Threat Research

The team uncovered a targeted supply chain attack against multiple cryptocurrency wallet providers, carried out through a GitHub account named sapho11. The campaign combines a Rust-based dependency confusion technique, coordinated GitHub pull requests, and phishing attempts against software maintainers. So far, Keplr, Zcash, Vizor, and Cosmos have been identified as targets....

Researchers identified multiple threat actors abusing GSocket, an open-source remote access tool, to establish stealthy Command-and-Control (C2), reverse shell access, and Remote Code Execution (RCE) on compromised Linux servers following the exploitation of internet-facing web applications....

Falcon (also known as XG or Xiàng Gē) is a browser-based command-and-control (C2) framework that uses malicious JavaScript and fake browser extensions disguised as legitimate PDF readers to compromise users. It steals sensitive information, including passwords, session cookies, emails, and browsing history, while supporting browser-based proxying and data exfiltration....

Gorbag is a Russia-aligned threat actor active since at least February 2025, primarily targeting Ukrainian law enforcement, justice institutions, frontline local administrations, and defense organizations....

Cybercriminals are increasingly using Flutter to develop Android malware because its cross-platform capabilities and complex architecture make reverse engineering difficult. Researchers analyzed a recently discovered Android malware named TinstaPorn, which disguises itself as an online casino platform impersonating a popular Macau casino....

Crafty Falcon is an AI-assisted financial threat actor identified by CERT-In's CSIRT-Fin in advisory CIAD-2026-0058, targeting India's NBFCs, digital lenders, fintech companies, payment aggregators, and cryptocurrency exchanges....

Researchers analyzed a fileless SharePoint intrusion attributed with moderate confidence to Storm-2603, involving exploitation of ToolShell vulnerabilities CVE-2025-53770 and CVE-2025-53771 to achieve remote code execution....

: Anubis ransomware attackers deployed a newly discovered custom backdoor, named Backdoor.Lindnor, against a U.S. organization in October 2026. The malware disguised itself as legitimate Chrome and VMware components and was found on two Microsoft SQL Server systems....

Malware-as-a-Service (MaaS) is becoming easier to access through online gaming communities and other internet platforms. Tools that once required advanced technical skills are now freely available, allowing even inexperienced individuals to launch attacks....

Researchers uncovered Mirax, an Android Remote Access Trojan (RAT) and Malware-as-a-Service (MaaS) platform that enables real-time device takeover through Accessibility Service abuse, screen sharing, keylogging, SMS/OTP interception, and banking application overlay injection....

: DARK PROJECT is a financially motivated ransomware group that employs double-extortion tactics, combining data theft with file encryption to pressure victims into paying ransoms. According to the report, the group recently posted three new victims across the United States and the Philippines, targeting the Energy, Transportation & Logistics, and Automotive industries....

The investigation uncovered an open directory at `23.248.226[.]250`, identified as a Hong Kong-based jump server containing Claude Code configurations, custom model-routing scripts, and 19 agent skills....

Researchers uncovered a fake-download campaign distributing trojanized installers disguised as legitimate games, cracked software, and utilities to compromise Windows systems....

The team investigated multiple incidents in 2026 involving threat actors hijacking enterprise access to Large Language Models (LLMs), a technique known as LLMJacking. These attacks affected organizations across North America, South America, and Asia Pacific, spanning financial services, retail, technology, and transportation sectors....

PHP2Shell exploits two critical PHP memory-safety vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that can enable remote code execution on vulnerable systems. Further investigations uncovered 616 PHP2Shell-related files, including exploit kits, custom tools, scanners, and post-exploitation utilities....