Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

Threatpost

SecurityWeek

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

AWS Security Bulletins

GCP Kubernetes Security

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

This analysis examines Infostealer trends in August 2025, focusing on distribution volume, methods, and disguises. AhnLab's automated systems collect and analyze malware, providing real-time IOC services. Infostealers, often disguised as cracks, are distributed through SEO poisoning. Notable variants include LummaC2, ACRStealer, and Rhadamanthys. Distribution methods evolved from personal blogs to legitimate websites, bypassing search engine restrictions. Malware is primarily distributed as EXE files (89.7%) or through DLL-SideLoading (10.3%). Two significant trends emerged: mass distribution via Slack Marketplace and ACRStealer's domain masquerading technique, which now targets security company domains to evade detection.

The August 2025 Infostealer Trend Report highlights evolving tactics and distribution methods of infostealer malware, focusing on variants such as LummaC2, ACRStealer, and Rhadamanthys. Infostealers are malicious programs designed to covertly harvest sensitive information from infected systems, including credentials, personal data, and system details. Traditionally distributed via SEO poisoning—where attackers manipulate search engine results to lure victims to malicious sites—these malware families have shifted their distribution channels from personal blogs to legitimate websites, effectively bypassing search engine restrictions and increasing infection rates. The primary delivery format remains executable files (EXE) at 89.7%, with a significant minority (10.3%) using DLL SideLoading, a technique where malicious DLLs are loaded by legitimate applications to evade detection. Two notable trends are emphasized: first, mass distribution through the Slack Marketplace, exploiting the platform's ecosystem to spread malware widely; second, ACRStealer's domain masquerading technique, which involves impersonating security company domains to evade detection and increase trustworthiness in the eyes of victims and security tools. The malware employs multiple advanced techniques aligned with MITRE ATT&CK tactics such as T1140 (Deobfuscate/Decode Files or Information), T1190 (Exploit Public-Facing Application), T1055 (Process Injection), T1059 (Command and Scripting Interpreter), T1102 (Web Service), T1547.001 (Registry Run Keys/Startup Folder), T1588.002 (Obtain Capabilities: Acquire Infrastructure), T1027 (Obfuscated Files or Information), and T1573 (Encrypted Channel). These techniques facilitate stealthy persistence, lateral movement, and data exfiltration. The report does not indicate known active exploits in the wild but provides numerous file hashes for detection and blocking. Overall, this threat represents a sophisticated and adaptive infostealer campaign leveraging social engineering, supply chain abuse, and advanced evasion tactics to compromise victims.

Detailed information about August 2025 Infostealer Trend Report. Get real-time updates, technical details, and mitigation strategies.

August 2025 Infostealer Trend Report - Live Threat Intelligence - Threat Radar | OffSeq.com

August 2025 Infostealer Trend Report

Threats Tagged 'slack'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'slack'

Lead Pen Test Professional