Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A new spyware campaign dubbed SparkKitty has been discovered targeting both iOS and Android devices. The malware, believed to be connected to the previously identified SparkCat campaign, is distributed through official app stores and unofficial sources. It primarily steals photos from infected devices, likely searching for cryptocurrency wallet information. The campaign has been active since at least February 2024 and mainly targets users in Southeast Asia and China. The malware is embedded in various apps, including modified versions of popular applications like TikTok, and uses different techniques to evade detection. The researchers identified multiple variations of the malware, including obfuscated libraries and malicious frameworks mimicking legitimate ones.

The SparkKitty Trojan is a spyware campaign targeting both iOS and Android mobile devices, discovered to be active since at least February 2024. It is believed to be linked to the earlier SparkCat campaign. The malware is distributed through both official app stores (Apple App Store and Google Play) and unofficial sources, increasing its reach and infection vectors. SparkKitty is embedded within various applications, including modified versions of popular apps such as TikTok, which helps it evade detection by masquerading as legitimate software. The malware employs obfuscated libraries and malicious frameworks that mimic legitimate ones, complicating detection and analysis efforts. Its primary objective is to steal photos from infected devices, with a likely focus on extracting cryptocurrency wallet information, which is often stored as images or QR codes. The campaign mainly targets users in Southeast Asia and China, but the presence in official app stores implies potential for wider distribution. The malware uses techniques consistent with known tactics such as user execution (T1204.002), input capture (T1056), and malicious code injection or framework manipulation (T1176). Despite its medium severity rating, the campaign's persistence, multi-platform targeting, and use of legitimate distribution channels make it a significant threat to mobile users. No known exploits in the wild have been reported beyond the malware's distribution itself, and no specific affected versions are listed, indicating a broad potential impact across device models and OS versions.

Detailed information about The new SparkKitty Trojan spy in the App Store and Google Play. Get real-time updates, technical details, and mitigation strategies.

The new SparkKitty Trojan spy in the App Store and Google Play - Live Threat Intelligence - Threat Radar | OffSeq.com

The new SparkKitty Trojan spy in the App Store and Google Play

Threats Tagged 'sparkcat'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'sparkcat'

Lead Pen Test Professional