Topic: threat evolution
-
Russian APT28 Deploys 'NotDoor' Backdoor to Target Microsoft Outlook
A new sophisticated backdoor called NotDoor, attributed to Russian state-aligned group APT28, targets Microsoft Outlook to exfiltrate data and execute remote commands. The malware uses obfuscated VBA code and triggers from specific email phrases to deploy malicious actions, while employing evasio...
Read More » -
Barracuda Exposes Stealthy Microsoft 365 Phishing Kit
Whisper 2FA is a sophisticated phishing-as-a-service platform that has compromised nearly one million Microsoft 365 accounts by stealing login credentials and authentication tokens since July 2025. It employs a continuous credential theft loop that persistently prompts victims for multi-factor au...
Read More » -
MonsterRAT: Stealthy Malware Threatens Windows Systems
A sophisticated phishing campaign distributes the previously undocumented MonsterRAT malware, which targets Windows systems and grants attackers full administrative control through a multi-stage infection process. The attack uses phishing emails disguised as business correspondence to deliver the...
Read More » -
UNC2891: Inside the ATM Fraud Money Mule Network
Cybersecurity group UNC2891 executed sophisticated ATM fraud attacks in Indonesia, using a money mule recruitment network and custom malware like STEELCORGI to target banks over multiple years. The criminals employed advanced tools including the CAKETAP rootkit to bypass security checks and multi...
Read More » -
Fake TechCrunch Impersonators Still Targeting Businesses
Scammers are impersonating TechCrunch journalists and event coordinators to deceive businesses, using the publication's trusted reputation to solicit sensitive information or gain unauthorized access. These fraudulent actors employ tactics like mimicking official email domains and refining their ...
Read More » -
Hacker Groups Unite: Scattered Spider, ShinyHunters, LAPSUS$ Form Alliance
Scattered LAPSUS$ Hunters (SLH) is a confirmed alliance merging the reputations of Scattered Spider, ShinyHunters, and LAPSUS$, signaling a long-term strategic consolidation in the cybercrime world. The group operates through a small core of operators managing multiple personas, using Telegram as...
Read More » -
19 Malicious Visual Studio Code Extensions Uncovered
A malicious campaign used 19 Visual Studio Code extensions to hide malware, often by embedding a tampered npm package or disguising a binary archive as a PNG image to evade detection. The attacks targeted developers by mimicking trusted tools, with some extensions executing a Trojan upon launch a...
Read More » -
42 Million Downloads: Malicious Android Apps Found on Google Play
Malicious Android applications on Google Play accumulated over 42 million downloads, with spyware and banking trojans posing severe risks as criminals shift to social engineering tactics targeting mobile payment systems. Adware now dominates Android threats at 69% of detections, while spyware saw...
Read More »