Research reports

Joyfill npm Packages Compromised with Blockchain C2 Loader

Two beta versions published to the @joyfill npm scope on July 28, 2026 carried the same blockchain C2 loader documented in the astro.config.mjs attack. The compromised packages are @joyfill/layouts@0.1.2-2773.beta.0 and…

MalwareSupply chain

Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan

Socket proactively blocks malicious open source packages in your code. Install Two npm beta releases in the @joyfill namespace contain an import-time JavaScript implant that resolves encrypted code through Tron, Aptos, and BNB Smart Chain transactions. Static…

MalwareSupply chain

Compromised npm Packages: @joyfill/components and @joyfill/layouts Ship an Obfuscated Remote Access Trojan

On July 28, 2026, malicious beta versions of two Joyfill npm packages, @joyfill/components and @joyfill/layouts , were published to the npm registry. Both versions carry the same heavily obfuscated payload injected into the built distribution bundles. The…

MalwareSupply chain

Someone's Hands Are on Your Keyboard Then Your Whole Network. Courtesy of ClickFix, Potemkin, RMMProject and EtherRAT

Huntress previously documented a ClickFix case in February involving lateral movement and the delivery of malware-as-a-service loader Matanbuchus and a novel custom implant called AstarionRAT. In a new case in May 2026 , we observed another ClickFix infection…

Malware

An Angry Spark, or a Triangle in Disguise?

A Union-Jack-clad triangle angrily emits sparks on the screen of a retro monitor (Source: ChatGPT) On April 14, 2026, Gen Digital published “Chasing an Angry Spark”, a report about sophisticated Windows spyware that Gen saw once in 2022, and never again.…

PureLogs, PureRAT and misleading zgRAT

No excerpt available.

Malware

AsyncRAT Family Threat Overview

AsyncRAT is a family of open-source Windows remote access trojans (RATs): an original codebase that has been forked repeatedly into dozens of descendant malware families. Its most prolific descendant, DCRAT (also known as DarkCrystal RAT), spawned a second…

Malware

JadePuffer Becomes the First Ransomware Campaign to Let an AI Agent Run the Entire Attack

No excerpt available.

RansomwareVulnerabilities

ClickFix × HijackLoader: Dissecting a Live Stealer Campaign - Part 2

In Part 1, I walked through the full delivery chain, from the ClickFix lure through the MSI package, both loader stages, and into the ti64 orchestrator. By the end, the syscall table was built, ntdll was unhooked, and TinyCallProxy64 was loaded into the…

Infostealers

public-research/reports/2026-07-24-jackskid-residential-proxy-upnp.md at main · deepfield/public-research

Most residential-proxy malware works hard to stay invisible. The infected device dials out to a director, holds the connection open, and tunnels customer traffic back through it. Nothing listens; nothing is reachable from the internet; the only footprint is…

ClickFix × HijackLoader: Dissecting a Live Stealer Campaign - Part 1

While browsing, I randomly came across an ad telling me that human verification was required. Curious, I followed it. The site it led to was simple. Just a lonely button, asking me to click it to prove I was human. Once I did, I was given instructions: press…

Infostealers

MalwareAnalysisReports/LockBit5.0/Lockbit 5.0 loader analysis.md at main · VenzoV/MalwareAnalysisReports

By VenzoV Sample Information SHA256 180e93a091f8ab584a827da92c560c78f468c45f2539f73ab2deb308fb837b38 Summary of execution flow JMP address values iare obfuscated using opaque predicates and MBA. Antidebug checks( NtGlobalFlag,PEB-> BeingDebugged,…

RansomwareMalware

VoidStealer: Debugging Chrome to Steal Its Secrets

VoidStealer is the first infostealer observed in the wild adopting a novel debugger-based Application-Bound Encryption (ABE) bypass technique that leverages hardware breakpoints to extract the v20_master_key directly from browser memory. The bypass requires…

Cavern Manticore: Exposing Iran-Linked Modular C2 Framework

Note: SysAid was not compromised, and no SysAid vulnerability was involved. The attacker had already gained access to the victim environment and abused a legitimate software-deployment feature to deploy malware onto another machine within it. Key Points Check…

Latest Cyber Threat Intelligence & Security Insights

The cyber threat landscape has witnessed the emergence of the Scattered LAPSUS$ Hunters (SLSH), a highly effective threat actor collective formalized in 2025. SLSH represents a dangerous fusion of methodologies and personnel from Scattered Spider…

State-sponsored

Proxying to Compromise: SonicWall Secure Mobile Access 0-day Exploitation

In early July 2026, Volexity was engaged to perform an incident response investigation where it discovered a threat actor had successfully compromised SonicWall Secure Mobile Access (SMA) VPN appliances through a chain of multiple zero-day exploits in the…

VulnerabilitiesMobile

Multiple Threat Actors Leveraging CVE-2025-55182 (React2Shell)

Executive Summary Multiple vendors have observed active exploitation of CVE-2025-55182, a critical remote code execution vulnerability in React Server Components and frameworks like Next.js. Multiple threat actors, including China-nexus and North Korea-nexus…

Vulnerabilities

AI Security Incident Case: JadePuffer Ransomware Leverages AI Agent to Automate Attacks

In early July 2026, security firm Sysdig publicly disclosed a new type of ransomware attack. After gaining initial access by exploiting a Langflow vulnerability (CVE-2025-3248), the JadePuffer ransomware leveraged a Large Language Model (LLM) agent to…

RansomwareVulnerabilitiesAI

UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign

Cisco Talos is disclosing UAT-11795, a sophisticated, Russian-speaking, financially motivated adversary that has been conducting a malicious campaign targeting users in the U.S. and Europe since at least June 2025. Talos has discovered that the actor in this…

Malware

GodDamn Ransomware: Latest Beast Rebrand Uses Malicious Driver to Disable Defenses

Analysis of a recent GodDamn ransomware attack indicates that this seemingly new ransomware is in fact the latest rebrand of the Beast ransomware, which in itself was a rebrand of the Monster ransomware, which was first seen in 2022. The Symantec Threat…

Ransomware