ALERTS AUGUST  2026  2025  2024  2023  2022

HOME  AI  APT  BOTNET  CAMPAIGN  CRIME  CRYPTOCURRENCY  EXPLOIT  HACKING  GROUP  OPERATION  PHISHING  RANSOM  SPAM  VIRUS  VULNEREBILITY | 2024  2025
2026  January(30) February(48) March(53) April(50) May(50) June(41) July(43) August(52) SEPTEMBER(0) October(0) November(0) December(0)

DATE

NAME

INFO

CATEGORY

SUBCATE
28.8.26 HookEdge backdoor distributed by the BlueDelta threat group Latest report from the Insikt Group researchers discusses recent malicious campaigns conducted by threat group BlueDelta (aka Forest Blizzard, or Fancy Bear) that have been targeting government, diplomatic, and defense manufacturing bodies in Romania, Spain, and Turkey. ALERTS APT
28.8.26 Unauthenticated RCE vulnerability in Apache Log4j2 (Issue 4255) A newly disclosed vulnerability in Apache Log4j's FilteredObjectInputStream component enables unauthenticated remote code execution against services that receive serialized log events over a network connection. The unpatched flaw affects log4j-core 2.8.0 through 2.26.1 and log4j-api 2.11.0 through 2.26.1, and is limited to applications using Log4j's serialized log-event network receivers rather than to all Log4j deployments. ALERTS VULNEREBILITY
28.8.26 WeedHack Malware via SEO Poisoning McAfee Labs has published a report on a campaign distributing WeedHack, a Malware-as-a-Service infostealer and remote access tool targeting Minecraft players. The attackers use SEO poisoning and YouTube videos to push malicious clone sites above official repositories on search engines, tricking gamers searching for popular clients and modifications like Xenon or Radium. ALERTS VIRUS
28.8.26 GoCaracal and Bandook Malware Target Communications Sector Arctic Wolf has published a report on a new modular malware framework called GoCaracal, deployed by the cyberespionage group Dark Caracal. The threat actors have been observed targeting the communications sector in Venezuela and other parts of Latin America. The attack begins with financial-themed phishing emails containing weaponized SVG attachments, which initiate a sequence to download a lightweight GoCaracal executable to establish initial system access. ALERTS VIRUS
28.8.26 TwoStroke backdoor distributed by the Tortoiseshell threat group Group-IB’s threat research into the IRGC-affiliated Iranian actor Tortoiseshell (aka Mirage Kitten, Nimbus Manticore) indicates broadened cyber campaigns extending across Europe and the Middle East. Tortoiseshell typically breaches defense, aerospace, military, and technology organizations using watering-hole attacks, supply-chain exploits, and fraudulent recruitment portals. ALERTS VIRUS
28.8.26 SparkRAT malware targets Cambodia in a recent campaign Acronis’ researchers reported on a recent cyber campaign targeting entities across Cambodia using varied decoy materials, such as official state advisories, medical records or commercial promotions. The attack sequence initiates through an Inno Setup installer that triggers a legitimate Tencent binary, and performs DLL side-loading. The malicious loader subsequently retrieves and decrypts hidden shellcode embedded within PNG images. ALERTS VIRUS
26.8.26 SynkLoader Distributed via Teams Researchers at Expel recently reported a new malware family dubbed SynkLoader, which utilizes a modular architecture bridging multiple programming languages to evade detection. Threat actors initiate the compromise via Microsoft Teams phishing, masquerading as internal IT personnel to persuade victims to download a malicious MSI installer hosted on an Azure endpoint. ALERTS VIRUS
26.8.26 PavinLoader Emerges as Loader-as-a-Service Delivering Information Stealers A new campaign documented by Malwarebytes details the widespread deployment of PavinLoader across ClickFix social engineering lures, trojanized game releases, and fake software downloads. Operating as a potential Loader-as-a-Service, PavinLoader uses initial vector lures such as fake CAPTCHA prompts or Dropbox-hosted installers to execute malicious scripts or batch files on victim systems. ALERTS VIRUS
26.8.26 RedC2 AI-Powered Linux Implant TrendAI identified a supply-chain campaign where deceptive npm packages masquerade as legitimate date and calendar utilities. Simply importing one of these compromised dependencies triggers an embedded Linux ELF binary to execute as an independent background process. The embedded payload, known as RedShell, functions as a Linux beacon for the commercial RedC2 4.0 command-and-control framework. ALERTS AI
26.8.26 Vidar infostealer distributed under the disguise of a Gemini installer Darktrace recently analyzed an incident where users seeking a desktop version of Google Gemini installer could inadvertently download the Vidar infostealer variant instead. The attack leveraged search-driven discovery, leading the user to a Google Colab notebook that served a fraudulent executable. Once launched, this Go-based variant of Vidar would begin harvesting sensitive data from the compromised endpoint and attempt outbound communication with Telegram-based command-and-control infrastructure controlled by the attackers. ALERTS VIRUS
26.8.26 Kynx Stealer A new malware family documented by SOCRadar reveals the growing intersection of artificial intelligence and credential theft. Dubbed Kynx, this C++-based Malware-as-a-Service is believed to be distributed through cracked software or fake update lures, displaying a deceptive system update progress bar upon initial execution. ALERTS VIRUS
26.8.26 Manic Android Threat Observed in Ukraine ThreatFabric has recently identified a new Android malware family dubbed Manic that functions as a hybrid banking trojan and surveillance tool. The malware primarily targets financial institutions, government identity services, and messaging applications in Ukraine, with secondary victims across Europe and Russia. ALERTS VIRUS
26.8.26 ToxicPanda 2.0 Refines Overlay Attacks and Abuse of Accessibility Services Researchers at Zimperium recently reported on ToxicPanda 2.0, an upgraded version of the Android banking Trojan with a significantly expanded global operational footprint. The threat targets over 340 banking, cryptocurrency, and e-wallet applications across 16 countries, abusing Android Accessibility Services to automate malicious actions and steal sensitive credentials. ALERTS VIRUS
26.8.26 RubyGems Supply Chain Attack Deploys Stealer A campaign documented by OpenSourceMalware exposes a RubyGems supply chain attack dubbed StubMaker, targeting Windows developer environments. The actor published typosquats of high-traffic dependencies, weaponizing extconf.rb to execute code at install time while writing fake compiler stubs so the native extension phase reports a clean build. ALERTS HACKING
26.8.26 Core Werewolf Deploys Custom CoreRAT Malware According to BI.ZONE, a previously undocumented RAT dubbed CoreRAT is being deployed by the Core Werewolf espionage actor against Russia's public sector and defense industry, observed June–July 2026 and traced back to at least March 2026. Initial access comes via phishing messages on Telegram delivering 7zSFX or Rust droppers named after military and government paperwork. ALERTS VIRUS
22.8.26 PlikanLocker Ransomware Point Wild Threat Intelligence has recently identified a new .NET-based ransomware strain named PlikanLocker that blends file extortion with aggressive endpoint lockdown tactics. Distributed primarily through phishing attachments, malicious links, and social media lures, the malware targets general Windows environments by securing administrator rights via UAC prompts. ALERTS RANSOM

22.8.26

 Threat Actors Deploy WordlistLoader in Latest Amatera Attacks Researchers at Gen Threat Labs recently reported a new malware family called WordlistLoader, which threat actors are utilizing to deliver the Amatera infostealer to a wide range of victims. According to their analysis, the attack begins on legitimate but compromised websites where visitors encounter a fake CAPTCHA prompt as part of a ClearFake campaign. ALERTS VIRUS

22.8.26

 Mirage2FA Campaigns ANY.RUN has published a report on Mirage2FA, a commercial phishing-as-a-service (PhaaS) kit operated by LinX Coders that has been active between September 2024 and July 2026. ALERTS CAMPAIGN

22.8.26

 Grandoreiro Banking Trojan Resurfaces With DLL Sideloading Campaign in Mexico In a recent write-up, Acronis details a campaign demonstrating the geographic expansion of the Grandoreiro banking trojan from South America into Mexican financial, logistics, and industrial sectors. Distributed through tax- and invoice-themed phishing emails containing malicious ZIP archive attachments or direct download links, the attack chain lures victims into executing a heavily padded installer binary.  ALERTS VIRUS

22.8.26

 Threat Group UAT-10147 Deploys SPECTRE Backdoor and Linux Rootkits Researchers at Cisco Talos recently reported on malicious campaigns conducted by the Chinese-speaking threat group UAT-10147 targeting Linux and Windows web servers across government, education, technology, media, and gaming sectors worldwide.  ALERTS APT
22.8.26 AmnesiaStealer - a macOS infostealer written in Rust Jamf Threat Labs researchers recently reported on AmnesiaStealer, an advanced multi-stage macOS malware written in Rust. Threat actors have been distributing this malware via "ClickFix" social engineering tactics, leveraging deceptive GitHub download pages. Once executed, the stealer extracts system passwords using native-looking prompts, exfiltrates Keychain data, and sweeps local storage for sensitive files, Apple Notes, and Telegram sessions. ALERTS VIRUS

19.8.26

 StealNui - a new Linux RAT variant Security researchers at ExaTrack report on StealNui, an emerging C++-based Remote Access Trojan (RAT) crafted for Linux platforms. The malware provides operators with extensive espionage and surveillance functionality. Its toolkit includes screen capture utilities, a keystroke logger, reverse shell access, local file exfiltration, and arbitrary remote command execution and a cryptocurrency clipper module. ALERTS VIRUS

19.8.26

 JWR PhaaS In a recent write-up, Cisco Talos details an undocumented phishing framework dubbed JWR, which is built to impersonate major payment and e-commerce platforms. Delivered primarily through SMS lures disguised as postal and toll authorities in Southeast Asia and the Middle East, the framework operates as a highly interactive, real-time threat rather than a static credential harvester. ALERTS PHISHING

19.8.26

 QUICAgent Backdoor Hidden in VHD Lures Researchers at Seqrite recently reported a campaign orchestrated by a China-nexus threat actor targeting Myanmar's government and IT sectors. Dubbed Operation QUICSILVER, the attacks single out diplomats and officials by using deceptive Burmese-language graduation ceremony invitations packaged inside Virtual Hard Disk (VHD) files. ALERTS VIRUS

19.8.26

 Lucid Stealer malware Lucid Stealer is a sophisticated information-harvesting malware variant promoted through Telegram that masquerades as a legitimate Node.js JavaScript runtime. Upon execution, the malware deploys native modular components to conduct data harvesting operations. ALERTS VIRUS

14.8.26

 GhostDesk via Fake Softwares A new campaign documented by Malwarebytes details the distribution of a malicious Google Chrome extension dubbed GhostDesk, delivered through counterfeit software installers. Threat actors are luring Windows users to spoofed download portals for popular utilities, including CCleaner, 7-Zip, and Adobe Acrobat. Once the trojanized executable is launched, it uses a legitimate scripting engine to hijack system components and forcibly patch Chrome's security extension settings. ALERTS VIRUS

14.8.26

 WindRelay and SpyNote Drive NFC Fraud Researchers at Group-IB recently reported a new malware family combination involving a custom near-field communication (NFC) relay tool dubbed WindRelay deployed alongside the known SpyNote remote access trojan (RAT). This campaign primarily targets banking customers in Czechia, Slovakia, and Slovenia. The attack begins with a social engineering phone call where operators posing as bank employees convince victims to sideload a customized SpyNote payload. ALERTS VIRUS

14.8.26

 Sandworm-Linked Group Uses Fake Job Interviews to Deploy Trojanized WireGuard Client According to CERT-UA, the Russian state-sponsored threat group Sandworm (tracked in this campaign as UAC-0145) is actively targeting system administrators and IT staff through fake job recruitment offers. Posing as hiring representatives from legitimate IT firms, the operators engage candidates via email and Telegram before conducting online technical interviews. ALERTS APT

14.8.26

 Jewelbug: APT Group Runs Espionage and Crypto Fraud Operations Side by Side A months-long investigation by the Symantec Threat Hunter Team has produced unprecedented visibility into the activities of Jewelbug (aka Earth Alux, REF7707, CL-STA-0049), a China-based APT group that has been breaking into government ministries across Asia and the Middle East while quietly running a cryptocurrency fraud business on the side. The two are not separate ventures that happen to share a name: our investigation revealed they are run by the same small team, on shared infrastructure, from one control panel. ALERTS APT

14.8.26

 Chaos Malware Variant Targeting Linux Cloud Infrastructure A new variant documented by Darktrace highlights how the Go-based Chaos botnet has shifted its targeting from edge routers to Linux cloud environments. Following an initial infection that quickly deletes its own footprint from the disk, the malware establishes long-term persistence using systemd services alongside a keep-alive script. ALERTS VIRUS

14.8.26

 Gunra Ransomware expands its operations A joint cybersecurity advisory released by international law enforcement and intelligence agencies including CISA, the FBI, NSA, USSS, DC3, and South Korea’s KNPA warns organizations of Gunra, an escalating ransomware-as-a-service (RaaS) threat. Initially discovered in April 2025 and built upon leaked Conti ransomware source code, the encryptor targeted Windows environments before incorporating Linux capabilities to enable multi-platform attacks. By early 2026, the operators established a dark-web-promoted affiliate program targeting government entities and critical infrastructure. Gunra employs a double-extortion scheme, exfiltrating sensitive organizational files prior to encrypting system drives. ALERTS RANSOM

14.8.26

 A new variant of the Kimwolf botnet identified in the wild Researchers at Unit 42 of Palo Alto Networks detailed the operation of Aeternum, a C++ botnet loader that uses public Polygon blockchain smart contracts to manage decentralized command-and-control (C2) operations. The threat actors leverage JSON-RPC requests to public Polygon endpoints to bypass conventional IP and domain blocking, staging secondary payloads including XWorm RAT, XMRig cryptocurrency miners, data stealers, and Telegram-controlled Python backdoors. The loader also implements anti-analysis routines, including virtual machine verification and security control evasion, to ensure resilience against disruption. ALERTS BOTNET

12.8.26

 Aeternum Botnet Researchers at Unit 42 of Palo Alto Networks detailed the operation of Aeternum, a C++ botnet loader that uses public Polygon blockchain smart contracts to manage decentralized command-and-control (C2) operations. The threat actors leverage JSON-RPC requests to public Polygon endpoints to bypass conventional IP and domain blocking, staging secondary payloads including XWorm RAT, XMRig cryptocurrency miners, data stealers, and Telegram-controlled Python backdoors. ALERTS BOTNET

12.8.26

 DeadLock Ransomware Combines Resource-Aware Encryption with Resilient Extortion Protocols Researchers at SOCRadar's Threat Research Unit recently reported on DOUBLECUP, a Russian Loader-as-a-Service platform built for ClickFix-style social engineering campaigns and active since early June 2026. Operators license access to a client panel and embed DOUBLECUP's front-end logic into lure pages, including sites spoofing NetSuite, Odoo, HubSpot, and Salesforce login portals. ALERTS RANSOM

12.8.26

 CRPxO Ransomware Researchers at SOCRadar's Threat Research Unit recently reported on DOUBLECUP, a Russian Loader-as-a-Service platform built for ClickFix-style social engineering campaigns and active since early June 2026. Operators license access to a client panel and embed DOUBLECUP's front-end logic into lure pages, including sites spoofing NetSuite, Odoo, HubSpot, and Salesforce login portals ALERTS RANSOM

8.8.26

 DOUBLECUP Loader-as-a-Service Deploys Stealthy RATs via Fake CRM Portals Researchers at SOCRadar's Threat Research Unit recently reported on DOUBLECUP, a Russian Loader-as-a-Service platform built for ClickFix-style social engineering campaigns and active since early June 2026. ALERTS VIRUS

8.8.26

 Fake CAPTCHA Prompts Leverage ClickFix Tactics to Infect macOS Systems In a recent write-up, Huntress details a macOS stealer malware campaign that uses ClickFix social engineering tricks to compromise Apple systems and siphon cryptocurrency wallets. Initiated through malicious links in email messages, the attack presents victims with a fake CAPTCHA window instructing them to paste a shell command into the macOS Terminal. ALERTS VIRUS

8.8.26

 Vanta Stealer Dubbed Vanta Stealer, a Python-based information stealer has been analyzed by the Lat61 Threat Intelligence Team, who describe it as a PyInstaller-packaged Windows executable with PyArmor-obfuscated bytecode protecting its core logic. ALERTS VIRUS

8.8.26

 Greatness PhaaS Campaigns Continue In a recent write-up, ZeroBEC details a campaign utilizing the Greatness phishing-as-a-service (PhaaS) platform, tracked under the HoneyStorm tag by URLQuery. ALERTS CAMPAIGN

8.8.26

 Popular NPM Packages Hijacked with New Shai-Hulud Malware Researchers at Aikido Security recently reported an active supply chain attack impacting widely downloaded npm libraries, including keyv and related caching utilities. The campaign leverages compromised maintainer credentials to publish poisoned package versions containing malicious preinstall hooks. ALERTS VIRUS

8.8.26

 Abuse of ScreenConnect RMM and Cloudflare Tunnels in SMOKE#SCREEN Campaign Researchers at Securonix recently reported an active multi-stage campaign dubbed SMOKE#SCREEN that abuses legitimate ScreenConnect remote monitoring and management (RMM) software to gain persistent access to enterprise endpoints. The operation targets both Windows and macOS environments using social engineering lures themed around Zoom updates, corporate document reviews, and system utilities. ALERTS CAMPAIGN

5.8.26

 Hump Hump Locker Ransomware Symantec's Threat Intelligence teams worldwide offer unparalleled analysis and commentary on current cyberthreats impacting businesses. Symantec's browser extensions integrate this intelligence directly into your browser, enabling effective detection and blocking of various web-borne threats. ALERTS RANSOM

3.8.26

 Go-based BlueShell Linux RAT Latest Variant A new Go-written variant of the Linux-based BlueShell RAT, linked to BlackTech and other China-based threat actors, was recently reported by researchers at IIJ Sec. The variant deploys via an XOR-encoded dropper and focuses heavily on evasion, renaming its process to mimic a legitimate kernel worker thread to blend into standard system activity. ALERTS VIRUS

1.8.26

 ValleyRAT distribution campaign targeting organizations in Japan As reported by the researchers from Cato Networks, the Monarch threat group (aka SilverFox) has recently launched a malicious campaign targeting a Japanese industrial manufacturing company to deliver ValleyRAT, a persistent remote access trojan. Initiated via invoice-themed phishing emails linked to attacker-controlled content hosted on legitimate Tencent Cloud and QQ services, the attack drops a compressed file containing an initial downloader executable. ALERTS VIRUS

1.8.26

 AtlasRAT malware variant AtlasRAT is a Remote Access Trojan (RAT) variant delivered through malicious setup files disguised as legitimate Flash Player software. As reported by researchers from ASEC, to obfuscate its command-and-control traffic, AtlasRAT utilizes ChaCha20 encryption over TLS, employing self-signed certificates spoofed to resemble Microsoft update infrastructure. ALERTS VIRUS