Securonix Archives • Daily CyberSecurity

New TASK#STOMP PowerShell Backdoor Targets Windows

Diagram showing how prompt injection attacks and prompt injection techniques threaten AI security.

New TASK#STOMP PowerShell Backdoor Targets Windows

Do Son September 24, 2026

Learn how the new TASK#STOMP PowerShell backdoor steals data. The TASK#STOMP PowerShell backdoor abuses native Windows tools for persistence.

SMOKE#SCREEN Campaign Abuses ScreenConnect RMM for Stealthy Remote Access SMOKE#SCREEN campaign infection chain abusing ScreenConnect RMM through fake Zoom update phishing lures

SMOKE#SCREEN campaign infection chain abusing ScreenConnect RMM through fake Zoom update phishing lures

SMOKE#SCREEN Campaign Abuses ScreenConnect RMM for Stealthy Remote Access

Do Son August 7, 2026

The SMOKE#SCREEN campaign abuses ScreenConnect RMM and Cloudflare tunnels via fake Zoom and Adobe update lures, Securonix reports.

Veil#Drop Malware Uses Blogspot to Deliver PureLog Stealer China influence operations using banned ChatGPT accounts in OpenAI's June 2026 threat report targeting the US AI policy debate

China influence operations using banned ChatGPT accounts in OpenAI's June 2026 threat report targeting the US AI policy debate

Veil#Drop Malware Uses Blogspot to Deliver PureLog Stealer

Do Son July 8, 2026

Veil#Drop malware abuses Blogspot to run PowerShell loaders and deploy PureLog Stealer in memory, dodging antivirus and file-based detection.

Attackers Hijack Trusted RMM Tools to Create Invisible, Permanent Backdoors RMM Hijacking Campaign Self-Healing Persistence

Attackers Hijack Trusted RMM Tools to Create Invisible, Permanent Backdoors

Do Son May 7, 2026

Securonix exposes an 80+ organization breach using "self-healing" RMM tools and Safe Mode persistence. Standard antivirus is blind—learn how to hunt it!

The Self-Parsing Ghost: Inside Deep#Door’s Stealthy Python Backdoor Deep#Door Backdoor Python RAT Framework

The Self-Parsing Ghost: Inside Deep#Door’s Stealthy Python Backdoor

Do Son May 4, 2026

Meta Description (152 Characters)Securonix uncovers Deep#Door: a self-contained Python RAT that uses TCP tunneling and obfuscated scripts to bypass traditional defense. Secure your systems now.

The 25-Second Heist: Inside FAUX#ELEVATE’s “Inflated” Phishing Attack on French Corporations FAUX#ELEVATE Living-off-the-Land Attack

The 25-Second Heist: Inside FAUX#ELEVATE’s “Inflated” Phishing Attack on French Corporations

Do Son March 31, 2026

Securonix uncovers FAUX#ELEVATE, a 25-second attack using 10MB "inflated" VBScripts to steal credentials and mine crypto in French corporate environments.

SHADOW#REACTOR Malware Builds Remcos RAT via Text Files TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

SHADOW#REACTOR Malware Builds Remcos RAT via Text Files

Do Son January 15, 2026

Securonix reveals SHADOW#REACTOR: A stealthy framework using "text-only" fragments to deploy Remcos RAT in memory via MSBuild. Avoids disk detection.

The ClickFix Trap: PHALT#BLYX Targets Hotels with Fake Blue Screens and DCRat PHALT#BLYX hospitality campaign, ClickFix BSOD malware

The ClickFix Trap: PHALT#BLYX Targets Hotels with Fake Blue Screens and DCRat

Do Son January 7, 2026

PHALT#BLYX is a malware campaign using fake Booking.com alerts and BSOD screens to trick hotel staff into installing Russian-linked RATs.

SERPENTINE#CLOUD: Stealthy Malware Campaign Leverages Cloudflare Tunnels for In-Memory RAT Delivery TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

SERPENTINE#CLOUD: Stealthy Malware Campaign Leverages Cloudflare Tunnels for In-Memory RAT Delivery

Do Son June 20, 2025

The SERPENTINE#CLOUD campaign exploits Cloudflare Tunnel subdomains and LNK files to deliver in-memory RATs like AsyncRAT and Remcos, evading detection.

USB Under Siege: The STEADY#URSA Attack Campaign of SUBTLE-PAWS on Ukrainian Military STEADY#URSA campaign

USB Under Siege: The STEADY#URSA Attack Campaign of SUBTLE-PAWS on Ukrainian Military

Do Son February 6, 2024

A new, sophisticated attack campaign, dubbed STEADY#URSA, has emerged, casting a long shadow over the cybersecurity defenses of Ukraine's military