NeedyMantis Hides Its Next Stage Behind Familiar DLL Names
Microsoft traces NeedyMantis through planted DLLs, an extensionless archive and a fake…
Kothamine Carries Hostile Commands Through a Legitimate Tunnel
Kothamine uses tailcat for encrypted remote control. The research shows why localhost…
RemotePanel and BoundSiphon Split a ClickFix Attack in Two
A ClickFix command installs persistent RemotePanel access and the BoundSiphon stealer. Why…
Storm-2570 Uses Four Ransomware Brands—and the Same Access Tools
Microsoft links Storm-2570 to four ransomware families. Repeated remote access, credential theft…
CLOSEDQUORUM: Windows Malware Puts Its Next Move to a Vote
Talos found a Windows implant designed to take votes from four AI…
GigCluster.exe: Is It a Virus? Check and Remove It Safely
GigCluster.exe using high CPU or GPU? Check a suspected miner, verify the…
WaterPlum Fake Job Interviews Infect 30,000 Devices
A joint advisory links WaterPlum fake interviews to 30,000 infected devices. How…
Settra Ransomware Leaves a Defender Log Intact After a Typo
Huntress found that Settra misspelled a Defender event-log name. What survived, how…
MovieReaper Turns Movie Torrents Into Remote File Access
MovieReaper used a compromised torrent repository, a movie-named EXE and Solana address…
CHOSEN BRICK: Fake Support Moves Spyware to Personal PCs
A joint warning shows how CHOSEN BRICK operators move targets from work…
Fake macOS Toolkit Setup Leads to AMOS Data Theft
Unit 42 traced a fake macOS toolkit from a pasted Terminal command…
Music.exe: Is It a Virus? Check and Remove It Safely
Found Music.exe in Task Manager, startup, or on a USB drive? Identify…