Research reports

Vidar v1.5 in Go: same family, new language, heavy sandbox checks

Vidar is a name most infostealer trackers know well -- an Arkei descendant that has been snatching browser credentials and crypto wallets since 2018. It usually ships as a .NET binary or a C++ PE. The v1.5 sample we pulled from Triage on May 13, 2026 is…

Infostealers

Inside Trickbot, Russia’s Notorious Ransomware Gang

Internal messages WIRED has viewed shed new light on the operators of one of the world's biggest botnets. Photograph: katleho Seisa/Getty Images When the phones and computer networks went down at Ridgeview Medical Center’s three hospitals on October 24, 2020,…

Ransomware

StealC Is Back, and This Time It's a RAT

In June, Europol tore down StealC, a prominent infostealer, as part of Operation Endgame. International authorities seized 326 servers and 142 domains, recovered more than 25 million stolen credentials from 385,000 infected machines, and pulled the plug on…

MalwareInfostealersTakedowns and arrests

Tracking BokBot (IcedID) Infrastructure

BokBot (also known as IcedID) started life as a banking trojan using man-in-the-browser attacks to steal credentials from online banking sessions and initiate fraudulent transactions. Over time, the operator(s) of BokBot have also developed its use as a…

Malware

MalwareBazaar - GCleaner

No excerpt available.

Silent Push Identifies More Than 10,000 Infected IPs as Part of SystemBC Botnet Malware Family

Using a custom-built SystemBC tracker, Silent Push Preemptive Cyber Defense Analysts identified more than 10,000 unique infected IP addresses as part of this botnet. While we don’t have immediate visibility on any follow-on malware payloads deployed via this…

MalwareBotnets and DDoS

The DGA of Sisron

Sisron was part of a financial fraud and identity theft botnet. It was taken down by Microsoft in the anti-botnet operation B106. The malware uses a very simple domain generation algorithm (DGA) that produces sets of similar looking domains. mjawmjiwmtia.com…

Botnets and DDoS

Trust the Tunnel, Get the Trojan: Silver Fox Delivers Atlas RAT via Weaponized VPN Installers

Overview of the Silver Fox AtlasCross campaign kill chain, from typosquatted lure domains through the triple-nested Setup Factory installer to fileless AtlasCross RAT deployment. Executive Summary A multi-stage remote access trojan campaign is actively…

MalwareSupply chain

Gozi: The Malware with a Thousand Faces

Most of the time, the relationship between cybercrime campaigns and malware strains is simple. Some malware strains, like the gone-but-not-forgotten GandCrab, are intimately tied to a single actor, who is using the malware directly or distributing it via an…

Malware

MoqHao Part 1: Identifying Phishing Infrastructure

In mid-January, Twitter users @NaomiSuzuki_ and @KesaGataMe0 identified nearly 20 malicious phishing domains spoofing AEON Bank in Japan. The domains were tied to MoqHao, a malware family targeting Android OS devices, primarily in Japan, South Korea, and…

Phishing

Lemon Group’s Cybercriminal Businesses Built on Preinfected Devices

Note: This group's name is a generic identification based on components found during our investigation, and it might be used by other legitimately registered companies that legally render services and products. The illicit entity "Lemon Group" identified here…

Threat Group Cards: A Threat Actor Encyclopedia

Home > List all groups > List all tools > List all groups using tool Retefe (Android) Tool: Retefe (Android) Names Retefe (Android) Category Malware Type Banking trojan, Backdoor, Info stealer, Credential stealer, Botnet (GovCERT.ch) Recently, some anti-virus…

MalwareInfostealersMobile

Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic

A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini,…

MalwareSupply chain

Investigating Ephemeral Supply Chain Tampering

Google Threat Intelligence Group (GTIG) and Mandiant investigated a software supply chain compromise campaign targeting the update infrastructure belonging to AOMEI Technology between April 2026 and July 2026. The threat actor conducted repeated, short-burst…

Supply chain

GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories

The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file. The latest…

Infostealers

Auditing the auditor: Unmasking Apex Accelerator

Elastic Security Labs identified a malicious npm package, @apexacc/cli , which led us to an operation posing as a Web3 accelerator. That operation had spent months building a public presence, targeting cryptocurrency start-ups and founders with offers of free…

Malware

GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font File

We’ve discovered a new element to the GhostAction campaign, which steals secrets through malicious GitHub Actions workflows. It now has a second stage that persists even if the victim has removed the malicious workflow. Existing Stage 1: Use stolen GitHub…

Infostealers

ARMORY CASTLE Exploits BeyondTrust

Written by: Jayson Frost, Bryce Greathouse, Brian Meyer, John Palmisano, Rajesh Rajeshirke, Steve Rasch, John Wolfram Introduction On October 15, BeyondTrust disclosed a vulnerability, CVE-2026-102764, impacting BeyondTrust Remote Support (formerly Bomgar)…

Vulnerabilities

The GhostAction Campaign: 3,325 Secrets Stolen Through Compromised GitHub Workflows

TL;DR: GitGuardian discovered and investigated the GhostAction campaign, which compromised 327 GitHub users across 817 repositories, stealing 3,325 secrets through malicious workflows disguised as "Github Actions Security." Attackers extracted PyPI, npm,…

Supply chain

Supply-Chain Compromise via AOMEI Backupper

Published in coordination with Google Threat Intelligence Group and Mandiant. Their report on the wider UNC7017 campaign is available here. Detection: On 28 May 2026, ManageEngine EDR recorded AOMEI Backupper installing Radmin, a commercial…

Supply chain