Beyond ‘Fake Updates’: From Application Store-Themed Phishing to Large-Scale Distribution of ScreenConnect 2026-08-07 True King Orande and Cris Tomboc True Release the RAVEN: Exploiting the Cracks 2026-08-06 True Karl Biron True Release the RAVEN: First Contact 2026-08-05 True Karl Biron True Review of the July 2026 Cyberattacks Against U.S. Water and Wastewater Systems 2026-08-04 True Nikita Kazymirskyi True Release the RAVEN: An Offensive Reconnaissance and Attack Tool on Vulnerable Elasticsearch Nodes 2026-07-29 True Karl Biron True LegacyHive: Hunting Windows Profile Initialization Abuse Through Offline Registry Manipulation 2026-07-27 True Serhii Melnyk and Timmy Lister True LevelBlue TTP Briefing Q2 2026: Stolen Identities Outpace Defenses 2026-07-23 True True Exploitarium: Inside the Archive Behind the Mass 0-Day Drop 2026-07-21 True Serhii Melnyk True LegacyHive: Nightmare-Eclipse’s Latest Zero-Day Drop with a Stripped PoC 2026-07-20 True Pauline Bolaños True Still Circling: Blind Eagle's Toolkit Keeps Evolving 2026-07-17 True Serhii Melnyk True ClickFix on macOS: Blockchain-Powered Infostealer Hidden Inside Compromised Websites 2026-07-16 True Rodel Mendrez True Mitigating New Vulnerabilities with owLSM 2026-07-13 True True Hiding in the Chain: Multi-Stage LNK Attack Leveraging TON Blockchain to Deliver Node.JS Backdoor 2026-07-09 True Nathaniel Morales True From Phishing to Persistence: A CrySome RAT Infection Chain Analysis 2026-07-06 True Sean Shirley and Kyle Sopt True AsyncRAT and Remcos Delivered in Multi-Stage Phishing Campaign 2026-07-02 True LevelBlue SpiderLabs True An Analysis of ValleyRAT Infection Campaigns from Fake Installers, Japanese Malicious Emails 2026-06-30 True Hajime Takai True Novel Java-Based QuimaRAT Targets Windows, macOS, and Linux 2026-06-25 True True LokiBot After a Decade: An Analysis of a Recent LokiBot Campaign 2026-06-24 True Dawid Nesterowicz True Operation FlutterBridge: The FlutterShell macOS Backdoor 2026-06-18 True Maor Gabay True RoguePlanet and GreatXML: Detecting Local Privilege Escalation and BitLocker Security Boundary Abuse 2026-06-17 True Serhii Melnyk True Reversing NVIDIA’s CVE-2026-24190: How a Kernel Flaw Put Enterprise AI Clusters and Workstations at Risk 2026-06-15 True Alon Bancic True The Device Code Phishing Tsunami: What We’re Seeing in the Wild 2026-06-09 True John Kevin Adriano True macOS ClickFix Social Engineering Campaigns 2026-06-04 True Maor Gabay True ClickFix Is Now Hiring: From Job Platform Impersonation to Python-Based RAT Delivery 2026-06-04 True King Orande and Cris Tomboc True The Demon Arrives Later: A Havoc Stager Hides Behind Microsoft Defender DLP 2026-06-03 True Jose Martin True Sapphire Sleet Targets macOS in Multi-Stage Intrusion Campaign 2026-05-28 True Maor Gabay True From WinRE to SYSTEM: Hunting the YellowKey and MiniPlasma Attack Chain 2026-05-22 True True YellowKey and GreenPlasma: Two New Windows Zero-Days Unveiled 2026-05-19 True James Ballantyne True A Closer Look at The Gentlemen’s Alleged Leak 2026-05-18 True Arthur Erzberger True Threat Analysis: Backdoored Electron Apps Evading Defenses 2026-05-08 True Michael Morose True Unmasking a Multi-Stage Loader: AutoIt Abuse Leading to Vidar Stealer Command-and-Control Communication 2026-05-07 True Mahadev Joshi True LevelBlue TTP Briefing Q1 2026: Trust Abuse Exposes Weaknesses 2026-05-05 True True Inside Vect Ransomware-as-a-Service 2026-04-30 True SpiderLabs Researcher True Hacking Hotels via Smart Stationary Bikes: How Unsecured Gym Equipment Can Lead to RCE 2026-04-29 True John Lopez True Crypto Drainers as a Converging Threat: Insights into Emerging Hybrid Attack Ecosystems 2026-04-23 True Serhii Melnyk, King Orande, Cris Tomboc, Sean Shirley True A Closer Look at the Novel and Stealthy KarstoRAT Malware 2026-04-21 True Chen Aviani True Go With the Flow: Abusing OAuth Device Code Flow 2026-04-20 True Jakub Wiewiorski True RedSun and the Expanding Risk Window: Why Microsoft Defender Patching Can’t Wait 2026-04-17 True True Why Attackers Are Bypassing Phishing Emails and Targeting Identity Instead 2026-04-13 True Jamie Mamroe True Trojanized CPUID HWMonitor Installer Delivers Fileless .NET Payload via Obfuscated IPv6 Scriptlet 2026-04-10 True Sean Shirley True Axios NPM Package Supply Chain Compromise Leads to RAT Deployment 2026-04-09 True Mahadev Joshi and Sho Kishimoto True Err-Hiding and Seek: How ErrTraffic v3 Leverages EtherHiding in ClickFix Campaign 2026-04-09 True King Orande and Cris Tomboc True Major Supply Chain Compromise in the Popular axios npm Package 2026-04-03 True Karl Sigler True Using RF Power Levels to Defeat MAC Address Randomization Enabling Passive Device Tracking 2026-03-31 True Tom Neaves True Azure ServiceBus WebSockets as a C2 Channel 2026-03-24 True Stuart White True Tracing a Multi-Vector Malware Campaign: From VBS to Open Infrastructure 2026-03-23 True Sean Shirley True “Say My Name”: How MioLab is building MacOS Stealer Empire 2026-03-20 True Mark Tsipershtein and Evgeny Ananin True Fake CAPTCHA Campaign: Inside a Multi-Stage Stealer Assault 2026-03-19 True Shabtay Barel, Serhii Melnyk, Rodel Mendrez True KongTuke: A King Among Threat Groups 2026-03-18 True True How LevelBlue OTX and Cybereason XDR Detected a North Korea-Linked Remote IT Worker 2026-03-17 True Tue Luu True 
