Threat Research

Researcher uncovered a global AI-assisted hacking campaign combining a customized ARTEX penetration-testing framework, AI coding assistants, and automation scripts to target organizations across multiple countries and industry sectors....

In September 2026, threat hunters identified an SEO poisoning campaign distributing Armorsteal malware through fake Chocolatey and Microsoft Activation Scripts (MAS) websites. The fraudulent pages targeted users searching for installation commands and displayed malicious PowerShell commands to download and execute the malware installer....

On October 21, 2026, the PHP Group disclosed and patched two critical unauthenticated remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively tracked as PHP2Shell, affecting PHP deployments since version 5.4....

Researcher identified a software supply chain attack compromising LiteLLM version 1.107.0 on PyPI and Docker, distributing malicious Python startup hooks that execute automatically when Python initializes....

Phishing pages hosted on AI-powered website builders are increasingly common and often have unique DOM hashes, making hash-based detection less effective. Despite these differences, many pages retain identifiable markers from the website builder within their HTML markup....

The threat actor k0t was linked to a large-scale campaign exploiting vulnerabilities and brute-forcing exposed network edge devices, including FortiGate firewalls and Palo Alto GlobalProtect, to gain initial access to organizations worldwide....

Swallowtail (APT28/Fancy Bear/Forest Blizzard), a Russian state-linked cyberespionage group, targeted organizations in two NATO member states, including a law enforcement agency, a naval shipbuilder, and a military aircraft engine manufacturer....

Threat actors used legitimate Sandboxie executables alongside a malicious `sbiedll.dll` to execute attacker-controlled code through DLL sideloading. This recurring technique serves as a potential group identifier, although other executable and DLL combinations are also used. The sideloaded DLLs decrypt and execute payloads stored in `config.ini` files, reducing static detection...

The SafePay ransomware group has been active since August 2024, targeting businesses and critical infrastructure across North America, South America, Europe, and Australia. The threat actors gain initial access through credential theft, password guessing, vulnerability exploitation, and phishing....

CVE-2026-88771 is a critical, unauthenticated remote code execution (RCE) vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway, rated CVSS 9.8 (v3.1) and 9.5 (v4.0)....

: Researcher cross-tenant token-sweeping campaign abusing the ConnectWise Cloud Backup (formerly SkyKick) application to obtain Microsoft Graph access tokens across Microsoft 365 tenants that had previously granted consent....

Researcher observed renewed Coruna-like and DarkSword iOS exploit kit activity originating from Chinese-language webpages, including sites associated with video distribution and adult-content lures. The attack chain uses injected iframes to redirect visitors to domains hosting exploit kits that target vulnerable, outdated iOS versions....

Three exposed directories on `45.142.193[.]132` disclosed attacker utilities, exploit code, activity logs, and post-compromise artifacts. The directory on port 18080 contained a PaperCut exploitation toolkit with AI-agent instructions, vulnerability analysis tools, exploit variants, and research documentation....

Threat actor UNC7017 conducted a software supply chain compromise targeting AOMEI Technology’s update infrastructure between April and July 2026, using brief configuration-tampering windows lasting just 5–10 minutes to evade traditional detection....

Aoki (Aokigahara) is an infostealer whose recent versions target credentials and session files for AI coding assistants, including Claude, OpenAI Codex, Cursor, Codeium, Gemini, and GitHub Copilot....