Intel Feed
Cyber Threat IntelligencePage 8
Reports
Reporting archive — page 8
Showing 169–192 of 611 reports
WeedHack Shows SEO Poisoning Is Malware Delivery Infrastructure
McAfee says WeedHack is still using fake gaming sites, SEO poisoning, Discord links, MediaFire, and GitHub-style trust signals to deliver malware. The same playbook can hit business users searching for tools and downloads.
AI Agent Incidents Need Task-Scoped Incident Response
AI agents need incident response that maps credential use back to task authorization. Here is how SMBs and government contractors can reduce blast radius with task-scoped access, logging, and containment runbooks.
SDLC Supply-Chain Attacks Show Why Developer Tools Need Runtime Controls
Attackers are targeting developer endpoints, CI/CD pipelines, package managers, and cloud runtime—not just finished applications. Here is how SMBs and government contractors can reduce SDLC supply-chain blast radius.
Russian Auth-Flow Phishing Shows MFA Can Be Bypassed Without Exploits
Russian-linked clusters are abusing app passwords, OAuth consent, device-code login, WhatsApp linking, and captive portals. The defense is visibility and governance around authorization flows—not just MFA at login.
Fake AI Tools Show Brand Trust Has Become Malware Delivery
Sophos X-Ops found attackers repeatedly impersonating AI brands with fake installers, malicious extensions, phishing lures, and AI-assisted tooling. The near-term defense is not exotic: approved sources, browser governance, endpoint telemetry, DNS controls, token hygiene, and clear AI software rules.
StopAndProtect Shows Why WordPress Sites Are Attack Infrastructure
Check Point Research exposed StopAndProtect, an operation abusing thousands of compromised WordPress sites for ClickFix delivery, malware staging, command routing, victim logging, data theft, and ransomware. The practical lesson: public websites need the same ownership, telemetry, and incident-response discipline as other production infrastructure.
MacSync Stealer Shows Why Behavioral Pivots Beat Rotating Domains
Microsoft Defender Experts expanded MacSync Stealer tracking from a small domain set to 30+ related domains by correlating durable endpoint and network behaviors. For defenders, the lesson is to hunt the attack chain—not just the rotating infrastructure.
PurpleDelta Shows Why Remote Hiring Is Now an Insider-Risk Control
Recorded Future’s PurpleDelta research shows North Korean IT worker operations using fabricated personas, AI-assisted interviews, remote desktop tooling, and facilitators to enter legitimate remote technical roles. Defenders should treat hiring, identity proofing, endpoint onboarding, and contractor access as one security workflow.
GitLab GraphQL Flaw Shows Why DevSecOps Platforms Need Emergency Patch Runbooks
GitLab patched CVE-2026-19478, a critical GraphQL flaw affecting self-managed CE/EE instances. Defenders should patch fast and verify DevSecOps platform integrity after the update.
Forminator RCE Shows Why WordPress Plugin Risk Needs Runtime Controls
CVE-2026-15748 in Forminator Forms shows why WordPress file uploads need plugin patching, upload-directory hardening, and runtime monitoring—not just auto-update hope.
C2Looper Shows Why GitHub-Based C2 Belongs in Ransomware Triage
Zscaler ThreatLabz found C2Looper, a Rust-based backdoor that evolved to use GitHub for command-and-control. Here is what SMBs and government contractors should monitor before trusted-platform abuse becomes ransomware.
VMware vCenter Exploitation Shows Why Patching Is Not Incident Closure
Active exploitation of CVE-2026-59310 shows why VMware vCenter patching must be paired with compromise assessment, reverse-shell hunting, and control-plane segmentation.
Ransomware’s Long Tail Means Defenders Need Faster Triage
Check Point Research’s Q2 2026 ransomware data shows a wider operator ecosystem, faster exploitation windows, and lower payment rates. Here is what SMBs and government contractors should harden first.
Azure Directory Dumps Show Why Identity Data Is Attack Infrastructure
A reported Azure and Entra directory exfiltration campaign shows why cloud identity data, service accounts, and org charts need defensive monitoring before attackers weaponize them.
Signed ClickOnce Shows Fake Interviews Are Now a Credential-Theft Delivery System
A fake Web3 interview chain used a signed ClickOnce app to deliver stealers and a RAT. Here is what SMBs and government contractors should change in endpoint, identity, and hiring-workflow defenses.
Dropcatch Domains Show Why Reputation Is Not Trust
Threat actors are buying expired domains with inherited reputation, backlinks, and traffic, then using them for redirects, scams, malware, and command-and-control. Here is what SMBs and government contractors should harden first.
CaptiveCrunch Shows Why Travel Wi-Fi Is an Identity Attack Surface
Zscaler reports that Midnight Blizzard operators are abusing hotel and conference Wi-Fi captive portals for Microsoft 365 credential theft, device-code phishing, and malware delivery. Here is what SMBs and government contractors should harden first.
HoneyMyte’s CoolClient Rootkit Shows Why Kernel Visibility Matters
HoneyMyte’s CoolClient backdoor now includes signed kernel-mode rootkit capabilities, raising the bar for driver monitoring, Defender exclusion review, and post-compromise endpoint validation.
JWR Phishing Framework Shows Why MFA Codes Are Now Live Targets
Cisco Talos documented JWR, a real-time phishing framework that lets operators steer victims through fake checkout and login flows while harvesting credentials, payment data, OTPs, identity documents, and device fingerprints. For SMBs and government contractors, the lesson is direct: MFA codes are n
Evooo1Bot Shows Why Exposed Linux and Edge Devices Are Still High-Value Targets
FortiGuard Labs documented Evooo1Bot, a Linux botnet combining Mirai-style DDoS with SSH brute forcing, SOCKS relay, credential sniffing, persistence, and exploit-driven infection of exposed devices.
Malware Crypting Services Show Why Behavioral Detection Matters
Recorded Future’s look at malware crypting services shows why SMBs and government contractors need behavioral detection, endpoint telemetry, and incident response—not just clean file scans.
Private Wireless Utility Networks Are Becoming OT Attack Paths
A CERT Polska follow-up on an energy-sector incident shows why private APNs, private LTE/5G, and cellular routers must be treated as OT attack paths — not inherently trusted connectivity.
Kong Mesh Vulnerabilities Show Why Service Mesh Security Needs Control-Plane Discipline
Fresh Kong Mesh/Kuma vulnerabilities touch service-mesh trust boundaries: admin token exposure, data-plane configuration disclosure, workload identity confusion, token interception, and control-plane DoS.
Gunra Ransomware Shows Why VPN Compromise Is an Incident, Not a Patch Ticket
Gunra ransomware activity tied to Fortinet VPN exploitation shows why edge-device compromise requires incident response: credential review, session validation, segmentation checks, and backup protection — not just patching.