Threats & Attacks
Ransomware, malware, phishing and the actors behind them.
Pastejacking: How Social Engineering Became the Default Malware Delivery Method
Once a rare exploit, pastejacking via ClickFix now drives nearly half of all initial-access attacks, leveraging API-driven payloads, macOS bypasses, and fileless execution to turn user trust into a weaponized vector.
The OS Trap: How Phishing Campaigns Use User-Agent Fingerprinting to Serve the Right Malware for Your Device
Modern phishing kits leverage browser telemetry to deliver OS-specific payloads like FleetDeck, Tiflux RAT, and LummaC2 infostealers—maximizing compromise rates by avoiding wasted clicks on unsupported platforms.
Beijing's Dual-Vector Espionage Push Into Central Europe and East Asia
An examination of dual-method data exfiltration campaigns targeting government and public sector entities in Taiwan and the Czech Republic by Chinese nation-state actors.
Parallel Phishing Operations: How Malicious Zips Target Hospitality Firms in EU and Asia
Analysis of parallel phishing campaigns identified by Microsoft and Trend Micro that use malicious zip files to deliver malware through social engineering tactics targeting EU and Asian hospitality organizations.
Dynamic Malware Targeting: How Modern Phishing Campaigns Adapt to Victim Operating Systems
An analysis of how cybercriminals utilize browser User-Agent fingerprinting and traffic distribution system (TDS) infrastructure to serve OS-specific payloads, increasing phishing campaign efficiency and evasion capabilities.
No Longer the Exception: How the Ingenious 'ClickFix' Hook Became Cybercrime's New Standard
An in-depth analysis of the massive surge in 'ClickFix' clipboard-injection campaigns, tracking its graduation from a novel proof-of-concept to the dominant delivery method utilized by top-tier cybercriminals and nation-state advanced persistent threat (APT) groups.
The 2029 Mandate: How Microsoft Is Racing to Outrun Quantum Hackers
Microsoft accelerates its quantum-safe security roadmap, targeting 2029 for the transition of critical products to post-quantum cryptography (PQC) due to evolving quantum threats.
Operation Navy Ghost: Trojanized Telegram Bot Libraries Compromise Servers
A newly identified PyPI supply chain attack, Operation Navy Ghost, involves malicious forks of the Pyrogram library designed to gain persistent, remote control of Telegram bot infrastructure used by Python developers.
The Poisoned Tenant: How Threat Actors Use Fraudulent OpenAI Organizations to Harvest Corporate Secrets
Push Security has uncovered a "Poisoned Tenant" campaign in which threat actors create fraudulent OpenAI tenants impersonating legitimate companies, then invite employees via platform-originated notifications to trick them into submitting sensitive data through ChatGPT prompts and projects.
Undocumented SprySOCKS Windows Backdoors Reveal FishMonger's Expanded Espionage Reach
FishMonger expands operations by deploying undocumented Windows variants of the SprySOCKS backdoor against government targets using kernel stealth and spooler abuse.
When Malware Wears a Halo: The New Era of Reputation Hijacking in Crypto Attacks
How attackers weaponize GitHub, YouTube, and VirusTotal to build false trust for crypto clipboard hijackers — and what defenders can do about it.
macOS ClickFix Attack Silently Mounts DMGs to Deploy AMOS Infostealer
Following the disruption of malicious code-signing provider Fox Tempest, the operators of the Lorem Ipsum malware pivoted from signed installers to compromised WordPress sites executing ClickFix browser lures, with analysts linking the activity to the Vice Society ransomware syndicate. Optimized for SEO and discoverability.