← Feed

Posts

• View post

  TIKTOUK: Tracing a WordPress Credential Collection Toolkit Pulse ID: 6ac338b90015d38c899398ec Pulse Link: https://otx.alienvault.com/pulse/6ac338b90015d38c899398ec Pulse Author: Tr1sa111 Created: 2026-10-05 05:42:17 Be advised, this data is unverified and should be considered preliminary. Always do further verification. #Credential #TIKTOUK #Wordpress #OTX #Tr1sa111

• View post

  Fake xStocks, Pendle, and other sites bait crypto users with rewards votes Pulse ID: 6ac338b11e9a6f20af31a928 Pulse Link: https://otx.alienvault.com/pulse/6ac338b11e9a6f20af31a928 Pulse Author: Tr1sa111 Created: 2026-10-05 05:42:09 Be advised, this data is unverified and should be considered preliminary. Always do further verification. #OTX #Tr1sa111

• View post

  Warlock Ransomware Attackers Hit Water and Telecom Operators Pulse ID: 6ac338a9cf325c4919d1b050 Pulse Link: https://otx.alienvault.com/pulse/6ac338a9cf325c4919d1b050 Pulse Author: Tr1sa111 Created: 2026-10-05 05:42:01 Be advised, this data is unverified and should be considered preliminary. Always do further verification. #Telecom #Warlock #RansomWare #OTX #Tr1sa111

• View post

  Hallucinating Credibility: China-Aligned TA419 Impersonates its Way into US AI Policy Circles Pulse ID: 6ac3389ecc4d8f2f8b8a0c6f Pulse Link: https://otx.alienvault.com/pulse/6ac3389ecc4d8f2f8b8a0c6f Pulse Author: Tr1sa111 Created: 2026-10-05 05:41:50 Be advised, this data is unverified and should be considered preliminary. Always do further verification. #TA419 #China #OTX #Tr1sa111

• View post

  Citrix NetScaler CVE-2026-88771: Observed Exploitation Artifacts and Hunt Indicators Pulse ID: 6ac33890e1bfafb65406440a Pulse Link: https://otx.alienvault.com/pulse/6ac33890e1bfafb65406440a Pulse Author: Tr1sa111 Created: 2026-10-05 05:41:36 Be advised, this data is unverified and should be considered preliminary. Always do further verification. #CVE202688771 #Citrix #NetScaler #OTX #Tr1sa111

• View post

  Cling Malware Masquerades as Google STUN Traffic to Control Compromised IoT Devices Cling malware is turning compromised internet-connected devices into a botnet while disguising its control traffic as replies from Google’s public STUN service. The technique makes attacker instructions look like routine communications used by applications to connect across network boundaries. The infection begins with attacks against exposed devices running vulnerable Realtek software. Earlier reporting on Real...

• View post

  The Psychedelic Stealer: When the CAPTCHA Is the Installer Between September 9 and September 14, 2026, an unattributed Russian-speaking operator compromised at least six legitimate Ukrainian small-business websites to deliver a fake Cloudflare verification page. The ClickFix chain convinced victims to manually execute msiexec.exe commands via the Windows Run dialog, achieving a 14 percent completion rate (79 infections from 426 clicks). The payload, internally named Psychedelic, combines creden...

• View post

  SMTP is the key: BPFDoor and AVERAT hitting the network edge A sophisticated multi-component campaign targeting telecommunications and network-edge appliances has been discovered, featuring BPFDoor variants and a newly identified implant designated AVERAT. The operation leverages SMTP traffic on port 25 to blend command-and-control communications with legitimate mail relay activity, exploiting the trust environments of targeted systems. Attackers deploy a dropper that stages payloads into memor...

• View post

  Anatomy of BraZetsu: How Cybercriminals Supply the Underground Ecosystem BraZetsu is a sophisticated Python-based Windows malware framework attributed to the Brazilian threat actor Exilware. Unlike standard infostealers, it functions as a comprehensive toolkit for Initial Access Brokers, converting compromised systems into high-value commercial assets. The framework employs modular architecture, advanced evasion techniques, and AI-enhanced reconnaissance capabilities to target corporate, financ...

• View post

  Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Threat actors exploited ChatGPT's Custom GPT feature to impersonate legitimate ChatGPT models, directing victims through sponsored Google ads to malicious Custom GPTs titled 'Plus 5.6'. These instances served fake service availability notices, redirecting users to Google Sites pages hosting ClickFix lures disguised as CloudFlare CAPTCHA checks. Victims were tricked into executing PowerShell commands that dow...

• View post

  Pretty Themes, Hidden Loaders: GlassWorm-Linked Extensions Span VS Code Marketplace and Open VSX Socket identified a malicious cluster of Visual Studio Code extensions spanning both VS Code Marketplace and Open VSX registries. Two confirmed malicious themes were discovered: Aurora Nocturne Night Theme, which downloaded and executed threat actor-controlled batch files, and Cosmic Nebula Themes, containing a staged loader that decrypts embedded JavaScript, performs Russian-language gating, and us...

• View post

  XWorm Malware: Worming Its Way From Entry to Exploitation XWorm is a versatile modular malware that poses a multifaceted threat through remote access, data theft, ransomware delivery, and botnet creation. Associated with the DDGroup cybercrime group, it rapidly gained notoriety for using advanced techniques. The malware employs diverse delivery methods including phishing emails with malicious attachments, drive-by downloads, exploit kits targeting browser vulnerabilities, USB drives, and Remote...

• View post

  Hackers Abuse Legitimate ScreenConnect Tool to Gain Remote Access Through Phishing Hackers are using a legitimate ScreenConnect client to turn a payment notification into a route for remote access. Instead of delivering custom malware, the phishing attempt directs recipients to software already designed to let someone else connect to their computer. The email claims that a payment of $5745.65 has been received and invites the recipient […] The post Hackers Abuse Legitimate ScreenConnect Tool to...

• View post

  Response Overview and Colonel Clustered – Grouping Burp Responses by Content Two Burp Suite extensions that group responses by content: Response Overview, a BApp with a threshold you set, and Colonel Clustered, which picks its own. Pulse ID: 6ac39e746ceb2124f3eb1e3d Pulse Link: https://otx.alienvault.com/pulse/6ac39e746ceb2124f3eb1e3d Pulse Author: CyberHunter_NL Created: 2026-10-05 12:56:20 Be advised, this data is unverified and should be considered preliminary. Always do further verificat...

• View post

  GlassWorm Supply Chain Attack Uses Fake VS Code Themes to Deliver Hidden Malware GlassWorm is turning developer tools into malware delivery channels, this time through extensions advertised as attractive VS Code themes. The investigated cluster spans Visual Studio Marketplace and Open VSX, showing how appearance changes can provide cover for code that runs on developer machines. The campaign first surfaced in October 2025 and has since expanded across […] The post GlassWorm Supply Chain Attack...

• View post

  Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2 Threat actors have been observed attempting to exploit a now-patched critical security flaw impacting the Realtek Jungle software development kit (SDK) to deploy a botnet malware called Cling. "Cling is notable not because it introduces a new propagation technique, but because it repurposes ordinary STUN behavior into a practical command-and-control channel," Nozomi Networks said in a report Pulse ID:...

• View post

  ClickFix Fake CAPTCHA Attack Executes Malware Hidden Inside Browser Cache A new ClickFix campaign is turning a web safety check into a route for malware. Visitors to compromised websites see a fake CAPTCHA or repair message and are told to open the Windows Run dialog, paste copied text, and press Enter. The instruction looks simple, but it makes the victim run the attacker’s command. The […] The post ClickFix Fake CAPTCHA Attack Executes Malware Hidden Inside Browser Cache appeared first on Cyb...

• View post

  Caught in 4K: The Gentlemen Files A Russian-speaking affiliate of the Gentlemen ransomware group, identifying as Azazel, compromised over two dozen organizations across six countries while simultaneously betraying the RaaS operator. The threat actor deployed independent leak site LEAKNED, keeping all extortion proceeds. Attack chains primarily exploited CI/CD secrets from GitLab instances, with one deep compromise involving an AI platform through SSRF, credential decryption, and continuous obje...

• View post

  A STUNning Disguise: Cling Malware Masquerades as Google A sophisticated IoT botnet dubbed Cling has been discovered exploiting vulnerable internet-exposed devices through CVE-2021-35394 and other command-injection flaws. The malware distinguishes itself by abusing STUN protocol traffic and public STUN infrastructure for command-and-control communications, making malicious activity appear as legitimate NAT-traversal behavior. Cling propagates through multiple CVE exploits targeting routers, DVR...

• View post

  CVE-2026-104286: Critical FortiMail Zero-Day Exploited for Unauthenticated File Writes Fortinet has disclosed a critical FortiMail zero-day vulnerability that attackers are already exploiting in the wild. Tracked as CVE-2026-104286 and rated 9.8 on the CVSS scale, the flaw enables an unauthenticated remote attacker to write arbitrary files to the underlying system by sending specially crafted HTTP or HTTPS requests. The vulnerability poses a significant risk […] The post CVE-2026-104286: Critic...

• View post

  Beware the SparroWock: The backdoor that bites, the commands that catch Indicators extracted from public reporting. Source: https://www.eset.com/int/business/services/threat-intelligence/?utm_source=welivesecurity.com&utm_medium=referral&utm_campaign=wls-research&utm_content=beware-sparrowock-backdoor-bites-commands-catch&sfdccampaignid=7011n0000017htTAAQ Pulse ID: 6aad0a9f11a363a15814494b Pulse Link: https://otx.alienvault.com/pulse/6aad0a9f11a363a15814494b Pu...

• View post

  ThreatsDay: Self-Rewriting Agents, 800+ Flaws Patched, Insider SIM Swaps and 22 More New Stories Indicators extracted from public reporting. Source: https://thehackernews.com/2026/09/threatsday-self-rewriting-agents-800.html Pulse ID: 6aacb63e160b1f1ab8d3a1fd Pulse Link: https://otx.alienvault.com/pulse/6aacb63e160b1f1ab8d3a1fd Pulse Author: CyberHunter_NL Created: 2026-09-18 03:55:42 Be advised, this data is unverified and should be considered preliminary. Always do further verification. #...

• View post

  PIVOTPIPE: A New .NET-based Unofficial Beacon Payload Pulse ID: 6aab7c429cbc2675255fd261 Pulse Link: https://otx.alienvault.com/pulse/6aab7c429cbc2675255fd261 Pulse Author: Tr1sa111 Created: 2026-09-17 05:36:02 Be advised, this data is unverified and should be considered preliminary. Always do further verification. #NET #OTX #Tr1sa111

• View post

  The banana stand: brokering and managing infections across Asia using MQTT Pulse ID: 6aab7c49da521a5fde002948 Pulse Link: https://otx.alienvault.com/pulse/6aab7c49da521a5fde002948 Pulse Author: Tr1sa111 Created: 2026-09-17 05:36:09 Be advised, this data is unverified and should be considered preliminary. Always do further verification. #Asia #MQTT #OTX #Tr1sa111

• View post

  The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions Pulse ID: 6aab7c54a7d3b34045501163 Pulse Link: https://otx.alienvault.com/pulse/6aab7c54a7d3b34045501163 Pulse Author: Tr1sa111 Created: 2026-09-17 05:36:20 Be advised, this data is unverified and should be considered preliminary. Always do further verification. #Chrome #OTX #Tr1sa111

• View post

  StyleSmuggler: Magento and Adobe Commerce 0-day RCE under active attack Pulse ID: 6aa8f78f28a8d7073b557898 Pulse Link: https://otx.alienvault.com/pulse/6aa8f78f28a8d7073b557898 Pulse Author: Tr1sa111 Created: 2026-09-15 07:45:19 Be advised, this data is unverified and should be considered preliminary. Always do further verification. #0Day #Adobe #Magento #RCE #OTX #Tr1sa111

• View post

  Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence Pulse ID: 6aa8d48bb9571ef6455a21c6 Pulse Link: https://otx.alienvault.com/pulse/6aa8d48bb9571ef6455a21c6 Pulse Author: Tr1sa111 Created: 2026-09-15 05:15:55 Be advised, this data is unverified and should be considered preliminary. Always do further verification. #Phishing #Browser #OTX #Tr1sa111

• View post

  Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon Pulse ID: 6aa8d28c00a1fa0064105d5e Pulse Link: https://otx.alienvault.com/pulse/6aa8d28c00a1fa0064105d5e Pulse Author: Tr1sa111 Created: 2026-09-15 05:07:24 Be advised, this data is unverified and should be considered preliminary. Always do further verification. #Chinese #Government #OTX #Tr1sa111

• View post

  Financially Motivated Threat Actor BREEZE COMET Targets Brazil Pulse ID: 6aa8d24632573b2a3c81b5f6 Pulse Link: https://otx.alienvault.com/pulse/6aa8d24632573b2a3c81b5f6 Pulse Author: Tr1sa111 Created: 2026-09-15 05:06:14 Be advised, this data is unverified and should be considered preliminary. Always do further verification. #Brazil #OTX #Tr1sa111

• View post

  Hackers Exploit FortiGate SSL-VPN Vulnerability to Attack Broadband Provider Indicators extracted from public reporting. Source: https://cybersecuritynews.com/fortigate-ssl-vpn-vulnerability/ Pulse ID: 6aa835ee9dc88a53daa3efde Pulse Link: https://otx.alienvault.com/pulse/6aa835ee9dc88a53daa3efde Pulse Author: CyberHunter_NL Created: 2026-09-14 17:59:10 Be advised, this data is unverified and should be considered preliminary. Always do further verification. #SSL #VPN #Vulnerability #OTX #Cyb...