Find what you’re looking for
Browse everything
6,868 results in Threat Reports
DOUBLECUP Malware: When PNG Files Become PowerShell Delivery Vehicles
DOUBLECUP malware represents a novel approach to payload delivery by appending PowerShell scripts directly to PNG image files rather than using traditional steganographic techniques. Discovered in August 2024, this malware cleverly leverages Windows' FINDSTR command to extract and execute malicious PowerShell code that is concatenated to legitimate image files. The technique bypasses traditional detection methods by disguising malicious payloads as image files while avoiding complex steganographic encoding that might trigger security tools. The malware uses carriage return and newline characters to facilitate payload extraction, demonstrating attackers' continued innovation in file-based attack vectors. This incident highlights the evolving sophistication of malware delivery mechanisms as threat actors seek new ways to evade detection systems that rely on traditional file analysis and steganographic detection tools.
ToxicPanda 2.0: The Android Banking Trojan That Hijacks VPN Permissions
ToxicPanda 2.0 Android malware emerged in August 2026 with sophisticated capabilities targeting 349 banking and financial applications across 16 countries. The malware exploits VPN service permissions to create local network interfaces that block Google Play communications, preventing security updates and Play Protect interference. It leverages Accessibility Services to automatically enable Wireless ADB debugging, gaining shell-level access to execute high-privilege commands and bypass Android security restrictions. The malware supports 167 remote commands and includes invisible phishing overlays that capture credentials and device PINs while maintaining persistence across major Android device manufacturers. Mobile banking trojans are experiencing a resurgence in 2026, with threat actors increasingly targeting VPN permissions and ADB abuse techniques to circumvent Google's enhanced security measures and maintain persistent access to compromised devices.
Critical TSN Protocol Flaws Expose Industrial Control Systems to Manipulation
In August 2026, cybersecurity researchers from Nozomi Networks disclosed critical vulnerabilities in Time-Sensitive Networking (TSN) protocols, specifically targeting Mitsubishi Electric's CC-Link IE TSN implementation. The research demonstrated how attackers could exploit Layer 2 security weaknesses and TSN switch management interface flaws to inject malicious traffic into industrial control systems. Successful exploitation allows complete manipulation of operational technology processes, including starting and stopping robotic arms, tampering with synchronization clocks, and disrupting safety-critical communications in manufacturing environments. This research highlights the growing security challenges as industrial automation increasingly adopts TSN protocols for deterministic communication. With nation-state actors targeting critical infrastructure and the convergence of IT and OT networks accelerating, these vulnerabilities expose fundamental weaknesses in emerging industrial protocols that prioritize availability over security.
First-Ever Android Car Head Unit Malware: MoYu Group's Supply Chain Attack Analysis
In August 2026, Kaspersky researchers discovered a sophisticated supply-chain attack by the MoYu threat group targeting Android-based car head units manufactured by DoFun, a Chinese automotive software provider. The attackers compromised the legitimate TWCore system app to deliver JarService malware, which established command-and-control communication and downloaded additional payloads. The malware transformed infected head units into proxy botnet nodes and conducted advertising fraud operations, marking the first documented malware infection chain specifically designed for automotive head units. While the malware did not interfere with critical vehicle systems, it demonstrated a new attack vector in the expanding Internet of Things landscape. This incident highlights the growing security risks in connected vehicle ecosystems as automotive manufacturers increasingly integrate internet-connected Android systems. The attack underscores vulnerabilities in automotive supply chains and the emergence of vehicles as new targets for cybercriminal monetization schemes.
Windows Named Pipes Under Attack: Critical Privilege Escalation Vulnerability Analysis
Windows named pipes, a critical interprocess communication mechanism, have become a significant attack vector for privilege escalation vulnerabilities in 2024. Security researchers have identified multiple instances where attackers exploit weak access controls on named pipes to gain elevated privileges and move laterally within Windows environments. These attacks leverage improperly configured pipe permissions, allowing untrusted processes to communicate with privileged services, ultimately leading to system compromise. The exploitation typically involves identifying accessible named pipes, crafting malicious requests, and leveraging inadequate input validation to execute code with elevated privileges. This attack vector has gained prominence as organizations increasingly adopt zero-trust architectures and attackers shift focus to Windows-specific interprocess communication flaws. The rise in named pipe exploitation coincides with growing ransomware campaigns targeting enterprise Windows infrastructure and sophisticated APT groups leveraging these techniques for persistent access.
Critical Zimbra Vulnerability Added to CISA's KEV Catalog Following Active Exploitation
CISA has added CVE-2026-73570, a critical OS command injection vulnerability in Zimbra Collaboration Suite, to its Known Exploited Vulnerabilities Catalog following evidence of active exploitation in the wild. This vulnerability allows attackers to execute arbitrary operating system commands on compromised Zimbra servers, potentially leading to complete system takeover. The addition coincides with CISA's new Binding Operational Directive (BOD) 26-04, which requires federal agencies to prioritize remediation of KEV-listed vulnerabilities on publicly exposed assets that grant total control post-exploitation. This development highlights the continued targeting of enterprise collaboration platforms by threat actors seeking to establish persistent footholds in corporate networks. As hybrid work environments increasingly rely on email and collaboration infrastructure, vulnerabilities in platforms like Zimbra represent high-value targets for initial access brokers and advanced persistent threat groups.
Critical SAML Vulnerability in Citrix NetScaler Enables Unauthenticated Remote Code Execution
CVE-2026-8452 is a critical heap overflow vulnerability (CVSS 8.8) in Citrix NetScaler ADC and Gateway SAML authentication processing, discovered by JPMorgan Chase's XOR team. The vulnerability allows unauthenticated attackers to trigger memory corruption through a single malformed SAML request containing an oversized PrefixList parameter, potentially leading to remote code execution. The flaw affects the packet engine process that handles all traffic through the appliance, requiring no authentication to exploit and impacting any Gateway or AAA virtual server with SAML configuration. This vulnerability highlights the growing threat to identity infrastructure and SAML-based authentication systems, which have become prime targets for attackers seeking to compromise enterprise perimeter defenses. With NetScaler appliances commonly deployed at network edges and trusted by internal systems, successful exploitation could provide attackers with significant access to corporate environments.
ChainDrop npm Worm Exposes Critical Gaps in Software Supply Chain Security
In August 2026, the ChainDrop npm worm compromised over 400 JavaScript packages including popular libraries like keyv and cacheable-request through a sophisticated three-stage attack. The malware used malicious preinstall scripts to download obfuscated payloads, directly harvested credentials from GitHub Actions runner memory and local developer environments, then self-propagated using stolen npm and GitHub tokens. The attack established persistent backdoors in developer tools like VS Code while managing command-and-control infrastructure through Ethereum blockchain transactions, demonstrating unprecedented sophistication in supply chain attacks. This incident represents a critical escalation in supply chain warfare, where attackers now target the development infrastructure itself rather than just finished applications. With modern codebases containing 80-90% open-source components and developers routinely executing code from thousands of dependencies, the attack surface has expanded exponentially beyond traditional security perimeters.
Apollo Global Management Hit by BlackFile Social Engineering Attack: $1 Trillion Firm Discloses Data Breach
Apollo Global Management disclosed a data breach occurring between July 6-10, 2024, where attackers used social engineering tactics to gain unauthorized access to cloud platforms. The attack was attributed to BlackFile, a threat group affiliated with The Com collective, which has been targeting financial institutions, law firms, and medical technology companies. Personal data including names, Social Security numbers, dates of birth, and contact information were compromised, though Apollo found no evidence of data being posted online or used for identity theft. This incident exemplifies the growing threat of sophisticated social engineering campaigns targeting the financial sector, particularly as cybercriminals increasingly focus on high-value private equity firms and leverage voice-phishing techniques to bypass traditional security controls.
SickKids Hospital Data Breach Exposes Critical Third-Party Security Gaps
In December 2024, Toronto's Hospital for Sick Children (SickKids) disclosed a cybersecurity incident that exposed personal information of current and former employees and job applicants through a vulnerability in third-party software. The breach affected human resources data including names, addresses, phone numbers, and employment details, while clinical systems and patient records remained unaffected. SickKids immediately secured the compromised system, launched an investigation with cybersecurity experts, and began notifying affected individuals while implementing additional security measures. This incident highlights the growing trend of healthcare organizations facing data breaches through third-party vendor vulnerabilities, a critical concern as healthcare becomes increasingly digitized and regulatory scrutiny intensifies under frameworks like HIPAA and emerging privacy legislation.
Novel FTP Banner Attack Delivers E4del and PINHOLE RATs in 2026 Campaign
In July 2026, threat actors developed a novel attack technique using FTP server banners as dead-drop resolvers to deliver two previously undocumented remote access trojans: E4del and PINHOLE. The campaign begins with phishing attacks distributing ZIP archives containing malicious LNK files that connect to compromised FTP servers to retrieve PowerShell commands embedded in server greeting banners. E4del masquerades as Discord using a digitally signed Electron application, while PINHOLE uses sophisticated evasion techniques including shellcode fluctuation and retrieval of C2 configurations from Pinterest and SurveyMonkey. SOCRadar researchers found this technique remained active through August 2026 with new infrastructure continuously deployed. This incident highlights the evolution of living-off-the-land techniques where attackers abuse legitimate protocols and services to evade detection, representing a broader trend toward more sophisticated command and control methods that bypass traditional security controls.
TrueConf Server Supply Chain Attack: How Head Mare Exploited Critical CVE-2026-72529 Vulnerability
In August 2026, CISA ordered federal agencies to patch two critical TrueConf Server vulnerabilities (CVE-2026-72529 and CVE-2026-72530) within two weeks after adding them to the Known Exploited Vulnerabilities catalog. The flaws allow unauthenticated remote code execution and sandbox escape attacks on the self-hosted communications platform. The Head Mare hacktivist group has been actively exploiting these vulnerabilities since July 2026 to replace legitimate client installers with backdoor-laden versions, targeting Russian organizations across transportation, energy, and IT sectors. This incident follows previous TrueConf compromises, including Operation True Chaos linked to Chinese threat actors in April 2026. This attack highlights the growing trend of supply chain compromises targeting enterprise communication platforms, particularly as organizations increasingly rely on self-hosted solutions for secure corporate messaging and video conferencing amid rising cybersecurity concerns about cloud-based alternatives.