CYFIRMA researchers discovered Neptune RAT, an advanced Remote Access Trojan targeting Windows. Learn about its destructive features, evasion techniques, and distribution methods.

A deep dive into Lumma Stealer's sophisticated techniques: from fake CAPTCHAs to complex infection chains designed to evade detection and steal sensitive data.

Zscaler reveals TransferLoader: a stealthy malware using IPFS and obfuscation to drop ransomware and backdoors. A new threat in the wild since 2025.

A new ransomware strain, Lyrix, targets Windows systems with strong encryption, anti-analysis, and data destruction techniques. Learn how to protect your data.

APT36 is targeting Indian defense personnel with sophisticated phishing, using fake NIC documents and multi-layered malware to steal sensitive data and evade analysis.

Unit 42 exposes SLOW#TEMPEST, a new malware variant using advanced CFG obfuscation and indirect function calls to evade static analysis, making it nearly impossible to detect.

A new, highly evasive SquidLoader malware variant is targeting Hong Kong's financial institutions via phishing, bypassing antivirus and deploying Cobalt Strike Beacons.

A new report reveals a ToneShell backdoor from Mustang Panda. The malware targets Myanmar and uses anti-analysis tricks to evade detection.

CERT-UA uncovered a campaign (UAC-0245) using Signal to deliver malicious XLL files and inject the full-featured CABINETRAT backdoor. The malware evades sandboxes by checking system specs.

FortiGuard Labs identified a new Stealit malware variant abusing Node.js SEA for stealthy distribution. The campaign features a public C2 panel and uses Telegram for data exfiltration.

Unit 42 exposed PhantomVAI Loader, a stealthy MaaS tool that uses steganography (hiding DLL in images) and VM detection to deploy Katz Stealer in MSBuild.exe and exfiltrate crypto credentials globally.

BitSight uncovered a Lampion banking Trojan campaign using ClickFix lures and a 700MB bloatware DLL to evade AV. The VBScript loader establishes persistence via the Windows Startup folder.

ASEC exposed Cephalus, a Go-based RaaS group attacking RDP. The malware uses VirtualLock, XOR encryption, and a fake AES key pattern to severely complicate memory and forensic analysis.

Despite a recent doxxing attempt, Lumma Stealer has resurfaced, integrating browser fingerprinting into its C&C to collect WebGL/Canvas signatures for sandbox evasion and victim assessment.

Socket exposed a new npm attack (dino_reborn) using Adspect cloaking to hide behind a fake crypto CAPTCHA for victims, while showing a polished decoy site (Offlido) to researchers.