Threat Research

Researcher observed renewed Coruna-like and DarkSword iOS exploit kit activity originating from Chinese-language webpages, including sites associated with video distribution and adult-content lures. The attack chain uses injected iframes to redirect visitors to domains hosting exploit kits that target vulnerable, outdated iOS versions....

Three exposed directories on `45.142.193[.]132` disclosed attacker utilities, exploit code, activity logs, and post-compromise artifacts. The directory on port 18080 contained a PaperCut exploitation toolkit with AI-agent instructions, vulnerability analysis tools, exploit variants, and research documentation....

Threat actor UNC7017 conducted a software supply chain compromise targeting AOMEI Technology’s update infrastructure between April and July 2026, using brief configuration-tampering windows lasting just 5–10 minutes to evade traditional detection....

Aoki (Aokigahara) is an infostealer whose recent versions target credentials and session files for AI coding assistants, including Claude, OpenAI Codex, Cursor, Codeium, Gemini, and GitHub Copilot....

Researchers identified and mapped the infrastructure behind a phishing-kit-as-a-service (PhaaS) operation marketed as “Iron Man System.” The kit is sold to cybercriminals as a self-hosted package that creates fake websites impersonating postal services, banks, tax agencies, telecom providers, and other organizations to steal victims’ information....

Researcher identified CL-UNK-1211, an AI-powered cyber espionage campaign targeting government entities and state-affiliated infrastructure, with activity observed from October 2025 to April 2026....

: UAT-6275 (also tracked as TAG-193 by Recorded Future) targeted government organizations across CIS countries, with additional interest in water resources and energy sectors. Between June 2025 and August 2026, the group used four infection chains involving macro-enabled documents, PowerShell downloaders, GitHub-hosted scripts, and WinRAR exploitation of CVE-2025-8088....

Threat actors tracked as CL-STA-0954 (UNC5820) compromised a telecommunications managed service provider by exploiting CVE-2024-47575 (FortiJump) on a centralized FortiManager appliance, stealing configurations, credentials, cryptographic material, and network topology data for more than 500 managed FortiGate firewalls....

This campaign uncovered a phishing campaign using fake Calendly booking pages impersonating Meta Careers to lure job seekers into fraudulent interviews and steal their personal information....

This campaign demonstrates how Threat Actors can abuse trusted tools and legitimate Windows components to evade traditional detection. The attack combines LNK execution, Deno-based scripting, DLL side-loading, in-memory execution, and scheduled-task reuse....

Apex Accelerator is a fraudulent Web3 venture capital operation targeting cryptocurrency startups and founders through offers of free AI credits, coding tools, and security audits. The campaign distributes backdoored npm packages and code repositories, delivering CloudSyncD malware for macOS and a custom Windows information stealer that exfiltrates data through Telegram....

The Casbaneiro banking trojan (also known as Metamorfo and Ponteiro) was observed alongside a malicious Chromium extension, with both infrastructures remaining active. Initial access involved a phishing email that tricked victims into installing a remote-access client, enabling attackers to execute PowerShell commands on compromised systems....

: Midnight Mimosa is an Android malware campaign involving a persistent, preinstalled system application that compromises devices before users switch them on for the first time. Operating with system-level privileges, it silently installs disguised apps, performs hidden advertising and click fraud, collects device information, and turns infected phones into residential proxy no...

Researchers identified nine malicious Chrome extensions disguised as harmless utilities, including note-taking apps, stopwatches, and password generators, that impersonate cryptocurrency wallets to steal digital assets....

Researchers identified a new Go-based Windows malware family, named C2Agent, designed to leverage AI for operations on infected systems. The malware uses its command-and-control (C2) server to prompt Large Language Models (LLMs) to perform various tasks. C2Agent functions as a Model Context Protocol (MCP) client and communicates with a legitimate MCP server....