Threats

Threats

Operation Bizarre Bazaar: First LLMjacking Marketplace Monetizes Stolen AI Infrastructure Access

Security researchers have documented the first fully attributed criminal operation dedicated to hijacking and reselling unauthorized access to AI infrastructure at scale. Dubbed Operation Bizarre Bazaar, the campaign represents a complete LLMjacking supply chain—from initial reconnaissance to commercial marketplace monetization—operated by a threat actor known as "Hecker&

Threats

North Korea's LABYRINTH CHOLLIMA Splinters into Three Specialized Cyber Units

CrowdStrike Intelligence has reclassified LABYRINTH CHOLLIMA, the North Korean threat group behind the 2017 WannaCry ransomware attack, into three distinct operational units with specialized missions, malware, and targeting patterns. The new attribution framework recognizes GOLDEN CHOLLIMA, PRESSURE CHOLLIMA, and a narrower core LABYRINTH CHOLLIMA group as separate adversaries that emerged

Threats

Google Disrupts IPIDEA, One of the World's Largest Residential Proxy Networks Used by 550+ Threat Groups

Google Threat Intelligence Group (GTIG) has led a coordinated disruption of IPIDEA, believed to be one of the largest residential proxy networks in the world. The operation reduced the network's available device pool by millions and exposed infrastructure leveraged by over 550 threat groups in a single week.

Threats

Fake ClawdBot VS Code Extension Deploys ScreenConnect RAT on Developer Machines

Security researchers at Aikido Security have discovered a malicious Visual Studio Code extension masquerading as "ClawdBot Agent," a fake version of the popular AI coding assistant. The extension functions as a fully working AI tool while silently deploying remote access malware to Windows machines. The real ClawdBot team

Threats

Initial Access Broker TA584 Deploys High-Speed Phishing Campaigns with ClickFix Social Engineering and New Tsundere Bot Backdoor

The financially motivated threat actor TA584 has significantly escalated its initial access operations, adopting a high-speed attack model built around short-lived campaigns, rapid infrastructure changes, and aggressive social engineering techniques, according to research published by Proofpoint. The evolution reflects a broader shift in modern cybercrime where speed and adaptability now

Threats

Threat Actors Exploit React2Shell Vulnerability to Deploy Cryptocurrency Miners and Botnets Worldwide

Threat actors are actively exploiting a critical remote code execution vulnerability in React Server Components to compromise systems across multiple industries worldwide, deploying cryptocurrency miners, botnets, and remote access tools, according to research from BI.ZONE Threat Detection and Response. The vulnerability, tracked as CVE-2025-55182 and commonly referred to as

Threats

Sicarii Ransomware Contains Fatal Coding Flaw That Makes Decryption Impossible Even After Payment

A critical coding error in the Sicarii ransomware, possibly introduced through over-reliance on AI-assisted development tools, renders decryption impossible for both victims and the ransomware operators themselves, according to researchers at Halcyon's Ransomware Research Center. The flaw means that paying the ransom will not result in data recovery.

Threats

Vietnamese Threat Actor Uses AI to Develop PureRAT Malware in Job-Themed Phishing Campaign

A Vietnamese cybercrime actor is using artificial intelligence to develop malware tools powering an ongoing phishing campaign that delivers PureRAT and other payloads through fake job opportunity lures, according to research published by Symantec. Multiple tools used by the attacker bear hallmarks of AI-assisted development, including detailed comments with numbered

Threats

Outlook Add-in Attack Enables Silent Email Exfiltration with Zero Forensic Traces

A newly disclosed attack technique allows threat actors to abuse Microsoft Outlook add-ins to silently exfiltrate sensitive email data from organizations without generating any audit logs or forensic traces, according to research published by Varonis Threat Labs. The attack method, dubbed Exfil Out&Look, exploits a visibility gap in

Threats

China-Aligned APT Groups Deploy PeckBirdy JScript Framework for Fileless Attacks on Government Targets

China-aligned advanced persistent threat groups have been using a previously undocumented JScript-based command-and-control framework called PeckBirdy to conduct fileless attacks against Asian government entities, educational institutions, and Chinese gambling operations since 2023, according to research published by Trend Micro. PeckBirdy is built entirely in JScript and leverages the Windows Script

Threats

Malicious npm Package "G_Wagon" Steals Browser Credentials and 100+ Cryptocurrency Wallets

A sophisticated malicious npm package disguised as a UI component library has been discovered deploying a multi-stage infostealer that targets browser credentials, over 100 cryptocurrency wallet extensions, cloud credentials, and messaging tokens, according to research published by Aikido Security. The package, named ansi-universal-ui, describes itself as "a lightweight, modular

Threats

Mustang Panda Upgrades CoolClient Backdoor with Clipboard Monitoring and Credential Theft Capabilities

The China-linked advanced persistent threat group HoneyMyte, also known as Mustang Panda or Bronze President, has significantly upgraded its CoolClient backdoor with new surveillance capabilities including clipboard monitoring, HTTP proxy credential sniffing, and browser credential theft, according to research published by Kaspersky. The group continues to actively target government entities