#threatresearch — Public Fediverse posts

New.

Google: Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia https://cloud.google.com/blog/topics/threat-intelligence/distinct-clusters-target-individuals-of-interest-to-russia #Google #threatresearch #espionage #infosec

New.

Check Point: BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive https://research.checkpoint.com/2026/btr-reforged-weaponizing-defenders-remediation-driver-as-a-kernel-operation-primitive/ #threatresearch #infosec #Windows #Microsoft

New.

Socket: Popular Rust Crates Compromised in Build-Time Supply Chain Attack https://socket.dev/blog/popular-rust-crates-compromised @SocketSecurity #infosec #threatresearch #Rust #supplychain #cyberattack

New.

Esentire: Malware-as-a-Service Cocktail: ErrTraffic and Cruciferra - Killing Your EDR Since 2025 https://www.esentire.com/blog/malware-as-a-service-cocktail-errtraffic-and-cruciferra-killing-your-edr-since-2025

More:

Infosecurity-Magazine: MaaS Campaign Combines ClickFix, ErrTraffic and Cruciferrahttps://www.infosecurity-magazine.com/news/maas-clickfix-errtraffic-cruciferra/ #infosec #malware #threatresearch #Clickfix

Well, that's interesting.

Tenable: Detecting cloud ransomware in Azure with Tenable One’s cloud detection and response capabilities https://www.tenable.com/blog/detecting-cloud-ransomware-in-azure-with-tenable-ones-cloud-detection-and-response @tenable #infosec #threatresearch #Azure #ransomware #Microsoft #cybercrime

New.

Rapid7: New Report: AI threats are here. Why Q2 2026 signals the end of traditional patch cycles https://www.rapid7.com/blog/post/tr-new-report-ai-threats-q2-2026-ends-traditional-patch-cycles/ @Rapid7Official #threatresearch #infosec

New.

Check Point: Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect https://research.checkpoint.com/2026/thousands-of-hacked-wordpress-sites-one-operation-unmasking-stopandprotect/ #threatresearch #infosec #WordPress #cybercrime

New.

Ontinue: Living Off the Cloud: A Python Implant Hiding Its Entire C2 Inside Microsoft 365 & Azure https://www.ontinue.com/resource/python-implant-hiding-its-entire-c2-inside-microsoft-365-azure/ #infosec #threatresearch #Microsoft #Azure #Python #vulnerability

New.

Zscaler: C2Looper: A New Backdoor Likely Tied To Ransomware With GitHub C2 https://www.zscaler.com/blogs/security-research/c2looper-new-backdoor-likely-tied-ransomware-github-c2 #infosec #threatresearch #ransomware #GitHub

New.

Operation ASTERIX: Anatomy of a Crypto Fraud Pipeline https://www.rapid7.com/blog/post/tr-operation-asterix-crypto-fraud-vishing-phishing/ @Rapid7Official #infosec #threatresearch #fraud

SpecterOps, published yesterday: Return of the Cookie Monster https://specterops.io/blog/2026/08/13/chrome-devtools-protocol-cookie-theft/

More:

The Hacker News: Chrome DevTools Technique Enables Authenticated Session Hijacking in Live Windows Browsers https://thehackernews.com/2026/08/chrome-devtools-technique-enables.html @thehackernews #infosec #threatresearch #Windows #Chrome #Google #Microsoft

New.

Kaspersky: APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit https://securelist.com/honeymyte-coolclient-driver-rootkit/121028/ @Kaspersky

More:

The Hacker News: Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth https://thehackernews.com/2026/08/mustang-panda-adds-signed-windows.html @thehackernews #infosec #Microsoft #Windows #threatresearch

https://www.wiz.io/blog/mini-shai-hulud-strikes-again-tanstack-more-npm-packages-compromised
#CyberSecurity #InfoSec #SupplyChainSecurity #SoftwareSupplyChain #NPM #OpenSourceSecurity #AppSec #DevSecOps #ThreatIntel #Malware #JavaScript #NodeJS #CICD #GitHubActions #CloudSecurity #TypeScript #ReactJS #WebDev #OpenSource #DevTools #SoftwareEngineering #DeveloperSecurity #SecureCoding #GitHub #SupplyChainAttack #Programming #TechNews #DevOps #ApplicationSecurity #ThreatResearch #SecurityEngineering #CyberAttack #Hackers #MalwareAlert #SecurityResearch #DevCommunity

New research shows 3 flaws dubbed #ClaudyDay in Claude AI could be chained to steal user data using fake Google Ads, hidden prompts, and built-in features.

Read: https://hackread.com/claudy-day-flaws-data-theft-fake-claude-ai-ads/

#CyberSecurity #AI #ClaudeAI #InfoSec #DataSecurity #ThreatResearch #Malware #Privacy

We’ve been tracking a cluster of RDGA‑generated domains involved in distributing fake app‑store landing pages. These domains are consistently registered through Namecheap and protected by Cloudflare, which the operators use to obscure origin infrastructure and rapidly cycle through fresh front‑end domains.

The sites impersonate Google Play or iTunes, based on their device’s user‑agent, presenting users with pages that look and feel legitimate. Instead of real apps, the pages deliver Progressive Web Applications (PWAs) that persist on the device and enable ongoing notification abuse.

PWAs are a chrome application which plays cross platform, windows, linux, android, iOS and gets added as an icon on the desktop ofevery device.

Once installed, the PWA triggers a redirection chain through one or more intermediary domains before sending users to online casinos, adult content, or other low‑quality destinations. Because many of these casinos operate from regions where online gambling is restricted or illegal, the operators continually replace the final‑stage domains. This use of RDGA and PWAs allows them to evade regional blocking, reputation systems, and automated detection controls by rotating infrastructure at scale and keeping their persistence to the user devices.

fwiw, most large scale gambling operations like these are not simply illegal in the regions they target... they are scams and often connected to other major crimes, including human trafficking.

play-megawin[.]site
play-icefish[.]website
play-richcasino[.]site
play-casinostaat[.]site
mountainvertex[.]shop
play-fdjfrance[.]site
play-lucky7[.]site
funterra[.]shop
hotcoins[.]site
stonefestal[.]shop
spirevanguard[.]shop
play-crowngreen[.]website
forestoutpost[.]shop

#threatintel #gambling #pwa #dns #fake #infoblox #threatresearch #malware #scam #fakeApp #googleplay #infobloxthreatintel #itunes

Operation Bizarre Bazaar documents systematic abuse of exposed LLM and MCP infrastructure with commercial monetization.

The campaign demonstrates how AI endpoints without authentication, rate limits, or proper exposure controls can enable compute theft, data access, and potential lateral movement.

AI infrastructure security is increasingly inseparable from traditional cloud and app security.

What controls are most effective in your environment?

Source: https://www.pillar.security/blog/operation-bizarre-bazaar-first-attributed-llmjacking-campaign-with-commercial-marketplace-monetization

Follow TechNadu for objective infosec research coverage.

#AIsecurity #LLM #MCP #CloudDefense #ThreatResearch #InfosecCommunity

⚠️ Smishing alert for Greek citizens. 💳 🚨

Scammers are pushing fake AADE (Independent Authority for Public Revenue) “unpaid taxes” SMS that lead to cloned payment pages designed to steal credit‑card info. If a text suddenly demands urgent payment, treat it like a pop‑up from nowhere—don’t click, don’t trust, don’t pay. Share to protect others.

mycargr[.]com
aadcar[.]com
aadgee[.]com
aadgre[.]com

#CyberThreatIntel #Infoblox #DNS #ThreatResearch #phishing #smishing #Cybercrime #AADE #Greece

New, from me: Who Operates the Badbox 2.0 Botnet?

The cybercriminals in control of Kimwolf -- a disruptive botnet that has infected more than 2 million devices -- recently shared a screenshot indicating they'd compromised the control panel for Badbox 2.0, a vast China-based botnet powered by malicious software that comes pre-installed on many Android TV streaming boxes. Both the FBI and Google say they are hunting for the people behind Badbox 2.0, and thanks to bragging by the Kimwolf botmasters we may now have a much clearer idea about that.

https://krebsonsecurity.com/2026/01/who-operates-the-badbox-2-0-botnet/

#infosec #botnet #IoT #Android #Google #threatresearch

New, from me: The Kimwolf Botnet is Lurking in Corporate, Govt. Networks

A new Internet-of-Things botnet called Kimwolf has spread to more than 2 million devices, forcing infected systems to participate in massive distributed denial-of-service (DDoS) attacks and to relay other malicious and abusive Internet traffic. Kimwolf’s ability to scan the local networks of compromised systems for other IoT devices to infect makes it a sobering threat to organizations, and new research reveals Kimwolf is surprisingly prevalent in government and corporate networks.

https://krebsonsecurity.com/2026/01/kimwolf-botnet-lurking-in-corporate-govt-networks/

#botnet #infosec #IoT #DDoS #threatresearch #malware

Researchers disclosed Reprompt, a prompt-injection-based technique affecting Microsoft Copilot Personal, allowing session hijacking and stealthy data exfiltration via crafted URLs.

Although now patched and not seen in active exploitation, the research highlights:

- Prompt injection via URL parameters
- Session persistence risks in AI assistants
- Limitations of first-request-only guardrails
- Challenges for client-side detection

A useful case study in LLM threat modeling and defensive design.

What security control do you see as most critical for consumer AI assistants?

Source: https://www.bleepingcomputer.com/news/security/reprompt-attack-let-hackers-hijack-microsoft-copilot-sessions/

Follow @technadu for sober, security-first reporting.
Add your insights below.

#InfoSec #AIsecurity #PromptInjection #LLM #ThreatResearch #DataSecurity

Threat actors continue to operationalize current-events lures as part of malware delivery chains.

Recent research shows a backdoor deployed via attachments themed around breaking geopolitical news, using legitimate binaries and DLL sideloading techniques for persistence.

No attribution assumptions - just a reminder that contextual relevance remains one of the most effective social engineering tools.

What controls have you found most effective against news-driven phishing?

Engage with us in the comments and follow @technadu for practical threat intelligence coverage.

Source: https://www.darktrace.com/blog/maduro-arrest-used-as-a-lure-to-deliver-backdoor

#InfoSec #ThreatResearch #MalwareTTPs #PhishingDefense #CyberOperations #ThreatDetection #TechNadu

Gen Digital researchers have disclosed GhostPairing, a technique that leverages WhatsApp’s multi-device functionality via social engineering to enable persistent, low-noise access to user communications.

The case highlights how legitimate features can become attack surfaces when paired with deception rather than technical exploitation.

Open discussion: how can platforms mitigate abuse of trusted workflows without degrading user experience?

Follow TechNadu for objective threat analysis and security research updates.

Source: https://www.techrepublic.com/article/news-whatsapp-ghostpairing/

#InfoSec #ThreatResearch #SocialEngineering #MessagingSecurity #PrivacyEngineering #CyberRisk