Group-IB Archives • Daily CyberSecurity

XMRig Botnet Abuses Linux PAM to Spread Forensic Smokescreen Across User Accounts XMRig Linux PAM abuse fileless cryptominer V25 botnet forensic smokescreen

XMRig Linux PAM abuse fileless cryptominer V25 botnet forensic smokescreen

XMRig Botnet Abuses Linux PAM to Spread Forensic Smokescreen Across User Accounts

Do Son August 5, 2026

At a glance Field Detail Malware family Modified XMRig 6.25.0 botnet implant (marked “PRIVATE VERSION FOR BOTNET”),...

JadeProx Used TriBack Loader Against a Vietnamese Hospital, Malaysia’s Foreign Ministry, and Hong Kong Schools ACR Stealer infection chain starting with a ClickFix lure to steal browser credentials

ACR Stealer infection chain starting with a ClickFix lure to steal browser credentials

JadeProx Used TriBack Loader Against a Vietnamese Hospital, Malaysia’s Foreign Ministry, and Hong Kong Schools

Do Son July 28, 2026

At a Glance Actor or group JadeProx, a China-nexus cluster named by Group-IB; no known group named...

ClickLock Stealer Locks macOS Screens Until Victims Hand Over Their Password ClickLock Stealer macOS malware fake Cloudflare ClickFix Terminal prompt stealing passwords

ClickLock Stealer macOS malware fake Cloudflare ClickFix Terminal prompt stealing passwords

ClickLock Stealer Locks macOS Screens Until Victims Hand Over Their Password

Do Son July 21, 2026

At a glance Malware family ClickLock Stealer (new, named by Group-IB) Threat actor Unattributed. No actor or...

SilabRAT Malware: The $5,000-a-Month Crypto-Hunting RAT Hiding Behind HijackLoader SilabRAT malware SnappyClient, HijackLoader, Malware-as-a-Service

SilabRAT malware SnappyClient, HijackLoader, Malware-as-a-Service

SilabRAT Malware: The $5,000-a-Month Crypto-Hunting RAT Hiding Behind HijackLoader

Do Son June 17, 2026

A new commercial remote access trojan called SilabRAT is making waves on the cybercrime underground. Also known...

Massive Smishing Error524 Campaign Evades Traditional Security Filters Worldwide Smishing Error524 campaign Group-IB phishing report

Massive Smishing Error524 Campaign Evades Traditional Security Filters Worldwide

Do Son June 8, 2026

Overview of the Global Fraud Threat Cybercriminals are constantly finding new ways to bypass modern security defenses....

Unmasking the Phoenix System’s Rogue BTS Smishing Empire Phoenix System PhaaS Rogue BTS Smishing

Unmasking the Phoenix System’s Rogue BTS Smishing Empire

Do Son May 1, 2026

While analyzing global smishing operations spanning APAC, LATAM, Europe, and MEA, Group-IB researchers have uncovered a centralized...

The GTFire Scheme: How Cybercriminals are Weaponizing Google’s Trusted Services for Global Phishing GTFire Phishing Campaign Google Firebase Abuse

GTFire Phishing Campaign Google Firebase Abuse

The GTFire Scheme: How Cybercriminals are Weaponizing Google’s Trusted Services for Global Phishing

Do Son March 2, 2026

Modern cybercriminals are evolving, increasingly hiding their malicious activities within the very legitimate cloud services that businesses...

Operation Olalampo: MuddyWater Unleashes AI-Assisted Rust Malware and Telegram C2 in MENA Espionage Surge Harvester APT Linux Backdoor OT Cyberattack Iranian APT Operation Olalampo MuddyWater APT Prince of Persia APT, Tonnerre v50 Patchwork APT, DLL Sideloading Subtle Snail, cyber espionage ShadowSilk, cyber espionage Volt Typhoon APT Group - Chinese Cybersecurity Firm

Harvester APT Linux Backdoor OT Cyberattack Iranian APT Operation Olalampo MuddyWater APT Prince of Persia APT, Tonnerre v50 Patchwork APT, DLL Sideloading Subtle Snail, cyber espionage ShadowSilk, cyber espionage Volt Typhoon APT Group - Chinese Cybersecurity Firm

Operation Olalampo: MuddyWater Unleashes AI-Assisted Rust Malware and Telegram C2 in MENA Espionage Surge

Do Son February 24, 2026

A new wave of targeted cyber-espionage is sweeping across the Middle East and North Africa (MENA) region....

Industrialized Theft: GoldFactory Malware Hijacks Tax Season via Fake ‘Coretax’ Apps Mercenary Akula European Financial Targeting AI-Generated Malware React2Shell Exploit UAT-8837 Critical Infrastructure Attack APT36, BOSS Linux BRICKSTORM Malware, China Espionage Curly COMrades, MucorAgent Chinese APT - HTTP Client Tools Shuckworm Cyber Espionage

Mercenary Akula European Financial Targeting AI-Generated Malware React2Shell Exploit UAT-8837 Critical Infrastructure Attack APT36, BOSS Linux BRICKSTORM Malware, China Espionage Curly COMrades, MucorAgent Chinese APT - HTTP Client Tools Shuckworm Cyber Espionage

Industrialized Theft: GoldFactory Malware Hijacks Tax Season via Fake ‘Coretax’ Apps

Do Son February 23, 2026

As tax season approaches, cybersecurity defenders are tracking a massive escalation in mobile banking fraud. According to...

The Invisible Landlord: ShadowSyndicate Rotates Keys to Hide Infrastructure

Do Son February 6, 2026

The sprawling, murky network known as ShadowSyndicate has evolved. Previously identified by a singular, careless digital fingerprint,...

Crossing the Andes: Sophisticated Loan Phishing Scams Hit Peru Peru Loan Phishing Luhn Algorithm Scam

Crossing the Andes: Sophisticated Loan Phishing Scams Hit Peru

Do Son January 23, 2026

A sophisticated wave of digital fraud is sweeping through Peru, targeting vulnerable individuals with the promise of...

DeadLock Ransomware: New Strain Hides C2 in Polygon Smart Contracts DeadLock Ransomware Polygon Smart Contracts

DeadLock Ransomware: New Strain Hides C2 in Polygon Smart Contracts

Do Son January 16, 2026

A new ransomware family is turning the decentralized dream of blockchain into a cybersecurity nightmare. Analysts at...

“Ghost Tap” Rising: New Wave of Android Malware Turns Phones into Digital Pickpockets Ghost Tap Malware NFC Relay Attack

“Ghost Tap” Rising: New Wave of Android Malware Turns Phones into Digital Pickpockets

Do Son January 8, 2026

Your smartphone might be the only accomplice a thief needs to drain your bank account, even if...

Wonderland Unleashed: New Android “Dropper” Malware Hijacks Telegram to Drain Bank Accounts Android zero day flaw June 2026 security bulletin RuTaxi Trojan Android Banking Malware Pixel 9 zero-click exploit, Dolby UDC vulnerability CVE-2025-54957 NexusRoute Android RAT, India E-Challan Phishing ClayRat Self-Defense, Android Accessibility Abuse Android Trojan, AntiDot Android Malware "BadPack"

Android zero day flaw June 2026 security bulletin RuTaxi Trojan Android Banking Malware Pixel 9 zero-click exploit, Dolby UDC vulnerability CVE-2025-54957 NexusRoute Android RAT, India E-Challan Phishing ClayRat Self-Defense, Android Accessibility Abuse Android Trojan, AntiDot Android Malware "BadPack"

Wonderland Unleashed: New Android “Dropper” Malware Hijacks Telegram to Drain Bank Accounts

Do Son December 23, 2025

A sophisticated wave of mobile malware is sweeping through Central Asia, marking a dangerous evolution in how...

MuddyWater APT Shifts Tactics to Custom Malware MuddyWater APT ANY.RUN security incident

MuddyWater APT Shifts Tactics to Custom Malware

Do Son September 19, 2025

Group-IB analysts have released new intelligence on MuddyWater, the Iranian state-sponsored APT linked to Tehran’s Ministry of...

ShadowSilk Unmasked: The Hybrid Espionage Group Targeting Central Asian Governments Harvester APT Linux Backdoor OT Cyberattack Iranian APT Operation Olalampo MuddyWater APT Prince of Persia APT, Tonnerre v50 Patchwork APT, DLL Sideloading Subtle Snail, cyber espionage ShadowSilk, cyber espionage Volt Typhoon APT Group - Chinese Cybersecurity Firm

ShadowSilk Unmasked: The Hybrid Espionage Group Targeting Central Asian Governments

Do Son August 29, 2025

Group-IB analysts, in cooperation with CERT-KG, have published new research exposing the activities of a threat cluster...

Unseen Threat: Group-IB Exposes How Hackers Use Linux Bind Mounts to Hide ATM Attack

Do Son July 31, 2025

Group-IB has detailed a sophisticated intrusion by threat actor UNC2891 that blended physical access, anti-forensics, and Linux...

Fake Receipts, Real Damage: Group-IB Uncovers Fraud-as-a-Service Empire Behind MaisonReceipts Fraud-as-a-Service, Fake Receipts

Fake Receipts, Real Damage: Group-IB Uncovers Fraud-as-a-Service Empire Behind MaisonReceipts

Do Son July 21, 2025

In an age where deception is just a few clicks away, Group-IB’s latest report reveals a rise...

Qwizzserial: Telegram-Driven Android SMS Stealer Infects 100,000 Devices Android Malware, Qwizzserial

Qwizzserial: Telegram-Driven Android SMS Stealer Infects 100,000 Devices

Do Son July 3, 2025

A newly uncovered Android malware family named Qwizzserial is wreaking havoc across Uzbekistan, stealing sensitive financial data...

Middle East Cyberwar Escalates: GPS Spoofing, Fake Alerts, Crypto Hacks, & IP Camera Spying Revealed DynoWiper Malware Middle East Cyberwar, Cyber Operations

DynoWiper Malware Middle East Cyberwar, Cyber Operations

Middle East Cyberwar Escalates: GPS Spoofing, Fake Alerts, Crypto Hacks, & IP Camera Spying Revealed

Do Son June 25, 2025

As conflict surged across the Middle East in June 2025, so too did the intensity and scope...