Fake GTA6 downloads bundle remote access, theft, and destructive malware
A fake GTA6 leak is reported to deliver remote-access, information-stealing, and destructive malware through supposedly early game downloads.
3 min readOpen brief →
Malware is most useful to defenders when connected to behavior, access and impact. Track verified campaigns, delivery methods and post-compromise activity with practical context for detection and response.
TOPIC NAVIGATIONBrowse all topics →
Counterfeit installers to system compromise: Tracking a deceptive software download campaign
The download page may be the first security control to fail. This brief shows how software provenance, endpoint policy, and user behavior fit together in stopping counterfeit installers.
3 min readOpen brief →
Five plead guilty in Kansas ATM jackpotting case
Federal guilty pleas show how ATM malware can turn a familiar cash machine into a physically accessed fraud endpoint.
3 min readOpen brief →
Fake CAPTCHA campaign turns pasted PowerShell into a network tunnel
A fake CAPTCHA can become a network foothold when it persuades someone to paste a command into PowerShell.
3 min readOpen brief →
Unit 42 examines AI-enabled malware from brand abuse to agentic execution
Verified research explores AI-enabled malware and argues that behavioral and endpoint defenses remain central to stopping AI-authored code.
3 min readOpen brief →
Fake crypto-conference lure targets cybersecurity researchers
A threat actor posing as a cryptocurrency-media representative targeted cybersecurity professionals with invitations and documents tied to a fake conference. The campaign used trusted collaboration tools such as…
3 min readOpen brief →
Fake AI-branded browser extension silently redirected users’ searches
Microsoft analyzed a Chromium browser extension using AI-related branding that altered search behavior and redirected users through unwanted services. Microsoft Security Blog published the underlying report or notice on 2026-06-29, placing the event within
3 min readOpen brief →
Global operation disrupted three malware networks used for fraud and ransomware
Europol and international partners announced coordinated action against SocGholish, Amadey and StealC infrastructure used to steal information and enable further cybercrime. Europol published the underlying report or notice on 2026-06-24, placing the event within
3 min readOpen brief →
WhatsApp file campaign installed remote-access software on Windows computers
Kaspersky documented a campaign distributing malicious script files through WhatsApp that installed legitimate remote-monitoring software for unauthorized access. Kaspersky Securelist published the underlying report or notice on 2026-06-22, placing the event within the month’s
3 min readOpen brief →
Investigation links residential proxy botnet to a publicly traded company
An investigation by KrebsOnSecurity linked the Popa residential-proxy botnet to infrastructure and business relationships involving a publicly traded Israeli company. KrebsOnSecurity published the underlying report or notice on 2026-06-18, placing the event within the
3 min readOpen brief →
Malicious Steam Workshop wallpapers put gaming accounts and computers at risk
Kaspersky found dozens of malicious wallpaper items distributed through Steam Workshop that could expose gamers to malware and account theft. Kaspersky Securelist published the underlying report or notice on 2026-06-16, placing the event within
3 min readOpen brief →
Kimwolf botnet administrator arrested after hijacking home devices
On May 21, 2026, KrebsOnSecurity reported that kimwolf botnet administrator arrested after hijacking home devices. The account describes a concrete security, privacy or fraud consequence rather than a…
3 min readOpen brief →
Phone Link malware steals one-time passcodes from Windows PCs
On May 5, 2026, CSO Online reported that phone link malware steals one-time passcodes from windows pcs. The account describes a concrete security, privacy or fraud consequence rather…
3 min readOpen brief →
Researchers find destructive Lotus Wiper campaign targeting Venezuela’s energy sector
A targeted wiper campaign against Venezuela’s energy sector highlights how cyber incidents can shift from access to irreversible destruction.
3 min readOpen brief →
JanaWare ransomware targets users in Turkey with localized campaign
JanaWare uses Turkish-language targeting, location checks and phishing delivery to focus ransomware activity on users and smaller businesses in Turkey.
3 min readOpen brief →
NoVoice malware reached 2.3 million Android downloads through Google Play
Malware hidden inside ordinary-looking Google Play apps turned old Android flaws into a large-scale device and messaging risk.
3 min readOpen brief →
Malicious Axios releases put developer systems and credentials at risk
Malicious Axios releases briefly exposed developer systems to credential theft, showing how a trusted dependency can spread risk through automated builds.
3 min readOpen brief →
Authorities disrupted botnets built from millions of connected devices
International authorities disrupted botnets built from millions of connected devices, but vulnerable routers and cameras can still be recruited again.
3 min readOpen brief →
Report: IcedID malware developer allegedly faked his own death to evade the FBI
Risky Business News reports that an IcedID malware developer allegedly faked his own death to evade the FBI, with few details supplied about the case.
3 min readOpen brief →
Phishing campaign reportedly uses old Office flaw to deliver fileless XWorm
A reported phishing chain combines a patched Office flaw, malicious Excel add-in, and fileless XWorm delivery to complicate detection.
3 min readOpen brief →
Kimwolf Botnet Reportedly Disrupts I2P Anonymity Network
Krebs on Security reports that the Kimwolf IoT botnet is disrupting I2P while allegedly using the network to evade takedown efforts.
3 min readOpen brief →
Weaponized Windows shortcuts reportedly deliver Global Group ransomware
Researchers report a Phorpiex-linked phishing campaign using malicious LNK files to deliver Global Group ransomware through local execution.
3 min readOpen brief →
Trojanized Notepad++ updates reportedly delivered malware to selected users
A reported Notepad++ supply-chain incident redirected selected updates to malicious servers, highlighting older update-verification weaknesses and lingering provider credentials.
3 min readOpen brief →
Kimwolf Operators May Have Exposed Who Runs Badbox 2.0
A reported screenshot may link Kimwolf’s operators to Badbox 2.0, an Android TV botnet under investigation by the FBI and Google.
3 min readOpen brief →