Do Son North Korea's "Contagious Interview" campaign uses DriverFixer0428 to steal macOS credentials via fake prompts and Dropbox C2. Stay alert!
Malware
Genians exposes APT37's Artemis campaign, where hackers pose as Korean TV writers using fake casting calls to deliver malware via HWP documents.
Jamf uncovers a new MacSync Stealer variant that was notarized by Apple, allowing it to bypass Gatekeeper and infect Macs without terminal commands.
Kaspersky warns of Webrat malware targeting researchers via fake GitHub PoCs for CVE-2025-10294 and other high-CVSS flaws to install a backdoor.
SafeBreach reveals the return of the Prince of Persia (Infy) group, using Telegram and the new Tonnerre v50 malware to target victims in 2025.
ASEC warns of EtherRAT, a multi-stage crypto-stealer exploiting the React2Shell flaw. It uses Node.js and Ethereum for stealthy C2. Patch now!
Group-IB uncovers "Wonderland," a bidirectional Android SMS stealer in Uzbekistan that uses Telegram droppers to drain bank accounts and hijack sessions.
iVerify exposes Cellik, a $150/mo Android RAT that wraps malicious code inside Play Store apps to grant attackers total device control.
Sophos CTU reveals how the ClickFix tactic led to a Qilin ransomware attack via NetSupport RAT and StealC V2 using stolen VPN credentials.
Gen Digital uncovers AuraStealer, a new infostealer using TikTok "Scam-Yourself" tactics to trick users into infecting their own Windows PCs.
RSF uncovers ResidentBat, a Belarusian KGB spyware physically installed during interrogations to hijack encrypted messages and monitor journalists.
Kimsuky is deploying a new DOCSWAP RAT via QR codes and smishing. The DPRK-linked malware turns phones into surveillance tools for data theft.
A notorious cyber-espionage group known for terrorizing South American institutions has launched a new campaign against the...
With 1.8 million infected Android TVs, Kimwolf issued 1.7 billion commands in 3 days, using Ethereum ENS to become a nearly un-killable cyber threat.
Check Point Research exposes the YouTube Ghost Network, using GachiLoader to spread Rhadamanthys infostealer through cracked software and game cheats.
Jolly Scorpius has upgraded its Mario ransomware with multi-layered, dual-key encryption and dynamic chunking to bypass recovery and lock down data.
Phantom v3.5 info-stealer targets passwords and crypto via a fake Adobe installer. It uses SMTP to exfiltrate data directly to attackers.
The Forum Troll APT is targeting Russian scholars with highly personalized phishing lures and the Tuoni framework disguised as plagiarism reports.
Ink Dragon is weaponizing government servers in Europe using a relay-centric mesh. By hijacking IIS servers, they mask C2 traffic across global networks.
SantaStealer, a new MaaS info-stealer, is being aggressively marketed on the dark web. It's a BluelineStealer rebrand that uses C code and open-source libraries to steal crypto wallets and credentials, despite having amateur anti-analysis features.
The Gentlemen ransomware group rapidly emerged, targeting 17 countries with double extortion. It uses BYOVD and GPO manipulation to bypass security and hit manufacturing, healthcare, and insurance sectors.
NexusRoute is a sophisticated Android RAT campaign impersonating Indian E-Challan/mParivahan via GitHub phishing. It steals UPI PINs and conducts surveillance using a native-backed and professionally maintained malware framework.