ThreatVectr

Threat Intelligence — Page 6

A network diagram showing Node
Threat Intelligence

Hackers Are Hiding Malware Inside Node.js, and Windows Sees Nothing Wrong

Symantec says attackers have been abusing the legitimate Node.js runtime since February 2026 to slip past defences at governments, tech firms and hotel chains.

3 min read
A smartphone screen with iMessage notification active, zero-day exploit code invisibly deploying across the interface, Pegasus spyware installation represented
Threat Intelligence

Pegasus Spyware Hit a Serbian Student Activist's iPhone Through a Silent iMessage Attack

Citizen Lab says a zero-click exploit planted NSO Group's Pegasus on the phone of a member of Serbia's student protest movement, with no tap or click required.

4 min read
A laptop screen displays a bank transfer interface with concerning activity alerts, surrounded by scattered documents and a mobile phone showing suspicious acco
Threat Intelligence

Three Australians Plead Guilty to Helping Overseas Scammers Strip Victims of Life Savings

The trio acted as local foot soldiers for foreign criminals running fake investment schemes that robbed Australians of millions of dollars.

3 min read
A computer screen showing a fake software download webpage that mimics legitimate sources, with Windows Update settings disabled in the system tray
Threat Intelligence

Fake Software Download Sites Push Malware That Turns Off Windows Update

Microsoft says a long-running campaign is pushing rigged installers to Chinese-speaking users and staff at multinationals operating in China, disabling defences on the way in.

3 min read
A network security monitoring station displaying traffic flowing into Brazilian government and education domain servers, with threat analysis indicators highlig
Threat Intelligence

Chinese-Speaking Crew Slips Malicious Apache Modules Onto Brazilian .gov and .edu Sites

Check Point tracks the cluster as Gambling Goblin, with medium-confidence links to Chinese-speaking SEO-poisoning operators active since mid-2025.

4 min read
A smartphone screen displaying a fake TV streaming app advertisement from Facebook, with banking app icons visible and a trojan installation prompt in progress
Threat Intelligence

Fake TV Streaming Ads on Facebook Pushed a New Android Banking Trojan to Spanish Users

StreamRat, spread through Meta ads that reached more than half a million EU accounts, hands attackers near-total control of the phone it lands on.

4 min read
A European government office desk with a smartphone displaying encrypted messaging apps, surrounded by classified document folders and a computer showing securi
Threat Intelligence

Russian Hackers Are Phishing EU Officials on WhatsApp and Signal

Eight serious attacks on European government staff have exposed a gap no one planned for: officials trusting consumer messaging apps with sensitive business.

4 min read
Illustration: A data center in Amsterdam with server racks humming in dim
Threat Intelligence

Hackers Stole Nuclear Blueprints From the Philippines Using Flaws Fixed Two Years Ago

Researchers found nearly 1.2 gigabytes of stolen data on a server in Amsterdam, including reactor component databases, fuel records, and passport files belonging to Filipino government scientists.

4 min read
A blockchain network visualization displayed across multiple monitors in a security research lab, with hidden command-and-control instructions embedded within t
Threat Intelligence

Criminals Hid a Hacking Network Inside a Cryptocurrency Blockchain. Thirty-One Companies Got Caught.

A new campaign turns blockchain technology into an untraceable instruction relay, letting attackers redirect infected computers to a new server for less than a penny per update.

5 min read
A freelance work platform office with network security analysts reviewing fake account profiles and malicious Excel attachment samples, malware analysis tools r
Threat Intelligence

Russian man charged with infecting 80,000 freelancers through fake Excel attachments

Searzhudin Aktulaev allegedly used 255 fake accounts on a freelance work platform to spread TVRAT and DarkVNC remote-control malware between 2016 and 2017.

4 min read
An FBI field office with law enforcement and cyber agents gathered around seized server equipment, network diagrams showing connections to targeted government a
Threat Intelligence

The US just seized the servers behind China's hacking-for-hire empire

A private Chinese company quietly ran shared attack tools for state hackers targeting NASA, the Federal Reserve, and US hospitals. The FBI just pulled the plug.

5 min read
A multinational cybercrime task force headquarters with computers displaying botnet network topology maps, infected nodes being systematically disconnected and
Threat Intelligence

Police Hijack Sality Botnet's Own Network to Kill It Off

A four-country operation used the malware's peer-to-peer design against it, blocking infected computers from receiving fresh criminal payloads.

4 min read
Multiple computer workstations in a network showing real-time system monitoring dashboards, with one screen displaying Adobe file icons being deployed across co
Threat Intelligence

Phishing crews hijacked a legitimate IT tool to take over more than 450 computers

Attackers pushed fake Adobe files that quietly enrolled victim PCs into Faronics Deploy, then used it to install ScreenConnect for hands-on remote control.

3 min read
A world map highlighting 22 countries with connection nodes showing international money-laundering networks and fraud operation infrastructure being disrupted,
Threat Intelligence

Interpol Arrests 58 in Operation Jackal IV, Targeting West African Fraud Networks

A 22-country sweep disrupted the money-laundering infrastructure and online scam operations behind some of the world's most prolific fraud gangs, with preliminary results pointing to a strategic shift toward dismantling criminal support systems rather than counting arrests.

4 min read
A financial institution's payment processing center with transaction monitoring dashboards, Brazilian currency visible, payment software interfaces showing unau
Threat Intelligence

Brazil hit by 'Breeze Comet' crew draining bank accounts through payment software

Google's Mandiant team says the group has quietly siphoned money from Brazilian financial institutions and merchants since 2024 by hijacking the software that moves payments around.

4 min read
© 2026 Threat Vectr