Threat research
Camera management software compromise malware
huntress.com: Camera management software compromise malware. Tracked with its indicators in EncryptLayer intelligence.
Threat research
Malware and phishing campaigns documented by research teams, with verified indicators to block and hunt.
October 2026 50
Threat research1 indicator
SolanaCry: agents searching the internet attacked by malware discovered in the wild, steals their crypto wallets
AIR Research Lab discovered malware in the wild that targets AI agents creating crypto wallets. A GitHub repository posing as a Solana starter kit, which ranks as the top result when an agent...
Threat research1 indicator
Yet Another ClickFix Campaign
Yet Another ClickFix Campaign, Author: Brad Duncan
Threat research1 indicator
MadApe: The Code That Opens the Door
Group-IB uncovers MadApe, a previously undocumented Microsoft Device Code phishing kit that uses business-themed PDF lures, configurable redirects and fake document-sharing pages to trick victims...
Threat research1 indicator
NIK C2: The new AI-enabled command-and-control framework
Cisco Talos observed a new AI-integrated command-and-control (C2) framework in the wild called “NIK C2.”
Threat research10 indicators
Lumma Stealer in a 900 MB torrent screensaver
Lumma Stealer v6 hides in a 900 MB screensaver delivered through a fake TV torrent. We trace its loader, C2 infrastructure, and clipboard and screenshot theft.
Threat research1 indicator
Investigating a new Click-fix variant
Atos Researchers identified a new variant of popular ClickFix technique, where attackers convince the user to execute a malicious command on their own device through the Win + R shortcut. In this...
Threat research4 indicators
SEO Poisoning Campaign Delivers Armorsteal Malware
Zscaler Threat Hunting examines an SEO poisoning campaign using fake Chocolatey & MAS sites to deploy Armorsteal malware.
Threat research
StealC Is Back, and This Time It
Four months after Operation Endgame took it down, StealC
Threat research1 indicator
Trellix: Unveiling Sirius Backdoor
trellix.com: Trellix: Unveiling Sirius Backdoor. Tracked with its indicators in EncryptLayer intelligence.
Threat research2 indicators
Tricks from the Past deployed via signed ChatGPT and Claude binaries
Key Points Introduction Over the past two months, we have been tracking a campaign that abuses the popularity of AI tools such as ChatGPT and Claude to spread a custom malware chain we call Yoba....
Threat research1 indicator
Beyond the Sandbox: Leveraging Android Intrusion Logs to Expose Advanced Threats
How Android Intrusion Logging and Delegated Scope give defenders OS-level evidence, and how Zimperium MTD used these logs to expose RatHat malware.
Threat research
ThreatLocker MDR team intercepts Chimera C2 ClickFix attack
The ThreatLocker MDR team intercepted a ClickFix attack which attempted to implement an active C2 framework and subscribe to a platform titled “ChimeraC2”.
Threat research
Sekoia Honeypot Captures an Attack on GenAI Infrastructure
Sekoia’s TDR team ran a decoy Flowise server to study attacks on GenAI platforms. One threat actor stole its credentials and tried to misuse its AI agent.
Threat research1 indicator
LiteLLM Hijacked Again: Malicious 1.107.0 Wheels Steal Credentials and Load Remote Code
LiteLLM has been hijacked again: malicious `litellm` 1.107.0 wheels contain an interpreter-startup credential stealer and an hourly remote-code loader absent from the source distribution.
Threat research3 indicators
Stray Cat, Open Doors: How k0t Wanders Through the Network Edge
Group-IB and NyxLab expose threat actor k0t’s large-scale campaign exploiting FortiGate, FortiWeb, and Palo Alto GlobalProtect edge devices to harvest credentials, establish persistent access and...
Threat research4 indicators
Infostealer riding the AI Train
Key Points Introduction Infostealers commonly target browser passwords, session cookies, and cryptocurrency wallets. This malware combines those established capabilities with dedicated collection...
Threat research17 indicators
Prince of Persia: A Threat Group Hiding in Plain Sight
New research from Semperis reveals the Prince of Persia APT group’s latest activities, including new strategies and indicators of compromise.
Threat research2 indicators
Sophos: BRONZE SANDCASTLE modified Meterpreter
sophos.com: Sophos: BRONZE SANDCASTLE modified Meterpreter. Tracked with its indicators in EncryptLayer intelligence.
Threat research
Swallowtail: Russian Espionage Group Targets Defense Firms in Two NATO Countries
Russian group stole credentials and tunneled into the network during a two-month intrusion at a naval shipbuilder.
Threat research1 indicator
Analysis of Operation FlashHole, a complex Lazarus Group campaign
An analysis of Operation FlashHole, a recent Lazarus Group campaign that uses a complex malware chain, the watering hole technique and abuse of CrossWeb EX, software used to protect financial...
Threat research2 indicators
Fake Amazon Music x YouTube deal lures creators into a Google login trap
A convincing “creator portal” uses your own YouTube videos and viewing figures to steal your Google login.
Threat research1 indicator
Inside Wazza: A Newly Observed Device Code Phishing Kit Targeting Microsoft 365 Accounts
LevelBlue SpiderLabs has been tracking multiple waves of Wazza, a newly observed multi-stage phishing kit that deploys device code phishing targeting Microsoft 365 accounts.
Threat research1 indicator
Mini Shai-Hulud in Tensorlake: A Token Monitor That Can Wipe Your Home Directory
A malware campaign based on the npm Shai-Hulud tactics hit the Tensorlake AI sandboxing ecosystem. Learn about how it worked, how to detect it, and what to do if you’re impacted.
Threat research
INC and The Gentlemen Ransomware: Exposed AI Infrastructure
SOCRadar Threat Research Unit (STRU) has uncovered an AI-driven intrusion ecosystem run by affiliates of the INC Ransomware and The Gentlemen
Threat research1 indicator
Active Exploitation of CVE-2026-110936 in Siemens Software Center
cert-portal.siemens.com: Active Exploitation of CVE-2026-110936 in Siemens Software Center. Tracked with its indicators in EncryptLayer intelligence.
Threat research16 indicators
Two Hawks in a Pod: one Android RAT behind a flock of fake Japanese brands
Over the past month we collected and analysed 64 Android samples (first seen 2026-09-15 to 2026-10-16) that are all the same thing: a thin dropper that installs a packed second-stage WebSocket...
Threat research1 indicator
Investigating Ephemeral Supply Chain Tampering
GTIG and Mandiant uncovered a supply chain attack targeting AOMEI Technology’s update infrastructure, where attackers used short-burst configuration tampering on origin servers to deploy tools...
Threat research1 indicator
Cyber Swachhta Kendra: ReverseRAT Malware (SideCopy Spear-Phishing Campaign)
Cyber Swachhta Kendra (Botnet Cleaning and Malware Analysis Centre), information on ReverseRAT Malware (SideCopy Spear-Phishing Campaign) - CERT-In
Threat research24 indicators
Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware
This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. We call the technique AdFection, and show how it was used to infect devices at Al Jazeera...
Threat research
GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font File
A cluster of 1200+ compromised repos have a second stage that autoruns a credential stealer and installs a cron job.
Threat research18 indicators
ADINT: Weaponized Ad Tech for Zero-Click Spyware and Mass Identity Vacuuming
Confiant Threat Intelligence - security@confiant.com
Threat research
AI-Powered Espionage Campaign Targets Government Linux Infrastructure
Our analysis an AI-powered espionage campaign targeting government Linux infrastructure with custom malware, web shells, and advanced credential theft.
Threat research1 indicator
Inside Help TDS: Hotejka and Cloudflare Abuse
Infoblox attributes Help TDS to Hotejka and detects 16,000 malicious Cloudflare Pages before they are used to direct users to tech support scam call centers.
Threat research2 indicators
Hirudo: From Fake Updates to Patched Banking Apps
Hirudo replaces Indonesian banking apps with patched copies that blind their defences. We break down its patching, distribution, targeting and fraud.
Threat research11 indicators
Fake Calendly “Meta Careers” pages steal Facebook and Google logins
An interview invitation becomes a trap for your Facebook and Google passwords, even with two-factor authentication turned on.
Threat research
Canto incognito: tracking the PoeLLM malware
Understand how early detection helped Black Lotus Labs uncover PoeLLM malware targeting enterprise AI systems and block its infrastructure to protect customers.
Threat research2 indicators
Trojanized Terraform Provider Campaign
ThreatLabz analyzes a trojanized Terraform provider delivering FLATROOF and ROOFDECK malware across Windows, macOS, and Linux.
Threat research2 indicators
A new version of the MacSync macOS stealer targets crypto enthusiasts and developers
We look at a new version of the MacSync macOS stealer with a backdoor module that targets crypto enthusiasts and developers.
Threat research1 indicator
Mirai Botnet Hiding C2 Servers in XOR-Encoded DNS Records
A Mirai kit on our honeypot keeps its server addresses in DNS, XOR-encoded. Sandboxes miss it. How we decoded it offline and confirmed both servers.
Threat research1 indicator
Brazilian Access Broker Targeting Latin America: Mapping BraZetsu Infrastructure Beyond the Published IOCs
TLS certificates tied BraZetsu
Threat research1 indicator
Anatomy of BraZetsu: How Cybercriminals Fuel the Underground Ecosystem
Group-IB uncovers BraZetsu, a new Python-based Windows malware that serves as a master toolkit for Initial Access Brokers and powers a unique, AI-enhanced underground marketplace for...
Threat research32 indicators
DarkBlinders: Active Espionage Campaign
Dream uncovered an active DarkBlinders espionage campaign against Israel and the Kurdistan Region of Iraq, linking the activity to UNC5795, Dust Specter, and APT34 through GitHub-based command and...
Threat research2 indicators
The phone was compromised before the user turned it on: the rise of Midnight Mimosa
Bitdefender has identified a malware campaign (dubbed Midnight Mimosa) running on low-cost, multi-brand Android devices built on MediaTek platforms.
Threat research12 indicators
A Fake Captcha, a Trojanised File Manager, and a Year of IOC C2 Domains
On 7th October our Threat Intelligence pipeline flagged a script from ohhhhhmoney.com injected into compromised WordPress sites. It is a ClickFix kit, and at the end of the chain is a backdoored...
Threat research
Weekly Threat Bulletin
These are the top threats you should know about this week.
Threat research1 indicator
DarkSword/Coruna Open Directory Finding Report
Executive summary Key judgments Background: DarkSword and Coruna DarkSword is an exploit chain for iOS that Google Threat Intelligence Group (GTIG) first documented publicly in March 2026. The...
Threat research5 indicators
Reverse engineering Android malware with Claude Code
I pointed an autonomous coding agent at a $35 projector. It found a big RAT.
Threat research2 indicators
From BlackCat to Panda Workshop: Inside the Evolving C2 Panel Behind RATHat
Cleafy’s TIR team analyzed the operator infrastructure behind RATHat, an Android banking trojan that abuses Accessibility Services to enable wireless debugging on the victim’s phone, obtain a...
Threat research24 indicators
Inside a multi stage toll fraud operation targeting Poland
CERT Polska uncovered a toll fraud operation targeting Polish users through deceptive Meta advertisements and malicious applications distributed via Google Play. We preserved 1235 ads, linked 852...
September 2026 2
Threat research2 indicators
Inside Corp MDM, the Android spyware targeting logistics companies
Source-code analysis of the Corp MDM Android spyware campaign targeting logistics companies through fake Google Play pages, with SMS theft, call forwarding, persistence, C2, and detection details.
Threat research1 indicator
Casbaneiro: A Banking Trojan with Distributed Data-Receiving Servers
FortiGuard Labs examines how a new Casbaneiro campaign targeting Latin America uses geofencing and distributed servers to evade analysis and detection…
Industry partners
