Stories with indicators of compromise: attacker IPs, domains, URLs and file hashes to hunt for and block.
40 stories match your filters.
A fake Claude Code 2.1.313 on Cursor's extension marketplace added an attacker SSH key, persistence and a reverse tunnel on up to 5,000 developer machines on Oct. 29. Update to 2.1.314 and check for the 'svc-telemetry' key.
CloudSEK says the Doorway botnet compromised 11,363 routers, cameras and servers in a month, mostly via blank or default passwords on MikroTik routers plus old RouterOS and Openfire bugs.
Huntress says attackers trick staff into enrolling PCs in attacker-run Hexnode and Rippling device-management tenants, then use them to install ScreenConnect as SYSTEM, and reinstall it when removed.
Kaspersky says an unknown group used NetamLoader, a near-fileless .NET loader that abuses a legitimate Patch My PC tool and hides in dllhost.exe, against a customized Windows 10 build used by governments in Asia.
CYFIRMA's new Star Blizzard profile, built largely on Microsoft's RedFlick report, describes bulk phishing against 100+ organizations in 2026, VHDX-and-shortcut lures, the CosmicPulse backdoor and a leaked iPhone exploit kit.
Check Point's Yoba campaign pairs genuine signed OpenAI and Anthropic installers with a sideloaded DLL on fake GitHub AI-app pages, installing a hidden XMRig miner via a Telegram-seeded DGA.
Acronis TRU dissects Qilin's Rust encryptor, its password gate and the PowerShell routine that resets ESXi root passwords and encrypts every host, as the gang passes 900 claimed victims in 2026.
ANY.RUN tracked the SkyW4lker kit across 173 domains: password-protected lures send Microsoft 365 users to the real device login page, where one typed code hands the attacker a token.
Group-IB tracked seven Android trojan families behind fake bank 'protection plan' calls in India: nearly 18,000 phones infected and 7.6 million texts, including OTPs, intercepted.
Huntress tracked a campaign that replayed stolen Microsoft 365 sign-in tokens to take over 97 accounts at 79 organizations, then planted rogue Entra devices, swapped MFA methods and hid payroll mail.
Wiz says the Gheist campaign used stolen GitHub tokens to plant 13,500+ branches across 850+ accounts, each running a workflow that dumps repository secrets into Actions logs and deletes the run.
Check Point says the new Aokigahara infostealer has a dedicated module for AI assistant and coding-tool sessions, plus cloud configs, SSH keys, browsers and crypto wallets.
Securonix found JavaScript on hijacked sites that uses a logged-in WordPress admin's session to install a backdoored plugin that persists in mu-plugins and hides from the plugin list.
Sansec says a Brazilian Magecart group planted a card skimmer in the Plausible analytics script every Convertr store loads, exposing checkouts at dozens of fashion brands Oct. 24 to 27.
Ransom-ISAC's analysis of leaked Silent Ransom Group files shows callback-phishing extortion of mostly US law firms via AnyDesk, with at least $43.95 million confirmed received.
Hunt.io combed about ten attacker open directories full of PHP2Shell tooling and a Mirai-style botnet, and published attempt signatures and indicators defenders can search for today.
CYFIRMA says Korean-speaking operators are quietly scanning 216 unpatched PHP hosts at governments, banks and logistics firms, with a moderate-confidence Lazarus link.
Group-IB and NyxLab say actor k0t exploited exposed FortiWeb, FortiGate and GlobalProtect devices through 2026, reached domain admin, and stole more than 70,000 credentials, likely as an initial access broker.
Imperva ran attacker code on an official Node.js 24.22.0 image by feeding it crafted Brotli data, through fetch() responses or Express 5 body parsers. Patch Node.js and rebuild images.
Kaspersky found BlackX, a UEFI bootkit used against Central Asian diplomats that bypasses Secure Boot via Baton Drop because Microsoft's revocation step was never applied. Medium-confidence link to APT41.
Wiz says ARTEX AI agents tied to Storm-0940 spent October probing IT and software vendors' Okta, Entra ID and Cognito sign-ins. Most attempts failed.
Huntress says a sponsored Google result led to a fake Amazon login and a ClickFix CAPTCHA that used finger.exe to install the Lumma infostealer and NetSupport remote access.
ADAMnetworks details how a device code phishing kit let an operator register rogue Entra devices, sit in a company's Microsoft 365 account for seven weeks and attempt payment fraud.
Semperis says Iran-linked Prince of Persia (Infy) rebuilt its infrastructure after a February exposure and is now running a Tornado C2 server in the US for the first time in a decade.
A Teams caller posing as IT talks victims into installing remote-access tools, then drops EtherRAT, a Node.js backdoor that looks up its command server in an Ethereum smart contract.