Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A malvertising campaign targeted 29 organizations by exploiting the legitimate Claude.ai domain to distribute a fake ClaudeDesktop.exe containing the SectopRAT remote access trojan. The campaign used advanced anti-analysis techniques such as VMProtect packing, GPU-based VM detection, and DirectX shader-based payload decryption. The malware's command-and-control infrastructure leveraged Ethereum blockchain transactions (EtherHiding) to hide C2 addresses, enhancing resilience against takedowns. SectopRAT exfiltrated sensitive data including credit card information, credentials, browser data, and personal files. The campaign infrastructure is linked to previous operations dating back to December 2025 and associated with known threat groups.

Between July 21-22, 2026, a sophisticated malvertising campaign compromised 29 organizations by leveraging sponsored ads on Bing that led to a malicious Claude Artifact hosted on the authentic Claude.ai domain. This artifact redirected users to attacker-controlled infrastructure distributing a fake ClaudeDesktop.exe file containing SectopRAT malware. SectopRAT employed multiple advanced evasion techniques including VMProtect packing, GPU-based virtual machine detection, and DirectX shader-based payload decryption. Its command-and-control infrastructure used EtherHiding, embedding C2 addresses within Ethereum blockchain transactions to avoid takedown efforts. The malware exfiltrated credit card data, credentials, browser information, and personal files. Analysis linked this campaign to prior activity from December 2025 and to infrastructure associated with Operation Endgame and StealC distribution.

CC=AE ASN=AS61317 digital energy technologies ltd.

CC=GB ASN=AS47583 hostinger international limited

Detailed information about Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT. Get real-time updates, technical de

Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT - Live Threat Intelligence - Threat Radar | OffSeq.com

Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT

Threats Tagged 'gpu anti-vm'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'gpu anti-vm'

Lead Pen Test Professional