Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
13 / 13 results
highperson_alertThreat ActorChinese Hacker Targets South Korean Banks with AI-Powered Tools
The threat actor is identified as a Chinese hacker who conducted targeted cyberattacks against South Korean financial institutions. Motivation appears to be focused on the financial services sector, potentially for financial gain, espionage, or disru…
highbug_reportVulnerabilityWazza phishing kit uses multi-stage routing to evade detection
Banking, government, and manufacturing organizations in the US, EU, and Australia. The kit uses wildcard domains (e.g., boegl-krysl[.]eu) and Cloudflare Workers infrastructure (beacon-surge-sync[...]workers[.]dev) to deliver Adobe-themed Device Code…
highpublicGeopoliticalSouth Korea investigates AI-assisted breaches at major banks
The coordinated cyberattacks against South Korea's financial sector—affecting Shinhan Bank, KB Kookmin Bank, and Hana Bank—represent a significant escalation in targeting critical financial infrastructure in Northeast Asia.
highperson_alertThreat ActorRatHat MaaS Operators Deploy AI-Powered Android Banking Trojan
RatHat operators are cybercriminals running a malware-as-a-service (MaaS) platform focused on Android banking fraud. The operators build and distribute the RatHat Android banking trojan, providing customers with web-based consoles to control infected…
highbug_reportVulnerabilityKREMLIN malware force-installs malicious Chrome/Edge extensions via bypass
Google Chrome and Microsoft Edge browsers on Windows systems. Active campaign since May 2025 with 1,515+ confirmed infections, primarily in Brazil. Affects users who execute malicious JavaScript files disguised as business documents.
highperson_alertThreat ActorREF9334 Deploys KREMLIN Malware Targeting Brazilian Financial Sector
REF9334 is a Brazilian threat actor tracked by Elastic Security Labs, active since at least May 2025. The actor specializes in banking fraud operations targeting Brazilian financial institutions through sophisticated malware delivery campaigns.
highperson_alertThreat Actor€30M Bank Fraud via Service Provider Exploit Targets Commerzbank
An unknown cybercriminal group, financially motivated, conducted a coordinated bank fraud operation targeting Commerzbank customers. The group operated across multiple jurisdictions, with four members arrested in Brazil and three charged in Europe.
highbug_reportVulnerabilityTwo H1 2026 campaigns use compromised email and clipboard hijacking
Campaign 1: Users in Czechia, Slovakia, Poland, and Lithuania targeted by GepyS banking malware via compromised corporate email accounts. Campaign 2: Cryptocurrency users globally affected by Rust-based clipboard hijacker monitoring 21 blockchain typ…
highperson_alertThreat ActorREF6045 targets Mexican banking sector with SCMBANKER via ClickFix lures
REF6045 is a financially motivated threat actor conducting banking fraud operations against Mexican financial institutions and their customers. The actor targets banking, fintech, and cryptocurrency exchange users in Mexico, leveraging social enginee…
highbug_reportVulnerabilityRedWing Android MaaS enables bank fraud via credential theft
Android devices targeted by RedWing malware, distributed as Malware-as-a-Service on Telegram. Variant of Oblivion MaaS. Primarily affects banking applications and users with compromised devices.
highbug_reportVulnerabilityOusaban banking trojan targets Spain and Portugal via phishing
Windows users in Spain and Portugal. Ousaban banking trojan campaign using fake PDF lures with geolocation filtering and steganography techniques. No specific product vulnerability; threat actor campaign identified by Fortinet FortiGuard Labs in May…
highbug_reportVulnerabilityMalicious NuGet package "Sicoob.Sdk" steals banking credentials
NuGet package "Sicoob.Sdk" versions 2.0.0 through 2.0.4. Targets developers integrating with Sicoob (Brazilian cooperative banking system). Affects .NET development environments where the malicious package was installed.
highbug_reportVulnerabilityBanking trojans Grandoreiro and BTMOB target LATAM and Europe
Windows and Android devices in Latin America (Brazil, Mexico) and Europe (Spain, Portugal). Grandoreiro targets Windows systems at companies; BTMOB RAT targets Android mobile users in Brazil.