GoSerpent: a persistent threat evolves with sophisticated data collection and exfiltration
Two-phase attacks with the GoSerpent backdoor, Stowaway RAT, ThumbcacheService and other tools aim to steal data from government entities in Southeast Asia.
Search Intelligence
Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery
Threat actors compromised AsyncAPI packages and weaponized trusted CI/CD workflows to distribute malware through npm. This analysis breaks down the attack chain, payload delivery, and recommended defe
OkoBot: new sophisticated malware framework targets cryptocurrency users
Kaspersky GReAT experts dissect the new OkoBot campaign targeting cryptocurrency users. This complex framework employs TookPS, exfiltrates seed phrases, monitors Chromium-based browsers, and installs
How an Infostealer Infection Led to a Sophisticated ClickFix Campaign at Artlist
How an Infostealer Infection Led to a Sophisticated ClickFix Campaign at Artlist How an Infostealer Infection Led to a Sophisticated ClickFix Campaign at Artlist A shared research investigation... The
NetNut botnet takes a hit. Don’t be part of the next one.
Google, the FBI, and other partners have disrupted a residential proxy network built on millions of hijacked devices and used by criminals.
Armored Likho digging a snake pit: inside the covert BusySnake Stealer campaign
An inside look at the active Armored Likho APT campaign. The attackers are using spear-phishing, AI-generated loaders, and a new Python-based tool, BusySnake Stealer, to target organizations in Russia
FBI Seizes NetNut Proxy Platform, Popa Botnet
The Federal Bureau of Investigation (FBI) said today it worked with industry partners to seize hundreds of domains associated with NetNut, a sprawling residential proxy service operated by the publicl
The SOC Files: ScreenConnect masked as freeware. An inside look at a large-scale campaign
Kaspersky experts have uncovered a malicious network infrastructure for delivering AsyncRAT. The Trojan is dropped via compromised ScreenConnect software. In this post, we break down the infection cha
ToddyCat: your hidden email assistant. Part 2
An in-depth analysis of Umbrij, a new tool used by the ToddyCat APT group to compromise corporate email communications in Gmail. The attack targeted OAuth authorization tokens, allowing threat actors
Why patch directives only go so far
Six weeks of undetected access through a compromised VPN exposes why patching isn't a solution for the organizations already breached. The post Why patch directives only go so far appeared first on Cy
StrikeShark: investigating a new campaign delivering Cobalt Strike through SharkLoader
Kaspersky researchers analyze a new global campaign dubbed StrikeShark that delivers Cobalt Strike Beacon via custom SharkLoader malware.
Thousands of D-Link routers under control of AryStinger botnet
Thousands of outdated D-Link routers have been absorbed into the AryStinger botnet, with no future security updates available to protect them.
Inside the FortiBleed Response: Hudson Rock’s Insights into the Global Disclosure Effort
Fortibleed updates from Hudson Rock Inside the FortiBleed Response: Hudson Rock’s Insights into the Global Disclosure Effort The past few days following our publication on the Fortinet compromis
‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm
For the past four years, a sprawling Android-based botnet called Popa has forced millions of consumer TV boxes to relay Internet traffic linked to advertising fraud, account takeovers, and mass data-s
Crypto Clipper uses Tor and worm-like propagation for persistence and control
Microsoft Threat Intelligence analyzed a cryptocurrency clipper campaign that combines clipboard theft, wallet replacement, Tor-based communications, and worm-like propagation. Beyond stealing cryptoc
FortiBleed: 75,000 Fortinet Firewalls Compromised: Global Enterprises Exposed – Claim Your Ethical Disclosure
FortiBleed: 75,000 Fortinet Firewalls Compromised: Global Enterprises Exposed FortiBleed: 75,000 Fortinet Firewalls Compromised: Global Enterprises Exposed – Claim Your Ethical Disclosure By Hudson Ro
Dozens of malicious wallpapers found on Steam Workshop: gamers’ accounts at risk
Since late 2025, malware has been spreading rapidly through the Steam Workshop, the gaming platform's built-in service for players to create and share custom content. The attackers are primarily targe
Fake virus alerts are invading mobile games
"Your device is infected!" Fake account warnings and virus alerts are turning some in-game ads into malware traps.
Fake BlueWallet steals passwords, accounts, and crypto from Macs
A fake BlueWallet download tricks Mac users into running malware that steals passwords, crypto wallets, and clipboard data.
Fake ChatGPT download site infects Windows and Mac users with malware
Searching for ChatGPT? This fake download site serves malware to both Windows and Mac users, using separate payloads tailored to each platform.