AsyncRAT
TRENDING TOPICS JUNE 17, 2025 Update: Fileless AsyncRAT Campaign Targets Users with Fake Verification Prompts A sophisticated campaign leveraging the fileless variant of AsyncRAT has been uncovered, attributed to cybercriminal groups that employ deceptive tactics to infiltrate users' systems. While the specific threat actor behind this campaign has not
GitHub
TRENDING TOPICS JUNE 13, 2025 GitHub Device Code Flow is the New Backdoor for Phishing Attacks A new phishing technique quietly targets developers by misusing GitHub’s OAuth 2.0 Device Code Flow, a login method originally intended for smart devices and limited-input systems. Attackers start by requesting a real
Interlock
Ransomware Groups Comparison Chart Detailed Analysis: Interlock, Rhysida & Vice Society Characteristic INTERLOCK RHYSIDA VICE SOCIETY First Observed September 2024 May 2023 June 2021 Operational Model Ransomware-as-a-Service (RaaS) Ransomware-as-a-Service (RaaS) Initially not RaaS Later evolved to use various payloads File Extension .interlock .rhysida .v-society .v-s0ciety Multiple commodity extensions Primary Target
CVE-2025-47934
TRENDING TOPICS MAY 23, 2025 OpenPGP.js Flaw (CVE-2025-47934): Critical Signature Spoofing Vulnerability in JavaScript Encryption Library A critical flaw in OpenPGP.js, a widely used JavaScript library for handling encrypted email, could allow attackers to spoof digital signatures and make tampered messages appear authentic. Tracked as CVE-2025-47934, this vulnerability
APT36
TRENDING TOPICS MAY 13, 2025 Update: APT36 Adapts ClickFix Attacks to Target Linux Systems in New Campaign ClickFix, a social engineering tactic we’ve previously covered in trending topics, has now been observed in a new campaign by APT36 (Transparent Tribe), a threat group linked to Pakistan. Traditionally used to
COLDRIVER
TRENDING TOPICS MAY 08, 2025 COLDRIVER Deploys LOSTKEYS Malware in Targeted Espionage Campaign Using ClickFix COLDRIVER, a Russian state-aligned threat group also tracked as Callisto and Star Blizzard, has shifted tactics by deploying a new custom malware called LOSTKEYS. This marks a notable evolution from their typical credential phishing operations
MintsLoader
TRENDING TOPICS MAY 02, 2025 Update: MintsLoader and GhostWeaver Malware Campaigns Now Utilizing ClickFix Threat actors use a malware loader, MintsLoader, to deploy the remote access trojan GhostWeaver through increasingly sophisticated phishing and drive-by campaigns. Since early 2023, MintsLoader has used a multi-stage infection process involving obfuscated JavaScript and PowerShell
Oracle
TRENDING TOPICS APR 17, 2025 Update: Oracle Legacy Server Breach Expands in Scope, Prompts CISA Advisory In a new advisory, CISA has flagged increased breach risks following the compromise of Oracle’s legacy Cloud Classic (Gen 1) servers, building on earlier reports but now emphasizing the potential for long-term credential
Rilide
TRENDING TOPICS MAR 25, 2025 Rilide: Covert Browser Extension Malware Exploiting Chromium Platforms Rilide is a sophisticated browser extension-based malware that targets users of Chromium-based browsers, primarily Google Chrome and Microsoft Edge. Disguised as a legitimate Google Drive utility, it tricks users into installing it by presenting itself as a
VenomRAT
TRENDING TOPICS MAR 19, 2025 Update: VenomRAT Delivered Through Virtual Hard Disk Files in New Stealth Attack Cybercriminals have adopted a novel technique to distribute VenomRAT, embedding it within virtual hard disk (.VHD) image files to bypass traditional security defenses. The campaign begins with phishing emails disguised as purchase orders,