A new active campaign by the Kimsuki (APT-43) group has been discovered targeting AI, blockchain, and logistics sectors in Europe and the United States. The campaign uses fake job offers, invitations, and package tracking notifications to deliver an infostealer malware. Attackers impersonate about 50 companies and operate a dedicated platform to track victim interactions and credential theft. The campaign is attributed with high confidence to North Korea and is linked to the UNK_DeadDrop cluster and Kimsuky group (APT-43).
A Chinese-speaking threat actor group known as Red Heron exploited a recently disclosed remote code execution vulnerability (CVE-2026-60004) in Gitea, a self-hosted Git service, in a multinational campaign. The campaign targeted internet-facing Gitea instances across multiple countries, including Canada, Argentina, Taiwan, the United States, and Sri Lanka, focusing on sectors such as defense, elections, energy, aerospace, telecommunications, government, and research. The attackers used automated tools to steal source code, credentials, and maintain persistent access, including root-level control on some infrastructure. They deployed a novel Linux implant named JITTERLY with extensive post-exploitation capabilities and embedded a previously undocumented rootkit called SIXZUT to maintain stealth and persistence. The campaign demonstrates rapid weaponization of n-day vulnerabilities in development platforms and highlights significant risks to source code confidentiality and infrastructure integrity.
A threat actor exploited CVE-2026-15409, a critical unauthenticated server-side request forgery vulnerability in SonicWall SMA1000 appliances, to gain command execution and steal credentials. The attacker used a modified public proof-of-concept exploit to access internal Erlang services on the appliance, enabling remote code execution. This allowed extraction of LDAP configurations, Active Directory credentials, and deployment of tools to dump secrets from internal Windows systems. The campaign targeted at least 250 SonicWall SMA1000 devices across multiple countries and sectors, with confirmed credential theft in France, India, Italy, and the US. The attack leveraged compromised appliances as pivots into internal networks, exposing sensitive Active Directory data and enabling DCSync attacks against domain controllers. The targeting was opportunistic and technology-driven rather than sector-specific. The campaign was uncovered through an open directory left exposed by the attacker, providing a comprehensive view of the operation.
A large-scale distributed denial-of-service (DDoS) campaign targeted AI Weekly following their investigative reporting on Meta's advertising partner GatherOne and associated nudify apps with child-safety concerns. The attack generated roughly four billion HTTP requests, primarily targeting the specific investigative article. The campaign caused significant server resource exhaustion, including maxing out Nginx worker connections, filling disk storage, and causing numerous server errors and job failures. The attack persisted in waves, shifting focus from the article to the homepage when mitigated, and returning weeks later. There is no evidence implicating Meta, GatherOne, or related entities in orchestrating the attacks. The campaign weaponized infrastructure to disrupt reporting rather than engage in direct rebuttal or criticism.
A large-scale phishing campaign used invisible Unicode characters from the deprecated Unicode Tags block to obfuscate keywords related to loans and financing, bypassing email filters that rely on contiguous ASCII string matching. The campaign sent between 1 million and 2.37 million messages daily at its peak in early 2026, primarily targeting recipients with fraudulent loan offers. The messages were routed through the legitimate marketing platform ActiveCampaign, leveraging its reputation to evade detection. There is no software vulnerability or patch associated with this technique; it exploits differences in how email clients and filters process Unicode text. Mitigation requires enhanced email filtering that inspects raw Unicode content and flags or removes invisible characters to detect obfuscated phishing keywords.
This report analyzes a scam campaign observed through the lens of a URL shortener service. The campaign involved three short links that collectively received nearly 90,000 clicks in 48 hours. The destination URLs employed sophisticated cloaking techniques, including user-agent checks, Selenium/Puppeteer detection, ad blocker detection, mouse movement sampling, and device fingerprinting to evade detection and only target real human victims. Attempts to block the malicious destination were circumvented by the attackers quickly reusing the same short links with new domains forwarding to the same scam content. The URL shortener operator implemented a fix by reserving purged slugs to prevent reuse. This analysis provides insight into the evasive tactics used in this scam campaign and the challenges in detecting it.
A malware campaign targeting Indian users leverages a GST-themed lure to distribute ValleyRAT, a remote access trojan. The campaign uses a Microsoft-signed executable for DLL sideloading, employs process injection, UAC bypass, and security product tampering to evade detection. It features keylogging, screenshot capture, clipboard theft, and multiple command-and-control endpoints with a complex delivery infrastructure. The campaign is actively analyzed with indicators of compromise and infrastructure details published.
This content is a request posted on Reddit seeking repositories or datasets containing samples of malicious email campaigns. The user references existing resources like phishing_pot on GitHub and malware-traffic-analysis.net but is looking for collections of multiple emails from the same campaign. There is no specific vulnerability or exploit detailed in this content.
This analysis covers a Windows-targeted cyber campaign involving social engineering via fake interviews leading to cryptocurrency theft. The campaign notably did not use DPRK malware but leveraged known malware-as-a-service (MaaS) tools and unidentified Go and Rust-based stealers and remote access trojans (RATs). The threat actor may be using DPRK tradecraft as a false flag to confuse attribution, possibly indicating Russian operators. The campaign targets web3 organizations and involves a multi-stage payload delivery chain using signed ClickOnce applications.
A large-scale adware campaign involving over 700 Chrome extensions linked to the operators Ovkas, Gameograf, and Kidswallpapers/Owhit has been identified. These extensions, primarily wallpaper-related, engage in ad fraud by generating unauthorized ad impressions and exhibit malicious behaviors such as deleting browser IndexedDB data and injecting unsanitized HTML popups. The campaign has over 30,000 installs, with most extensions still active on the Chrome Web Store and distributed via grayware websites employing bot protection. The extensions also track uninstall events to enable retargeting. Evidence suggests the extensions were likely authored using AI coding agents. Only a few extensions have been removed so far, indicating ongoing risk to users.
SeasonalInvite is a phishing campaign identified in 2026 that abuses commercial Remote Monitoring and Management (RMM) tools and eCards to conduct social engineering attacks aligned with seasonal events. The campaign has been active since at least January 2026 and leverages legitimate RMM software to facilitate malicious activity. There is no specific patch or fix since this is a phishing campaign exploiting social engineering and tool misuse rather than a software vulnerability. Organizations are advised to maintain strict control and inventory of approved RMM tools to mitigate risk.
Multiple threat campaigns are abusing dormant 'ghost' GitHub accounts to perform mass reconnaissance on GitHub organizations by enumerating public repositories, members, and related metadata via the GitHub API. These campaigns have been active since at least October 2025, using automated scanners and leaked credentials to collect information. While most activity targets publicly available data, some cases involved exfiltration of private repository data using exposed tokens. The activity blends with normal API traffic, complicating detection. Defenders are advised to monitor for anomalous user agent behavior and enable GitHub audit log streaming to detect unauthorized access.
A malvertising campaign is leveraging ChatGPT and OpenAI branding to deceive users into downloading malware. The campaign was reported via a Reddit post linking to an external analysis by Evalian. There are no specific affected software versions or technical exploit details provided. The campaign is categorized as phishing and malware distribution. No known exploits in the wild or patch information is available. The threat appears to be recent but has minimal discussion and no direct indicators shared.
The WaSteal campaign involves a large number of malicious Chrome extensions used for data exfiltration. Recent analysis revealed 57 additional extensions linked to the same operator and backend, bringing the total to 183 active extensions on the Chrome Web Store. These extensions share the same exfiltration behavior and remain live, posing ongoing risk to users who install them. The campaign is actively tracked and reported by threat intelligence sources, but no specific patch or remediation guidance is provided in the available data.
Four coordinated npm supply chain campaigns were active during May and June 2026, targeting the npm ecosystem with various sophisticated techniques including dependency confusion, namespace compromise, scope confusion, and typosquatting. These campaigns employ multi-stage postinstall execution chains that fetch and run platform-specific payloads, aiming to steal environment variables, CI/CD secrets, cloud metadata service tokens, and other sensitive credentials. The campaigns affect multiple platforms (Windows, macOS, Linux) and cloud environments (GCP, Azure). Detection relies on identifying version sentinels, cloud metadata endpoint access patterns, and characteristic postinstall behaviors. An open-source scanner with detection capabilities for these campaigns is available for community use.
A new phishing campaign targets Japanese online banking users by impersonating a legitimate bank with a typographical error in the brand name, using 'PayPoy' instead of the correct name. The phishing emails demand verification within 24 hours but contain a conspicuous branding typo that has reduced the campaign's perceived credibility, turning it into a viral meme in the local tech community rather than causing widespread alarm. The campaign was reported on Reddit cybersecurity forums with minimal discussion and no confirmed exploits in the wild. No patch or official remediation is applicable as this is a phishing campaign rather than a software vulnerability.
A large-scale smishing campaign has been exposed involving 1,628 malicious URLs linked by a unique 128-character HTML fingerprint. This campaign spans 19 countries and uses infrastructure distributed across multiple cloud providers including Tencent Cloud, Alibaba Cloud, Cloudflare anycast, and ALEXHOST Moldova. The campaign targets users via SMS phishing (smishing) with URLs designed to deceive recipients. The detection artifact is a consistent metadata hash found on all phishing pages, facilitating identification. There is no information about active exploitation or patches since this is a threat campaign rather than a software vulnerability.
A macOS stealer malware campaign was discovered by a non-security professional who was tricked into running a malicious terminal command from a fake Apple support website delivered via a Google Ad. The attack involved downloading and executing obfuscated scripts that ultimately attempted to run a binary designed to steal browser credentials. The attack was halted when the victim denied Finder access permissions. The campaign uses multiple domains for phishing, tracking, and payload delivery, with infrastructure registered very recently. No sample of the final binary was obtained, and the campaign is currently undocumented elsewhere.
A phishing campaign is abusing Google Cloud applications to impersonate legitimate Google emails, deceiving recipients into trusting malicious messages. Attackers leverage the credibility of Google Cloud infrastructure to bypass traditional email security filters and increase the success rate of phishing attempts. This technique enables threat actors to send emails that appear authentic, potentially leading to credential theft, malware deployment, or further social engineering attacks. The campaign is currently assessed as medium severity due to its potential impact and ease of exploitation without requiring user interaction beyond opening the email. European organizations, especially those heavily reliant on Google Workspace and cloud services, face increased risk. Mitigation requires enhanced email filtering, user awareness training focused on recognizing subtle phishing cues, and strict verification of email sources even when messages appear to come from trusted domains. Countries with high adoption of Google services and significant cloud infrastructure usage, such as the UK, Germany, France, and the Netherlands, are most likely to be targeted. Given the campaign's use of trusted cloud platforms to impersonate legitimate emails, defenders must remain vigilant and implement layered security controls to reduce exposure.
The DarkSpectre browser extension campaigns have compromised approximately 8.8 million users worldwide by distributing malicious browser extensions. These campaigns involve extensions that likely perform unauthorized data collection, user tracking, or other malicious activities, impacting user privacy and security. Although no specific affected versions or exploits in the wild are detailed, the scale of impact and exposure indicates a high-severity threat. European organizations using popular browsers susceptible to these extensions are at risk of data leakage and potential downstream attacks. The threat does not require user authentication but likely depends on user installation of malicious extensions, making user awareness critical. Mitigation involves proactive monitoring of browser extensions, enforcing strict extension policies, and educating users about risks. Countries with high browser usage and significant digital economies, such as Germany, France, and the UK, are most likely to be affected. Given the broad impact on confidentiality and potential integrity of user data, ease of exploitation through extension installation, and large affected user base, this threat is assessed as high severity. Defenders should prioritize detection and removal of these extensions and strengthen endpoint security controls.
