Zscaler ThreatLabz Archives • Daily CyberSecurity

Deceptive “DeepSeek-Claw” Skill Hijacks OpenClaw Agents to Steal Credentials OpenClaw Framework Malware DeepSeek-Claw AI Skill

Deceptive “DeepSeek-Claw” Skill Hijacks OpenClaw Agents to Steal Credentials

Do Son May 7, 2026

Security researchers at Zscaler ThreatLabz have uncovered a deceptive campaign targeting the OpenClaw framework—an open-source tool designed...

The Rise of Payouts King and the Resurrection of BlackBasta Payouts King Ransomware BlackBasta Successor

The Rise of Payouts King and the Resurrection of BlackBasta

Do Son April 22, 2026

Following the high-profile disbandment of the BlackBasta ransomware group in early 2025, security researchers at Zscaler ThreatLabz...

New Stealth Attack Chain Weaponizes Legitimate Remote Access Software ScreenConnect Hijack In-Memory Attack

New Stealth Attack Chain Weaponizes Legitimate Remote Access Software

Do Son April 14, 2026

Security researchers have uncovered a sophisticated new threat that turns the simple act of downloading a document...

Beyond the Hook: Unmasking SnappyClient, the HijackLoader-Linked Stealth Stealer Targeting Crypto SnappyClient HijackLoader

Beyond the Hook: Unmasking SnappyClient, the HijackLoader-Linked Stealth Stealer Targeting Crypto

Do Son March 25, 2026

Security researchers at Zscaler ThreatLabz have unmasked a sophisticated new command-and-control (C2) framework implant they’ve dubbed SnappyClient....

Zscaler Uncovers 8,000+ Domains and APT Backdoors Exploiting Middle East Tensions Middle East Cyber Threats

Zscaler Uncovers 8,000+ Domains and APT Backdoors Exploiting Middle East Tensions

Do Son March 11, 2026

Zscaler ThreatLabz is currently tracking a significant surge in cybercriminal operations that capitalize on the elevated political...

Dust Specter: Iran-Linked Hackers Weaponize Iraqi Government Sites in New Cyber Espionage Campaign Zyxel security - Mitel MiCollab Vulnerability

Zyxel security - Mitel MiCollab Vulnerability

Dust Specter: Iran-Linked Hackers Weaponize Iraqi Government Sites in New Cyber Espionage Campaign

Do Son March 9, 2026

Cybersecurity researchers at Zscaler ThreatLabz have uncovered a persistent espionage campaign targeting government officials in Iraq. Attributed...

Hiding in the Cloud: GuLoader Malware Evolves to Evade Detection GuLoader Malware CloudEye Obfuscation npm, malware Ethereum, npm supply chain OAST techniques StilachiRAT macOS Malware PasivRobber

GuLoader Malware CloudEye Obfuscation npm, malware Ethereum, npm supply chain OAST techniques StilachiRAT macOS Malware PasivRobber

Hiding in the Cloud: GuLoader Malware Evolves to Evade Detection

Do Son February 11, 2026

Zscaler ThreatLabz has released a deep-dive analysis of GuLoader (also known as CloudEye), revealing how this long-standing...

Marco Stealer: The New “Data Raider” Targeting Crypto & Cloud Storage PromptMink Campaign AI Agent Deception LIMINAL PANDA UNC1549 DLL Hijacking, VDI Breakout

PromptMink Campaign AI Agent Deception LIMINAL PANDA UNC1549 DLL Hijacking, VDI Breakout

Marco Stealer: The New “Data Raider” Targeting Crypto & Cloud Storage

Do Son February 10, 2026

A new information-stealing malware has entered the chat, and it is aggressively targeting the digital wallets and...

GemStuffer RubyGems Campaign RubyGems Data Exfiltration TanStack npm Compromise Supply Chain Attack DNS Hijacking APT28 (Fancy Bear) OpenVSX Supply Chain Attack Checkmarx Plugin Breach Stryker Cyberattack CISA Alert Trans-Regional Cyber Conflict Operation Epic Fury Cyber Operation MacroMaze APT28 Cyber Espionage Notepad++ Supply Chain Attack Lotus Blossom Group Defense Industrial Base Threats GTIG Report APT28 Operation Neusploit CVE-2026-21509 Bookworm Malware

Fancy Bear Returns: APT28 Exploits Office Flaw in “Operation Neusploit”

Do Son February 3, 2026

The notorious Russia-linked threat group APT28 (also known as Fancy Bear) has resurfaced with a sophisticated new...

Spies in the Spreadsheet: “Sheet Attack” Uses Google Sheets & AI to Target India Iranian Hacktivists Operation Epic Fury Cyber New Generation Warfare Russian Hybrid Escalation Plex data breach Water Systems Cybersecurity - Threat Actor Naming Standard

Iranian Hacktivists Operation Epic Fury Cyber New Generation Warfare Russian Hybrid Escalation Plex data breach Water Systems Cybersecurity - Threat Actor Naming Standard

Spies in the Spreadsheet: “Sheet Attack” Uses Google Sheets & AI to Target India

Do Son January 29, 2026

A sophisticated cyberespionage operation targeting the Indian government has been exposed, revealing a disturbing evolution in how...

“Gopher Strike”: New Pakistan-Linked Cyber Campaigns Target Indian Government Zyxel security - Mitel MiCollab Vulnerability

“Gopher Strike”: New Pakistan-Linked Cyber Campaigns Target Indian Government

Do Son January 28, 2026

A sophisticated new wave of cyberespionage campaigns targeting the Indian government has been exposed, utilizing custom-built tools...

NodeCordRAT: The Trojan Hiding in NPM to Steal Crypto via Discord NodeCordRAT NPM Supply Chain Attack

NodeCordRAT: The Trojan Hiding in NPM to Steal Crypto via Discord

Do Son January 9, 2026

The open-source ecosystem has once again been weaponized, this time targeting developers working with cryptocurrency libraries. In...

“Caminho” to Compromise: BlindEagle Hackers Hijack Government Emails in Colombia Iranian Cyber Reconnaissance IP Camera Security NCSC Warning Russian Hacktivists Taiwan Cyberattacks China State-Sponsored Hacking state-sponsored threat actor Ransomware RAT Abuse, AnyDesk

Iranian Cyber Reconnaissance IP Camera Security NCSC Warning Russian Hacktivists Taiwan Cyberattacks China State-Sponsored Hacking state-sponsored threat actor Ransomware RAT Abuse, AnyDesk

“Caminho” to Compromise: BlindEagle Hackers Hijack Government Emails in Colombia

Do Son December 22, 2025

A notorious cyber-espionage group known for terrorizing South American institutions has launched a new campaign against the...

PyPI Under Attack: New Malware ‘SilentSync’ Is Stealing Credentials SonicWall Reconnaissance Akira Ransomware residential proxy malware TraderTraitor BreachForums Honeypot, French Interior Ministry Leak

SonicWall Reconnaissance Akira Ransomware residential proxy malware TraderTraitor BreachForums Honeypot, French Interior Ministry Leak

PyPI Under Attack: New Malware ‘SilentSync’ Is Stealing Credentials

Do Son September 22, 2025

Zscaler ThreatLabz has uncovered yet another supply chain attack against the Python Package Index (PyPI). In August...

kkRAT: A New Malware Blends Crypto Hijacking with Legitimate RMM Tools

Do Son September 12, 2025

Zscaler ThreatLabz has identified a sophisticated malware campaign active since early May 2025, targeting Chinese-speaking users with...

The AI Phishing Trap: Zscaler Exposes Fake Brazilian Government Websites Generated by AI to Steal Payments

Do Son August 6, 2025

Zscaler’s ThreatLabz has uncovered a phishing campaign that leverages generative AI to construct high-fidelity replicas of Brazilian...

TransferLoader Malware Unmasked: IPFS-Enabled Loader Deploys Ransomware and Backdoors with Obfuscation Precision

Do Son May 16, 2025

Zscaler ThreatLabz has uncovered a new and dangerous malware loader dubbed TransferLoader, actively used in the wild...

Critical Alert 1 Active Exploit Detected Today