This threat involves a phishing campaign leveraging a kit targeting FACEIT and Steam users. The campaign expanded from initially using 3 domains to 75 domains, indicating a significant scaling of the phishing infrastructure. The information is sourced from a Reddit post linking to an external blog analysis. No specific affected software versions or exploits in the wild are reported. The campaign is categorized as medium severity based on available details.
ThreatNexus v2 is a threat intelligence platform focused on nation-state APT campaigns, providing improved data quality, strategic and operational context, and actionable intelligence for detection and hunting. It aggregates vendor research, news, and government/CERT sources into a digest format to aid analysts and decision-makers. This release aims to enhance usefulness across strategic, operational, and tactical levels but is not a direct security threat or vulnerability itself.
This entry describes a promotional post for a project called Threat Hub, which is a tailored threat intelligence hub offering customized threats and alerts. The content is a link post on Reddit with minimal discussion and no technical vulnerability or exploit details provided.
A malspam infrastructure is distributing a JavaScript backdoor malware targeting various sectors globally, including energy and finance ministries in the CIS region. The campaigns appear financially motivated, aiming at email account compromise and business email compromise. The malicious infrastructure uses two bulletproof hosting networks: GHOSTYNETWORKS (a rebrand of OPTIBOUNCE linked to AnonRDP) and OMEGATECH (associated with Virtualine). These networks provide resilient hosting for both spam sending IPs and command-and-control servers. Historical analysis shows this threat actor has been active since late 2025 with related malspam and malware operations supported by similar bulletproof hosting services.
HTTP-Basma is a multi-stage HTTP fingerprinting tool that probes servers with crafted HTTP requests to generate detailed behavioral fingerprints. It analyzes server responses such as status lines, headers, allowed methods, and edge-case handling to create unique signatures that identify servers regardless of their Server header claims. This tool is intended for security research, reconnaissance, attack surface mapping, and infrastructure analysis. It is open-source and freely available for use. There is no indication that this tool itself is a vulnerability or exploit, but rather a method for granular server differentiation.
JSMonoGlyphRAT is a persistent backdoor malware actively targeting US enterprises, primarily delivered via phishing emails disguised as purchase orders, quotes, and business proposals. It has been confirmed to affect organizations in technology, telecom, education, and MSSP sectors. The malware is notable for evading most antivirus detection tools. Once installed, it enables attackers to deploy ransomware, steal data, and disrupt business operations. There is no information on available patches or official remediation. The threat is currently assessed as medium severity based on its impact and targeting profile.
This entry describes an update to a Threat Actor Intelligence Dashboard, a tool designed to track and profile threat actors with real-time intelligence. It is a resource aimed at the security community to aid defenders by providing refreshed actor profiles and improved search capabilities. The content is promotional in nature, describing the tool's features and availability rather than a specific security vulnerability or active threat. No technical vulnerability, exploit, or attack campaign details are provided.
This entry describes a methodology and toolset for automating dark web OSINT investigations. The approach consolidates multiple data sources such as Tor search engines, paste sites, GitHub, certificate transparency logs, breach databases, and more into a single automated pipeline. This reduces manual effort, speeds up investigations, and helps uncover sources that might be missed by manual methods. It is not a vulnerability or exploit but rather a research and analysis methodology to improve threat intelligence gathering.
This threat describes a widespread fake engagement problem on GitHub where bot accounts artificially inflate star counts on repositories, primarily targeting low-quality AI tools and executor software. A detection tool named phantomstars identifies these campaigns by analyzing account creation dates, activity patterns, and coordinated timing of star events. The fake engagement distorts the credibility signals developers rely on to evaluate and recommend software. No direct exploitation or vulnerability is described, but the manipulation impacts trust and decision-making in the open source ecosystem.
This content describes the launch of Deltabridge, an AI-native threat intelligence platform designed to aggregate, synthesize, and present threat intelligence from over 57 public OSINT sources. It is not a security vulnerability or threat but rather a tool aimed at improving threat intelligence workflows for security professionals. The platform offers a free community tier and paid business tiers, featuring AI-generated briefs, a STIX 2.1 knowledge graph, and an AI agent named Athena for advanced querying and reporting. There is no indication of a security flaw or exploit associated with this platform in the provided data.
A large-scale phishing campaign has been targeting U. S.banking users since November 2025 by impersonating ESL Federal Credit Union and potentially other financial institutions. The campaign uses a multi-step phishing flow to steal usernames, passwords, one-time passwords (OTPs), and email verification data, increasing the risk of account takeover and fraud. It employs over 230 phishing domains with rotating infrastructure, primarily in . sbs, . cfd, and . click domains. Victim data is exfiltrated through chained POST requests and forwarded to attacker-controlled Telegram bots. The campaign remains active with reusable phishing page assets and endpoint structures, making it trackable despite frequent domain changes.
VoidAccess v1.3 is an updated version of a threat intelligence tool that enhances capabilities such as certificate transparency subdomain enumeration, infrastructure cluster detection, sandbox analysis integration, false-positive suppression, and expanded data scraping from various sources. It introduces IOC freshness decay to reduce chasing outdated indicators. This update is informational about tool improvements rather than a direct security vulnerability or exploit. No known exploits or vulnerabilities are reported in this release.
This entry references a Reddit post linking to an image described as a 'real-world situation' related to cybersecurity. The post itself contains no detailed technical information, vulnerability data, or exploit descriptions. There is no indication of affected software versions, no known exploits, and no vendor advisories or patches. The content appears to be more of a discussion prompt or observational note rather than a concrete security threat.
This entry announces the release of SocVel Quiz #47, a cybersecurity quiz published on May 15, 2026. The content is a news update linking to the quiz on the SocVel website, with no direct indication of a security vulnerability or threat. The post includes a poem referencing various cybersecurity topics but does not describe any specific exploit, vulnerability, or attack vector.
