Global Threats

SeverityHigh Detail Cybersecurity researchers have identified multiple trojanized npm packages that appear to provide legitimate calendar and streak utilities but are designed to secretly deliver an AI-powered Linux implant known as RedC2 4.0. When one of the affected modules is loaded, it locates a bundled binary, makes it executable, and launches it as a detached […]

SeverityMedium Detail A previously unknown malware family called SynkLoader is being distributed through Microsoft Teams phishing campaigns to steal Windows credentials using a fake lock screen. The attackers impersonate the target organization’s IT help desk, a tactic that has been increasingly observed in multi-stage attacks. Victims are directed to install a fake “PowerShell Cleaner” MSI […]

SeverityMedium Detail Threat actors are abusing FTP server banners to conceal commands used to deliver two previously undocumented remote access trojans (RATs), named E4del and PINHOLE. MalwareHunterTeam observed the technique in July 2026 during an attack involving Windows shortcut files (.LNK) and FTP server banners used as dead-drop resolvers (DDR) to retrieve commands. SOCRadar subsequently […]

SeverityHigh Detail A new Android malware family named Manic has been observed targeting banking, cryptocurrency, government identity, messaging, and military-focused applications. The malware combines banking trojan and spyware capabilities with extensive device-control and surveillance features. Manic has been active since at least February 2026 and is distributed through phishing websites and malicious dropper applications disguised […]

Severity High Detail Security researchers Tom Stacey from PortSwigger and Tobia Righi from TurtleSec have identified a new class of HTTP request smuggling attacks called CRLF-Powered Desync Attacks. The technique abuses HTTP header injection weaknesses that can escalate into serious attacks, including account takeover, HTTPOnly cookie theft, response queue poisoning, and potentially self-propagating desync worms. […]

SeverityHigh Detail Security researchers have identified a campaign using a fake Google Gemini installer to deliver the Vidar information-stealing malware to Windows users. The campaign abuses trusted Google services and AI-related search interest to make the malicious software appear legitimate. The activity was observed on a company network in the EMEA region. The attackers used […]

SeverityHigh Detail Security researchers from Varonis Threat Labs have disclosed three vulnerabilities in Microsoft Copilot Personal that could allow attackers to steal sensitive information from connected applications through a single malicious link. The vulnerabilities, collectively named CoSnitch, include a flaw tracked as CVE-2026-24301. Microsoft released fixes for the reported issues on August 18, 2026. The […]

SeverityHigh Detail Microsoft Defender Experts have identified more than 30 rotating domains associated with MacSync Stealer, a macOS-focused information-stealing malware. Microsoft linked the infrastructure by correlating repeated endpoint and network behaviors across changing domains rather than relying solely on static indicators. MacSync Stealer is designed to collect sensitive information from compromised macOS devices, including credentials, […]

SeverityHigh Detail Cybersecurity researchers have identified a previously undocumented Python-based malware framework called TWINLOOT that abuses legitimate Microsoft services, including SharePoint Online and Microsoft Teams, for command-and-control (C2) communication and lateral movement. TWINLOOT uses SharePoint Online through the Microsoft Graph API to receive commands and exfiltrate data, while Microsoft Teams TURN servers can be abused […]

SeverityHigh Detail The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability affecting Ray, an open-source Python framework used for distributed AI and machine learning workloads, to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation. The vulnerability, tracked as CVE-2025-62593 with a CVSS score of 9.4, can allow remote code […]

SeverityHigh Detail A critical vulnerability in Microsoft Active Directory Certificate Services (AD CS), tracked as CVE-2026-54121 and dubbed Certighost, can allow a low-privileged Active Directory user to obtain a certificate that authenticates as a Domain Controller. Successful exploitation can ultimately lead to full Active Directory domain compromise. Microsoft patched the vulnerability as part of its […]

Severity Medium Detail Microsoft has disclosed a new elevation-of-privilege (EoP) vulnerability in the Microsoft Malware Protection Engine, tracked as CVE-2026-69414 and referred to as ShieldBreak. The vulnerability reportedly acts as a patch bypass for a previous Microsoft Defender flaw known as RoguePlanet, which was patched by Microsoft on July 8. RoguePlanet was previously associated with […]

SeverityMedium Detail A new Mirai-based Linux botnet called Evooo1Bot has been targeting internet-facing gateway devices and turning compromised systems into SOCKS5 traffic relay nodes. The malware also includes credential theft, SSH brute-force scanning, DDoS capabilities, and an integrated vulnerability exploitation module. Fortinet researchers identified Evooo1Bot targeting devices from Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, and […]

SeverityMedium Detail The threat actor HoneyMyte, also known as Mustang Panda, has been observed deploying an updated version of the CoolClient backdoor with a signed Windows kernel-mode rootkit. The rootkit can hide and protect malicious processes, files, registry objects, and command-and-control (C2) network information. Kaspersky identified victims in Myanmar, Mongolia, Pakistan, and Russia, including confirmed […]

SeverityMedium Detail Shell is investigating a potential security incident after the Clop ransomware group claimed it stole 89GB of data from the company. Clop’s dark web data leak site listed Shell among 43 new victims allegedly targeted in data theft attacks involving internet-exposed PTC Windchill and FlexPLM systems. The group claimed that the stolen Shell […]

SeverityMedium Detail Hardware wallet manufacturer Trezor disclosed a data breach involving ShipMonk, a third-party shipping provider. The incident exposed personal information belonging to 13,689 Trezor customers. ShipMonk notified Trezor on August 10, 2026, that an unauthorized party had accessed systems containing customer order information. Trezor publicly disclosed the incident on August 13 while continuing its […]

Severity Medium Detail A malicious campaign is abusing the popularity of CCleaner by distributing a counterfeit installer designed to compromise Windows systems and deploy a spyware component known as GhostDesk. The attackers operate a fake download website, ccleanerwind[.]top, which closely imitates the legitimate CCleaner portal and provides both standard and Pro download options. However, both […]

SeverityMedium Detail An active ErrTraffic malware-as-a-service (MaaS) campaign is combining compromised WordPress websites, ClickFix social-engineering techniques, Polygon blockchain smart contracts, and frequently changing malware domains to distribute multiple types of Windows malwares. ErrTraffic is marketed as a MaaS framework by a forum user known as “LenAI.” Its main function is a traffic distribution system that […]

SeverityMedium Detail Security researchers from Tenet have disclosed a new attack technique called GhostJacking, which abuses trusted observability, monitoring, and security platforms to influence AI coding and operations agents into performing unauthorized actions. The research, presented at DEF CON 34, demonstrates how attacker-controlled content contained in logs, alerts, diagnostic events or issue reports can act […]

Severity Medium Detail Play ransomware has been observed using a custom Windows service binary named PSexesvc.exe, designed to mimic Microsoft Sysinternals PsExec. This technique falls under MITRE ATT&CK T1036 – Masquerading, where attackers make malicious artifacts appear legitimate to reduce suspicion. The binary was found alongside attack tools and ransom notes in C:\Users\Public\Music\, a user-writable […]

Severity Medium Detail A newly demonstrated attack technique shows that malware running within a compromised Windows user session can abuse Windows Hello for Business (WHFB) cryptographic keys to authenticate to Microsoft Entra ID without requiring the victim’s password, PIN, or biometric authentication. The technique could allow attackers to obtain cloud access, establish persistence, and potentially […]

Severity Medium Detail Patchwork also known as Dropping Elephant is an advanced espionage threat group that targets both Windows and Android devices through deceptive PDF shortcut files and trojanized chat applications. The campaign is designed to steal sensitive information, maintain persistent access, and conduct long-term surveillance against government, defense, energy, research, aviation, financial, and technology […]

Severity High Detail A widespread phishing campaign is targeting Microsoft 365 users by leveraging Adversary-in-the-Middle (AitM) techniques to hijack authenticated sessions and bypass multi-factor authentication (MFA). The attackers focus on organizations across the healthcare, education, manufacturing, government, and professional services sectors, with the objective of identifying personnel involved in payroll, finance, and human resources functions […]

Severity Medium Detail Barracuda’s Red Team has demonstrated how a compromised Microsoft 365 account with Microsoft Copilot access could be abused to facilitate business email compromise (BEC) attacks. In a controlled proof-of-concept, the researchers showed that attackers could use Copilot to gather organizational information, impersonate a company CEO, and redirect a USD 247,500 wire transfer. […]

Severity Medium Detail Vanta Stealer is a Python-based information stealer designed to compromise Windows systems by stealing credentials, browser data, cryptocurrency wallets, gaming accounts, communication-platform sessions, and sensitive files. The malware uses multiple layers of obfuscation to evade detection and complicate analysis. How? Vanta Stealer is typically distributed through phishing emails, fake software updates, cracked […]

Severity Medium Detail Microsoft has identified a large-scale macOS ClickFix campaign using over 250 malicious domains to distribute Atomic Stealer (AMOS) and MacSync. The attackers use server-side fingerprinting to determine whether a visitor is a legitimate macOS user before displaying a fake software download page, helping them evade detection by security researchers and automated analysis […]

Severity Medium Detail Security researchers have identified a series of attack techniques, collectively named Pass-ta-key, that could allow malware on a compromised Windows device to abuse Google-synced passkeys and gain unauthorized access to online accounts. Unlike traditional credential theft, the attacks do not rely on stealing passwords or capturing biometric data, but instead exploit weaknesses […]

Severity Medium Detail Researchers have uncovered DOUBLECUP, a Russian Loader-as-a-Service (LaaS) that uses ClickFix lures to deliver malware. It hides malicious code inside PNG images stored in the browser cache before deploying CountLoader or the newly discovered DeviceManager RAT. The framework uses steganography, environmental keying, and blockchain-based command-and-control (C2) techniques to evade detection and maintain […]

Severity Medium Detail Cybersecurity researchers have identified a previously undocumented attack framework involving a Go-based loader called HollowFrame and a Rust-based backdoor named Matryoshka. The malware was observed in a targeted intrusion against a law firm, where it was used to establish persistent remote access, perform reconnaissance, and deliver additional payloads. The campaign demonstrates a […]

Severity High Detail Cybersecurity researchers have identified a new Linux-focused campaign in which the China-linked threat actor BlackTech deploys a customized version of the open-source BlueShell remote access trojan (RAT). The malware is designed for post-compromise operations and disguises itself as a legitimate Linux kernel worker process to evade detection and hinder forensic investigations. Unlike […]

Severity Medium Detail Cybersecurity researchers have observed an active SSH reconnaissance campaign in which automated threat actors exploit weak SSH credentials to gain unauthorized access to Linux systems. Instead of immediately deploying malware, the attackers perform system profiling to determine whether compromised hosts are valuable targets for future attacks. This campaign adopts a reconnaissance-first approach. […]

Severity Medium Detail Cybersecurity researchers have identified an active ransomware campaign, tracked as STAC4749, in which threat actors exploit Microsoft Teams voice calls and chats to gain initial access to corporate environments. The attackers impersonate legitimate IT support personnel and convince employees to grant remote access through trusted remote assistance tools such as Microsoft Quick […]

SeverityMedium Detail Cybersecurity researchers have uncovered widespread activity involving Flying Eagle, an Android Remote Access Trojan (RAT) framework whose leaked source code is now circulating in cybercriminal Telegram channels. Researchers from Hunt.io and NetAskari identified approximately 170 internet-facing command-and-control (C2) servers associated with Flying Eagle, indicating active use by multiple threat actors. The framework primarily […]

Severity Medium Detail Cybersecurity researchers have identified Tengu, a sophisticated Mirai-based malware family targeting poorly secured Linux and Internet of Things (IoT) devices. Unlike traditional Mirai variants that primarily conduct Distributed Denial-of-Service (DDoS) attacks, Tengu includes advanced capabilities such as proxy services, device reconnaissance, payload delivery, malware removal, and multiple persistence mechanisms. The malware primarily […]

SeverityMedium Detail Cybersecurity researchers at Proofpoint have identified Cruciferra, a sophisticated crypter service used by multiple cybercriminal groups to deliver a variety of Remote Access Trojans (RATs) and information-stealing malware. Active since late 2025, Cruciferra has been observed in phishing campaigns targeting organizations across financial services, healthcare, government, education, manufacturing, hospitality, and travel sectors. The […]

SeverityMedium Detail Cybersecurity researchers at Zscaler ThreatLabz have identified a targeted cyber espionage campaign against government entities in the Middle East. The campaign deploys three previously undocumented malware families, TELESHIM, MIXEDKEY, and BINDCLOAK, through a multi-stage infection chain designed to establish persistent access on compromised systems. The attackers abuse the Telegram API as a command-and-control […]

SeverityMedium Detail Cybersecurity researchers at Confiant have identified a malvertising campaign named SourTrade that constructs malicious Windows executables directly within victims’ browsers instead of downloading a complete malware file from a remote server. Active since late 2024, the campaign impersonates cryptocurrency and trading platforms including TradingView, Solana, and Luno, targeting retail traders and cryptocurrency investors […]

SeverityMedium Detail Security researchers at Seqrite have identified a sophisticated phishing campaign that disguises malware delivery within routine business communications to deploy Phantom Stealer v3.5.0. The campaign uses two phishing themes that ultimately lead to the same multi-stage infection chain. One phishing email impersonates UPS Forwarding Hub, referencing fake shipment bookings and quotation IDs to […]

SeverityMedium Detail Cybersecurity researchers have identified an active phishing kit operated by BlueNoroff, a North Korean threat actor group, that impersonates Zoom and Microsoft Teams in social engineering campaigns designed to deliver malware. According to JUMPSEC, BlueNoroff has developed an operator-driven victim acquisition platform that combines compromised industry contacts, social engineering, cryptocurrency wallet reconnaissance, and […]

SeverityMedium Detail Russian state-backed threat group Laundry Bear has been linked to an espionage campaign targeting organizations by exploiting CVE-2025-66376, a cross-site scripting (XSS) vulnerability in the Zimbra Collaboration Suite (ZCS) webmail platform. According to a joint advisory issued by the NSA, FBI, CISA, and international cybersecurity partners, the campaign has been active since July […]

Severity Medium Detail A newly disclosed Linux kernel vulnerability, tracked as CVE-2026-64600 and nicknamed RefluXFS, allows an unprivileged local attacker to overwrite root-owned files on affected XFS filesystems, potentially leading to persistent root privilege escalation. The vulnerability affects Linux kernels 4.11 and later that use XFS with reflink enabled (reflink=1). The issue primarily impacts default […]

Severity Medium Detail Researchers from Infoblox Threat Intel have identified an active Adversary-in-the-Middle (AiTM) phishing campaign that targets Microsoft 365 users by cloning legitimate Microsoft authentication pages. Unlike conventional phishing attacks that only steal usernames and passwords, this campaign intercepts login credentials, Multi-Factor Authentication (MFA) codes, and authenticated session tokens in real time, allowing attackers […]

Severity Medium Detail Threat actors have been exploiting the recently patched CVE-2026-0257 vulnerability in Palo Alto Networks PAN-OS as an initial access vector to deploy Qilin (Agenda) ransomware. The authentication bypass flaw affects the PAN-OS portal and gateway components, allowing attackers to establish SSL VPN sessions without valid credentials when authentication override cookies are enabled […]

Severity Medium Detail Hugging Face disclosed a security incident on July 16, 2026, involving unauthorized access to parts of its production infrastructure. The breach affected a limited number of internal datasets and several service credentials. The company is still investigating whether any customer or partner information was exposed and stated that affected parties will be […]

SeverityMedium Detail Cybersecurity researchers have attributed the April 2026 DigiCert security incident to a threat activity cluster tracked as CylindricalCanine. According to Expel, CylindricalCanine is a subgroup of GoldenEyeDog (also known as APT-Q-27, Dragon Breath, and Miuuti Group), a Chinese cybercrime group active since at least 2015 and known for targeting the gambling and gaming […]

SeverityMedium Detail Security researchers have identified a new botnet named NadMesh that actively targets exposed AI services and Secure Shell (SSH) servers to compromise internet-facing systems. According to the researchers, the botnet scans for publicly accessible services and exploits weak or exposed environments to recruit devices into its network. The campaign has been observed targeting […]

SeverityHigh Detail Microsoft has identified a surge in activity involving ACR Stealer, an information-stealing malware targeting customers between late April and mid-June 2026. The malware has been used in campaigns that rely on ClickFix social engineering techniques to trick users into executing malicious commands. ACR Stealer is associated with the evolution of Amatera Stealer and […]

SeverityHigh Detail Cybersecurity researchers have discovered a previously undocumented malware named GoSerpent, which has been used in cyber attacks targeting government and diplomatic organizations in Southeast Asia since late 2025. The activity was identified by Russian cybersecurity company Kaspersky in February 2026, with the attackers focusing on maintaining long-term access and gathering sensitive intelligence. GoSerpent […]

SeverityHigh Detail A newly identified ransomware family named Spirals was discovered after being deployed against an IT services company in South Asia in June 2026. The ransomware was identified by the Symantec Threat Hunter Team and is considered a previously unseen threat. The attack involved both data theft and network encryption, following a double extortion […]

SeverityMedium Detail Security researchers have identified the re-emergence of Daxin, a sophisticated China-linked kernel-mode rootkit, alongside a newly discovered Windows backdoor named Stupig within the network of a Taiwan-based subsidiary of a multinational high-tech manufacturing company. Daxin was first publicly documented in 2022 but has been associated with cyber espionage campaigns targeting governments and critical […]