-
A server linked to a malware campaign attributed to a Midnight Blizzard-associated cluster was still delivering malicious files on October 5, 2026. The server returned HTTP 200 responses for multiple payload paths, including one used by simple Windows …
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
An Android remote-access Trojan, YuanKong, whose weakly protected dropper reveals more than its hidden payload: it exposes the operator account identifiers embedded in each build. Analysis of 110 droppers uncovered 57 distinct child payloads, 42 operat…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Hackers used AI-assisted scripts to compromise government Linux servers, harvest administrator credentials, and establish persistent backdoors during a campaign observed between October 2025 and April 2026. The cluster remains unattributed. Under Unit …
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
More than 20,000 malicious Cloudflare Pages subdomains used by Help TDS, a longstanding traffic distribution system that funnels victims into fraudulent technical support call centers. Researchers assess with high confidence that Hotejka, a Russian-lan…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A likely Russian-speaking threat actor used hundreds of AI agents to exploit PaperCut NG/MF servers, steal Windows credentials and establish reusable access to internal networks. GreyNoise identified at least 440 compromised instances belonging to 395 …
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Microsoft and international partners have disrupted infrastructure supporting CoGUI. This phishing kit Proofpoint says generates more than 100 million malicious emails monthly. The coordinated action targeted a Chinese-speaking fraud ecosystem encompas…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
The Aoki infostealer, also known as Aokigahara, has expanded its collection capabilities to steal credentials and session files from AI coding assistants, putting developer identities and connected infrastructure at risk. First observed earlier in 2026…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A newly disclosed proxyjacking campaign has compromised at least 143 devices across 34 countries, exploiting vulnerabilities in network appliances and enterprise software to monetize victims’ internet connections. GreyNoise identified an attacker insta…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A suspected China-linked espionage group exploited a critical BeyondTrust Remote Support vulnerability as a zero-day in late August 2026 weeks before BeyondTrust disclosed it on October 15. Mandiant, which investigated the incident, found the attackers…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
PEERSTITCH, a memory-resident ARM64 implant deployed against FortiGate firewalls during a prolonged intrusion into a telecommunications managed service provider. The malware hijacks legitimate FortiOS processes, leaving no persistent executable, openin…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
