Huntress analyses DesckVB RAT, a malware family active since around Feb 2026 and spread through a malspam kit. The malspam kit personalises each page in real time, uses a Google-owned redirect domain, & ends with a 5-stage chain culminating in a reflective .NET RAT. www.huntress.com/blog/malspam...

Volexity analyses a VerdantBamboo intrusion where a compromised Egnyte Storage Sync appliance was used to run BRICKSTORM, proxy traffic, and access Microsoft 365 while blending in with legitimate network activity. www.volexity.com/blog/2026/06...

LevelBlue SpiderLabs analyses a ClickFix campaign that impersonates LinkedIn & Indeed to lure victims. The chain abuses the legacy Finger protocol, uses native Windows tools plus portable Python runtimes, & deploys fileless CastleLoader & a Python-based RAT. www.levelblue.com/blogs/spider...

Vincent Li at FortiGuard Labs analyses C0XMO, a new Gafgyt variant that spreads by exploiting CVE-2021-27137. A key change is the separation of lateral movement into a standalone Python script, helping the botnet target multiple architectures and device types. www.fortinet.com/blog/threat-...

Jose Martin at LevelBlue SpiderLabs details a Brazilian lure campaign. A fake NF-e invoice ZIP drops an installer that imitates Microsoft Defender DLP, then uses a stager DLL to fetch the Havoc demon shellcode at runtime. www.levelblue.com/blogs/spider...

G Data reports a growing number of Chrome extensions posing as productivity tools while stealing conversations from AI platforms. Extensions such as Urban VPN, Smart Sidebar and Chat AI target chats from services including ChatGPT, Claude and DeepSeek. blog.gdatasoftware.com/2026/06/3842...

Join Martin Chlumecký & Luis Corrons at #VB2026 in Seville to explore the Reservation Hijack attack chain, a multi-stage fraud workflow using stolen booking context and compromised access to target guests. Find out more about this talk 👉 www.virusbulletin.com/conference/v...

Aayush Tyagi at McAfee Labs uncovers Weedhack, a colossal Minecraft-focused malware-as-a-service campaign that gives threat actors remote access to victims’ screens, webcams, and file systems through a dashboard accessible with a Discord account. www.mcafee.com/blogs/other-...

Unit 42 analyses Operation FlutterBridge, a macOS malvertising campaign that seems to be the next stage of JSCoreRunner. The attackers now deliver adware with full backdoor capabilities through a payload dubbed FlutterShell. unit42.paloaltonetworks.com/flutterbridg...

Arctic Wolf Labs uncovers the Kali365 operator moving into new territory, with phishing infrastructure now mimicking Microsoft, AWS, Okta, Xerox DocuShare, and several Russian online services. arcticwolf.com/resources/bl...

Seqrite uncovers Operation XENOFISCAL, a spear-phishing campaign targeting Afghanistan’s Ministry of Finance, with TTPs that overlap with the Pakistan-linked SideCopy cluster. The attack uses a ZIP-delivered LNK and a structured chain that deploys persistent XenoRAT. www.seqrite.com/blog/operati...

Jonathan Peters at Nextron Systems analyses a sideloading infection chain attributed to Iran-nexus APT group Nimbus Manticore (UNC1549/Smoke Sandstorm), highlighting how the group changes implementation details while preserving a consistent core tradecraft. www.nextron-systems.com/2026/06/01/d...

BlueCyber analyses a January 2026 Mustang Panda PlugX sample delivered through a three-file set dropped by an MSI chain. The sample uses DLL sideloading, staged decryption, manual in-memory loading, and a final WinHTTP connection into the controller loop. bluecyber.hashnode.dev/mustang-pand...

Silent Push uncovers DriveSurge as the actor behind a surge in ClickFix & FakeUpdates driveby campaigns. It seems to operate as a specialized IAB, using a pay-per-install model & thousands of compromised websites to route victims into malware delivery chains. www.silentpush.com/blog/drivesu...

Seqrite APT Team uncovers Operation Dragon Weave, a spear-phishing campaign targeting officials and citizens in the Czech Republic and Taiwan. The attack begins with a ZIP attachment and uses two delivery paths that converge on the same payload execution chain. www.seqrite.com/blog/operati...

Sekoia TDR analyses Gamaredon as a long-running FSB-operated cyber espionage threat targeting Ukraine. The report reconstructs the infection chain, and shows how GammaPhish and GammaWorm support persistent, low-visibility intrusion. blog.sekoia.io/fsbs-matryos...

G Data uncovers a new Remcos RAT infection chain starting with a seemingly harmless batch file that executes encoded commands. The loader creates hidden directories, pulls additional tools & encrypted payloads, & shifts delivery towards an in-memory model. blog.gdatasoftware.com/2026/05/3842...

Krasimir Konov at GoDaddy Security analyses WordPress malware that hides encoded payload data inside Steam Community profile comments. The malware then decodes the hidden data and injects external JavaScript into compromised WordPress pages. www.godaddy.com/resources/ne...

Maor Gabay at LevelBlue SpiderLabs reports Sapphire Sleet targeting high-value macOS environments in venture capital, Web3, and cryptocurrency organizations. The campaign relies on fake Zoom SDK update lures and abuses trusted built-in macOS applications. www.levelblue.com/blogs/spider...

Microsoft Threat Intelligence details The Gentlemen ransomware encryptor, focusing on its execution flow, defence evasion, encryption design & lateral movement techniques. The Go-based threat pairs strong per-file encryption with aggressive self-propagation. www.microsoft.com/en-us/securi...

VB2026 is coming to Seville! Register your interest to hear first when registration opens, including early ticket offers, programme releases, venue information, and key conference updates. Sign up for VB2026 updates 👉 tinyurl.com/kammbcxr #VB2026 #VirusBulletin #vbconference

ENKI Whitehat analyses recent Kimsuky cases targeting South Korean military & corporate organizations. The campaign used tailored social engineering, including spoofed security software installation pages & a fake Webex meeting page, alongside a 3-stage HttpSpy chain. www.enki.co.kr/en/media-cen...

Harsh Gupta at K7 Labs uncovers a fake RVTools installer signed with a valid Sectigo certificate, allowing it to look trustworthy while deploying a modular Python RAT. labs.k7computing.com/index.php/rv...

JUMPSEC's Jack Lewis details a Remcos infection chain with previously undocumented loader behaviour. Notably, second-stage execution is bracketed between ipconfig /release and ipconfig /renew, creating a brief network blackout that can blind network-based monitoring. www.jumpsec.com/guides/black...

David Sardinha at Intrinsec reports on March 2026 malspam campaigns distributing a JavaScript backdoor. The activity targeted organizations across regions and sectors, and relied on bulletproof networks GHOSTYNETWORKS & OMEGATECH for both spam delivery & C2 hosting. www.intrinsec.com/pivoting-on-...

Xiaopeng Zhang at FortiGuard Labs uncovers a phishing campaign distributing a JavaScript-driven PureLogs variant. The infection chain moves from an obfuscated JavaScript to PowerShell, process hollowing, and a downloader module that deploys the stealer. www.fortinet.com/blog/threat-...

Cyble analyses OverlayPhantom, an Android banking trojan targeting 180+ apps in 10 countries, which poses as Google Play Services, gains control through Accessibility abuse, and enables credential theft via embedded HTML phishing pages & live screen streaming. cyble.com/blog/overlay...

Planning your trip to Seville for VB2026? We’ve put together a handy guide covering travel tips, local food recommendations and sightseeing ideas to help you make the most of your time in the city during the conference. Read the guide here 👉 tinyurl.com/4u68fmbu

Check Point researchers look into recent Nimbus Manticore (also tracked as UNC1549) activity. The threat actor has adopted several new techniques, including AppDomain (application domain) hijacking, AI-assisted malware development, and SEO poisoning. research.checkpoint.com/2026/fast-an...

Trend Micro's Kazuki Fujisawa looks into a recent update by Void Dokkaebi (aka Famous Chollima) to InvisibleFerret, shifting its delivery format from Python scripts to Cython-compiled binaries, distributing the malware as .pyd files on Windows & .so files on macOS. www.trendmicro.com/en_us/resear...

Palo Alto Networks looks into ROADtools, a publicly available toolkit used for offensive and defensive security purposes that attackers have integrated into cloud attacks. ROADtools operates through legitimate Microsoft APIs and can mimic typical traffic. unit42.paloaltonetworks.com/roadtools-cl...

Trend Micro researchers describe how a solo Russian-speaking threat actor ran a 5-year MAGA-themed Telegram channel and, starting Sept 2025, used AI to automate its content, credential theft, and a cryptocurrency fraud scheme targeting American audiences. www.trendmicro.com/en_us/resear...

EclecticIQ analysts identified an ongoing infostealer campaign targeting Gemini CLI & Claude Code users. Threat actors use SEO poisoning to surface fake domains above legitimate results, directing victims to attacker-controlled infrastructure. blog.eclecticiq.com/seo-poisonin...

Barracuda researcher Megharaj Balaraddi analyses CypherLoc, a browser-lock scareware designed to drive victims to fraudulent tech support calls. It evades scanners and sandboxes through encrypted, condition-based execution inside the browser. blog.barracuda.com/2026/05/20/t...

XLab researchers show how threat actors exploited CVE-2026-26980 to compromise Ghost CMS, causing numerous websites to become accomplices in ClickFix attacks. blog.xlab.qianxin.com/ghost-cms-pa...

Seqrite Labs has seen a targeted spear-phishing campaign targeting students and faculty members at Changzhou University (常州大学), leveraging a highly contextual lure. Operation Dragon Whistle is attributed to threat actor UNG0002 with medium-high confidence. www.seqrite.com/blog/operati...

Joe Security researchers examine a multi-stage phishing campaign targeting staff members of the PSCA & PPIC3 in Pakistan. The attacker's objective seems to be enrolling the compromised machine into a VS Code Remote Tunnels workflow controlled by the attacker. joesecurity.org/blog/8858614...

Zimperium identified an Android malware campaign conducting carrier billing fraud through premium SMS abuse across Malaysia, Thailand, Romania & Croatia. Almost 250 malicious applications selectively target users based on their mobile operator. zimperium.com/blog/premium...

Palo Alto Networks documents novel activity clusters that have significant overlap with TamperedChef (aka EvilAI). TamperedChef-style malware is trojanized productivity software, such as PDF editors or calendars, that delivers malicious payloads. unit42.paloaltonetworks.com/tracking-tam...

K7 researchers analyse fake Microsoft Teams distribution sites tricking users into downloading a trojanized installer packaged as a Zip archive, which leads to ValleyRAT via a malicious NSIS-based installer and DLL sideloading. labs.k7computing.com/index.php/fa...

SophosLabs analysts investigate WantToCry ransomware attacks that involved the threat actors abusing the Server Message Block (SMB) service for initial access before exfiltrating files to attacker-controlled infrastructure for remote encryption. www.sophos.com/en-us/blog/w...

Cisco Talos's Joey Chen uncovers a BadIIS variant that functions as commodity malware. The variant is likely sold or shared among multiple Chinese-speaking cybercrime groups that operate under a malware-as-a-service model for continuous monetization. blog.talosintelligence.com/from-pdb-str...

Trend Micro researchers describe how they mapped the full operation of SHADOW-WATER-063’s Banana RAT banking malware by analysing server-side artifacts & victim-side data. Banana RAT targets 16 Brazilian financial institutions & a Pix QR code interception subsystem www.trendmicro.com/en_us/resear...

ESET researchers describe new tools and techniques that the Webworm APT group recently added to its arsenal. Webworm is linked to other China-aligned APT groups such as SixLittleMonkeys and FishMonger. www.welivesecurity.com/en/eset-rese...

Robin Dost examines UAC-0184, a lesser-documented cluster targeting Ukraine with familiar tradecraft including Ukraine-themed lures, messenger-based social engineering, staged loaders, LOLBins, signed binaries, and archive delivery. blog.synapticsystems.de/uac-0184-fro...

Microsoft researchers report on Storm-2949: a methodical, multi-layered intrusion focused on exfiltrating as much sensitive data as possible from high-value assets. The attack spanned Microsoft 365, file-hosting services, and Azure-hosted production environments. www.microsoft.com/en-us/securi...

Securonix Threat Research analyses TAX#TRIDENT, a fake Indian tax campaign that uses 3 delivery paths to reach Windows endpoints. The same lure can lead to a ZIP-to-installer flow, a decoy-driven VBScript chain, or a PHP-looking endpoint that returns script content. www.securonix.com/blog/taxtrid...

Logpresso analyses four Kimsuky spear-phishing campaigns from the first half of 2026, targeting recruiters, cryptocurrency investors, developers, defence-sector officials, and graduate school education staff. logpresso.com/ko/blog/2026...

Winnie Lin and Yurren Wan at FortiGuard Labs uncover a phishing campaign that abuses environment variables to hide malicious commands and uses PawsRunner as a steganography loader to deploy the .NET infostealer PureLogs. www.fortinet.com/blog/threat-...

Unit 42 analyses new Gremlin stealer obfuscation tactics that hide payloads inside embedded resources. The variant examined also used a commercial packer. Gremlin targets browser data, session tokens, payment details, wallet data, & FTP / VPN credentials. unit42.paloaltonetworks.com/gremlin-stea...