Indicators

Reports whose articles were checked and found to contain indicators. Counts are measured, not guessed: open a report, read it, take the addresses. Verify every one before it goes anywhere near a block list — a count is evidence a report is worth your time, not that an address is hostile.

37 items from 15 sources

headlines only — every link goes to the original

BleepingComputer
Fortinet warns of critical FortiMail flaw exploited in zero-day attacks
2026-10-01 22:42 UTCindicators3 ip · 9 hashesactively exploitedFortinet is warning customers of a critical FortiMail vulnerability, tracked as CVE-2026-104286, that is being actively exploited in zero-day attacks to execute unauthorized code or commands on vulnerable devices. [...]
Huntress
Huntress Tragic Quadrant: Top Cyber Threats Wrecking Businesses
2026-10-01 13:00 UTCindicators19 hashesClickFixThe Huntress Tragic Quadrant ranks the cyber threats hitting businesses most, from RMM abuse to AiTM, ClickFix, using real SOC data.
Huntress
Defender Exclusion Abuse: How Attackers Hide Malware from MDAV
2026-09-30 17:30 UTCindicators23 hashesmalwareSee how attackers like GootKit and WhisperGate abuse Windows Defender exclusions to hide malware from AV scans — and how Huntress detects it.
The Hacker News
Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures
2026-09-30 15:00 UTCindicators2 hashesmalwareThreat actors are abusing ChatGPT Custom GPTs to disguise them as legitimate product offerings and direct unsuspecting victims to malicious sites that employ ClickFix lures to deliver malware. Huntress, which observed…
Microsoft Security
Star Blizzard refines phishing and malware delivery with the RedFlick technique
2026-09-29 15:00 UTCindicators8 ip · 12 hashesthreat actorSince January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their detection evasion capabilities through large-scale phishing campaigns, the use of accounts on compromised websites, and a…
Huntress
Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix
2026-09-28 20:00 UTCindicators2 ip · 39 hashesmalwareHuntress researchers reveal how attackers are exploiting ChatGPT Custom GPTs to spread ClickFix lures and DLL-sideloaded malware. See the full breakdown.
The Hacker News
Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials
2026-09-26 18:22 UTCindicators1 ipcompromisedThe Psychedelic Stealer malware distributed via compromised Ukrainian websites using ClickFix-style Cloudflare verification checks is part of a wider malware-as-a-service (MaaS) platform called Lunex. The new findings…
SANS ISC
A Closer Look at Malware From the Macfinger ClickFix Campaign, (Fri, Sep 25th)
2026-09-25 12:45 UTCindicators3 ip · 6 hashescampaignIntroduction
Huntress
The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint
2026-09-24 13:00 UTCindicators1 ip · 15 hashesthreat actorThreat actors exploited Samsung MagicINFO to install AnyDesk, disable Defender, and compile a Monero miner directly on a victim endpoint. Learn the detection signals.
ESET Research
Beware the SparroWock: The backdoor that bites, the commands that catch
2026-09-17 08:50 UTCindicators18 ip · 2 hashesAPTESET researchers document SparroWocky, the new flagship backdoor of the FamousSparrow APT group
Zscaler ThreatLabz
Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH
2026-09-16 15:13 UTCindicators1 ip · 13 hashescampaignIntroductionIn August 2026, Zscaler ThreatLabz observed new activity by the Pakistan-nexus threat actor APT36 in a campaign we’re tracking as Operation RapidRust. Since our last publication about the group’s activity in…
Securelist
NightEagle targets Russian companies
2026-09-16 10:00 UTCindicators8 hashescampaignKaspersky GERT experts have uncovered a new campaign by the NightEagle APT, featuring the GhostContainer backdoor and tools hosted on GitHub. The group is also exploiting vulnerabilities in Active Directory and RDP.
Zscaler ThreatLabz
SloppyRAT: A New Tool For Ransomware Attacks
2026-09-10 14:43 UTCindicators2 ip · 24 hashesthreat actorIntroductionIn June 2026, Zscaler ThreatLabz identified a new malware family, tracked as SloppyRAT, that is likely leveraged by a ransomware-related threat actor. ThreatLabz observed SloppyRAT being delivered through a…
Cisco Talos
ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2
2026-09-08 10:00 UTCindicatorscampaignCisco Talos is tracking a cryptocurrency-stealing campaign that abuses the Google Visualization API for command and control (C2), retrieving obfuscated JavaScript from a publicly published Google Sheets document and…
Rapid7
DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors
2026-09-04 12:00 UTCindicators30 hashescampaignOverview A new Linux toolkit, identified by Rapid7 Labs, has been targeting organizations across South Korea’s automotive and media industries with minimal detection. The campaign made use of a HAProxy instance named…
Rapid7
Critical SonicWall SMA1000 Vulnerabilities CVE-2026-83548, CVE-2026-83549 Exploited in the Wild
2026-09-02 16:58 UTCindicatorsactively exploitedOverview On September 1, 2026, SonicWall disclosed two vulnerabilities affecting SonicWall SMA1000 appliances that the vendor says are being actively exploited in the wild. The vulnerabilities, CVE-2026-83548 and…
Huntress
Inside Knight Office, a New M365 AiTM Phishing Kit
2026-09-02 13:00 UTCindicators2 ip · 14 hashesphishingAn inside look at Knight Office, a newly discovered AiTM phishing kit featuring custom control panels, Cloudflare Turnstile, and M365 Token theft.
Unit 42
Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams
2026-08-31 10:00 UTCindicators16 ip · 1 hashescampaignLearn how the Spring Ring campaign abuses Microsoft Teams and voice phishing to deploy malware and target enterprise domain controllers. The post Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft…
Huntress
Next-Gen Phishing Tactics Users Aren’t Ready For | Huntress
2026-08-28 16:00 UTCindicators14 hashesphishingMove past basic credential harvesting. Discover how modern attackers use ClickFix, BitB, and OAuth consent phishing—and how to train your users with Huntress SAT.
Rapid7
PaperCut NG/MF Critical Zero-Day Exploited in the Wild
2026-08-28 10:09 UTCindicatorsexploited inOverview On August 27, 2026, PaperCut Software published an urgent security advisory stating that it is investigating active exploitation of a vulnerability affecting PaperCut NG and PaperCut MF. PaperCut has confirmed…
Elastic Security Labs
From 88 lines to 1: Detecting DLL hijacking with Elastic Defend
2026-08-28 00:00 UTCindicators3 hashescampaignThe ClickFix campaign that sideloads a malicious mscoree.dll also ships a driver to kill Elastic Endpoint. We rebuilt that DLL as a NativeAOT library, dropped it beside a signed Microsoft binary, and Elastic Defend…
Malware Traffic Analysis
2026-08-21: SmartApeSG ClickFix campaign leads to two RATs
2026-08-21 17:49 UTCindicators2 ip · 4 hashescampaign
Huntress
Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware
2026-08-19 13:00 UTCindicators3 ip · 20 hashescampaignHuntress researcher uncovers post-Black Hat & DEF CON phishing campaign using X DMs & malicious documents to deliver AMOS, NetSupport RAT, and other malware.
Zscaler ThreatLabz
C2Looper: A New Backdoor Likely Tied To Ransomware With GitHub C2
2026-08-17 14:06 UTCindicators3 ip · 4 hashesthreat actorIntroductionIn July 2026, Zscaler ThreatLabz identified a new Rust-based malware family that we track as C2Looper, which is likely leveraged by a ransomware-related threat actor. Furthermore, ThreatLabz assesses with…
Huntress
Akira Hits Safe Mode: Ransomware Rebooting Around EDR
2026-08-12 13:00 UTCindicators1 ip · 16 hashesaffiliateAn Akira affiliate rebooted into Safe Mode to kill EDR and Defender, then Safe Mode broke their own ransomware. Here’s the full attack chain.
Zscaler ThreatLabz
CaptiveCrunch: Midnight Blizzard Weaponizes Hotel Wi-Fi Captive Portals to Steal Microsoft 365 Credentials
2026-08-11 22:06 UTCindicators7 ip · 3 hashescampaignIntroductionOn July 31, Microsoft Threat Intelligence reported an ongoing credential theft campaign tracked as CaptiveCrunch. Microsoft attributes this activity to Storm-2945, a sub-cluster of Midnight Blizzard (also…
Huntress
Credential Stuffing Campaign Hits SonicWall | Huntress SOC Tracking
2026-07-28 13:00 UTCindicators5 ip · 14 hashescampaignThe Huntress SOC is tracking an active credential stuffing campaign targeting SonicWall devices, compromising dozens of organizations since July 25.
Zscaler ThreatLabz
Helpdesk Hijackers: Teams Vishing, Quick Assist, and GoGRPC Backdoor
2026-07-27 14:51 UTCindicators8 ip · 12 hashesthreat actorIntroductionZscaler ThreatLabz has been tracking attacks from a threat actor that is likely an initial access broker for ransomware attacks since January 2026. The threat actor targets organizations by leveraging…
Huntress
Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT
2026-07-22 20:00 UTCindicators21 ip · 19 hashescampaignOn July 21 and July 22, Huntress observed a number of attacks that started with a malicious public Claude Artifact hosted on a legitimate Claude domain, and ended in organizations being infected by the SectopRAT stealer.
Elastic Security Labs
New North Korean campaign uses fake coding interviews to steal developer credentials
2026-07-18 00:00 UTCindicators2 ip · 10 hashescampaignDPRK-aligned hackers hid malware inside SVG flag images to backdoor developer job interview coding tests. Not one antivirus vendor caught it.
Fortinet
The TTF Trap: A Global Campaign of a Low-Detection Lua Loader
2026-07-16 13:00 UTCindicators5 ip · 34 hashescampaignFortiGuard Labs analyzes a global phishing campaign using obfuscated JScript, disguised .ttf files, and Lua loaders to deliver RATs and infostealers.
Elastic Security Labs
TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains
2026-07-16 00:00 UTCindicators2 ip · 17 hashesmalwareTELEPUZ is a modular malware that emerged through CLICKFIX-VIDAR attacks in April. We reverse-engineered it to show you the infrastructure and evasion techniques that matter.
Zscaler ThreatLabz
ClaudeFix: Shared Claude Chats Meet ClickFix
2026-07-15 14:39 UTCindicators1 ip · 10 hashesClickFixIntroductionClickFix is a widely employed attack technique, first seen in 2024, where a victim is instructed to paste-and-run instructions on their system to “fix” a problem or install software. The seemingly benign…
Huntress
Threat Actors Achieve Persistence After SQL Injection
2026-07-13 13:00 UTCindicators15 hashesthreat actorSee how a threat actor used SQL injection and BadIIS to gain persistence, disable Windows Defender, and quietly install a cryptominer.
Elastic Security Labs
ClickFix to Cash-Out: Anatomy of a Mexican Banking-Fraud Toolkit
2026-07-08 00:00 UTCindicators3 ip · 30 hashesClickFixElastic Security Labs tracks REF6045, an active operator-assisted banking fraud operation targeting customers of Mexican banks, fintech, payment processors, and cryptocurrency exchanges.
The DFIR Report
From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira
2026-06-29 13:07 UTCindicators11 ip · 9 hashesintrusionKey Takeaways This case was first reported to customers in a threat brief released in July 2025 and in a public flash alert in August 2025 in partnership with Swisscom B2B CSIRT, which observed another intrusion tied to…
The DFIR Report
Apache ActiveMQ Exploit Leads to LockBit Ransomware
2026-02-23 14:09 UTCindicators2 ip · 5 hashesthreat actorKey Takeaways An audio version of this report can be found on Spotify, Apple, YouTube, Audible, & Amazon. This intrusion began in mid-February 2024 after a threat actor exploited a vulnerability (CVE-2023-46604) on an…

|Fortinet warns of critical FortiMail flaw exploited in zero-day attacks

|Huntress Tragic Quadrant: Top Cyber Threats Wrecking Businesses

|Defender Exclusion Abuse: How Attackers Hide Malware from MDAV

|Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures

|Star Blizzard refines phishing and malware delivery with the RedFlick technique

|Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix

|Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials

|A Closer Look at Malware From the Macfinger ClickFix Campaign, (Fri, Sep 25th)

|The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint

|Beware the SparroWock: The backdoor that bites, the commands that catch

|Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH

|NightEagle targets Russian companies

|SloppyRAT: A New Tool For Ransomware Attacks

|ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2

|DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors

|Critical SonicWall SMA1000 Vulnerabilities CVE-2026-83548, CVE-2026-83549 Exploited in the Wild

|Inside Knight Office, a New M365 AiTM Phishing Kit

|Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams

|Next-Gen Phishing Tactics Users Aren’t Ready For | Huntress

|PaperCut NG/MF Critical Zero-Day Exploited in the Wild

|From 88 lines to 1: Detecting DLL hijacking with Elastic Defend

|2026-08-21: SmartApeSG ClickFix campaign leads to two RATs

|Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware

|C2Looper: A New Backdoor Likely Tied To Ransomware With GitHub C2

|Akira Hits Safe Mode: Ransomware Rebooting Around EDR

|CaptiveCrunch: Midnight Blizzard Weaponizes Hotel Wi-Fi Captive Portals to Steal Microsoft 365 Credentials

|Credential Stuffing Campaign Hits SonicWall | Huntress SOC Tracking

|Helpdesk Hijackers: Teams Vishing, Quick Assist, and GoGRPC Backdoor

|Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT

|New North Korean campaign uses fake coding interviews to steal developer credentials

|The TTF Trap: A Global Campaign of a Low-Detection Lua Loader

|TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains

|ClaudeFix: Shared Claude Chats Meet ClickFix

|Threat Actors Achieve Persistence After SQL Injection

|ClickFix to Cash-Out: Anatomy of a Mexican Banking-Fraud Toolkit

|From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira

|Apache ActiveMQ Exploit Leads to LockBit Ransomware

Fortinet warns of critical FortiMail flaw exploited in zero-day attacks

Huntress Tragic Quadrant: Top Cyber Threats Wrecking Businesses

Defender Exclusion Abuse: How Attackers Hide Malware from MDAV

Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures

Star Blizzard refines phishing and malware delivery with the RedFlick technique

Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix

Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials

A Closer Look at Malware From the Macfinger ClickFix Campaign, (Fri, Sep 25th)

The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint

Beware the SparroWock: The backdoor that bites, the commands that catch

Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH

NightEagle targets Russian companies

SloppyRAT: A New Tool For Ransomware Attacks

ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2

DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors

Critical SonicWall SMA1000 Vulnerabilities CVE-2026-83548, CVE-2026-83549 Exploited in the Wild

Inside Knight Office, a New M365 AiTM Phishing Kit

Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams

Next-Gen Phishing Tactics Users Aren’t Ready For | Huntress

PaperCut NG/MF Critical Zero-Day Exploited in the Wild

From 88 lines to 1: Detecting DLL hijacking with Elastic Defend

2026-08-21: SmartApeSG ClickFix campaign leads to two RATs

Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware

C2Looper: A New Backdoor Likely Tied To Ransomware With GitHub C2

Akira Hits Safe Mode: Ransomware Rebooting Around EDR

CaptiveCrunch: Midnight Blizzard Weaponizes Hotel Wi-Fi Captive Portals to Steal Microsoft 365 Credentials

Credential Stuffing Campaign Hits SonicWall | Huntress SOC Tracking

Helpdesk Hijackers: Teams Vishing, Quick Assist, and GoGRPC Backdoor

Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT

New North Korean campaign uses fake coding interviews to steal developer credentials

The TTF Trap: A Global Campaign of a Low-Detection Lua Loader

TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains

ClaudeFix: Shared Claude Chats Meet ClickFix

Threat Actors Achieve Persistence After SQL Injection

ClickFix to Cash-Out: Anatomy of a Mexican Banking-Fraud Toolkit

From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira

Apache ActiveMQ Exploit Leads to LockBit Ransomware