Research reports
1,224 reports from 387 publishers45 added in the past week
Added Fri 31 Jul
Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan
Socket proactively blocks malicious open source packages in your code. Install Two npm beta releases in the @joyfill namespace contain an import-time JavaScript implant that resolves encrypted code through Tron, Aptos, and BNB Smart Chain transactions. Static…
MalwareSupply chain
Compromised npm Packages: @joyfill/components and @joyfill/layouts Ship an Obfuscated Remote Access Trojan
On July 28, 2026, malicious beta versions of two Joyfill npm packages, @joyfill/components and @joyfill/layouts , were published to the npm registry. Both versions carry the same heavily obfuscated payload injected into the built distribution bundles. The…
MalwareSupply chain
Someone's Hands Are on Your Keyboard Then Your Whole Network. Courtesy of ClickFix, Potemkin, RMMProject and EtherRAT
Huntress previously documented a ClickFix case in February involving lateral movement and the delivery of malware-as-a-service loader Matanbuchus and a novel custom implant called AstarionRAT. In a new case in May 2026 , we observed another ClickFix infection…
Malware
Added Wed 29 Jul
AsyncRAT Family Threat Overview
AsyncRAT is a family of open-source Windows remote access trojans (RATs): an original codebase that has been forked repeatedly into dozens of descendant malware families. Its most prolific descendant, DCRAT (also known as DarkCrystal RAT), spawned a second…
Malware
Added Tue 28 Jul
MalwareAnalysisReports/LockBit5.0/Lockbit 5.0 loader analysis.md at main · VenzoV/MalwareAnalysisReports
By VenzoV Sample Information SHA256 180e93a091f8ab584a827da92c560c78f468c45f2539f73ab2deb308fb837b38 Summary of execution flow JMP address values iare obfuscated using opaque predicates and MBA. Antidebug checks( NtGlobalFlag,PEB-> BeingDebugged,…
RansomwareMalware
UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign
Cisco Talos is disclosing UAT-11795, a sophisticated, Russian-speaking, financially motivated adversary that has been conducting a malicious campaign targeting users in the U.S. and Europe since at least June 2025. Talos has discovered that the actor in this…
Malware
Added Thu 23 Jul
GitHub - muhammadzidane632/Hopeless: Ransomware Wiper Bootkit Hybrid (Real Author Only Zdn2Pwn) Look at Date the Initial Commit
A C-based malware research framework designed to demonstrate advanced multi-stage system compromise techniques on Windows. This project is intended solely for educational purposes, security research, and understanding offensive techniques in a controlled…
RansomwareMalware
Added Wed 22 Jul
Operation Turb00 — Part 3: Unmasking the SnappyClient RAT
The orchestrator behind the first chain, WizardDa42.exe (the legitimate Radmin VPN process), also launches this second one. Beyond that shared parent process, the two have nothing in common, as
Malware
SnappyClient
SnappyClient is a C++-based C2 implant first identified in December 2025, delivered through the HijackLoader malware loader. It combines remote access (terminal, process control, file management) with data theft (keylogging, screenshots, browser and crypto…
Malware
Anomali Cyber Watch: F5 Breach, Mysterious Elephant APT, Malicious MCP Servers, and More
Jewelbug APT Executes Five-Month Espionage Against Russian IT Provider When Trusted AI Connections Turn Hostile LinkPro Linux Rootkit Exposes Deep Stealth Threat to Cloud & Linux Environments Silver Fox Expands Winos 4.0 Attacks to Japan and Malaysia via…
State-sponsoredMalware
Added Tue 21 Jul
Sequel to ChainVeil npm malware: ViteVenom
When we published our ChainVeil report in June 2026, we noted something that didn’t fit: the SuccessKey campaign’s Command and Control (Command and Control (C2)) infrastructure contained a secondary server at 198.105.127[.]210 and a tertiary server at…
MalwareSupply chain
ChainVeil and ViteVenom are DPRK’s PolinRider Campaign
On June 16, 2026, Checkmarx Zero published a detailed breakdown of an npm supply chain campaign they named "ChainVeil." It's careful work: they pulled together nine malicious packages, a 77KB remote access trojan (RAT), a four-tier blockchain command channel…
MalwareSupply chain
TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel Industry
Attackers are targeting employees of Booking.com partner companies in Japan, using phishing emails that impersonate guest complaints and review requests to trick hotel staff into executing malicious files. Multiple email delivery methods were observed,…
MalwarePhishing
Added Sat 18 Jul
Malware-Slop: Crypto Stealer Impersonating Polymarket Exposes Its Own Credentials
Then Exposes Its Own GitLab Credentials Overview The OX Research team recently discovered a malicious npm package cryptocurrency theft and credential exfiltration campaign. The package specifically impersonates target high-value crypto users. In a new…
MalwareInfostealersSupply chain
Added Fri 17 Jul
Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access
By Microsoft Defender Security Research Team, Microsoft Defender Experts, Parth Jomadkar Microsoft Threat Intelligence has identified an active multi-stage intrusion campaign targeting organizations in the hospitality and hotel industry since April 2026.…
Malware
Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor
Backdoor.Daxin, the China-linked kernel-mode rootkit that Symantec first uncovered and exposed in 2022, is still operational. It was found running on a compromised host in Taiwan in 2026, more than four years after it was first uncovered. On the same machine,…
Malware
Introducing CylindricalCanine: The GoldenEyeDog subgroup responsible for the April DigiCert incident
Chinese cybercrime group, GoldenEyeDog, has been regularly updating their malware and tactics since 2015. We’ve observed them regularly leveraging code-signing certificates to bypass Windows’s SmartScreen since 2024. They leverage several malware, including…
Malware
Added Tue 14 Jul
UAT-7810 continues building ORB networks using new malware
Cisco Talos is actively tracking infrastructure and malware associated with UAT-7810, an advanced persistent threat (APT) actor responsible for maintaining and proliferating the LapDogs Operational Relay Box (ORB) network, first disclosed by SecurityScorecard…
Malware
Analysis of Ongoing Ousaban Attacks Targeting the Iberian Peninsula
In May 2026, FortiGuard Labs identified an attack targeting users in Spain and Portugal involving the banking Trojan Ousaban. This malware has been active in Brazil and is spread through an MSI downloader. The malicious payload involves a DLL file that is run…
Malware
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.