Malware

Line-art illustration of a smartphone showing a Microsoft device login code being captured remotely, depicting the Tycoon2FA OAuth device-code variant.

Cyber Attacks

Tycoon2FA Came Back in Weeks. The OAuth Device-Code Variant Uses Microsoft's Own Login Page Against M365.

Tycoon2FA is back six weeks after the Microsoft/Europol takedown — now phishing OAuth device-code consents against M365 via a Trustifi-laundered relay.

An npm package with a hidden backdoor function siphoning secret keys out through a DNS channel.

Application Security

Three node-ipc Versions Hide a Stealer Backdoor — and the Attacker Took Over a Dead Maintainer's Domain to Publish Them

Three published versions of node-ipc — a package with 822,000 weekly downloads — hide an obfuscated stealer backdoor that exfiltrates 90 categories of developer and cloud secrets over DNS. The attacker hijacked a lapsed maintainer domain to publish them.

A backdoor code window with emoji-marked comments, three target pins on Brazil, Germany, South Korea.

Threat Intelligence

Kimsuky's PebbleDash Now Hits Defense Sectors in Three Countries — And Its New Backdoor Was Coded With AI

Kaspersky found something unusual in a North Korean backdoor: comments that look written by an LLM, not a human. Combined with Kimsuky's expansion into defense targets across three countries, it is documented evidence that state malware development is borrowing AI.

A laptop with a Signal message database file being siphoned out, a backdoor injected into a system process.

Threat Intelligence

Microsoft's Kazuar Analysis Shows Russia's Secret Blizzard Wants Your Signal Desktop Files

Microsoft's new Kazuar analysis names one capability that ties it to the other Russian Signal operation in the news: Kazuar steals Signal Desktop message files. Encryption protects the conversation in transit — not the database on a compromised laptop.

A PDF document splitting into two paths over a map of Ukraine — one benign, one malicious RAR archive.

Cyber Attacks

Ghostwriter Now Geofences Its Phishing Lures — Only Ukrainian IPs Get the Malware

Ghostwriter built operational security into its phishing lure. Send the campaign's malicious PDF to a Ukrainian IP and it triggers the attack chain. Send it anywhere else — including to the analysts investigating it — and they get a harmless document.

Oil derrick and pipeline overlaid on a map of the Caspian region, three intrusion-wave arrows.

Threat Intelligence

Salt Typhoon Just Pivoted to Azerbaijani Oil and Gas — Chinese APT Targeting Now Follows Energy Geopolitics

Salt Typhoon spent three months inside an Azerbaijani oil and gas company — a target type it normally ignores. Bitdefender's assessment of why is the part that matters: Chinese APT targeting now follows energy geopolitics in real time.

Masked operative removing a ransomware mask, Teams chat window, credentials text file.

Cyber Attacks

Iranian Spies Are Pretending to Be Ransomware Operators — Inside MuddyWater's Chaos False Flag

An Iranian state-sponsored APT spent early 2026 conducting espionage while wearing the Chaos ransomware brand as a costume. Rapid7 pulled back the curtain. The Microsoft Teams screen-sharing tradecraft is why IR triage needs updating.

A pharma vial with broken seal, three servers shutting down, a globe with disconnected nodes.

Critical Infrastructure

Ransomware Forces West Pharmaceutical to Take Global Systems Offline

West Pharmaceutical Services disclosed a disruptive ransomware attack via SEC Form 8-K on May 7, took global systems offline, and engaged Palo Alto Unit 42. The pharma-packaging CI adjacency just became a documented sector risk.

See all

Tycoon2FA Came Back in Weeks. The OAuth Device-Code Variant Uses Microsoft's Own Login Page Against M365.

Three node-ipc Versions Hide a Stealer Backdoor — and the Attacker Took Over a Dead Maintainer's Domain to Publish Them

Kimsuky's PebbleDash Now Hits Defense Sectors in Three Countries — And Its New Backdoor Was Coded With AI

Microsoft's Kazuar Analysis Shows Russia's Secret Blizzard Wants Your Signal Desktop Files

Ghostwriter Now Geofences Its Phishing Lures — Only Ukrainian IPs Get the Malware

Salt Typhoon Just Pivoted to Azerbaijani Oil and Gas — Chinese APT Targeting Now Follows Energy Geopolitics

Iranian Spies Are Pretending to Be Ransomware Operators — Inside MuddyWater's Chaos False Flag

Foxconn Hit by Nitrogen Ransomware — 11M Files Across Apple, NVIDIA, Google

Ransomware Forces West Pharmaceutical to Take Global Systems Offline

A Fake OpenAI Repository on Hugging Face Hit 244,000 Downloads. It Was Stealing Crypto Wallets and Browser Sessions.

A New Linux RAT Was Built to Steal npm and PyPI Tokens, and It's the Tool the Next LiteLLM Was Waiting For

RansomHouse Claims the Trellix Breach, and the Screenshots Show More Than Source Code