-
A newly marketed macOS malware-as-a-service platform, ICMacOS, is using fake Apple system dialogs to steal login passwords before deploying an information stealer that has evolved into a persistent remote-access trojan (RAT). The operator markets the t…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Disclosure: This article was provided by ANY.RUN. The information and analysis presented are based on their research and findings.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A sophisticated campaign in which threat actors posed as a Web3 venture-capital accelerator to target cryptocurrency start-ups, developers and founders with free Claude and Gemini credits, AI coding tools and smart-contract security audits. It claimed …
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A newly reported macOS implant tracked as GhostProfile clones browser profiles and remotely operates concealed copies of Chrome or Firefox, allowing attackers to browse using victims’ authenticated sessions. The researchers described it as a hidden-VNC…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
North Korea-linked cyber espionage group Kimsuky has expanded its Operation GitPower campaign by using fake Zoom installers and malicious Windows shortcut files to target Ukrainian experts working in diplomacy, security, and international policy. Resea…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Japanese karaoke operator Daiichi Kosho has issued a warning about a malware infection at its outsourcing partner, Nippon Columbia Group (NCG), that may have exposed about 8.72 million personal records. This potential data exposure includes both custom…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A WhatsApp-delivered financial-document lure is being used to deploy a sophisticated Windows malware chain that injects code into the Task Scheduler service and executes subsequent payloads with LocalSystem privileges. The executable acts as an NRV2E-c…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Midnight Mimosa, an Android malware campaign embedded in firmware that monetizes compromised smartphones through advertising fraud and residential proxy services. Disclosed on October 8, the operation affected thousands of devices across more than 150 …
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
CastleStealer, a C# information stealer first publicly identified in April 2026, has expanded its capabilities beyond credential theft. New samples analyzed by Flashpoint bypass Chromium app-bound encryption, support remote command execution, and trans…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A campaign in July 2026 using a trojanized Terraform provider to deploy cross-platform malware against developer environments. The operation delivers FLATROOF for credential theft and initial access, followed by ROOFDECK for broader remote control. Att…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
