New Lua-based malware LucidRook observed in targeted attacks against Taiwanese organizations

Cisco Talos observed a spear-phishing attack delivering LucidRook, a newly identified stager that targeted a Taiwanese NGO in October 2025. The metadata in the email suggests that it was delivered via authorized mail infrastructure, which implies potential misuse of legitimate sending capabilities.

• Operation Dragon Weave: Uncovering a China-Linked Campaign Targeting Czech Republic and Taiwan Using Azure Cloud C2Malware2026-05-29
• MATCHBOIL: New tricks, same old evil intentionsMalware2026-10-09
• Device Code Phishing: Turning a Convenience Feature Into an MFA BypassPhishing2026-07-23
• Analysis of Attack Activities Using SSH+TOR Tunnels to Achieve Covert PersistenceCampaign2026-04-29
• The n8n n8mare: How threat actors are misusing AI workflow automationMalware2026-04-15