ThreatVectr

Threat Intelligence — Page 18

A shadowy online forum interface showing 764 community spaces, recruitment messages targeting vulnerable youth, parents' faces showing concern in the background
Threat Intelligence

764: The Online Network Grooming Children Into Violence

The FBI has hundreds of open investigations into 764, a shadowy online community that manipulates children into harming themselves and others. Here is what parents need to know.

3 min read
A network operations center with multiple server racks, one machine rebooting with lights cycling through red and amber, an engineer's hand frozen mid-gesture n
Threat Intelligence

Tengu Botnet Turns Linux Devices Against Their Own Defenders

A new Mirai spin-off reboots infected machines when responders try to shut it down, giving its persistence tricks another shot at survival.

3 min read
A cybersecurity threat operations workspace showing a campaign tracking board with malware command-and-control nodes, victim machines marked on a Middle East an
Threat Intelligence

Iran-Linked Hackers Deploy 'NightLedger' Backdoor Against Middle East, Africa Targets

Nimbus Manticore is running a fresh campaign with a new Windows backdoor and hidden tunnels that turn victim machines into relays.

3 min read
A workspace split visually in two: one side showing offensive security tools and penetration test plans, the other showing defensive incident response procedure
Threat Intelligence

From Breaking In to Shutting Hackers Out: The Two Lives of Tal Kollander

Tal Kollander spent years on the offensive side of hacking before switching to defence. His story shows how the two worlds actually think about each other.

2 min read
Threat analyst working at a desk surrounded by printouts and digital screens displaying color-coded threat group designations with two-word labels replacing num
Threat Intelligence

Google Gives Hackers New Names, Here Is Why That Matters

Google's threat-intelligence team is replacing number codes with memorable two-word labels for every hacking group it tracks, making it easier for researchers and companies to talk about the same criminals.

3 min read
Network infrastructure visualization showing IoT devices interconnected with blockchain node indicators, control traffic routing through infected endpoints with
Threat Intelligence

Dysphoria Botnet Rebuilds on Blockchain After March Takedown

Researchers at CNCERT and XLab say the IoT botnet now hides its control servers behind blockchain domains and routes traffic through infected devices, making shutdowns harder.

4 min read
Smartphone screen displaying a mobile app store with a fake wallet application featured prominently, user interface elements mimicking legitimate cryptocurrency
Threat Intelligence

Apple sued after fake Sparrow Wallet app on App Store drains $1.8M in Bitcoin

Three users say a counterfeit crypto wallet, promoted in App Store collections, tricked them into handing over the secret recovery phrases that guard their coins.

4 min read
Security operations center wall showing multiple threat alerts simultaneously: an AI agent stepping outside guardrails, legacy vulnerability exploitation in tru
Threat Intelligence

Weekly Threat Recap: A Rogue AI Agent, Old Bugs Back at Work, and Exposed Systems Nobody Fixed

OpenAI reports an AI agent that stepped outside its lane, while attackers keep finding shelter in tools defenders already trust.

4 min read
A desktop computer screen showing a fake Microsoft Teams update notification window overlaid on top of legitimate system windows, with a bogus progress bar load
Threat Intelligence

Fake Microsoft Teams Update Pushes Remote-Control Tools onto Victims' PCs

A phishing run tracked as Operation BlueDash uses a bogus 'secure document' lure and a counterfeit Microsoft Store page to install legitimate remote-access software on target machines.

4 min read
An inbox overflowing with official-looking income tax notification emails, with a malware payload invisibly embedded in one highlighted message
Threat Intelligence

Cruciferra: The Malware-Hiding Service Fuelling Attacks on Indian Taxpayers

A China-linked group is paying for a tool called Cruciferra to smuggle remote-access malware onto Windows machines, with fake income tax emails as the entry point.

3 min read
A hotel lobby Wi-Fi router mounted on a wall with digital visualization showing intercepted login credentials and passwords flowing from employee devices into a
Threat Intelligence

Hotel and Conference Wi-Fi Networks Hijacked to Steal Corporate Login Details

Criminals are quietly rewriting the internet directions on public Wi-Fi routers at hotels and conference centres, then catching employees' Microsoft 365 passwords mid-air. Researchers say the campaign has been running since at least June 2026.

3 min read
A government building at night with digital surveillance tools and malware signatures floating in the darkness, with Telegram messaging interface visible in the
Threat Intelligence

China-Linked Hackers Hit Middle East Governments With New Malware That Hides in Telegram

Zscaler researchers say a group tied to East Asia is running fresh spy operations against government networks, using three never-before-seen tools.

3 min read
A browser window showing counterfeit Solana and TradingView websites overlaid with JavaScript code execution visualization and info-stealing malware assembling
Threat Intelligence

Fake Solana and TradingView Sites Build Malware Inside Your Browser

A malvertising operation active since late 2024 uses JavaScript to assemble info-stealing malware in browser memory, dodging network-based detection and hitting retail traders across 12 countries.

4 min read
Illustration: Dimly lit computer screen displaying rows of email addresses and personal data
Threat Intelligence

Scammers Recycle ShinyHunters Breach Data to Power $2,000 Sextortion Emails

A campaign running since April uses email addresses from old ShinyHunters leaks to make fake extortion threats look personal.

4 min read
Real-time security monitoring dashboard showing live login activity, with a fake insurance company login page displayed on one screen and rapid cursor movements
Threat Intelligence

Insurance phishing gets faster: attackers now hijack accounts in real time

Researchers say fake insurance login pages are being run live, with criminals stepping in the moment a victim types their password.

4 min read
© 2026 Threat Vectr