INC Ransomware Exploits SonicWall SMA 1000 Zero-Days in Widespread Attacks
INC Ransomware has emerged as the dominant threat actor exploiting recently disclosed vulnerabilities in SonicWall Secure Mobile Access (SMA) 1000 series VPN…
Tag: credential theft
GHOSTBLADE: iOS Information-Stealing Malware
GHOSTBLADE is an information-stealing malware deployed on iOS devices via the DarkSword exploit kit. It delivers keychain, iCloud, and Wi-Fi credential-dumping modules…
Chinese Threat Actor Uses Leaked DarkSword Kit to Deploy GHOSTBLADE on iOS
A Chinese-speaking threat actor has been observed running a campaign targeting Apple iOS devices by leveraging a publicly leaked version of the…
CornFlake RAT
Go-based remote access trojan delivered via fake updates in the CaptiveCrunch campaign. It captures screenshots, steals credentials, and provides remote shell access.
ChocoShell (CHERRYPIE): PowerShell Infostealer with LLM-Generated Code
ChocoShell, also known as CHERRYPIE, is a PowerShell-based infostealer delivered via ClickFix lures. It steals browser session cookies, saved passwords, Microsoft 365…
Russian Hackers Exploit Microsoft OWA Flaw to Maintain Mailbox Access After Credential Rotation
Russian threat actors linked to the exploitation of a Zimbra vulnerability have been observed exploiting CVE-2026-42897, a cross-site scripting (XSS) flaw in…
Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads
Ruby on Rails has released fixes for a critical Active Storage vulnerability, CVE-2026-66066 (CVSS 9.5), that could allow unauthenticated attackers to read…
Flying Eagle Android RAT Found on 170 Servers as Source Code Circulates
Security researchers have identified traces of the Flying Eagle Android remote access trojan (RAT) framework on 170 internet servers, as its source…
Flying Eagle Android RAT Framework
Flying Eagle is an Android remote access trojan (RAT) framework that supports payment-password and keystroke capture, screen recording, camera access, and phishing…
Two Compromised joyfill npm Packages Deliver RAT via Blockchain-Based C2
Two npm packages in the @joyfill namespace, @joyfill/layouts@0.1.2-2773.beta.0 and @joyfill/components@4.0.0-rc24-2773-beta.4, have been compromised to deliver a remote access trojan (RAT) associated with…