ALERTS SEPTEMBER 2026 2025 2024 2023 2022
HOME AI
APT
BOTNET
CAMPAIGN
CRIME
CRYPTOCURRENCY
EXPLOIT
HACKING
GROUP
OPERATION
PHISHING
RANSOM
SPAM
VIRUS
VULNEREBILITY
| 2024
2025
2026 January(30)
February(48)
March(53)
April(50)
May(50)
June(41)
July(43)
August(52) SEPTEMBER(39)
October(0)
November(0)
December(0)
DATE |
NAME |
INFO |
CATEGORY |
SUBCATE |
|
29.9.26 |
Kothamine Agent malware | Security researchers at Malwarebytes reported on Kothamine Agent, a previously unknown Remote Access Trojan (RAT) targeting Windows environments. Programmed in C and C++, the malware operates via a dedicated loader that typically injects its dynamic-link library (DLL) payload into legitimate processes such as explorer.exe. | ALERTS | VIRUS |
|
29.9.26 |
Lunex MaaS Campaign Targets Ukrainian Users | A new campaign documented by Ontinue details the deployment of the Lunex information stealer, a malware-as-a-service platform currently targeting Ukrainian-speaking users. The intrusion begins with a deceptive CAPTCHA page that initiates a covert MSI installation. The ensuing loader leverages a Bring Your Own Vulnerable Driver (BYOVD) maneuver—abusing a vulnerable AMD driver (CVE-2023-20598)— an attempt to terminate endpoint security telemetry at the kernel level. | ALERTS | CAMPAIGN |
|
29.9.26 |
RemControl – Android Banking Malware | Group-IB has published a report on a previously undocumented Android banking trojan dubbed RemControl, which operates as a Malware-as-a-Service platform. The threat targets retail banking customers across Europe, the Middle East, and Canada by masquerading as a popular IPTV application. Distributed via malvertising that leads to fake app stores, the malware uses a local VPN service to block Google Play Protect and generates unique certificates for each installation to evade detection. | ALERTS | VIRUS |
|
29.9.26 |
TokenGrabber infostealer | A recent K7 Security Labs publication explores how the Malware-as-a-Service (MaaS) threat actors create and distribute customized info-stealers comprising of Python-driven tools alongside integrated data-theft modules. The malware builder utility leveraged by the attackers allows them to construct bespoke Windows executables compiled via Nuitka or PyInstaller, directly configuring delivery webhooks during creation. | ALERTS | VIRUS |
|
29.9.26 |
DarkMe RAT Delivered via PIF | Researchers at Huntress recently reported a campaign involving the DarkMe remote access trojan, which has notably shifted its initial delivery tactics. Previously attributed to the financially motivated Water Hydra group, this malware historically targeted forex traders, cryptocurrency users, and gambling platforms using sophisticated zero-day exploits. | ALERTS | VIRUS |
|
29.9.26 |
Psychedelic Stealer malware | Cybersecurity researchers at Arctic Wolf Labs uncovered an ongoing threat campaign abusing compromised Ukrainian commercial websites to distribute a novel malware variant dubbed Psychedelic Stealer. Attackers embed malicious iframes into trusted web pages, presenting visitors with deceptive Cloudflare verification prompts. This social engineering tactic coerces users into copying commands and launching them via the Windows Run dialog, fetching a malicious MSI installers. | ALERTS | VIRUS |
|
29.9.26 |
Sauron - a new malware Loader on the threatscape | Security researchers at DCSO recently identified a previously undocumented malware loader dubbed Sauron which has been used to compromise numerous organizations across Germany. Distributed via a Malware-as-a-Service commercial model, the loader serves as the final stage of intrusion chains initiated through social engineering and ClickFix campaigns. | ALERTS | VIRUS |
|
29.9.26 |
ClosedQuorum - an autonomous AI Windows implant | Cisco Talos reported on a novel Windows implant dubbed ClosedQuorum that leverages autonomous decision loop determining its post-compromise actions. By bypassing conventional attacker-controlled infrastructure or live operator prompts, the implant queries a panel of prominent commercial large language models (LLMs): DeepSeek, Qwen, Mistral, and Google Gemini. | ALERTS | VIRUS |
|
24.9.26 |
ClickFix Campaign Delivers ChainScript RAT Disguised as Spotify, Zoom and Teams Installers | In a recent write-up, Blackpoint’s Adversary Pursuit Group (APG) details a previously undocumented Node.js remote access trojan tracked as ChainScript. Distributed through ClickFix social engineering lures disguised as legitimate corporate software like Spotify, Zoom, and Microsoft Teams, the malware deploys via custom Windows Installers that execute without requiring administrative rights. | ALERTS | CAMPAIGN |
|
24.9.26 |
Macfinger ClickFix operation | Latest SANS Internet Storm Center report examines an a recent operation dubbed the Macfinger ClickFix. This campaign compromises legitimate websites by injecting malicious scripts engineered specifically to profile visitors and exploit macOS systems. | ALERTS | OPERATION |
|
24.9.26 |
Rapuncel Infostealer | LastPass’s threat intelligence reported on a recent malware operation that mimicked more than forty brands on GitHub, including LastPass Authenticator. Dubbed Rapuncel, the infostealer was distributed through attacker-controlled infrastructure and the threat actors were leveraging a Microsoft-certified kernel driver in the attack chain. | ALERTS | VIRUS |
|
24.9.26 |
VelvetCake malware delivered via Operation Conflict Compass | SOCRadar Threat Research Unit reported on a cyberespionage initiative called Operation Conflict Compass, conducted by the North Korean threat group Vedalia (aka Konni). The campaign aimed to gather strategic intelligence regarding the progression of the Russia-Ukraine conflict, predominantly focusing on diplomatic institutions, non-governmental organizations, and think tanks. | ALERTS | VIRUS |
|
24.9.26 |
New updates in the latest iteration of the Vidar Infostealer malware | Vidar is an active information-stealing malware strain that systematically updates its evasion tactics to challenge security analysts and detection mechanisms. Latest research conducted by Zscaler ThreatLabz tracking iterations from version 2.0 through 3.4 illustrates that the threat actors continuously refine internal obfuscation while preserving core operational capabilities. In the most recent malware releases, sensitive strings are shielded through a proprietary virtual machine governed by an agile bytecode interpreter, deployed alongside an adaptable, | ALERTS | VIRUS |
|
24.9.26 |
SideCopys' attack chain leads to RAT deployment | Trellix analysts have documented the strategic shifts and operational scope of the threat group SideCopy, focusing on how their recent intrusions rely heavily on mshta.exe misuse to deploy remote access trojans (RATs). The attack sequence begins with phishing emails delivering suspicious ZIP archives. Unsuspecting targets extract and launch a malicious LNK shortcut file that fetches an HTML Application (HTA) hosted on remote adversary infrastructure. | ALERTS | VIRUS |
|
24.9.26 |
HeavyGram and CrudeExclude malware distribution | Group-IB cybersecurity researchers have identified novel variants of the HeavyGram and CrudeExclude malware strains. Expanding upon prior threat alerts and infrastructure seizures conducted by United States authorities, these operations are linked to an Iranian intelligence-affiliated adversary known as Handala Hack. Attackers typically lure targeted victims through messaging applications, delivering deceptive initial droppers that masquerade as legitimate software. | ALERTS | VIRUS |
|
24.9.26 |
RatHat Android Malware | In a recent write-up, Zimperium details RatHat, an Android malware family designed to harvest financial credentials, screen inputs, and two-factor authentication codes from compromised mobile devices. The malware is delivered mainly through smishing messages and malvertising that direct victims to fraudulent download portals hosting malicious APKs disguised as legitimate apps. | ALERTS | VIRUS |
|
17.9.26 |
KREMLIN toolkit leveraged in malicious operation REF9334 | Elastic Security Labs researchers have documented findings concerning a sophisticated Brazilian cybercrime operation tracked as REF9334 that impersonates roughly a dozen regional financial institutions to deploy rogue browser extensions. | ALERTS | VIRUS |
|
17.9.26 |
AutoIT delivery campaign distributing AsyncRAT malware | Point Wild Threat Intelligence documented a sophisticated, multi-tiered intrusion chain that deploys AsyncRAT malware variant. The compromise initiates via a deceptive batch script masquerading as an invoice file. Upon execution, this launcher invokes a covert PowerShell instance that pieces together ten fragmented Base64 strings, eliminates obfuscating filler characters, and unscrambles the data using a repeating XOR key. | ALERTS | CAMPAIGN |
|
17.9.26 |
VectraRAT - a new malware-as-a-service (MaaS) variant | SOCRadar’s research team has identified VectraRAT, a novel Malware-as-a-Service (MaaS) platform engineered entirely from the ground up. Architecturally, the ecosystem pairs a Go-based central command hub with an integrated Vue3 management console and a native C++ Windows client, utilizing a custom binary MessagePack TCP protocol for communication. | ALERTS | VIRUS |
|
17.9.26 |
Hagaseca THost9 - a multi-stage Android RAT Loader | The Hagaseca malware cluster targets Android systems, exploiting vulnerable, internet-facing Android Debug Bridge (ADB) ports as well as containerized Redroid environments. As reported by Dark Atlas researchers, the intrusion chain relies on a specialized packer and launcher, exemplified by the THost9 APK build. | ALERTS | VIRUS |
|
17.9.26 |
VHDX malware distribution campaign | Cybersecurity researchers from CYFIRMA uncovered a sophisticated malware operation mimicking India's Income Tax Department to compromise Windows systems. The adversaries deployed a number of fraudulent web domains designed to imitate authentic government revenue portals. The attack delivers its payload inside a virtual hard disk container (VHDX) masquerading as an official tax return utility. | ALERTS | CAMPAIGN |
|
17.9.26 |
PhantomRaven infostealer | CrowdStrike researchers recently identified a financially motivated threat actor, operating legitimately as a bug bounty researcher, who distributed a JavaScript-based infostealer dubbed PhantomRaven. The actor targeted software developers on the open-source npm registry by uploading typosquatted packages that housed benign code, like a basic "Hello, world!" script. | ALERTS | VIRUS |
|
17.9.26 |
KATARU IoT malware | KATARU is a novel IoT malware built atop a conventional Mirai foundation. As reported by Nozomi Networks researchers, the botnet exhibits unusually sophisticated technical capabilities, integrating local privilege escalation exploits, anti-analysis routines, decoy traffic generation, and broad persistence mechanisms spanning Android, desktop, router, and embedded Linux environments. | ALERTS | VIRUS |
|
12.9.26 |
SloppyRAT malware | Researchers at Zscaler ThreatLabz uncovered SloppyRAT, an emerging malware strain linked to ransomware operators aiming to establish initial footholds and facilitate lateral network traversal across victim environments. Delivered primarily through multi-stage ClickFix delivery campaigns, this remote access trojan supplies attackers with an expansive suite of built-in, PowerShell-like commands alongside reverse SOCKS proxy capabilities. | ALERTS | VIRUS |
|
12.9.26 |
Espionage Groups Deploy BlueMoon Exploit Chain | Researchers at Proofpoint recently reported on targeted spearphishing campaigns involving multiple state-aligned espionage groups utilizing a novel exploit framework dubbed BlueMoon. The campaigns primarily involve China-nexus threat groups, such as Sheathminer (aka APT31, TA412), targeting entities globally using newly staged infrastructure. | ALERTS | GROUP |
|
12.9.26 |
Telegram-beaconing VBS downloader deploys ScreenConnect RMM | Symantec has observed a campaign using an unobfuscated VBScript downloader distributed as a fake Adobe plugin update. The script fingerprints the host, attempts to disable Windows Defender and Smart App Control through registry policy writes, and then invokes msiexec to install a remotely hosted MSI package that deploys the ConnectWise ScreenConnect client, giving the actor access. | ALERTS | VIRUS |
|
12.9.26 |
Mantax Otax Android Malware | Researchers at Zimperium recently reported on Mantax Otax, a dual-function Android malware strain originating from threat actors based in Indonesia. The hybrid threat targets regional Android users by combining intrusive espionage tools and file-encryption capabilities into a single payload. | ALERTS | VIRUS |
|
12.9.26 |
GoldFactory threat group abuses Android Work Profiles with Vwork clone tool | Cybersecurity researchers at Group-IB discovered a novel defense-evasion technique used by the threat group GoldFactory, creators of the Gigabud Android banking trojan. The operators pair their malware with Vwork, an adapted variant of the open-source utility Shelter that exploits Android’s Work Profile architecture. | ALERTS | GROUP |
|
12.9.26 |
CL-CRI-1171 cybercrime operation | Unit 42 researchers uncovered an extensive, two-year cybercrime scheme designated as CL-CRI-1171. The group responsible functions as a commercial pay-per-install marketplace that distributes diverse payloads for third-party adversaries. The operation funnels traffic through two deceptive avenues: manipulated search engine results and influential gaming-focused YouTube channels. | ALERTS | CRIME |
|
4.9.26 |
Zawoo Ransomware | Researchers at CERTAINITY recently reported on Zawoo Team, a ransomware operation. The actor has been active since at least early August 2026 and brought its leak site online on 30 August, listing 19 victims at once, concentrated among small and micro enterprises in German-speaking Europe across engineering, industrial software, construction, hospitality and real estate. Access came through the victim's VPN using valid credentials for an already privileged account with no multi-factor authentication enforced, and no exploitation or escalation was observed. | ALERTS | RANSOM |
|
4.9.26 |
Mirage Kitten Expands Toolset with Cross-Platform NodeRabbit and PollCat RATs | In a recent write-up, Kaspersky details a campaign by the Iranian threat group Mirage Kitten targeting aviation, FinTech, and technology organizations across the Middle East and Africa. The threat actor recruits candidates on professional networking platforms and entices software engineers to download trojanized coding challenges hosted on cloud storage. | ALERTS | APT |
|
4.9.26 |
SleepWalker backdoor | SleepWalker is a stealthy Windows backdoor identified by an independent researcher at r136a1 that departs from typical malware by staying dormant rather than beaconing to an external command server. Disguised as a native Microsoft dynamic link library with falsified ESET metadata, the implant relies on DLL side-loading to run inside the official ESET Management Agent executable. | ALERTS | VIRUS |
|
4.9.26 |
Node.js: Old Technique Makes a Comeback | Between March and July 2026, attackers who compromised a technology start-up in Asia ran into a problem: almost every payload they attempted to deploy, including AdaptixC2 agents and Cobalt Strike Beacon, was blocked on the victim's network. Their response was to download the official Node.js installer from nodejs.org and use the trusted, signed runtime to execute a malicious implant. | ALERTS | VIRUS |
|
4.9.26 |
GOLD SHERWOOD Operators Leverage Credential Abuse and EDR Killers in The Gentlemen Ransomware Attacks | Researchers at Sophos recently reported on the post-exploitation tactics and intrusion mechanics associated with The Gentlemen Ransomware-as-a-service (RaaS) operations. This activity is attributed to the GOLD SHERWOOD threat group. Threat actors reportedly gain initial access through various means, such as exploiting unpatched edge devices or by leveraging compromised VPN user credentials without multi-factor authentication. | ALERTS | OPERATION |
|
4.9.26 |
BraZetsu - a Python-based malware | Discovered by Group-IB analysts and attributed with high confidence to the Brazilian cybercrime group Exilware, BraZetsu is a modular, Python-based malware framework designed specifically for Initial Access Brokers (IABs). The codebase suggest heavy reliance on generative AI during the development process. | ALERTS | VIRUS |
|
2.9.26 |
RevStealer malware impersonates legitimate software | RevStealer is an infostealer variant found to be commonly distributed under the disguise of trojanized Electron desktop application. As reported by researchers from Morphisec, this malware strain is primarily spread through game-cheat websites and fake GitHub repositories. | ALERTS | VIRUS |
|
2.9.26 |
Fiasco Ransomware | Symantec has collected and analyzed a ransomware binary that belongs to a likely new double-extortion ransomware actor who goes by the name of "Fiasco". They utilize a Rust-written Windows 64Bit PE to encrypt files and append a .secure extension. | ALERTS | RANSOM |
|
2.9.26 |
KryBit Ransomware | KryBit is a cross-platform Ransomware-as-a-Service (RaaS) that targets endpoints, virtual machines, and network storage spanning Windows, Linux, and VMware ESXi environments. As per a recent report from Picus Security, the attackers behind this ransomware variant are employing a double-extortion model, and exfiltrating sensitive data before encrypting sensitive files, appending them with a .KRYBIT extension and leaving a ransom note in the form of a .txt file. | ALERTS | RANSOM |
|
2.9.26 |
Adware Sideloading Chain Deploys ValleyRAT Payload | Kaspersky has published a report on a campaign distributing the ValleyRAT backdoor disguised as adware. The malware arrives through installer files that, depending on a naming variant, install a decoy application such as a collaboration tool or browser while covertly deploying a modified version of a legitimate Chinese wallpaper utility. They're using that utility for DLL sideloading, so the malicious library gets to run under cover of a signed process. | ALERTS | VIRUS |