Threat Research

Threat actors are actively exploiting CVE-2026-102785, an unauthenticated remote code execution vulnerability affecting YOOtheme Pro versions 5.0.0–5.0.52 used with WordPress and Joomla. Attackers use automated scanning to deploy JPEG/PHP polyglot webshells in the WordPress uploads directory, enabling remote command execution and file uploads....

The Threat Response Team investigated a suspicious alert involving an unexpectedly executed PDF, uncovering a multistage campaign delivering a previously undocumented Sirius Backdoor variant. The attack began with a phishing email containing a ZIP archive with a PDF that used malicious /OpenAction and /Launch objects to trigger a Base64-encoded PowerShell command....

Researchers analyzed SkyW4lker, also known as SkyW4lker x365 Sentinel, a phishing kit targeting Microsoft 365 accounts through OAuth device-code phishing. The campaign uses password-protected email attachments, CAPTCHA gates, decoy pages, and obfuscated JavaScript to trick victims into authenticating through legitimate Microsoft pages....

Researchers identified Hidden Hawk, an operation abusing domain shadowing to promote illegal Indonesian gambling brands through compromised school and government subdomains across Bangladesh, India, and Mexico....

In April 2025, eMudhra issued eight intermediate CA certificates, including six for TLS and two for code signing, with dangerously weak P-384 private keys. The private keys used extremely small values, some below 256, with one set to just 4, making them recoverable from public certificates in less than a second....

A suspected North Korean (DPRK)-linked campaign is progressing from reconnaissance to targeted scanning of global PHP infrastructure, exploiting CVE-2026-109618 and CVE-2026-109619, critical unauthenticated remote code execution vulnerabilities in PHP core....

Hirudo is an Android banking remote access trojan (RAT) that steals banking credentials and allows attackers to control infected devices remotely. It spreads through shopping and entertainment apps that trick users into installing the malware through fake update prompts....

The threat actor BUGSTER used jailbroken AI tools, including the Hermes Agent framework powered by DeepSeek V4, to plan and execute multiple cybercrime activities, including credential theft, data exfiltration, VoIP fraud, Wi-Fi password cracking, cryptocurrency reconnaissance, and command-and-control operations....

Researcher uncovered a global AI-assisted hacking campaign combining a customized ARTEX penetration-testing framework, AI coding assistants, and automation scripts to target organizations across multiple countries and industry sectors....

In September 2026, threat hunters identified an SEO poisoning campaign distributing Armorsteal malware through fake Chocolatey and Microsoft Activation Scripts (MAS) websites. The fraudulent pages targeted users searching for installation commands and displayed malicious PowerShell commands to download and execute the malware installer....

On October 21, 2026, the PHP Group disclosed and patched two critical unauthenticated remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively tracked as PHP2Shell, affecting PHP deployments since version 5.4....

Researcher identified a software supply chain attack compromising LiteLLM version 1.107.0 on PyPI and Docker, distributing malicious Python startup hooks that execute automatically when Python initializes....

Phishing pages hosted on AI-powered website builders are increasingly common and often have unique DOM hashes, making hash-based detection less effective. Despite these differences, many pages retain identifiable markers from the website builder within their HTML markup....

The threat actor k0t was linked to a large-scale campaign exploiting vulnerabilities and brute-forcing exposed network edge devices, including FortiGate firewalls and Palo Alto GlobalProtect, to gain initial access to organizations worldwide....

Swallowtail (APT28/Fancy Bear/Forest Blizzard), a Russian state-linked cyberespionage group, targeted organizations in two NATO member states, including a law enforcement agency, a naval shipbuilder, and a military aircraft engine manufacturer....