Do Son A new report from Cisco Talos details PS1Bot, a modular PowerShell-based malware campaign using malvertising to steal data and maintain stealthy persistence.
malware
A new report from Infoblox reveals the shocking scale of VexTrio, a 15-year-old cybercrime syndicate that profits from a massive network of scams and fake apps.
A new large-scale malware campaign is using GitHub repositories disguised as game cheats and software cracks to distribute SmartLoader and steal user data.
Kaspersky exposes Efimer, a new crypto-stealer using fake legal threats and malicious torrents from compromised WordPress sites to hijack wallets and brute-force other sites.
A coordinated campaign by GreedyBear used 150+ malicious Firefox extensions and fake sites to steal over $1M in crypto. They are now using a new technique called Extension Hollowing to evade detection.
S2W TALON exposes ScarCruft (APT37), a North Korean APT using a new campaign disguised as a postal notice, deploying NubSpy and VCD ransomware via PubNub C2.
ESET warns of an actively exploited WinRAR zero-day (CVE-2025-8088). The path traversal flaw allows attackers to execute code by crafting malicious archives.
Fortinet uncovers a new DarkCloud stealer variant using a fileless, multi-stage attack chain with obfuscated PowerShell and process hollowing to evade detection and exfiltrate data.
Socket uncovers a long-running supply chain attack on RubyGems. A threat actor published 60 malicious gems stealing credentials from grey-hat marketers.
Unit 42 uncovers DarkCloud Stealer's new evasion tactics, including heavily obfuscated JavaScript/WSF loaders and a final VB6 payload that injects into RegAsm.exe to bypass detection.
Socket uncovers 11 malicious Go packages, including 8 typosquats, on GitHub. The packages deliver stealthy, in-memory payloads that compromise developer machines and CI pipelines.
Two malicious npm packages disguised as WhatsApp libraries contain a kill switch that remotely wipes a developer's system if their phone number isn't whitelisted.
Beware of fake Binance ads! This multi-stage malware campaign uses Facebook to trick crypto users, stealing credentials and sensitive data. Stay safe with our tips.
CERT-UA uncovers a new UAC-0099 campaign targeting Ukraine's defense sector. The group uses a toolkit of MATCHBOIL, MATCHWOK, and DRAGSTARE malware for reconnaissance and data exfiltration.
The DFIR Report details a destructive attack: Bumblebee malware, delivered via SEO poisoning in Bing search results, led to a full Akira ransomware deployment in under 44 hours.
SentinelLABS and Beazley expose PXA Stealer, a Python-based infostealer campaign targeting 62 countries with stealthy DLL sideloading, decoy files, and Telegram-based data exfiltration.
ThreatLabz reveals the evolution of Raspberry Robin malware, now featuring stronger encryption, complex obfuscation, and a new privilege escalation exploit to bypass detection.
A new report reveals Kimsuky, a North Korea-linked APT, is using sophisticated LNK files and reflective payloads to infiltrate systems and conduct cyberespionage against South Korean targets.
APT37, a North Korea-linked group, is using a new RoKRAT backdoor to target South Korea. The malware uses stealthy LNK files and steganography to evade detection.
eSentire exposes Interlock, a new ransomware group using multi-stage payloads and the ClickFix social engineering technique to deploy ransomware and backdoors via compromised websites.
WithSecure uncovers a stealthy campaign using legitimate RMM tools embedded in PDFs to target European organizations, bypassing security with zero malware at initial entry.
Gen Digital has released a free decryptor for FunkSec ransomware, allowing victims to recover files. The group appears dormant, with no new victims since March 2025.