Welcome to Security Signals
Every two weeks, we bring you expert insights and handpicked articles covering the latest threats, threat actor activity, vulnerabilities, incident trends, and defensive strategies. Whether you’re on the front lines or shaping your organization’s security posture, Security Signals delivers the information you need to stay informed and ready.
For more articles, check out our #onpatrol4malware blog.
April 2026 Edition
Key stats from real-world telemetry and live attack observations over the past month – a concise look at what we’re seeing across malware, phishing, ransomware, C2s, and domain abuse.
Insights (TL;DR)
These insights summarize the most common attacker behaviors, techniques, and defensive themes observed across the threat research featured below, helping highlight what mattered most during this reporting period.
Top ATT&CK Techniques Observed
- T1195 – Supply Chain Compromise (9/9): npm, PyPI, OpenSearch, TanStack, TeamPCP, and Shai-Hulud activity dominated this period.
- T1566 – Phishing / Social Engineering (8/9): Smishing, OAuth device-code phishing, fake apps, aid-themed lures, and AI-assisted campaigns remained prominent.
- T1555 – Credential Access (8/9): Infostealers, banking trojans, OAuth token theft, and cloud credential harvesting appeared across multiple campaigns.
- T1059 – Command Execution (7/9): PowerShell, Python, Bun, Git hooks, loaders, and RATs supported multi-stage execution chains.
- T1071 – Application Layer C2 (7/9): Telegram, NATS, Microsoft Teams, and other trusted channels were abused for C2 and operations.
What Matters Most
- Supply chain attacks remain the clearest trend. Developer ecosystems and package managers continue to be used for scalable access.
- Credential theft is the common objective. Many campaigns ultimately target passwords, sessions, tokens, banking data, or cloud keys.
- AI is moving into attacker workflows. Adversaries are using AI for exploitation, lures, targeting, and operational scale.
- Trusted platforms are being abused. Teams, Git hooks, package repositories, and cloud services are central to multiple attack chains.
What Defenders Should Watch
- Unexpected package installs, Git hook activity, or developer tool execution
- OAuth device-code abuse, suspicious MFA flows, and session theft patterns
- Outbound traffic to Telegram, NATS, cloud-hosted, or newly observed infrastructure
- Infostealer behavior targeting browsers, wallets, tokens, and cloud credentials
Quick Wins
- Restrict and monitor package manager activity in developer environments
- Review OAuth app approvals and device-code authentication policies
- Alert on execution from temp, download, and user-controlled directories
- Block newly registered domains tied to phishing, fake apps, and software lures
Key Insight: Attackers are increasingly abusing trusted developer ecosystems, social engineering campaigns, and cloud platforms to scale operations, with credential theft remaining the primary objective.
Articles
Early May 2026 Cyber Threat Reports highlights a fast-moving mix of supply chain compromise, phishing infrastructure, infostealer activity, and AI-assisted attacker workflows. This edition includes Shai-Hulud, TeamPCP, Tycoon 2FA, AMOS, Kazuar, and campaigns abusing npm, PyPI, Microsoft Teams, OAuth flows, and developer tooling.
Mini Shai-Hulud: Cross-Ecosystem Supply Chain Worm Targeting npm and PyPI
Source: Expel
(Published: 06 May 2026)
Expel researchers detail Mini Shai-Hulud, a wormable supply chain campaign targeting both npm and PyPI ecosystems to spread malicious packages. Read more.
Inside a Criminal Phishing Panel
Source: Push Security
(Published: 06 May 2026)
Push Security analyzes a modern phishing panel used to automate credential theft, session hijacking, and operational management for phishing campaigns. Read more.
PureLogs Delivery via PawsRunner and Steganography
Source: Fortinet
(Published: 06 May 2026)
Fortinet researchers observed PureLogs malware being distributed through PawsRunner loaders combined with steganography techniques. Read more.
Operation HumanitarianBait: An Infostealer Campaign in Disguise
Source: Cyble
(Published: 07 May 2026)
Cyble analyzes Operation HumanitarianBait, a stealthy espionage campaign using aid-themed lures to deploy a fileless Python infostealer. Read more.
Industrialized Smishing Infrastructure Targeting UAE and Singapore
Source: Medium
(Published: 07 May 2026)
Researchers uncovered a large-scale smishing infrastructure impersonating transportation and government services in the UAE and Singapore. Read more.
TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook
Source: Elastic Security Labs
(Published: 07 May 2026)
REF3076 uses a trojanized Logitech installer to deploy TCLBANKER, a Brazilian banking trojan with environment-gated payloads, WPF fraud overlays, and self-propagating WhatsApp and Outlook worm modules. Read more.
Architecture Deception Investment Crypto Fraud
Source: Group-IB
(Published: 07 May 2026)
Group-IB uncovered a cryptocurrency investment fraud operation using deceptive infrastructure and impersonation tactics. Read more.
Suspicious Microsoft Store Apps May Deliver Go Backconnect Proxy Malware
Source: Luke Acha
(Published: 08 May 2026)
A suspicious Microsoft Store utility package impersonating WinDirStat loads a Go-based backconnect proxy implant through a native DLL. Read more.
PAN-OS Buffer Overflow Flaw Under Active State-Sponsored Exploitation
Source: HivePro
(Published: 08 May 2026)
A critical PAN-OS buffer overflow vulnerability is being actively exploited in campaigns linked to state-sponsored threat actors. Read more.
Orbit Returns
Source: Intezer
(Published: 08 May 2026)
Intezer researchers observed the return of Orbit malware, a Linux-focused threat using stealthy persistence and credential harvesting techniques. Read more.
Lookalike Domains Expose the iPhone Theft Economy
Source: Infoblox
(Published: 08 May 2026)
Infoblox researchers identified lookalike domains supporting large-scale iPhone theft and resale fraud operations. Read more.
Mobidash Android Ad Fraud Click Injection Analysis
Source: Jamf
(Published: 08 May 2026)
Jamf researchers analyzed Mobidash, an Android ad fraud campaign abusing click injection techniques for monetization. Read more.
OpenSearch Compromised in TeamPCP Campaign
Source: OpenSourceMalware
(Published: 09 May 2026)
TeamPCP operators compromised OpenSearch infrastructure to distribute malicious payloads and expand supply chain access. Read more.
Attackers Adopt Bun Runtime to Spread NWHStealer
Source: Malwarebytes
(Published: 09 May 2026)
Threat actors are leveraging the JavaScript runtime Bun to distribute NWHStealer malware and evade traditional detections. Read more.
DPRK Git Hooks Malware Campaign
Source: OpenSourceMalware
(Published: 10 May 2026)
North Korean operators are abusing Git hooks to silently execute malware within developer environments and repositories. Read more.
Sinkholing CountLoader: Insights Into Recent Campaigns
Source: McAfee
(Published: 10 May 2026)
McAfee Labs shares insights from sinkholing CountLoader infrastructure tied to malware delivery campaigns. Read more.
GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access
Source: Google Cloud Blog
(Published: 11 May 2026)
Google Threat Intelligence Group describes adversaries leveraging AI for vulnerability exploitation, augmented operations, and initial access. Read more.
Shai-Hulud compromises the @tanstack ecosystem: 160+ packages compromised
Source: Endor Labs
(Published: 11 May 2026)
Attackers planted credential-stealing malware in 84 @tanstack package versions across React, Solid, Vue, and Start as part of the fifth Shai-Hulud wave in eight months. Read more.
April 2026 Phishing Email Trends Report
Source: AhnLab ASEC
(Published: 12 May 2026)
In April 2026, the most common threat in phishing email attachments was Trojan, followed by phishing and downloader activity. Read more.
The Ultimate Guide to Detection Engineering with Censys
Source: Censys
(Published: 12 May 2026)
Vendor detection is not enough, and Censys frames infrastructure context as a way to turn indicators into reusable detection patterns. Read more.
Tycoon 2FA Operators Adopt OAuth Device Code Phishing
Source: eSentire
(Published: 12 May 2026)
Tycoon 2FA operators have adopted OAuth device code phishing to bypass traditional phishing defenses and capture user authentication tokens. Read more.
Malicious npm Packages Deliver Telegram RAT
Source: SafeDep
(Published: 13 May 2026)
Researchers uncovered malicious npm packages distributing a Telegram-controlled remote access trojan through open-source ecosystems. Read more.
FamousSparrow APT Targets Azerbaijani Oil and Gas Industry
Source: Bitdefender
(Published: 13 May 2026)
Bitdefender Labs tracked a multi-wave intrusion targeting an Azerbaijani oil and gas company from late December 2025 through late February 2026. Read more.
Suspected China-Linked Threat Actor Targets Global Manufacturer With Undocumented TencShell Malware
Source: Cato Networks
(Published: 13 May 2026)
The observed infection chain moves from a first-stage dropper to Donut shellcode retrieval through a masqueraded .woff resource, reflective shellcode execution, in-memory loading, and attempted C2 communication. Read more.
Kimsuky AppleSeed and PebbleDash Campaigns
Source: Kaspersky Securelist
(Published: 14 May 2026)
Kimsuky operators continue deploying AppleSeed and PebbleDash malware in espionage-focused campaigns targeting regional organizations. Read more.
NATS-as-C2: Inside a New Technique Attackers Are Using to Harvest Cloud Credentials and AI API Keys
Source: Sysdig
(Published: 14 May 2026)
The Sysdig Threat Research Team identified a novel command-and-control technique in which a threat actor used a NATS server as C2 infrastructure. Read more.
Amatera Stealer 4.0.2 Beta: What’s New in This Variant
Source: eSentire
(Published: 14 May 2026)
eSentire’s Threat Response Unit analyzes Amatera Stealer 4.0.2 Beta and changes in this variant’s behavior, delivery, and capability set. Read more.
Kazuar: Anatomy of a Nation-State Botnet
Source: Microsoft Security
(Published: 14 May 2026)
Microsoft details Kazuar malware infrastructure and tradecraft associated with nation-state activity. Read more.
ModeloRAT Campaign Uses Microsoft Teams Compromise
Source: Rapid7
(Published: 14 May 2026)
Rapid7 researchers dissected a ModeloRAT campaign leveraging Microsoft Teams compromise and social engineering. Read more.
OceanLotus Suspected PyPI Campaign
Source: Kaspersky Securelist
(Published: 15 May 2026)
Researchers identified suspected OceanLotus-linked malicious Python packages uploaded to PyPI to target developers and organizations. Read more.
Gremlin Stealer’s Evolved Tactics: Hiding in Plain Sight With Resource Files
Source: Unit 42 (Palo Alto Networks)
(Published: 15 May 2026)
Unit 42 researchers describe how Gremlin Stealer has evolved to hide malicious content in resource files while targeting credentials and sensitive data. Read more.
Dirty Pipe Variant Enables Linux Privilege Escalation
Source: ReversingLabs
(Published: 15 May 2026)
Researchers analyzed DirtyFrag, a Linux privilege escalation exploit targeting vulnerable systems. Read more.
Fake Claude Site Spreads Backdoor Malware
Source: Sophos
(Published: 15 May 2026)
Sophos researchers identified fake Claude AI websites distributing backdoor malware through deceptive downloads. Read more.
AMOS Malware Steals macOS Data at Scale
Source: Sophos
(Published: 16 May 2026)
Sophos details how AMOS malware is increasingly targeting macOS users for large-scale credential and data theft. Read more.
TeamPCP Supply Chain Attacks Analysis
Source: Trend Micro
(Published: 16 May 2026)
Trend Micro analyzes TeamPCP supply chain attacks affecting developer ecosystems and open-source infrastructure. Read more.
OpenClaw Skill Distributes Remcos RAT and GhostLoader
Source: Zscaler
(Published: 17 May 2026)
Zscaler researchers observed malicious OpenClaw skills distributing Remcos RAT and GhostLoader malware. Read more.
Funnull Sanctioned: What the Polyfill[.]io Attack Exposed About Infrastructure Laundering
Source: cside
(Published: 17 May 2026)
OFAC sanctioned Funnull Technology Inc. on 2025-05-29, along with administrator Liu Lizhi. Read more.
SHub Reaper | macOS Stealer Spoofs Apple, Google, and Microsoft in a Single Attack Chain
Source: SentinelOne
(Published: 18 May 2026)
Infostealers targeting macOS have continued to proliferate over the last two years, with threat actors iterating on successful techniques across related malware families. Read more.
Want more articles? Check out the previous edition of Security Signals here.
Free Evaluation
Gain a comprehensive view of the external cyber landscape with Malware Patrol’s Cyber Threat Intelligence (CTI) services. We cover a broad spectrum of malicious activities, including malware, ransomware, phishing, cryptominers, newly registered domains, and command-and-control servers to equip your organization with the insights needed to proactively detect and mitigate potential attacks.
Take advantage of a free trial to test our data for yourself.