Unmasking LucidRook: A Deep Dive into UAT-10362’s Lua-Based Campaign Against TaiwanApr 15, 2026·6 min read·21
The Evolution of EvilTokens: Analyzing AI-Enabled Device Code Phishing CampaignsExecutive Summary The threat landscape for credential theft is shifting from static, proxy-based phishing toward sophisticated, automated abuse of OAuth 2.0 authentication flows. Recent intelligence fApr 15, 2026·6 min read·19
Analyzing the CPUID Watering Hole: STX RAT Distribution via Trojanized System ToolsApr 15, 2026·5 min read·1
ClickFix Evolution: Cross-Platform Social Engineering Targeting Enterprise WorkflowsMar 26, 2026·5 min read·6
Weaponizing the Watcher: Analyzing the TeamPCP Trivy Supply Chain CompromiseExecutive Summary On March 19, 2026, a highly sophisticated CI/CD-focused supply chain attack targeted Trivy, the widely adopted open-source vulnerability scanner maintained by Aqua Security. AttributMar 26, 2026·6 min read·4
Exploiting Trust: PureHVNC RAT Delivery via Malicious Google FormsThe threat landscape is constantly evolving, with attackers frequently pivoting toward legitimate cloud services to bypass traditional email security filters. Recently, SecLookup identified and trackeMar 21, 2026·6 min read·24
Storm-2561 Uses SEO Poisoning to Distribute Fake VPN Clients for Credential TheftExecutive Summary In a sophisticated campaign targeting enterprise environments, the threat actor Storm-2561 has resumed operations by leveraging Search Engine Optimization (SEO) poisoning to distribuMar 20, 2026·5 min read·14
Unpacking the "Sapecar" Campaign: Technical Analysis of the Horabot Banking Trojan in MexicoThe threat landscape in Latin America continues to evolve with increasing complexity, as evidenced by a recent surge in activity surrounding Horabot. This multi-stage threat bundle—comprising a modulaMar 19, 2026·5 min read·10
Unmasking DarkSword: The Proliferation of a New iOS Full-Chain Exploit Across Global Threat ActorsThe mobile threat landscape has reached a new level of sophistication with the discovery of "DarkSword," a potent iOS exploit chain capable of achieving full device compromise through a sequence of zeMar 19, 2026·6 min read·3
IPv6 Obfuscation Tactics in Healthcare Phishing: Analyzing the "Free Toothbrush" CampaignExecutive Summary A sophisticated phishing campaign targeting United Healthcare beneficiaries has recently resurfaced, utilizing a deceptive lure involving a premium Oral-B toothbrush to harvest sensiMar 19, 2026·5 min read·2
