ThreatVectr

Threat Intelligence — Page 15

A database administration interface showing SQL queries and command execution windows, with files and sensitive data visible in the background, illustrating how
Threat Intelligence

Hackers hid their attack tools inside an Oracle database itself

A rarely seen technique let intruders run commands, steal password data and browse files from within the database, after breaking in through a sloppy search box.

4 min read
A browser window showing a fake macOS download page with a security warning overlay and multiple domain names partially visible in the address bar or browser ta
Threat Intelligence

Fake Mac Downloads Hide Behind 250+ Domains That Screen Visitors First

Microsoft says a large ClickFix network now checks who is knocking before showing macOS users a booby-trapped installer, keeping researchers and scanners out of view.

3 min read
An email inbox showing a phishing message with COLDCARD hardware wallet branding, an installation dialog in the background, and subtle indicators of the ScreenC
Threat Intelligence

Fake COLDCARD 'Security Audit' Emails Push Remote Access Tool After $88M Bitcoin Theft

A phishing campaign impersonates the hardware wallet maker, tricks owners into installing ScreenConnect, and hands attackers full control of the victim's PC.

4 min read
A code repository or npm package manager interface on screen showing package listings, with an Ethereum blockchain explorer window open in the background displa
Threat Intelligence

Malicious npm Packages Hide Attacker Servers Inside Empty Ethereum Transactions

Researchers found two booby-trapped code libraries pulling instructions from fake wallet addresses on the Ethereum blockchain, a twist on the EtherHiding trick now dubbed NullReceiver.

4 min read
Multiple fake login pages loading rapidly across browser tabs, with blocklist databases shown as outdated in the taskbar
Threat Intelligence

Why Blocklists Can't Keep Up With AI-Built Phishing Sites

Attackers are spinning up throwaway phishing pages faster than defenders can list them. Researchers at Push Security argue the fix is watching what a page does, not where it lives.

4 min read
A network diagram on a security analyst's screen showing a single command-and-control server connected to 30 operators across different nations, with government
Threat Intelligence

One C2 Kit, 30 Customers, Two Governments: How Criminal Infrastructure Is Hiding State Hackers

A security researcher traced a single command-and-control tool to roughly 30 separate operators, including two with suspected government ties. The finding breaks a core assumption most security teams quietly rely on every day.

5 min read
A Windows system tray showing a VPN application icon with hidden backdoor processes running in the background, network traffic being redirected to unknown serve
Threat Intelligence

Trojanised QuickFox VPN installer plants stealth backdoor on users' PCs

Fortinet researchers say a tampered version of the China-focused VPN app has been serving the FDMTP backdoor since at least August 2025, with tradecraft that overlaps activity tracked as Silver Fox.

3 min read
A macOS development environment with poisoned Xcode project files visible in Finder, malware notifications appearing alongside legitimate development tools
Threat Intelligence

XCSSET Malware Returns With Chrome Hijacker and Fake Telegram App, Hitting Mac Developers

A refreshed version of the XCSSET macOS malware is spreading through poisoned Xcode projects on GitHub, stealing credentials and hijacking cryptocurrency payments.

4 min read
A corporate employee desktop with ScreenConnect remote-access tool running in the background while antivirus software shows a clean status, attacker command pro
Threat Intelligence

Hackers Are Using a Legitimate Remote-Access Tool to Spy on Companies, and Your Antivirus Won't Notice

The Smoke#Screen campaign tricks employees into installing ScreenConnect, a genuine remote-support program, which then hands criminals full control of the victim's computer while looking completely normal to security software.

4 min read
A developer's computer monitor displaying code in an IDE, with network activity indicators and connection logs visible on the screen, suggesting background data
Threat Intelligence

77 fake developer tools on Open VSX quietly mapped coders' machines for a week

The counterfeit extensions copied real names from AMD, Azure, Salesforce and others, then phoned home to a domain registered days earlier.

4 min read
A user's desktop showing what appears to be legitimate Adobe and Zoom update prompts in the notification area, while system tray indicators and background proce
Threat Intelligence

Fake Adobe and Zoom Update Prompts Slip Remote-Control Software Onto Victim PCs

Securonix researchers say the SMOKE#SCREEN campaign is tricking staff into installing ConnectWise ScreenConnect, handing attackers a quiet way back in.

3 min read
A water utility control room with SCADA screens displaying system operations, while on an adjacent monitor a digital backup shows attackers may possess more com
Threat Intelligence

The criminals behind the Minnesota water attacks may have a better backup of your plant than you do

Hackers hit more than 30 small water utilities in two days. The most alarming detail isn't how they got in: they may have walked out with the only complete copy of control logic the operators ever had.

5 min read
Illustration: a casino floor and children's hospital interior simultaneously split-screen
Threat Intelligence

A Decade of Iranian Cyberattacks on America: What We Know

From wiping casino hard drives to targeting children's hospitals, a pattern of disruptive attacks tied to Iran stretches back more than a decade. Now investigators are asking whether the same playbook was used against water systems in seven US states.

5 min read
Driver sitting in parked car looking at a suspicious text message on phone screen, parking meter and street setting visible in background, expression of confusi
Threat Intelligence

Fake RingGo Texts Are Tricking Drivers Into Handing Over Bank Details

Scammers are sending fraudulent parking-fee demands that impersonate the RingGo app, banking on the fact that most drivers genuinely can't remember every parking session they've paid for.

3 min read
Computer screen showing browser cache folder with PNG image files, malware analysis software running in background, code and command-line interfaces visible wit
Threat Intelligence

DOUBLECUP: the new Russian malware service that hides code inside cached images

A service called DOUBLECUP tricks users into pasting rogue commands, then pulls malware out of PNG files sitting in the browser's cache.

3 min read
© 2026 Threat Vectr