ThreatVectr

Threat Intelligence — Page 28

Illustration: a laptop screen showing a generic web browser with a red warning icon in the address bar and a blurred popup
Threat Intelligence

Opera's new Paste Protect tries to stop the copy-paste scam that's been draining wallets

The browser will now block dodgy commands before they reach your clipboard, targeting the ClickFix trick that has become criminals' favourite way to trick people into infecting their own computers.

3 min read
Illustration: FBI agents in a server room, with racks of servers and computer screens displaying FBI seizure notices
Threat Intelligence

FBI Dismantles NetNut Proxy and Popa Botnet Operations

The FBI has seized hundreds of NetNut domains in a joint operation with Google, Lumen and Shadowserver, disrupting a residential proxy service tied to over two million compromised devices.

3 min read
Illustration: a suburban neighbourhood at dusk with faint blue network light traces emanating from individual houses
Threat Intelligence

Google and FBI Kneecap NetNut, Cutting Millions of Home Devices From Proxy Pool

Google's Threat Intelligence Group says a joint operation with the FBI and Lumen has stripped millions of infected home devices from NetNut, also tracked as Popa.

3 min read
Illustration: several plain black USB thumb drives scattered across weathered asphalt in a parking lot
Threat Intelligence

The USB Drop That Changed Pen Testing: Steve Stasiukonis's Credit Union Experiment, Revisited

Twenty years ago, a handful of booby-trapped thumb drives in a parking lot became one of the most-cited social-engineering case studies in security history. What actually happened, and why it still matters.

3 min read
Illustration: A single slightly ajar server room door casting a thin blade of light into a dim corridor lined with rack
Threat Intelligence

Small Gaps, Big Consequences: The Week's Breaches Ran on Trust, Not Zero-Days

Browsers, bots, AI sandboxes and email flows all failed the same way: quietly, and inside the rules.

3 min read
Illustration: a darkened data center corridor with a single amber warning light reflecting off polished server racks
Threat Intelligence

ToddyCat's New Umbrij Malware Pulls Gmail Straight From Google's API

Kaspersky ties the China-nexus crew to a Gmail-siphoning tool that skips the browser and talks to Google directly.

3 min read
Illustration: a darkened developer workstation at night
Threat Intelligence

ChocoPoC: The Fake Exploit Repos Turning Bug Hunters Into Victims

A Python-based infostealer is hiding inside GitHub proof-of-concept code marketed to vulnerability researchers, siphoning credentials, cookies, and files before dropping a remote shell.

3 min read
Illustration: a cluttered security researcher's desk at night: open laptop showing terminal-
Threat Intelligence

ChocoPoC RAT Hides in Fake GitHub Exploits, Targets Security Researchers

A cluster of trojanized proof-of-concept repositories is pushing a Python-based remote access trojan to the very people who go looking for them.

3 min read
Illustration: a stark federal courthouse corridor at dusk, cold blue-grey marble, empty benches
Threat Intelligence

Scattered Spider Suspect, 19, Extradited From Finland to Chicago

Peter Stokes, a dual U.S.-Estonian citizen, faces conspiracy, intrusion and fraud charges tied to the loose-knit crew behind a string of high-profile enterprise breaches.

3 min read
Illustration: a laptop on a dark wooden desk with a generic software installer progress bar glowing on screen
Threat Intelligence

ScreenConnect Turned Loader: Trojanized Installers Push AsyncRAT via Spoofed Software Sites

A sprawling campaign is abusing a signed RMM binary to sideload AsyncRAT onto victims chasing free copies of OBS Studio, Bandicam, and other utilities, Kaspersky says.

3 min read
Illustration: a dimly lit workstation monitor displaying an abstract blog-
Threat Intelligence

VEIL#DROP: Blogger-Hosted Chain Drops PureLogs Stealer

Securonix flags a multi-stage delivery scheme abusing Google's Blogger platform to stage PureLogs, a commodity infostealer sold in underground forums.

3 min read
Illustration: a dimly lit laptop screen displaying a generic corrupted PDF icon and a blurred Iberian-
Threat Intelligence

Ousaban Resurfaces in Iberia, Hiding Bank-Stealer Payloads Inside Images

A Brazilian trojan pivots to Spanish and Portuguese banking customers, using geofenced PDF lures and steganography to bury its real payload.

3 min read
Illustration: a dark server rack aisle with faint blue and violet indicator lights, wisps of fog drifting between cabinets
Threat Intelligence

Phantom Squatting: When Attackers Camp on the Domains LLMs Hallucinate

Unit 42 documents a pre-positioning tactic where actors register non-existent domains that AI assistants keep suggesting, then wait for the traffic to arrive.

3 min read
Illustration: a darkened office monitor displaying a generic fake CAPTCHA verification page reflected in a glass surface
Threat Intelligence

ClickFix Grows a Back Office: API-Served Payloads and a New AMSI Bypass

Researchers pulled roughly 3,000 live payloads from ClickFix infrastructure and found a polymorphic delivery pipeline built to defeat Windows script scanning.

3 min read
Illustration: a tangle of consumer networking gear — a stacked home router, an IP camera
Threat Intelligence

RustDuck: A Rust-Based DDoS Botnet Quietly Building Out Since February

XLab researchers say the two-stage loader is iterating faster than its install base is growing, and that's the interesting part.

3 min read
© 2026 Threat Vectr