Find what you’re looking for
Browse everything
6,877 results in Threat Reports
Evasive Panda: APT Delivers MgBot via DNS Poisoning in Asia (2022–2024)
Between November 2022 and November 2024, the Evasive Panda APT group executed a sophisticated campaign targeting victims primarily in Türkiye, China, and India. Leveraging adversary-in-the-middle (AitM) techniques and DNS poisoning, the attackers delivered a unique MgBot malware implant through fake software updates and stealthy loaders. The operation employed hybrid encryption, memory injection in signed executables, and evaded traditional defenses to maintain long-term persistence. Multiple new and legacy C2 infrastructures enabled sustained access while attackers tailored payloads based on the victim’s OS. This incident showcases the ongoing evolution of nation-state threat actors, utilizing advanced evasion, supply chain impersonation, and DNS manipulation to bypass security controls. It reflects a broader surge in attacks exploiting trust in software supply chains and underlines the need for continuously adaptive security strategies as actor sophistication grows.
MacSync Stealer 2025: Notarized macOS Malware Defeats Gatekeeper Protections
In June 2025, security researchers uncovered a new campaign leveraging a variant of the MacSync information stealer, which specifically targets macOS devices. In this incident, attackers distributed malware using a digitally signed and Apple-notarized Swift-based application disguised as a messaging app installer. This approach allowed the threat to bypass Apple Gatekeeper security controls designed to prevent unauthorized software execution. Once executed, the stealer harvested sensitive user data—such as browser credentials, wallets, and system information—and exfiltrated it to remote attacker-controlled servers, posing significant operational and reputational risks to affected organizations and users. This incident highlights a growing trend wherein adversaries employ legitimate-looking, signed applications to circumvent platform defenses. With an uptick in sophisticated macOS attacks and abuse of code-signing, organizations need to bolster defenses and maintain heightened vigilance for notarized application threats in enterprise environments.
Nomani Scam Exposes AI Deepfake Threats to Social Media in 2025
In 2025, the Nomani investment scam surged by 62%, leveraging sophisticated AI-based deepfake advertisements across major social media platforms including Facebook and YouTube. The scheme utilized convincing fake endorsements and manipulated video content to lure unsuspecting individuals into fraudulent investment schemes. Security firm ESET recorded over 64,000 unique URLs distributing the fraudulent campaign, indicating an expansion both in scale and reach. The attackers exploited trust in familiar faces, rapidly spreading the scam and leading to substantial financial losses and reputational risks for victims and targeted brands. This incident highlights the growing threat of AI-enabled social engineering, with deepfakes enabling unprecedented scale and believability. As identity manipulation technologies proliferate, organizations and regulators face increased pressure to combat fraud, educate users, and adapt security controls to counter the evolving landscape of digital deception.
Webrat Infostealer Campaign: How Fake GitHub Exploits Breached the Cybersecurity Supply Chain
In early 2025, security researchers identified a campaign distributing the Webrat infostealer through malicious GitHub repositories. The threat actors disguised their malware as proof-of-concept exploits for high-profile vulnerabilities, targeting not only gamers and users of cracked software, but also inexperienced cybersecurity professionals and students. Victims who downloaded these fake exploits unwittingly executed a dropper that installed Webrat, granting attackers administrator privileges, disabling security controls, and enabling data theft from wallets and communication platforms while providing backdoor access and surveillance. This incident underscores a growing attacker trend of abusing trust in open-source platforms and targeting cybersecurity researchers themselves. As the use of AI-generated content and supply chain attacks increase, professionals must exercise greater scrutiny when handling code from unverified sources, amplifying the need for security awareness and robust isolation practices.
WebRAT Infostealer Abuses GitHub: 2024 Supply Chain Attack Exposed
In June 2024, cybersecurity researchers observed a campaign distributing the WebRAT infostealer through malicious GitHub repositories. Threat actors uploaded repositories pretending to offer proof-of-concept exploits for recent vulnerabilities, luring security professionals and researchers to download and execute the malware. Once installed, WebRAT exfiltrates sensitive information, leverages encrypted channels to evade detection, and can facilitate follow-on attacks via credential or data theft. This campaign underscores the risks in sourcing security tools or code from unverified public repositories and demonstrates the sophistication of modern software supply chain attacks. The incident highlights the growing trend of cybercriminals abusing trusted platforms like GitHub to reach a wide audience. With infostealer malware evolving and developer-targeted attacks increasing, organizations must remain vigilant about supply chain security and implement controls to detect and block lateral movement or data exfiltration.
Malicious Chrome Extensions Steal Credentials in 2024 Supply-Chain Attack
In June 2024, security researchers discovered two malicious Chrome extensions, 'Phantom Shuttle,' available in the official Web Store, that masqueraded as proxy service plugins but instead hijacked users’ browser sessions. Once installed, these extensions intercepted sensitive user data—including login credentials—by redirecting and manipulating network traffic. By deploying the extensions within the Chrome browser ecosystem, threat actors leveraged a trusted supply-chain vector to reach a broad user base without raising immediate suspicion, resulting in widespread data theft before the plugins were reported and removed. This incident highlights the persistent risks associated with supply-chain compromise in browser extension ecosystems. Attackers increasingly exploit official platforms like Chrome’s Web Store to distribute malicious tools, circumvent traditional network defenses, and exfiltrate credentials, underscoring the need for robust extension vetting, user education, and advanced detection capabilities.
Urban VPN Proxy Secretly Harvests AI Chat Data in Major 2025 Breach
In December 2025, security researchers revealed that Urban VPN, a widely used proxy extension, was surreptitiously intercepting conversations across multiple major AI platforms including ChatGPT, Claude, Gemini, and others. The extension embedded specialized scripts to harvest every prompt, response, and session identifier, regardless of VPN connectivity, compromising the privacy of millions of users. This covert data collection occurred without user awareness or consent, and the only available mitigation was uninstalling the extension altogether. Widespread harvesting of AI chat data raised severe concerns over data confidentiality and regulatory non-compliance. This incident underscores the increasing exploitation of browser extensions as attack vectors, especially as user reliance on generative AI tools for sensitive communications grows. The lack of transparency and opt-out mechanisms amplifies exposure to data-harvesting malware and highlights urgent needs for enhanced supply-chain vetting and detective controls in both enterprise and consumer environments.
INTERPOL’s Landmark Crackdown: 574 Cybercrime Arrests across Africa in Operation Sentinel
In November 2025, INTERPOL coordinated Operation Sentinel across 19 African nations, resulting in the arrest of 574 suspected cybercriminals and recovery of $3 million. The operation targeted major cybercrime networks involved in business email compromise (BEC), digital extortion, and related ransomware campaigns. Notably, a Ukrainian national associated with ransomware operations pled guilty, highlighting the global breadth of these criminal networks. The operation uncovered sophisticated use of encrypted communication and lateral movement tactics to evade detection, impacting financial institutions and businesses across the continent. The crackdown underscores the evolving nature of cybercrime, with attackers leveraging advanced techniques and international collaboration among law enforcement agencies rising in response. Increased BEC and ransomware threats have pressed organizations in Africa and globally to evaluate existing cybersecurity and compliance controls.
How Phantom Shuttle Chrome Extensions Undermined Enterprise Security with Man-in-the-Middle Attacks
In December 2025, cybersecurity researchers discovered two versions of a Google Chrome extension named 'Phantom Shuttle' that secretly intercepted network traffic and stole user credentials from over 170 targeted domains. Masquerading as a legitimate VPN and speed test tool, these browser add-ons leveraged proxy permissions and malicious JavaScript code to inject authentication credentials and enable man-in-the-middle attacks. Users paid for subscriptions believing they were purchasing a secure service, while in reality, their web traffic, including passwords, authentication cookies, credit card information, API keys, and browsing histories, was exfiltrated continuously to a threat actor-controlled command-and-control server. The operation leveraged a subscription model and payment integrations via Alipay and WeChat, while traffic was routed through threat actor proxies managed via PAC scripts. This incident highlights a growing trend of browser extension abuse, with attackers monetizing malicious add-ons under the guise of productivity or security tools. With enterprise users increasingly utilizing browser extensions for business workflows, unmanaged browser risk is rapidly becoming a critical threat to organizational data security and compliance.
Amazon Thwarts Massive North Korean IT Job Scam: Lessons in Zero Trust and Insider Defense
In 2024, Amazon confronted a surge of over 1,800 suspected North Korean state-sponsored IT job scammers who attempted to infiltrate the company’s workforce through fraudulent job applications. The attackers used sophisticated social engineering and impersonation tactics to pose as legitimate IT professionals, seeking remote work to gain internal access or sensitive data. Amazon’s security and HR teams collaborated to detect anomalies, verify identities, and block the hiring process for the fraudulent profiles, successfully preventing insider threats and potential exploitation of corporate assets. The operation underscores the increasing complexity and scale of employment-based attack vectors. This incident is particularly relevant as cybercriminals and nation-state actors are increasingly leveraging remote work trends and IT labor shortages to execute social engineering intrusions. It highlights the need for enhanced workforce vetting, robust anomaly detection, and proactive segmentation to protect organizations from evolving insider and supply chain threats.
Mitsubishi Electric ICS Flaw in 2025 Highlights Need for Encrypted Traffic
In December 2025, the Cybersecurity and Infrastructure Security Agency (CISA) released an advisory detailing a critical vulnerability affecting Mitsubishi Electric Air Conditioning Systems that are widely deployed in industrial environments. The issue, cataloged as ICSA-25-177-01, centers on insufficient encryption for industrial control system (ICS) communications, exposing unencrypted traffic that could be intercepted and manipulated by malicious actors. If exploited, this vulnerability could enable attackers to intercept sensitive data or issue unauthorized commands to affected ICS devices, putting essential infrastructure operations at risk. Immediate mitigation steps were recommended for organizations to safeguard operational technology environments and prevent exploitation. This incident draws attention to the persistent risks of unencrypted or poorly protected network traffic within legacy ICS deployments. As digital transformation accelerates and threat actors increasingly target critical infrastructure, robust encrypted traffic solutions and segmentation controls are vital to ensure compliance and operational resilience.
Threat Actors Exploit Zero-Day Vulnerability in WatchGuard Firebox Devices
In early 2024, cybercriminals exploited a previously unknown zero-day vulnerability in WatchGuard Firebox firewall devices, enabling unauthorized remote access and control over affected appliances. Attackers leveraged this flaw to bypass authentication, deploy malware, and establish persistent footholds within targeted organizational networks. The campaign resulted in potential data breaches, service disruptions, and exposure of sensitive internal traffic due to compromised network perimeters. WatchGuard has since released urgent patches and guidance, while security teams raced to detect and remediate compromised devices. This incident highlights the persistent targeting of edge security appliances by advanced threat actors and the speed at which zero-day exploits are weaponized. As remote work and hybrid cloud adoption surge, organizations must prioritize rapid patching and enhanced detection to mitigate risks posed by critical perimeter vulnerabilities.