Research reports
1,224 reports from 387 publishers45 added in the past week
294 reports, newest added first
Added Fri 22 May
LATAM Businesses Hit by XWorm via Fake Financial Receipts: Full Campaign Analysis
Editor’s note: The current article is authored by Moises Cerqueira, malware researcher and threat hunter. You can find Moises on LinkedIn. Malware campaigns targeting Latin America (LATAM) are evolving. While the final payloads, often commodity RATs like…
Malware
Added Thu 21 May
Lorem Ipsum Malware: Trojanized MS Teams Installers Deliver…
Lorem Ipsum Malware: Trojanized MS Teams Installers Deliver Multi-Stage Loader and Backdoor May 4, 2026 | 18 min read What Happened? BlueVoyant Security Operations Center (SOC) and Threat Fusion Cell (TFC) security researchers have been tracking an emerging,…
Malware
TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook
Elastic Security Labs identified a new Brazilian banking trojan that we are tracking as TCLBANKER, a malware family we assess is a major update of the MAVERICK/SORVEPOTEL family. The campaign, tracked as REF3076, features a loader with robust anti-analysis…
Malware
Added Wed 20 May
OpenClaw’s Hologram: Fake Installer Ships Rust Infostealer
Netskope Threat Labs has found a fake OpenClaw installer delivering red-team-grade capabilities—all pointed at stealing credentials from over 250 crypto wallet and password manager extensions. The dropper’s manifest doesn’t hide the intent: “Hologram – Decoy…
MalwareInfostealers
Zynap’s Next-Gen Sandbox Redefines Automatic Malware Analysis
In simple terms, a hook is like placing a “sensor” on certain operating system functions: every time the malware calls that function, the sensor records the action. This allows us to observe what the malware does without having to perform a manual…
Malware
Added Tue 19 May
MacOS malware persistence 11: osascript LOLBin. Simple C example
Hello, cybersecurity enthusiasts and white hackers! Continuing the macOS malware persistence series. Today we look at another Apple-signed LOLBin: osascript - the command-line interpreter for AppleScript and JavaScript for Automation (JXA). Used in the wild…
Malware
Malware analysis with IDA/Radare2 - Multiple unpacking (Ramnit worm)
Today we are following our previous post on these series unpacking a sample (Ramnit) that looks a bit more complex as it performs multiple unpacking, combining own methods with an open source packer. As this piece of malware is relatively old, I’ll be using a…
Malware
Kazuar: Anatomy of a nation-state botnet
Kazuar, a sophisticated malware family attributed to the Russian state actor Secret Blizzard, has been under constant development for years and continues to evolve in support of espionage-focused operations. Over time, Kazuar has expanded from a relatively…
State-sponsoredMalwareBotnets and DDoS
LATAM Under Siege: Agent Tesla’s 18-Month Credential Theft Campaign Against Chilean Enterprises
Editor’s note: The analysis is authored by Moises Cerqueira, malware researcher & threat hunter. You can find Moises on LinkedIn and X. Credential theft malware rarely announces itself with ransomware-level noise. Instead, it operates like a silent siphon…
Malware
New TrickMo Variant: Device Take Over malware targeting Banking, Fintech, Wallet & Auth apps
Modern Android banking malware increasingly evolves through architectural redesigns intended to improve stealth, resilience, and operational flexibility rather than through entirely new user-facing capabilities. As platform protections and detection measures…
MalwareMobile
Malware analysis with IDA/Radare2 - Basic Unpacking (Dridex first stage)
Greetings again dear malware analysts! In this part of the series we are leaving the initial topics behind to start focusing on unpacking/decrypting malware by applying our reverse engineering skills to those binaries. We will start by unpacking the initial…
Malware
Analysis on Malware that attacks Israel’s Water treatment facilities
I go after the entry point of the malware and right away we can see that there’s only three main functions. This makes it easier for us to analyze the malware. I’m not sure why the author did not add a layer of obfuscation to the binary to make it hearder to…
Malware
Added Thu 14 May
Kaspersky discovers Keenadu – a multifaceted Android malware that can come preinstalled on new devices
Kaspersky has detected a new malware for Android devices that it dubbed Keenadu. This malware is distributed in multiple forms – it can be preinstalled directly into devices’ firmware, embedded within system apps, or even downloaded from official app stores…
MalwareMobile
jsonspack: Multi-Tenant Node.js RAT — DPRK Supply Chain Campaign
Note — jsonspack vs legitimate jsonpack : jsonpack is a legitimate npm JSON compression library published by sapienlab in 2013, maintained through 2022, with 1.1.5 as the final version.P2 (Footnote prefixes: E = evidence, P = prior art, R = references, A =…
MalwareSupply chain
SpiderLabs IDs New Banking Trojan Distributed Through WhatsApp
November 19, 2025 10 Minute Read by Nathaniel Morales, John Basmayor, and Nikita Kazymirskyi LevelBlue SpiderLabs researchers have recently identified a banking Trojan we dubbed Eternidade Stealer, which is distributed through WhatsApp hijacking and social…
Malware
Threat Actor Mr_Rot13 Actively Exploits CVE-2026-41940 for Backdoor Deployment
CVE-2026-41940 is a high-severity unauthenticated authentication bypass vulnerability affecting cPanel & WHM. This product is widely used in Linux server operations and virtual hosting management. The vulnerability has a CVSS score as high as 9.8 (Critical).…
MalwareVulnerabilities
A Slopoly start to AI-enhanced ransomware attacks
In early 2026, IBM X-Force discovered a likely AI-generated novel malware which we are dubbing “Slopoly,” used during a ransomware attack. The operators are part of a group tracked as Hive0163, whose main objective is extortion through large-scale data…
RansomwareMalwareAI
Inside Shadow-Earth-053: A China-Aligned Cyberespionage Campaign Against Government and Defense Sectors in Asia
Table 1. Legitimate executables vulnerable to DLL sideloading abused by SHADOW‑EARTH‑053 SHADOW-EARTH-053 uses a legitimate Toshiba Bluetooth Stack executable, renamed to CIATosBtKbd.exe, to sideload a malicious DLL (TosBtKbd.dll). This loader employs a…
Malware
Added Tue 12 May
LevelBlue Labs Discovers Highly Evasive, New Loader Targeting Chinese Organizations
LevelBlue Labs recently discovered a new highly evasive loader that is being delivered to specific targets through phishing attachments. A loader is a type of malware used to load second-stage payload malware onto a victim’s system. Due to the lack of…
Malware
New BoryptGrab Stealer Targets Windows Users via Deceptive GitHub Pages
The BoryptGrab campaign uses fake SEO‑optimized GitHub repositories and deceptive download pages to distribute a data‑stealing malware family that delivers multiple payloads, including a reverse SSH backdoor, to Windows users. Save to Folio Key Takeaways…
MalwareInfostealers
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.