Do Son A stealthy spear-phishing campaign uses fake Rothschild job offers to trick finance execs into installing NetBird RAT, gaining remote access.
Malware
APT41 is exploiting Google Calendar as a covert C2 channel in the TOUGHPROGRESS cyberespionage campaign, targeting government entities with stealthy malware.
A new global malware campaign delivers PureHVNC RAT via fake job offers and complex, multi-stage obfuscation, making detection extremely difficult.
A stealthy campaign is persistently hacking ASUS routers via undocumented bypasses and CVE-2023-39780, building a backdoor network without malware.
Zanubis, a sophisticated Android malware, exploits Accessibility Services to steal banking data, intercept 2FA codes, and lock devices.
A malware campaign is hijacking WordPress sites with fake Java update pop-ups, tricking visitors into downloading malicious executables.
A new campaign by UNC6032 uses fake AI video generator sites and social media ads to distribute a malware cocktail including STARKVEIL.
CHOICEJACKING, a new USB attack, bypasses existing JuiceJacking mitigations on Android and iOS by simulating user input via malicious chargers.
Katz Stealer, a new MaaS infostealer, targets browsers, crypto wallets, and Discord using advanced evasion and UAC bypass techniques.
The Catena malware loader is using trojanized app installers (QQBrowser, LetsVPN) to deploy the memory-resident Winos v4.0 RAT.
Mimo (Hezb) is exploiting an unauthenticated RCE (CVE-2025-32432) in Craft CMS to deploy webshells, cryptominers, and proxyware. Patch now!
AppleProcessHub, a new macOS infostealer, uses an Objective-C dropper and AES-decrypted C2 to steal sensitive files like SSH keys and Keychain.
A fake Google Meet page on compromised WordPress sites tricks users into manually running PowerShell commands, delivering remote access malware.
GhostSpy, a sophisticated Android RAT, uses Accessibility Services for full surveillance, data theft (including 2FA), and device control.
TA-ShadowCricket (formerly Shadow Force), a China-linked group, has been active for over a decade, targeting Asia-Pacific government and enterprise networks.
A new malware family, DOUBLELOADER, leverages the ALCATRAZ obfuscator to deploy RHADAMANTHYS infostealer with advanced evasion techniques.
An active npm malware campaign uses over 60 packages to steal internal/external IP addresses, hostnames, and user paths, designed for enterprise network mapping.
Over 40 malicious Chrome extensions, disguised as legitimate tools, are stealing cookies, logins, and impersonating users, many still live on the Web Store.
The "ClickFix" campaign tricks users with fake CAPTCHAs, leading them to paste malicious commands into the Windows Run dialog, delivering infostealers.
AI-generated TikTok videos are instructing users to run PowerShell commands, leading to the delivery of Vidar and StealC infostealer malware.
Malicious scripts disguised as Cloudflare human verification are embedded in WordPress themes, tricking users into executing PowerShell commands that deliver malware.
The Rhadamanthys stealer is back with targeted phishing attacks across Central and Eastern Europe, using fake copyright infringement lures.