Security researchers have uncovered a sophisticated attack campaign, dubbed Operation PhantomCLR, that leverages a legitimate, digitally signed Intel utility to secretly deploy malware. This advanced technique, known as AppDomain hijacking, allows attackers to turn trusted Intel software into a malware launcher without altering the original code. The primary targets of…

A sophisticated new malware campaign is distributing both Gh0st Remote Access Trojan (RAT) and CloverPlus adware simultaneously, presenting a significant new threat to cybersecurity. Threat actors are employing a single, obfuscated loader designed to infect victim machines with both powerful remote access capabilities and intrusive advertising software. This dual-payload approach…

A new investigation has revealed that Iran’s Ministry of Intelligence and Security (MOIS) is orchestrating a sophisticated, multi-faceted cyber campaign utilizing at least three distinct hacker personas: Homeland Justice, Karma/KarmaBelow80, and Handala. Previously perceived as independent hacktivist groups, these entities have now been confirmed to be operating under a unified,…

A sophisticated cybersecurity campaign, reportedly orchestrated by a North Korean threat group known as UNC1069, is targeting cryptocurrency and Web3 professionals. The group employs deceptive tactics, luring victims into fake online meetings orchestrated through imitation video conferencing platforms. This operation’s primary objective is to compromise user devices and steal digital…

Threat actors are increasingly weaponizing QEMU, a legitimate open-source machine emulator and virtualizer, to establish stealthy backdoors for credential theft and ransomware deployment. This alarming trend involves leveraging the virtualization technology to bypass endpoint security solutions, making attacks harder to detect and contain within enterprise networks. Sophos analysts are investigating…

A sophisticated new cyberattack campaign is exploiting legitimate Microsoft collaboration tools, specifically Microsoft Teams and Quick Assist, to impersonate IT helpdesk personnel. Threat actors are leveraging these familiar platforms to trick employees into granting unauthorized remote access to their computer systems, bypassing traditional security measures. This concerning trend highlights a…

A new ransomware strain named JanaWare is actively targeting home users and small to medium-sized businesses primarily in Turkey. This threat leverages a customized version of the Adwind Remote Access Trojan (RAT) as its initial entry vector. The campaign has been noted for its specific geographic focus, relatively low ransom…

A sophisticated Android malware campaign is actively distributing dangerous payloads, including infostealers, RATs, and banking trojans, through a multi-stage delivery system known as MiningDropper. Researchers have identified a significant increase in activity, with threat actors utilizing phishing pages, social media links, and fake websites mimicking trusted services to trick users…

A new malware-as-a-service (MaaS) platform named FUD Crypt is significantly lowering the barrier to entry for sophisticated cyberattacks. By allowing users to upload any Windows executable and receive a fully packaged, polymorphic malware payload, FUD Crypt offers attackers potent tools with built-in persistence and command-and-control (C2) capabilities for a monthly…

New research from cybersecurity firm GreyNoise suggests that attackers signal their intent to exploit edge device vulnerabilities days or weeks before public disclosure. This discovery, based on monitoring network traffic, offers a potential early-warning system for organizations to bolster their defenses against impending cyber threats. GreyNoise’s analysis, spanning 103 days…

A newly identified botnet campaign is actively exploiting a critical flaw in TBK digital video recorders (DVRs) to deploy a dangerous piece of malware known as Nexcorium. This Mirai-based threat is specifically engineered to launch large-scale distributed denial-of-service (DDoS) attacks, posing a significant risk to online services and infrastructure. The…

A significant surge in email-borne worms targeting industrial control systems (ICS) during the fourth quarter of 2025 has introduced a new wave of threats to operational technology (OT) environments globally. This escalation is primarily attributed to a single piece of malware, Backdoor.MSIL.XWorm, which spread rapidly via phishing emails. The malicious…