A China-aligned espionage group abused the update traffic of Sogou Input Method, one of China's most widely used keyboard apps,…
Phexia, a modular macOS backdoor and infostealer sold to multiple threat actors. Operators deliver it through ClickFix lures. Since May…
A new XLoader infection chain. It hides the credential stealer inside an embedded LuaJIT interpreter. It moves it into another…
An evolving fake-download campaign that disguises trojanized installers as popular games, cracked software, and utilities to monetize Windows computers. Rather…
A campaign tracked as Yoba abuses interest in generative AI to push cryptocurrency-mining malware through fake GitHub projects. Check Point…
DarkBlinders has compromised a high-profile Israeli individual associated with the security sector and a government cloud environment in Iraqi Kurdistan,…
A campaign by the BITTER threat group that delivers a custom remote access trojan (RAT) called PapRAT to South Asian…
Google and industry partners have dismantled the XCPE botnet. This firmware-level backdoor enrolled more than 1.3 million Android set-top boxes.…
UAT-11473, an advanced persistent threat actor deploying KeyDrift, a custom malware framework targeting Cisco Catalyst SD-WAN controllers. The framework embeds…
INJ3CTOR3 has expanded its FreePBX toll-fraud campaign with automated credential theft, letting attackers keep billing unauthorized calls to victims even…