Do Son Operation TaxShadow uses fake tax notices to spread in-memory tax phishing malware with WebSocket C2, per CYFIRMA's new report.
Cyfirma
CYFIRMA warns of Operation SilentCanvas: A weaponized JPEG delivers trojanized ScreenConnect, bypassing AMSI and UAC for full-system surveillance. Stay alert!
CYFIRMA uncovers an elite stealth framework hijacking signed Intel utilities via AppDomain Manager. It targets EMEA finance with undetectable memory-only code.
A new QR code "drainer" targets Trust Wallet users on Telegram. It exploits the ERC-20 approve mechanism to wipe USDT. Learn how to protect your assets now.
Cyfirma uncovers the RuTaxi Android banking Trojan, a highly persistent malware using VNC capabilities to hijack Russian bank accounts and crypto wallets.
CYFIRMA reveals a new cyber espionage campaign by Transparent Tribe (APT36) targeting Indian defense with stealthy multi-stage malware and decoy PDFs.
Cyfirma reveals how Telegram has replaced the dark web as the ultimate digital black market, making tools like malware and data theft available to anyone.
New Telegram phishing campaign abuses the "This is me" feature for account takeover. CYFIRMA reveals a global framework evading detection. Stay alert.
New LTX Stealer malware abuses Node.js & Inno Setup to bypass antivirus. This $10 tool steals browser passwords & crypto wallets. Stay alert.
CYFIRMA reveals SolyxImmortal, a Python info-stealer using Discord webhooks for C2. It logs keys and steals files while evading detection.
CYFIRMA unmasks APT36's latest campaign: a fake JLPT exam lure using fileless LNK malware to evade antivirus and spy on Indian government targets.
CYFIRMA exposes APT-36 weaponizing a fake NCERT WhatsApp advisory to deliver a stealthy backdoor and seize long-term control of government systems.
A sophisticated new phishing campaign is targeting employees where they are most vulnerable—their paychecks—by leveraging QR codes...
CYFIRMA uncovered Yurei Ransomware, a sophisticated Go-based double-extortion threat that uses ChaCha20 encryption, anti-forensic wipes, and disguises itself as WindowsUpdate.exe to propagate over SMB.
CYFIRMA uncovers XillenStealer, a new Python-based, open-source malware on GitHub. Its built-in builder enables even novices to steal data and credentials.
A new report reveals a surge in coordinated hacktivist attacks on India's critical infrastructure. Groups from Pakistan, Russia, and others are launching breaches and DDoS attacks.
Salat Stealer, a new Go-based MaaS, is hijacking browsers and crypto wallets. The malware is sold by Russian-speaking operators on the dark web.
A new report reveals Inf0s3c Stealer, a stealthy Python malware that abuses Discord to exfiltrate passwords, crypto wallets, and other sensitive data from victims.
A new report reveals TinkyWinkey, a stealthy Windows keylogger that uses low-level APIs and DLL injection to steal credentials and sensitive data from victims.
CYFIRMA's new report reveals REVENANT, a malware-free attack framework that can achieve long-term persistence by hiding in AI models and document fonts.
CYFIRMA unveils RenderShock, a zero-click attack strategy exploiting silent OS background processes like file previews and search indexing to execute malware and steal credentials without user interaction.
A malicious campaign on GitHub is distributing Lumma Stealer via fake "Free VPN for PC" and "Minecraft Skin Changer" repositories, using obfuscation and process injection for stealthy delivery.