ThreatVectr

Threat Intelligence — Page 29

Illustration: a dark wooden desk with a generic laptop displaying an abstract browser window
Threat Intelligence

Silent Swap: Unsigned Installers Drop Fake Chromium Extensions That Hijack Crypto Transactions

McAfee Labs documents a clipper campaign using .NET and Golang loaders to sideload a malicious browser extension that rewrites wallet addresses at send time.

3 min read
Illustration: a dimly lit desk with an open laptop showing a generic email inbox interface, scattered printed invoices
Threat Intelligence

BEC Isn't an Email Problem. It's a Supply Chain.

Underground forums reveal Business Email Compromise as a multi-stage operation built on account access, target research, and cash-out networks, not a clever phishing lure.

3 min read
Illustration: an empty modern football stadium at dusk, floodlights on, viewed from an upper tier
Threat Intelligence

FIFA 2026 Fraud Infrastructure Was Pre-Staged Months Before Kickoff, Researchers Say

A Check Point exposure report documents pre-positioned phishing kits, lookalike domains and multilingual scam pages built well ahead of the June 11 opening match.

3 min read
Illustration: A dimly lit workbench covered in disassembled electronic hardware — circuit boards, soldering tools
Threat Intelligence

From Modded Game Controllers to IBM X-Force Red: The Chris Thompson Arc

A teenage hardware tinkerer grows up to run one of the most recognizable offensive-security brands in enterprise tech, then leaves to build something new.

3 min read
Illustration: a generic laptop screen showing an abstract browser address bar mid-typing
Threat Intelligence

Fake Perplexity Extension Siphoned Every Chrome Address Bar Keystroke

Microsoft researchers flagged a counterfeit Perplexity Chrome extension that routed queries and omnibox input through an attacker server before completing the search.

3 min read
Illustration: a darkened government office at night, glowing monitor displaying abstract file-sync icons and directory trees
Threat Intelligence

Mustang Panda Turns Zoho WorkDrive Into C2 in Twin Campaigns Against Indian Government

The China-aligned crew is running parallel operations against New Delhi ministries and hydropower operators, routing commands through a legitimate cloud collaboration service that most enterprise defenses will never flag.

3 min read
Illustration: a dimly lit server room with a single rack door slightly ajar
Threat Intelligence

Monday Brief: A DirtyClone Linux Bug, Turla's New Backdoor, and the Infostealer Churn

Old access paths, missed patches, and a fresh kernel flaw kept defenders busy. A roundup of what moved this week in the cybercrime ecosystem.

3 min read
Illustration: a cluttered developer workstation at night
Threat Intelligence

236,000 Sites Run Pig-Butchering Templates Built on DCloud Uni-App

Infoblox researchers tie a sprawling fake-exchange and wallet-drainer ecosystem to a legitimate Chinese cross-platform dev framework.

3 min read
Illustration: a dim operations room with multiple monitors showing abstract network traffic graphs and an Eastern European
Threat Intelligence

Gamaredon's 2025 Phishing Surge: 35 Campaigns, Fresh Loaders, and Identity Tradecraft

The Russia-aligned group has spent the year refining spear-phishing lures against Ukrainian targets, leaning harder on cloud services and credential theft.

3 min read
Illustration: a dark server room with rows of glowing fiber optic cables converging into a single locked vault door
Threat Intelligence

Harvest Now, Decrypt Later: Why Credentials Are the First Casualty of Q-Day

Captured ciphertext today becomes plaintext tomorrow. Credentials sit at the top of the target list.

3 min read
Illustration: a dark desk with a laptop screen showing an abstract browser extensions management interface, glowing slightly
Threat Intelligence

Microsoft Pulls 119 Edge Extensions Tied to 'StegoAd' Steganography Campaign

The add-ons concealed payloads in image and font files and activated days after install. Microsoft attributes the activity to a single actor operating since 2021.

3 min read
Illustration: a developer workstation at night, multiple monitors showing dense terminal output and an open code editor
Threat Intelligence

Supply-Chain Attackers Hide Python Stealer in npm and Go Packages, Sidestep Lifecycle Scripts

JFrog flags two hijacked npm packages and a Go cluster that abuse VS Code tasks to drop a cross-platform infostealer, bypassing the script hooks defenders typically watch.

3 min read
Illustration: a darkened smartphone screen displaying a generic green messenger app with a QR code prompt
Threat Intelligence

SSU, FBI Detail Russian Phishing Op Targeting Signal and Telegram Accounts

Ukrainian counterintelligence says GRU and FSB-linked operators ran fake tech-support flows against officials' messengers across Ukraine, Europe, and the U.S.

3 min read
Illustration: a smartphone on a dark wooden desk displaying an abstract blue messaging app settings screen
Threat Intelligence

Russia's Signal Phishing Now Targets the Backup Recovery Key — and the Key Doesn't Expire

An FBI/CISA update says GRU-linked operators are coaxing victims into surrendering their Signal Backup Recovery Key, which yields full message history and durable account access.

3 min read
Illustration: a dim government-
Threat Intelligence

SharkLoader Drops Cobalt Strike on Asian Government Targets in 'StrikeShark' Campaign

A previously undocumented loader is being used against a diplomatic office in Indonesia and government bodies in Taiwan, with operators staging Cobalt Strike Beacon as the final payload.

3 min read
© 2026 Threat Vectr