At a glance Field Detail Actor / group BlueNoroff (TA444), a subgroup of North Korea’s Lazarus Group Activity type ClickFix phishing kit faking Zoom and Teams meetings Targets Web3 and crypt…

At a glance Malware family CastleLoader (loader); payloads include CastleStealer, NetSupport RAT, Lobshot, and NeedleStealer Threat actor Not named in this report; the loader is publicly tied to a…

A routine internet search can culminate in a full macOS compromise – one in which a counterfeit system update prompt manipulates the user into executing a malicious command themselves, and t…

At a Glance Attribute Detail Malware family Interlock ransomware (double extortion) Threat actor Interlock, tracked by Sophos as GOLD EMBRACE (confirmed) Target / victims Critical infrastructure, …

At a glance Malware family MaaS infostealer delivered via SmartLoader (NodeJS strain among final payloads) Threat actor Operators behind TroyDen’s “lure factory” (suspected, not …

At a Glance Attribute Detail Malware family DOUBLECUP (Loader-as-a-Service); payloads CountLoader 4.5p and DeviceManager RAT Threat actor Rognar, a Russian operator (confirmed by SOCRadar) Target …

At a glance Malware family Atomic Stealer (AMOS) and MacSync infostealers Threat actor Unnamed operator running a Traffic Distribution System (attribution not stated) Target or victims Genuine mac…

A familiar humanity check has suddenly become a gateway into the corporate network. Microsoft has disclosed a campaign named TerminalFix, in which compromised websites display a counterfeit Cloudf…

At a Glance Category Details Malware Family Amatera (rebrand of ACR Stealer / AcridRain) Threat Actor Unattributed (overlaps with ErrTraffic Malware-as-a-Service ecosystem) Target or Victims Visit…

Sometimes, threat actors utilize video files not for mere viewing, but for cunning concealment. Censys specialists recently discovered a sophisticated malware campaign. This campaign actively depl…