Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A malware campaign utilizing malvertising has been distributing PS1Bot, a sophisticated multi-stage framework implemented in PowerShell and C#. PS1Bot features modular design, enabling information theft, keylogging, reconnaissance, and persistent system access. The malware minimizes artifacts and uses in-memory execution techniques for stealth. Active since early 2025, PS1Bot's information stealer targets cryptocurrency wallets and employs wordlists to identify files containing passwords and seed phrases. The campaign overlaps with previously reported Skitnet activities and uses similar C2 infrastructure. Delivery involves compressed archives with obfuscated scripts, leading to PowerShell modules for antivirus detection, screen capture, data theft, keylogging, and system information collection. Persistence is established through startup directory manipulation.

The PS1Bot malware campaign represents a sophisticated multi-stage threat primarily distributed via malvertising, leveraging deceptive online advertisements to infect victims. PS1Bot is implemented using PowerShell and C#, featuring a modular architecture that allows attackers to deploy various payloads tailored for information theft, keylogging, reconnaissance, and establishing persistent access on compromised systems. The malware employs advanced stealth techniques, including in-memory execution to avoid detection by traditional antivirus solutions and minimize forensic artifacts. The infection chain typically begins with compressed archives containing obfuscated scripts that execute PowerShell modules. These modules perform a range of malicious activities such as antivirus evasion, screen capturing, data exfiltration, keylogging, and system information gathering. Notably, PS1Bot targets cryptocurrency wallets by scanning files with wordlists to locate passwords and seed phrases, indicating a focus on financial theft. Persistence is maintained by manipulating the startup directory, ensuring the malware executes upon system reboot. The campaign has been active since early 2025 and shares infrastructure and tactics with the previously reported Skitnet malware group, suggesting a possible link or evolution. The use of malvertising as a delivery vector increases the attack surface, as it can reach a broad and diverse user base through compromised or malicious advertising networks. The modular design and use of PowerShell and C# enable rapid adaptation and deployment of new capabilities, making PS1Bot a versatile and persistent threat.

Detailed information about Malvertising campaign leads to PS1Bot, a multi-stage malware framework. Get real-time updates, technical details, and mitigation stra

Malvertising campaign leads to PS1Bot, a multi-stage malware framework - Live Threat Intelligence - Threat Radar | OffSeq.com

Malvertising campaign leads to PS1Bot, a multi-stage malware framework

Threats Tagged 'ps1bot'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'ps1bot'

Lead Pen Test Professional