ThreatVectr

Threat Intelligence — Page 31

Illustration: a cluttered developer desk at night, mechanical keyboard glowing amber
Threat Intelligence

Three npm Packages Squat PostCSS Names to Drop a Windows RAT

Typosquatted utilities pulled roughly a thousand combined downloads before researchers flagged them. The payload targets Windows developer machines, which is exactly where the credentials live.

2 min read
Illustration: a generic laptop screen glowing in a dim office
Threat Intelligence

WhatsApp DMs Push VBScript Loaders That Deploy Legitimate RMM Tools

An active campaign abuses WhatsApp Desktop and Web to distribute scripted droppers that install commercial remote-management software across at least nine jurisdictions.

3 min read
Illustration: a dimly lit server rack with one Ethernet cable glowing faint red while the others glow blue
Threat Intelligence

ShapedPlugin's Update Channel Hijacked, Pro Plugins Shipped with Backdoor

Attackers slipped malicious code into licensed Pro releases by compromising the vendor's own build pipeline, a clean supply-chain hit on WordPress installs.

2 min read
Illustration: a dimly lit desk with multiple dark monitors displaying abstract scrolling data grids and search interface
Threat Intelligence

The 'Search-as-a-Service' Economy Built on Stolen Credentials

Underground brokers now sell targeted lookups against stolen credential corpora, lowering the bar for access brokers and intrusion crews alike.

3 min read
Illustration for the story: OXLOADER Drops CastleStealer via Poisoned Google Ads, Researchers Say
Threat Intelligence

OXLOADER Drops CastleStealer via Poisoned Google Ads, Researchers Say

Elastic Security Labs links the malvertising chain to a likely Russian-speaking, financially motivated operator.

3 min read
Illustration: a dimly lit security operations center desk with multiple monitors showing abstract network graphs and red
Threat Intelligence

Weekly Threat Roundup: EDR Killers, Browser Bugs, and an Android Trojan With Too Many Hands

Abused integrations, poisoned WordPress, and ransomware crews still gunning for endpoint sensors, familiar tradecraft, better packaged.

3 min read
Illustration: a glowing server rack illuminated in cold blue light
Threat Intelligence

ShinyHunters Doesn't Need Malware. That's the Point.

The group's latest breaches are a reminder that stolen credentials and patience beat zero-days most days of the week.

3 min read
Illustration: an aging consumer home router with dusty plastic casing and blinking status LEDs
Threat Intelligence

AryStinger Quietly Conscripts 4,300 Old Routers Into a Recon Proxy Fabric

Researchers say the malware skips the usual DDoS playbook and instead builds infrastructure for pre-breach reconnaissance.

3 min read
Illustration: a dimly lit operations center with multiple monitors showing abstract network maps of the Asia-Pacific region
Threat Intelligence

INTERPOL Flags Sharp Rise in Phishing, Ransomware and AI Scams Across Asia-Pacific

A new INTERPOL assessment maps a region where cybercrime is outpacing defensive capacity, with phishing leading the volume charts and ransomware crews exploiting the gap.

3 min read
Illustration: a rack-mounted network security appliance in a dim data center aisle, status LEDs glowing amber and red
Threat Intelligence

FortiBleed Campaign Hits 86,644 FortiGate Boxes; CISA Pushes Customers to Lock Down

Russian-speaking operators are working through internet-exposed Fortinet appliances at scale. CISA wants admins moving now.

2 min read
Illustration: a dimly lit desk with an open laptop displaying a generic news article layout
Threat Intelligence

Clipper Crew Buys Sponsored Posts on News Sites to Push Trojanized Crypto Tools

An untracked actor is laundering credibility through paid press placements, a phishing-grade WordPress hub, and seeded GitHub and SourceForge repos to deliver clipboard hijackers.

3 min read
Illustration: a server rack inside a dimly lit data center
Threat Intelligence

UNC6508 Spent a Year Inside US and Canadian Research Networks via Trojanized REDCap

A China-linked espionage group hijacked REDCap's own upgrade process to plant persistent malware across academic, medical, and defense-adjacent research environments.

3 min read
Illustration: a darkened developer workstation at night
Threat Intelligence

Contagious Interview Pivots to Dev-Review Lures in Two Fresh Campaigns

The North Korea-linked cluster is back with phishing pretexts aimed at developers: recruiter pitches and code-review requests that drop malware on engineers' workstations.

3 min read
Illustration: a dimly lit Linux developer workstation: mechanical keyboard
Threat Intelligence

Over 400 AUR Packages Backdoored With Rust-Based Credential Stealer

Attackers rewrote build scripts in Arch's community repo to drop a secret-harvesting binary, with an eBPF rootkit waiting if it gets root.

3 min read
Illustration: a sleek modern desk with a glowing dark monitor showing abstract code patterns and a subtle subscription-
Threat Intelligence

The Cybercrime Economy Is Looking a Lot Like SaaS

A leaked worm kit, a $5K/month browser-cloning RAT, and AI agents handing over real credentials: the criminal stack is industrialising.

3 min read
© 2026 Threat Vectr