Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit NetSec

Reddit Cybersecurity

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A malicious campaign is targeting French-speaking users in an attempt to steal passwords, payment details and banking details from people across France, according to researchers at the Institute for Strategic Studies (ISS).

This campaign involves a fraudulent website impersonating Windows support to distribute malware designed to steal user credentials and financial information. It targets French-speaking users, leveraging social engineering and technical methods such as code obfuscation and persistence mechanisms (indicated by tags like T1036, T1547, T1140, T1105, T1059, T1027). The malware delivery involves scripts and possibly Electron-based applications. Indicators include the malicious domain microsoft-update.support and several file hashes. There is no CVE or patch associated with this campaign, and no known exploits in the wild have been reported.

MD5 of c94de13f548ce39911a1c55a5e0f43cddd681deb5a5a9c4de8a0dfe5b082f650

SHA1 of c94de13f548ce39911a1c55a5e0f43cddd681deb5a5a9c4de8a0dfe5b082f650

Detailed information about This fake Windows support website delivers password-stealing malware. Get real-time updates, technical details, and mitigation strate

This fake Windows support website delivers password-stealing malware - Live Threat Intelligence - Threat Radar | OffSeq.com

This fake Windows support website delivers password-stealing malware

A multi-stage malware execution chain originating from a ClickFix lure has been discovered, leading to the delivery of infostealing malware like LummaC2 and Rhadamanthys. The campaign utilizes steganography to hide malicious code within PNG images. Two distinct ClickFix lures were observed: a standard 'Human Verification' and a convincing fake Windows Update screen. The execution chain involves mshta.exe, PowerShell, and .NET assemblies, ultimately extracting and injecting shellcode into target processes. The steganographic technique encodes malicious data directly into image pixel data, using specific color channels for payload reconstruction and decryption in memory. This sophisticated approach helps evade signature-based detection and complicates analysis.

The ClickFix malware campaign represents a sophisticated multi-stage attack chain beginning with social engineering lures that impersonate legitimate prompts such as 'Human Verification' or a Windows Update screen. Victims are tricked into executing malicious content that initiates a chain involving mshta.exe, PowerShell scripts, and .NET assemblies. The core innovation lies in the use of steganography to embed malicious code within PNG images by encoding payload data into specific color channels of the image pixels. This payload is not directly executable but is reconstructed and decrypted in memory during runtime, which helps evade signature-based antivirus and endpoint detection systems. The final payloads delivered include infostealing malware families LummaC2 and Rhadamanthys, which are capable of harvesting credentials and sensitive data from compromised systems. The malware injects shellcode into legitimate processes to maintain stealth and persistence. Indicators of compromise include specific hashes, IP addresses, and a wide range of suspicious domains primarily with .su and other less common TLDs. While no known exploits are currently active in the wild, the campaign’s use of legitimate Windows tools and advanced evasion techniques makes it a credible threat. The campaign leverages multiple MITRE ATT&CK techniques such as T1204.002 (User Execution), T1106 (Execution through API), T1140 (Deobfuscate/Decode Files or Information), T1055 (Process Injection), and T1547.001 (Registry Run Keys / Startup Folder), highlighting its complexity and stealth.

Detailed information about ClickFix Gets Creative: Malware Buried in Images. Get real-time updates, technical details, and mitigation strategies.


This fake Windows support website delivers password-stealing malware 0 A malicious campaign is targeting French-speaking users in an attempt to steal passwords, payment details and banking details from people across France, according to researchers at the Institute for Strategic Studies (ISS). MediumCampaign#windows update #france #microsoft Join the discussion	AlienVault OTX General	04/09/2026, 17:48:01 UTC Added: 04/09/2026, 17:50:46 UTC
ClickFix Gets Creative: Malware Buried in Images 0 A multi-stage malware execution chain originating from a ClickFix lure has been discovered, leading to the delivery of infostealing malware like LummaC2 and Rhadamanthys. The campaign utilizes steganography to hide malicious code within PNG images. Two distinct ClickFix lures were observed: a standard 'Human Verification' and a convincing fake Windows Update screen. The execution chain involves mshta.exe, PowerShell, and .NET assemblies, ultimately extracting and injecting shellcode into target processes. The steganographic technique encodes malicious data directly into image pixel data, using specific color channels for payload reconstruction and decryption in memory. This sophisticated approach helps evade signature-based detection and complicates analysis. MediumMalwareGermanyFranceUnited Kingdom+5#multi-stage #social engineering #steganography Join the discussion	AlienVault OTX General	11/24/2025, 21:10:01 UTC Added: 11/25/2025, 09:13:18 UTC

Threats Tagged 'windows update'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'windows update'

Lead Pen Test Professional