Top ATT&CK Techniques Observed

• T1195 – Supply Chain Compromise: Software supply chain attacks remained one of the dominant themes, with compromises affecting npm packages, developer tools, IDE plugins, SDKs, and CI/CD workflows.
• T1566 – Phishing: Attackers continued to rely on shopping scams, WhatsApp campaigns, fake domain renewals, Bubble.io phishing, and AI-themed lures to steal credentials.
• T1555 / T1556 – Credential Access: Multiple campaigns targeted developer credentials, AI API keys, browser sessions, enterprise logins, and cloud identities.
• T1071 – Application Layer Protocol: Modern malware increasingly used cloud services, collaboration platforms, blockchain infrastructure, and encrypted channels for command-and-control.
• T1055 / T1059 – Defense Evasion & Execution: Attackers continued adopting reflective loading, DLL sideloading, steganography, PowerShell, and in-memory execution to reduce detection.

What Matters Most

• Developer ecosystems remain under sustained attack. AI frameworks, npm packages, JetBrains plugins, SDKs, and developer tooling were repeatedly compromised during this reporting period.
• Credential theft continues to drive intrusions. Whether targeting developers, cloud administrators, or end users, most campaigns ultimately sought credentials, tokens, or session access.
• Supply chain attacks are expanding beyond package managers. Threat actors increasingly target plugins, extensions, SDKs, repositories, and software update mechanisms.
• Nation-state operations remain highly active. Multiple reports covered activity linked to China- and DPRK-aligned actors, as well as campaigns targeting government, healthcare, and critical infrastructure.

What Defenders Should Watch

• Unexpected package updates, dependency changes, IDE plugins, or CI/CD modifications
• Credential theft targeting AI platforms, developer accounts, and enterprise cloud services
• Execution from temporary folders, archive contents, DLL sideloading, and script interpreters
• Outbound connections to newly observed infrastructure, cloud services, and fast-changing C2 endpoints

Quick Wins

• Review package trust policies and require verification for new dependencies
• Monitor AI platform credentials and API keys alongside traditional privileged accounts
• Strengthen detection for phishing-resistant authentication and suspicious session activity
• Audit developer workstations and CI/CD pipelines for unauthorized changes or plugins

Key Insight: This period marked another shift toward attacks on software development ecosystems. Rather than targeting only end users, threat actors increasingly compromised developer tools, package repositories, and AI-related workflows to gain access to organizations and their cloud environments.

May 2026 Infostealer Trend Report

Source: AhnLab ASEC
(Published: 17 June 2026)
This report summarizes the distribution channels, number of infostealers, number of detections, target companies, and execution types of new infostealers collected during the month of May 2026. Read more.

More Than 4,000 Legacy Routers Compromised by AryStinger, Turned into Global Attack Proxies for Hackers

Source: Qianxin XLab
(Published: 17 June 2026)
On May 20, 2026, the Ministry of State Security’s WeChat official account published an article “Your internet is slow, and the culprit turns out to be this!”, highlighting that outdated routers are becoming a key entry point for threat actors to conduct cyber espionage. Read more.

AdaptixC2: Fingerprinting an Open-Source C2 Framework at Scale

Source: Censys
(Published: 17 June 2026)
AdaptixC2 is an open-source post-exploitation framework with a default configuration that makes deployed servers trivially identifiable from passive scanning. Read more.

Klue Integration Abused in Salesforce Data Theft

Source: ReliaQuest
(Published: 17 June 2026)
In June 2026, ReliaQuest observed a compromised integration for Klue, a competitive-intelligence platform that syncs battlecard and win/loss data with Salesforce, being used to exfiltrate customer relationship management (CRM) data. Read more.

Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat

Source: StepSecurity
(Published: 17 June 2026)
On June 17, 2026, an attacker compromised the @mastra npm organization and quietly added easy-day-js as a dependency across 140+ packages in the Mastra AI framework ecosystem. Read more.

Mastra Supply Chain Compromise: easy-day-js Dropper Pulls a Cross-Platform RAT Into @mastra Installs

Source: Upwind
(Published: 17 June 2026)
On June 17 2026, a coordinated supply chain attack pushed a malicious easy-day-js package into the dependency tree of the entire @mastra/* npm organization. Read more.

PureRAT Variant Observed in AI Video Player

Source: Luke Acha
(Published: 17 June 2026)
Follow-up analysis of extracted .NET loader stage, internally named Ykzrh.exe (smveo-csharp-agent.exe) in one recovered artifact, revealed a substantial virtualization and runtime reconstruction layer. Read more.

Prinz Eugen Ransomware: A Deep Dive Into a New Go-Based Encryptor

Source: ThreatDown
(Published: 17 June 2026)
On May 11, 2026, our research team investigated a customer infected with a brand-new ransomware family called Prinz Eugen. Read more.

Operation FanTrap: Inside the FIFA 2026 Fraud Ecosystem

Source: Cyble
(Published: 18 June 2026)
The FIFA World Cup 2026 has become more than a global sporting event. Read more.

Mastra Attack Targets Crypto, Password Managers, Authenticators, and Zapier

Source: OpenSourceMalware
(Published: 18 June 2026)
A threat actor compromised the Mastro NPM organization yesterday and published more than 140 malicious packages. Read more.

15 Malicious JetBrains Plugins Stole AI API Keys from 70,000 Developers

Source: StepSecurity
(Published: 18 June 2026)
On June 16, 2026, JetBrains received security reports identifying a coordinated supply chain attack involving 15 malicious third-party plugins on the JetBrains Marketplace. Read more.

Killing Me Gently: Inside Gentlemen’s EDR Killer Framework

Source: ESET Research
(Published: 18 June 2026)
ESET Research shares the results of a months-long investigation into the suite of EDR killers maintained by the RaaS gang Gentlemen. Read more.

SmartApeSG Launches Okendo Reviews Supply Chain Attack

Source: Zscaler
(Published: 18 June 2026)
On May 14, 2026, the Zscaler ThreatLabz team identified unusually high activity associated with the threat actor SmartApeSG to deploy malware. Read more.

Amazon Prime Day 2026: Bargains Begin June 23 – and So Do the Scams

Source: Check Point Research
(Published: 19 June 2026)
When Amazon Prime Day returns on June 23-26, 2026, more than 25 countries will take part in one of the largest shopping windows of the year. Read more.

OXLOADER: New Loader Evading Detection to Drop Infostealer

Source: Elastic Security Labs
(Published: 19 June 2026)
After all the checks have passed, the malware makes a copy of the Windows DirectUI Engine DLL (C:\Windows\System32\dui70.dll), storing it in a temporary location using a randomly generated name with the .ocx extension. Read more.

Threat Actors Weaponizing RAR Archives to Target Thailand’s Healthcare Sector

Source: Seqrite
(Published: 19 June 2026)
Authors: Vaibhav Krushna Billade, Dixit Panchal & Rumana Siddiqui. Read more.

MyBait: Why We Lured Attackers To Encrypt Our Cloud MySQL

Source: Varonis
(Published: 19 June 2026)
Varonis Threat Labs deployed MySQL honeypots across GCP, AWS, and Azure. Read more.

@withgoogle/stitch-sdk: Scope Squat Harvests Developer Credentials

Source: SafeDep
(Published: 19 June 2026)
A malicious npm package published under @withgoogle/stitch-sdk impersonates Google’s Stitch AI design tool by squatting the @withgoogle npm scope. Read more.

FortiBleed: Anatomy of the FortiBleed Campaign Based on the Server That the Attackers Themselves Left Exposed

Source: ZenoX
(Published: 20 June 2026)
In June 19 2026 we received access to the contents of an internet-exposed directory, left open by the operators themselves of a campaign the press named FortiBleed. Read more.

A Multi-Stage Steganographic Loader Campaign Deploying Diverse Payloads Globally

Source: K7 Labs
(Published: 20 June 2026)
The final payload achieves its persistence through the Run entry, winlogon.exe, & userinit. Read more.

From PostCSS Masquerading to Windows RAT

Source: JFrog Security Research
(Published: 20 June 2026)
The downloaded bundle was not a simple script. Read more.

A VBScript Campaign Distributed Through WhatsApp Deploying RMM Software

Source: Kaspersky Securelist
(Published: 22 June 2026)
In June 2026, we observed a malware campaign distributing malicious VBScript files through direct messages in WhatsApp. Read more.

USB Worm CryptoBandits Steals Cryptocurrency via Windows Shortcut Files

Source: ThreatAft
(Published: 22 June 2026)
A financially motivated USB worm campaign has been actively stealing cryptocurrency from Windows users worldwide since at least February 2026. Read more.

What Was a 45-GPU Cracking Farm Built For?

Source: ThreatMon
(Published: 22 June 2026)
Most credential leaks are messy. Someone dumps a pile of raw data, half of it stale, and walks away. Read more.

EvilTokens: How “Ghost” Code Threatens US and European Businesses

Source: ANY.RUN
(Published: 23 June 2026)
EvilTokens can hide serious account takeover risk from your SOC through “ghost” code that appears only after browser-side decryption. Read more.

Inside FortiBleed: Reverse Engineering the CyberStrike Harvester Behind a Global FortiGate Credential Factory

Source: Arctic Wolf
(Published: 23 June 2026)
Arctic Wolf reverse-engineered a recovered CyberStrike Harvester binary and connected it to the broader FortiBleed operator workflow, showing how exposed perimeter credentials can quickly become full internal-network exposure. Read more.

CVE-2025-54068 Laravel Livewire Credential Theft Campaign: 6,000+ Applications Compromised

Source: Imperva
(Published: 24 June 2026)
The campaign, first documented here, has been running for several months, as evidenced by the large volume of stolen data. Read more.

A Burst Bubble: How Threat Actors Are Using Bubble.io to Deliver a New Phishing Campaign

Source: S-RM
(Published: 24 June 2026)
The login follows the expected Microsoft login flow, but it is using the dynamic pages copied from Microsoft’s flow but on the threat actors content delivery network. Read more.

Edgecution: Malicious Edge Extension Backdoor

Source: Zscaler
(Published: 24 June 2026)
Edgecution is a malicious Microsoft Edge extension backdoor associated with ransomware initial access activity. Read more.

May 2026 Threat Trend Report on APT Attacks (South Korea)

Source: AhnLab ASEC
(Published: 24 June 2026)
This report provides a statistical summary and analysis of APT attacks targeting South Korea in May 2026. Read more.

Operation Navy Ghost: How Attackers Planted a Telegram-Powered Backdoor Across Fake pyrogram Packages on PyPI

Source: Checkmarx
(Published: 25 June 2026)
When the attacker sends “/asu print(os.environ)” to the victim’s bot, this function compiles and executes that Python code on the victim’s machine. Read more.

Threat Intelligence Report: Nation-State Targeting of Water Systems 2024-2026

Source: DomainTools
(Published: 25 June 2026)
DomainTools assesses nation-state targeting of water systems from 2024 through 2026, including activity linked to Iran, Russia, and China. Read more.

Coinbase Cartel: Behind the Noise of a Prolific Leak Operation

Source: Intrinsec
(Published: 25 June 2026)
Coinbase Cartel is a prolific leak operation built around high-volume extortion activity and public data exposure claims. Read more.

Fake Domain Renewal Emails Trick Website Owners Into Paying Scammers

Source: Malwarebytes
(Published: 25 June 2026)
Scammers are sending fake domain renewal notices to trick website owners into paying fraudulent invoices. Read more.

Negative SEO Attack: Inside a Black Hat SEO Operation

Source: Zynap
(Published: 25 June 2026)
Negative SEO is a form of search engine manipulation aimed not at boosting the attacker’s own site, but at damaging the ranking, reputation, or visibility of a target domain. Read more.

Operation Turb00 – Part 2: A Multi-Stage HijackLoader Campaign Delivers Vidar v2.1

Source: Medium
(Published: 26 June 2026)
This is the second post in a three-part series on the Vidar infostealer and the infrastructure behind it. Read more.

From CI/CD to Cloud Data: How Shai-Hulud Persistence Leads to Redshift Breach

Source: Fortinet
(Published: 26 June 2026)
The “Shai-Hulud: The Second Coming” campaign represents a major evolution in the landscape of npm supply-chain attacks. Read more.

Beyond Banking Trojans: Rokarolla Expands the Android Fraud Playbook

Source: PolySwarm
(Published: 26 June 2026)
Rokarolla represents a new generation of Android fraud tooling that extends beyond traditional banking trojan behavior. Read more.

Gaslight: The Rust-Powered macOS Implant Designed to Mislead AI Tools

Source: HivePro
(Published: 26 June 2026)
Gaslight (macOS.Gaslight) is a Rust-based macOS implant and information stealer attributed with high confidence to DPRK-aligned activity, first seen on May 22, 2026 and targeting macOS systems worldwide. Read more.

Investigating a Novel OpenAI Poisoned Tenant Attack

Source: Push Security
(Published: 26 June 2026)
Push Security investigated a poisoned tenant attack that abused OpenAI-related workflows to target identity and application access. Read more.

Understanding Langflow CVE-2026-55255, and Why Higher CVSS Vulnerabilities Aren’t Always the Most Exploited

Source: Sysdig
(Published: 26 June 2026)
Sysdig analyzes Langflow CVE-2026-55255 and explains why vulnerabilities with lower scores may see heavier attacker adoption than higher-severity flaws. Read more.

Anatomy of a WHQL-Signed Windows Filtering Platform Kernel-Resident Network Backdoor

Source: Nextron Systems
(Published: 26 June 2026)
Nextron Systems analyzes a WHQL-signed Windows Filtering Platform kernel-resident network backdoor. Read more.

Operation DragonReturn: China-Nexus Cyber Espionage Campaign Targeting Govt. of India/MoF Tax Infrastructure via Multi-Stage DcRAT Deployment

Source: Seqrite
(Published: 26 June 2026)
Seqrite Lab actively tracks and analyse threat actors and their campaigns, focusing on attribution, infrastructure analysis, and adversary tradecraft. Read more.

Mustang Panda Targets India’s Government and Energy Sectors with ZOHOMURK and MINIRECON

Source: Acronis
(Published: 28 June 2026)
Our investigation began after identifying a suspicious archive, Hydropower Cooperation Project Proposal.zip, believed to have been distributed via spear-phishing and subsequently uploaded to VirusTotal in May 2026. Read more.

SystemBC Malware: How the Coroxy Proxy Backdoor Targets Windows

Source: Picus Security
(Published: 29 June 2026)
SystemBC, also tracked as Coroxy, is a Windows malware family that primarily turns an infected machine into a SOCKS5 proxy while also functioning as a persistent backdoor and RAT. Read more.

TONResolver RAT Abuses TON Blockchain to Target Japan’s Hotel Industry

Source: Trend Micro
(Published: 29 June 2026)
In this blog entry, TrendAI™ Research examines a wave of phishing emails observed in May 2026 that targeted Japanese accommodation facilities using Booking.com, detailing the victims, attack techniques used, and characteristics of the malware involved. Read more.

The Gentlemen Are Knocking: Custom Backdoors and Evolving Tactics

Source: Kaspersky Securelist
(Published: 29 June 2026)
This year saw the emergence of The Gentlemen, a prominent example of a group operating under the ransomware-as-a-service model. Read more.

RustDuck: An In-Depth Analysis of a Two-Stage Botnet

Source: Qianxin XLab
(Published: 29 June 2026)
Although the family’s current activity level and influence in DDoS attacks are not yet comparable to some mainstream botnets, its speed of technological evolution deserves significant attention. Read more.

UAC-0184 Tooling Evolution: OneDrive Sideload to Remcos

Source: Synaptic Systems
(Published: 29 June 2026)
Launching shortcuts directly from an archive can behave differently depending on the archive utility and extraction context. Read more.

Inside Kimsuky’s CHM Tradecraft: Multi-Stage Execution and Selective Payload Delivery

Source: Synaptic Systems
(Published: 29 June 2026)
The visible text comments on the structure of a manuscript, including sections covering diversion of civilian resources to military spending, degradation of agricultural production, and inequality in food distribution. Read more.

From CitrixBleed 2 to Cloudflared: The Tools and Techniques Behind Anubis Ransomware Attacks

Source: Arctic Wolf
(Published: 30 June 2026)
Arctic Wolf Labs observed Anubis ransomware attacks using CitrixBleed 2 exploitation and Cloudflared tunneling as part of the intrusion chain. Read more.

Glitch SPY: An Emerging Android RAT Distributed Through a Fake Polish Rental App

Source: Cyble
(Published: 30 June 2026)
Cyble Research and Intelligence Labs identified an emerging Android malware family tracked as Glitch SPY, distributed through a fraudulent Polish apartment and house rental platform designed to lure users into downloading an Android APK. Read more.

Not Very Gentlemanly: Analyzing a Zero-Day Exploit Used by The Gentlemen Ransomware to Disable Targets’ EDRs

Source: Expel
(Published: 30 June 2026)
Ransomware groups have long relied on disabling endpoint detection and response tools before deploying their payloads, and in recent years have utilized bring-your-own-vulnerable-driver attacks to do so. Read more.

The Polymarket Trap: A Fake Arbitrage Bot, Ten npm Accounts, and Four Ways to Deliver an Infostealer

Source: SafeDep
(Published: 30 June 2026)
A set of small npm packages, GitHub repositories, and matching themes were used to lure developers into installing infostealer code disguised as Polymarket arbitrage tooling. Read more.

ToddyCat: Your Hidden Email Assistant. Part 2

Source: Kaspersky Securelist
(Published: 30 June 2026)
We continue to share details on the malicious techniques and toolsets used by the ToddyCat APT group. Read more.

No (Bad) CAP: Inside an Ongoing LSHIY Password Spray Attack

Source: Huntress
(Published: 30 June 2026)
The targeting of these attacks seems to be based entirely on password prevalence on compromised password combo lists, and is not specific to business type or industry. Read more.

Silent Swap: A Crypto Clipper Extension Campaign

Source: McAfee
(Published: 30 June 2026)
McAfee Labs analyzed a browser extension campaign designed to swap cryptocurrency wallet addresses and redirect payments to attacker-controlled wallets. Read more.

These insights summarize the most common attacker behaviors, techniques, and defensive themes observed across the threat research featured below, helping highlight what mattered most during this reporting period.

ASEC Threat Report

Source: AhnLab ASEC
(Published: 20 May 2026)
ASEC analyzed recent malware and phishing activity affecting users and organizations. Read more.

From Token Bingo to MAX Takeover: Kali365 Expands Into AWS, Microsoft, Okta, Xerox, MAX Messenger

Source: Arctic Wolf
(Published: 21 May 2026)
Kali365 operators expanded their account takeover operation across cloud, identity, messaging, and business platforms. Read more.

SEO Poisoning Campaign Leverages Gemini and Claude Code Impersonation to Deliver Infostealer

Source: EclecticIQ
(Published: 21 May 2026)
Financially motivated eCrime actors are impersonating AI developer tools to compromise workstations and steal sensitive data. Read more.

Fake Apps Deliver DonutLoader and Remcos RAT

Source: G DATA
(Published: 21 May 2026)
Researchers analyzed a malware campaign using fake applications to deliver DonutLoader and Remcos RAT. Read more.

Lazarus Expands Financial Espionage Operations With Memory-Resident RemotePE RAT

Source: PolySwarm
(Published: 22 May 2026)
Lazarus-linked operators are expanding financial espionage with memory-resident malware and follow-on tooling. Read more.

SolyxImmortal: Analysis of a Python-Based Information Stealer

Source: Pulsedive
(Published: 22 May 2026)
Researchers analyzed SolyxImmortal, a Python-based infostealer targeting credentials and sensitive data. Read more.

Gamaredon’s Matryoshka Campaign Keeps Unpacking Gammaphish and Gammaworm

Source: Sekoia
(Published: 22 May 2026)
Sekoia analyzed a Gamaredon campaign using layered delivery techniques to deploy Gammaphish and Gammaworm payloads. Read more.

UAC-0247 Malware Targeting FPV Operators

Source: Synaptic Systems
(Published: 23 May 2026)
Researchers identified malware activity targeting FPV operators in a campaign tied to UAC-0247. Read more.

The Art of Being Ungovernable

Source: Cisco Talos
(Published: 23 May 2026)
Cisco Talos examined threat activity involving evasion, persistence, and abuse of infrastructure. Read more.

Ghost CMS Mass Compromised via CVE-2026-26980 Now Fueling ClickFix Attacks

Source: Qianxin XLab
(Published: 23 May 2026)
Attackers are exploiting Ghost CMS at scale to fuel ClickFix-style attacks and malicious infrastructure. Read more.

Mustang Panda PlugX Analysis: A Multi-Layer Execution Chain

Source: BlueCyber
(Published: 24 May 2026)
Researchers analyzed a Mustang Panda PlugX sample using a multi-layer execution chain. Read more.

CERT-UA Article 6315762

Source: CERT-UA
(Published: 24 May 2026)
CERT-UA published an advisory describing recent cyber activity and defensive guidance. Read more.

FortiClient EMS Exploited via CVE-2026-35616 to Deliver EKZ Infostealer Disguised as a Fortinet Patch

Source: Arctic Wolf
(Published: 27 May 2026)
Arctic Wolf observed a threat cluster exploiting CVE-2026-35616 to deploy an infostealer disguised as a Fortinet patch to FortiClient EMS-managed endpoints. Read more.

KnowledgeDeliver: ViewState Deserialization Vulnerability Exploitation

Source: Google Cloud
(Published: 27 May 2026)
Google Threat Intelligence analyzed exploitation activity involving a ViewState deserialization vulnerability. Read more.

AzureVeil Spearphishing Delivers C2

Source: CyberPress
(Published: 27 May 2026)
AzureVeil uses spearphishing to deliver command-and-control tooling against targeted victims. Read more.

China APT Webworm Hides European Government Espionage Traffic Inside Discord and Microsoft Cloud

Source: CyberSecSentinel
(Published: 27 May 2026)
A China-linked APT is hiding espionage traffic inside trusted cloud and collaboration platforms. Read more.

OverlayPhantom Android Banking Trojan

Source: Cyble
(Published: 28 May 2026)
Cyble analyzed OverlayPhantom, an Android banking trojan abusing overlay techniques to steal financial data. Read more.

Modern Supply Chain Intrusions: From CI/CD Abuse to Ecosystem-Wide Compromise

Source: DarkAtlas
(Published: 28 May 2026)
Researchers examined supply chain intrusions abusing CI/CD workflows and trusted developer ecosystems. Read more.

The Gentlemen Russia RaaS Operation Rocket Leak Analysis

Source: FalconFeeds
(Published: 28 May 2026)
FalconFeeds analyzed leaked materials related to The Gentlemen ransomware-as-a-service operation. Read more.

Inside CrowdStrike’s Takedown of a Developer-Targeting Botnet

Source: CrowdStrike
(Published: 28 May 2026)
CrowdStrike detailed a takedown operation against a botnet targeting developers and software ecosystems. Read more.

Codestorm: A Microsoft 365 AiTM Phishing Kit With Storm-1167 Overlap

Source: HexaStrike
(Published: 29 May 2026)
Codestorm is a Microsoft 365 adversary-in-the-middle phishing kit with overlap to Storm-1167 activity. Read more.

Tracking North Korea Nation-State APT Infrastructure: Kimsuky

Source: Idan Malihi
(Published: 29 May 2026)
Researchers mapped infrastructure associated with Kimsuky-linked North Korean operations. Read more.

Fake Microsoft Teams Campaign Delivers ValleyRAT

Source: K7 Computing
(Published: 29 May 2026)
Threat actors are using fake Microsoft Teams lures to deliver ValleyRAT through NSIS installers and DLL sideloading. Read more.

FlutterBridge: New FlutterShell Backdoor

Source: Unit 42 (Palo Alto Networks)
(Published: 29 May 2026)
Unit 42 analyzed FlutterBridge, a new FlutterShell backdoor used in targeted activity. Read more.

Tracking Tampered Chef Clusters

Source: Unit 42 (Palo Alto Networks)
(Published: 29 May 2026)
Researchers tracked compromised Chef clusters and related attacker tradecraft. Read more.

Stealthy P2P Cryptominer Targets Ollama Endpoints

Source: Akamai
(Published: 29 May 2026)
Akamai observed a stealthy peer-to-peer cryptominer targeting exposed Ollama endpoints. Read more.

GreyVibe

Source: WithSecure Labs
(Published: 30 May 2026)
WithSecure analyzed GreyVibe malware activity and related tradecraft. Read more.

LLMShare Malvertising Campaign

Source: Push Security
(Published: 30 May 2026)
Push Security analyzed a malvertising campaign abusing LLM-themed lures to target users. Read more.

Laravel Lang Supply Chain Advisory

Source: Snyk
(Published: 30 May 2026)
Snyk disclosed a Laravel Lang supply chain compromise affecting package users and downstream environments. Read more.

Laravel Lang Compromise

Source: Socket
(Published: 30 May 2026)
Socket analyzed a compromise affecting Laravel Lang packages in the open-source ecosystem. Read more.

AI Agent at the Wheel: From CVE to Internal Database in Four Pivots

Source: Sysdig
(Published: 30 May 2026)
Sysdig analyzed how an attacker used LLMs to move from vulnerability exploitation to an internal database in four pivots. Read more.

Supply Chain Attack Targets Laravel-Lang Packages With Credential Stealer

Source: Aikido
(Published: 30 May 2026)
Aikido analyzed a Laravel-Lang supply chain attack that introduced credential-stealing code into package workflows. Read more.

Fake Claude Code Installer Infostealer

Source: Cyderes
(Published: 30 May 2026)
Cyderes analyzed a fake Claude Code installer used to deliver infostealer malware. Read more.

Kimsuky’s Advanced Attack Techniques: JSONPing, WebEx Spoofing, and HTTPSpy Variant

Source: ENKI
(Published: 30 May 2026)
Researchers analyzed advanced Kimsuky techniques involving JSONPing, WebEx spoofing, and a new HTTPSPY variant. Read more.

Trapdoor: Cross-Ecosystem Supply-Chain Credential Theft Operation

Source: SlowMist
(Published: 31 May 2026)
Researchers analyzed Trapdoor, a cross-ecosystem supply chain operation designed to steal credentials. Read more.

Nimbus RAT Abuses Microsoft Teams and Google Drive to Deploy Java RAT

Source: eSentire
(Published: 31 May 2026)
Threat actors are abusing Microsoft Teams and Google Drive to deploy Nimbus RAT. Read more.

Misconfigured, Enrolled, and Dormant: Anatomy of a P2PInfect Kubernetes Compromise

Source: Fortinet
(Published: 31 May 2026)
Fortinet analyzed a Kubernetes compromise involving P2PInfect activity and misconfigured cluster exposure. Read more.

Ghost Stadium Football Fraud

Source: Group-IB
(Published: 31 May 2026)
Group-IB analyzed football-themed fraud infrastructure targeting users with deceptive campaigns. Read more.

The Gentlemen Ransomware Defense Evasion TTPs

Source: Huntress
(Published: 31 May 2026)
Huntress analyzed defense evasion techniques used by The Gentlemen ransomware operators. Read more.

Pivoting on a Malspam Infrastructure Delivering JS Malware

Source: Intrinsec
(Published: 31 May 2026)
Intrinsec tracked malspam infrastructure used to deliver JavaScript malware through bulletproof networks. Read more.

From Fake Purchase Orders to Remote Access: Analyzing the JS.MonoGlyphRAT Threat to US Enterprises

Source: ANY.RUN
(Published: 02 June 2026)
Learn how JS.MonoGlyphRAT targets organizations, enables remote access, and creates costly security risks. Read more.

These Convincing Copyright Notices Are Designed to Steal Google Logins

Source: Security Boulevard
(Published: 02 June 2026)
Scammers use fake takedown requests, countdown timers, and spoofed sign-in screens to steal Google logins from Chrome developers. Read more.

New npm Supply Chain Attack: Red Hat Cloud Services Compromised

Source: OX Security
(Published: 02 June 2026)
A new npm supply chain attack compromised packages associated with Red Hat Cloud Services. Read more.

Rapid7 Observed Exploitation of PAN-OS GlobalProtect Authentication Bypass CVE-2026-0257

Source: Rapid7
(Published: 02 June 2026)
Rapid7 observed exploitation of a PAN-OS GlobalProtect authentication bypass vulnerability tracked as CVE-2026-0257. Read more.

ATMZOW Skimmer

Source: Reflectiz
(Published: 02 June 2026)
Reflectiz analyzed ATMZOW, a skimmer campaign targeting payment data through compromised web infrastructure. Read more.

Hunting Megalodon Fossils

Source: ReversingLabs
(Published: 02 June 2026)
ReversingLabs described hunting techniques for identifying Megalodon-related malware artifacts and infrastructure. Read more.

Red Hat Cloud Service npm Packages Backdoored in 72 Seconds

Source: ReversingLabs
(Published: 02 June 2026)
Researchers analyzed how Red Hat Cloud Service npm packages were backdoored shortly after compromise. Read more.

Operation Dragon Weave Targets Czech Republic and Taiwan Using Azure Cloud C2

Source: Seqrite
(Published: 02 June 2026)
Seqrite uncovered a China-linked campaign targeting Czech Republic and Taiwan using Azure cloud command-and-control. Read more.

DriveSurge

Source: Silent Push
(Published: 02 June 2026)
Silent Push analyzed DriveSurge infrastructure and related threat activity. Read more.

GitHub Internal Repositories Breached

Source: Sophos
(Published: 02 June 2026)
Sophos analyzed activity involving breached internal GitHub repositories and related security implications. Read more.

Multiple Red Hat Cloud Services npm Packages Compromised

Source: StepSecurity
(Published: 02 June 2026)
StepSecurity analyzed multiple compromised Red Hat Cloud Services npm packages and associated supply-chain risks. Read more.

Kali365 PhaaS Inside Attack Infrastructure

Source: Todyl
(Published: 02 June 2026)
Todyl analyzed Kali365 phishing-as-a-service infrastructure and its role in account compromise operations. Read more.

Void Dokkaebi Uses InvisibleFerret Malware

Source: Trend Micro
(Published: 02 June 2026)
Trend Micro analyzed Void Dokkaebi activity using InvisibleFerret malware in targeted campaigns. Read more.

Smart Contracts for Command and Control

Source: Trend Micro
(Published: 02 June 2026)
Trend Micro analyzed attacker use of smart contracts as command-and-control infrastructure. Read more.

Validin Python SDK for Threat Monitoring

Source: Validin
(Published: 02 June 2026)
Validin introduced a Python SDK for threat monitoring and infrastructure analysis workflows. Read more.

Webworm: New Burrowing Techniques

Source: ESET Research
(Published: 02 June 2026)
ESET Research analyzed Webworm’s new techniques for persistence, stealth, and intrusion activity. Read more.

Threat Actors Target Crypto Organizations

Source: Wiz
(Published: 02 June 2026)
Wiz analyzed attacker targeting of cryptocurrency organizations and related cloud security risks. Read more.

Wiz Sensor Forensics GA

Source: Wiz
(Published: 02 June 2026)
Wiz announced forensic capabilities for incident response and cloud investigation workflows. Read more.

Premium Deception: Global Android Carrier Billing Fraud Campaign

Source: Zimperium
(Published: 02 June 2026)
Zimperium uncovered a global Android carrier billing fraud campaign using deceptive premium service flows. Read more.

These insights summarize the most common attacker behaviors, techniques, and defensive themes observed across the threat research featured below, helping highlight what mattered most during this reporting period.

Top ATT&CK Techniques Observed

• T1195 – Supply Chain Compromise (9/9): npm, PyPI, OpenSearch, TanStack, TeamPCP, and Shai-Hulud activity dominated this period.
• T1566 – Phishing / Social Engineering (8/9): Smishing, OAuth device-code phishing, fake apps, aid-themed lures, and AI-assisted campaigns remained prominent.
• T1555 – Credential Access (8/9): Infostealers, banking trojans, OAuth token theft, and cloud credential harvesting appeared across multiple campaigns.
• T1059 – Command Execution (7/9): PowerShell, Python, Bun, Git hooks, loaders, and RATs supported multi-stage execution chains.
• T1071 – Application Layer C2 (7/9): Telegram, NATS, Microsoft Teams, and other trusted channels were abused for C2 and operations.

What Matters Most

• Supply chain attacks remain the clearest trend. Developer ecosystems and package managers continue to be used for scalable access.
• Credential theft is the common objective. Many campaigns ultimately target passwords, sessions, tokens, banking data, or cloud keys.
• AI is moving into attacker workflows. Adversaries are using AI for exploitation, lures, targeting, and operational scale.
• Trusted platforms are being abused. Teams, Git hooks, package repositories, and cloud services are central to multiple attack chains.

What Defenders Should Watch

• Unexpected package installs, Git hook activity, or developer tool execution
• OAuth device-code abuse, suspicious MFA flows, and session theft patterns
• Outbound traffic to Telegram, NATS, cloud-hosted, or newly observed infrastructure
• Infostealer behavior targeting browsers, wallets, tokens, and cloud credentials

Quick Wins

• Restrict and monitor package manager activity in developer environments
• Review OAuth app approvals and device-code authentication policies
• Alert on execution from temp, download, and user-controlled directories
• Block newly registered domains tied to phishing, fake apps, and software lures

Key Insight: Attackers are increasingly abusing trusted developer ecosystems, social engineering campaigns, and cloud platforms to scale operations, with credential theft remaining the primary objective.

Mini Shai-Hulud: Cross-Ecosystem Supply Chain Worm Targeting npm and PyPI

Source: Expel
(Published: 06 May 2026)
Expel researchers detail Mini Shai-Hulud, a wormable supply chain campaign targeting both npm and PyPI ecosystems to spread malicious packages. Read more.

Inside a Criminal Phishing Panel

Source: Push Security
(Published: 06 May 2026)
Push Security analyzes a modern phishing panel used to automate credential theft, session hijacking, and operational management for phishing campaigns. Read more.

PureLogs Delivery via PawsRunner and Steganography

Source: Fortinet
(Published: 06 May 2026)
Fortinet researchers observed PureLogs malware being distributed through PawsRunner loaders combined with steganography techniques. Read more.

Operation HumanitarianBait: An Infostealer Campaign in Disguise

Source: Cyble
(Published: 07 May 2026)
Cyble analyzes Operation HumanitarianBait, a stealthy espionage campaign using aid-themed lures to deploy a fileless Python infostealer. Read more.

Industrialized Smishing Infrastructure Targeting UAE and Singapore

Source: Medium
(Published: 07 May 2026)
Researchers uncovered a large-scale smishing infrastructure impersonating transportation and government services in the UAE and Singapore. Read more.

TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook

Source: Elastic Security Labs
(Published: 07 May 2026)
REF3076 uses a trojanized Logitech installer to deploy TCLBANKER, a Brazilian banking trojan with environment-gated payloads, WPF fraud overlays, and self-propagating WhatsApp and Outlook worm modules. Read more.

Architecture Deception Investment Crypto Fraud

Source: Group-IB
(Published: 07 May 2026)
Group-IB uncovered a cryptocurrency investment fraud operation using deceptive infrastructure and impersonation tactics. Read more.

Suspicious Microsoft Store Apps May Deliver Go Backconnect Proxy Malware

Source: Luke Acha
(Published: 08 May 2026)
A suspicious Microsoft Store utility package impersonating WinDirStat loads a Go-based backconnect proxy implant through a native DLL. Read more.

PAN-OS Buffer Overflow Flaw Under Active State-Sponsored Exploitation

Source: HivePro
(Published: 08 May 2026)
A critical PAN-OS buffer overflow vulnerability is being actively exploited in campaigns linked to state-sponsored threat actors. Read more.

Orbit Returns

Source: Intezer
(Published: 08 May 2026)
Intezer researchers observed the return of Orbit malware, a Linux-focused threat using stealthy persistence and credential harvesting techniques. Read more.

Lookalike Domains Expose the iPhone Theft Economy

Source: Infoblox
(Published: 08 May 2026)
Infoblox researchers identified lookalike domains supporting large-scale iPhone theft and resale fraud operations. Read more.

Mobidash Android Ad Fraud Click Injection Analysis

Source: Jamf
(Published: 08 May 2026)
Jamf researchers analyzed Mobidash, an Android ad fraud campaign abusing click injection techniques for monetization. Read more.

OpenSearch Compromised in TeamPCP Campaign

Source: OpenSourceMalware
(Published: 09 May 2026)
TeamPCP operators compromised OpenSearch infrastructure to distribute malicious payloads and expand supply chain access. Read more.

Attackers Adopt Bun Runtime to Spread NWHStealer

Source: Malwarebytes
(Published: 09 May 2026)
Threat actors are leveraging the JavaScript runtime Bun to distribute NWHStealer malware and evade traditional detections. Read more.

DPRK Git Hooks Malware Campaign

Source: OpenSourceMalware
(Published: 10 May 2026)
North Korean operators are abusing Git hooks to silently execute malware within developer environments and repositories. Read more.

Sinkholing CountLoader: Insights Into Recent Campaigns

Source: McAfee
(Published: 10 May 2026)
McAfee Labs shares insights from sinkholing CountLoader infrastructure tied to malware delivery campaigns. Read more.

GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access

Source: Google Cloud Blog
(Published: 11 May 2026)
Google Threat Intelligence Group describes adversaries leveraging AI for vulnerability exploitation, augmented operations, and initial access. Read more.

Shai-Hulud compromises the @tanstack ecosystem: 160+ packages compromised

Source: Endor Labs
(Published: 11 May 2026)
Attackers planted credential-stealing malware in 84 @tanstack package versions across React, Solid, Vue, and Start as part of the fifth Shai-Hulud wave in eight months. Read more.

April 2026 Phishing Email Trends Report

Source: AhnLab ASEC
(Published: 12 May 2026)
In April 2026, the most common threat in phishing email attachments was Trojan, followed by phishing and downloader activity. Read more.

The Ultimate Guide to Detection Engineering with Censys

Source: Censys
(Published: 12 May 2026)
Vendor detection is not enough, and Censys frames infrastructure context as a way to turn indicators into reusable detection patterns. Read more.

Tycoon 2FA Operators Adopt OAuth Device Code Phishing

Source: eSentire
(Published: 12 May 2026)
Tycoon 2FA operators have adopted OAuth device code phishing to bypass traditional phishing defenses and capture user authentication tokens. Read more.

Malicious npm Packages Deliver Telegram RAT

Source: SafeDep
(Published: 13 May 2026)
Researchers uncovered malicious npm packages distributing a Telegram-controlled remote access trojan through open-source ecosystems. Read more.

FamousSparrow APT Targets Azerbaijani Oil and Gas Industry

Source: Bitdefender
(Published: 13 May 2026)
Bitdefender Labs tracked a multi-wave intrusion targeting an Azerbaijani oil and gas company from late December 2025 through late February 2026. Read more.

Suspected China-Linked Threat Actor Targets Global Manufacturer With Undocumented TencShell Malware

Source: Cato Networks
(Published: 13 May 2026)
The observed infection chain moves from a first-stage dropper to Donut shellcode retrieval through a masqueraded .woff resource, reflective shellcode execution, in-memory loading, and attempted C2 communication. Read more.

Kimsuky AppleSeed and PebbleDash Campaigns

Source: Kaspersky Securelist
(Published: 14 May 2026)
Kimsuky operators continue deploying AppleSeed and PebbleDash malware in espionage-focused campaigns targeting regional organizations. Read more.

NATS-as-C2: Inside a New Technique Attackers Are Using to Harvest Cloud Credentials and AI API Keys

Source: Sysdig
(Published: 14 May 2026)
The Sysdig Threat Research Team identified a novel command-and-control technique in which a threat actor used a NATS server as C2 infrastructure. Read more.

Amatera Stealer 4.0.2 Beta: What’s New in This Variant

Source: eSentire
(Published: 14 May 2026)
eSentire’s Threat Response Unit analyzes Amatera Stealer 4.0.2 Beta and changes in this variant’s behavior, delivery, and capability set. Read more.

Kazuar: Anatomy of a Nation-State Botnet

Source: Microsoft Security
(Published: 14 May 2026)
Microsoft details Kazuar malware infrastructure and tradecraft associated with nation-state activity. Read more.

ModeloRAT Campaign Uses Microsoft Teams Compromise

Source: Rapid7
(Published: 14 May 2026)
Rapid7 researchers dissected a ModeloRAT campaign leveraging Microsoft Teams compromise and social engineering. Read more.

OceanLotus Suspected PyPI Campaign

Source: Kaspersky Securelist
(Published: 15 May 2026)
Researchers identified suspected OceanLotus-linked malicious Python packages uploaded to PyPI to target developers and organizations. Read more.

Gremlin Stealer’s Evolved Tactics: Hiding in Plain Sight With Resource Files

Source: Unit 42 (Palo Alto Networks)
(Published: 15 May 2026)
Unit 42 researchers describe how Gremlin Stealer has evolved to hide malicious content in resource files while targeting credentials and sensitive data. Read more.

Dirty Pipe Variant Enables Linux Privilege Escalation

Source: ReversingLabs
(Published: 15 May 2026)
Researchers analyzed DirtyFrag, a Linux privilege escalation exploit targeting vulnerable systems. Read more.

Fake Claude Site Spreads Backdoor Malware

Source: Sophos
(Published: 15 May 2026)
Sophos researchers identified fake Claude AI websites distributing backdoor malware through deceptive downloads. Read more.

AMOS Malware Steals macOS Data at Scale

Source: Sophos
(Published: 16 May 2026)
Sophos details how AMOS malware is increasingly targeting macOS users for large-scale credential and data theft. Read more.

TeamPCP Supply Chain Attacks Analysis

Source: Trend Micro
(Published: 16 May 2026)
Trend Micro analyzes TeamPCP supply chain attacks affecting developer ecosystems and open-source infrastructure. Read more.

OpenClaw Skill Distributes Remcos RAT and GhostLoader

Source: Zscaler
(Published: 17 May 2026)
Zscaler researchers observed malicious OpenClaw skills distributing Remcos RAT and GhostLoader malware. Read more.

Funnull Sanctioned: What the Polyfill[.]io Attack Exposed About Infrastructure Laundering

Source: cside
(Published: 17 May 2026)
OFAC sanctioned Funnull Technology Inc. on 2025-05-29, along with administrator Liu Lizhi. Read more.

SHub Reaper | macOS Stealer Spoofs Apple, Google, and Microsoft in a Single Attack Chain

Source: SentinelOne
(Published: 18 May 2026)
Infostealers targeting macOS have continued to proliferate over the last two years, with threat actors iterating on successful techniques across related malware families. Read more.

Top ATT&CK Techniques Observed

• T1195 – Supply Chain Compromise (Score: 9/9): Abuse of trusted software distribution channels including npm packages, developer tools, and compromised updates.
• T1566 – Phishing / Social Engineering (Score: 8/9): OAuth AiTM attacks, smishing kits, CAPTCHA lures, and AI-generated phishing campaigns.
• T1555 – Credential Access (Score: 8/9): Widespread infostealer activity targeting credentials, sessions, and financial data.
• T1190 – Exploit Public-Facing Applications (Score: 7/9): Active exploitation of cPanel, LLM infrastructure, and internet-facing services.
• T1071 – Application Layer C2 (Score: 7/9): Use of SaaS platforms, OAuth workflows, and blockchain-based communication channels.
• T1059 – Command Execution (Score: 6/9): PowerShell, Python backdoors, and multi-stage loaders enabling execution and persistence.

What Matters Most This Period

• Supply chain attacks are leading initial access. Compromised packages, repositories, and software updates are being used to scale access across enterprise environments.
• Credential theft is the common objective. Across phishing, malware, and supply chain attacks, the end goal is consistently identity and account access.
• AI is increasing attacker efficiency. Threat actors are using AI-generated lures and automation to improve targeting and scale campaigns.
• Trusted platforms are being systematically abused. GitHub, SaaS tools, browser extensions, and developer ecosystems are central to multiple attack chains.
• Infrastructure exploitation remains high-impact. Targeting of appliances and exposed services continues to deliver significant access.

What Defenders Should Watch

• Execution from developer tools, package managers, and software installers
• OAuth abuse, MFA bypass attempts, and unusual authentication flows
• Browser extensions and macOS scripting activity tied to credential theft
• Outbound connections to newly observed or cloud-hosted infrastructure
• Mobile applications requesting sensitive permissions tied to financial workflows

Quick Wins

• Restrict and monitor package manager and developer tool usage
• Enforce MFA with additional verification for high-risk actions
• Alert on execution from temporary and download directories
• Block newly registered domains associated with phishing and fake software
• Review exposure of internet-facing services and administrative interfaces

Key Insight: Attackers are converging on three scalable entry points: 1) trusted software (supply chain), 2) trusted users (phishing), and 3) trusted platforms (SaaS/cloud) – all with credential theft as the consistent objective.

Tropic Trooper Pivots to AdaptixC2 and Custom Beacon Listener

Source: Zscaler
(Published: 22 April 2026)
Tropic Trooper has shifted tactics by adopting AdaptixC2 and a custom beacon listener in a multi-stage campaign targeting organizations across East Asia. Read more.

When Malware Authors Study Algebra: The Group Theory Inside Bedep’s DGA

Source: Gen Digital
(Published: 22 April 2026)
Bedep was a malware family active mainly in 2014 and 2015 that used an unusually sophisticated domain generation algorithm, or DGA, to hide its command-and-control infrastructure. Read more.

DragonBreath: Dragon in the Kernel

Source: Ransom-ISAC
(Published: 22 April 2026)
A 0-day BYOVD vulnerability in dragoncore_k.sys signed by Zhengzhou 403 Network Technology, with shell company analysis, Dragon Breath APT-Q-27 attribution, and an APT31 / Wuhan Xiaoruizhi personnel nexus. Read more.

The Gentlemen RaaS and SystemBC Activity Observed in Enterprise Intrusions

Source: PolySwarm
(Published: 22 April 2026)
Recent enterprise intrusions reveal increased activity from The Gentlemen ransomware-as-a-service operation alongside SystemBC malware used for command-and-control. Read more.

Malicious Checkmarx Artifacts Found in Official KICS Docker Repository and Code Extensions

Source: Socket
(Published: 22 April 2026)
Docker and Socket have uncovered malicious Checkmarx KICS images and suspicious code extension releases in a broader supply chain compromise. Read more.

The Meta 2FA Trap: From Verified Badge to Account Takeover

Source: Cofense
(Published: 22 April 2026)
Attackers are exploiting Meta’s verified badge system to bypass 2FA protections and take over user accounts through social engineering techniques. Read more.

Hold the Phone! International Revenue Share Fraud Driven by Fake CAPTCHAs

Source: Infoblox
(Published: 23 April 2026)
CAPTCHAs, the mundane tasks where we demonstrate our ability to select bicycles or distinguish chihuahuas from blueberry muffins, are increasingly being weaponized to trick users into performing actions with unexpected consequences. Read more.

Analyzing a Full ClickFix Attack Chain – Part 1

Source: Stormshield
(Published: 23 April 2026)
In a previous article, we introduced the ClickFix technique. Read more.

Komari C2 Agent Abuse

Source: Huntress
(Published: 23 April 2026)
Threat actors are abusing Komari C2 agents to establish persistence and execute malicious commands across compromised environments. Read more.

Snow Flurries: How UNC6692 Employed Social Engineering to Deploy a Custom Malware Suite

Source: Google Cloud Blog
(Published: 23 April 2026)
Google Threat Intelligence Group identified a multistage intrusion campaign by UNC6692 that used persistent social engineering, custom malware, and pivoting inside victim environments. Read more.

Operation TrustTrap: Domain Spoofing Campaign

Source: Cyble
(Published: 23 April 2026)
Operation TrustTrap leverages domain spoofing techniques to deceive users and facilitate phishing and credential theft campaigns. Read more.

Inside agenteV2: How Brazilian Attackers Use Fake Court Summons to Steal Banking Credentials in Real Time

Source: ANY.RUN
(Published: 24 April 2026)
A new phishing campaign targeting Brazilian users demonstrates how modern financial malware has evolved from simple credential theft into full-scale, operator-driven fraud platforms. Read more.

Bitwarden CLI Supply Chain Compromise

Source: SafeDep
(Published: 24 April 2026)
The malicious @bitwarden/cli npm release was not a normal Bitwarden update. Read more.

Kyber Ransomware: Double Trouble With Windows and ESXi Attacks

Source: Rapid7
(Published: 24 April 2026)
Kyber ransomware operators are targeting both Windows and ESXi environments, increasing impact through multi-platform encryption strategies. Read more.

Compromised eScan Update Enables Multi-Stage Malware and Blockchain C2

Source: Darktrace
(Published: 24 April 2026)
A compromised eScan software update was used to deliver multi-stage malware that communicates with blockchain-based command-and-control infrastructure. Read more.

KYCShadow Android Banking Malware Exploits Fake KYC Workflows

Source: CYFIRMA
(Published: 25 April 2026)
KYCShadow malware targets Android users by abusing fake KYC processes to steal credentials and one-time passwords. Read more.

Lotus Wiper Malware Campaign

Source: Kaspersky Securelist
(Published: 25 April 2026)
Lotus Wiper is a destructive malware campaign targeting organizations with data wiping capabilities following initial compromise. Read more.

CVE-2026-33626 Exploited in LLM Inference Engines Within Hours

Source: Sysdig
(Published: 25 April 2026)
Attackers rapidly weaponized CVE-2026-33626 to exploit LMDeploy-based LLM inference engines within hours of disclosure. Read more.

Mustang Panda Targets Banking Sector and Geopolitical Entities

Source: Acronis
(Published: 26 April 2026)
Mustang Panda is conducting campaigns targeting banking institutions and geopolitical organizations using advanced malware delivery techniques. Read more.

High-Risk GenAI Browser Extensions Expose Users to Data Theft

Source: Unit 42 (Palo Alto Networks)
(Published: 26 April 2026)
Researchers identified multiple GenAI browser extensions exposing sensitive user data through excessive permissions and insecure handling of inputs. Read more.

BlueNoroff Uses ClickFix, Fileless PowerShell, and AI-Generated Fake Zoom Meetings to Target Web3 Sector

Source: Arctic Wolf
(Published: 27 April 2026)
Arctic Wolf has identified a targeted intrusion against a North American Web3/cryptocurrency company, which we attribute with a high confidence level to BlueNoroff, a financially motivated subgroup of DPRK’s Lazarus Group. Read more.

New NGate Variant Hides in Trojanized NFC Payment App

Source: ESET Research
(Published: 27 April 2026)
A new NGate malware variant is distributed through trojanized NFC payment apps to steal financial data from mobile users. Read more.

Critical cPanel Authentication Bypass Actively Exploited

Source: Cato Networks
(Published: 27 April 2026)
A critical authentication bypass vulnerability in cPanel/WHM is being actively exploited in the wild to gain unauthorized access to systems. Read more.

Oluomo OAuth AiTM Phishing Campaign

Source: Censys
(Published: 28 April 2026)
Attackers are leveraging OAuth-based adversary-in-the-middle techniques using naturalization-themed lures to harvest credentials. Read more.

Silent Lures: Empty Subject Email Attacks

Source: Cyberproof
(Published: 28 April 2026)
Attackers are using empty subject lines in phishing emails to bypass filters and increase user engagement rates. Read more.

GachiLoader Uses AI-Themed Lures to Deliver Rhadamanthys Infostealer

Source: Malwarebytes (ThreatDown)
(Published: 29 April 2026)
GachiLoader campaigns use AI-themed lures and fake repositories to distribute Rhadamanthys infostealer malware. Read more.

Mini Shai-Hulud Targets SAP npm Packages With a Bun-Based Secret Stealer

Source: Aikido
(Published: 29 April 2026)
A new npm supply-chain compromise is targeting the SAP developer ecosystem. Read more.

Claude Adds Malware to Crypto Agent

Source: ReversingLabs
(Published: 29 April 2026)
ReversingLabs researchers discovered malicious code in a crypto trading project after an AI-based coding agent added a malicious package as a dependency. Read more.

Fake DHL Phishing Campaign Targets Credentials

Source: Forcepoint
(Published: 29 April 2026)
A phishing campaign impersonating DHL delivery notifications is being used to steal user credentials through fake tracking pages. Read more.

ClickFix Removes Your Background but Leaves the Malware

Source: Huntress
(Published: 30 April 2026)
BackgroundFix is a ClickFix lure dressed up as a free image-editing tool. Read more.

OtterCookie and Shifty Corsair Attack Strategy

Source: BlueVoyant
(Published: 30 April 2026)
Researchers observed a bifurcated attack strategy combining OtterCookie malware with shifting infrastructure to evade detection. Read more.

Mapping Remus Infostealer

Source: Cyber Intelligence Insights
(Published: 30 April 2026)
Researchers mapped Remus infostealer infrastructure using indicators, hosting patterns, ASN analysis, and blockchain pivots to uncover additional C2 domains and operator infrastructure. Read more.

Email Threat Landscape: Q1 2026 Trends and Insights

Source: Microsoft Security
(Published: 30 April 2026)
Microsoft analyzed Q1 2026 email threat activity, highlighting trends in phishing, social engineering, malware delivery, and credential theft. Read more.

RDP Security Risks Highlight Need for Secure Remote Access

Source: Forescout
(Published: 30 April 2026)
Ongoing threats targeting RDP services are driving the need for stronger remote access security controls and monitoring. Read more.

Watch Guard! Qilin Affiliate Exploits Network Appliances for Initial Access

Source: Ctrl-Alt-Intel
(Published: 01 May 2026)
Qilin is a long-standing and prolific Ransomware-as-a-Service group, active since late 2022, causing real-world impact across numerous sectors globally. Read more.

Inside Lazarus: AI-Driven Attacks on Developers

Source: Expel
(Published: 01 May 2026)
Lazarus Group is leveraging AI tools to scale attacks targeting developers and software supply chains. Read more.

Phoenix Phishing-as-a-Service Kit for Smishing Campaigns

Source: Group-IB
(Published: 02 May 2026)
The Phoenix PhaaS kit is enabling large-scale smishing campaigns with automated phishing infrastructure. Read more.