ALERTS JUNE  2026  2025  2024  2023  2022

HOME  AI  APT  BOTNET  CAMPAIGN  CRIME  CRYPTOCURRENCY  EXPLOIT  HACKING  GROUP  OPERATION  PHISHING  RANSOM  SPAM  VIRUS  VULNEREBILITY | 2024  2025
2026  January(30) February(48) March(53) April(50) May(50) June(41) July(9) August(0) SEPTEMBER(0) October(0) November(0) December(0)

29.6.26 DCRAT malware delivered in Operation DragonReturn Operation DragonReturn is a sophisticated, ongoing cyber espionage campaign linked to Chinese-nexus threat actors, designed to compromise India's public and private tax infrastructure. First detected in mid-May 2026 and remaining highly active through June, the operation strategically exploits the AY2026-27 tax-filing season ALERTS VIRUS
29.6.26 StealC and Amadey Infostealer Infrastructure Targeted in Global Takedown Microsoft Threat Intelligence has published a report on the cybercrime infrastructure powering the StealC information stealer and Amadey loader families, detailing a coordinated global disruption of over 200 command-and-control domains.  ALERTS VIRUS
29.6.26 Gaslight - a Rust-based macOS implant SentinelLABS recently identified Gaslight, a novel Rust-based malware implant attributed to North Korean state-sponsored hackers. Discovered in early June and targeting the ARM64 architecture, this malware's most distinctive characteristic is its innovative evasion strategy: it embeds a 3.5 KB prompt-injection payload comprising thirty-eight fabricated system messages. ALERTS VIRUS
29.6.26 Nirsoft tool abused by ransomware actors Nirsoft tools are free, lightweight, and portable Windows utilities created by Nir Sofer developers. Their applications are primarily used for password recovery, network monitoring, system troubleshooting, digital forensics and so on. ALERTS RANSOM
29.6.26 Langflow CVE-2026-33017 vulnerability exploited in campaign delivering cryptominers A newly observed cryptocurrency mining campaign exploits CVE-2026-33017, an unauthorized code execution flaw in Langflow. As reported by researchers from Trend Micro, the attack initiates when an arbitrary Python code executed through an open Langflow API endpoint downloads a malicious shell script.  ALERTS VULNEREBILITY
29.6.26 AMOS (Atomic macOS Stealer) malware deployed in latest ClickFix campaign targeting macOS users A recent macOS ClickFix campaign utilizes fraudulent CAPTCHA prompts to distribute the Atomic macOS Stealer (AMOS) malware. As reported by researchers from Unit 42, this distribution technique deceives victims into pasting a malicious command directly into their system’s Terminal. ALERTS VIRUS
29.6.26 Backdoor.Mistic: New Backdoor May be Linked to Ransomware Access Broker A relatively new backdoor that we have called Backdoor.Mistic has been deployed in multiple attacks since April 2026. The backdoor was first documented by Zscaler (which tracks it as MLTBackdoor) earlier this month. Mistic may be linked to the financially motivated initial access broker (IAB) tracked publicly as KongTuke (which we track as Woodgnat) and it was used in one intrusion that also involved the group's ModeloRAT remote access trojan. ALERTS VIRUS
29.6.26 Blue Gryphus RAT Emerges in Latin America with Banking Fraud Capabilities A sophisticated new threat, the Blue Gryphus RAT, has emerged in Latin America, primarily targeting users in Colombia. A report by SCILabs details this .NET-based Remote Access Trojan which acts as a modular banking threat. Reportedly distributed via phishing emails disguised as legal or Windows updates, it deploys droppers that establish persistence, evade Windows Defender, and bypass User Account Control. ALERTS VIRUS
29.6.26 Fake Invoices on WhatsApp Deliver VBScript Malware That Hijacks Systems with RMM A recently observed campaign leveraged compromised WhatsApp accounts to deliver malicious VBScript files. The scripts, disguised as routine financial statements or invoices, trigger a multi-stage infection chain once opened. The malware actively modifies Windows User Account Control settings to increase evasion, facilitating the download and execution of additional payloads.  ALERTS VIRUS
29.6.26 Recent operations of the INC ransomware As reported by the researchers from Acronis, INC ransomware variant has risen to prominence as one of the leading RaaS operations, claiming over 800 targets since 2023. The threat actors have transitioned both its Windows and Linux encryptors to the Rust language. They also updated their toolkit, notably developing a credential harvester targeting Veeam backup deployments. I ALERTS RANSOM
29.6.26 Prinz Eugen ransomware variant Prinz Eugen is a new Go-based ransomware variant recently discovered by the researchers from Malwarebytes. The encryptor employs ChaCha20-Poly1305 encryption with built-in integrity verification, prioritizes recently modified data, and executes unrestricted recursive folder searches, all while leaving no ransom note behind.  ALERTS RANSOM
29.6.26 Inside the Gentlemen RaaS Evasion Ecosystem ESET Research has published a detailed investigation into the Gentlemen ransomware-as-a-service (RaaS) gang and its advanced endpoint detection and response (EDR) killer ecosystem. Emerging as a highly active threat in late 2025, Gentlemen stands out by directly providing its affiliates with a standardized, operator-maintained suite of evasion tools rather than requiring them to source their own. ALERTS RANSOM
22.6.26 Inside the Gentlemen RaaS Evasion Ecosystem ESET Research has published a detailed investigation into the Gentlemen ransomware-as-a-service (RaaS) gang and its advanced endpoint detection and response (EDR) killer ecosystem. Emerging as a highly active threat in late 2025, Gentlemen stands out by directly providing its affiliates with a standardized, operator-maintained suite of evasion tools rather than requiring them to source their own. ALERTS RANSOM
22.6.26 SheetCreep RAT delivered in recently discovered espionage operation Securonix has uncovered SheetCreep, an active espionage operation employing diplomatic-themed ISO lures to distribute a C# remote access trojan (RAT). The recently observed campaign initiates via a malicious LNK file masquerading as a UAE-India strategic partnership document, primarily targeting Indian foreign relations personnel. ALERTS VIRUS
22.6.26 CVE-2026-34908 - UniFi OS Auth Bypass Vulnerability CVE-2026-34908 is a recently disclosed critical (CVSS score 10) Improper Access Control vulnerability affecting Ubiquiti UniFi OS devices. If successfully exploited the flaw might allow malicious actors with network access to make unauthorized changes to the vulnerable system. ALERTS VULNEREBILITY
22.6.26 CVE-2026-54420 - LiteSpeed cPanel Plugin vulnerability CVE-2026-54420 is a recently disclosed high-severity (CVSS score 8.5) UNIX Symbolic Link (Symlink) following vulnerability affecting LiteSpeed cPanel plugin (all versions before 2.4.8, as distributed in LiteSpeed WHM Plugin before 5.3.2.0). If successfully exploited the flaw might allow a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS. This vulnerability has already been added to the CISA Known Exploited Vulnerabilities (KEV) Catalog following the reports of the in-the-wild exploitation. ALERTS VULNEREBILITY
22.6.26 Rokarolla Android Banking Malware Researchers at Zimperium have shared details about an Android banking trojan dubbed Rokarolla which targets over 200 cryptocurrency and financial applications. The malware spreads via deceptive websites masquerading as legitimate applications like Google Chrome. ALERTS VIRUS
22.6.26 Hidden in Teams: DragonForce Attackers Weaponize Microsoft Teams Relays to Stay Hidden Attackers deploying the DragonForce ransomware against a major U.S. services firm hid their command and-control traffic (C&C) inside Microsoft Teams’ own relay infrastructure, using a custom Go-based backdoor that Symantec is tracking as Backdoor.Turn. To network defenders, the only traffic they could see was outbound connections to legitimate Microsoft Teams servers. The attackers were on the victim network for between one and two months. ALERTS APT
22.6.26 Fake Software Tutorials Push Stealer from TikTok and Instagram According to ReversingLabs, threat actors are using TikTok and Instagram Reels to distribute phishing-style tutorials that promote free access to premium software. The actors use short videos, copied account templates, Windows-themed branding, and engagement tactics such as saves, shares, and comment prompts to increase reach. ALERTS VIRUS
22.6.26 10FXRAT Campaign Targets Organizations in Japan According to LAC, organizations in Japan were targeted in April 2026 by spear-phishing attacks that deployed PXDropper, PoisonX, and 10FXRAT – The latter is a modular remote access trojan that supports system reconnaissance, command execution, SOCKS5 tunneling, plugin loading, and additional theft-oriented capabilities. ALERTS VIRUS
22.6.26 OnyxC2 Stealer In a recent write-up, BlackFog details OnyxC2, a malware-as-a-service infostealer advertised on cybercrime forums and packaged with multiple subscription tiers. The malware is designed to collect credentials, cookies, autofill data, wallet material, and other sensitive information from more than 210 applications and browser extensions. ALERTS VIRUS
22.6.26 SilabRAT malware First emerging on dark web marketplaces in late 2025, SilabRAT (commercially branded as SnappyClient) is an advanced Remote Access Trojan operated under the Malware-as-a-Service umbrella. Group-IB analysts have reported that cybercriminals have been deploying this malware through email spam and ClickFix schemes. ALERTS VIRUS
22.6.26 BlueRabbit - a new Golang-based backdoor with ransomware capabilities BlueRabbit is a sophisticated, Go-based backdoor variant believed to be operated by an Iranian cyber espionage group. As reported by analysts from Binary Defense, the malware routes command operations through RabbitMQ open-source message broker, tracks victim states with Redis, and steals sensitive data using S3-compatible MinIO channel transfers. ALERTS VIRUS
22.6.26 HarborWatch Agent Delivered Through ClickFix Social Engineering According to Cofense, an Amazon-themed phishing campaign has been used to deliver HarborWatch Agent, a custom monitoring RAT. The campaign targets email users in organizations, with no specific sector or region identified in the published analysis. Recipients are sent a fake account security alert that leads to a lookalike verification page using ClickFix-style instructions. ALERTS VIRUS

13.6.26

 FlutterShell macOS backdoor leveraged within the Operation FlutterBridge Security researchers from Unit 42 reported about an Operation FlutterBridge, a widespread macOS malvertising campaign that represents an evolution of older JSCoreRunner threat. The attackers now deploy a sophisticated backdoor payload named FlutterShell that leverages the Flutter framework. The malware masquerades as legitimate desktop applications but executes malicious background activities, including file system tampering, arbitrary shell command execution, and environmental variable exfiltration. ALERTS VIRUS

13.6.26

 OnionDrop loader malware The Howler Cell Threat Research Team has identified OnionDrop, a highly sophisticated, multi-stage malware loader designed to distribute infostealing payloads. First discovered active in early 2026, researchers have uncovered more than 645 unique DLL samples linked to this ongoing campaign, which evolved from prior operations involving CGrabber and Direct-sys loaders. ALERTS VIRUS

13.6.26

 Recent activities of the Blue Margay threat group In a recent report, the analysts from SCILabs have detailed the tactics, techniques, and procedures of Blue Margay, an active threat group targeting Brazilian users and organizations to conduct banking and cryptocurrency fraud. Initial compromise is achieved primarily through targeted phishing emails masquerading as Brazil’s Ministry of Finance or various internal corporate departments. ALERTS GROUP

13.6.26

 CVE-2026-7465 - Spectra Gutenberg Blocks RCE Vulnerability CVE-2026-7465 is a recently disclosed high-severity (CVSS score 8.8) Remote Code Execution (RCE) vulnerability affecting Spectra Gutenberg Blocks which is a Website Builder for the Block Editor plugin for WordPress. If successfully exploited the flaw might allow authenticated attackers with contributor-level access or higher to execute arbitrary PHP code on the server host. ALERTS VULNEREBILITY

13.6.26

 Threat Actors Leverage Old WinRAR Vulnerability to Deliver Data-Stealing Malware Researchers at Trend Micro have highlighted recent campaigns targeting Ukrainian organizations by Russian-aligned threat actors. The report focuses on the exploitation of CVE-2025-8088, a long-patched WinRAR vulnerability. The WinRAR flaw allows attackers to quietly deploy malware families including GIFTEDCROOK, GammaSteel, and GammaWorm. These variants are designed to steal credentials, monitor files, collect sensitive documents, and maintain long-term access to compromised systems. ALERTS VULNEREBILITY

13.6.26

 CVE-2026-11645 - Chrome V8 Zero-Day vulnerability exploited in the wild CVE-2026-11645 is a recently disclosed high-severity (CVSS score 8.8) out-of-bounds memory access vulnerability in Google Chrome's V8 JavaScript and WebAssembly engine. If successfully exploited the flaw might allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML pages. This vulnerability has already been reported as being exploited in the wild. ALERTS VULNEREBILITY

13.6.26

 SilentNet – A RAT/Stealer masquerading as a Minecraft Hack Client SilentNet is a Java-based remote access trojan and infostealer sold as a malware-as-a-service offering. It is actively promoted on platforms including YouTube and is already being used in the wild by various actors. ALERTS VIRUS

13.6.26

 Operation TaxShadow Researchers from Cyfirma disclosed details of a sophisticated phishing campaign, dubbed "Operation TaxShadow", that targets victims by impersonating Indian tax authorities. Using urgent, government-branded emails, attackers lure users to a deceptive portal to download a malicious ZIP archive containing a three-stage payload. Once executed the threat leverages DLL hijacking, API hooking, and token manipulation to successfully elevate its privileges. ALERTS OPERATION

13.6.26

 C0XMO - a new Gafgyt malware variant The cybersecurity researchers at FortiGuard Labs identified C0XMO, a novel variant of the Gafgyt botnet. This malware spreads by leveraging CVE-2021-27137, a critical stack buffer overflow vulnerability within the UPnP service of certain vulnerable DD-WRT routers. ALERTS VIRUS

13.6.26

 CVE-2026-45321 - TanStack npm supply chain compromise CVE-2026-45321 is a recently disclosed critical (CVSS score 9.6) supply chain vulnerability affecting the TanStack npm ecosystem. The attackers leveraged GitHub Actions and trusted-publisher workflows to publish 84 malicious versions across 42 tanstack packages under a trusted identity. The published payloads contained credential-stealing malware. This vulnerability has already been added to the CISA Known Exploited Vulnerabilities (KEV) Catalog following the reports of the in-the-wild exploitation. ALERTS VULNEREBILITY
6.6.26 Python RAT deployment under the disguise of RVTools Security researchers from K7 Security Labs recently identified a malicious campaign distributing a fake installer for RVTools, a popular management utility. Once executed, the installer initiates a three-stage payload delivery. It begins with an obfuscated VBScript hidden inside the binary, which executes a hidden PowerShell command to pull down a malicious archive from a Dropbox repository.  ALERTS VIRUS
6.6.26 TA4922 Delivers Atlas RAT in Recent Campaigns The sophisticated Chinese-speaking cybercrime group TA4922 is rapidly expanding its global reach with an aggressive operational tempo and a highly dangerous, evolving malware arsenal. Security researchers from Proofpoint have tracked the group shifting away from its traditional East Asian focus to deploy devastating new payloads across Europe and Africa. ALERTS APT
6.6.26 Espionage Campaign Targeted Stock Exchange Executive for Five Months A five-month espionage campaign targeted the email account of a senior figure at a major global stock exchange. For an espionage actor, a senior executive's mailbox is a high-value intelligence target. An Outlook profile may yield details of external negotiations, internal deliberations, the executive's calendar, travel pattern, and their contacts. ALERTS CAMPAIGN
6.6.26 Pakistan-Linked SideCopy Deploys XenoRAT in Targeted Government Espionage Campaign Researchers at Seqrite have uncovered Operation XENOFISCAL, an aggressive cyber campaign targeting Afghanistan’s Ministry of Finance and attributed to the Pakistan-linked threat group SideCopy. The attack begins with spear-phishing emails containing a ZIP archive that delivers a malicious shortcut file.  ALERTS VIRUS
2.6.26 New PureLogs Variant Targets Browsers, Discord, and Cryptocurrency Wallets Researchers at FortiGuard Labs have highlighted a sophisticated new phishing campaign that is actively deploying a dangerous fileless PureLogs variant designed to aggressively harvest sensitive user information. Initially disguised as a standard purchase order, the attack utilizes heavily obfuscated JavaScript and a malicious PowerShell script to subtly hijack a trusted Windows process through process hollowing. ALERTS CRYPTOCURRENCY
2.6.26 Telegram Campaign Delivers Silent Stealer In a recent write-up, the Ransom-ISAC Research Team details a Telegram-distributed Silent Stealer v2.6.5 build packaged by a distributor operating under the alias ShinySpider. The report identifies a two-actor model: Silent Stealer is a commercially operated Malware-as-a-Service authored by @MainSilent, with ShinySpider acting as a separate builder and distributor who wraps purchased license builds in a custom NSIS installer for delivery via Telegram. ALERTS CAMPAIGN
2.6.26 MacOS malware distributed in the JINX-0164 campaign The Wiz Customer Incident Response Team (CIRT) has identified JINX-0164, a previously unreported cyber threat actor targeting cryptocurrency organizations since at least mid-2025. Using recruitment-themed social engineering, the attackers employ credible LinkedIn profiles to offer virtual meetings to developers. When victims click the meeting link, they are directed to a malicious domain masqueraded as a teleconference provider, unknowingly downloading and executing custom macOS malware with remote access trojan (RAT) capabilities. ALERTS CAMPAIGN