NadMesh Botnet Targets Exposed AI Services for Cloud Credentials and Kubernetes Tokens
A new Go-based botnet named NadMesh has been discovered actively hunting exposed AI services to steal cloud credentials and Kubernetes tokens. First…
Tag: threat intelligence
SANS ISC: Documented ACR Stealer Infection via Claude Impersonation
SANS ISC handler Brad Duncan documented an ACR Stealer infection traced to a page impersonating Claude AI, reached through malicious Google ads.
LabubaRAT Masquerades as NVIDIA Software to Control Windows Hosts
Cybersecurity researchers have flagged a previously undocumented Rust-based remote access trojan (RAT) codenamed LabubaRAT that masquerades as NVIDIA software to blend into…
ZeroBAC Email Security Company
ZeroBAC is an email security company that discovered and analyzed the Forg365 PhaaS operation, providing detailed technical analysis of its capabilities.
Attacker Uses Suspected AI-Generated PowerShell Script to Map Active Directory
Cybersecurity researchers at Huntress have identified an intrusion where an unknown threat actor used a suspected AI-generated PowerShell script to enumerate Active…
Lexfo: French Cybersecurity Firm Specializing in Threat Intelligence
Lexfo is a French security company that discovered and analyzed three Evilginx phishing operations targeting Microsoft 365, leveraging a misconfigured server to…
Hunt.io: Threat Intelligence and Investigation Platform
Hunt.io is a cybersecurity company that provides threat intelligence and investigation services. In August 2026, Hunt.io disclosed details of Operation CameraSwarm, a…
Binary Defense: Cybersecurity Firm
Binary Defense identified the same malware as BLUERABBIT and tied it to an Iran-nexus group targeting Israeli organizations, citing Google's Threat Intelligence…
Dormant GitHub ‘Ghost’ Accounts Used in Coordinated Reconnaissance Campaigns
Datadog Security Labs has uncovered several overlapping campaigns that leverage dormant GitHub accounts—some created two to five years ago—to systematically enumerate corporate…
GodDamn Ransomware Deploys PoisonX Driver to Bypass Endpoint Security
Cybersecurity researchers have identified a new ransomware family named GodDamn, which leverages the PoisonX kernel driver to disable endpoint defenses. First observed…