Threats & Attacks
Ransomware, malware, phishing and the actors behind them.
XCSSET Malware v40: AI Cybersecurity Threats to macOS Developers Through Compromised Xcode Projects
Analysis of XCSSET v40 malware targeting macOS developers through compromised Xcode projects and GitHub repositories, featuring Chrome hijacker and Telegram trojanizer modules with enhanced evasion techniques.
Inside the Coupang Data Breach: How Device Code Phishing and Vishing Bypass Security Controls
An analysis of how device code phishing and vishing attacks bypass traditional security controls while leaving minimal forensic evidence, using the coupang data breach as a case study of modern social engineering tactics.
DOUBLECUP ClickFix Loader: Russian Malware-as-a-Service Hides Payloads in Browser Cache Images
Analysis of DOUBLECUP, a new Russian loader-as-a-service using ClickFix attacks and steganographic PNG images to deliver CountLoader and DeviceManager malware.
CaptiveCrunch: How Russian APT29 (Midnight Blizzard) Uses AI-Developed Malware to Target Hotel Wi-Fi and Steal Microsoft 365 Accounts
Microsoft links the CaptiveCrunch campaign to Russian threat actor Midnight Blizzard (APT29/Storm-2945). The campaign uses AI-developed malware families—CornFlake and ChocoShell—to compromise hospitality Wi-Fi networks and steal Microsoft 365 credentials through DNS manipulation and ClickFix delivery.
Stadler Rail Rejects $12.3M Extortion Attempt Amid AI Cybersecurity Threats
Swiss rail manufacturer Stadler Rail refused a $12.3M extortion demand from the Everest ransomware gang after a breach of a shared vendor data platform. Here is how network segmentation and zero-ransom policies defeated the attack.
Browser-Based Evading C2: How Chaos Group's msaRAT Redefines AI Cybersecurity Threats
Chaos ransomware operators have deployed msaRAT, a Rust-based backdoor that hijacks headless Chrome and Edge sessions via Chrome DevTools Protocol. By abusing Cloudflare Workers, Twilio TURN servers, and dual-layer encryption, msaRAT completely hides command-and-control infrastructure within legitimate browser traffic.
Teams Vishing Unleashes Chaos: How Fake Helpdesk Calls Fuel AI Cybersecurity Threats in 2026
Threat actors tracking as STAC4749 impersonate IT helpdesk staff in Microsoft Teams calls, deploying Chaos ransomware across North American enterprise networks in under 17 hours.
AI Cybersecurity Threats: Health-ISAC Warns of ShinyHunters SaaS Identity Attacks
Health-ISAC has issued an advisory warning healthcare and medical technology organizations of escalating identity and data theft attacks by the ShinyHunters extortion gang. This analysis details their vishing and phishing tactics targeting helpdesk agents, Microsoft Entra and Okta SSO dashboards, and connected SaaS services, while outlining complete defensive practices for securing Tier 0 control planes in 2026.
How FBI's Operation Cronos Shattered LockBit Trust Amid Rising AI Cybersecurity Threats
An in-depth analysis of how the FBI's Operation Cronos shattered LockBit by targeting affiliate trust, and what the dismantling of Ransomware-as-a-Service trust models means for AI cybersecurity threats in 2026.
The MCBS Data Breach: 1.26 Million Patients Left Exposed in a 9-Month Security Failure
A comprehensive analysis of the MCBS data breach affecting 1.26 million individuals, examining the PEAR ransomware attack, the 9-month notification delay, HIPAA compliance failures, and the broader implications for healthcare billing security.
Trojanized Enterprise Tools and Blockchain C2: AI Cybersecurity Threats in 2026
A technical breakdown of threat actor UAT-11795 deploying Starland RAT, CastleStealer, and the in-memory WLDR agent via trojanized WebEx, Zoom, and developer tools.
Under 24 Hours to Lockout: How Spirals Portends AI Cybersecurity Threats in 2026
A technical breakdown of the June 2026 Spirals ransomware intrusion, where threat actors moved from IIS web shell access to network-wide Rust-based encryption in under 24 hours.