The Mistic backdoor has emerged as a sophisticated threat linked to the KongTuke threat actor, targeting multiple industry sectors through ClickFix social engineering techniques and ModeloRAT campaigns. This multi-stage attack employs PowerShell obfuscation, fileless execution, and advanced evasion
Operation Endgame, a coordinated international law enforcement action, successfully disrupted multiple malware dropper operations that formed the backbone of global cybercrime infrastructure. The operation targeted infrastructure behind IcedID, Trickbot, Pikabot, and other malware families, resultin
A sophisticated backdoor named Mistic has been discovered masquerading as legitimate Microsoft security software to evade detection and maintain persistent access to compromised systems. The malware cleverly mimics the behavior and naming conventions of Microsoft Endpoint Detection and Response (EDR
Cybercriminals are exploiting tax season anxieties by distributing malicious Income Tax Assessment Notices that deliver Remote Access Trojan (RAT) malware to Windows systems. These sophisticated phishing campaigns leverage social engineering tactics, disguising malware as legitimate tax documents to
Attackers have deployed typosquatted npm packages masquerading as the legitimate PostCSS library, infecting developer workstations with remote access trojans (RATs) and credential stealers. The malicious packages specifically target Chrome browser passwords and establish persistent backdoor access t
Threat actors are weaponizing politically sensitive and forbidden text strings within malware code to exploit AI security systems’ content filtering mechanisms. By embedding phrases related to weapons, terrorism, and restricted topics, attackers cause AI-powered analysis tools to refuse processing t
Microsoft’s Digital Crimes Unit (DCU) successfully dismantled over 200 command-and-control (C2) servers associated with both Amadey bot malware and StealC information stealer in a coordinated legal takedown. This marks the first time a court-authorized operation has simultaneously targeted two disti
A sophisticated backdoor dubbed “Mistic” has been linked to KongTuke, a known ransomware access broker operating in the cybercriminal underground. The malware enables initial access operations by maintaining persistent, stealthy footholds in compromised networks before selling access to ransomware o
A sophisticated supply chain attack has emerged targeting OpenClaw’s ClawHub Skill Marketplace, where threat actors have been distributing malicious AI agent “skills” designed to exfiltrate sensitive data while evading traditional security controls. The malware leverages AI-specific execution enviro
North Korean threat actors have deployed macOS.Gaslight, a sophisticated Rust-based backdoor that employs an unprecedented defensive mechanism: weaponized prompt injection attacks targeting security analysts using AI-powered analysis tools. Rather than escaping sandboxes through prompt manipulation,