A familiar humanity check has suddenly become a gateway into the corporate network. Microsoft has disclosed a campaign named TerminalFix, in which compromised websites display a counterfeit Cloudf…

At a Glance Category Details Malware Family Amatera (rebrand of ACR Stealer / AcridRain) Threat Actor Unattributed (overlaps with ErrTraffic Malware-as-a-Service ecosystem) Target or Victims Visit…

Sometimes, threat actors utilize video files not for mere viewing, but for cunning concealment. Censys specialists recently discovered a sophisticated malware campaign. This campaign actively depl…

At a glance Category Details Campaign / Family TerminalFix (ClickFix variant) Threat Actor Unattributed (Tracked across ongoing intrusion clusters) Targets Enterprise networks across multiple glob…

At a Glance Malware type Browser-injected web skimmer Threat actor Unattributed; linked to “The Protocol One” persona Targets Crypto traders using SwapZone and SimpleSwap Delivery vect…

ClickFix has abandoned its habit of knocking at PowerShell and has taken up residence directly inside the browser. Cisco Talos has disclosed a campaign in which the victim is invited to paste Java…

At a glance Security researchers at Seqrite APT Team uncovered an evasive malware campaign targeting Apple enterprise users. This newly analyzed threat, known as the MacSync macOS stealer, tricks …

From junk-variable soup to real IOCs: a static analysis walkthrough of a ClickFix malware loader and the supply-chain attack that helped…

Blackpoint Cyber found ChainScript, a Node.js RAT spread through fake Spotify, Zoom and Teams installers that uses Polygon smart contracts to locate its C2 server.

Varonis Threat Labs discovered AvisLoader, a Windows malware loader that uses the Tox peer-to-peer network for C2 and arrives through a malicious ClickFix lure.

A perilous trap may now await visitors upon seemingly familiar digital terrain: malicious actors have systematically compromised several legitimate Ukrainian websites, covertly embedding a fraudul…

A mundane, ubiquitous example URL embedded within countless developer documentation files has horrifyingly metamorphosed into a live attack vector. The specific domain, third-party[.]com, historic…

The most compelling element of this novel cyberattack resides not upon a disparate phishing domain, but directly within the authentic ChatGPT interface. Huntress unveiled a sophisticated campaign …

At a glance Malware family Warden Stealer (earlier tracked by Gen as CallbackBeaver) Threat actor Unnamed MaaS authors; suspected to operate in Russian-speaking cybercrime circles Targets Windows …

Threat actors have weaponized Google advertisements and Bing’s redirection architecture, forging an elaborate snare for macOS users seeking the Claude application. Analysts have unearthed a …

Ontinue’s 1H 2026 threat report shows attackers increasingly abusing Microsoft Teams, npm packages, device-code logins and blockchain ClickFix tactics to steal access and spread malware.

TL;DR On October 19, 2026, Siemens confirmed that attackers are exploiting CVE-2026-110936 in the wild. The Siemens Software Center vulnerability is a DLL sideloading flaw that a ClickFix campaign…

Google Upgrades Enhanced Protection in Chrome Google has unveiled new Enhanced Protection features for Chrome, detailed in its post on the latest defenses against evolving web scams. The additions…

Protections have been added against scams and social engineering, including new site warnings and server-side Gemini analysis.

At a glance Malware family Doina loader, a Node.js malware module, suspected Lumma Stealer, and a pirated NetSupport RMM client Threat actor Unknown; no attribution Targets Windows and macOS users…