Threat Research

Researcher identified a software supply chain attack compromising LiteLLM version 1.107.0 on PyPI and Docker, distributing malicious Python startup hooks that execute automatically when Python initializes....

Phishing pages hosted on AI-powered website builders are increasingly common and often have unique DOM hashes, making hash-based detection less effective. Despite these differences, many pages retain identifiable markers from the website builder within their HTML markup....

The threat actor k0t was linked to a large-scale campaign exploiting vulnerabilities and brute-forcing exposed network edge devices, including FortiGate firewalls and Palo Alto GlobalProtect, to gain initial access to organizations worldwide....

Swallowtail (APT28/Fancy Bear/Forest Blizzard), a Russian state-linked cyberespionage group, targeted organizations in two NATO member states, including a law enforcement agency, a naval shipbuilder, and a military aircraft engine manufacturer....

Threat actors used legitimate Sandboxie executables alongside a malicious `sbiedll.dll` to execute attacker-controlled code through DLL sideloading. This recurring technique serves as a potential group identifier, although other executable and DLL combinations are also used. The sideloaded DLLs decrypt and execute payloads stored in `config.ini` files, reducing static detection...

The SafePay ransomware group has been active since August 2024, targeting businesses and critical infrastructure across North America, South America, Europe, and Australia. The threat actors gain initial access through credential theft, password guessing, vulnerability exploitation, and phishing....

CVE-2026-88771 is a critical, unauthenticated remote code execution (RCE) vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway, rated CVSS 9.8 (v3.1) and 9.5 (v4.0)....

: Researcher cross-tenant token-sweeping campaign abusing the ConnectWise Cloud Backup (formerly SkyKick) application to obtain Microsoft Graph access tokens across Microsoft 365 tenants that had previously granted consent....

Researcher observed renewed Coruna-like and DarkSword iOS exploit kit activity originating from Chinese-language webpages, including sites associated with video distribution and adult-content lures. The attack chain uses injected iframes to redirect visitors to domains hosting exploit kits that target vulnerable, outdated iOS versions....

Three exposed directories on `45.142.193[.]132` disclosed attacker utilities, exploit code, activity logs, and post-compromise artifacts. The directory on port 18080 contained a PaperCut exploitation toolkit with AI-agent instructions, vulnerability analysis tools, exploit variants, and research documentation....

Threat actor UNC7017 conducted a software supply chain compromise targeting AOMEI Technology’s update infrastructure between April and July 2026, using brief configuration-tampering windows lasting just 5–10 minutes to evade traditional detection....

Aoki (Aokigahara) is an infostealer whose recent versions target credentials and session files for AI coding assistants, including Claude, OpenAI Codex, Cursor, Codeium, Gemini, and GitHub Copilot....

Researchers identified and mapped the infrastructure behind a phishing-kit-as-a-service (PhaaS) operation marketed as “Iron Man System.” The kit is sold to cybercriminals as a self-hosted package that creates fake websites impersonating postal services, banks, tax agencies, telecom providers, and other organizations to steal victims’ information....

Researcher identified CL-UNK-1211, an AI-powered cyber espionage campaign targeting government entities and state-affiliated infrastructure, with activity observed from October 2025 to April 2026....

: UAT-6275 (also tracked as TAG-193 by Recorded Future) targeted government organizations across CIS countries, with additional interest in water resources and energy sectors. Between June 2025 and August 2026, the group used four infection chains involving macro-enabled documents, PowerShell downloaders, GitHub-hosted scripts, and WinRAR exploitation of CVE-2025-8088....