Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Kaspersky Security Blog

Check Point Research

CVE Database V5

AlienVault OTX General

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Exploit-DB RSS Feed

The Hacker News

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit NetSec

Reddit InfoSec News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

IClickFix is a malicious framework that compromises WordPress sites to distribute malware using the ClickFix social engineering tactic. Active since December 2024, it has infected over 3,800 WordPress sites globally. The framework injects malicious JavaScript into compromised sites, leading users through a fake CAPTCHA challenge that tricks them into executing malicious code. This ultimately installs NetSupport RAT, granting attackers full control of infected systems. The campaign has evolved over time, adding traffic distribution systems and refining its lures. While initially distributing Emmenhtal Loader and XFiles Stealer, it now primarily delivers NetSupport RAT. The widespread nature of the attacks suggests opportunistic exploitation rather than targeted campaigns.

IClickFix is a malicious framework that compromises WordPress websites by injecting malicious JavaScript code which presents visitors with a fake CAPTCHA challenge. This social engineering tactic, known as ClickFix, deceives users into executing malicious code that ultimately installs the NetSupport Remote Access Trojan (RAT) on their systems. The RAT provides attackers with full remote control, enabling data theft, system manipulation, and persistence. Initially, the framework distributed other malware such as Emmenhtal Loader and XFiles Stealer, but it has since evolved to focus on NetSupport RAT. The campaign has been active since December 2024 and has infected over 3,800 WordPress sites worldwide. The infection chain involves watering hole attacks where legitimate websites are compromised to target visitors, leveraging JavaScript injection and social engineering to bypass traditional defenses. The framework also employs traffic distribution systems to refine its lures and maximize infection rates. Exploitation does not require user authentication but depends on user interaction with the fake CAPTCHA prompt. The campaign appears opportunistic, targeting any vulnerable WordPress site rather than specific high-value targets. The lack of known exploits in the wild suggests infections occur through compromised sites rather than direct exploitation of WordPress vulnerabilities. The threat leverages multiple MITRE ATT&CK techniques including initial access via watering hole (T1189), user execution (T1204.002), persistence (T1547.001), and command and control (T1071.001).

Detailed information about Meet IClickFix: a widespread framework using the ClickFix tactic. Get real-time updates, technical details, and mitigation strategies

Meet IClickFix: a widespread framework using the ClickFix tactic - Live Threat Intelligence - Threat Radar | OffSeq.com

Meet IClickFix: a widespread framework using the ClickFix tactic

A compromised EmEditor installer was used in a software supply chain attack to deliver multistage malware. The attack, discovered in late December 2025, targeted users of this widely-used text editor. The malware performs credential theft, data exfiltration, and enables lateral movement. It uses obfuscated PowerShell scripts and geofencing techniques, suggesting possible Russian origin. The malware disables security features, gathers system information, and exfiltrates data to a command-and-control server. This incident highlights the importance of validating installer integrity, monitoring PowerShell usage, preserving endpoint telemetry, and enforcing least privilege principles. Software publishers are advised to secure download infrastructure and prepare incident response plans.

This threat involves a sophisticated watering hole attack targeting users of EmEditor, a popular text editor, by compromising its installer in a software supply chain attack discovered in late December 2025. The attackers replaced or injected malicious code into the EmEditor installer, which when executed, deploys multistage malware known as Evelyn Stealer. The malware leverages obfuscated PowerShell scripts to evade detection and uses geofencing techniques to restrict execution to specific geographic regions, indicating a likely Russian origin. Once executed, the malware disables security features such as antivirus or endpoint detection and response tools to maintain persistence and avoid removal. It collects detailed system information, including credentials and other sensitive data, and facilitates lateral movement within the victim’s network to expand its foothold. Data exfiltration is performed by sending stolen information to a remote command-and-control (C2) server. The attack chain demonstrates advanced tactics including credential dumping (T1003.001), system information discovery (T1082), disabling security tools (T1497), and use of obfuscated scripts (T1027). The campaign highlights the risks inherent in software supply chain compromises, where trusted software becomes a vector for malware delivery. The absence of affected version specifics suggests the compromised installer was distributed broadly. Indicators of compromise include multiple file hashes and suspicious domains related to the EmEditor download infrastructure. The attack underscores the importance of validating installer integrity, monitoring PowerShell usage, preserving endpoint telemetry for forensic analysis, and enforcing least privilege principles to limit malware impact. Software publishers are urged to secure their download infrastructure and prepare incident response plans to mitigate such supply chain threats.

Detailed information about Watering Hole Attack Targets EmEditor Users With Information-Stealing Malware. Get real-time updates, technical details, and mitigati

Watering Hole Attack Targets EmEditor Users With Information-Stealing Malware - Live Threat Intelligence - Threat Radar | OffSeq.com

Watering Hole Attack Targets EmEditor Users With Information-Stealing Malware

A threat group known as Golden Eye Dog (APT-Q-27) has been targeting individuals involved in gambling and related activities in Southeast Asia, as well as overseas Chinese communities. The group's operations include remote control, cryptocurrency mining, DDoS attacks, and traffic-related activities. Their malware samples are primarily distributed through Telegram groups, with strong anti-detection capabilities and highly targeted lures. The article describes new watering hole activities by the group, including the use of modified MSI installers for popular messaging apps like Telegram. The group has evolved its tactics since previous reports, making their operations more covert and difficult to detect. The analysis reveals the group's use of various programming languages and sophisticated techniques, suggesting it may be part of a larger, more advanced organization called Miuuti Group.

Operation Dragon Breath is a targeted cyber espionage and disruption campaign attributed to the advanced persistent threat group Golden Eye Dog (APT-Q-27), believed to be linked to the broader Miuuti Group. The campaign focuses on individuals and entities involved in the gambling industry, primarily in Southeast Asia and overseas Chinese communities. The group distributes malware mainly through Telegram groups, leveraging social engineering with highly targeted lures and strong anti-detection capabilities. A key tactic involves watering hole attacks using modified MSI installers masquerading as legitimate installers for popular messaging applications like Telegram, enabling initial compromise. The malware capabilities include remote control of infected systems, cryptocurrency mining to monetize compromised assets, distributed denial-of-service (DDoS) attacks to disrupt targets, and traffic-related manipulations. The group employs a variety of programming languages and sophisticated techniques such as process injection (T1055), credential dumping (T1003), persistence mechanisms (T1547), and network traffic obfuscation (T1071). Indicators of compromise include specific IP addresses, domain names, and file hashes associated with their infrastructure. Despite no known CVEs or exploits in the wild, the campaign’s covert nature and multi-faceted attack vectors demonstrate a medium-level threat that can impact confidentiality, integrity, and availability of targeted systems. The campaign’s evolution towards stealthier operations complicates detection and response efforts.

Detailed information about Operation Dragon Breath (APT-Q-27): Dimensional Reduction Attack Against the Gambling Industry. Get real-time updates, technical deta

Operation Dragon Breath (APT-Q-27): Dimensional Reduction Attack Against the Gambling Industry - Live Threat Intelligence - Threat Radar | OffSeq.com

Operation Dragon Breath (APT-Q-27): Dimensional Reduction Attack Against the Gambling Industry

Amazon's threat intelligence team has uncovered and disrupted a watering hole campaign conducted by APT29, a Russian threat actor. The campaign involved compromising legitimate websites to redirect visitors to malicious infrastructure, tricking users into authorizing attacker-controlled devices through Microsoft's device code authentication flow. This opportunistic approach demonstrates APT29's evolving tactics in scaling their operations for intelligence collection. The group employed techniques such as injecting obfuscated JavaScript, rapidly adapting infrastructure when faced with disruption, and using server-side redirects. Amazon's response included isolating affected EC2 instances, partnering with providers to disrupt domains, and sharing information with Microsoft. The article provides recommendations for user and organizational protection against such attacks.

This threat involves a sophisticated watering hole campaign orchestrated by APT29, a well-known Russian advanced persistent threat group. The attackers compromised legitimate websites to redirect visitors to malicious infrastructure controlled by them. The core technique involved injecting obfuscated JavaScript into these legitimate sites, which then redirected users to attacker-controlled domains such as 'findcloudflare.com' and 'cloudflare.redirectpartners.com'. The malicious infrastructure leveraged Microsoft's device code authentication flow to trick users into authorizing devices controlled by the attackers. This method allows the adversaries to harvest credentials and gain persistent access without directly exploiting software vulnerabilities, relying instead on social engineering and session hijacking techniques. The campaign demonstrated rapid infrastructure adaptation, with APT29 quickly shifting domains and servers when disruptions occurred, indicating a high level of operational agility. Amazon's threat intelligence team detected and disrupted the campaign by isolating affected EC2 instances, collaborating with hosting providers to take down malicious domains, and sharing intelligence with Microsoft to mitigate the abuse of their authentication mechanisms. The campaign employed multiple tactics from the MITRE ATT&CK framework, including JavaScript execution (T1059.007), device authentication abuse (T1608.004), exploitation of public-facing applications (T1190), credential harvesting (T1555), and user execution (T1204.001). This attack highlights the evolving tactics of APT29 in scaling intelligence collection operations by combining web compromise, social engineering, and authentication flow manipulation.

Detailed information about Amazon disrupts watering hole campaign by Russia's APT29. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'watering hole'

Stop chasing alerts. Route them.

Filter Threats

Threats Tagged 'watering hole'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility