At a glance Malware family ClickLock Stealer (new, named by Group-IB) Threat actor Unattributed. No actor or group named. Target / victims macOS users, especially crypto holders. At least 100 vict…

At a glance Malware family TELEPUZ Threat actor Unnamed; suspected solo developer or small team running a MaaS Target / victims Windows users reached through compromised web pages Delivery vector …

At a glance Actor / group UAT-11795 (suspected Russian-speaking, financially motivated) Activity type Credential and cryptocurrency theft via trojanized software installers Targets / victims Windo…

At a glance Malware family ACR Stealer (infostealer; linked to a rebrand of Amatera Stealer) Threat actor No named actor; sold via malware-as-a-service (MaaS) Target / victims Enterprise Windows e…

A recent cyberattack targeted a financial institution using a ClickFix social engineering lure. This incident revealed an evolving TAG-150 attack chain. Security researchers from eSentire Threat R…

Evolution of the Golden Chickens Ecosystem Cybercriminals operating within the TAG-195 ecosystem have fundamentally restructured their malware architecture, adopting a highly modular approach. Con…

At a glance Threat actor Famous Chollima, also called Wagemole; North Korea-aligned Activity type Social engineering via fake job interviews; ClickFix lures delivering RATs Targets Crypto and Web3…

At a glance Actor or group TAG-195, also tracked as Golden Chickens and Venom Spider; deployment observed by an operator tracked as TAG-127 Activity type Malware-as-a-service development; credenti…

At a glance Field Detail Actor / group BlueNoroff (TA444), a subgroup of North Korea’s Lazarus Group Activity type ClickFix phishing kit faking Zoom and Teams meetings Targets Web3 and crypt…

At a glance Malware family CastleLoader (loader); payloads include CastleStealer, NetSupport RAT, Lobshot, and NeedleStealer Threat actor Not named in this report; the loader is publicly tied to a…

A routine internet search can culminate in a full macOS compromise – one in which a counterfeit system update prompt manipulates the user into executing a malicious command themselves, and t…

At a Glance Attribute Detail Malware family Interlock ransomware (double extortion) Threat actor Interlock, tracked by Sophos as GOLD EMBRACE (confirmed) Target / victims Critical infrastructure, …

At a glance Malware family MaaS infostealer delivered via SmartLoader (NodeJS strain among final payloads) Threat actor Operators behind TroyDen’s “lure factory” (suspected, not …

At a Glance Attribute Detail Malware family DOUBLECUP (Loader-as-a-Service); payloads CountLoader 4.5p and DeviceManager RAT Threat actor Rognar, a Russian operator (confirmed by SOCRadar) Target …

At a glance Malware family Atomic Stealer (AMOS) and MacSync infostealers Threat actor Unnamed operator running a Traffic Distribution System (attribution not stated) Target or victims Genuine mac…