulnerability affecting PTC Windchill and FlexPLM. Read more.

XCSSET v4.0 Malware Analysis

Source: Unit 42
(Published: 31 July 2026)
After months of dormancy, the attackers behind the XCSSET malware released version 40 (v40), targeting the macOS ecosystem. Read more.

DarkSword’s Panel Sprawl

Source: Censys
(Published: 31 July 2026)
DarkSword is a commercial iOS exploit chain, six chained vulnerabilities spanning iOS 18.4 through 18.7, that leaked publicly via a GitHub repository… Read more.

CaptiveCrunch: Midnight Blizzard Targets Travelers Worldwide

Source: Microsoft
(Published: 31 July 2026)
Since early May 2026, Microsoft Threat Intelligence has observed Storm-2945, a sub-cluster of Midnight Blizzard, conducting widespread but targeted traffic manipulation attacks involving hospitality sector networks… Read more.

Polinrider Caused Dozens of npm and Go Compromises

Source: OpenSourceMalware
(Published: 31 July 2026)
That PolinRider connection grabbed my attention, because that campaign isn’t really known for compromising legitimate packages. Read more.

Snowlight Government Chinese Campaign

Source: SOCRadar
(Published: 31 July 2026)
SOCRadar Threat Research Unit (STRU) identified and analyzed an exposed adversary-operated staging server containing a full attack infrastructure… Read more.

From WSProxy to Root: INC Ransomware and SonicWall SMA Exploit Chain

Source: Resecurity
(Published: 1 August 2026)
Virtual private network (VPN) appliances occupy one of the most sensitive positions in modern enterprise architecture: the boundary between the untrusted public internet and the internal corporate… Read more.

NullReceiver DPRK C2 Technique

Source: OpenSourceMalware
(Published: 2 August 2026)
We just identified a new blockchain-based command-and-control technique hiding inside two trojanized npm packages, bianira-ui and fluid-type-ui. Read more.

DoubleCup ClickFix Loader and DeviceManager RATs

Source: SOCRadar
(Published: 3 August 2026)
SOCRadar’s Threat Research Unit (STRU) identified and analyzed DOUBLECUP, a Russian Loader-as-a-Service (LaaS) for ClickFix campaigns. Read more.

Developers in the Crosshairs: Fake AI Tools Deliver Infostealer

Source: Netskope
(Published: 3 August 2026)
In April 2026, Netskope Threat Labs reported a Windows-based Malware-as-a-Service (MaaS) infostealer delivered through the “Clickfix” social engineering tactic. Read more.

Targeted Attack Against Government Entities in the Middle East – Part 2

Source: Zscaler
(Published: 3 August 2026)
This is Part 2 of our two-part technical analysis on new tools used by an East Asia-linked threat actor targeting government entities in the Middle East. Read more.

Inside a Russian-Speaking Access Broker’s Dual Operation

Source: CloudSEK
(Published: 3 August 2026)
An exposed server owned by a Russia-nexus threat actor revealed months of activity from a high-volume initial access broker. Read more.

N-able Vulnerability Exploitation

Source: Huntress
(Published: 3 August 2026)
On August 1–2, 2026, N-able disclosed a critical vulnerability in N-central, its flagship remote monitoring and management (RMM) platform… Read more.

Smoke Screen: ScreenConnect RMM Abuse and Cloudflare Tunnels

Source: Securonix
(Published: 4 August 2026)
Securonix Threat Research has been tracking an active, multi-wave campaign we are calling SMOKE#SCREEN, in which threat actors use a rotating collection of social engineering lures… Read more.

QuickFox Supply Chain Attack Used to Deploy FDMTP Implant

Source: Fortinet
(Published: 4 August 2026)
FortiGuard Labs is tracking a campaign associated with a long-standing supply chain attack on the QuickFox application. Read more.

Cryptomining Attack Hiding in Memory

Source: Aqua Security
(Published: 4 August 2026)
The attacks most likely to go undetected are the ones that never touch disk. Read more.

ChainDrop Supply Chain Compromise: Anatomy of a Self-Propagating Worm

Source: Microsoft
(Published: 4 August 2026)
Microsoft Threat Intelligence identified a large-scale npm supply chain attack affecting more than 400 packages across multiple unrelated publishers… Read more.

Shai-Hulud Is Back: August

Source: JFrog
(Published: 4 August 2026)
The JFrog security research team identified a new version of the Shai-Hulud supply-chain malware affecting 400+ packages across 1700+ versions. Read more.

Malware Bypasses DNS With Direct-to-IP Communication

Source: Unit 42
(Published: 4 August 2026)
Malware samples often bypass DNS entirely, communicating directly to IP addresses instead. Read more.

Fake CAPTCHA, Real Business: Traffic Distribution for Hire

Source: Netskope
(Published: 4 August 2026)
A single PDF factory has stamped out more than 12,700 structurally similar FakeCaptcha documents and parked them on Webflow’s content delivery network… Read more.

Detecting CertiGhost CVE-2026-54121

Source: Nextron Systems
(Published: 4 August 2026)
Many organizations rely on Microsoft Active Directory to manage users, computers, logins, and access permissions. Read more.

macOS ClickFix Campaign Learned to Hide

Source: Microsoft
(Published: 5 August 2026)
Microsoft Threat Intelligence observed a macOS ClickFix campaign distributing infostealers, including MacSync and Atomic Stealer (AMOS), through a large cluster of look-alike domains. Read more.

Payroll Pirates: Strange New Tides in Business Email Compromise

Source: Arctic Wolf
(Published: 6 August 2026)
Arctic Wolf is tracking an ongoing Microsoft 365 phishing campaign affecting healthcare, education, manufacturing, government, professional services, and other sectors across the United States… Read more.

StealNui: A New Linux RAT/Clipper

Source: ExaTrack
(Published: 6 August 2026)
This binary, detected only once on VirusTotal, makes far too much noise on Exalyze to be honest, so let’s dig into it a little to understand… Read more.

22 Seconds to Compromise: Automated SSH Actors

Source: SANS ISC
(Published: 6 August 2026)
On May 23, 2026, a threat actor successfully authenticated to my Cowrie SSH honeypot using compromised credentials and, within 22 seconds, injected a backdoor SSH key… Read more.

Fake Zoom Installer Delivers Overlord RAT

Source: Jamf
(Published: 6 August 2026)
Jamf Threat Labs recently identified a campaign using a fake Zoom installer to deliver a configured build of Overlord, an open-source remote access framework… Read more.

CaptiveCrunch: Amplifying Coverage With Variant Discovery

Source: Stairwell
(Published: 6 August 2026)
CaptiveCrunch is an ongoing espionage campaign reported on by Microsoft on July 31, 2026. Read more.

CVE-2026-16812: Critical Command Injection in Arista VeloCloud Orchestrator

Source: Resecurity
(Published: 6 August 2026)
CVE-2026-16812 is a critical unauthenticated OS command injection vulnerability affecting on-premises Arista VeloCloud Orchestrator (VCO) deployments. Read more.

AI Token Jacking

Source: Unit 42
(Published: 6 August 2026)
It’s three a.m., do you know what your AI agent is doing? Read more.

Clustering macOS ClickFix Campaign Pages Using HTTP-Basma

Source: Netomize
(Published: 6 August 2026)
On August 5, 2026, the Microsoft Security Research Team (MSRT) blogged about a new macOS ClickFix campaign… Read more.

Supply Chain Attack Activities Against Domestic Electron Software

Source: Qianxin
(Published: 7 August 2026)
Since our discovery of Operation Dragon Dance in 2021, we have repeatedly emphasized the vulnerability of domestic Electron software… Read more.

BDThemes Ecosystem Supply Chain Compromise via Poisoned API Response

Source: Wordfence
(Published: 8 August 2026)
The Wordfence Threat Intelligence Team was notified on August 7th, 2026 of a supply chain compromise affecting BdThemes, a WordPress plugin vendor… Read more.

CERT-UA Article 6318863

Source: CERT-UA
(Published: 8 August 2026)
CERT-UA ???????? ?????????? ???? ???????????? ?????????? ??????? ?????????? ????????? ????????? ??????????? UAC-0145… Read more.

Kimsuky Integrates AI/LLM Into Attack Chain

Source: Genians
(Published: 9 August 2026)
???? ???? ??(Genians Security Center)? ?? ?????? ?? ??? ?? ???? ??? ???(Kimsuky)? ??? ??? ???? GitHub ? GitLab ?? ?? ??? ????? ???? ????. Read more.

Insolent Hyena: Mixed Motives and Objectives

Source: BI-ZONE
(Published: 10 August 2026)
Hacktivists typically target organizations to generate publicity. Read more.

Aeternum Blockchain C2 Analysis

Source: Unit 42
(Published: 10 August 2026)
Aeternum is a recently discovered C++ botnet loader that shifts its command-and-control (C2) infrastructure entirely to the public Polygon blockchain. Read more.

Lazarus Group IT Workers Investigation – Part Two

Source: ANY.RUN
(Published: 10 August 2026)
Back in December, we were the first ever to fully record the Famous Chollima infiltration cycle. Read more.

Abyssos: Technical Analysis of a New Modular RAT

Source: Zscaler
(Published: 10 August 2026)
In late June 2026, Zscaler ThreatLabz identified a new malware family that we track as Abyssos. Read more.

Deadlock Ransomware: Rust-Based Encryptor With Decentralized Recovery Infrastructure

Source: Microsoft
(Published: 10 August 2026)
Microsoft Threat Intelligence tracks DeadLock ransomware as an emerging financially motivated operation distinguished by its use of decentralized infrastructure to support victim communications and data leak operations. Read more.

TXTBook: A Supply Chain Heist Rehearsed in Public

Source: CloudSEK
(Published: 10 August 2026)
An operator has spent the summer of 2026 publishing malicious packages to the public npm registry under names that belong to somebody else. Read more.

AI Sidebar Extension Monetizes Its Own Updates

Source: Netskope
(Published: 11 August 2026)
The Chrome extension “AI Sidebar with DeepSeek AI” that Google removed from the Chrome Web Store in January 2026 for stealing AI conversation content resumed shipping… Read more.

Head Mare Targets TrueConf Server With PhantomCore

Source: Kaspersky Securelist
(Published: 11 August 2026)
In July 2026, Kaspersky experts detected a new attack by the Head Mare group. Read more.

Deleting the Defenders: A Commodity BYOVD Toolkit

Source: VMRay
(Published: 11 August 2026)
[Source page could not be retrieved reliably; excerpt left blank for manual verification.] Read more.

The Phishing Link That Died on Purpose

Source: Gen Digital
(Published: 11 August 2026)
The first URL was already dead. Read more.

Fake CCleaner Installs GhostDesk Chrome Spyware

Source: Malwarebytes
(Published: 11 August 2026)
A fake version of the popular PC cleaning tool CCleaner is being used to infect Windows users with a malicious Chrome extension called GhostDesk… Read more.

Shattering the Dream: When a Job Offer Becomes a Zero-Day Attack

Source: Check Point Research
(Published: 11 August 2026)
Check Point Research is tracking a long-running campaign called Operation Dream Job, targeting organizations worldwide, with a particular focus on the defense sector. Read more.

Kimwolf v7 Botnet Malware

Source: Unit 42
(Published: 11 August 2026)
We identified a new version (v7) of the Kimwolf Android/internet-of-things (IoT) botnet. Read more.

ClickFix Campaign Abuses Deno Runtime for Infostealer Delivery

Source: Sophos
(Published: 11 August 2026)
Counter Threat Unit™ (CTU) researchers investigated a June 2026 campaign in which threat actors used the Deno JavaScript runtime as a core execution mechanism… Read more.

Top ATT&CK Techniques Observed

T1566 – Phishing: Credential theft remained one of the primary initial access vectors, with campaigns using device code phishing, adversary-in-the-middle (AiTM) techniques, fake recruiters, Google Ads lures, procurement scams, eCards, and other social engineering methods.

T1071 – Application Layer Protocol: Threat actors increasingly relied on legitimate services and protocols—including Outlook, DNS, browsers, blockchain infrastructure, Telegram, and cloud platforms—for command-and-control to blend malicious traffic with normal network activity.

T1583 / T1584 – Acquire & Compromise Infrastructure: Multiple investigations focused on attacker-controlled infrastructure, compromised government websites, malicious domains, cloud resources, and software repositories used to support phishing, malware delivery, and command-and-control.

T1195 – Supply Chain Compromise: Software supply chain attacks remained highly active, targeting npm packages, PyPI repositories, SDKs, browser extensions, AI tooling, IDE components, and other developer ecosystems.

T1105 / T1059 – Ingress Tool Transfer & Command Execution: Researchers observed widespread use of custom loaders, remote access trojans, malware frameworks, scripting engines, ClickFix techniques, and living-off-the-land methods to establish persistence and evade detection.

What Matters Most

Identity has become the preferred attack surface. Rather than exploiting vulnerabilities, many campaigns focused on stealing credentials through phishing, adversary-in-the-middle attacks, Microsoft 365 abuse, and social engineering.

ClickFix continues to gain momentum. Multiple unrelated threat actors—including financially motivated groups, DPRK operators, and nation-state campaigns—adopted ClickFix techniques, reinforcing its emergence as a mainstream initial access method.

Trusted infrastructure is increasingly abused. Government websites, SaaS platforms, Microsoft 365, GitHub, Telegram, cloud services, and blockchain infrastructure were repeatedly leveraged to host payloads, deliver malware, or conceal command-and-control traffic.

Threat research is shifting toward infrastructure analysis. Many reports focused less on individual malware samples and more on mapping attacker infrastructure, command-and-control architecture, operational ecosystems, and attribution.

What Defenders Should Watch

• Device code phishing, AiTM campaigns, and Microsoft 365 authentication abuse
• ClickFix-style execution chains involving PowerShell, MSBuild, script interpreters, or trusted Windows utilities
• Newly observed domains, DNS tunneling, Outlook- or browser-based C2 channels, and rapidly changing infrastructure
• Unauthorized package updates, developer dependencies, browser extensions, SDKs, and software repositories
• Remote administration tools, custom loaders, and malware communicating through trusted cloud services

Quick Wins

• Strengthen phishing-resistant authentication and monitor for suspicious OAuth, device code, and session activity
• Expand detection coverage for ClickFix techniques and script-based execution from user-accessible directories
• Monitor outbound DNS, Outlook, browser, and cloud-service traffic for unusual command-and-control behavior
• Verify software dependencies, package updates, browser extensions, and developer tooling before deployment
• Continuously enrich detections with current malicious domains, URLs, IPs, and C2 infrastructure to identify emerging campaigns earlier

Key Insight: This reporting period highlighted a continued shift away from traditional exploit-driven intrusions toward attacks that abuse trusted identities, legitimate services, and widely used platforms. At the same time, researchers placed greater emphasis on uncovering attacker infrastructure and command-and-control techniques, giving defenders more opportunities to detect campaigns through behavioral patterns rather than malware signatures alone.

Langflow Exploited to Build Custom DDoS Gafgyt Botnets

Source: Akamai
(Published: July 14, 2026)

This technical analysis examines Langflow Exploited to Build Custom DDoS Gafgyt Botnets, including its propagation, command-and-control design, capabilities, and infrastructure. Read more.

Kratos PhaaS Targets US and EU Companies

Source: ANY.RUN
(Published: July 14, 2026)

Kratos is a mature Phishing-as-a-Service operation targeting Microsoft 365 users across the US, Europe, and other regions. Read more.

LabubaRAT: A Rust Based Remote Access Tool Masquerading as NVIDIA Software

Source: Blackpoint Cyber
(Published: July 14, 2026)

This technical analysis examines LabubaRAT: A Rust Based Remote Access Tool Masquerading as NVIDIA Software, including its delivery chain, execution behavior, persistence, command-and-control, and evasion techniques. Read more.

Burnt by Burgers: Highlighting Void Blizzard’s Russian State Links

Source: Ctrl-Alt-Intel
(Published: July 14, 2026)

This report investigates Burnt by Burgers: Highlighting Void Blizzard’s Russian State Links, covering the campaign’s targeting, tooling, infrastructure, and observed attacker tradecraft. Read more.

Compromised AsyncAPI npm Packages

Source: Datadog Security Labs
(Published: July 14, 2026)

This research details Compromised AsyncAPI npm Packages, including how the software ecosystem was abused and what defenders can use to identify affected packages or systems. Read more.

SeasonalInvite: New Phishing Campaign Abuses eCards and RMM

Source: Forescout
(Published: July 14, 2026)

This research analyzes SeasonalInvite: New Phishing Campaign Abuses eCards and RMM, with attention to the lure, delivery infrastructure, credential-theft flow, and defensive indicators. Read more.

Signed, Sealed, Stolen: CrashStealer Slips Past Gatekeeper

Source: HivePro
(Published: July 14, 2026)

This technical analysis examines Signed, Sealed, Stolen: CrashStealer Slips Past Gatekeeper, including its delivery chain, execution behavior, persistence, command-and-control, and evasion techniques. Read more.

How an Infostealer Infection Led to a Sophisticated ClickFix Campaign at Artlist

Source: Infostealers.com
(Published: July 14, 2026)

This technical analysis examines How an Infostealer Infection Led to a Sophisticated ClickFix Campaign at Artlist, including its delivery chain, execution behavior, persistence, command-and-control, and evasion techniques. Read more.

Miasma Worm Returns to npm

Source: JFrog
(Published: July 14, 2026)

This research details Miasma Worm Returns to npm, including how the software ecosystem was abused and what defenders can use to identify affected packages or systems. Read more.

HTTP-Basma – Clustering Verbosus Fingerprints

Source: Netomize
(Published: July 14, 2026)

This research maps HTTP-Basma – Clustering Verbosus Fingerprints, highlighting infrastructure relationships, operational patterns, and detection opportunities. Read more.

Detailed Analysis of BIRDCALL Malware Masquerading as Zangi Messenger

Source: S2W
(Published: July 14, 2026)

This technical analysis examines Detailed Analysis of BIRDCALL Malware Masquerading as Zangi Messenger, including its delivery chain, execution behavior, persistence, command-and-control, and evasion techniques. Read more.

Injective SDK Compromised: Crypto Wallet Private Keys Stolen

Source: SlowMist
(Published: July 14, 2026)

This research details Injective SDK Compromised: Crypto Wallet Private Keys Stolen, including how the software ecosystem was abused and what defenders can use to identify affected packages or systems. Read more.

Tracking Donot APT-C-35 Bangladesh Military Intrusion

Source: Cyderes
(Published: July 15, 2026)

This report investigates Tracking Donot APT-C-35 Bangladesh Military Intrusion, covering the campaign’s targeting, tooling, infrastructure, and observed attacker tradecraft. Read more.

DINDoOR, DenoRAT, and NightshadeC2: TAG-150’s Evolving Tradecraft

Source: eSentire
(Published: July 15, 2026)

This report investigates DINDoOR, DenoRAT, and NightshadeC2: TAG-150’s Evolving Tradecraft, covering the campaign’s targeting, tooling, infrastructure, and observed attacker tradecraft. Read more.

Introducing CylindricalCanine: The GoldenEyeDog Subgroup Responsible for the April DigiCert Incident

Source: Expel
(Published: July 15, 2026)

This research details Introducing CylindricalCanine: The GoldenEyeDog Subgroup Responsible for the April DigiCert Incident, including how the software ecosystem was abused and what defenders can use to identify affected packages or systems. Read more.

Operation Fake KickOff: Attackers Abuse Recruiters and SaaS to Harvest Work Credentials

Source: Intel 471
(Published: July 15, 2026)

Intel 471 investigated an ongoing, multi-stage phishing operation that systematically abuses legitimate software-as-a-service sales and marketing platforms and cloud services to orchestrate corporate credential theft. Read more.

OkoBot Framework Targets Cryptocurrency Wallets

Source: Kaspersky Securelist
(Published: July 15, 2026)

This technical analysis examines OkoBot Framework Targets Cryptocurrency Wallets, including its delivery chain, execution behavior, persistence, command-and-control, and evasion techniques. Read more.

Unpacking the AsyncAPI npm Supply-Chain Compromise

Source: Microsoft
(Published: July 15, 2026)

This research details Unpacking the AsyncAPI npm Supply-Chain Compromise, including how the software ecosystem was abused and what defenders can use to identify affected packages or systems. Read more.

MuddyWater: ClickFix to Telegram & PatchAgent Backdoor

Source: Ransom-ISAC
(Published: July 15, 2026)

This report investigates MuddyWater: ClickFix to Telegram & PatchAgent Backdoor, covering the campaign’s targeting, tooling, infrastructure, and observed attacker tradecraft. Read more.

Telegram Account Compromised, Wallet Swapped: macOS Malware Analysis

Source: SlowMist
(Published: July 15, 2026)

This research analyzes Telegram Account Compromised, Wallet Swapped: macOS Malware Analysis, with attention to the lure, delivery infrastructure, credential-theft flow, and defensive indicators. Read more.

TuxBot v3: Evolution of an IoT Botnet

Source: Unit 42
(Published: July 15, 2026)

This technical analysis examines TuxBot v3: Evolution of an IoT Botnet, including its propagation, command-and-control design, capabilities, and infrastructure. Read more.

20+ Government Websites Hijacked: PhantomEnigma Investigation

Source: ANY.RUN
(Published: July 16, 2026)

An original threat intelligence investigation uncovered how trusted government infrastructure became an attack channel, placing banking organizations and public-sector systems at risk. Read more.

UAT-11795 Deploys Novel Starland RAT and Bespoke WLDR C2 Implant

Source: Cisco Talos
(Published: July 16, 2026)

This technical analysis examines UAT-11795 Deploys Novel Starland RAT and Bespoke WLDR C2 Implant, including its delivery chain, execution behavior, persistence, command-and-control, and evasion techniques. Read more.

TELEPUZ Malware-as-a-Service Uses ClickFix

Source: Elastic Security Labs
(Published: July 16, 2026)

This technical analysis examines TELEPUZ Malware-as-a-Service Uses ClickFix, including its delivery chain, execution behavior, persistence, command-and-control, and evasion techniques. Read more.

The TTF Trap: A Global Campaign of a Low-Detection Lua Loader

Source: Fortinet
(Published: July 16, 2026)

Since late March, 2026, we have been observing large-scale campaigns that use a combination of fileless techniques and Lua-based loaders with low detection rates to deploy various malware families, including Agent Tesla, Remcos, XWorm, and Best Private LOGGER. Read more.

ClickLock Stealer: macOS Malware

Source: Group-IB
(Published: July 16, 2026)

This technical analysis examines ClickLock Stealer: macOS Malware, including its delivery chain, execution behavior, persistence, command-and-control, and evasion techniques. Read more.

GoSerpent Backdoor in Southeast Asia

Source: Kaspersky Securelist
(Published: July 16, 2026)

This report investigates GoSerpent Backdoor in Southeast Asia, covering the campaign’s targeting, tooling, infrastructure, and observed attacker tradecraft. Read more.

Hiding in Plain Ledger: Four Months of a ClickFix Operator’s Blockchain C2

Source: Melted in Hex
(Published: July 16, 2026)

To hide its command-and-control server, this operation writes the address onto a public blockchain. Read more.

ACR Stealer: Two Observed Intrusion Chains

Source: Microsoft
(Published: July 16, 2026)

This technical analysis examines ACR Stealer: Two Observed Intrusion Chains, including its delivery chain, execution behavior, persistence, command-and-control, and evasion techniques. Read more.

StealC: A Commodity Stealer Loader

Source: Stairwell
(Published: July 16, 2026)

This technical analysis examines StealC: A Commodity Stealer Loader, including its delivery chain, execution behavior, persistence, command-and-control, and evasion techniques. Read more.

GigaWiper: Inside a Modular Cyberweapon

Source: PolySwarm
(Published: July 17, 2026)

This technical analysis examines GigaWiper: Inside a Modular Cyberweapon, including its delivery chain, execution behavior, persistence, command-and-control, and evasion techniques. Read more.

NadMesh Botnet Analysis: A Product-Grade Threat for the AI Service Era

Source: XLab
(Published: July 17, 2026)

This technical analysis examines NadMesh Botnet Analysis: A Product-Grade Threat for the AI Service Era, including its propagation, command-and-control design, capabilities, and infrastructure. Read more.

Contagious Interview Malware Uses SVG Steganography

Source: Elastic Security Labs
(Published: July 18, 2026)

This report investigates Contagious Interview Malware Uses SVG Steganography, covering the campaign’s targeting, tooling, infrastructure, and observed attacker tradecraft. Read more.

GitHub Poisoning Attack Disguised as Recruitment

Source: SlowMist
(Published: July 18, 2026)

This research details GitHub Poisoning Attack Disguised as Recruitment, including how the software ecosystem was abused and what defenders can use to identify affected packages or systems. Read more.

Hollowgraph: Microsoft 365 Espionage

Source: Group-IB
(Published: July 20, 2026)

This research examines Hollowgraph: Microsoft 365 Espionage, highlighting the principal attacker behaviors, technical findings, and defensive implications. Read more.

CloudAtlasGo Backdoor

Source: Kaspersky Securelist
(Published: July 20, 2026)

This report investigates CloudAtlasGo Backdoor, covering the campaign’s targeting, tooling, infrastructure, and observed attacker tradecraft. Read more.

Fake Games Spread Stealers With Ren’Py Loader, MSBuild, and EtherHiding

Source: Malwarebytes
(Published: July 20, 2026)

This technical analysis examines Fake Games Spread Stealers With Ren’Py Loader, MSBuild, and EtherHiding, including its delivery chain, execution behavior, persistence, command-and-control, and evasion techniques. Read more.

On-Chain Backdoor in a Malicious Trae Extension

Source: SlowMist
(Published: July 20, 2026)

This research details On-Chain Backdoor in a Malicious Trae Extension, including how the software ecosystem was abused and what defenders can use to identify affected packages or systems. Read more.

Kali365 Targets US Organizations With Device Code Phishing

Source: ANY.RUN
(Published: July 21, 2026)

Kali365 is targeting US organizations with device code phishing attacks that abuse legitimate Microsoft authentication. Read more.

Click to Sync: From Google Ads Maintenance Notice to Credential Theft

Source: Cofense
(Published: July 21, 2026)

This research analyzes Click to Sync: From Google Ads Maintenance Notice to Credential Theft, with attention to the lure, delivery infrastructure, credential-theft flow, and defensive indicators. Read more.

The Procurement Trap: An AiTM Campaign Targeting Global Institutions

Source: Infoblox
(Published: July 21, 2026)

This research analyzes The Procurement Trap: An AiTM Campaign Targeting Global Institutions, with attention to the lure, delivery infrastructure, credential-theft flow, and defensive indicators. Read more.

Project CAV3RN: Cyberespionage Framework Using Outlook and DNS

Source: Kaspersky Securelist
(Published: July 21, 2026)

This report investigates Project CAV3RN: Cyberespionage Framework Using Outlook and DNS, covering the campaign’s targeting, tooling, infrastructure, and observed attacker tradecraft. Read more.

INC Ransomware Affiliate Targets ESXi & NAS Devices in AD Environment

Source: Ctrl-Alt-Intel
(Published: July 22, 2026)

This research examines INC Ransomware Affiliate Targets ESXi & NAS Devices in AD Environment, including the intrusion chain, tooling, infrastructure, or operational tradecraft associated with the activity. Read more.

Email Bombing, IT Impersonation, Quick Assist, and Edgecution: UNC6692

Source: eSentire
(Published: July 22, 2026)

This research examines Email Bombing, IT Impersonation, Quick Assist, and Edgecution: UNC6692, highlighting the principal attacker behaviors, technical findings, and defensive implications. Read more.

Inside a TrickBot Variant Using DNS Tunneling for C2

Source: Fortinet
(Published: July 22, 2026)

FortiGuard Labs recently captured several malicious samples that were sending malformed DNS queries. Read more.

FakeAgent Claude Desktop Malvertising Ends in .NET RAT

Source: Huntress
(Published: July 22, 2026)

This technical analysis examines FakeAgent Claude Desktop Malvertising Ends in .NET RAT, including its delivery chain, execution behavior, persistence, command-and-control, and evasion techniques. Read more.

Cl0p Windchill/FlexPLM Exploitation

Source: Ransom-ISAC
(Published: July 22, 2026)

This research examines Cl0p Windchill/FlexPLM Exploitation, including the intrusion chain, tooling, infrastructure, or operational tradecraft associated with the activity. Read more.

Malicious Copilot MCP Apex npm Package Delivers macOS Infostealer

Source: SafeDep
(Published: July 22, 2026)

This research details Malicious Copilot MCP Apex npm Package Delivers macOS Infostealer, including how the software ecosystem was abused and what defenders can use to identify affected packages or systems. Read more.

Rondo Meets GeoServer

Source: SANS ISC
(Published: July 22, 2026)

This analysis examines Rondo Meets GeoServer, including observed exploitation activity, post-exploitation behavior, and relevant defensive guidance. Read more.

Chaos ransomware’s msaRAT: Living off the browser to build a covert C2 channel

Source: Cisco Talos
(Published: July 23, 2026)

This research examines Chaos ransomware’s msaRAT: Living off the browser to build a covert C2 channel, including the intrusion chain, tooling, infrastructure, or operational tradecraft associated with the activity. Read more.

JadeProx: China-Nexus TRIBACK Loader

Source: Group-IB
(Published: July 23, 2026)

This report investigates JadeProx: China-Nexus TRIBACK Loader, covering the campaign’s targeting, tooling, infrastructure, and observed attacker tradecraft. Read more.

TA488 Targets Zimbra Mail Servers With Half-Click Exploits

Source: Proofpoint
(Published: July 23, 2026)

This report investigates TA488 Targets Zimbra Mail Servers With Half-Click Exploits, covering the campaign’s targeting, tooling, infrastructure, and observed attacker tradecraft. Read more.

Russian Webmail Espionage

Source: Unit 42
(Published: July 23, 2026)

Unit 42 has observed a persistent cyberespionage campaign it tracks as CL-STA-1114. Read more.

The Gentlemen RaaS: Origins, OPSEC & OSINT

Source: Ctrl-Alt-Intel
(Published: July 24, 2026)

This research examines The Gentlemen RaaS: Origins, OPSEC & OSINT, including the intrusion chain, tooling, infrastructure, or operational tradecraft associated with the activity. Read more.

Inside a DPRK BlueNoroff ClickFix Kit

Source: JUMPSEC
(Published: July 24, 2026)

This report investigates Inside a DPRK BlueNoroff ClickFix Kit, covering the campaign’s targeting, tooling, infrastructure, and observed attacker tradecraft. Read more.

MrMustard Malicious PyPI Package

Source: SafeDep
(Published: July 24, 2026)

This research details MrMustard Malicious PyPI Package, including how the software ecosystem was abused and what defenders can use to identify affected packages or systems. Read more.

Dysphoria Botnet Evolution and Technical Analysis

Source: XLab
(Published: July 25, 2026)

This technical analysis examines Dysphoria Botnet Evolution and Technical Analysis, including its propagation, command-and-control design, capabilities, and infrastructure. Read more.

From Compliant Emails to Remote Control: A Web3 Investigation

Source: SlowMist
(Published: July 26, 2026)

This research examines From Compliant Emails to Remote Control: A Web3 Investigation, highlighting the principal attacker behaviors, technical findings, and defensive implications. Read more.

The Zedxion Corporate Nexus

Source: DomainTools
(Published: July 27, 2026)

This research maps The Zedxion Corporate Nexus, highlighting infrastructure relationships, operational patterns, and detection opportunities. Read more.

The Telegram Malware Ecosystem

Source: Ransom-ISAC
(Published: July 27, 2026)

This technical analysis examines The Telegram Malware Ecosystem, including its delivery chain, execution behavior, persistence, command-and-control, and evasion techniques. Read more.

Top ATT&CK Techniques Observed

• T1195 – Supply Chain Compromise: Software supply chain attacks remained one of the dominant themes, with compromises affecting npm packages, developer tools, IDE plugins, SDKs, and CI/CD workflows.
• T1566 – Phishing: Attackers continued to rely on shopping scams, WhatsApp campaigns, fake domain renewals, Bubble.io phishing, and AI-themed lures to steal credentials.
• T1555 / T1556 – Credential Access: Multiple campaigns targeted developer credentials, AI API keys, browser sessions, enterprise logins, and cloud identities.
• T1071 – Application Layer Protocol: Modern malware increasingly used cloud services, collaboration platforms, blockchain infrastructure, and encrypted channels for command-and-control.
• T1055 / T1059 – Defense Evasion & Execution: Attackers continued adopting reflective loading, DLL sideloading, steganography, PowerShell, and in-memory execution to reduce detection.

What Matters Most

• Developer ecosystems remain under sustained attack. AI frameworks, npm packages, JetBrains plugins, SDKs, and developer tooling were repeatedly compromised during this reporting period.
• Credential theft continues to drive intrusions. Whether targeting developers, cloud administrators, or end users, most campaigns ultimately sought credentials, tokens, or session access.
• Supply chain attacks are expanding beyond package managers. Threat actors increasingly target plugins, extensions, SDKs, repositories, and software update mechanisms.
• Nation-state operations remain highly active. Multiple reports covered activity linked to China- and DPRK-aligned actors, as well as campaigns targeting government, healthcare, and critical infrastructure.

What Defenders Should Watch

• Unexpected package updates, dependency changes, IDE plugins, or CI/CD modifications
• Credential theft targeting AI platforms, developer accounts, and enterprise cloud services
• Execution from temporary folders, archive contents, DLL sideloading, and script interpreters
• Outbound connections to newly observed infrastructure, cloud services, and fast-changing C2 endpoints

Quick Wins

• Review package trust policies and require verification for new dependencies
• Monitor AI platform credentials and API keys alongside traditional privileged accounts
• Strengthen detection for phishing-resistant authentication and suspicious session activity
• Audit developer workstations and CI/CD pipelines for unauthorized changes or plugins

Key Insight: This period marked another shift toward attacks on software development ecosystems. Rather than targeting only end users, threat actors increasingly compromised developer tools, package repositories, and AI-related workflows to gain access to organizations and their cloud environments.

May 2026 Infostealer Trend Report

Source: AhnLab ASEC
(Published: 17 June 2026)
This report summarizes the distribution channels, number of infostealers, number of detections, target companies, and execution types of new infostealers collected during the month of May 2026. Read more.

More Than 4,000 Legacy Routers Compromised by AryStinger, Turned into Global Attack Proxies for Hackers

Source: Qianxin XLab
(Published: 17 June 2026)
On May 20, 2026, the Ministry of State Security’s WeChat official account published an article “Your internet is slow, and the culprit turns out to be this!”, highlighting that outdated routers are becoming a key entry point for threat actors to conduct cyber espionage. Read more.

AdaptixC2: Fingerprinting an Open-Source C2 Framework at Scale

Source: Censys
(Published: 17 June 2026)
AdaptixC2 is an open-source post-exploitation framework with a default configuration that makes deployed servers trivially identifiable from passive scanning. Read more.

Klue Integration Abused in Salesforce Data Theft

Source: ReliaQuest
(Published: 17 June 2026)
In June 2026, ReliaQuest observed a compromised integration for Klue, a competitive-intelligence platform that syncs battlecard and win/loss data with Salesforce, being used to exfiltrate customer relationship management (CRM) data. Read more.

Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat

Source: StepSecurity
(Published: 17 June 2026)
On June 17, 2026, an attacker compromised the @mastra npm organization and quietly added easy-day-js as a dependency across 140+ packages in the Mastra AI framework ecosystem. Read more.

Mastra Supply Chain Compromise: easy-day-js Dropper Pulls a Cross-Platform RAT Into @mastra Installs

Source: Upwind
(Published: 17 June 2026)
On June 17 2026, a coordinated supply chain attack pushed a malicious easy-day-js package into the dependency tree of the entire @mastra/* npm organization. Read more.

PureRAT Variant Observed in AI Video Player

Source: Luke Acha
(Published: 17 June 2026)
Follow-up analysis of extracted .NET loader stage, internally named Ykzrh.exe (smveo-csharp-agent.exe) in one recovered artifact, revealed a substantial virtualization and runtime reconstruction layer. Read more.

Prinz Eugen Ransomware: A Deep Dive Into a New Go-Based Encryptor

Source: ThreatDown
(Published: 17 June 2026)
On May 11, 2026, our research team investigated a customer infected with a brand-new ransomware family called Prinz Eugen. Read more.

Operation FanTrap: Inside the FIFA 2026 Fraud Ecosystem

Source: Cyble
(Published: 18 June 2026)
The FIFA World Cup 2026 has become more than a global sporting event. Read more.

Mastra Attack Targets Crypto, Password Managers, Authenticators, and Zapier

Source: OpenSourceMalware
(Published: 18 June 2026)
A threat actor compromised the Mastro NPM organization yesterday and published more than 140 malicious packages. Read more.

15 Malicious JetBrains Plugins Stole AI API Keys from 70,000 Developers

Source: StepSecurity
(Published: 18 June 2026)
On June 16, 2026, JetBrains received security reports identifying a coordinated supply chain attack involving 15 malicious third-party plugins on the JetBrains Marketplace. Read more.

Killing Me Gently: Inside Gentlemen’s EDR Killer Framework

Source: ESET Research
(Published: 18 June 2026)
ESET Research shares the results of a months-long investigation into the suite of EDR killers maintained by the RaaS gang Gentlemen. Read more.

SmartApeSG Launches Okendo Reviews Supply Chain Attack

Source: Zscaler
(Published: 18 June 2026)
On May 14, 2026, the Zscaler ThreatLabz team identified unusually high activity associated with the threat actor SmartApeSG to deploy malware. Read more.

Amazon Prime Day 2026: Bargains Begin June 23 – and So Do the Scams

Source: Check Point Research
(Published: 19 June 2026)
When Amazon Prime Day returns on June 23-26, 2026, more than 25 countries will take part in one of the largest shopping windows of the year. Read more.

OXLOADER: New Loader Evading Detection to Drop Infostealer

Source: Elastic Security Labs
(Published: 19 June 2026)
After all the checks have passed, the malware makes a copy of the Windows DirectUI Engine DLL (C:\Windows\System32\dui70.dll), storing it in a temporary location using a randomly generated name with the .ocx extension. Read more.

Threat Actors Weaponizing RAR Archives to Target Thailand’s Healthcare Sector

Source: Seqrite
(Published: 19 June 2026)
Authors: Vaibhav Krushna Billade, Dixit Panchal & Rumana Siddiqui. Read more.

MyBait: Why We Lured Attackers To Encrypt Our Cloud MySQL

Source: Varonis
(Published: 19 June 2026)
Varonis Threat Labs deployed MySQL honeypots across GCP, AWS, and Azure. Read more.

@withgoogle/stitch-sdk: Scope Squat Harvests Developer Credentials

Source: SafeDep
(Published: 19 June 2026)
A malicious npm package published under @withgoogle/stitch-sdk impersonates Google’s Stitch AI design tool by squatting the @withgoogle npm scope. Read more.

FortiBleed: Anatomy of the FortiBleed Campaign Based on the Server That the Attackers Themselves Left Exposed

Source: ZenoX
(Published: 20 June 2026)
In June 19 2026 we received access to the contents of an internet-exposed directory, left open by the operators themselves of a campaign the press named FortiBleed. Read more.

A Multi-Stage Steganographic Loader Campaign Deploying Diverse Payloads Globally

Source: K7 Labs
(Published: 20 June 2026)
The final payload achieves its persistence through the Run entry, winlogon.exe, & userinit. Read more.

From PostCSS Masquerading to Windows RAT

Source: JFrog Security Research
(Published: 20 June 2026)
The downloaded bundle was not a simple script. Read more.

A VBScript Campaign Distributed Through WhatsApp Deploying RMM Software

Source: Kaspersky Securelist
(Published: 22 June 2026)
In June 2026, we observed a malware campaign distributing malicious VBScript files through direct messages in WhatsApp. Read more.

USB Worm CryptoBandits Steals Cryptocurrency via Windows Shortcut Files

Source: ThreatAft
(Published: 22 June 2026)
A financially motivated USB worm campaign has been actively stealing cryptocurrency from Windows users worldwide since at least February 2026. Read more.

What Was a 45-GPU Cracking Farm Built For?

Source: ThreatMon
(Published: 22 June 2026)
Most credential leaks are messy. Someone dumps a pile of raw data, half of it stale, and walks away. Read more.

EvilTokens: How “Ghost” Code Threatens US and European Businesses

Source: ANY.RUN
(Published: 23 June 2026)
EvilTokens can hide serious account takeover risk from your SOC through “ghost” code that appears only after browser-side decryption. Read more.

Inside FortiBleed: Reverse Engineering the CyberStrike Harvester Behind a Global FortiGate Credential Factory

Source: Arctic Wolf
(Published: 23 June 2026)
Arctic Wolf reverse-engineered a recovered CyberStrike Harvester binary and connected it to the broader FortiBleed operator workflow, showing how exposed perimeter credentials can quickly become full internal-network exposure. Read more.

CVE-2025-54068 Laravel Livewire Credential Theft Campaign: 6,000+ Applications Compromised

Source: Imperva
(Published: 24 June 2026)
The campaign, first documented here, has been running for several months, as evidenced by the large volume of stolen data. Read more.

A Burst Bubble: How Threat Actors Are Using Bubble.io to Deliver a New Phishing Campaign

Source: S-RM
(Published: 24 June 2026)
The login follows the expected Microsoft login flow, but it is using the dynamic pages copied from Microsoft’s flow but on the threat actors content delivery network. Read more.

Edgecution: Malicious Edge Extension Backdoor

Source: Zscaler
(Published: 24 June 2026)
Edgecution is a malicious Microsoft Edge extension backdoor associated with ransomware initial access activity. Read more.

May 2026 Threat Trend Report on APT Attacks (South Korea)

Source: AhnLab ASEC
(Published: 24 June 2026)
This report provides a statistical summary and analysis of APT attacks targeting South Korea in May 2026. Read more.

Operation Navy Ghost: How Attackers Planted a Telegram-Powered Backdoor Across Fake pyrogram Packages on PyPI

Source: Checkmarx
(Published: 25 June 2026)
When the attacker sends “/asu print(os.environ)” to the victim’s bot, this function compiles and executes that Python code on the victim’s machine. Read more.

Threat Intelligence Report: Nation-State Targeting of Water Systems 2024-2026

Source: DomainTools
(Published: 25 June 2026)
DomainTools assesses nation-state targeting of water systems from 2024 through 2026, including activity linked to Iran, Russia, and China. Read more.

Coinbase Cartel: Behind the Noise of a Prolific Leak Operation

Source: Intrinsec
(Published: 25 June 2026)
Coinbase Cartel is a prolific leak operation built around high-volume extortion activity and public data exposure claims. Read more.

Fake Domain Renewal Emails Trick Website Owners Into Paying Scammers

Source: Malwarebytes
(Published: 25 June 2026)
Scammers are sending fake domain renewal notices to trick website owners into paying fraudulent invoices. Read more.

Negative SEO Attack: Inside a Black Hat SEO Operation

Source: Zynap
(Published: 25 June 2026)
Negative SEO is a form of search engine manipulation aimed not at boosting the attacker’s own site, but at damaging the ranking, reputation, or visibility of a target domain. Read more.

Operation Turb00 – Part 2: A Multi-Stage HijackLoader Campaign Delivers Vidar v2.1

Source: Medium
(Published: 26 June 2026)
This is the second post in a three-part series on the Vidar infostealer and the infrastructure behind it. Read more.

From CI/CD to Cloud Data: How Shai-Hulud Persistence Leads to Redshift Breach

Source: Fortinet
(Published: 26 June 2026)
The “Shai-Hulud: The Second Coming” campaign represents a major evolution in the landscape of npm supply-chain attacks. Read more.

Beyond Banking Trojans: Rokarolla Expands the Android Fraud Playbook

Source: PolySwarm
(Published: 26 June 2026)
Rokarolla represents a new generation of Android fraud tooling that extends beyond traditional banking trojan behavior. Read more.

Gaslight: The Rust-Powered macOS Implant Designed to Mislead AI Tools

Source: HivePro
(Published: 26 June 2026)
Gaslight (macOS.Gaslight) is a Rust-based macOS implant and information stealer attributed with high confidence to DPRK-aligned activity, first seen on May 22, 2026 and targeting macOS systems worldwide. Read more.

Investigating a Novel OpenAI Poisoned Tenant Attack

Source: Push Security
(Published: 26 June 2026)
Push Security investigated a poisoned tenant attack that abused OpenAI-related workflows to target identity and application access. Read more.

Understanding Langflow CVE-2026-55255, and Why Higher CVSS Vulnerabilities Aren’t Always the Most Exploited

Source: Sysdig
(Published: 26 June 2026)
Sysdig analyzes Langflow CVE-2026-55255 and explains why vulnerabilities with lower scores may see heavier attacker adoption than higher-severity flaws. Read more.

Anatomy of a WHQL-Signed Windows Filtering Platform Kernel-Resident Network Backdoor

Source: Nextron Systems
(Published: 26 June 2026)
Nextron Systems analyzes a WHQL-signed Windows Filtering Platform kernel-resident network backdoor. Read more.

Operation DragonReturn: China-Nexus Cyber Espionage Campaign Targeting Govt. of India/MoF Tax Infrastructure via Multi-Stage DcRAT Deployment

Source: Seqrite
(Published: 26 June 2026)
Seqrite Lab actively tracks and analyse threat actors and their campaigns, focusing on attribution, infrastructure analysis, and adversary tradecraft. Read more.

Mustang Panda Targets India’s Government and Energy Sectors with ZOHOMURK and MINIRECON

Source: Acronis
(Published: 28 June 2026)
Our investigation began after identifying a suspicious archive, Hydropower Cooperation Project Proposal.zip, believed to have been distributed via spear-phishing and subsequently uploaded to VirusTotal in May 2026. Read more.

SystemBC Malware: How the Coroxy Proxy Backdoor Targets Windows

Source: Picus Security
(Published: 29 June 2026)
SystemBC, also tracked as Coroxy, is a Windows malware family that primarily turns an infected machine into a SOCKS5 proxy while also functioning as a persistent backdoor and RAT. Read more.

TONResolver RAT Abuses TON Blockchain to Target Japan’s Hotel Industry

Source: Trend Micro
(Published: 29 June 2026)
In this blog entry, TrendAI™ Research examines a wave of phishing emails observed in May 2026 that targeted Japanese accommodation facilities using Booking.com, detailing the victims, attack techniques used, and characteristics of the malware involved. Read more.

The Gentlemen Are Knocking: Custom Backdoors and Evolving Tactics

Source: Kaspersky Securelist
(Published: 29 June 2026)
This year saw the emergence of The Gentlemen, a prominent example of a group operating under the ransomware-as-a-service model. Read more.

RustDuck: An In-Depth Analysis of a Two-Stage Botnet

Source: Qianxin XLab
(Published: 29 June 2026)
Although the family’s current activity level and influence in DDoS attacks are not yet comparable to some mainstream botnets, its speed of technological evolution deserves significant attention. Read more.

UAC-0184 Tooling Evolution: OneDrive Sideload to Remcos

Source: Synaptic Systems
(Published: 29 June 2026)
Launching shortcuts directly from an archive can behave differently depending on the archive utility and extraction context. Read more.

Inside Kimsuky’s CHM Tradecraft: Multi-Stage Execution and Selective Payload Delivery

Source: Synaptic Systems
(Published: 29 June 2026)
The visible text comments on the structure of a manuscript, including sections covering diversion of civilian resources to military spending, degradation of agricultural production, and inequality in food distribution. Read more.

From CitrixBleed 2 to Cloudflared: The Tools and Techniques Behind Anubis Ransomware Attacks

Source: Arctic Wolf
(Published: 30 June 2026)
Arctic Wolf Labs observed Anubis ransomware attacks using CitrixBleed 2 exploitation and Cloudflared tunneling as part of the intrusion chain. Read more.

Glitch SPY: An Emerging Android RAT Distributed Through a Fake Polish Rental App

Source: Cyble
(Published: 30 June 2026)
Cyble Research and Intelligence Labs identified an emerging Android malware family tracked as Glitch SPY, distributed through a fraudulent Polish apartment and house rental platform designed to lure users into downloading an Android APK. Read more.

Not Very Gentlemanly: Analyzing a Zero-Day Exploit Used by The Gentlemen Ransomware to Disable Targets’ EDRs

Source: Expel
(Published: 30 June 2026)
Ransomware groups have long relied on disabling endpoint detection and response tools before deploying their payloads, and in recent years have utilized bring-your-own-vulnerable-driver attacks to do so. Read more.

The Polymarket Trap: A Fake Arbitrage Bot, Ten npm Accounts, and Four Ways to Deliver an Infostealer

Source: SafeDep
(Published: 30 June 2026)
A set of small npm packages, GitHub repositories, and matching themes were used to lure developers into installing infostealer code disguised as Polymarket arbitrage tooling. Read more.

ToddyCat: Your Hidden Email Assistant. Part 2

Source: Kaspersky Securelist
(Published: 30 June 2026)
We continue to share details on the malicious techniques and toolsets used by the ToddyCat APT group. Read more.

No (Bad) CAP: Inside an Ongoing LSHIY Password Spray Attack

Source: Huntress
(Published: 30 June 2026)
The targeting of these attacks seems to be based entirely on password prevalence on compromised password combo lists, and is not specific to business type or industry. Read more.

Silent Swap: A Crypto Clipper Extension Campaign

Source: McAfee
(Published: 30 June 2026)
McAfee Labs analyzed a browser extension campaign designed to swap cryptocurrency wallet addresses and redirect payments to attacker-controlled wallets. Read more.

These insights summarize the most common attacker behaviors, techniques, and defensive themes observed across the threat research featured below, helping highlight what mattered most during this reporting period.

ASEC Threat Report

Source: AhnLab ASEC
(Published: 20 May 2026)
ASEC analyzed recent malware and phishing activity affecting users and organizations. Read more.

From Token Bingo to MAX Takeover: Kali365 Expands Into AWS, Microsoft, Okta, Xerox, MAX Messenger

Source: Arctic Wolf
(Published: 21 May 2026)
Kali365 operators expanded their account takeover operation across cloud, identity, messaging, and business platforms. Read more.

SEO Poisoning Campaign Leverages Gemini and Claude Code Impersonation to Deliver Infostealer

Source: EclecticIQ
(Published: 21 May 2026)
Financially motivated eCrime actors are impersonating AI developer tools to compromise workstations and steal sensitive data. Read more.

Fake Apps Deliver DonutLoader and Remcos RAT

Source: G DATA
(Published: 21 May 2026)
Researchers analyzed a malware campaign using fake applications to deliver DonutLoader and Remcos RAT. Read more.

Lazarus Expands Financial Espionage Operations With Memory-Resident RemotePE RAT

Source: PolySwarm
(Published: 22 May 2026)
Lazarus-linked operators are expanding financial espionage with memory-resident malware and follow-on tooling. Read more.

SolyxImmortal: Analysis of a Python-Based Information Stealer

Source: Pulsedive
(Published: 22 May 2026)
Researchers analyzed SolyxImmortal, a Python-based infostealer targeting credentials and sensitive data. Read more.

Gamaredon’s Matryoshka Campaign Keeps Unpacking Gammaphish and Gammaworm

Source: Sekoia
(Published: 22 May 2026)
Sekoia analyzed a Gamaredon campaign using layered delivery techniques to deploy Gammaphish and Gammaworm payloads. Read more.

UAC-0247 Malware Targeting FPV Operators

Source: Synaptic Systems
(Published: 23 May 2026)
Researchers identified malware activity targeting FPV operators in a campaign tied to UAC-0247. Read more.

The Art of Being Ungovernable

Source: Cisco Talos
(Published: 23 May 2026)
Cisco Talos examined threat activity involving evasion, persistence, and abuse of infrastructure. Read more.

Ghost CMS Mass Compromised via CVE-2026-26980 Now Fueling ClickFix Attacks

Source: Qianxin XLab
(Published: 23 May 2026)
Attackers are exploiting Ghost CMS at scale to fuel ClickFix-style attacks and malicious infrastructure. Read more.

Mustang Panda PlugX Analysis: A Multi-Layer Execution Chain

Source: BlueCyber
(Published: 24 May 2026)
Researchers analyzed a Mustang Panda PlugX sample using a multi-layer execution chain. Read more.

CERT-UA Article 6315762

Source: CERT-UA
(Published: 24 May 2026)
CERT-UA published an advisory describing recent cyber activity and defensive guidance. Read more.

FortiClient EMS Exploited via CVE-2026-35616 to Deliver EKZ Infostealer Disguised as a Fortinet Patch

Source: Arctic Wolf
(Published: 27 May 2026)
Arctic Wolf observed a threat cluster exploiting CVE-2026-35616 to deploy an infostealer disguised as a Fortinet patch to FortiClient EMS-managed endpoints. Read more.

KnowledgeDeliver: ViewState Deserialization Vulnerability Exploitation

Source: Google Cloud
(Published: 27 May 2026)
Google Threat Intelligence analyzed exploitation activity involving a ViewState deserialization vulnerability. Read more.

AzureVeil Spearphishing Delivers C2

Source: CyberPress
(Published: 27 May 2026)
AzureVeil uses spearphishing to deliver command-and-control tooling against targeted victims. Read more.

China APT Webworm Hides European Government Espionage Traffic Inside Discord and Microsoft Cloud

Source: CyberSecSentinel
(Published: 27 May 2026)
A China-linked APT is hiding espionage traffic inside trusted cloud and collaboration platforms. Read more.

OverlayPhantom Android Banking Trojan

Source: Cyble
(Published: 28 May 2026)
Cyble analyzed OverlayPhantom, an Android banking trojan abusing overlay techniques to steal financial data. Read more.

Modern Supply Chain Intrusions: From CI/CD Abuse to Ecosystem-Wide Compromise

Source: DarkAtlas
(Published: 28 May 2026)
Researchers examined supply chain intrusions abusing CI/CD workflows and trusted developer ecosystems. Read more.

The Gentlemen Russia RaaS Operation Rocket Leak Analysis

Source: FalconFeeds
(Published: 28 May 2026)
FalconFeeds analyzed leaked materials related to The Gentlemen ransomware-as-a-service operation. Read more.

Inside CrowdStrike’s Takedown of a Developer-Targeting Botnet

Source: CrowdStrike
(Published: 28 May 2026)
CrowdStrike detailed a takedown operation against a botnet targeting developers and software ecosystems. Read more.

Codestorm: A Microsoft 365 AiTM Phishing Kit With Storm-1167 Overlap

Source: HexaStrike
(Published: 29 May 2026)
Codestorm is a Microsoft 365 adversary-in-the-middle phishing kit with overlap to Storm-1167 activity. Read more.

Tracking North Korea Nation-State APT Infrastructure: Kimsuky

Source: Idan Malihi
(Published: 29 May 2026)
Researchers mapped infrastructure associated with Kimsuky-linked North Korean operations. Read more.

Fake Microsoft Teams Campaign Delivers ValleyRAT

Source: K7 Computing
(Published: 29 May 2026)
Threat actors are using fake Microsoft Teams lures to deliver ValleyRAT through NSIS installers and DLL sideloading. Read more.

FlutterBridge: New FlutterShell Backdoor

Source: Unit 42 (Palo Alto Networks)
(Published: 29 May 2026)
Unit 42 analyzed FlutterBridge, a new FlutterShell backdoor used in targeted activity. Read more.

Tracking Tampered Chef Clusters

Source: Unit 42 (Palo Alto Networks)
(Published: 29 May 2026)
Researchers tracked compromised Chef clusters and related attacker tradecraft. Read more.

Stealthy P2P Cryptominer Targets Ollama Endpoints

Source: Akamai
(Published: 29 May 2026)
Akamai observed a stealthy peer-to-peer cryptominer targeting exposed Ollama endpoints. Read more.

GreyVibe

Source: WithSecure Labs
(Published: 30 May 2026)
WithSecure analyzed GreyVibe malware activity and related tradecraft. Read more.

LLMShare Malvertising Campaign

Source: Push Security
(Published: 30 May 2026)
Push Security analyzed a malvertising campaign abusing LLM-themed lures to target users. Read more.

Laravel Lang Supply Chain Advisory

Source: Snyk
(Published: 30 May 2026)
Snyk disclosed a Laravel Lang supply chain compromise affecting package users and downstream environments. Read more.

Laravel Lang Compromise

Source: Socket
(Published: 30 May 2026)
Socket analyzed a compromise affecting Laravel Lang packages in the open-source ecosystem. Read more.

AI Agent at the Wheel: From CVE to Internal Database in Four Pivots

Source: Sysdig
(Published: 30 May 2026)
Sysdig analyzed how an attacker used LLMs to move from vulnerability exploitation to an internal database in four pivots. Read more.

Supply Chain Attack Targets Laravel-Lang Packages With Credential Stealer

Source: Aikido
(Published: 30 May 2026)
Aikido analyzed a Laravel-Lang supply chain attack that introduced credential-stealing code into package workflows. Read more.

Fake Claude Code Installer Infostealer

Source: Cyderes
(Published: 30 May 2026)
Cyderes analyzed a fake Claude Code installer used to deliver infostealer malware. Read more.

Kimsuky’s Advanced Attack Techniques: JSONPing, WebEx Spoofing, and HTTPSpy Variant

Source: ENKI
(Published: 30 May 2026)
Researchers analyzed advanced Kimsuky techniques involving JSONPing, WebEx spoofing, and a new HTTPSPY variant. Read more.

Trapdoor: Cross-Ecosystem Supply-Chain Credential Theft Operation

Source: SlowMist
(Published: 31 May 2026)
Researchers analyzed Trapdoor, a cross-ecosystem supply chain operation designed to steal credentials. Read more.

Nimbus RAT Abuses Microsoft Teams and Google Drive to Deploy Java RAT

Source: eSentire
(Published: 31 May 2026)
Threat actors are abusing Microsoft Teams and Google Drive to deploy Nimbus RAT. Read more.

Misconfigured, Enrolled, and Dormant: Anatomy of a P2PInfect Kubernetes Compromise

Source: Fortinet
(Published: 31 May 2026)
Fortinet analyzed a Kubernetes compromise involving P2PInfect activity and misconfigured cluster exposure. Read more.

Ghost Stadium Football Fraud

Source: Group-IB
(Published: 31 May 2026)
Group-IB analyzed football-themed fraud infrastructure targeting users with deceptive campaigns. Read more.

The Gentlemen Ransomware Defense Evasion TTPs

Source: Huntress
(Published: 31 May 2026)
Huntress analyzed defense evasion techniques used by The Gentlemen ransomware operators. Read more.

Pivoting on a Malspam Infrastructure Delivering JS Malware

Source: Intrinsec
(Published: 31 May 2026)
Intrinsec tracked malspam infrastructure used to deliver JavaScript malware through bulletproof networks. Read more.

From Fake Purchase Orders to Remote Access: Analyzing the JS.MonoGlyphRAT Threat to US Enterprises

Source: ANY.RUN
(Published: 02 June 2026)
Learn how JS.MonoGlyphRAT targets organizations, enables remote access, and creates costly security risks. Read more.

These Convincing Copyright Notices Are Designed to Steal Google Logins

Source: Security Boulevard
(Published: 02 June 2026)
Scammers use fake takedown requests, countdown timers, and spoofed sign-in screens to steal Google logins from Chrome developers. Read more.

New npm Supply Chain Attack: Red Hat Cloud Services Compromised

Source: OX Security
(Published: 02 June 2026)
A new npm supply chain attack compromised packages associated with Red Hat Cloud Services. Read more.

Rapid7 Observed Exploitation of PAN-OS GlobalProtect Authentication Bypass CVE-2026-0257

Source: Rapid7
(Published: 02 June 2026)
Rapid7 observed exploitation of a PAN-OS GlobalProtect authentication bypass vulnerability tracked as CVE-2026-0257. Read more.

ATMZOW Skimmer

Source: Reflectiz
(Published: 02 June 2026)
Reflectiz analyzed ATMZOW, a skimmer campaign targeting payment data through compromised web infrastructure. Read more.

Hunting Megalodon Fossils

Source: ReversingLabs
(Published: 02 June 2026)
ReversingLabs described hunting techniques for identifying Megalodon-related malware artifacts and infrastructure. Read more.

Red Hat Cloud Service npm Packages Backdoored in 72 Seconds

Source: ReversingLabs
(Published: 02 June 2026)
Researchers analyzed how Red Hat Cloud Service npm packages were backdoored shortly after compromise. Read more.

Operation Dragon Weave Targets Czech Republic and Taiwan Using Azure Cloud C2

Source: Seqrite
(Published: 02 June 2026)
Seqrite uncovered a China-linked campaign targeting Czech Republic and Taiwan using Azure cloud command-and-control. Read more.

DriveSurge

Source: Silent Push
(Published: 02 June 2026)
Silent Push analyzed DriveSurge infrastructure and related threat activity. Read more.

GitHub Internal Repositories Breached

Source: Sophos
(Published: 02 June 2026)
Sophos analyzed activity involving breached internal GitHub repositories and related security implications. Read more.

Multiple Red Hat Cloud Services npm Packages Compromised

Source: StepSecurity
(Published: 02 June 2026)
StepSecurity analyzed multiple compromised Red Hat Cloud Services npm packages and associated supply-chain risks. Read more.

Kali365 PhaaS Inside Attack Infrastructure

Source: Todyl
(Published: 02 June 2026)
Todyl analyzed Kali365 phishing-as-a-service infrastructure and its role in account compromise operations. Read more.

Void Dokkaebi Uses InvisibleFerret Malware

Source: Trend Micro
(Published: 02 June 2026)
Trend Micro analyzed Void Dokkaebi activity using InvisibleFerret malware in targeted campaigns. Read more.

Smart Contracts for Command and Control

Source: Trend Micro
(Published: 02 June 2026)
Trend Micro analyzed attacker use of smart contracts as command-and-control infrastructure. Read more.

Validin Python SDK for Threat Monitoring

Source: Validin
(Published: 02 June 2026)
Validin introduced a Python SDK for threat monitoring and infrastructure analysis workflows. Read more.

Webworm: New Burrowing Techniques

Source: ESET Research
(Published: 02 June 2026)
ESET Research analyzed Webworm’s new techniques for persistence, stealth, and intrusion activity. Read more.

Threat Actors Target Crypto Organizations

Source: Wiz
(Published: 02 June 2026)
Wiz analyzed attacker targeting of cryptocurrency organizations and related cloud security risks. Read more.

Wiz Sensor Forensics GA

Source: Wiz
(Published: 02 June 2026)
Wiz announced forensic capabilities for incident response and cloud investigation workflows. Read more.

Premium Deception: Global Android Carrier Billing Fraud Campaign

Source: Zimperium
(Published: 02 June 2026)
Zimperium uncovered a global Android carrier billing fraud campaign using deceptive premium service flows. Read more.

These insights summarize the most common attacker behaviors, techniques, and defensive themes observed across the threat research featured below, helping highlight what mattered most during this reporting period.

Top ATT&CK Techniques Observed

• T1195 – Supply Chain Compromise (9/9): npm, PyPI, OpenSearch, TanStack, TeamPCP, and Shai-Hulud activity dominated this period.
• T1566 – Phishing / Social Engineering (8/9): Smishing, OAuth device-code phishing, fake apps, aid-themed lures, and AI-assisted campaigns remained prominent.
• T1555 – Credential Access (8/9): Infostealers, banking trojans, OAuth token theft, and cloud credential harvesting appeared across multiple campaigns.
• T1059 – Command Execution (7/9): PowerShell, Python, Bun, Git hooks, loaders, and RATs supported multi-stage execution chains.
• T1071 – Application Layer C2 (7/9): Telegram, NATS, Microsoft Teams, and other trusted channels were abused for C2 and operations.

What Matters Most

• Supply chain attacks remain the clearest trend. Developer ecosystems and package managers continue to be used for scalable access.
• Credential theft is the common objective. Many campaigns ultimately target passwords, sessions, tokens, banking data, or cloud keys.
• AI is moving into attacker workflows. Adversaries are using AI for exploitation, lures, targeting, and operational scale.
• Trusted platforms are being abused. Teams, Git hooks, package repositories, and cloud services are central to multiple attack chains.

What Defenders Should Watch

• Unexpected package installs, Git hook activity, or developer tool execution
• OAuth device-code abuse, suspicious MFA flows, and session theft patterns
• Outbound traffic to Telegram, NATS, cloud-hosted, or newly observed infrastructure
• Infostealer behavior targeting browsers, wallets, tokens, and cloud credentials

Quick Wins

• Restrict and monitor package manager activity in developer environments
• Review OAuth app approvals and device-code authentication policies
• Alert on execution from temp, download, and user-controlled directories
• Block newly registered domains tied to phishing, fake apps, and software lures

Key Insight: Attackers are increasingly abusing trusted developer ecosystems, social engineering campaigns, and cloud platforms to scale operations, with credential theft remaining the primary objective.

Mini Shai-Hulud: Cross-Ecosystem Supply Chain Worm Targeting npm and PyPI

Source: Expel
(Published: 06 May 2026)
Expel researchers detail Mini Shai-Hulud, a wormable supply chain campaign targeting both npm and PyPI ecosystems to spread malicious packages. Read more.

Inside a Criminal Phishing Panel

Source: Push Security
(Published: 06 May 2026)
Push Security analyzes a modern phishing panel used to automate credential theft, session hijacking, and operational management for phishing campaigns. Read more.

PureLogs Delivery via PawsRunner and Steganography

Source: Fortinet
(Published: 06 May 2026)
Fortinet researchers observed PureLogs malware being distributed through PawsRunner loaders combined with steganography techniques. Read more.

Operation HumanitarianBait: An Infostealer Campaign in Disguise

Source: Cyble
(Published: 07 May 2026)
Cyble analyzes Operation HumanitarianBait, a stealthy espionage campaign using aid-themed lures to deploy a fileless Python infostealer. Read more.

Industrialized Smishing Infrastructure Targeting UAE and Singapore

Source: Medium
(Published: 07 May 2026)
Researchers uncovered a large-scale smishing infrastructure impersonating transportation and government services in the UAE and Singapore. Read more.

TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook

Source: Elastic Security Labs
(Published: 07 May 2026)
REF3076 uses a trojanized Logitech installer to deploy TCLBANKER, a Brazilian banking trojan with environment-gated payloads, WPF fraud overlays, and self-propagating WhatsApp and Outlook worm modules. Read more.

Architecture Deception Investment Crypto Fraud

Source: Group-IB
(Published: 07 May 2026)
Group-IB uncovered a cryptocurrency investment fraud operation using deceptive infrastructure and impersonation tactics. Read more.

Suspicious Microsoft Store Apps May Deliver Go Backconnect Proxy Malware

Source: Luke Acha
(Published: 08 May 2026)
A suspicious Microsoft Store utility package impersonating WinDirStat loads a Go-based backconnect proxy implant through a native DLL. Read more.

PAN-OS Buffer Overflow Flaw Under Active State-Sponsored Exploitation

Source: HivePro
(Published: 08 May 2026)
A critical PAN-OS buffer overflow vulnerability is being actively exploited in campaigns linked to state-sponsored threat actors. Read more.

Orbit Returns

Source: Intezer
(Published: 08 May 2026)
Intezer researchers observed the return of Orbit malware, a Linux-focused threat using stealthy persistence and credential harvesting techniques. Read more.

Lookalike Domains Expose the iPhone Theft Economy

Source: Infoblox
(Published: 08 May 2026)
Infoblox researchers identified lookalike domains supporting large-scale iPhone theft and resale fraud operations. Read more.

Mobidash Android Ad Fraud Click Injection Analysis

Source: Jamf
(Published: 08 May 2026)
Jamf researchers analyzed Mobidash, an Android ad fraud campaign abusing click injection techniques for monetization. Read more.

OpenSearch Compromised in TeamPCP Campaign

Source: OpenSourceMalware
(Published: 09 May 2026)
TeamPCP operators compromised OpenSearch infrastructure to distribute malicious payloads and expand supply chain access. Read more.

Attackers Adopt Bun Runtime to Spread NWHStealer

Source: Malwarebytes
(Published: 09 May 2026)
Threat actors are leveraging the JavaScript runtime Bun to distribute NWHStealer malware and evade traditional detections. Read more.

DPRK Git Hooks Malware Campaign

Source: OpenSourceMalware
(Published: 10 May 2026)
North Korean operators are abusing Git hooks to silently execute malware within developer environments and repositories. Read more.

Sinkholing CountLoader: Insights Into Recent Campaigns

Source: McAfee
(Published: 10 May 2026)
McAfee Labs shares insights from sinkholing CountLoader infrastructure tied to malware delivery campaigns. Read more.

GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access

Source: Google Cloud Blog
(Published: 11 May 2026)
Google Threat Intelligence Group describes adversaries leveraging AI for vulnerability exploitation, augmented operations, and initial access. Read more.

Shai-Hulud compromises the @tanstack ecosystem: 160+ packages compromised

Source: Endor Labs
(Published: 11 May 2026)
Attackers planted credential-stealing malware in 84 @tanstack package versions across React, Solid, Vue, and Start as part of the fifth Shai-Hulud wave in eight months. Read more.

April 2026 Phishing Email Trends Report

Source: AhnLab ASEC
(Published: 12 May 2026)
In April 2026, the most common threat in phishing email attachments was Trojan, followed by phishing and downloader activity. Read more.

The Ultimate Guide to Detection Engineering with Censys

Source: Censys
(Published: 12 May 2026)
Vendor detection is not enough, and Censys frames infrastructure context as a way to turn indicators into reusable detection patterns. Read more.

Tycoon 2FA Operators Adopt OAuth Device Code Phishing

Source: eSentire
(Published: 12 May 2026)
Tycoon 2FA operators have adopted OAuth device code phishing to bypass traditional phishing defenses and capture user authentication tokens. Read more.

Malicious npm Packages Deliver Telegram RAT

Source: SafeDep
(Published: 13 May 2026)
Researchers uncovered malicious npm packages distributing a Telegram-controlled remote access trojan through open-source ecosystems. Read more.

FamousSparrow APT Targets Azerbaijani Oil and Gas Industry

Source: Bitdefender
(Published: 13 May 2026)
Bitdefender Labs tracked a multi-wave intrusion targeting an Azerbaijani oil and gas company from late December 2025 through late February 2026. Read more.

Suspected China-Linked Threat Actor Targets Global Manufacturer With Undocumented TencShell Malware

Source: Cato Networks
(Published: 13 May 2026)
The observed infection chain moves from a first-stage dropper to Donut shellcode retrieval through a masqueraded .woff resource, reflective shellcode execution, in-memory loading, and attempted C2 communication. Read more.

Kimsuky AppleSeed and PebbleDash Campaigns

Source: Kaspersky Securelist
(Published: 14 May 2026)
Kimsuky operators continue deploying AppleSeed and PebbleDash malware in espionage-focused campaigns targeting regional organizations. Read more.

NATS-as-C2: Inside a New Technique Attackers Are Using to Harvest Cloud Credentials and AI API Keys

Source: Sysdig
(Published: 14 May 2026)
The Sysdig Threat Research Team identified a novel command-and-control technique in which a threat actor used a NATS server as C2 infrastructure. Read more.

Amatera Stealer 4.0.2 Beta: What’s New in This Variant

Source: eSentire
(Published: 14 May 2026)
eSentire’s Threat Response Unit analyzes Amatera Stealer 4.0.2 Beta and changes in this variant’s behavior, delivery, and capability set. Read more.