June 19, 2026 update: Microsoft assesses with high confidence that this activity is attributable to Sapphire Sleet, a North Korean state actor that primarily targets the financial sector. The ...

WhatsApp caught and disrupted spear phishing attempts linked to NSO, a spyware firm blacklisted by the US government. Today, we’re asking the court to hold NSO in contempt for violating a permanent ...

Our recent review of threat detections in Brazil surfaced BTMOB, an Android remote access trojan (RAT) that is less notable for detection volume than for the damage it can wreak. The combination of ...

Kazuar, a sophisticated malware family attributed to the Russian state actor Secret Blizzard, has been under constant development for years and continues to evolve in support of espionage-focused ...

A new wave of the Mini Shai-Hulud campaign compromised dozens of TanStack npm packages as part of a broader supply chain attack affecting developer ecosystems, including packages tied to UiPath, ...

Abstract: In the realm of cybersecurity, the extraction of Cyber Threat Intelligence (CTI) is vital for acquiring accurate Tactics, Techniques, and Procedures (TTPs) and Indicators of Compromise (IoC) ...

The post From fake Proton VPN sites to gaming mods, this Windows infostealer is everywhere appeared first on Malwarebytes. We’ve uncovered multiple campaigns distributing an infostealer we track as ...

The post Fake YouTube copyright notices can steal your Google login appeared first on Malwarebytes. A convincing phishing campaign is going after YouTube creators, and if it works, attackers don’t ...

An apparent hack-for-hire campaign likely orchestrated by a threat actor with suspected ties to the Indian government targeted journalists, activists, and government officials across the Middle East ...

Abstract: In the ever-evolving cyber era, cyberattack threats are increasingly diverse and elusive. Precise and complete information related to cyber attacks can be utilised to create a reliable ...

OTX DirectConnect provides a mechanism to automatically pull indicators of compromise from the Open Threat Exchange portal into your environment. The DirectConnect API provides access to all Pulses ...