ThreatVectr

Threat Intelligence — Page 10

A developer's workstation with a code editor showing package dependencies and terminal windows with security warnings, with red alert indicators on the screen
Threat Intelligence

Fake npm Calendar Tools Hid an AI-Powered Linux Backdoor

Researchers found 14 booby-trapped packages on the popular open-source library npm, each quietly installing a remote-control tool called RedC2 4.0 on Linux machines.

3 min read
A computer monitor displaying a convincing Windows lock screen with an error message, while Microsoft Teams is visible in the background with a suspicious messa
Threat Intelligence

SynkLoader: The Fake IT Help Desk Trick Hiding Behind a Phony Windows Lock Screen

Attackers posing as internal IT are pushing a new modular malware through Microsoft Teams, complete with a convincing fake login prompt built to steal Windows passwords.

4 min read
A car dashboard infotainment system screen showing an update notification and suspicious network activity, with the vehicle's interior visible around it
Threat Intelligence

New Android malware slips into cars through the dashboard's own update system

Kaspersky says the DoFun head unit malware turns infected vehicles into ad-fraud engines and proxy relays for cybercrime.

4 min read
A technician in a data center cuts through a thick network cable with industrial shears, sparks flying, server racks illuminated in the background during an eme
Threat Intelligence

Zombie Cards, Cut Cables, and a Botnet: The Week's Cybercrime Stories You May Have Missed

T-Mobile physically severed a network cable to stop an active intrusion, a new Linux botnet called Evooo1Bot is spreading across hijacked servers, and Threema's encrypted messaging service was knocked offline by a DDoS attack. Here is what happened.

3 min read
An FTP server welcome screen with disguised command instructions hidden within greeting text, with malicious payloads downloading to a Windows system in the bac
Threat Intelligence

Hackers Hide Malware Instructions in FTP Server Greetings

A quiet trick spotted by SOCRadar uses FTP welcome messages to smuggle commands onto Windows machines, dropping two new remote-control tools called E4del and PINHOLE.

3 min read
A darkened control room with multiple screens displaying network infrastructure and maps of South Asia, with indicators highlighting telecommunications faciliti
Threat Intelligence

Pakistan's Transparent Tribe Is Spying on Afghan Telecom Workers With Fresh Malware

A Pakistani hacking group has been quietly breaking into government and telecom targets in Afghanistan using two newly documented tools. India was in their sights too, but appears to have held the line.

4 min read
A Mexican bank's branding and interface visible on a compromised computer screen, with a file manager window open showing suspicious executable files disguised
Threat Intelligence

Grandoreiro Banking Malware Is Back, Targeting Mexican Bank Customers

A banking Trojan first spotted in 2016 is still active, still stealing money, and now using a trusted file-management tool as cover to slip past security software on computers in Mexico.

4 min read
A Firefox browser window displaying the extensions panel with multiple wallet extension icons visible, some appearing nearly identical, with warning flags overl
Threat Intelligence

Fake Firefox Wallet Extensions Drain Crypto From Unwary Users

Researchers at Socket found 40 Firefox add-ons impersonating OKX, Rabby, TronLink and other crypto wallet brands, part of a wider 77-extension operation they call Offside Wallet Theft Factory.

3 min read
A smartphone screen displaying banking and cryptocurrency apps on the home screen, with malware infection indicators and PIN entry fields compromised by overlay
Threat Intelligence

ToxicPanda 2.0: Android Banking Malware Now Targets 140+ Apps and Steals PINs

A revamped ToxicPanda carries 167 remote commands and a PIN-grabbing routine aimed at more than 140 banking and cryptocurrency apps worldwide.

4 min read
Multiple smartphones arranged on a surface with bluetooth and wifi symbols appearing between them, showing data flowing wirelessly from one device to others, Uk
Threat Intelligence

Manic Android malware hops between infected phones to steal Ukrainian banking data

Researchers at ThreatFabric say the spyware, active since February, targets 169 apps and can relay stolen data through nearby infected devices over Wi-Fi Direct or Bluetooth when the internet is unavailable.

4 min read
An industrial factory floor with manufacturing equipment and control systems, cybersecurity warning banners and AI-generated script alerts visible on monitoring
Threat Intelligence

US agencies warn hackers are using AI to break into Siemens factory controllers

CISA, NSA, FBI, DOE and EPA say attackers are scanning the internet for exposed Siemens S7 PLCs and running AI-written scripts dressed up as monitoring tools.

4 min read
A cybersecurity researcher's desk with investigation files spread out, a security camera image displayed on monitor, directory structure and authentication logs
Threat Intelligence

Researchers Say 14,500 Dahua Cameras Fell to a Six-Week Hijack Campaign

Hunt.io traced Operation CameraSwarm through an exposed 407 MB working directory, revealing password guessing, two authentication-bypass flaws, and a peer-to-peer relay trick.

3 min read
A network diagram visualization showing interconnected nodes representing government infrastructure across a map of Central Asia, with several nodes highlighted
Threat Intelligence

SilkParasite: New Espionage Group Hits Central Asian Governments With Five Unseen Hacking Tools

Researchers have named a fresh spying operation running seven remote-access tools against government offices across the region, five of them never seen before.

3 min read
A federal courthouse interior with official seals and legal documents related to cybercrime charges displayed on a desk, with a digital overlay showing stolen r
Threat Intelligence

US Charges 17 Iranians With Hacking Hundreds of Universities and Government Agencies

A federal indictment names 17 people linked to a Tehran company that stole more than 31 terabytes of academic research on behalf of Iran's Revolutionary Guard. Five defendants now carry $10 million bounties.

3 min read
A WordPress dashboard interface overlaid with malware distribution nodes and command-and-control infrastructure visualization, showing how compromised sites for
Threat Intelligence

Nearly 2,000 Hacked WordPress Sites Turned Into a Criminal Toolkit

A sprawling operation dubbed StopAndProtect is quietly using compromised WordPress sites as a delivery network for malware, stolen files and screenshots.

3 min read
© 2026 Threat Vectr