ThreatVectr

Threat Intelligence — Page 11

A network analysis dashboard showing multiple domain names rotating and shifting across a visual representation of internet infrastructure, with suspicious beha
Threat Intelligence

Microsoft Ties 30+ Rotating Domains to MacSync, a New Mac Data-Stealing Malware

Defender Experts traced the macOS stealer across shifting web infrastructure by matching endpoint and network behaviour, not just domain names.

4 min read
A security operations center with multiple detection screens showing successful blocks of known attack patterns highlighted in green, while subtle, unusual netw
Threat Intelligence

Your security tools stopped the obvious attack. They missed the sneaky one.

Picus Security's Blue Report 2026 finds defenses catch famous techniques reliably but let quieter variants walk straight through.

3 min read
A software repository package listing showing nearly identical library names with subtle misspellings, with one package highlighted as malicious and credential-
Threat Intelligence

Malicious RubyGems Packages Impersonate Popular Libraries to Steal Windows Credentials

Researchers flagged seven typosquatted gems on August 15, 2026, part of a wider campaign delivering a Windows information stealer.

3 min read
A Windows 11 desktop with a cleaner right-click context menu displayed, showing fewer options and streamlined design, with command-line windows and legacy tool
Threat Intelligence

Microsoft trims Windows 11 right-click menu and retires a tool long abused by hackers

Faster File Explorer and a cleaner context menu land in Insider builds, while WMIC, a command-line tool ransomware crews have leaned on for years, gets pulled from Windows 11.

4 min read
Microsoft cloud service icons (SharePoint, Teams, Edge) arranged on a server, with hidden malware threads running through the environment, visualized as invisib
Threat Intelligence

TWINLOOT Malware Hides Inside Microsoft's Own Cloud to Steal Passwords

A newly discovered piece of malicious software uses Microsoft SharePoint, Teams, and Edge to run its operation, making it nearly invisible to the tools most companies rely on.

4 min read
A modern office building exterior in Brisbane during daytime, with a laptop visible through a window displaying a fake website alongside legitimate business doc
Threat Intelligence

FBI Probe Into Chinese Espionage Front Ensnares a Small Brisbane Consultancy

A legitimate Australian firm called Horizzen found itself flooded with job applications meant for a fake version of its business. That fake site was one of 13 seized by the US Department of Justice as part of an alleged Chinese espionage operation.

3 min read
Network traffic visualization on a monitoring screen showing encrypted packets flowing through Google and DNS services, with malicious commands hidden within no
Threat Intelligence

Iranian Hackers Refine 'Cavern' Toolkit to Hide Inside Google and DNS Traffic

Kaspersky says the Cav3rn framework, aimed at Israeli targets, now hides its commands inside services most networks trust by default.

4 min read
A security incident response room with investigators reviewing screens showing exposed database servers, unpatched systems, and abandoned user sessions on publi
Threat Intelligence

The Boring Break-Ins: Why This Week's Worst Hacks Were the Simplest

Fresh incidents show attackers rarely need clever tricks. Exposed servers, old bugs and unattended browser sessions did most of the damage this week.

4 min read
A smartphone displaying a software installation dialog box for a telecom application, with network infrastructure silhouettes visible through a window behind it
Threat Intelligence

PATCHCORD: The Fake VPN Installer Hitting Afghan Phone Networks and Indian Infrastructure

A new backdoor is being smuggled onto computers through fake Afghan Telecom software, and researchers say critical services in South Asia are in the crosshairs.

3 min read
A Windows desktop with Chrome browser window open, and a developer tools panel glowing with active debugging information in the lower portion of the screen
Threat Intelligence

Researchers Show How Attackers Can Hijack Live Chrome and Edge Sessions on Windows

A post-exploitation trick flips on Chrome's built-in debugger inside a running browser, handing attackers cookies and logged-in sessions without touching the password vault.

3 min read
A busy security operations center wall displaying multiple stacked windows and alerts from different security tools, creating a complex layered visual of interc
Threat Intelligence

This Week's Security Grab Bag: AI Hijacks, Fake Fixes, and a Cursor Bug

A roundup week: nothing catastrophic on its own, but the patterns are the story.

4 min read
A Windows system registry editor window displayed on a monitor, with kernel-level entries highlighted in red, while a map in the background shows target regions
Threat Intelligence

Chinese Hacking Group Hides Backdoor Behind a Signed Windows Rootkit

Kaspersky researchers say the Mustang Panda crew paired an updated CoolClient backdoor with a kernel-level cloaking tool, striking targets in Myanmar and Pakistan.

4 min read
A domain marketplace auction interface showing expired domain names being purchased in bulk, with registration dates and transfer notices filling the screen in
Threat Intelligence

Criminals Spent Almost $7 Million Buying Expired Web Domains to Push Scams and Malware

Infoblox says 50,400 'dropcatch' domains were scooped up in the first half of 2026 to inherit the trust of the sites that came before them.

4 min read
Illustration: A split-screen
Threat Intelligence

New Zealand's spy agency says China is spying 'at scale'. Beijing says that's a lie.

New Zealand's national intelligence service named China as the only country conducting large-scale espionage on its soil. China's embassy fired back, calling the report fabricated and blaming 'anti-China forces' for orchestrating the claims.

3 min read
A network traffic visualization showing waves of DDoS attack packets hitting server infrastructure, with real-time defense responses filtering and blocking the
Threat Intelligence

Threema knocked offline by shifting DDoS attacks, Swiss messenger says

The encrypted messaging service and its Swiss hosting partner Nine faced sustained flood attacks that changed tactics to slip past defences.

3 min read
© 2026 Threat Vectr