Inside Wazza: A Newly Observed Device Code Phishing Kit Targeting Microsoft 365 Accounts 2026-10-20 75 Cris Tomboc and Kevin Adriano True Inside PhantomPolia: Remus Stealer Delivery via Donut Shellcode in ClickFix Campaign 2026-10-07 77 King Orande and Cris Tomboc True Filling the Well: Nightmare-Eclipse's BigDiskBuster and the Defender Update That Never Lands 2026-10-05 55 Serhii Melnyk and Timmy Lister True TIKTOUK: Tracing a WordPress Credential Collection Toolkit 2026-10-01 78 Maor Gabay True Citrix NetScaler CVE-2026-88771: Observed Exploitation Artifacts and Hunt Indicators 2026-09-30 80 Sean Shirley True Citrix NetScaler Zero-Day Exploited Globally 2026-09-29 90 Karl Sigler True File Acquisition May Be Recorded as “FileAccessed” in Microsoft 365 (“M365”) 2026-09-24 72 Jamie Mamroe True Enumerating Users and MFA via Microsoft's Password Reset Portal 2026-09-23 60 Matthew Coady True One Patch Behind: Nightmare-Eclipse's ShieldCrash and the Defender Bypass That Won't Stay Fixed 2026-09-16 55 Serhii Melnyk and Timmy Lister True Expanding the Attack Surface: Analyzing Nightmare-Eclipse's Latest PoCs 2026-09-09 75 Serhii Melnyk and Timmy Lister True Still Circling: Inside the Operator Behind Blind Eagle's GitHub Loader 2026-08-28 75 Serhii Melnyk True Energy Disruption in UK Critical Infrastructure and the Growing OT Cyber Threat 2026-08-25 65 Nikita Kazymirskyi True Cloud Sync Root RegistrationShieldBreak: Hunting Windows Defender Remediation Abuse and Cloud Files Hijacking 2026-08-19 75 Serhii Melnyk and Timmy Lister True Release the RAVEN: Destruction and Discipline 2026-08-18 75 Karl Biron True Release the RAVEN: Data Heist and Persistence 2026-08-14 80 Karl Biron True Release the RAVEN: Kibana Under Siege 2026-08-13 85 Karl Biron True The Infrastructure Relay: Inside Multi-Stage Phishing Redirection Chains 2026-08-12 70 Karla Agregado True CNCMachineRMS: The Undocumented RAT At the End of a BabaDeda Chain 2026-08-10 80 Rodel Mendrez True Beyond ‘Fake Updates’: From Application Store-Themed Phishing to Large-Scale Distribution of ScreenConnect 2026-08-07 78 King Orande and Cris Tomboc True Release the RAVEN: Exploiting the Cracks 2026-08-06 70 Karl Biron True Release the RAVEN: First Contact 2026-08-05 70 Karl Biron True Review of the July 2026 Cyberattacks Against U.S. Water and Wastewater Systems 2026-08-04 80 Nikita Kazymirskyi True Release the RAVEN: An Offensive Reconnaissance and Attack Tool on Vulnerable Elasticsearch Nodes 2026-07-29 75 Karl Biron True LegacyHive: Hunting Windows Profile Initialization Abuse Through Offline Registry Manipulation 2026-07-27 65 Serhii Melnyk and Timmy Lister True LevelBlue TTP Briefing Q2 2026: Stolen Identities Outpace Defenses 2026-07-23 80 True Exploitarium: Inside the Archive Behind the Mass 0-Day Drop 2026-07-21 70 Serhii Melnyk True LegacyHive: Nightmare-Eclipse’s Latest Zero-Day Drop with a Stripped PoC 2026-07-20 70 Pauline Bolaños True Still Circling: Blind Eagle's Toolkit Keeps Evolving 2026-07-17 80 Serhii Melnyk True ClickFix on macOS: Blockchain-Powered Infostealer Hidden Inside Compromised Websites 2026-07-16 75 Rodel Mendrez True Mitigating New Vulnerabilities with owLSM 2026-07-13 55 True Hiding in the Chain: Multi-Stage LNK Attack Leveraging TON Blockchain to Deliver Node.JS Backdoor 2026-07-09 75 Nathaniel Morales True From Phishing to Persistence: A CrySome RAT Infection Chain Analysis 2026-07-06 78 Sean Shirley and Kyle Sopt True AsyncRAT and Remcos Delivered in Multi-Stage Phishing Campaign 2026-07-02 75 LevelBlue SpiderLabs True An Analysis of ValleyRAT Infection Campaigns from Fake Installers, Japanese Malicious Emails 2026-06-30 72 Hajime Takai True Novel Java-Based QuimaRAT Targets Windows, macOS, and Linux 2026-06-25 75 True LokiBot After a Decade: An Analysis of a Recent LokiBot Campaign 2026-06-24 70 Dawid Nesterowicz True Operation FlutterBridge: The FlutterShell macOS Backdoor 2026-06-18 75 Maor Gabay True RoguePlanet and GreatXML: Detecting Local Privilege Escalation and BitLocker Security Boundary Abuse 2026-06-17 75 Serhii Melnyk True Reversing NVIDIA’s CVE-2026-24190: How a Kernel Flaw Put Enterprise AI Clusters and Workstations at Risk 2026-06-15 78 Alon Bancic True The Device Code Phishing Tsunami: What We’re Seeing in the Wild 2026-06-09 75 John Kevin Adriano True macOS ClickFix Social Engineering Campaigns 2026-06-04 78 Maor Gabay True ClickFix Is Now Hiring: From Job Platform Impersonation to Python-Based RAT Delivery 2026-06-04 75 King Orande and Cris Tomboc True The Demon Arrives Later: A Havoc Stager Hides Behind Microsoft Defender DLP 2026-06-03 75 Jose Martin True Sapphire Sleet Targets macOS in Multi-Stage Intrusion Campaign 2026-05-28 90 Maor Gabay True From WinRE to SYSTEM: Hunting the YellowKey and MiniPlasma Attack Chain 2026-05-22 76 True YellowKey and GreenPlasma: Two New Windows Zero-Days Unveiled 2026-05-19 88 James Ballantyne True A Closer Look at The Gentlemen’s Alleged Leak 2026-05-18 85 Arthur Erzberger True Threat Analysis: Backdoored Electron Apps Evading Defenses 2026-05-08 70 Michael Morose True Unmasking a Multi-Stage Loader: AutoIt Abuse Leading to Vidar Stealer Command-and-Control Communication 2026-05-07 70 Mahadev Joshi True LevelBlue TTP Briefing Q1 2026: Trust Abuse Exposes Weaknesses 2026-05-05 78 True 
