https://www.threatintelreport.com/ Evidence-led cyber threat intelligence for defendersen https://www.threatintelreport.com/articles/openclaw-lures-fuel-clickfix-infostealer-infections-as-agentic-ai-ecosystems-become-a-new-credential-target/ https://www.threatintelreport.com/articles/openclaw-lures-fuel-clickfix-infostealer-infections-as-agentic-ai-ecosystems-become-a-new-credential-target/ Thu, 12 Mar 2026 18:19:26 +0000 Tactics & Techniques A rapid wave of lookalike sites, social ads and poisoned “skills” is exploiting OpenClaw’s popularity to push StealC v2, AMOS and other stealers through user-driven install flows.https://www.threatintelreport.com/articles/microsoft-incident-responders-publish-a-playbook-for-detecting-prompt-abuse-in-enterprise-ai-tools/ https://www.threatintelreport.com/articles/microsoft-incident-responders-publish-a-playbook-for-detecting-prompt-abuse-in-enterprise-ai-tools/ Thu, 12 Mar 2026 18:03:00 +0000 Industry News Indirect prompt injection via URL fragments can manipulate AI outputs while evading traditional server-side visibility.https://www.threatintelreport.com/articles/stryker-handala-incident-global-microsoft-environment-disruption-and-reported-remote-device-wipes/ https://www.threatintelreport.com/articles/stryker-handala-incident-global-microsoft-environment-disruption-and-reported-remote-device-wipes/ Thu, 12 Mar 2026 18:03:00 +0000 Incident Reports Disruptive Iran-nexus hacktivist operation claims large-scale data destruction as Stryker restores services and CISA investigates.https://www.threatintelreport.com/articles/hudson-rock-ties-polyfill-io-supply-chain-compromise-to-dprk-operator-via-lumma-stealer-telemetry/ https://www.threatintelreport.com/articles/hudson-rock-ties-polyfill-io-supply-chain-compromise-to-dprk-operator-via-lumma-stealer-telemetry/ Thu, 12 Mar 2026 18:03:00 +0000 Industry News Infostealer logs from 2024 allegedly expose Funnull backend access and a separate Gate.us compliance infiltration.https://www.threatintelreport.com/articles/storm-2561-pushes-fake-vpn-installers-via-seo-poisoning-to-steal-enterprise-credentials/ https://www.threatintelreport.com/articles/storm-2561-pushes-fake-vpn-installers-via-seo-poisoning-to-steal-enterprise-credentials/ Thu, 12 Mar 2026 18:03:00 +0000 Incident Reports A credential theft operation uses lookalike VPN download sites and GitHub-hosted ZIPs to drop signed malware that harvests VPN logins and configuration data.https://www.threatintelreport.com/articles/badpaw-and-meowmeow-steganographic-net-malware-hits-ukrainian-targets/ https://www.threatintelreport.com/articles/badpaw-and-meowmeow-steganographic-net-malware-hits-ukrainian-targets/ Thu, 12 Mar 2026 16:58:59 +0000 Incident Reports A ClearSky report details a new loader and backdoor pair, and Scythe shows how to operationalise it as continuous adversary emulation.https://www.threatintelreport.com/articles/uat-9244-hits-south-american-telcos-with-terndoor-peertime-and-bruteentry/ https://www.threatintelreport.com/articles/uat-9244-hits-south-american-telcos-with-terndoor-peertime-and-bruteentry/ Fri, 06 Mar 2026 08:54:01 +0000 Incident Reports Cisco Talos links the activity cluster to China-nexus tooling, including CrowDoor variants and ORB-style proxy infrastructurehttps://www.threatintelreport.com/articles/badaudio-and-apt24-good-enough-opsec-powering-a-multi-vector-espionage-chain/ https://www.threatintelreport.com/articles/badaudio-and-apt24-good-enough-opsec-powering-a-multi-vector-espionage-chain/ Mon, 02 Mar 2026 13:04:07 +0000 Incident Reports Reverse engineering shows pragmatic obfuscation, hardcoded crypto, and cloud-native infrastructure supporting scalable intrusion delivery.https://www.threatintelreport.com/articles/iran-crisis-cyber-risk-rises-as-defacements-and-disruptive-activity-reported/ https://www.threatintelreport.com/articles/iran-crisis-cyber-risk-rises-as-defacements-and-disruptive-activity-reported/ Mon, 02 Mar 2026 10:11:00 +0000 Trends & Analysis Iran • hacktivists • IRGC • MOIS • DDoS • wipers • ransomware • critical infrastructurehttps://www.threatintelreport.com/articles/openclaw-clawjacked-chain-malicious-websites-can-hijack-local-ai-agents-via-localhost-websockets/ https://www.threatintelreport.com/articles/openclaw-clawjacked-chain-malicious-websites-can-hijack-local-ai-agents-via-localhost-websockets/ Mon, 02 Mar 2026 09:41:16 +0000 Incident Reports Cross-origin browser-to-localhost access, missing loopback throttling, and implicit device trust combine into a silent takeover path from a single web visit.https://www.threatintelreport.com/articles/dprk-famous-chollima-opsec-failure-exposes-npm-publisher-ips-through-public-disposable-inboxes/ https://www.threatintelreport.com/articles/dprk-famous-chollima-opsec-failure-exposes-npm-publisher-ips-through-public-disposable-inboxes/ Sat, 28 Feb 2026 16:59:58 +0000 Threat Actors Affected ecosystem: npm registry and developer tooling supply chain Primary issue: OPSEC leakage from disposable email inbox exposure combined with npm publish notification metadata Exploitation…https://www.threatintelreport.com/articles/famous-chollima-dprk-employment-fraud-and-developer-lure-intrusion-set/ https://www.threatintelreport.com/articles/famous-chollima-dprk-employment-fraud-and-developer-lure-intrusion-set/ Sat, 28 Feb 2026 16:55:07 +0000 Threat Actors FAMOUS CHOLLIMA is a DPRK-aligned activity cluster that multiple vendors associate with job-themed social engineering, developer targeting, and monetisation that can include cryptocurrency theft…https://www.threatintelreport.com/articles/akamai-sirt-identifies-zerobot-botnet-exploiting-n8n-and-tenda-vulnerabilities/ https://www.threatintelreport.com/articles/akamai-sirt-identifies-zerobot-botnet-exploiting-n8n-and-tenda-vulnerabilities/ Sat, 28 Feb 2026 16:06:29 +0000 Vulnerabilities & Exploits Akamai SIRT identifies Mirai variant campaign actively targeting critical RCE flaws in automation platforms and routershttps://www.threatintelreport.com/articles/airsnitch-client-isolation-in-wi-fi-is-not-delivering-the-security-most-defenders-expect/ https://www.threatintelreport.com/articles/airsnitch-client-isolation-in-wi-fi-is-not-delivering-the-security-most-defenders-expect/ Fri, 27 Feb 2026 12:08:49 +0000 Trends & Analysis NDSS 2026 research shows practical injection and machine-in-the-middle paths across WPA2/WPA3, guest SSIDs, and enterprise multi-AP deploymentshttps://www.threatintelreport.com/articles/vshell-vshell-a-mandarin-language-c2-framework-surfacing-alongside-cobalt-strike-on-exposed-infrastructure/ https://www.threatintelreport.com/articles/vshell-vshell-a-mandarin-language-c2-framework-surfacing-alongside-cobalt-strike-on-exposed-infrastructure/ Fri, 27 Feb 2026 11:21:37 +0000 Incident Reports Censys has reported on Vshell (often stylised “VShell”) , a Go-based command-and-control (C2) platform used for post-compromise host management, pivoting, and proxying , and increasingly visible…https://www.threatintelreport.com/articles/preventing-the-access-that-powers-ransomware-lateral-movement-2026/ https://www.threatintelreport.com/articles/preventing-the-access-that-powers-ransomware-lateral-movement-2026/ Fri, 27 Feb 2026 06:45:00 +0000 Tactics & Techniques Designing upstream controls that cut off access brokers, endpoint breakout, and perimeter device exploitation before T1021 startshttps://www.threatintelreport.com/articles/ransomware-lateral-movement-in-2026-detection-opportunities-part-1-2/ https://www.threatintelreport.com/articles/ransomware-lateral-movement-in-2026-detection-opportunities-part-1-2/ Fri, 27 Feb 2026 06:15:00 +0000 Tactics & Techniques Ransomware lateral movement techniques in 2026 are increasingly identity-led, cloud-aware, and executed through legitimate admin channels, forcing defenders to prioritise high-fidelity telemetry,…https://www.threatintelreport.com/articles/security-debt-surges-as-legacy-vulnerabilities-accumulate/ https://www.threatintelreport.com/articles/security-debt-surges-as-legacy-vulnerabilities-accumulate/ Fri, 27 Feb 2026 03:02:00 +0000 Industry News Veracode’s 2026 State of Software Security finds remediation capacity falling behind development velocity, with third-party components driving the longest-lived high-risk exposure.https://www.threatintelreport.com/articles/scattered-lapsus-hunters-recruits-women-for-paid-helpdesk-vishing/ https://www.threatintelreport.com/articles/scattered-lapsus-hunters-recruits-women-for-paid-helpdesk-vishing/ Thu, 26 Feb 2026 20:50:00 +0000 Incident Reports Scattered Lapsus$ Hunters (SLH, also styled SLSH in some reporting) is advertising for female callers to conduct vishing against IT helpdesks, offering $500 to $1,000 per call and providing…https://www.threatintelreport.com/articles/scattered-spider-threat-actor-profile/ https://www.threatintelreport.com/articles/scattered-spider-threat-actor-profile/ Thu, 26 Feb 2026 20:45:00 +0000 Threat Actors Scattered Spider is a financially motivated eCrime collective best known for high-success social engineering against enterprise IT help desks, often enabling account takeover in SSO and hybrid…