Research reports
1,224 reports from 387 publishers45 added in the past week
5 reports, newest added first
Added Sat 24 Oct
Auditing the auditor: Unmasking Apex Accelerator
Elastic Security Labs identified a malicious npm package, @apexacc/cli , which led us to an operation posing as a Web3 accelerator. That operation had spent months building a public presence, targeting cryptocurrency start-ups and founders with offers of free…
Malware
Added Tue 13 Oct
Phantom in the vault: Obsidian abused to deliver PhantomPulse RAT
If you're interested in a deeper technical analysis of PHANTOMPULSE itself, covering its injection engines, persistence internals, and C2 protocol in greater detail, check out this follow-on analysis of the PHANTOMPULSE malware. Preamble Elastic Security Labs…
Malware
Added Tue 8 Sep
Shedding light on the ABYSSWORKER driver
Cybercriminals are increasingly bringing their own drivers — either exploiting a vulnerable legitimate driver or using a custom-built driver to disable endpoint detection and response (EDR) systems and evade detection or prevention capabilities. Elastic…
Malware
Added Fri 14 Aug
TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains
Elastic Security Labs is tracking an emerging threat named TELEPUZ, which we have discovered spreading widely via a CLICKFIX-VIDAR chain. This malware is in active development and has been operating since late April 2026, according to the infrastructure…
MalwareInfostealers
Added Thu 21 May
TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook
Elastic Security Labs identified a new Brazilian banking trojan that we are tracking as TCLBANKER, a malware family we assess is a major update of the MAVERICK/SORVEPOTEL family. The campaign, tracked as REF3076, features a loader with robust anti-analysis…
Malware
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.