Login
Fake AI Attacks Target US Firms as Researchers Warn of Corporate Credential Theft
ANY.RUN analyzed 1,258 sandbox submissions showing how fake ChatGPT and Claude downloads and setup guides steal corporate credentials and browser session data.
Reading view
Fake US Court Notices Target 100,000+ Businesses With LodaRAT
Fake US court notices target over 100,000 businesses, luring recipients to download LodaRAT malware that steals passwords, records…
StealC Malware Returns as Stadia RAT After Operation Endgame Takedown
StealC’s seller has returned with Stadia RAT, combining credential theft, hidden desktop control, and remote command execution using…
Overlord RAT Uses Fake Legal Notices to Infect Windows PCs in New Campaign
WatchGuard details Overlord RAT attacks using fake Brazilian legal notices, plus Lampion malware and a separate remote access…
China-Based BRONZE SANDCASTLE Hackers Abuse Sandboxie to Load Backdoors
Sophos found BRONZE SANDCASTLE abusing legitimate Windows apps to load encrypted backdoors, collect system information and steal Active…
Targeted Ads Used to Infect Al Jazeera Devices with Candiru Spyware
Citizen Lab found targeted ads delivered Candiru spyware to Al Jazeera devices without clicks, while the same ad…
Anthropic Warns Small AI Models Could Power Self-Spreading AI Worms
Anthropic finds small AI models can set up inference servers across different hardware, raising concerns about future AI…
MS Teams Phishing, ClickFix and Shai-Hulud npm Attacks Dominate Threat Report
Ontinue’s 1H 2026 threat report shows attackers increasingly abusing Microsoft Teams, npm packages, device-code logins and blockchain ClickFix…
Powering Proactive Defense: How MSSPs Can Strengthen Threat Hunting Against Ransomware
Disclosure: This article was provided by ANY.RUN. The information and analysis presented are based on their research and findings.
Midnight Mimosa Malware Found Preinstalled on Low-Cost Android Phones
Low-cost Android phones can arrive already compromised, with malware embedded in their firmware before buyers switch them on.
100+ Ukrainian Websites Hacked to Install Lunex Stealer with ClickFix Lure
Over 100 hacked Ukrainian websites used fake Cloudflare checks to install Lunex Stealer and steal browser passwords, tokens and cryptocurrency wallets.
Hackers Exploit 24 IoT Vulnerabilities to Install ClingSTUN Linux Backdoor
Meet ClingSTUN, a new Linux backdoor that exploits IoT vulnerabilities, gives attackers remote command access and turns infected devices into proxy nodes.
Star Blizzard Targets 100+ Organizations with Phishing and RedFlick Technique
Russian group Star Blizzard expands phishing campaigns with a new malware delivery RedFlick technique, using scheduled tasks to deliver the CosmicPulse backdoor.
New CloudSyncD macOS Backdoor Uses Fake Zoom Installer to Steal Passwords
CloudSyncD macOS backdoor uses a fake Zoom installer to steal Mac passwords, bypass Gatekeeper and connect infected devices to remote C2 servers.
MALFEX npm Attack Spreads Windows RAT, Steals Discord and Browser Data
CloudSEK uncovered the MALFEX campaign using malicious npm packages to deploy Overlord RAT, steal Discord and browser data,…
Global Group Ransomware Abuses WinMerge to Deploy Encryptor
Cofense researchers reveal how Global Group uses payment-themed phishing, malicious ISO files and WinMerge to deploy ransomware and extort large enterprises.
Tech Support Scam Kit Uses Google Ads to Deliver Fake Security Alerts
Google Ads deliver a tech support scam kit that shows fake security alerts, makes browsers appear locked and…
SectopRAT Abuses Legitimate Audio Software Files to Steal PC Data
FortiGuard found SectopRAT hidden in modified audio software files, using staged loading to steal browser data and remotely control infected Windows PCs.
New AvisLoader Windows Malware Uses ClickFix Lure and Tox P2P for C2
Varonis Threat Labs discovered AvisLoader, a Windows malware loader that uses the Tox peer-to-peer network for C2 and arrives through a malicious ClickFix lure.
RatHat Android Malware Uses AI to Target Banking Credentials in Real Time
RatHat Android malware uses generative AI to navigate infected devices, steal banking credentials, intercept OTP codes and reinstall itself after removal again.
