Follow on X RSS Feed

Delivering simplified cybersecurity alerts and information, ensuring you're always prepared to take immediate action.

Fake Claude Code Install Guide Hides MacSync Infostealer in Active Google Ads Campaign
macOS Malware

Fake Claude Code Install Guide Hides MacSync Infostealer in Active Google Ads Campaign

GroupAttribution unconfirmed; compromised Malaysian company's Google Ads account used as delivery infrastructure proxyTypeMalvertising / ClickFix Infostealer Campaign — cross-platform macOS and WindowsMalwareMacSync — macOS Malware as a Service infostealer targeting browser credentials, Keychain databases, session cookies, and cryptocurrency wallets; Trojan.Stealer.GJ / Trojan.Stealer.GK — Windows credential stealers delivered via mshta.
9 min read
CloudZ RAT and Pheno Plugin Hijack Microsoft Phone Link to Bypass MFA Without Touching Your Phone
Malware

CloudZ RAT and Pheno Plugin Hijack Microsoft Phone Link to Bypass MFA Without Touching Your Phone

GroupUnknown threat actor, attribution unconfirmedTypeModular RAT with novel MFA-interception pluginCVEsNone assigned. Exploits legitimate Windows application behaviour rather than a software vulnerabilityMalwareCloudZ RAT — modular .NET remote access tool with credential theft, screen recording, and C2 capabilities. Pheno — previously undocumented plugin that hijacks Microsoft Phone Link to intercept SMS messages and OTPs
8 min read
Snow Malware Suite Turns Microsoft Teams Into a Help Desk Trap
Malware

Snow Malware Suite Turns Microsoft Teams Into a Help Desk Trap

GroupUNC6692 (financially motivated cluster, attribution unconfirmed beyond Mandiant tracking ID)TypeModular custom malware suite, browser extension plus Python tunneler plus Python backdoorMalwareSNOWBELT (Chromium extension), SNOWGLAZE (WebSocket and SOCKS tunneler), SNOWBASIN (local HTTP backdoor)DeliveryEmail bombing followed by Microsoft Teams impersonation of internal IT helpdesk staffScore7.5 High. Active campaign, novel
8 min read
Android NFC Stealer NGate Targets Brazil via Fake Lottery and Counterfeit Google Play Page
Android Malware

Android NFC Stealer NGate Targets Brazil via Fake Lottery and Counterfeit Google Play Page

GroupUnknown. Attribution unconfirmed. Financially motivated cybercriminal actor.TypeAndroid NFC Relay Malware / Mobile InfostealerMalwareAndroid/Spy.NGate.CC and Android/Spy.NGate.CB — trojanised versions of the legitimate HandyPay NFC relay application, augmented with AI-generated malicious code to capture payment card PINs and relay NFC card data to attacker-controlled devicesScore🟠 8.5
7 min read
Storm Infostealer Ships Your Browser Credentials Home Before Decrypting Them
Infostealer

Storm Infostealer Ships Your Browser Credentials Home Before Decrypting Them

GroupUnknown cybercriminal operator(s); attribution unconfirmedTypeInfostealer-as-a-ServiceMalwareStorm; a session-hijacking credential stealer that exfiltrates encrypted browser data to attacker infrastructure for server-side decryption, bypassing Chrome App-Bound Encryption and endpoint detectionScore🟠 8.5 High. Actively deployed against confirmed victims across at least six countries, defeats Google Chrome's App-Bound Encryption, renders MFA
8 min read
CPUID Supply Chain Attack Delivers STX RAT via Trojanised CPU-Z and HWMonitor Downloads
Supply Chain Attack

CPUID Supply Chain Attack Delivers STX RAT via Trojanised CPU-Z and HWMonitor Downloads

GroupAttribution unconfirmed. Infrastructure overlap identified with a March 2026 fake FileZilla distribution campaign. C2 domain first observed November 2025. Campaign tagged internally as "CityOfSin".TypeSupply Chain Attack / Remote Access Trojan / BackdoorMalwareSTX RAT (classified as Backdoor.Win64.Alien by Kaspersky) — a multi-stage, memory-resident remote access trojan with credential theft,
9 min read
BYOVD Ransomware Attacks Now Capable of Defeating Every Major EDR Product
Ransomware

BYOVD Ransomware Attacks Now Capable of Defeating Every Major EDR Product

GroupQilin (RaaS, cybercriminal); Warlock aka Water Manaul (cybercriminal)TypeRansomware with BYOVD EDR KillerMalwaremsimg32.dll (DLL sideload loader); rwdrv.sys (kernel memory driver); hlpdrv.sys (EDR killer driver); NSecKrnl.sys (Warlock BYOVD driver); Qilin ransomware; LockBit-derived Warlock payload (.x2anylock)Score🔴 9.5 Critical. Two active RaaS groups have deployed kernel-level tooling
8 min read
Axios npm Backdoored: UNC1069 Deploys Cross-Platform RAT via Supply Chain Attack
Supply Chain Attack

Axios npm Backdoored: UNC1069 Deploys Cross-Platform RAT via Supply Chain Attack

GroupUNC1069 (North Korea-nexus, BlueNoroff-linked, financially motivated threat actor)Typenpm Supply Chain Compromise / Cross-Platform Remote Access TrojanMalwareSILKBELL: postinstall dropper embedded in plain-crypto-js@4.2.1. WAVESHAPER.V2: updated cross-platform RAT linked to prior BlueNoroff RustBucket campaignsScore🔴 9.5 Critical. Nation-state supply chain attack on one of npm's most downloaded
10 min read