Stories with indicators of compromise: attacker IPs, domains, URLs and file hashes to hunt for and block.
11 stories match your filters.
CYFIRMA's new Star Blizzard profile, built largely on Microsoft's RedFlick report, describes bulk phishing against 100+ organizations in 2026, VHDX-and-shortcut lures, the CosmicPulse backdoor and a leaked iPhone exploit kit.
Check Point says the new Aokigahara infostealer has a dedicated module for AI assistant and coding-tool sessions, plus cloud configs, SSH keys, browsers and crypto wallets.
Securonix found JavaScript on hijacked sites that uses a logged-in WordPress admin's session to install a backdoored plugin that persists in mu-plugins and hides from the plugin list.
Huntress says a sponsored Google result led to a fake Amazon login and a ClickFix CAPTCHA that used finger.exe to install the Lumma infostealer and NetSupport remote access.
ADAMnetworks details how a device code phishing kit let an operator register rogue Entra devices, sit in a company's Microsoft 365 account for seven weeks and attempt payment fraud.
Semperis says Iran-linked Prince of Persia (Infy) rebuilt its infrastructure after a February exposure and is now running a Tornado C2 server in the US for the first time in a decade.
A Teams caller posing as IT talks victims into installing remote-access tools, then drops EtherRAT, a Node.js backdoor that looks up its command server in an Ethereum smart contract.
WatchGuard details three Brazil-linked campaigns, Overlord RAT, Lampion and a newdev.dll RAT, that start with VBScript and lean on built-in Windows tools and signed programs to stay hidden.
Stormshield says hacked WordPress sites read C2 addresses from a Polygon smart contract, then show Windows visitors a fake Cloudflare check that leads to a stealer loaded through the Deno runtime.
Solar 4RAYS says Partisan Zmiy spent about two years in a Russian healthcare network, hiding the Telegram-controlled Vasilek backdoor and a fake service in an unmonitored VMware Tools directory.
ESET says UAC-0099 phished into a Ukrainian grain logistics company and handed access to Sandworm, which wiped data, while a new Go backdoor hid its C&C inside the Yggdrasil mesh network.