Miasma, a newly discovered malware strain, has infiltrated the npm ecosystem and GitHub Actions workflows, creating a sophisticated supply chain attack vector. The malware exfiltrates sensitive credentials, manipulates CI/CD pipelines, and establishes persistent backdoors across development environm
The Russia-linked Turla APT group has deployed a previously unknown backdoor called STOCKSTAY in targeted espionage operations against Ukrainian entities. Google’s Threat Analysis Group (TAG) identified this sophisticated malware framework featuring modular architecture, encrypted command-and-contro
North Korean threat actors have deployed macOS.Gaslight, a sophisticated malware strain designed to deceive security analysts by manipulating AI-powered analysis tools. The malware employs anti-analysis techniques that specifically target machine learning detection systems, generating false benign i
A sophisticated phishing campaign is targeting the hospitality industry with malicious ZIP archives disguised as photo collections. The attack delivers a Node.js-based implant that establishes persistent remote access on compromised systems. Hotels, resorts, and hospitality management companies are
A sophisticated backdoor dubbed “Mistic” has been identified as the primary tool of an access broker supplying corporate network credentials to ransomware operators. The malware features advanced evasion techniques including self-destruction capabilities, encrypted communications, and minimal forens
A critical privilege escalation vulnerability (CVE-2024-20272) in Cisco Unified Communications Manager (CUCM) has been weaponized by threat actors in less than 24 hours after public disclosure. The flaw allows authenticated attackers to escalate privileges to root level, granting complete system con
Cybercriminals are exploiting the massive hype around Grand Theft Auto 6 (GTA 6) by creating fraudulent websites claiming to offer early access, beta keys, and exclusive content. These malicious sites distribute information-stealing malware, cryptocurrency draining scripts, and phishing schemes. Thr
Mistic, a newly discovered backdoor, is being deployed in ransomware intrusion chains as a persistent access mechanism. This sophisticated malware combines advanced evasion techniques, encrypted command-and-control (C2) communications, and modular capabilities to maintain long-term access to comprom
A popular Chrome browser extension with over 10 million installations has been discovered containing dormant code injection capabilities that could execute arbitrary scripts on user browsers. The ad blocker, which appears legitimate on the surface, includes obfuscated functions that allow remote cod
The Mistic backdoor has emerged as a sophisticated threat linked to the KongTuke threat actor, targeting multiple industry sectors through ClickFix social engineering techniques and ModeloRAT campaigns. This multi-stage attack employs PowerShell obfuscation, fileless execution, and advanced evasion