Cyfirma Archives • Daily CyberSecurity

Operation TaxShadow: Tax Phishing Hides In-Memory Malware Operation TaxShadow, tax phishing malware, in-memory malware, WebSocket C2

Operation TaxShadow: Tax Phishing Hides In-Memory Malware

Do Son June 12, 2026

A Fake Tax Notice Hides a Dangerous Payload Security researchers at CYFIRMA have uncovered Operation TaxShadow, a...

Weaponized JPEG Payload Deploys Trojanized ScreenConnect for Covert Espionage axios Supply Chain Attack WAVESHAPER.V2 SnappyBee Malware Salt Typhoon Stately Taurus ScoringMathTea RAT, Lazarus Reflective DLL

axios Supply Chain Attack WAVESHAPER.V2 SnappyBee Malware Salt Typhoon Stately Taurus ScoringMathTea RAT, Lazarus Reflective DLL

Weaponized JPEG Payload Deploys Trojanized ScreenConnect for Covert Espionage

Do Son May 14, 2026

The threat intelligence team at CYFIRMA has uncovered a sophisticated multi-stage intrusion campaign. Attackers are currently leveraging...

The Intel “AppDomain” Hijack: Unmasking a Sophisticated Post-Exploitation Framework

Do Son April 22, 2026

A new and highly advanced threat has emerged in the financial sectors of the Middle East and...

One Scan to Zero: The QR Code Trap Wiping Trust Wallets via Telegram Trust Wallet Drainer QR Code Phishing

One Scan to Zero: The QR Code Trap Wiping Trust Wallets via Telegram

Do Son April 20, 2026

A sophisticated and highly effective cryptocurrency theft campaign is currently sweeping through Telegram channels, turning a simple...

TaxiSpy RAT: New Android Banking Trojan Targets Russian Financial Sector Android zero day flaw June 2026 security bulletin RuTaxi Trojan Android Banking Malware Pixel 9 zero-click exploit, Dolby UDC vulnerability CVE-2025-54957 NexusRoute Android RAT, India E-Challan Phishing ClayRat Self-Defense, Android Accessibility Abuse Android Trojan, AntiDot Android Malware "BadPack"

Android zero day flaw June 2026 security bulletin RuTaxi Trojan Android Banking Malware Pixel 9 zero-click exploit, Dolby UDC vulnerability CVE-2025-54957 NexusRoute Android RAT, India E-Challan Phishing ClayRat Self-Defense, Android Accessibility Abuse Android Trojan, AntiDot Android Malware "BadPack"

TaxiSpy RAT: New Android Banking Trojan Targets Russian Financial Sector

Do Son March 13, 2026

A highly sophisticated Android Banking Trojan has emerged, combining traditional financial theft with advanced Remote Access Trojan...

Stealth and Deception: Transparent Tribe’s Multi-Stage Assault on Indian Government Entities NATS-as-C2 Sysdig CVE-2026-33017 Langflow RCE Microsoft Phone Link Hijack CloudZ Pheno Plugin Insider Threat BlackCat (ALPHV) OFAC Sanctions DPRK IT Workers Transparent Tribe APT36 React2Shell, EtherRAT SideWinder Espionage, Netlify Phishing DDNS Abuse, C2 Infrastructure Hacking Health Club

NATS-as-C2 Sysdig CVE-2026-33017 Langflow RCE Microsoft Phone Link Hijack CloudZ Pheno Plugin Insider Threat BlackCat (ALPHV) OFAC Sanctions DPRK IT Workers Transparent Tribe APT36 React2Shell, EtherRAT SideWinder Espionage, Netlify Phishing DDNS Abuse, C2 Infrastructure Hacking Health Club

Stealth and Deception: Transparent Tribe’s Multi-Stage Assault on Indian Government Entities

Do Son March 5, 2026

Cybersecurity researchers at CYFIRMA have unmasked a sophisticated new campaign by the Pakistan-aligned threat actor Transparent Tribe...

From Chat App to Dark Web: How Telegram Became the New Hub for Cybercrime CVE-2024-22394

From Chat App to Dark Web: How Telegram Became the New Hub for Cybercrime

Do Son March 3, 2026

For millions of people around the world, Telegram is a secure and convenient way to chat with...

Telegram Phishing Campaign Hijacks Accounts by Abusing Trust Telegram Phishing Account Takeover

Telegram Phishing Campaign Hijacks Accounts by Abusing Trust

Do Son February 13, 2026

A new phishing campaign is targeting Telegram users by turning the platform’s own security features into a...

Weaponized Code: LTX Stealer Abuses Node.js to Bypass Antivirus LTX Stealer Node.js Malware

Weaponized Code: LTX Stealer Abuses Node.js to Bypass Antivirus

Do Son February 12, 2026

A new report by CYFIRMA has uncovered a sophisticated credential-stealing campaign that abuses legitimate software frameworks to...

Discord Spy: SolyxImmortal Malware Uses Webhooks for Stealthy Theft SolyxImmortal Malware Python Info-Stealer Discord Webhook C2, Supply Chain Abuse

SolyxImmortal Malware Python Info-Stealer Discord Webhook C2, Supply Chain Abuse

Discord Spy: SolyxImmortal Malware Uses Webhooks for Stealthy Theft

Do Son January 20, 2026

A newly identified Python-based malware, SolyxImmortal, is making the rounds in underground channels, offering a “monolithic” surveillance...

Transparent Tribe Weaponizes “JLPT” Tests in New Cyber-Espionage Campaign Against India Operation IconCat, UNG0801 AFP cyberattack -NetWalker Ransomware VShell RAT

Operation IconCat, UNG0801 AFP cyberattack -NetWalker Ransomware VShell RAT

Transparent Tribe Weaponizes “JLPT” Tests in New Cyber-Espionage Campaign Against India

Do Son January 5, 2026

A seemingly harmless notification about a Japanese language proficiency exam has become the latest vector for state-aligned...

APT-36 Uses Fake “WhatsApp Fraud” Advisory to Hack Government Systems TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

APT-36 Uses Fake “WhatsApp Fraud” Advisory to Hack Government Systems

Do Son December 24, 2025

The sophisticated threat group APT-36 is hacking government systems by warning them about hackers. A new intelligence...

The Payroll Trap: New Quishing Campaign Uses Fake CAPTCHAs to Hijack Employee Paychecks Payroll Quishing, CYFIRMA Analysis

The Payroll Trap: New Quishing Campaign Uses Fake CAPTCHAs to Hijack Employee Paychecks

Do Son December 23, 2025

A sophisticated new phishing campaign is targeting employees where they are most vulnerable—their paychecks—by leveraging QR codes...

New Yurei Ransomware Emerges: Go-Based Variant Uses Advanced Anti-Forensics for Irreversible Double Extortion Yurei Ransomware, Double Extortion

New Yurei Ransomware Emerges: Go-Based Variant Uses Advanced Anti-Forensics for Irreversible Double Extortion

Do Son October 7, 2025

A new ransomware variant known as Yurei Ransomware has emerged, and according to researchers from CYFIRMA, it...

XillenStealer: New Open-Source Malware Lowers Cybercrime Barrier XillenStealer, open-source malware

XillenStealer: New Open-Source Malware Lowers Cybercrime Barrier

Do Son September 19, 2025

CYFIRMA has released a detailed threat intelligence assessment of XillenStealer, an emerging open-source, Python-based malware family that...

Hacktivists Launch Coordinated Attacks on India’s Infrastructure hacktivist attacks

Hacktivists Launch Coordinated Attacks on India’s Infrastructure

Do Son September 18, 2025

India’s digital infrastructure has become a high-value battleground for hacktivists. A new analysis from CYFIRMA highlights how...

Salat Stealer: A New Go-Based MaaS Is Hijacking Browsers and Crypto Wallets Salat Stealer, MaaS

Salat Stealer: A New Go-Based MaaS Is Hijacking Browsers and Crypto Wallets

Do Son September 9, 2025

CYFIRMA has released an in-depth analysis of Salat Stealer (also known as WEB_RAT), a sophisticated Go-based malware...

Inf0s3c Stealer: A Stealthy Python Malware Is Abusing Discord to Steal Data Inf0s3c Stealer, Windows malware

Inf0s3c Stealer: A Stealthy Python Malware Is Abusing Discord to Steal Data

Do Son September 3, 2025

Cyfirma’s Threat Intelligence team has released a technical analysis of Inf0s3c Stealer, a Python-based information grabber designed...

TinkyWinkey: A Stealthy New Keylogger Is Hunting for Credentials on Windows TinkyWinkey Keylogger, Windows malware

TinkyWinkey: A Stealthy New Keylogger Is Hunting for Credentials on Windows

Do Son September 2, 2025

Researchers at CYFIRMA have released an in-depth analysis of a newly observed Windows malware family dubbed the...

REVENANT: The Experimental Framework That Infects AI Models and Evades Traditional Defenses Experimental attack framework, AI security

REVENANT: The Experimental Framework That Infects AI Models and Evades Traditional Defenses

Do Son August 18, 2025

In a new report, CYFIRMA has detailed an experimental attack framework called REVENANT, which demonstrates how adversaries...

Critical Alert 1 Active Exploit Detected Today