Malware analysis, exploit kits, zero-days, and proof-of-concept breakdowns.
Bitdefender's discovery of preinstalled system-privilege malware on budget Android devices exposes a supply chain blind spot that defenders …
Ledger's confirmation of malicious hardware implants in Nano X devices sold through a Southeast Asian reseller exposes the …
AvisLoader's shift to encrypted P2P messaging for command-and-control eliminates the single biggest lever defenders have: domain seizure. Varonis …
A Russian-speaking initial access broker orchestrated 51 AI agents to automate WordPress exploitation and Ukrainian infrastructure targeting at machine speed. The operation was exposed only through a single …
A Russian-speaking initial access broker weaponized Anthropic's Claude Code with 51 specialized agents to automate WordPress exploitation and Ukrainian critical infrastructure targeting. The campaign demonstrates how AI orchestration …
Elastic Security Labs exposes a fake Web3 accelerator distributing malicious npm packages, info-stealing malware, and attacker-controlled AI infrastructure. The campaign highlights how AI-generated legitimacy now lowers the cost …
This week's malware research roundup reveals threat actors embedding generative AI into operational pipelines, abusing public infrastructure for C2, and sustaining long-lived supply chain implants. Defenders face a …
Bitdefender's discovery of preinstalled, unremovable malware on budget Android phones across 150 countries highlights a critical supply chain failure. The Midnight Mimosa campaign shows firmware-level compromise is now …
Attackers are weaponizing Bing's click-tracking redirect and Google Ads to deliver ClickFix malware disguised as Claude installers. The 'Adception' technique exposes a systemic gap in how ad platforms …
The FBI's reported arrest of a suspected ShinyHunters operative signals renewed law enforcement pressure on data theft extortion rings. However, the simultaneous disclosure of a compromised Pentagon-run data …
The P7 DarkSword variant marks a shift from one-shot exploitation to persistent iOS implants with keychain and crypto wallet theft, bidirectional C2, and reduced forensic footprint. Defenders must …
Bitdefender's discovery of the Midnight Mimosa campaign reveals a persistent supply chain compromise in budget Android phones, giving attackers system-level control for ad fraud and residential proxy networks. …
The arrest of a Tren de Aragua-linked malware operator for ATM jackpotting marks a turning point: transnational cartels are now embedding cybercrime capabilities directly into their operational toolkit, …
This week's threat landscape highlights a dangerous convergence: commodified initial access, crypto-abusing C2 infrastructure, and poisoned developer tooling. The trust gaps on both sides of the fence reveal …
Hunt.io's analysis of BraZetsu infrastructure reveals why TLS certificate data outlasts traditional IP-based IOCs by months. Access brokers targeting ERP, SCADA, and EDR-equipped Windows machines are selling entry …
FakeGit's resurgence with over 17,000 malicious GitHub repositories reveals that platform-level takedown mechanisms are fundamentally outmatched by adaptive malware distribution. The campaign's abuse of developer trust and AI …
The Wazza phishkit demonstrates how attackers are building anti-detection and traffic filtering directly into phishing infrastructure, using Device Code Authentication abuse to bypass MFA. Defenders must evolve detection …
16 malicious Firefox extensions impersonating Rabby and OKX wallets exfiltrated recovery phrases via Cloudflare Workers. Shield53 analyzes why browser extension ecosystems remain a soft underbelly for credential theft …
The Shai-Hulud supply chain worm turned the tensorlake npm SDK into a credential harvesting platform with persistence, destructive retaliation, and self-propagation. The real threat is the post-infection blast …
The MALFEX npm campaign delivering Overlord RAT demonstrates that individual threat actors now build supply chain operations rivaling organized groups. With 40,767 downloads across 8 malicious packages, defenders …
The Canto Incognito campaign has compromised 3,400+ servers by targeting exposed LLM and AI infrastructure. Shield53 breaks down the novel poem-based C2 technique and what defenders should do …
The PoeLLM botnet has compromised 3,400+ exposed AI servers, weaponizing CVE-2026-42271 in LiteLLM for cryptomining and lateral movement. Shield53 breaks down the C2-in-a-poem tradecraft and what defenders must …
The joint FBI/Secret Service FortiBleed advisory reveals 86,644 Fortinet firewalls compromised without a software exploit — just leaked credentials and weak hashing. The real lesson: patching can't fix …
CERT-UA's discovery of over 100 compromised sites delivering LunexStealer via fake Cloudflare checks reveals attackers using smart contracts for tamper-resistant C2 and BYOVD techniques for defense evasion. Defenders …
CERT-UA's disclosure of 100+ compromised websites delivering LunexStealer reveals an alarming convergence of ClickFix social engineering, EtherHiding blockchain infrastructure, and multi-layered evasion. Defenders face a campaign that abuses …
ClickFix attacks now leverage DNS TXT records and browser cache pre-fetching to conceal payload delivery, bypassing network-based detection. Defenders must rethink edge controls and DNS monitoring to catch …
A human-operated phishing platform is impersonating ad products from ChatGPT, Gemini, Claude, and others using browser-in-the-browser tricks to steal credentials and MFA codes. Shield53 breaks down why AI-adjacent …
A sophisticated phishing campaign using browser-in-the-browser techniques is hijacking advertising accounts by impersonating AI products like ChatGPT and Gemini. Shield53 breaks down why ad-tech credentials are the new …
Fortinet's disclosure of ClingSTUN reveals a Linux backdoor that weaponizes public STUN infrastructure to hide C2 traffic inside legitimate WebRTC flows. The campaign's scale across a dozen-plus router …
ClingSTUN's clever abuse of public STUN servers for C2 channeling highlights a persistent IoT security failure: organizations still treat cameras and routers as disposable appliances rather than networked …
The arrest of Ploutus malware's alleged developer reveals how ATM jackpotting has become a funding pipeline for transnational organized crime. Financial institutions must treat ATM security as both …
Cling botnet exploits a five-year-old Realtek Jungle SDK RCE flaw and disguises its C2 channel as STUN NAT-traversal traffic, making detection extremely difficult. Defenders must hunt for protocol …
This week's malware research roundup reveals a convergence of trends: kernel-level evasion via BYOVD, agentic cloud attacks, and resurgent nation-state tooling. Shield53 breaks down what defenders must prioritize …
The detention of a ShinyHunters suspect in Jordan marks a turning point in the group's operational security. When threat actors turn state's evidence, the ripple effects extend far …
The reported detention and cooperation of a ShinyHunters operator in Jordan signals more than another arrest — it marks a turning point where internal fracture becomes law enforcement's …
Jamf Threat Labs has uncovered CloudSyncD, a fake Zoom installer targeting macOS users that steals passwords using invisible Unicode steganography. The rapid development-to-deployment timeline signals an alarming acceleration …
The U.S. Treasury's sanctions against eight Tren de Aragua members expose a startling reality: legacy ATM malware like Ploutus remains devastatingly effective, with $40.73 million stolen across 1,500+ …
Newly discovered Linux backdoors impersonating Asian mail security products highlight a growing adversary trend: hiding malicious implants in plain sight on edge devices where defenders rarely look. This …
Sucuri's discovery of the SC backdoor reveals an eight-component self-healing mesh that rebuilds itself across files, database, and shared memory. Standard cleanup approaches will fail. Here's what defenders …
Shield53 analysis: ClickFix campaigns now exploit the credibility of OpenAI and Google domains through malicious custom GPTs, turning AI assistive tools into delivery mechanisms for remote access trojans. …
Attackers are layering MSP360 and ScreenConnect in phishing-driven intrusions, abusing digitally signed RMM tools to hide in plain sight. The real problem isn't the tools — it's that …
The CSuite campaign's simultaneous targeting of Microsoft 365 sessions and endpoint control via legitimate RMM tools represents a dangerous convergence that traditional email security alone cannot stop. Shield53 …
Huntress uncovered a 40+ incident campaign abusing ChatGPT Custom GPTs as a social engineering launchpad for a multi-stage RAT. The real story isn't the malware—it's how trusted platforms …
Threat actors are abusing OpenAI's custom GPT ecosystem and sponsored Google results to funnel victims into ClickFix attacks delivering full-featured RATs. The campaign exploits the inherent trust in …
The arrest of an alleged ShinyHunters leader in Amsterdam reveals a threat group that has crossed from data theft into ordering physical murders. With 140+ breaches and $70M …
Two former Air Force members sentenced to nearly 16 years combined for BEC scams highlight an uncomfortable truth: insider access and operational knowledge amplify social engineering damage far …
101 malicious npm packages abusing the Baileys WhatsApp library have accumulated 490,000 downloads, silently auto-subscribing developers to attacker-controlled WhatsApp channels. This is a wake-up call for dependency hygiene …
The arrest of a convicted hacker working in legitimate cybersecurity roles while allegedly maintaining ties to ShinyHunters exposes critical gaps in background vetting, insider threat monitoring, and the …
Carbonato's use of Hermes Agent to run commands through Telegram on compromised Docker hosts marks a shift toward AI-augmented botnet operations. Defenders should treat exposed container APIs and …
Dutch police have arrested a 24-year-old Amsterdam man linked to the ShinyHunters hacking group. The case underscores the difficulty of attributing forum aliases to real-world actors and the …
Microsoft's analysis of NeedyMantis reveals a modular post-exploitation framework optimized for long-term dwell time in high-value targets. The DLL sideloading technique and WebSocket-based C2 make detection challenging for …
RatHat's operators have integrated Google's Gemini into their MaaS console to triage infected Android devices by estimated bank balance. The AI isn't moving money — it's making criminal …
A malicious Chrome extension disguised as an ad-blocker reached millions of downloads before removal, exposing fundamental flaws in browser extension vetting. Shield53 examines why app store approval is …
The Carbonato botnet's weaponization of Hermes Agent via exposed Docker daemons signals a shift where open-source AI frameworks become attacker infrastructure. Defenders must rethink container exposure and AI …
The 70-month sentence of Cameron Wagenius reveals a disturbing convergence of insider access, credential theft tools, and forum-based extortion economies. Shield53 analyzes the operational failures that enabled a …
Security Affairs' Round 116 newsletter surfaces a convergence of trends: MaaS platforms abusing GitHub, npm and Terraform supply chain poisoning, AI-driven C2 implants, and PAYLOAD ransomware weaponizing Active …
The Rydox marketplace operated for nearly a decade, selling stolen PII and fraud tools to 18,000 users. Its takedown shows how international coordination can disrupt cybercrime infrastructure, but …
Lunex stealer's use of CVE-2023-20598 in AMD's PDFWKRNL.sys driver to blind EDR before credential theft marks a dangerous convergence of ransomware-grade techniques with commodity infostealer operations. Defenders need …
The reactivation of compromised actions-cool GitHub Actions repositories reveals a dangerous persistence vector: malicious tags survived a platform takedown, automatically resuming credential exfiltration when repos came back online. …
The latest ClickFix campaign weaponizes compromised but legitimate Ukrainian business sites to deliver Psychedelic Stealer via fake Cloudflare CAPTCHAs, deliberately avoiding PowerShell. Defenders need clipboard monitoring and msiexec …
PamStealer's latest variant defeats static analysis by requiring a live X25519 key exchange with its C2 server before the payload can be unwrapped—meaning defenders can no longer extract …
The Rydox guilty plea reveals an eight-year criminal enterprise that commodified stolen credentials and identity data at industrial scale. For defenders, the real lesson isn't the conviction — …
The CARBONATO botnet represents a troubling evolution—malware that steals credentials to fund its own AI operations. Exposed Docker daemons remain the persistent entry vector, but the real story …
MacSync malware is abusing public iCloud calendar events as a covert C2 channel, leveraging Apple's infrastructure to evade traditional network detection. The addition of a Finder-impersonating backdoor module …
SectopRAT's return — this time hiding inside legitimate applications — reinforces a hard truth: reputation-based allowlisting is no longer sufficient. Defenders must pivot to behavioral detection and process-level …
Carbonato's integration of the Hermes AI agent framework into a self-propagating Docker botnet marks a meaningful evolution in attacker automation. Exposed Docker daemons on port 2375 remain a …
The weaponization of third-party[.]com — a non-IANA-reserved domain referenced across 1,700+ GitHub repos — exposes a systemic blind spot in how developers, documentation teams, and AI agent frameworks …
Arctic Wolf Labs uncovers a new ClickFix campaign using hacked Ukrainian business websites to distribute Psychedelic Stealer through fake Cloudflare verification pages. The attack chain exploits user trust …
A narrow but effective Android surveillance tool is targeting logistics workers via fake app store pages, intercepting SMS and enabling call redirection. The suspected AI-assisted development signals a …
ClickFix has overtaken conventional phishing as the top enterprise initial-access method by exploiting the one thing security tooling trusts implicitly: an authenticated user pasting into a native binary. …
The unreserved placeholder domain third-party.com is now serving ClickFix social-engineering attacks disguised as Cloudflare verification. Shield53 explains why documentation hygiene matters and how to harden your environments against …
Group-IB's discovery of RemControl reveals a maturing Android MaaS ecosystem where AI-assisted development, Telegram-based C2 rotation, and Accessibility Service abuse converge into a potent remote-controlled banking threat across …
A newly detailed EDR evasion technique bypasses endpoint detection by manipulating process initialization structures instead of calling monitored Windows APIs. Defenders relying solely on API hooking need layered …
North Korean-linked threat actors have expanded their Go-malware supply chain campaign into HashiCorp's Terraform Registry for the first time. The operation uses sophisticated multi-stage delivery via blockchain C2, …
Cisco Talos has documented CLOSEDQUORUM, a Windows implant that delegates command decisions to a voting panel of four commercial AI models. While the public sample is non-functional, the …
Compromised npm and PyPI packages from MemTensor delivered a cross-platform Go credential stealer with worm-like self-propagation. The attack chain through GitHub Actions exposes a systemic weakness in package …
The EvilTokens phishing-as-a-service kit weaponized AI to automate post-compromise reconnaissance traditionally requiring skilled operators. Its takedown reveals how AI is democratizing sophisticated social engineering at industrial scale.
A fake LastPass GitHub campaign delivered the Rapuncel infostealer using a Microsoft-signed driver to neutralize 145 security tools. The real story isn't the brand spoofing—it's the weaponization of …
Microsoft's takedown of the EvilTokens phishing-as-a-service platform highlights how device code flow abuse bypasses MFA by routing auth through Microsoft's own infrastructure. Defenders must restrict legacy auth patterns …
Shield53 analyzes the npm package tw-pkgprobe-7731, a sophisticated credential harvesting tool disguised as a Twilio bug-bounty probe. The rapid version evolution and environment-aware payload delivery signal a well-resourced …
CrowdSec's GitHub breach via the TanStack npm supply chain attack exposes how OAuth tokens from departed employees become persistent attack vectors. The real lesson isn't that security firms …
Microsoft's disruption of EvilTokens exposes how AI is being weaponized at every stage of phishing-as-a-service operations. The device code flow abuse vector remains underappreciated by defenders reliant on …
The EvilTokens takedown exposes how AI-enhanced PhaaS operators weaponized OAuth device-code flows to bypass MFA across 10,000+ organizations. Here's what defenders need to understand about the post-takedown threat …
The indexed-btree campaign demonstrates how threat actors pivot tactics within months of ecosystem-wide security changes. By embedding loaders in runtime code instead of lifecycle scripts, attackers bypass npm …
Cybercriminals are bundling malware into popular film torrents, with early victims in Kenya and Uganda. Shield53 breaks down why this delivery method persists, who's most exposed, and how …
A fake LastPass Authenticator installer on GitHub abuses a Microsoft-signed kernel driver to silently kill 145 security products before deploying a password stealer. This BYOVD attack exposes a …
The TASK#STOMP campaign demonstrates why PowerShell-based implantware remains a top-tier threat: dual C2 redundancy, scheduled task masquerading, and timestomping create persistent access that evades superficial monitoring. Defenders need …
Blackpoint's discovery of ChainScript marks a maturation of blockchain-based C2 from concept to operational reality. By embedding WebSocket endpoints in a Polygon smart contract, attackers gain infrastructure that …
ChainScript combines ClickFix lures with Polygon-based C2 rotation, giving threat actors a resilient, takedown-resistant delivery pipeline. Defenders must adapt detection beyond static indicators as blockchain-resolved infrastructure becomes commodity-grade.
The indexed-btree campaign demonstrates that blocking install scripts is necessary but insufficient. Defenders must now scrutinize runtime behavior, not just installation pipelines, to catch supply chain threats.
Security Affairs' Round 115 newsletter reveals converging malware trends: AI-powered threats, massive supply chain compromises, and sophisticated browser credential theft. Shield53 analyzes what defenders should prioritize.
The Brevo incident demonstrates how a single hardcoded Cloudflare API key turned a trusted CDN into a malware distribution channel for 100,000+ sites. Edge-based content manipulation bypasses traditional …
A new infostealer campaign weaponizes SEO-poisoned GitHub repos and a Microsoft-signed EDR-killing kernel driver to bypass endpoint protection. The abuse of trusted distribution channels and valid code-signing certificates …
A cluster of 13 malicious npm packages delivers WeaselBiscuit, a stripped-down stealer with ties to DPRK's Contagious Interview tooling. The shift toward lightweight, focused malware signals a deliberate …
RatHat elevates mobile malware sophistication by abusing Android Accessibility Services to silently extract ADB pairing codes and self-pair with the device's own debug interface — no cable, no …
CrowdStrike's attribution of PhantomRaven to an LLM-assisted developer highlights a troubling trend: generative AI is lowering the barrier to producing functional, evasive malware targeting software supply chains. Defenders …
RatHat leverages an LLM to dynamically navigate infected Android devices via the Accessibility API, making its automation far more adaptable than scripted malware. This represents a significant shift …
Two campaigns underscore a shifting threat landscape: unauthenticated LocalAI deployments are being weaponized for root-level access and credential theft, while a stealthy PPI marketplace turns YouTube and SEO …
A hardcoded Cloudflare API key in Brevo's source code enabled attackers to deploy a malicious Worker that injected ClickFix malware scripts at the CDN edge, affecting potentially 100,000+ …
Lumen's discovery of BambooToken marks a significant evolution in malware C2 design, leveraging MQTT brokers to obscure attacker infrastructure. Defenders must rethink network monitoring to catch protocol-abusing threats.
A Brazilian banking malware operation is silently installing malicious Chrome and Edge extensions by defeating Chromium's cryptographic integrity protections. The KREMLIN toolkit represents a dangerous escalation in browser-centric …
The N0va phishkit exploits legitimate authentication flows to steal valid session tokens, bypassing traditional malware detection. Shield53 analyzes why adversary-in-the-middle phishing demands a fundamentally different defensive posture.
The compromise of a premium WordPress plugin's distribution channel highlights persistent weaknesses in the CMS ecosystem's update trust model. At least 1,500 sites received backdoored updates after attackers …
Elastic Security Labs exposes REF9334, a Brazilian banking malware operation using Ethereum smart contracts for resilient C2 and malicious Chrome/Edge extensions that bypass Chromium integrity controls. Defenders need …
A $250/month malware-as-a-service platform offering full Windows enterprise attack capabilities signals further erosion of the barrier to entry for sophisticated cybercrime. Shield53 analyzes the defensive implications.
A stealthy multi-platform malware family has operated undetected for over three years, abusing IoT-friendly MQTT protocol and DLL sideloading through PKI token software. Defenders must rethink monitoring for …
BambooToken's use of MQTT for command-and-control highlights a growing trend of attackers abusing legitimate messaging protocols to evade network monitoring. Defenders need to rethink egress filtering and behavioral …
The extradition of five alleged Black Axe leaders to the US underscores how romance scam operations function as disciplined, transnational enterprises. Shield53 analyzes the operational patterns and what …
The hijacking of HBO Max's verified Reddit account to distribute 108 malicious ClickFix ads exposes how threat actors exploit platform trust signals. The PasteSwitch campaign demonstrates increasingly sophisticated …
A cross-store Twitch browser extension siphoning OAuth tokens to Russian proxy infrastructure exposes a persistent gap in browser extension governance and token-handling hygiene. Shield53 breaks down the technical …
Elastic Security Labs exposes a 15-month Brazilian banking malware campaign that forges Chrome's App-Bound encryption and Secure Preferences HMACs to silently install malicious extensions. The use of Ethereum …
Security Affairs' latest malware roundup reveals a converging threat landscape: AI-assisted analysis tools are being actively subverted, DPRK APTs are expanding sector targeting, and critical Artifactory CVEs are …
Extortion gangs are weaponizing passkey adoption messaging to bypass MFA through AiTM and device-code flow abuse. Shield53 analyzes why this social engineering pivot works and how defenders should …
GoldFactory's abuse of Android Work Profile to deploy Gigabud underscores a maturing mobile banking threat. Organizations must expand defenses beyond MDM to cover BYOD and consumer-grade devices touching …
The new Mantax Otax Android malware strain is a Swiss-army-knife threat combining file encryption, data exfiltration, screen capturing, and victim harassment. Its reliance on Accessibility services and legitimate …
Bitdefender's discovery of thousands of deceptive Early Access apps exposes a structural flaw in Google Play's review-suppression model. Attackers are weaponizing the absence of user ratings alongside AI-generated …
Gigabud's novel use of Android work profiles to evade banking app malware detection demonstrates how legitimate OS isolation features can be weaponized. Defenders must rethink mobile threat detection …
SophosLabs' analysis of PoisonedRefresh reveals a sophisticated two-stage Linux implant exploiting CVE-2025-53521 in F5 BIG-IP APM. Its fileless, in-memory PHP web shell injection and upgrade-survival mechanism make detection …
Attackers are chaining Google's own redirect services across multiple properties to bypass email security gateways and deliver credential theft payloads. The real lesson isn't about Google — it's …
DoppelCart's sprawling network of 119,000+ fraudulent e-commerce sites represents a new scale in payment card theft and brand abuse. Shield53 breaks down the infrastructure, threat surface, and what …
ClickFix social engineering has evolved beyond simple clipboard hijacking into a multi-stage persistence framework abusing trusted cloud and SaaS platforms. Defenders need to rethink endpoint detection boundaries.
CrowdStrike has uncovered Slim Spider, a financially motivated threat actor targeting Brazilian financial institutions since March 2026. The group's abuse of cloud instance metadata, Azure DevOps pipelines, and …
A Chinese-language threat group's compromise of Brazilian government servers to host gambling phishing via reverse proxies highlights a growing abuse of institutional trust. Defenders must rethink how they …
Threat cluster PREY-0058 is bypassing endpoint security entirely through phone-based IT impersonation and adversary-in-the-middle portals — no malware required. Shield53 analyzes the residential proxy session-replay technique and what …
PEEP demonstrates how Chromium's extension integrity model can be subverted post-compromise to create persistent, dual-layer backdoors. The native messaging bridge transforms a browser add-on into a full remote …
BigBear 2.0's AiTM phishing kit has bypassed MFA at 258 organizations using Evilginx2-based session cookie theft and FIDO2 interference. Defenders must move beyond MFA as a silver bullet …
Huntress reveals a four-stage VBScript chain abusing ConnectWise ScreenConnect to spread worm-like across newly connected hosts. The campaign's EDR-aware staging and legitimate-tool abuse demand immediate detection and hardening …
JSCeal's use of compiled V8 bytecode to hide crypto-stealing payloads exposes a widening gap in JavaScript-oriented malware analysis. Defenders need to rethink static analysis pipelines and endpoint detection …
JSCeal's browser-assembled, fileless delivery model and session cookie theft represent a paradigm shift in malvertising. Defenders must rethink detection strategies as traditional AV and network signatures become increasingly …
Attackers are splitting finance-themed lure words with invisible Unicode Tags block characters to bypass keyword filters. Shield53 explains why normalization must precede detection and how the same technique …
Elastic Security Labs has uncovered four REVSTEALER-linked modules that persist after the stealer self-destructs — one disabling Windows Update and Microsoft Defender to run a cryptominer. The post-compromise …
Security Affairs' Malware Newsletter Round 113 reveals a converging threat landscape where AI platforms are now both targets and weapons, RATs grow stealthier, and ML malware detectors face …
Threat actors are storing ClickFix payloads in BNB Smart Chain smart contracts, creating takedown-resistant infrastructure across 5,400+ compromised sites. Defenders face a paradigm where blockchain immutability becomes offensive …
Microsoft's disclosure of a high-volume phishing campaign abusing deprecated Unicode tag characters exposes a critical blind spot in traditional email security stacks. The convergence of ASCII smuggling techniques …
Attackers didn't exploit a software vulnerability — they compromised Coder's Cloudflare infrastructure to inject rogue registry servers, turning a trusted package source into a credential-stealing pipeline. This represents …
Group-IB's disclosure of the BraZetsu malware framework reveals a maturing access-as-a-service economy where AI-enhanced reconnaissance and sub-$6 pricing lower the barrier for follow-on attacks. Defenders in Latin American …
Infostealer logs now routinely contain session tokens that bypass MFA entirely. Security teams fixating on password resets are solving yesterday's problem while attackers walk through the front door …
Brazil's banking sector has long been a crucible for financially motivated cybercrime, but Breeze Comet represents a troubling leap in operational maturity. Shield53 analyzes what defenders should take …
A 46-country phishing campaign abusing legitimate RMM software exposes a fundamental gap in reputation-based defenses. With 94% of infrastructure rotating daily, SOC teams must shift to behavioral detection …
Symantec's disclosure of threat actors weaponizing the trusted Node.js runtime reveals a growing trend: attackers are pivoting to LOLBins and interpreted code to evade endpoint detection. Defenders need …
The Shai-Hulud infostealer worm nearly tripled its credential scanning footprint from 189 to 469 locations, now targeting AI tool configs alongside CI/CD and cloud secrets. This marks a …
The Spring Ring operation targeting Microsoft Teams users via vishing highlights a dangerous convergence of social engineering and collaboration platform abuse. Defenders must rethink identity-centric controls as attackers …
A sophisticated malware campaign attributed to the Silver Fox threat cluster is using cloned vendor websites to distribute installers that systematically disable Windows Update, weaken Defender, and establish …
The Gambling Goblin campaign exposes a dangerous blind spot: attackers weaponizing legitimate government web infrastructure as reverse proxies for SEO fraud and credential theft. Defenders must rethink how …
StreamRat's sophisticated multi-stage infection chain, pushed through Meta ads to nearly 600K EU accounts, demonstrates how Android's Accessibility Services remain the platform's most exploited attack surface — and …
The extradition of a Russian national for a 2016–2017 Excel macro campaign using TVRAT and DarkVNC underscores how basic social engineering and DLL hijacking remain devastatingly effective nearly …
A decade-old campaign infecting 80,000 freelancers via platform messaging reveals enduring truths: macro-laden attachments, legitimate RAT abuse, and gig-economy platforms remain a potent combination. The threat model hasn't …
The joint disruption of Sality's P2P infrastructure marks a rare victory against one of cybersecurity's longest-running threats. But the sinkholing approach has limitations defenders need to understand.
The DOJ's coordinated sinkhole operation against Sality demonstrates a replicable blueprint for dismantling decentralized botnets. But the real lesson for defenders is what this malware's longevity reveals about …
Elastic Security Labs' analysis of REVSTEALER reveals an infostealer that's maturing fast — combining blockchain-based C2 resilience, sandbox scoring, and YouTube hijack distribution. The gaming platform focus signals …
Threat actors are turning trusted endpoint management platforms into covert remote access channels. The Faronics Deploy abuse campaign demonstrates why defenders must monitor signed binaries and enrollment activity, …
Breeze Comet's systematic abuse of Brazil's Pix, STR, and Boleto payment rails exposes a broader pattern: threat actors are shifting from data theft to direct transactional fraud. Defenders …
Softaculous has confirmed a BGP hijacking attack redirected Virtualizor update traffic to attacker-controlled servers, delivering malicious updates during a 33-hour window. This incident underscores a fundamental weakness in …
Elastic Security Labs demonstrates five Linux fileless execution patterns using memfd_create and related primitives. As attackers leverage LLMs to prototype loaders, defenders need behavioral detection—not just file-based controls—to …
Thirteen malicious Composer packages bridged web supply chain compromise with a full WebKit-to-kernel iOS exploit chain. The campaign demonstrates how PHP dependency ecosystems can become delivery vectors for …
The ClickFix campaign's use of Polygon blockchain for dynamic C2 resolution represents a structural shift in how threat actors defeat infrastructure takedowns. Defenders can no longer rely on …
The Kansas ATM jackpotting case highlights a physical-cyber attack vector that cost U.S. financial institutions $20M in 2025 alone. Shield53 breaks down why this matters and what ATM …
Threat actors are industrializing initial access through repeatable, low-skill techniques like ClickFix social engineering and living-off-the-land tool abuse. The data shows standardization beats novelty — and defenders need …
Five guilty pleas linked to Tren de Aragua highlight how transnational organized crime is industrializing ATM malware operations. Shield53 examines what defenders should learn from the operational failures …
Infostealers compromising Anthropic's Claude session tokens expose a fundamental weakness: browser-based session authentication bypasses MFA entirely. Organizations must treat session cookies as crown-jewel credentials and adopt browser isolation, …
The TerminalFix campaign demonstrates how fake-update social engineering has matured into full enterprise compromise chains with reverse tunneling. Defenders must rethink detection around user-initiated execution and PowerShell living-off-the-land …
Silver Fox's ValleyRAT campaign weaponizes legitimate Chinese adware through DLL sideloading, exploiting defender blind spots around PUA classifications. The technique signals a shift toward hiding in plain sight …
Microsoft's discovery of TerminalFix marks a dangerous evolution in ClickFix social engineering — shifting from infostealer delivery to persistent reverse tunneling that can transform a single compromised workstation …
Silver Fox's latest ValleyRAT distribution through signed Chinese adware shows why code-signing trust and user-managed antivirus exclusions are structurally broken defenses. The BSOD-on-termination trick and DLL sideloading make …
Infostealer malware is swiping authenticated Claude sessions, bypassing MFA entirely and letting attackers drain paid usage. Anthropic's response is reactive — defenders need to think differently about session-based …
Anthropic's warning that infostealers like LummaC2 and Vidar are draining Claude session quotas reveals a new abuse vector. AI API credits and usage allowances are now a monetizable …
A sophisticated campaign compromising Chrome and Edge extensions since early 2024 deployed 16 modular payloads to drain crypto wallets, steal exchange credentials, and inject ClickFix lures. Five extensions …
SecurityAffairs' Round 112 malware newsletter reveals a convergence of state-sponsored espionage, AI-enabled malware evolution, and crimeware innovation. Shield53 analyzes the strategic implications for defenders.
Microsoft's disclosure of TerminalFix reveals how ClickFix attacks are maturing—shifting from the Run dialog to PowerShell, adding reverse-tunnel implants and steganographic payload delivery. Defenders need layered controls that …
A coordinated campaign tracked as 'Superior' has weaponized 19 Chrome and Edge extensions with wallet-stealing and crypto-draining code. The tactic of buying legitimate extensions or shipping clean versions …
The arrest of two alleged TeamPCP members in Australia highlights how easily malicious code in public repositories can cascade into 1,000+ compromised organizations. Defenders must rethink how they …
The arrest of two alleged TeamPCP members in Australia underscores how a small group can weaponize developer trust at global scale. Shield53 analyzes the operational lessons and what …
The charging of two alleged TeamPCP members in Australia exposes a cascading credential-theft model that turned trusted security tools into attack vectors. Organizations must treat the entire exposure …
The arrest of two alleged TeamPCP members in Australia marks a milestone in combating the most prolonged software supply chain attack campaign on record. But the operational model …
A Cambodia-targeted campaign delivers Spark RAT via a multi-stage chain that abuses a vulnerable OPSWAT driver to kill security tools. The BYOVD technique and open-source RAT combination lowers …
Dark Caracal's new Go-based malware uses Ethereum smart contracts as a fallback C2 mechanism, making infrastructure takedowns significantly harder. Defenders need blockchain monitoring in their threat hunting toolkit.
The leap from mobile click-fraud to vehicle infotainment systems signals a dangerous expansion of commodity malware into automotive platforms. Defenders in fleet and OEM spaces must treat head …
NovaCookies is a fully managed PhaaS platform abusing legitimate Docusign envelopes to bypass email authentication and steal Microsoft 365, Okta, and Entra federated sessions. Defenders must shift to …
AitM phishing kits like NovaCookies are industrializing MFA bypass through session cookie theft. Defenders must shift from credential-centric to session-centric identity protection.
Operation Jackal IV's disruption of Black Axe support infrastructure signals a strategic shift: targeting cybercrime logistics networks, not just individual operators. Organizations should treat this as intelligence on …
SOCRadar's exposure of AnonyMousKIT reveals a professionalized PhaaS platform using rented AI voice agents to social-engineer stolen device owners out of passcodes and 2FA codes. At ~10 cents …
Threat actors are turning npm package mirrors into free hosting for phishing redirectors, leveraging the reputations of unpkg.com and similar CDNs to evade security filtering. This represents a …
Shield53 analysis: A PhaaS platform with 506 domains and 168 reseller brands is using AI voice agents to socially engineer Apple device passcodes at $0.10 per call, turning …
The Mirage2FA phishing-as-a-service campaign has compromised thousands of organizations by stealing session cookies through AiTM attacks. Defenders must shift from password-centric controls to session-aware identity protection strategies.
Threat actors are repurposing npm and unpkg mirrors as free, reputation-laundered hosting for ClickFix phishing pages. This isn't a supply chain attack on developers—it's an abuse of trust …
E4del and PINHOLE RATs are abusing FTP server banners as dead drop resolvers — a first-in-the-wild technique that evades web-based C2 detection. Shield53 breaks down why this matters …
WeedHack's persistence after C2 disruption highlights how blockchain-backed command infrastructure and SEO poisoning create malware campaigns that survive traditional takedowns. Defenders need a fundamentally different response playbook.
The WordlistLoader technique marks a dangerous shift in ClickFix social engineering, using text-disguised payloads to deliver the Amatera infostealer. Defenders need to rethink detection strategies that rely on …
Attackers are weaponizing AI-built lookalike sites and SEO poisoning to outrank legitimate Minecraft client projects, distributing the Weedhack stealer via Discord and MediaFire links. Defenders should focus on …
Cybercriminals are weaponizing GTA VI leak hype with a 113GB fake build containing a 50KB malware payload. The attack disables Windows Defender before deploying—here's what defenders need to …
ReliaQuest survived a ShinyHunters vishing attack thanks to device-trust controls, but the campaign's evolving TTPs—lookalike .claims domains, MFA push fatigue, and help desk impersonation—demand urgent attention from every …
SynkLoader's revival of screen hijacking for credential theft signals a growing trend of multifunctional malware that defies traditional categorization. Defenders must prepare for modular threats that pivot from …
ToxicPanda's evolution from consumer banking fraud to enterprise-targeting Android malware signals a strategic shift by threat actors. BYOD environments and MDM gaps are now the front line.
The WordlistLoader-to-Amatera Stealer chain shows how ClickFix social engineering has matured into a resilient, blockchain-backed delivery infrastructure. Defenders must shift from blocking IOCs to disrupting execution chokepoints like …
Cisco Talos's exposure of UAT-10147 reveals a Chinese-speaking threat group operationalizing AI across the entire attack lifecycle to exploit 170,000+ web servers. The deployment of a novel cross-platform …
A $10,000 phishing toolkit abuses authenticated Google sessions to enroll attacker-controlled passkeys, creating persistence that survives password resets. This undermines standard incident response playbooks and weaponizes the very …
Security Affairs Round 111 surfaces a converging threat landscape where ransomware operators bypass EDR via Safe Mode, APT groups deploy AI-powered Linux implants through npm, and banking malware …
ToxicPanda's latest evolution weaponizes VPN and Accessibility permissions to blind Google Play Protect, then escalates to shell-level access via Wireless ADB — a layered abuse chain that exposes …
The leap from 16 to 349 targeted financial apps is significant, but the real story is ToxicPanda's abuse of Android Wireless Debugging for privilege escalation — a technique …
Kaspersky's discovery of the MoYu group infecting Android car head units via a supply-chain attack marks a concerning expansion of residential proxy botnets into automotive infotainment systems. The …
Kaspersky's discovery of malware abusing Android automotive update channels marks a dangerous leap for the BADBOX botnet — from cheap streaming boxes to vehicles. The supply-chain implications are …
Fourteen functional npm packages hide a Linux backdoor that activates on import — no install hook required. The AI-assisted C2 framework marks a dangerous evolution in supply chain …
SynkLoader's modular architecture—combining Python, PowerShell, C#, and C++—represents a concerning evolution in Teams-delivered malware. The credential-plus-tunneling combination is specifically designed to defeat IP allow-listing, a control many enterprises …
Check Point Research reveals that Defender's own signed boot-time driver can be weaponized for arbitrary kernel operations. Since BTR.sys is a required Windows component, traditional driver blocklisting fails …
Kaspersky's discovery of malware abusing DoFun head unit updaters marks a dangerous evolution of the BADBOX proxy botnet. Shield53 analyzes why compromised update mechanisms in automotive IoT demand …
Two undocumented RATs are using FTP server banners as dead-drop resolvers and Pinterest pins for C2 config, rendering traditional network detection nearly blind. Shield53 breaks down the tradecraft …
ThreatFabric's discovery of Manic reveals a hybrid banking-spyware Android threat using Bluetooth relay to exfiltrate data even offline. With 169 targeted apps and PIN extraction via fake lock …
The poisoning of arrayref and two related crates via a compromised maintainer account demonstrates that Rust's package ecosystem has reached the scale where supply-chain attacks are economically viable …
Grandoreiro's Mexican comeback highlights a hard truth: law enforcement disruptions buy time but rarely end the threat. Enhanced anti-analysis techniques and geographic pivoting show threat actors adapting faster …
The leap from 16 to 349 targeted institutions and the addition of ADB-based privilege escalation marks ToxicPanda 2.0 as a top-tier mobile banking threat. Defenders must rethink Android …
Manic's peer-to-peer relay exfiltration via Wi-Fi Direct and Bluetooth breaks conventional network-based detection models. Shield53 analyzes why this mesh approach demands a rethink of mobile threat defense and …
The 'Offside Wallet Theft Factory' campaign abused Mozilla's extension marketplace with 40 malicious add-ons impersonating Web3 wallets like OKX and Rabby. Defenders must rethink browser extension governance before …
Check Point's discovery of nearly 2,000 compromised WordPress sites repurposed as criminal infrastructure reveals how neglected CMS installations create cascading risk far beyond their own domains. The ClickFix-driven, …
Check Point's exposure of the StopAndProtect operation reveals how neglected WordPress installations have become wholesale infrastructure for multi-stage malware campaigns. The modular toolkit approach—combining ransomware, stealers, worms, and …
Microsoft's behavior-led hunt for MacSync Stealer exposes a fundamental truth: domain-based blocking cannot keep pace with infrastructure that rotates on disclosure. The real risk is credential theft targeting …
Microsoft's domain correlation work on MacSync Stealer reveals a macOS threat that goes beyond consumer data theft—targeting AWS and Kubernetes credentials. The static API key flaw and ClickFix …
TWINLOOT's abuse of SharePoint, Teams TURN relays, and the victim's own Edge browser represents a new tier of living-off-trusted-services tradecraft. Defenders relying on traditional egress filtering and endpoint …
Sixteen typosquatted RubyGems packages delivered a multi-stage Windows stealer targeting browser credentials, crypto wallets, and Telegram data. The campaign exploits fundamental weaknesses in RubyGems' namespace reclamation and author …
Fortinet's disclosure of Evooo1Bot reveals a Mirai variant that's evolved beyond DDoS into credential theft and proxy-as-a-service. With 18 CVEs in its arsenal—some nearly two decades old—the botnet …
Evooo1Bot's expansion beyond DDoS into credential harvesting, exploitation, and SOCKS proxying signals a shift in IoT botnet economics. Defenders must treat compromised edge devices as persistent attacker infrastructure, …
A newly discovered Linux botnet called Evooo1Bot builds on leaked Mirai code to silently convert compromised edge devices into SOCKS5 proxies — a tactic that obscures attacker infrastructure …
AmnesiaStealer is a sophisticated macOS infostealer that combines credential theft with real-time browser remote control via ClickFix lures — a dangerous evolution in Mac-targeted threats.
Attackers are systematically acquiring expired domains to exploit inherited trust, traffic, and DNS history for malware delivery and C2 infrastructure. With 65,000 domains re-registered daily, the threat surface …
Attackers are systematically acquiring expired domains to exploit their inherited reputation and traffic. Shield53 breaks down the threat and what defenders must do now.
A new Mirai-derived botnet is quietly converting edge routers into SOCKS5 proxy nodes, creating anonymization infrastructure that masks attacker origins. Here's why this threat model demands renewed attention …
Apple's latest wave of mercenary spyware notifications spanning 110 countries signals an escalating commercial surveillance crisis. Shield53 breaks down who's at risk and what defenders must do now.
AmnesiaStealer is a sophisticated Rust-based macOS infostealer using ClickFix lures on fake GitHub pages to steal credentials and hijack browser sessions live. Defenders must reassess macOS threat posture …
Microsoft's discovery that Storm-1175 has ditched Medusa for a custom C++ ransomware signals a dangerous maturation in China-linked financially motivated threat operations. Custom tooling reduces detection rates and …
A dangerous Android malware pairing combines NFC relay attacks with remote device control to drain victims' finances in real time. Here's what defenders and consumers need to know.
The City-Forum campaign exploits trusted SaaS platforms like Salesforce and ServiceNow to exfiltrate high-value business data. Organizations must reassess their SaaS security posture immediately.
Hundreds of Chrome Web Store extensions masquerading as legitimate VPN tools were secretly funneling user traffic through a centralized SOCKS5 proxy network. Shield53 breaks down the threat and …
Over 700 fraudulent Chrome VPN extensions were caught silently routing user traffic through attacker-controlled proxies. Shield53 breaks down the threat, who's at risk, and how to protect your …
Unit 42's discovery of Kimwolf v7 reveals a sophisticated DDoS botnet that blends malicious traffic with legitimate Chrome browser signatures and leverages Ethereum for command-and-control — a troubling …
Two malicious LiteLLM releases silently harvested cloud keys, SSH credentials, and Kubernetes tokens from over 2,100 organizations. Shield53 breaks down the attack surface, victim exposure, and what defenders …
The latest Kimwolf/AISURU botnet variant deploys HTTP/2 protocol abuse to camouflage attack traffic as normal web browsing, raising the detection bar for defenders significantly. Here's what security teams …
ExfilSquad is rewriting the extortion playbook by skipping ransomware entirely and weaponizing torrents for data distribution. Shield53 breaks down why this model is harder to contain and what …
New research reveals SIM cards can execute attacker-controlled commands directly inside cellular modem firmware, enabling full device takeover on EV chargers, industrial routers, and vehicle telematics — no …
A sophisticated supply chain attack targeting BdThemes plugins bypassed source code integrity checks entirely by poisoning JSON configuration files, exposing thousands of WordPress sites to rogue admin account …
A supply chain compromise targeting BdThemes' upstream infrastructure allowed attackers to inject rogue WordPress admin accounts via a tampered JSON feed — a stealthy vector that bypasses traditional …
Two malicious 'Solidity Pro' VS Code extensions were caught stealing crypto wallets, API keys, and credentials from Web3 developers. Shield53 breaks down the supply chain risk and what …
From Discord-spread Java stealers to npm supply chain RATs, the latest malware intelligence cycle reveals threat actors exploiting trust, platforms, and developer ecosystems with growing sophistication.
The Head Mare hacktivist group is compromising TrueConf video conferencing servers to swap legitimate client installers with backdoored versions — a textbook supply chain attack targeting Russian organizations.
Active exploitation of N-able's N-central RMM platform has reached managed endpoints, raising urgent supply chain concerns for MSPs and their downstream clients. Shield53 breaks down the threat and …
Nearly 800 malicious npm packages are delivering RAT and infostealer payloads across Windows, Mac, and Linux. Shield53 breaks down the threat and what developer teams must do now.
ClickFix social engineering tactics are now targeting macOS users with a Go-based stealer capable of draining crypto wallets and iCloud Keychain data. Shield53 breaks down who's at risk …
The UNC6671 threat group is bypassing corporate defenses entirely by targeting employees' personal phones via vishing. Shield53 breaks down why this matters and what security teams must do …
Gen's H1 2026 Threat Report reveals two sophisticated attack chains blending email compromise, browser manipulation, and clipboard hijacking. Here's what defenders need to understand about these converging threat …
TeamPCP's criminal infrastructure dates back to 2020, revealing a methodical escalation from Redis exploitation to supply chain attacks. Defenders must reassess exposure across both vectors immediately.
Attackers exploiting npm's cooldown removal window leave no trace in traditional file logs. Shield53 explains why snapshot-based detection is a critical gap most security teams haven't addressed.
A sophisticated ClickFix campaign now targets macOS users with a Go-based infostealer capable of harvesting cryptocurrency wallets, Apple Keychain secrets, and browser credentials. This marks a significant escalation …
Attackers are exploiting SQL injection in Oracle databases to compile malicious Java inside the engine itself, achieving SYSTEM-level access without ever dropping an executable to disk. The khunt …
Elastic Security Labs uncovers CHAINDROP, a credential-harvesting npm worm that leveraged a single compromised maintainer to backdoor packages with 1.3B+ monthly downloads. The supply chain blast radius is …
Attackers are now living inside Oracle databases themselves, using SQL injection as an entry point to deploy full post-exploitation toolkits. This shifts defenders' attention from perimeter controls to …
CSS styling rules can be weaponized to silently exfiltrate sensitive data from webmail clients — no JavaScript required. Security teams relying solely on script-blocking defenses may have a …
A macOS ClickFix campaign using over 250 domains and server-side browser fingerprinting is actively evading automated security analysis. Shield53 breaks down why this infrastructure shift is a significant …
Attackers are exploiting anxiety around the COLDCARD hardware wallet controversy to phish crypto holders into installing remote access tools. This campaign is a textbook example of threat actors …
Two trojanized npm packages use Ethereum transaction data to hide C2 server addresses, evading traditional detection. This NullReceiver technique raises the bar for supply chain defenders.
The Kali365 phishing kit weaponizes Microsoft's legitimate device code authentication flow, tricking employees into approving attacker-controlled tokens — bypassing MFA and granting persistent cloud access.
A coordinated campaign planted 77 malicious impersonator extensions in the Open VSX marketplace, silently harvesting developer environment data. This attack highlights the growing vulnerability of open-source IDE extension …
The SMOKE#SCREEN campaign highlights a growing attacker playbook: abuse trusted remote monitoring tools like ScreenConnect to establish persistent access while flying under the radar of traditional defenses.
A long-running supply chain attack on QuickFox VPN has been delivering the FDMTP backdoor since at least August 2025. Shield53 breaks down why this campaign is significant and …
The Greatness phishing platform has upgraded from simple credential theft to adversary-in-the-middle and device-code phishing, bypassing MFA and making detection far harder for enterprise defenders.
A revamped XCSSET variant is targeting macOS developers by embedding malware in Xcode projects shared via GitHub. Shield53 breaks down the supply chain risk and what dev teams …
Dozens of trojanized extensions on the Open VSX marketplace silently exfiltrated developer environment data, highlighting a critical but often overlooked attack surface in software supply chains.
The Smoke#Screen campaign reveals how threat actors are weaponizing legitimate RMM tools like ScreenConnect to bypass defenses. Shield53 breaks down the tactics and what defenders must do now.
The Greatness PhaaS toolkit now supports device code phishing via OAuth 2.0 Device Authorization Grant, letting attackers bypass MFA and steal session tokens without needing credentials. Here's what …
A self-propagating malware campaign dubbed ChainDrop has infected over 1,300 npm packages with 2 billion monthly downloads. Shield53 breaks down what defenders and dev teams must do now.
A supply chain worm originating in keyv@6.0.0 propagated across hundreds of npm packages, planting credential-stealing hooks targeting Claude Code and VS Code. The incident exposes critical weaknesses in …
The SMOKE#SCREEN campaign abuses trusted software brands to trick users into installing ScreenConnect, giving attackers persistent remote access that blends into normal IT operations. Here's what defenders need …
The DOUBLECUP loader-as-a-service operation combines ClickFix social engineering with steganographic PNG caching to deploy CountLoader and DeviceManager RAT — a multi-layered delivery chain that challenges traditional endpoint defenses.
The DOUBLECUP loader-as-a-service operation exploits browser cache steganography and ClickFix social engineering to deliver multi-platform malware. Here's why this technique raises the evasion bar and what defenders must …
Threat actors are weaponizing the popularity of Roblox cheat tools to distribute dual-payload malware combining remote access trojans and credential stealers, putting young gamers and their families at …
A targeted software supply chain attack leverages 18 malicious npm packages impersonating Alibaba developer tools to deliver a cross-platform RAT. Chinese-speaking developer environments are the primary target, highlighting …
Unit 42 researchers have detailed three attack chains against Google Password Manager's cloud authenticator that allow user-level malware to authenticate passkey-protected accounts with zero user interaction — undermining …
BTMOB RAT exemplifies a dangerous shift in mobile malware economics — from centralized operations to distributed criminal franchises. Shield53 breaks down what this means for enterprise defenders and …
From North Korean ClickFix kits to modular MaaS upgrades and browser-assembled malware, the latest threat intelligence roundup signals a clear pivot toward sophistication, stealth, and scalability among threat …
A compromised Adform JavaScript file turned ad-tech infrastructure into a browser-side crypto wallet hijacker on July 27, 2026. This supply chain attack illustrates how adtech CDNs represent an …
A wave of malicious AUR package takeovers has forced Arch Linux to disable package adoption, highlighting the systemic risks in community-maintained open source repositories. Defenders and developers need …
A supply-chain compromise targeting ad firm Adform turned its widely-deployed scripts into crypto-stealing tools. Clipboard hijacking is a low-noise, high-impact technique that defenders often overlook — here's what …
A novel Go-based loader and Rust-based backdoor combo is targeting law firms via spear-phishing. The multi-stage chain reveals a sophisticated threat actor prioritizing stealth and persistence in high-value …
Bitsight's discovery of the Fuyao operation reveals how budget Android TV boxes are shipping with pre-installed malware that commits ad fraud and silently enrolls consumer broadband connections into …
Hunt.io researchers have mapped a 170-server criminal infrastructure built on a leaked Android RAT, targeting victims through apps impersonating Chinese law enforcement. The operation reveals how commoditized malware …
Attackers are weaponizing trusted brand identities to bypass traditional security controls. With 700+ sites compromised using fake Cloudflare pages, defenders must treat brand monitoring as a frontline security …
Generic TV streaming sticks sold for a one-time fee are secretly enrolling consumer devices into large-scale ad fraud and residential proxy networks. The threat goes far beyond piracy …
Initial access is just the beginning. Shield53 breaks down why post-compromise attacker behavior — persistence, defense evasion, and system reshaping — demands a full investigation, not just a …
Chinese cybercrime group SilverFox is deploying a sophisticated 3-driver BYOVD attack chain against Japanese industrial manufacturers to deliver ValleyRAT. This escalation in technique complexity demands urgent attention from …
Southeast Asian cybercriminal syndicates have evolved from regional fraud operations into sophisticated global threat actors. At $88B in damages in 2025 alone, defenders worldwide must reassess their threat …
The Flying Eagle mobile RAT builder represents a new tier of commoditized mobile malware infrastructure targeting financial accounts. Shield53 breaks down the operational risk and what defenders must …
ShinyHunters is escalating attacks against healthcare organizations by exploiting weak SSO configurations and social engineering. The sector's rapid cloud adoption has outpaced its identity security maturity, making it …
New research reveals that the security tools organizations trust to find vulnerabilities can themselves become entry points for supply chain attacks. Defenders must now scrutinize the tools doing …
The Flying Eagle Android RAT source code is circulating on criminal Telegram channels, with researchers tracing its infrastructure to 170 active servers. Shield53 breaks down what defenders need …
Two beta npm packages in the @joyfill namespace have been trojaned to silently deploy a RAT from the DEV#POPPER malware family the moment they are imported. Any Node.js …
The 200,000-device Dysphoria botnet abuses Ethereum and Solana blockchain domains to hide C2 servers — a technique that makes traditional domain takedowns nearly impossible and signals a serious …
The Tengu botnet weaponizes Linux hardware watchdog timers to survive process termination — a clever anti-remediation technique that forces defenders to rethink IoT incident response entirely.
Proofpoint's discovery of Cruciferra exposes a maturing criminal ecosystem where evasion capability is sold as a service, allowing even low-skill threat actors to bypass modern defenses and deploy …
The Dysphoria botnet has quietly amassed 200,000 compromised devices for DDoS and traffic relay operations. Shield53 breaks down the threat model, who's at risk, and what defenders must …
MedusaHVNC exploits a legitimate Windows feature to create hidden desktops for browser hijacking and data theft — a stealthy technique that challenges conventional endpoint detection. Here's what defenders …
The Dysphoria botnet's adoption of blockchain-based C2 and peer-relay infrastructure signals a dangerous evolution in botnet resilience. Defenders and law enforcement face a shrinking window of opportunity after …
Operation BlueDash exploits trust in Microsoft Teams to deploy legitimate RMM tools as attack infrastructure. Shield53 breaks down why living-off-the-land with commercial software is a growing blind spot …
A sophisticated crypter service called Cruciferra is being used by multiple threat actors to evade AV detection via BYOVD and Process Ghosting. Shield53 breaks down what defenders must …
From state-linked Ukrainian targeting to 800+ fake AI tools delivering payloads, the latest malware intelligence roundup reveals defenders must now contend with threats across every attack surface simultaneously.
Threat actors are weaponizing Steam's discussion forums in a ClickFix social engineering campaign, tricking gamers into running commands that silently deploy XMRig cryptominers on their systems.
The SourTrade malvertising campaign forces victims' browsers to assemble malware piece-by-piece, evading traditional detection by never serving a complete malicious payload. Retail traders and crypto users are prime …
A sophisticated malvertising campaign assembles malware directly in browser memory using JavaScript, bypassing traditional file-based detection. Security teams must rethink endpoint and browser defenses.
The Golden Chickens MaaS ecosystem has returned with four new malware families, demonstrating that public exposure alone is insufficient to dismantle sophisticated criminal operations. Defenders must prioritize behavioral …
Threat actors are exploiting Bing's ad platform and the Claude AI brand to distribute SectopRAT malware. This campaign highlights the growing risk of AI-brand impersonation in malvertising attacks …
Cisco Talos uncovered msaRAT, a Rust-based RAT linked to the Chaos ransomware group that tunnels C2 traffic through Chrome or Edge via the Chrome DevTools Protocol — effectively …
Ukraine's CERT has uncovered a campaign abusing Notepad++ plugins to deliver the LunchPoke malware. This attack highlights how threat actors exploit trusted developer tools to bypass defenses and …
Attackers hijacked legitimate Packagist packages to turn GitHub Actions runners into distributed attack infrastructure targeting cPanel and WHM servers — a sobering escalation in CI/CD supply chain abuse.
The Chaos ransomware gang's new msaRAT backdoor tunnels C2 traffic through Chrome and Edge, bypassing traditional network controls. Defenders relying on perimeter tools alone are dangerously exposed.
Brazilian banking trojans are aggressively expanding into Portugal, exploiting shared language and cultural familiarity to bypass social engineering defenses. Shield53 breaks down the threat and what European organizations …
The wp2shell attack chain demonstrates full pre-authenticated RCE against WordPress — a critical wake-up call for defenders managing plugin-heavy sites. Here's what security teams need to know and …
Threat actors are weaponizing civilian anxiety during the Iran-Israel conflict to distribute sophisticated four-stage Android spyware via fake emergency alert apps. This campaign highlights how kinetic geopolitical events …
The Kratos phishing kit takedown exposes the limits of standard MFA in the face of adversary-in-the-middle attacks. Defenders must rethink session security and move toward phishing-resistant authentication now.
A trojanized NuGet package impersonating Newtonsoft.Json has been discovered hiding game-manipulation code targeting the Digitain sports betting platform — a sophisticated supply chain attack with financial fraud implications.
The FakeGit campaign weaponized GitHub's trusted reputation to distribute SmartLoader and StealC malware at massive scale. Security teams must rethink how they vet open-source dependencies.
A sophisticated phishing campaign blends fileless execution, low-detection loaders, and multiple RAT payloads to evade defenses. Shield53 breaks down why this multi-layer approach raises the bar for defenders.
The FakeGit campaign weaponizes GitHub's trusted reputation by flooding it with thousands of fake AI and MCP repositories. Shield53 breaks down what this means for developers and security …
HollowGraph weaponizes Microsoft 365 calendar features as a covert C2 channel, blending malicious traffic with legitimate cloud API calls. Defenders relying on perimeter controls face a significant blind …
An exposed malware delivery server uncovered by Rapid7 reveals how AI is accelerating phishing kit development, enabling even mid-tier threat actors to deploy polished, multi-stage campaigns at scale.
HollowGraph malware turns Microsoft 365 calendar events into covert C2 channels, blending spy operations into trusted cloud traffic. Here's why this matters and what defenders must do now.
Three malicious RubyGems packages have been weaponized in a supply chain campaign dubbed SleeperGem. Shield53 breaks down the threat to developer environments and what Ruby shops must do …
From macOS infostealers disguised as system utilities to poisoned npm packages with millions of weekly downloads, the latest malware trends reveal attackers diversifying targets and supply chain vectors …
Microsoft's warning about surging ACR Stealer campaigns exposes a persistent blind spot in enterprise security: browser credential stores remain dangerously trusted. Here's what defenders must prioritize immediately.
Seven malicious npm packages are targeting Vite developers using a four-tier blockchain-based C2 system to deliver a RAT. Shield53 breaks down why this attack is a watershed moment …
The NadMesh botnet is systematically harvesting cloud credentials from exposed AI tools like ComfyUI and Ollama. This is a wake-up call for teams deploying AI services faster than …
Russian-speaking UAT-11795 is deploying Starland RAT via fake Zoom, Webex, and MobaXterm installers, targeting U.S. and European users. This campaign highlights how trusted software brands are weaponized to …
ACR Stealer is combining social engineering via ClickFix lures with aggressive credential harvesting to exfiltrate live session tokens and M365 documents. Here's what defenders must do now.
A novel macOS infostealer named ClickLock weaponizes system instability as a social engineering lever, forcing users to voluntarily surrender their login passwords. Here's what defenders need to know.
OkoBot isn't just another stealer — it's a modular attack framework deploying 20+ payloads simultaneously. Here's why this architectural shift should alarm defenders and crypto holders alike.
Two Scattered Spider members jailed for the £29M TfL attack marks a significant enforcement milestone. Shield53 examines what this means for deterrence, critical infrastructure defense, and the broader …
Two young Scattered Spider members received 5.5-year sentences for the 2024 TfL breach. Shield53 examines what this prosecution means for deterrence, affiliate networks, and organizational resilience.
A new modular malware called TELEPUZ is exploiting ClickFix lures to steal data and execute remote commands. Shield53 breaks down why this threat's architecture and delivery method deserve …
ClickLock is a macOS infostealer that weaponizes frustration, killing apps every 210ms until victims surrender their login password. Shield53 breaks down why this behavioral coercion tactic is a …
Two Scattered Spider members received 5.5-year sentences for the TfL hack. Shield53 examines what this landmark prosecution means for cybercrime deterrence and enterprise security posture.
The PhantomEnigma campaign turned over 20 Brazilian government websites into active malware distribution channels, revealing sophisticated backdoor infrastructure. Here's what defenders need to know.
Russian threat actor UAT-11795 is trojanizing WebEx and Zoom installers to deploy the Starland RAT, targeting credentials and crypto wallets. Defenders must harden software distribution controls immediately.
Elastic Security Labs has uncovered TELEPUZ, a modular Malware-as-a-Service platform delivered via CLICKFIX-VIDAR infection chains. Here's what defenders need to know about this escalating threat.
Five malicious AsyncAPI npm packages delivered a remote access trojan capable of stealing credentials — a sobering reminder that trusted open-source ecosystems remain high-value attack surfaces for supply …
OkoBot malware injects malicious phishing overlays inside legitimate Ledger and Trezor desktop apps, tricking users into surrendering recovery phrases. This trust-hijacking technique is sophisticated and highly targeted.
A deceptively simple two-click exploit targeting Cursor AI IDE highlights the catastrophic risk of insecure developer environments. When attackers reach dev tooling, they reach everything: source code, secrets, …
Four AsyncAPI npm packages with 2M weekly downloads were backdoored with credential-stealing malware and remote access trojans. Here's what defenders and DevOps teams must do immediately.
Threat actors compromised four trusted @asyncapi npm packages to deliver a multi-stage botnet loader. Developers and CI/CD pipelines using these packages are at immediate risk of full system …
Hundreds of counterfeit GitHub repositories are masquerading as legitimate tools to deliver infostealer malware. Shield53 breaks down why this supply chain deception is so effective and what developers …
A newly discovered Rust-based RAT disguised as NVIDIA software highlights the growing danger of living-off-the-brand tactics. Here's what defenders need to know.
ClickFix has matured into a rentable, scalable attack ecosystem that bypasses traditional endpoint defenses. Organizations must rethink detection strategy around behavioral and memory-based analysis before this threat matures …
Japan's largest taxi operator going dark after a malware strike highlights how transportation firms remain dangerously exposed when IT and dispatch systems converge. Defenders must rethink segmentation now.
CrashStealer represents a maturing macOS threat landscape where attackers weaponize legitimate signing mechanisms. Security teams relying solely on Gatekeeper for endpoint protection are dangerously exposed.
A sophisticated npm campaign exploited students seeking web proxies, turning their browsers into DDoS nodes. This novel attack vector bypasses traditional developer-focused supply chain defenses entirely.
Microsoft's analysis of ShinyHunters reveals a year-long campaign targeting Salesforce through OAuth abuse and third-party trust relationships — no CVEs required. Here's what defenders must understand.
A malicious version of the Jscrambler npm package was downloaded nearly 1,500 times before discovery, highlighting the persistent and evolving threat of software supply chain attacks targeting developer …
A new macOS infostealer exploits user trust in Apple's native crash-reporting UI to silently harvest keychain data, credentials, and crypto wallets. Here's what defenders and Mac users need …
CrashStealer represents a sophisticated evolution in macOS-targeted malware, using Apple's own notarization process as a trust weapon. Here's what defenders need to know.
The removal of ModHeader from Chrome and Edge stores reveals how trusted browser extensions can harbor hidden data-collection code waiting to activate. Even dormant collectors represent serious enterprise …
GigaWiper's modular design lets threat actors mix backdoor persistence with destructive wiping on demand — a convergence that raises the stakes for defenders across every sector.
Forg365 combines device code phishing with adversary-in-the-middle session hijacking to bypass MFA on Microsoft 365 accounts. At $400/month, this commoditized PhaaS lowers the barrier for sophisticated credential theft …
A single misconfigured Python server exposed an attacker's full Evilginx toolkit and linked three active Microsoft 365 phishing operations. Here's what defenders can learn from the operator's own …
RedHook malware's abuse of Android Wireless Debugging marks a dangerous evolution in mobile threats—turning a legitimate developer tool into a privilege escalation mechanism that bypasses traditional detection.
Emerging malware families are breaking platform boundaries and blurring the line between legitimate tools and ransomware. Shield53 analyzes what these trends mean for enterprise defenders.
The jscrambler npm package v8.14.0 was compromised with a preinstall hook that silently drops and runs a Rust-based infostealer on Windows, macOS, and Linux. Any developer or CI …
A compromised GitHub repository was used to push a trojanized npm package capable of stealing cryptocurrency wallet private keys. This supply chain attack highlights growing risks for Web3 …
An exposed hacker server gave researchers a rare inside look at WP-SHELLSTORM, a mass WordPress backdooring campaign targeting over 1.4 million sites. Shield53 breaks down what defenders must …
A single malicious Go module unraveled a 222-repository malware network on GitHub. Shield53 breaks down why Go's ecosystem is increasingly targeted and what dev teams must do now.
Microsoft's discovery of GigaWiper — a Go-based backdoor fusing espionage, remote access, and destructive wiping — signals a dangerous evolution in attacker tooling. Here's what defenders need to …
A compromised GitHub repository allowed attackers to poison the Injective Labs SDK on npm with a crypto wallet stealer. This supply chain attack highlights critical risks for Web3 …
Microsoft's dissection of GigaWiper reveals a disturbing evolution in destructive malware: three legacy wiper tools unified into a single operator-controlled backdoor with ransomware theater built in. Here's what …
A new data-extortion group called Helix is bypassing traditional defenses using vishing, device code phishing, and MFA abuse to plunder SharePoint environments — a stark reminder that identity …
Criminals are weaponizing fake utility apps to silently enlist victim devices into residential proxy networks. Shield53 breaks down why this threat is harder to detect than traditional malware …
A threat actor called Lurking Lizard has been running a sprawling residential proxy operation since 2022, using 230+ lookalike domains and fake software installers to silently conscript victim …
Malicious packages impersonating Paysafe, Skrill, and Neteller SDKs on npm and PyPI highlight a dangerous escalation in supply chain attacks targeting developers handling financial credentials.
A financially motivated malvertising campaign is delivering Vidar infostealer alongside cryptomining malware to SMBs via fake cracked software lures. Shield53 breaks down why small businesses are uniquely exposed …
The EvilTokens campaign reveals a critical gap in traditional email security — malicious payloads that remain invisible until decrypted inside the victim's browser. Here's what defenders need to …
A sophisticated banking malware campaign targeting Mexican financial users leverages fake CAPTCHA pages to deploy a PowerShell toolkit. Shield53 breaks down the threat and what defenders must do …
RedWing's Telegram-based subscription model signals a dangerous democratization of mobile surveillance tools. Shield53 breaks down the threat and what Android defenders must do now.
A sophisticated operator-assisted fraud campaign is actively targeting Mexican banking and crypto users via ClickFix social engineering. Shield53 breaks down the threat and what defenders must do now.
RedWing packages sophisticated Android bank fraud into a Telegram rental service, enabling low-skill criminals to execute full account takeovers. Shield53 breaks down what defenders and consumers need to …
A new phishing campaign abuses Microsoft's own device-code authentication flow to hijack M365 accounts — no fake login pages required. Here's why this is harder to detect and …
A persistent Windows device identifier helped FBI agents trace an alleged Scattered Spider member across multiple accounts. This case reveals how native OS telemetry can become critical forensic …
The Armored Likho threat group is deploying the BusySnake infostealer against critical infrastructure across Russia, Brazil, and Kazakhstan. Shield53 breaks down why this campaign signals an escalating risk …
Attackers are weaponizing Microsoft Teams voice calls to impersonate IT helpdesks and deploy EtherRAT. Shield53 breaks down why this hybrid social engineering tactic is particularly dangerous and what …
Researchers demonstrate a novel data exfiltration technique exploiting video cable radio emissions from air-gapped machines. While requiring prior malware access, TrojPix represents a meaningful evolution in covert channel …
A new Java-based RAT called QuimaRAT is being sold as a subscription service, targeting Windows, Linux, and macOS simultaneously. Its MaaS model and cross-platform design signal a dangerous …
From hijacked npm packages leveraging blockchain dead drops to steganographic ad fraud, this week's malware landscape reveals attackers systematically raising the complexity bar. Defenders must adapt detection pipelines …
The FBI's TeamPCP FLASH alert exposes a sophisticated criminal group weaponizing trusted developer tools to harvest cloud credentials at scale. Shield53 breaks down why this attack model is …
The FBI's FLASH alert on TeamPCP reveals a sophisticated criminal group weaponizing trusted developer toolchains to harvest cloud credentials at scale — a stark reminder that your software …
The Avalon framework's modular design and multi-stage phishing delivery signal a dangerous convergence of attack capabilities. Shield53 breaks down why this all-in-one threat demands a layered defense rethink.
The disruption of NetNut's 2-million-device proxy botnet exposes how legitimate-looking proxy services can quietly weaponize consumer devices. Here's what defenders and device owners need to understand.
The ARToken PhaaS platform reveals the industrial sophistication of modern Microsoft 365 phishing operations. Shield53 breaks down what defenders need to know about adversary-in-the-middle toolkits targeting enterprise identity.
The coordinated disruption of NetNut exposes how residential proxy networks enable large-scale cybercrime. Here's what security teams need to understand about the threat and how to adapt their …
A new macOS stealer disguises itself as a legitimate clipboard manager to harvest login credentials. Shield53 breaks down the threat and what Mac-heavy organizations must do now.
The FBI's seizure of NetNut's infrastructure exposes the thin line between commercial proxy services and criminal botnets. Shield53 examines what this enforcement action means for enterprise defenders and …
Google's takedown of the NetNut residential proxy network exposes a growing threat: millions of home devices silently rented as attack infrastructure. Shield53 examines what this means for enterprise …
Opera's new Paste Protect feature targets ClickFix-style clipboard attacks head-on. Shield53 breaks down why this matters, who's at risk, and what defenders should do beyond browser-level controls.
The extradition of an alleged Scattered Spider member marks a rare but significant law enforcement win against a native English-speaking cybercrime collective known for devastating social engineering attacks …
The extradition of alleged Scattered Spider member Peter Stokes from Finland marks a pivotal moment in cross-border cybercrime accountability. Shield53 examines what this means for defenders and the …
A new malware strain called ChocoPoC is being deployed through fake GitHub PoC repositories, turning the tools of the trade against the security researchers who use them. Here's …
Modern phishing kits now silently fingerprint device OS via user-agent data to serve tailored malware payloads. This adaptive approach dramatically raises compromise rates and demands a rethink of …
Trojanized PoC exploits on GitHub are delivering the ChocoPoc RAT, turning security researchers' most trusted resource into an attack vector. Here's what defenders and researchers need to know.
A Python-based RAT named ChocoPoC is being distributed through trojanized PoC exploits on GitHub, deliberately targeting security researchers. This campaign highlights the growing threat of supply chain attacks …
ClickFix social engineering has shifted from a novel tactic to the dominant malware delivery method. Shield53 breaks down why defenders are struggling to keep up and what teams …
The extradition of a 19-year-old Scattered Spider suspect from Finland marks a turning point in international law enforcement cooperation against sophisticated social engineering networks. Here's what it means …
A sophisticated multi-domain SEO poisoning campaign is abusing ScreenConnect to silently deploy AsyncRAT. Shield53 breaks down why this attack chain is particularly dangerous and what defenders must do …
A sophisticated multi-stage malware chain dubbed VEIL#DROP is abusing Google's Blogger platform to deliver PureLogs infostealer. Shield53 breaks down the defender implications and why trusted infrastructure abuse is …
The Brazilian Ousaban banking trojan is targeting Spanish and Portuguese banking customers using fake PDF lures and steganographic payload delivery. Here's what defenders need to know.
RustDuck is a Rust-based DDoS botnet still in its infancy, but its architectural sophistication signals serious long-term ambitions. Security teams should treat it as a warning shot, not …
ClickFix has matured from a simple social engineering trick into a sophisticated API-driven delivery platform. Shield53 breaks down what defenders must know about this increasingly evasive threat.
Malicious Pyrogram forks on PyPI are silently compromising Telegram bot servers, giving attackers arbitrary file read access. This supply chain attack highlights the growing risk of typosquatting and …
Coordinated phishing campaigns targeting hospitality organizations across Europe and Asia are leveraging malicious ZIP files, social engineering, and blockchain-based obfuscation to establish persistent footholds.
The RustDuck botnet isn't just another DDoS threat — its rapid Rust-based evolution signals a new era of evasion-first botnet engineering. Shield53 breaks down what defenders need to …
A fake Perplexity AI extension on the Chrome Web Store silently tracked user searches and browsing activity. This incident highlights the persistent threat of malicious browser extensions exploiting …
A sophisticated crypto clipper campaign disguised as a Google Notes browser extension is silently swapping wallet addresses during transactions. Shield53 breaks down the attack chain and what crypto …
Nissan Americas has confirmed a data breach affecting current and former employees after threat actors exploited a critical Oracle PeopleSoft vulnerability. The attack is linked to a broader …
Microsoft uncovered a malicious Chrome extension impersonating the Perplexity AI platform that silently intercepted search queries and address bar keystrokes, routing them through attacker-controlled infrastructure before delivering normal …
Threat actors are weaponizing a critical SimpleHelp authentication bypass to deploy a sophisticated new cross-platform stealer targeting AI coding tools, cloud credentials, and developer infrastructure.
Researchers have uncovered a sprawling network of over 236,000 fraudulent websites exploiting the legitimate DCloud Uni-App development framework to power crypto scams, pig-butchering operations, and wallet-draining phishing campaigns.
A two-year browser extension campaign named StegoAd used steganography to conceal malicious JavaScript inside image and font files, reaching 2.6 million installs before Microsoft intervened.
Microsoft dismantled a sophisticated malicious extension network hiding payloads inside ordinary image and font files. The StegoAd campaign ran undetected for years, harvesting credentials and committing ad fraud …
Attackers have weaponized legitimate npm and Go packages to silently deploy a Python-based infostealer across Windows, Linux, and macOS. The campaign uses VS Code task hijacking to evade …
From 4,000 hijacked routers forming a global attack proxy network to backdoored WordPress plugins and a fresh Go-based ransomware encryptor, the current malware landscape demands urgent attention from …
A sophisticated phishing campaign targeting hotel front desks has been deploying TonRAT malware since April 2026, using legitimate services like Calendly and Google to bypass email authentication and …
A sophisticated new threat actor campaign dubbed StrikeShark is deploying a previously unknown malware loader to plant Cobalt Strike Beacon on government and diplomatic targets across Southeast and …
A sophisticated malware family is escalating its supply chain campaign, now targeting npm packages, abusing GitHub Actions workflows, and extending its reach into the Go ecosystem — raising …
A sophisticated phishing campaign has been striking hotels across Europe and Asia since April 2026, using photo-themed ZIP archives to deploy a Node.js implant on front-desk systems. The …
Cybercriminals are planting fake purchase receipts inside the Shop order-tracking app to lure victims into phone-based scams. Here's how the attack works and what users must do now.
A stealthy new backdoor called Mistic is giving ransomware affiliates persistent, low-visibility footholds in targeted networks. Linked to access broker KongTuke, it uses DLL sideloading and in-memory execution …
The Bluekit phishing-as-a-service platform has upgraded its credential theft capabilities with browser-in-the-middle technology, nearly 70 new hostnames, and sophisticated anti-detection systems targeting enterprise users.
A widely-installed YouTube ad blocker on the Chrome Web Store has been found to contain dormant code capable of executing arbitrary JavaScript. With over 10 million users and …
A newly identified backdoor called Mistic is being deployed against insurance, education, IT, and professional services firms in what researchers believe are financially motivated intrusions dating back to …
A sophisticated attack chain abuses Microsoft Edge's Native Messaging protocol to bridge the browser sandbox and deploy a Python backdoor — signaling a dangerous evolution in ransomware delivery …
A coordinated multinational law enforcement operation has struck at the foundational infrastructure enabling ransomware, fraud, and critical infrastructure attacks — seizing servers, freezing crypto assets, and recovering 27 …
Five malicious packages discovered on an AI skills marketplace managed to evade security controls while harboring infostealers and other threats. The incident highlights a growing and underappreciated vulnerability …
A sweeping international law enforcement operation, backed by major cybersecurity firms, has torn down the criminal infrastructure behind two of the most prolific infostealer platforms. Over 27 million …
A sweeping international law enforcement operation has taken down hundreds of servers and domains tied to the Amadey and StealC malware ecosystems, seizing millions in crypto and recovering …
A newly identified backdoor called Mistic is enabling long-term, undetected access to corporate networks across insurance, education, and IT sectors — with strong ties to a prolific ransomware …
A sprawling credential-theft operation exposed valid logins for nearly half of all internet-facing Fortinet firewalls worldwide, revealing how access brokering has become a sophisticated, AI-assisted industrial enterprise.
Tata Electronics has confirmed a cyberattack following claims by the World Leaks extortion group, which allegedly leaked sensitive manufacturing data including Apple component schematics and PCB designs.
A sophisticated attack pattern targeting CI/CD workflows has compromised repositories across Microsoft, Google, Apache, Cloudflare, and the Python Software Foundation. Developers and security teams need to act now.
A sophisticated ClickFix campaign is tricking macOS users into running Terminal commands that silently download and mount malicious disk images, delivering the Atomic macOS Stealer to harvest credentials, …
A financially motivated Russian-speaking threat actor has been systematically compromising FortiGate firewalls at global scale since early 2026, amassing over 110 million stolen credentials in a sophisticated multi-stage …
Two members of the Scattered Spider cybercrime group admitted guilt for breaching Transport for London's systems in 2024, causing £29 million in damages and exposing customer data from …
The Icarus extortion group compromised third-party platform Klue, stealing OAuth tokens that granted access to LastPass's Salesforce environment. Customer vaults were unaffected, but CRM data including names, emails, …
The dismantling of SocGholish infrastructure has cast a harsh light on how cybercriminal groups exploit traffic distribution systems to silently funnel victims toward malware. Here's what security teams …
A sophisticated threat campaign has compromised hundreds of thousands of FortiGate firewalls using a purpose-built Golang sniffer, harvesting over 110 million credentials in an ongoing global operation.
Threat actors are exploiting developer trust in popular CSS tooling ecosystems by publishing counterfeit npm packages that silently install a Windows RAT. Over 1,000 downloads were recorded before …
A sophisticated supply chain attack compromised ShapedPlugin's build pipeline, injecting backdoors into Pro plugin updates that steal credentials, harvest 2FA secrets, and hand attackers complete site control.
Attackers are weaponizing WhatsApp direct messages to distribute malicious VBScript files that silently install legitimate remote monitoring software. The campaign spans multiple continents, targeting users across Malaysia, Brazil, …
Attackers are hijacking WhatsApp accounts to distribute obfuscated VBScript files disguised as financial documents, quietly installing remote administration software on victims' Windows machines.
A sophisticated attacker drained $15 million from one of Ethereum's most prolific MEV bots by weaponizing its own opportunity-detection engine against it. The attack reveals deep structural vulnerabilities …
A sophisticated malware campaign is exploiting compromised WhatsApp accounts to deliver fake debt documents that silently install legitimate remote management software, granting attackers full system control.
A sophisticated threat actor exploited FortiGate's built-in diagnostic tools to harvest credentials at massive scale. Here's how the attack worked and what defenders must do now.
Threat actors compromised ShapedPlugin's build and distribution pipeline, pushing backdoor code through legitimate licensed update channels. Site owners using Pro versions of affected plugins should treat their installations …
A sophisticated threat campaign is exploiting GitHub, YouTube, and VirusTotal to manufacture fake credibility before delivering a cross-platform clipboard hijacker targeting cryptocurrency wallets.
A new service layer has emerged between infostealer infections and account takeover attacks — credential brokers who let attackers query stolen data like a search engine. Here's what …
A newly identified malware loader called OXLOADER is being distributed through poisoned Google Ads, silently deploying the CastleStealer infostealer. Evidence points to a financially motivated, Russian-speaking threat actor …
A sophisticated Russian-linked campaign has compromised over 430,000 FortiGate firewalls, siphoning 110 million credentials across 659 harvesting pipelines. Here's what defenders need to know now.
A sophisticated malware campaign is quietly conscripting end-of-life routers into a covert reconnaissance infrastructure. AryStinger exploits decade-old vulnerabilities to build a distributed network capable of large-scale scanning and …
A newly identified malware family is quietly hijacking legacy home routers to build a distributed proxy and reconnaissance network. Unlike typical botnets, AryStinger operates in the shadows before …
From a supply chain attack compromising 1.2 million websites to China-linked espionage targeting medical AI research, the mid-2026 threat landscape reveals a malware ecosystem growing in sophistication and …
A newly discovered botnet called AryStinger has silently compromised thousands of aging routers, turning them into distributed attack infrastructure. Here's what security teams and home users need to …
The Gentlemen ransomware operation has redefined affiliate enablement by centralizing EDR-killing capabilities into a standardized suite. Here's what security teams need to know.
A multi-operator threat group executed billions of automated login attempts against Fortinet FortiGate SSL VPN devices globally, compromising organizations across five countries. Here's what happened and what defenders …
A coordinated law enforcement operation across four nations has dismantled infrastructure behind the SocGholish malware network, scrubbing nearly 15,000 compromised WordPress sites clean and cutting off criminal access.
A multinational law enforcement operation has torn apart one of the internet's most persistent malware distribution networks, taking down over 100 servers and cleaning nearly 15,000 compromised WordPress …
A newly identified Windows loader called OXLOADER is weaponizing malicious Google Ads to deliver the CASTLESTEALER infostealer, using sophisticated obfuscation and anti-sandbox techniques to evade nearly all static …
A newly observed threat operation targeting Latin America appears to blend financial opportunism with systematic intelligence gathering — raising urgent questions about threat actor motivation and regional exposure.
A sophisticated clipboard-hijacking campaign active since early 2026 uses malicious USB shortcut files and Tor-routed infrastructure to steal seed phrases, swap wallet addresses, and maintain persistent backdoor access.
A four-year-old botnet called Popa has quietly enslaved millions of streaming devices, routing traffic for ad fraud and data scraping. Researchers now link its infrastructure to a publicly …
A self-spreading malware campaign active since February deploys clipboard-hijacking code via USB drives, silently replacing cryptocurrency wallet addresses while routing stolen data through the Tor network.
A sophisticated clipper malware campaign targeting Windows users has been quietly rerouting cryptocurrency transactions since early 2026, leveraging USB-propagated LNK files and an anonymous Tor-based command-and-control infrastructure.
A newly emerged extortion group called Icarus exploited compromised OAuth tokens through market intelligence platform Klue to raid Salesforce CRM environments across multiple organizations, triggering an active extortion …
A coordinated multinational law enforcement action has scrubbed nearly 15,000 WordPress sites of SocGholish malware and taken down over 100 servers tied to the Evil Corp cybercrime syndicate.
A supply chain attack on ShapedPlugin's release infrastructure compromised three paid WordPress plugins, silently pushing credential-stealing malware through the vendor's official update system.
A sophisticated threat actor is orchestrating a multi-platform crypto clipper campaign, abusing legitimate services like GitHub, YouTube, and even VirusTotal to distribute malware while hiding behind fake reviews …
A French-speaking attacker targeting a French automotive firm planted a keylogger and stolen credentials — then built a stealthy backup access channel using legitimate tools that survived his …
A sweeping cyber campaign has compromised over 30,000 Fortinet devices worldwide, with attackers systematically harvesting working credentials across nearly every country. The operation spans critical industries and shows …
A sophisticated Android banking trojan is silently targeting 217 financial apps worldwide, using fake overlays, clipboard hijacking, and screen capture to steal credentials and crypto funds.
A coordinated malware campaign has planted 15 fake AI coding assistant plugins on the JetBrains Marketplace, silently siphoning AI provider API keys and capturing developer chatbot sessions through …
Extortion group FulcrumSec leaked 1.3TB of Novo Nordisk data after a $25M ransom refusal, exposing clinical trial records and potentially years of proprietary AI research assets.
A sophisticated supply chain attack dubbed 'easy-day-js' has compromised 144 packages in the Mastra npm namespace after threat actors seized control of a contributor account. AI app developers …
Kodak has confirmed unauthorized access to company data as the ShinyHunters extortion group claims responsibility, threatening to leak 2.2 million records. The incident adds to a growing list …
A sophisticated fileless credential stealer is evading traditional defenses by operating entirely within system memory. Its layered anti-analysis design makes detection and forensic investigation exceptionally difficult.
A coordinated campaign planted 15 credential-stealing plugins on the JetBrains Marketplace, silently exfiltrating AI API keys from nearly 70,000 installs. Developers using DeepSeek and OpenAI integrations are most …
A sophisticated new Android banking trojan is targeting 217 financial and crypto apps with a sweeping command arsenal. Here's how it works and what users must do to …
Threat actors are exploiting Steam Workshop's wallpaper application feature to silently deliver backdoors, infostealers, and ransomware to unsuspecting gamers. Dozens of malicious packages accumulated tens of thousands of …
Security researchers have identified three distinct malware loaders — BabaDeda, Lorem Ipsum, and Potemkin — being deployed through evolving ClickFix social engineering campaigns targeting education and financial sectors.
A newly evolved Android threat is targeting users through counterfeit TikTok and Chrome downloads, blending financial theft with full remote device control and persistent surveillance capabilities.
A sophisticated malware campaign leveraging compromised WordPress sites has adopted the ClickFix social engineering method to deploy payloads. Researchers now suspect ties to Vice Society, a ransomware and …
A newly documented technique exploits recursive Windows file system junctions to generate astronomically large path counts, causing security scanners to hang indefinitely and leaving malware completely undetected.
A newly documented Android banking trojan called Rokarolla targets over 200 banking and crypto apps with an arsenal of 137 remote commands, giving attackers near-total device control.
Federal authorities shut down Outsider Enterprise, a sophisticated phishing-as-a-service operation that leveraged artificial intelligence to steal 3.8 million credit card records and cause $1.9 billion in losses through …
A sophisticated insider attack spanning 21 months disrupted classroom operations and cost an Iowa school district nearly $60,000 in remediation expenses.
Security researchers uncover sophisticated campaign targeting Arch Linux's community repository with credential-stealing malware and kernel-level rootkits designed for developer workstations.
Criminal marketplaces signal impending software supply chain compromises through GitHub access sales, leaked repositories, and stolen credentials long before attacks surface publicly.
A prominent UK research university has fallen victim to a sophisticated cyberattack targeting Oracle PeopleSoft systems, compromising sensitive financial and personal data of nearly half a million students.
The sophisticated Miasma credential-stealing framework has been deliberately released on GitHub, enabling threat actors to weaponize autonomous supply chain attacks against developer infrastructure.
GitHub's upcoming npm v12 introduces mandatory approval for installation scripts and remote dependencies, fundamentally changing how JavaScript packages are installed to prevent supply chain attacks.
ShinyHunters cybercriminal group has compromised over 100 organizations through targeted attacks against Oracle PeopleSoft enterprise systems, using advanced exploit chains to steal sensitive corporate data.
Threat actors infiltrated 73 Microsoft repositories on GitHub, forcing rapid containment within 105 seconds. The incident highlights escalating risks to enterprise development pipelines from sophisticated supply chain campaigns.
Hackers infiltrated France's secure Tchap messaging system using a hijacked account, potentially accessing hundreds of thousands of messages and sensitive government communications.
Cybercriminals are weaponizing GitHub repositories to distribute sophisticated Android banking malware that harvests payment card data through NFC exploitation, targeting European financial institutions.
Cybercriminals compromised 19 popular bioinformatics packages on PyPI, affecting hundreds of thousands of downloads to steal developer credentials and secrets.
Security researchers have identified a sophisticated IoT botnet variant that targets DD-WRT firmware while actively hunting and destroying rival malware installations across multiple device architectures.
Criminal groups are targeting legal practices with sophisticated phone-based social engineering campaigns that lead to data theft within hours. These attacks exploit lawyers' pressure to protect client confidentiality.
Toshiba and Muji warn users about malicious login prompts appearing on their websites, stemming from a compromised JavaScript library that should have been removed years ago.
Security researchers discovered malicious cryptocurrency mining code injected into a popular Windows browser through a supply chain compromise, highlighting vulnerabilities in software distribution pipelines.
Attackers are weaponizing trusted payment platforms to host malicious code and stolen financial data, bypassing security controls by abusing legitimate API infrastructure.
A major dental insurance administrator suffered a devastating cyber attack that exposed sensitive health and personal data of 2.6 million customers after failing to meet extortion demands.
Rust-based malware compromises 36 npm packages, targeting developer credentials and self-propagating through stolen publishing tokens in elaborate supply-chain attack.
Criminal forums are democratizing cybercrime by teaching newcomers to exploit vulnerabilities for profit. Security teams must understand these evolving threat actor recruitment methods.
Joint European law enforcement operation reveals how cybercriminals are leveraging advanced document forgery platforms to enable large-scale criminal enterprises across borders.
A financially motivated Chinese-speaking cybercrime group has dramatically expanded operations across Europe, deploying novel Atlas RAT malware alongside AI-assisted development techniques in sophisticated multi-vector attacks.
A coordinated law enforcement operation dismantled nine criminal organizations running illegal streaming services, revealing how piracy platforms expose millions of users to malware and data theft while generating …
A sophisticated malware-as-a-service operation targeting gamers has infected over 116,000 systems since January, leveraging fake Minecraft modifications and social media manipulation to distribute information-stealing malware.
A sophisticated malware-as-a-service operation has compromised over 116,000 Minecraft gaming systems through malicious mods and utilities, revealing the gaming community's vulnerability to targeted credential theft campaigns.
Cybercriminals exploit thousands of high-reputation websites through sophisticated traffic distribution systems, deploying both ClickFix social engineering and fake browser updates to deliver malware across Windows and macOS platforms.
Sophisticated attackers compromised over 30 Red Hat npm packages through GitHub account takeover, deploying advanced Miasma malware to harvest developer secrets and cloud credentials.
Spanish authorities arrest individual responsible for exposing sensitive personal information of government employees from critical state agencies including cybersecurity and law enforcement organizations.
A sophisticated malware campaign infected nearly 2,000 WordPress sites by concealing command-and-control data within Steam Community profile comments using invisible Unicode characters.
Underground cybercriminals have transformed distributed denial-of-service attacks from technical exploits into polished subscription platforms, complete with customer support, reseller programs, and monthly pricing plans.
Dutch law enforcement disrupted one of the largest botnets in recent history, seizing over 200 command servers and freeing 17 million compromised devices from cybercriminal control.
A decade-long scheme selling elderly Americans' personal data to international scammers highlights the urgent need for stronger data protection measures and elder fraud prevention strategies.
A prominent telecommunications provider serving over 32 million customers suffered a devastating breach when cybercriminals used voice phishing tactics to compromise internal systems and extract millions of customer …
A sophisticated malware-as-a-service platform targeting Latin America enables cybercriminals to generate customized Android trojans through an intuitive builder interface, facilitating widespread financial theft operations.
Cybercriminals have launched hundreds of fraudulent websites mimicking FIFA ahead of the 2026 World Cup, using sophisticated domain spoofing techniques to steal credentials and sell counterfeit tickets.
Threat actors are weaponizing a critical authentication bypass vulnerability in Fortinet's enterprise management platform to deploy advanced credential-stealing malware disguised as legitimate security updates.
A severe argument injection vulnerability in Gogs self-hosted Git service allows authenticated attackers to execute arbitrary code remotely. Over 2,400 exposed servers worldwide remain vulnerable with no patch …
A 46-year-old Romanian hacker received nearly five years in prison for breaching Oregon's emergency management systems and selling network access to criminal buyers, highlighting persistent threats to state …
Sophisticated attackers are weaponizing SEO manipulation and AI assistant responses to distribute GPU mining malware through poisoned software downloads, establishing persistent access via legitimate remote management tools.
Coordinated takedown eliminates sophisticated threat using Solana blockchain, BitTorrent networks, and calendar services for resilient command infrastructure targeting software developers.
The Silent Ransom Group has escalated beyond traditional phishing to deploying human operatives for direct data theft at law firm offices. Federal authorities warn of sophisticated social engineering …
Dutch authorities apprehend suspect in major breach of Amsterdam football club's systems, exposing fan data and ticketing infrastructure weaknesses that plague modern sports organizations.
Charter Communications confirms security incident following extortion threats, highlighting growing risks of voice phishing attacks against enterprise SSO systems and cloud-based customer databases.
A sophisticated attack on 7-Eleven's Salesforce environment compromised personal data of nearly 185,000 individuals, highlighting critical vulnerabilities in cloud-based franchise management systems.
A new phishing-as-a-service operation leverages legitimate authentication protocols to compromise enterprise Microsoft 365 accounts, demonstrating how attackers weaponize standard security features.
Cybercriminals compromised hundreds of Laravel localization packages by manipulating GitHub tags to distribute sophisticated credential-harvesting malware to unsuspecting developers.
Italian authorities dismantled CINEMAGOAL, a €300M piracy network that exploited streaming platform authentication systems using stolen credentials and virtual machines.
Federal prosecutors secured guilty pleas from two telecommunications executives who knowingly facilitated global tech support scams, highlighting the criminal infrastructure behind fraudulent call operations targeting vulnerable populations.
International law enforcement dismantled the KimWolf botnet operation, arresting its alleged Canadian administrator who commanded nearly 2 million compromised IoT devices capable of launching record-breaking DDoS attacks.
Sophisticated Drainer-as-a-Service platforms are professionalizing cryptocurrency theft through automated phishing campaigns that trick users into authorizing malicious wallet transactions.
Authorities seized 33 servers across 27 countries and arrested the administrator of First VPN, a service that enabled ransomware operations and cybercrime campaigns worldwide.
A compromised VS Code extension linked to the TanStack supply chain attack enabled hackers to breach 3,800 GitHub internal repositories, highlighting critical vulnerabilities in developer toolchain security.
Joint Ukrainian-U.S. investigation exposes teenage cybercriminal who orchestrated massive credential theft targeting California retailer, stealing data from 28,000 accounts.
A missed workflow token during incident response allowed attackers to maintain persistence in Grafana's repositories after supply chain compromise. The breach highlights critical gaps in token lifecycle management.
A dangerous new Linux privilege escalation flaw allows attackers to gain root access through kernel memory manipulation. While limited to specific configurations, security teams must act quickly to …
A malicious Visual Studio Code extension compromised an employee device, leading to unauthorized access of thousands of internal GitHub repositories. The incident highlights growing supply chain risks in …
A major code hosting platform is investigating unauthorized access to thousands of internal repositories after cybercriminals claimed to have stolen private source code and threatened public disclosure.
A sophisticated cybercrime operation exploited Microsoft's code-signing platform to legitimize malware for major ransomware groups, generating millions in profits before being shut down.
Advanced threat actor leverages social engineering and legitimate Microsoft features to compromise privileged accounts and exfiltrate sensitive data from Azure environments.
Cybercriminals launched a massive supply chain attack targeting npm packages, compromising over 600 libraries to steal developer credentials and CI/CD secrets through sophisticated obfuscation techniques.
Major convenience retailer confirms system compromise by ShinyHunters group, highlighting persistent vulnerabilities in cloud platform integrations and franchise data protection.
A coordinated international operation across 13 nations resulted in over 200 arrests and dismantled extensive cybercriminal infrastructure targeting regional victims through phishing, malware, and fraud schemes.
Cybercriminals have developed sophisticated techniques to circumvent Apple's recent security updates, using fake software installers and AppleScript manipulation to steal cryptocurrency wallets and sensitive data.
Opportunistic threat actors are leveraging recently leaked infostealer source code to launch typosquatting campaigns against the npm ecosystem, targeting developer credentials and cryptocurrency assets.
Popular analytics platform maker Grafana Labs confirmed hackers stole source code through a compromised GitHub token but declined to pay extortion demands, citing FBI guidance against ransomware payments.
Security researcher releases working exploit for unpatched Windows vulnerability that grants SYSTEM privileges on fully updated systems. The flaw allegedly stems from incomplete Microsoft patching.
The notorious Tycoon2FA phishing platform has rebounded from law enforcement disruption, adding sophisticated device authorization flows to bypass multi-factor authentication and hijack Microsoft 365 accounts.
Cybercriminals are actively targeting a critical flaw in the popular Funnel Builder WordPress plugin to inject payment skimmers that harvest customer financial data during checkout.
Cybercriminals have weaponized the widely-used node-ipc npm package to steal cloud credentials and sensitive data through sophisticated DNS tunneling techniques, affecting hundreds of thousands of weekly downloads.
New analysis reveals sophisticated infostealer operations are evolving beyond password theft to target browser sessions and authentication tokens, operating like structured software businesses.
Cybercriminals are threatening to leak proprietary artificial intelligence code repositories unless their ransom demands are met, highlighting new risks in AI development security.
Two OpenAI employees fell victim to the Mini Shai-Hulud campaign targeting developers through compromised npm and PyPI packages. The company rotated code-signing certificates as a precaution.
Cybercriminals are exploiting Microsoft Teams for lightning-fast corporate infiltrations, using sophisticated social engineering to deploy advanced remote access trojans within five minutes of initial contact.
Federal prosecutors have indicted the alleged main administrator of Dream Market, once the largest dark web marketplace, on money laundering charges following his arrest in Germany.
TeamPCP threat group exploited GitHub CI/CD workflows to distribute credential-stealing malware through legitimate package signatures, targeting developer infrastructure across npm and PyPI repositories.
TeamPCP hackers exploited previously stolen credentials to publish a malicious version of Checkmarx's Jenkins security plugin, marking the third supply chain attack against the company in two months.
Security researchers demonstrate how legitimate Windows file APIs can be weaponized to create denial-of-service conditions that evade traditional detection methods while providing cover for covert operations.
.jpg)
The latest TrickMo variant demonstrates how cybercriminals are exploiting decentralized networks to create nearly undetectable command-and-control infrastructure, targeting European banking customers.
Cybercriminals are leveraging legitimate AI platform features and Google Ads to distribute macOS malware through weaponized shared conversations that masquerade as official installation guides.
The swift shutdown of a rebooted German cybercrime marketplace demonstrates how authorities are adapting to the resilient nature of criminal enterprises, making quick pivots increasingly costly for operators.
Popular download management software's official website was breached to distribute Python-based remote access trojans, affecting Windows and Linux users who downloaded installers during the two-day compromise window.
Cybercriminals exploited Hugging Face's AI model sharing platform to distribute sophisticated infostealer malware, reaching trending status before detection.
The notorious RansomHouse cybercrime group has claimed responsibility for breaching Trellix's source code repository, publishing proof-of-concept images while the cybersecurity firm continues investigating the April incident.
A sophisticated attack on a former technology provider compromised customer data from the global fashion chain, highlighting critical third-party risk management challenges.
A sophisticated new malware operation is stealing credentials from exposed cloud services while systematically removing TeamPCP infections, suggesting internal conflict within cybercriminal ecosystems.
Cybercriminals are exploiting compromised WordPress sites to trick users into executing malicious PowerShell commands through fake verification prompts, leading to devastating data theft.
A cryptocurrency theft ring combined social engineering with home invasions to steal $230 million, highlighting how digital assets increasingly motivate traditional criminal tactics.
A sophisticated campaign uses fake Claude AI websites to distribute a novel Windows backdoor called Beagle, exploiting growing enterprise interest in AI tools to deliver persistent malware.
Cybercriminals are exploiting Google's advertising platform to deploy sophisticated phishing attacks against ManageWP users, compromising hundreds of WordPress websites through real-time credential theft.
Cybercriminals successfully trojanized DAEMON Tools Lite installers for weeks, deploying information stealers and backdoors to thousands of systems worldwide before detection.
A sophisticated new Linux malware combines rootkit, backdoor, and credential theft capabilities to infiltrate development environments and enable supply chain attacks through compromised developer systems.
A devastating cyberattack on education technology provider Instructure has compromised personal data from nearly 9,000 schools and universities, highlighting critical vulnerabilities in EdTech infrastructure.
DAEMON Tools installers were weaponized to deliver backdoors to thousands of systems across 100+ countries, with targeted second-stage payloads deployed to select high-value victims.
Security researchers expose sophisticated malware campaign targeting Microsoft's Phone Link feature to steal SMS-based two-factor authentication codes without compromising victim smartphones directly.
Threat actors are exploiting exposed AWS credentials to abuse Amazon's trusted email service for sophisticated phishing campaigns that evade traditional security controls.
Attackers compromised PyTorch Lightning version 2.6.3 on PyPI, deploying a JavaScript-based credential stealer targeting cloud services and browsers. The malware affects the popular AI framework with 11M monthly …
Criminal networks are abandoning technical exploits in favor of sophisticated identity fraud schemes that exploit legitimate lending workflows at smaller financial institutions.
Education technology giant Instructure confirms data theft affecting its Canvas platform, with cybercriminal group ShinyHunters claiming to possess personal information from nearly 15,000 educational institutions worldwide.
Security researchers expose FEMITBOT operation exploiting Telegram's Mini App feature to run sophisticated crypto scams and distribute Android malware while impersonating major brands.
The latest iteration of ConsentFix transforms OAuth phishing into a fully automated campaign platform, targeting Microsoft Azure environments with sophisticated social engineering and real-time token harvesting capabilities.
French authorities detained a 15-year-old for breaching the national document agency and attempting to sell 11.7 million citizen records on criminal forums. The case highlights growing youth involvement …
Romanian cybercriminal's four-year sentence highlights the serious legal consequences of coordinated swatting operations that terrorized dozens of officials and wasted hundreds of thousands in public resources.
Criminal groups are weaponizing phishing and system infiltration to orchestrate sophisticated cargo theft schemes, causing massive disruption to North American logistics operations.
International operation dismantles nine crypto fraud centers and arrests 276 suspects in coordinated strike against pig-butchering schemes that have cost victims billions globally.
Four official SAP npm packages were infiltrated with credential-harvesting malware targeting developer authentication tokens and CI/CD secrets across enterprise environments.
A popular WordPress redirect plugin concealed a sophisticated backdoor for years, affecting over 70,000 websites through a malicious update mechanism that bypassed official security controls.
Law enforcement dismantles sophisticated operation that compromised over 610,000 gaming accounts through malware disguised as game enhancement tools, highlighting growing threats to digital asset security.
Austrian and Albanian authorities dismantled a sophisticated cryptocurrency fraud operation that mimicked legitimate business structures to steal over €50 million from global victims.
Video platform Vimeo disclosed unauthorized access to customer email addresses and technical metadata following a supply chain attack through compromised data analytics provider Anodot.
Federal prosecutors have charged a 19-year-old dual citizen with wire fraud and conspiracy for his role in Scattered Spider's multimillion-dollar extortion campaigns targeting global corporations.
The notorious LAPSUS$ cybercriminal group has published nearly 100GB of stolen data from security firm Checkmarx, following a sophisticated supply chain attack that granted persistent access to the …
Cybercriminals are adopting military-grade operational security frameworks with three-tier architectures and systematic evasion tactics, signaling a shift toward more resilient threat operations.
Cybercriminals manipulated a major trading platform's account registration system to send legitimate-looking phishing emails that bypassed standard security checks, targeting millions of users.
Cybercriminals deploy 73 seemingly innocent development extensions that activate malicious payloads through post-installation updates, targeting developer credentials and cryptocurrency wallets.
Canadian law enforcement has dismantled a sophisticated mobile network fraud scheme using rogue cellular towers to intercept phones and deliver mass phishing campaigns across Toronto.
Attackers exploited a GitHub Actions vulnerability to inject malicious code into a widely-used data observability package, stealing developer credentials and cryptocurrency wallets from unsuspecting users.
The notorious cybercriminal group exploited single sign-on vulnerabilities to steal personal data from America's largest home security provider, demonstrating the growing threat of voice phishing attacks targeting corporate …
A recent federal prosecution reveals how sophisticated crypto heist operations use social engineering and laundering networks to steal and disguise hundreds of millions in digital assets.
Cybercriminals are exploiting Microsoft Teams' trusted status to deliver a sophisticated three-part malware toolkit, combining email bombing with IT helpdesk impersonation to steal domain credentials.
ADT confirms unauthorized access to customer data after ShinyHunters cybercriminal group exploited employee credentials through sophisticated voice phishing tactics to breach corporate systems.
Security agencies warn of advanced persistent malware targeting Cisco firewall infrastructure, demonstrating unprecedented resilience against standard remediation efforts.
A sophisticated supply chain attack infiltrated Bitwarden's npm distribution channel, deploying credential-stealing malware that targets developer environments and propagates through compromised repositories.
Attackers infiltrated the KICS security scanner through malicious Docker images and IDE extensions, targeting developer credentials and infrastructure secrets in a sophisticated multi-vector campaign.
Cybercriminals are weaponizing a command injection flaw in end-of-life D-Link routers to expand Mirai botnets, highlighting the persistent security risks of abandoned networking hardware.
Cybercriminals have transformed phone fraud into sophisticated business operations with structured hiring, training programs, and performance metrics that mirror legitimate call centers.
Cybercriminals are leveraging a trojanized version of the legitimate HandyPay mobile payment app to steal NFC card data from Android devices, primarily targeting users in Brazil through fake …
Security researchers uncovered a coordinated operation deploying 26 fraudulent cryptocurrency wallet applications that successfully bypassed App Store security measures to steal digital assets through seed phrase harvesting.
Cybercriminals have successfully compromised a major retailer's e-commerce platform, stealing customer data and launching a public shaming campaign to force ransom payment.
Cybercriminals are weaponizing cross-tenant messaging features to impersonate IT staff and gain remote access to corporate networks through trusted collaboration platforms.
The alleged leader of the notorious Scattered Spider cybercrime collective has pleaded guilty to orchestrating cryptocurrency thefts worth millions through sophisticated SMS phishing campaigns targeting major corporations.
Cybercriminals are exploiting Apple's account notification system to deliver convincing phishing emails that bypass security filters by originating from legitimate Apple servers.
Kyrgyzstan-based exchange Grinex attributes major cryptocurrency theft to foreign intelligence agencies after losing millions from Russian user accounts, highlighting geopolitical tensions in digital finance.
Underground fraud operations now use sophisticated vetting processes to evaluate stolen data suppliers, revealing how criminal markets have evolved into structured, business-like ecosystems with formal risk assessment protocols.
A Memphis man received a prison sentence for operating an underground marketplace selling access to compromised betting platform accounts, highlighting the growing threat of credential-stuffing attacks.
A coordinated 21-country operation shut down 53 illegal DDoS domains and identified thousands of cybercriminals using attack-for-hire services.
Security researchers have discovered sophisticated malware specifically engineered to manipulate water treatment facilities, highlighting growing threats to critical infrastructure and industrial control systems.
A cybersecurity researcher has released another privilege escalation exploit targeting Microsoft Defender, dubbed 'RedSun,' claiming the tech giant mishandled vulnerability disclosures.
Cybercriminals are leveraging Hugging Face's legitimate AI infrastructure to host and distribute sophisticated malware variants, demonstrating how trusted platforms become attack vectors.
Cybercriminals deploy sophisticated AgingFly malware against Ukraine's government and healthcare sectors, using runtime code compilation to evade detection while stealing browser credentials and WhatsApp data.
A sophisticated supply chain attack compromised over 30 WordPress plugins after a business acquisition, demonstrating how ownership changes can introduce devastating security vulnerabilities that remain dormant for months.
A sophisticated malware campaign leveraged signed software to disable security protections across critical infrastructure, education, and healthcare networks in 124 countries.
The sophisticated Mirax trojan, distributed through Meta advertising campaigns, has compromised hundreds of thousands of Android devices, turning victims into unwitting participants in cybercriminal infrastructure through SOCKS5 proxy …
Microsoft deploys new security warnings and resource restrictions for Remote Desktop connection files following increased abuse by threat actors in phishing attacks.
A major cryptocurrency platform faces extortion demands after threat actors recruited employees to access internal systems. The incident highlights growing insider recruitment tactics targeting the crypto sector.
Security researchers expose coordinated malware operation targeting Chrome users through 100+ malicious extensions that harvest authentication tokens and hijack accounts.
A counterfeit Ledger Live application infiltrated Apple's App Store, compromising 50 victims and draining nearly $10 million in digital assets within days before detection.
A coordinated enforcement action across three nations demonstrates how authorities are adapting to combat sophisticated crypto fraud schemes targeting thousands of victims.
ShinyHunters cybercrime group has leaked sensitive Rockstar Games data including anti-cheat source code and player analytics after exploiting third-party cloud infrastructure vulnerabilities.
Security researchers discover sophisticated social engineering campaign targeting finance professionals through compromised Obsidian plugins, delivering cross-platform malware with blockchain-based command infrastructure.
OpenAI is rotating macOS code-signing certificates after a GitHub Actions workflow was compromised by a malicious Axios package. The precautionary measure affects multiple desktop applications including ChatGPT Desktop.
Joint FBI-Indonesian operation dismantles sophisticated phishing infrastructure that exploited commercial tools to target thousands of victims worldwide. The takedown highlights the growing threat of accessible cybercrime toolkits.
Cybercriminals are deploying sophisticated infostealers that bypass traditional endpoint protection by decrypting stolen browser data on remote servers rather than infected devices.
Cybercriminals compromised a major hardware utilities website, replacing legitimate software downloads with STX RAT malware for six hours. The attack infected over 150 victims globally through trojanized installers.
OpenAI's proactive certificate revocation following a compromised GitHub Actions workflow highlights growing threats to software supply chains and automated development processes.
Cybercriminals penetrated Venice's flood control systems, threatening to disable protections for St. Mark's Square while selling access for just $600—exposing how vulnerable our critical infrastructure has become.
Recent malware campaigns demonstrate advanced threat actor capabilities across npm packages, IoT botnets, and zero-day exploits, signaling a concerning evolution in attack methodologies.
Cybercriminals compromised the official CPUID website for nearly 24 hours, replacing legitimate CPU-Z and HWMonitor downloads with malicious versions containing the STX remote access trojan.
A sophisticated malware campaign leverages native compiled code within fake IDE extensions to silently compromise multiple development environments across systems.
Operation Atlantic demonstrates how international cooperation can effectively combat cryptocurrency scams, identifying over 20,000 victims and disrupting multiple fraud networks across three countries.
The open-source Python notebook platform Marimo fell victim to lightning-fast exploitation, with attackers turning a critical authentication bypass into working exploits within hours of public disclosure.
Attackers weaponized a critical vulnerability in the open-source Python notebook tool within hours of disclosure, demonstrating how AI-powered threat actors now target even niche software with unprecedented speed.
A sophisticated malware campaign targets software developers through malicious IDE extensions, using advanced evasion techniques to establish persistent access across development environments.
A sophisticated campaign targeting developers deploys Zig-compiled droppers through malicious IDE extensions, compromising multiple development environments simultaneously to steal credentials and source code.
A sophisticated new variant of the GlassWorm campaign deploys Zig-compiled malware through malicious IDE extensions, targeting the entire developer ecosystem on compromised machines.
Attackers compromised CPUID's distribution infrastructure, delivering malicious versions of CPU-Z and HWMonitor to unsuspecting users for several hours through poisoned download links.
Cybercriminals are using sophisticated adversary-in-the-middle techniques to bypass multi-factor authentication and redirect employee paychecks through compromised HR systems.
Cybercriminals are deploying sophisticated LucidRook malware through deceptive email campaigns against Taiwanese NGOs and universities, utilizing complex multi-stage infection chains.
Cybercriminals compromised the Smart Slider 3 Pro plugin's update mechanism, distributing malicious code to hundreds of thousands of WordPress installations through poisoned software updates.
An exclusive look at the sophisticated multi-tenanted security infrastructure powering Defense Cyber Marvel 2026, where 2,500 personnel from 29 countries tested cyber defense capabilities in realistic threat scenarios.
Analysis of the sophisticated security monitoring platform that supported 2,500 personnel across 29 nations in the largest UK military cyber defense exercise.
CISA elevates a serious code injection vulnerability in Ivanti's mobile endpoint management platform to its priority remediation list following confirmed attacks in the wild.
Major security platforms expand integration capabilities with comprehensive data normalization, prebuilt dashboards, and AI-powered analysis across cloud, endpoint, and email threat detection systems.
Why traditional antivirus fails against Linux rootkits and how security teams can shift to behavioral detection for effective defense.
Google has released an emergency patch for CVE-2026-3910.
A threat actor claims that a previously unknown vulnerability commonly referred to as a zero-day affecting Fortinet’s FortiGate firewalls is being sold on the dark web.
Tenable researchers have uncovered a critical zero-day vulnerability (CVE-2025-31324) affecting SAP NetWeaver AS Java systems. The flaw, currently exploited in the wild, stems from a missing authentication check …
Fortinet has disclosed a critical stack-based buffer overflow vulnerability, identified as CVE-2025-32756, affecting multiple products, including FortiVoice, FortiMail, FortiNDR, FortiRecorder, and FortiCamera.
Citrix has released emergency patches addressing two critical vulnerabilities—CVE-2025-6543 and CVE-2025-5777—affecting NetScaler ADC and NetScaler Gateway appliances.
Cisco has confirmed an active zero-day vulnerability, CVE-2025-20352, in the SNMP subsystem of its IOS and IOS XE software. The flaw can allow an attacker to trigger remote …
Ivanti, a major player in enterprise IT management and security, has issued an urgent advisory regarding three newly discovered zero-day vulnerabilities affecting its Endpoint Manager Mobile (EPMM) product.
A recently discovered zero-day vulnerability in FortiManager and FortiManager Cloud allows attackers unauthorized access to sensitive network settings, potentially bypassing authentication.
This article presents a detailed analysis of a stealer campaign exploiting CVE-2024-21412, a security bypass vulnerability in Microsoft Windows SmartScreen.
On this Patch Tuesday, Microsoft has confirmed the presence of a critical zero-day vulnerability (CVE-2023-41689) within the Windows Management Console (WMC), which has been actively exploited in the …
In a recent announcement, Microsoft confirmed the exploitation of a zero-day vulnerability in the Windows Task Scheduler, urging immediate attention from system administrators and security teams.
Incident OverviewThis report covers a credential-stealing malware identified through Shield Security Operation team, named Lumma Stealer.
Fortinet Firewall SSL VPN CVE: CVE-2024-21762 Severity: CRITICAL Priority: CRITICAL Summary Threat Alert: CVE: CVE-2024-21762 Severity: CRITICAL Priority: CRITICAL Summary Fortinet is warning that a new critical remote …
A new vulnerability identified as CVE-2023-36884 in Microsoft Office has recently surfaced, adding to the growing list of 0-day flaws that could impact millions of users.
A critical vulnerability, CVE-2024-45519, in Zimbra Collaboration Suite’s postjournal feature has been identified, actively exploited by attackers. This flaw allows unauthenticated users to execute arbitrary commands on vulnerable …
Security AdvisoryPublished Date: January 15, 2025Vulnerability SummaryA critical authentication bypass vulnerability (CWE-288) has been identified in Fortinet's FortiOS and FortiProxy products. This flaw allows remote attackers to gain …
Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding two critical vulnerabilities in Palo Alto Networks' Expedition software, identified as CVE-2024-9463 and CVE-2024-9465.
The Shield53 Threat Intelligence Team is issuing this bulletin to alert you about a critical access control vulnerability in SonicWall SSL-VPN devices, which is currently being exploited in …
https://www.trendmicro.com/en_us/research/24/b/cve202421412-water-hydra-targets-traders-with-windows-defender-s.html CVE-2024-21410, identified as an elevation of privilege flaw within Microsoft Exchange Server, warrants immediate attention for patching.