TDS Archives • Daily CyberSecurity

macOS ClickFix Campaign Hides Its Lure Behind a Fingerprinting Gate

Spirals ransomware double extortion attack chain from IIS web shell to network encryption

macOS ClickFix Campaign Hides Its Lure Behind a Fingerprinting Gate

Do Son August 12, 2026

A macOS ClickFix campaign now uses a browser fingerprinting gate to hide AMOS infostealer lures from researchers. See how it works.

ErrTraffic Malware Spreads ClickFix Lures via Hacked WordPress Sites Spirals ransomware double extortion attack chain from IIS web shell to network encryption

ErrTraffic Malware Spreads ClickFix Lures via Hacked WordPress Sites

Do Son June 22, 2026

ErrTraffic malware powers ClickFix attacks on hacked WordPress sites, using EtherHiding on the blockchain to hide its C2 and spread infostealers.

Malicious Traffic Routing Stack Exploited to Spread Global Malware malicious traffic routing Check Point research report

Malicious Traffic Routing Stack Exploited to Spread Global Malware

Do Son June 9, 2026

Discover how malicious traffic routing hijacks open-source downloads in this new Check Point research report on global malware distribution.

The Invisible Trap: How Hackers Weaponize the Internet’s Root Infrastructure (.arpa) to Bypass Security Kali365 phishing platform EmEditor Supply Chain Attack, WALSHAM INVESTMENTS LIMITED EggStreme, fileless malware North Korea Cybercrime, Remote IT Job Fraud RedDelta APT

Kali365 phishing platform EmEditor Supply Chain Attack, WALSHAM INVESTMENTS LIMITED EggStreme, fileless malware North Korea Cybercrime, Remote IT Job Fraud RedDelta APT

The Invisible Trap: How Hackers Weaponize the Internet’s Root Infrastructure (.arpa) to Bypass Security

Do Son March 3, 2026

Infoblox uncovers a novel phishing tactic abusing the .arpa TLD. Attackers hijack internet "plumbing" to bypass firewalls and deliver brand-impersonation scams.

GrayAlpha’s Expanding Arsenal: FIN7-Aligned Threat Actor Deploys Custom Loaders to Spread NetSupport RAT GrayAlpha, FIN7

GrayAlpha’s Expanding Arsenal: FIN7-Aligned Threat Actor Deploys Custom Loaders to Spread NetSupport RAT

Do Son June 17, 2025

GrayAlpha, linked to FIN7, escalates tactics with fake browser/7-Zip updates and TAG-124 TDS, spreading NetSupport RAT in a multi-pronged infection campaign.

VexTrio Exposed: Infoblox Uncovers Massive Malicious Adtech Ecosystem Powering Global Malware VexTrio, Malicious Adtech

VexTrio Exposed: Infoblox Uncovers Massive Malicious Adtech Ecosystem Powering Global Malware

Do Son June 16, 2025

Infoblox unmasks VexTrio, a sprawling malicious adtech ecosystem intertwined with DNS-based malware campaigns and global website compromises, fueled by commercial operators

HelloTDS Unmasked: Covert Traffic System Funnels Millions to FakeCaptcha Malware! report

HelloTDS Unmasked: Covert Traffic System Funnels Millions to FakeCaptcha Malware!

Do Son June 13, 2025

HelloTDS is a sophisticated traffic direction system delivering millions to FakeCaptcha and other malware via advanced fingerprinting and evasive tactics.

Infoblox Exposes $5.7B Investment Scam Surge Fueled by RDGAs and DNS Abuse Investment Scams RDGA

Infoblox Exposes $5.7B Investment Scam Surge Fueled by RDGAs and DNS Abuse

Do Son April 30, 2025

Infoblox uncovers $5.7B lost to investment scams in 2024, driven by RDGAs, DNS abuse, and fake profit platforms run by sophisticated threat actors.