Malware Analysis

Indicators of Compromise Obfuscation Techniques Command and Control Payload Delivery Steganography Malware-as-a-Service Persistence Techniques Threat Actors Threat Detection Backdoors

4 ARTICLES

last wk.

Akira Affiliate Reboots Host Into Safe Mode to Disable EDR and Crashes Its Own Encryptor

Huntress says the Safe Mode reboot blinded endpoint defenses, caused the Akira payload to run out of virtual memory, leaving stolen files exposed for extortion.

4 ARTICLES

2w ago

Mac Malware Uses ClickFix Fake CAPTCHA to Steal Passwords and Drain Crypto

4 ARTICLES

2w ago

SMOKE#SCREEN Campaign Uses Legitimate ScreenConnect Installs to Give Attackers Persistent Access

4 ARTICLES

2w ago

Phishing Campaign Posing as Bank of America Installs Trojanised ScreenConnect with Silent UAC Bypass

3 ARTICLES

4w ago

AI-Generated PowerShell Script Mapped Active Directory and Staged Data Exfiltration

14 ARTICLES

2mo ago

Operation Endgame Disrupts Amadey and StealC Infrastructure

7 ARTICLES

2mo ago

WhatsApp Account Hijacks Deliver VBScript That Installs ManageEngine Remote‑Access Tool

10 ARTICLES

2mo ago

Law Enforcement Takedown Disrupts SocGholish, Cleans Nearly 15,000 WordPress Sites

4 ARTICLES

2mo ago

SprySOCKS Backdoor Ports to Windows With Kernel-Driver Stealth

6 ARTICLES

2mo ago

Red Hat npm Packages Backdoored to Deliver 'Miasma' Credential‑Stealing Worm

3 ARTICLES

2mo ago

BTMOB Android RAT Sells Point‑and‑Click Builder for Full Device Takeover

10 ARTICLES

3mo ago

Mini Shai-Hulud Poisons Hundreds of AntV npm Packages in One-Hour Burst

3 ARTICLES

3mo ago

cPanel Flaw Under Active Attack by Long-Running Group Deploying 'Filemanager'

Malware Analysis

Akira Affiliate Reboots Host Into Safe Mode to Disable EDR and Crashes Its Own Encryptor

Mac Malware Uses ClickFix Fake CAPTCHA to Steal Passwords and Drain Crypto

SMOKE#SCREEN Campaign Uses Legitimate ScreenConnect Installs to Give Attackers Persistent Access

Phishing Campaign Posing as Bank of America Installs Trojanised ScreenConnect with Silent UAC Bypass

MedusaHVNC Hijacks Real Browsers on Hidden Windows Desktops

Dolphin X Malware Uses AI Profiler to Rank High‑Value Windows Victims

Chaos Ransomware's msaRAT Tunnels C2 Through Headless Chrome and Edge

HOLLOWGRAPH Malware Uses Microsoft 365 Calendars as a Covert C2 Channel

ClickLock Stealer Locks Mac Desktops and Forces Users to Reveal Passwords

Russian-Speaking Actor Trojanizes Popular Installers to Deploy Starland RAT

Never miss stories about

Malware Analysis

Multi‑Stage Malware Found in Four AsyncAPI npm Packages

AI-Generated PowerShell Script Mapped Active Directory and Staged Data Exfiltration

Operation Endgame Disrupts Amadey and StealC Infrastructure

WhatsApp Account Hijacks Deliver VBScript That Installs ManageEngine Remote‑Access Tool

Law Enforcement Takedown Disrupts SocGholish, Cleans Nearly 15,000 WordPress Sites

SprySOCKS Backdoor Ports to Windows With Kernel-Driver Stealth

Red Hat npm Packages Backdoored to Deliver 'Miasma' Credential‑Stealing Worm

BTMOB Android RAT Sells Point‑and‑Click Builder for Full Device Takeover

Mini Shai-Hulud Poisons Hundreds of AntV npm Packages in One-Hour Burst

cPanel Flaw Under Active Attack by Long-Running Group Deploying 'Filemanager'

Never miss stories about

Malware Analysis