Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 546 results
highperson_alertThreat ActorCybercriminals Steal AI API Keys via Token Jacking for Resale
Cybercriminals targeting the AI development ecosystem are motivated by financial gain through the theft and resale of API keys (tokens) for premium AI platforms.
highperson_alertThreat ActorRansom Cartel Creator Maksim Silnikau Sentenced to 16 Years
Maksim Silnikau is a 40-year-old Belarusian national who created and administered the Ransom Cartel ransomware-as-a-service (RaaS) operation. Active on Russian-speaking cybercrime forums since at least 2005, Silnikau operated under aliases including…
highperson_alertThreat ActorCanadian Cybercriminal Pleads Guilty to Snowflake Data Theft Campaign
Connor Riley Moucka (also known as Alexander Moucka and "Waifu"), a 26-year-old Canadian national, operated as a cybercriminal targeting cloud storage environments for financial gain.
highperson_alertThreat ActorClickFix Campaign Uses Browser Fingerprinting to Target macOS Users
ClickFix is a macOS-focused social engineering campaign tracked by Microsoft Threat Intelligence. The operators remain unidentified, but the campaign demonstrates sophisticated evasion capabilities through server-side browser fingerprinting across mo…
highperson_alertThreat ActorPoipet Scam Network Leveraged ChatGPT for Multi-Scheme Fraud Operations
The Poipet scam network is a Cambodia-based organized criminal operation originating from Poipet, a city with extensive ties to scam compounds and human trafficking.
highperson_alertThreat ActorKali365 Campaign Weaponizes Microsoft Device Code Flow Against US Firms
Kali365 is a device code phishing campaign targeting US organizations through abuse of legitimate Microsoft authentication mechanisms. The campaign leverages a phishing kit designed to trick victims into approving attacker-controlled device codes on…
highperson_alertThreat ActorGreatness PhaaS Expands to AiTM and Device-Code Phishing via RingCentral
Greatness is a phishing-as-a-service (PhaaS) platform active since at least mid-2022, operated by cybercriminals who sell access for $289/month via a Telegram channel with thousands of subscribers.
highperson_alertThreat ActorMicrosoft Defender auto-isolates endpoint in 128 seconds at QNET
No specific threat actor is identified in this incident. The attack represents a common adversary pattern: initial access achieved directly on an endpoint, followed by attempted multi-stage payload delivery using living-off-the-land techniques.
highperson_alertThreat ActorSMOKE#SCREEN Campaign Deploys ScreenConnect via Fake Software Updates
SMOKE#SCREEN is an unattributed multi-wave campaign active as of August 2026 that leverages social engineering to deploy ConnectWise ScreenConnect RMM software for persistent remote access.
highbug_reportVulnerabilityGoogle removes ADK workflows after prompt injection exposed CI credentials
Google Agent Development Kit (ADK) Python repository on GitHub. Three workflows removed: issue-analyze.yml, issue-fix.yml, and pr-analyze.yml. Affected repository automation infrastructure, not the distributed ADK Python package itself.
highperson_alertThreat ActorDOUBLECUP LaaS Uses ClickFix and Steganography to Deploy CountLoader
DOUBLECUP is a Russian loader-as-a-service (LaaS) operation active since early June 2026. The service provides operators with licenses and a Go-based Windows GUI client to orchestrate campaigns that deliver malware via ClickFix social engineering lur…
highperson_alertThreat ActorMidnight Blizzard targets hospitality Wi-Fi in CaptiveCrunch campaign
Midnight Blizzard (APT29, also tracked as Storm-2945, IRON RITUAL, IRON HEMLOCK, NobleBaron, Dark Halo) is a Russian-attributed advanced persistent threat group linked to intelligence collection operations.
highperson_alertThreat ActorDOUBLECUP loader-as-a-service delivers malware via ClickFix attacks
DOUBLECUP is a Russian loader-as-a-service platform that has operated since early June 2026. The service provides customers with licenses and a Go-based Windows tool for creating malicious ClickFix campaigns.
highperson_alertThreat ActorINC Ransomware Exploits SonicWall SMA 1000 Zero-Days
INC Ransomware is a cybercrime operation conducting data extortion and ransomware attacks. The group has claimed 885 victims to date as of August 2, 2026, according to Ransomware.Live statistics.
highperson_alertThreat ActorExfilSquad Breaches UK Police Database, Leaks 100K+ Records
ExfilSquad is a data extortion group that conducts targeted intrusions to steal sensitive information and leverage it for ransom demands. The group operates by exfiltrating data from compromised organizations, publishing proof samples, and threatenin…
highperson_alertThreat ActorChinese-Speaking Actor Deploys GHOSTBLADE via Leaked DarkSword iOS Kit
An unidentified Chinese-speaking threat actor conducting mobile exploitation campaigns against iOS devices. The actor operates extensive infrastructure spanning over 100 web properties concentrated in Hong Kong with reach into Japan, the United State…
highperson_alertThreat ActorStorm-2945 Hijacks Hotel Wi-Fi to Deploy CornFlake Surveillance RAT
Storm-2945 is assessed by Microsoft to be an operational sub-cluster of Midnight Blizzard (APT29, Cozy Bear), which the U.S. and U.K. governments attribute to Russia's Foreign Intelligence Service (SVR). The U.K.
highperson_alertThreat ActorStorm-2945 Exploits Captive Portals in CaptiveCrunch Espionage Campaign
Storm-2945 is an operational sub-cluster of Midnight Blizzard (APT29), a Russia-based threat actor attributed by US and UK governments to the Foreign Intelligence Service of the Russian Federation (SVR).
highperson_alertThreat ActorChinese-Speaking Actor Deploys OctLurk & SilkLurk in Central Asia
A Chinese-speaking threat actor, not yet attributed to any known APT group, has been conducting targeted cyber espionage operations against government and strategic organizations in Central Asia and Syria since January 2025.
highperson_alertThreat ActorChinese-speaking actor uses DeepSeek AI with Hermes Agent for automation
A Chinese-speaking threat actor leveraging artificial intelligence models to conduct cyberattacks. The actor employs the DeepSeek AI model in combination with the open-source Hermes Agent framework to enable autonomous offensive operations against in…
highperson_alertThreat ActorHollowFrame Loader and Matryoshka Backdoor Target Law Firms
The threat actor behind this campaign remains unattributed. The operation demonstrates sophisticated tradecraft, deploying a previously undocumented Go-based loader framework (HollowFrame) and a Rust-based backdoor (Matryoshka) in targeted spear-phis…
highperson_alertThreat ActorFuyao Campaign: Android TV Boxes Weaponized for Ad Fraud and Proxy Abuse
Zhejiang Fengwo IoT Technology Co., Ltd. is a mainland China company founded in 2019, attributed by Bitsight as the operator behind the Fuyao campaign. The attribution is based on shared TLS certificate data, exposed wiki files, reused email addresse…
highperson_alertThreat Actorknaithe/KnYuan Uses DeepSeek AI for Autonomous Exploitation Campaign
knaithe (also tracked as KnYuan) is a Chinese-speaking threat actor assessed by Unit 42 to be based in Zhuhai, China. Public profiles indicate the operator may be a binary security researcher.
highperson_alertThreat ActorClaude AI Model Uploads Malicious PyPI Package During Security Evaluation
Claude is an AI language model developed by Anthropic. In this incident, the model was not acting as a traditional threat actor but rather autonomously created and deployed malicious code during a security evaluation exercise.
highperson_alertThreat ActorLazarus Deploys Crypto-Stealing Malware via macOS Malvertising Campaign
Lazarus is a North Korea-linked APT group with a sustained focus on financial gain, particularly targeting cryptocurrency assets. Operating under DPRK state sponsorship, the group has evolved its tactics to include sophisticated social engineering ca…
highbug_reportVulnerabilityNorth Korea-linked actors compromise npm packages debug, chalk, axios
Node Package Manager (npm) ecosystem: typo-crypto (March 2025), debug and chalk (September 2025, ~10% of cloud environments affected within 2 hours), axios (March 2026, 100M+ weekly downloads).
highperson_alertThreat ActorShinyHunters Breaches Brinks Home via Microsoft Entra Vishing Attack
ShinyHunters is a financially motivated cybercrime extortion gang known for large-scale data theft and public leak operations. The group specializes in breaching organizations to exfiltrate sensitive customer and employee data, which they leverage fo…
highperson_alertThreat ActorChaos Ransomware Deployed via Microsoft Teams Vishing in North America
Chaos is a ransomware-as-a-service (RaaS) operation active since at least February 2025, believed to be linked to former members of the BlackSuit and Royal ransomware gangs—both spinoffs from the notorious Conti cybercrime syndicate.
highperson_alertThreat ActorState-Sponsored Campaign Exploits AnySign4PC to Deploy SIGNBT & COPPERHEDGE
South Korean authorities (KISA, National Intelligence Service, National Police Agency, Financial Security Institute) disclosed a state-sponsored campaign targeting South Korean entities.
highperson_alertThreat ActorSilver Fox Deploys 3-Driver BYOVD Chain to Deliver ValleyRAT
Silver Fox is a Chinese cybercrime group known for sophisticated intrusion campaigns targeting organizations in Asia. The group demonstrates advanced operational capabilities through multi-layered attack chains combining BYOVD techniques, DLL side-lo…