Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,259 reports391 publishers75 added in the past week

341–360 of 1,259 reports · page 18 of 63

Added Thu 6 Aug

Trend Micro · Web page · Published 13 May
Analyzing TeamPCP’s Supply Chain Attacks: Checkmarx KICS and elementary-data in CI/CD Credential Theft
By By: Jacob Santos, John Rainier Navato May 13, 2026 Read time: 17 min (4541 words) Summary Our research analyzed the April 22 Checkmarx Keeping Infrastructure as Code Secure (KICS) and April 24 elementary-data incidents as two case studies within a broader…
Supply chain Original (new tab)
Wiz · Web page · Published 12 May
Mini Shai-Hulud Strikes Again: TanStack more npm Packages Compromised
On 11 May 2026, TeamPCP launched a coordinated supply chain attack against the npm and PyPi ecosystems, compromising packages across multiple namespaces simultaneously. May 13, 2026 2:30 UTC update: Further analysis of the @uipath/* and @mistralai/* npm…
Supply chain Original (new tab)
Aikido · Web page · Published 20 Mar
TeamPCP deploys CanisterWorm on NPM following Trivy compromise
On 20 Mar 2026, 20:45 UTC, we detected a large number of packages being compromised on NPM with a new worm that hasn't been observed before. We're calling this specific attack CanisterWorm, because it makes use of an ICP Canister for its C2 dead-drop, which…
Supply chain Original (new tab)
Arctic Wolf · Web page · Published 24 Apr
Token Bingo: Don’t Let Your Code be the Winner
In early April 2026, Arctic Wolf began tracking a large-scale device code phishing campaign impacting organizations across multiple regions and sectors. Similar to the widespread “Riding the Rails” campaign first observed in late March by Huntress, the threat…
Phishing Original (new tab)
Mandiant (Google) · Web page · Published 11 May
Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access
Since our February 2026 report on AI-related threat activity, Google Threat Intelligence Group (GTIG) has continued to track a maturing transition from nascent AI-enabled operations to the industrial-scale application of generative models within adversarial…
Vulnerabilities Original (new tab)
Sysdig · Web page · Published 23 Mar
TeamPCP expands: Supply chain compromise spreads from Trivy to Checkmarx GitHub Actions
On March 19, 2026, the threat actor known as TeamPCP compromised Aqua Security's Trivy vulnerability scanner and its associated GitHub Actions, injecting a credential-stealing payload into CI/CD pipelines across thousands of repositories. The incident was…
Supply chain Original (new tab)
eclecticiq.com · Web page · Added 6 Aug
ShinyHunters Calling: Financially Motivated Data Extortion Group Targeting Enterprise Cloud Applications
EclecticIQ analysts assess with high confidence that ShinyHunters is expanding its operations by combining AI-enabled voice phishing, supply chain compromises, and leveraging malicious insiders, such as employees or contractors, who can provide direct access…
Ransomware Phishing Original (new tab)

Added Wed 5 Aug

Microsoft · Web page · Published 19 May
Exposing Fox Tempest: A malware-signing service operation
Fox Tempest is a financially motivated threat actor that operates a malware-signing-as-a-service (MSaaS) used by other cybercriminals to more effectively distribute malicious code, including ransomware. The threat actor abuses Microsoft Artifact Signing to…
Malware Original (new tab)
Microsoft · Web page · Published 19 May
Disrupting Fox Tempest: A cybercrime service that turned “verified” software into a pathway for ransomware
Every day, we decide what software to trust in seconds guided by simple labels such as “verified,” “secure,” and “safe to install.” The problem is that those signs can be manipulated. Today, Microsoft unsealed a legal case in the US District Court for the…
Ransomware Malware Original (new tab)
The Record · Web page · Published 19 May
Microsoft disrupts Fox Tempest malware-signing-as-a-service platform tied to ransomware gangs
Microsoft said it took down a critical service that helped cybercriminals slip through defenses by making malware look like legitimate software. The company unsealed a legal case in U.S. District Court on Tuesday detailing the disruption of Fox Tempest — a…
Ransomware Malware Original (new tab)

Added Tue 4 Aug

Fortinet · Web page · Added 4 Aug
SVG Phishing hits Ukraine with Amatera Stealer, PureMiner
Infostealers Phishing Original (new tab)
Check Point · Web page · Published 3 Jun
Impersonation, Click Hijacking, and TDS: Inside a Malware Distribution Ecosystem
Check Point Research investigated a large-scale operation that impersonates open-source and freeware projects to capture search traffic, including lookalikes for researcher and security tooling such as Ghidra, dnSpy, and SpiderFoot. The sites are…
Malware Original (new tab)
Microsoft · Web page · Published 31 Jul
CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft
Since early May 2026, Microsoft Threat Intelligence has observed Storm-2945, a sub-cluster of Midnight Blizzard, conducting widespread but targeted traffic manipulation attacks involving hospitality sector networks served by captive portals worldwide. Despite…
State-sponsored Malware Original (new tab)
Medium · Web page · Published 30 Jul
1337_GTWK Linux Malware Analysis
This is the second part of a two-part series about a new Linux malware sample that I analysed (Click here for Part 1). In Part 1, we examined its website and the malware’ itself. The malware consists of two stages, with the second stage comprising two…
Malware Original (new tab)

Added Fri 31 Jul

Medium · Web page · Published 17 Jun
MetaStealer traffic, new DGAs and analyzing the “tracker” backdoor DGA with AI
In this blog we simply want to highlight a few new additions to what appears to be related to MetaStealer, one is a new wordlist based DGA used by MetaStealer. We also want to highlight that MetaStealer’s proxies or ‘gates’ don’t actually care what domain…
Malware Original (new tab)
safedep.io · Web page · Published 29 Jul
Joyfill npm Packages Compromised with Blockchain C2 Loader
Two beta versions published to the @joyfill npm scope on July 28, 2026 carried the same blockchain C2 loader documented in the astro.config.mjs attack. The compromised packages are @joyfill/layouts@0.1.2-2773.beta.0 and…
Malware Supply chain Original (new tab)
Socket · Web page · Published 28 Jul
Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan
Socket proactively blocks malicious open source packages in your code. Install Two npm beta releases in the @joyfill namespace contain an import-time JavaScript implant that resolves encrypted code through Tron, Aptos, and BNB Smart Chain transactions. Static…
Malware Supply chain Original (new tab)
StepSecurity · Web page · Added 31 Jul
Compromised npm Packages: @joyfill/components and @joyfill/layouts Ship an Obfuscated Remote Access Trojan
On July 28, 2026, malicious beta versions of two Joyfill npm packages, @joyfill/components and @joyfill/layouts , were published to the npm registry. Both versions carry the same heavily obfuscated payload injected into the built distribution bundles. The…
Malware Supply chain Original (new tab)
Huntress · Web page · Published 16 Jun
Someone's Hands Are on Your Keyboard Then Your Whole Network. Courtesy of ClickFix, Potemkin, RMMProject and EtherRAT
Huntress previously documented a ClickFix case in February involving lateral movement and the delivery of malware-as-a-service loader Matanbuchus and a novel custom implant called AstarionRAT. In a new case in May 2026 , we observed another ClickFix infection…
Malware Original (new tab)

Added Thu 30 Jul

Medium · Web page · Published 27 Jul
An Angry Spark, or a Triangle in Disguise?
A Union-Jack-clad triangle angrily emits sparks on the screen of a retro monitor (Source: ChatGPT) On April 14, 2026, Gen Digital published “Chasing an Angry Spark”, a report about sophisticated Windows spyware that Gen saw once in 2022, and never again.…
Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.