Category: Threat Research

Socket’s Threat Research Team found that the cross-store browser extension “Twitch Enhanced Viewer | JeetBot” forwards users’ live Twitch OAuth session tokens to operator-controlled proxy infrastructure, exposing account-scoped credentials across Chrome and Firefox. Earlier versions even POSTed the token to a dedicated set-token endpoint, and the operator’s infrastructure is tied to the JeetBot commercial Twitch, Kick, and VK-Live bot service. #TwitchEnhancedViewer #JeetBot #ChromeWebStore #FirefoxAddons

Sysdig TRT observed a skilled threat actor exploit CVE-2026-39987 in marimo to move from an unauthenticated WebSocket terminal to SSH access on a bastion host in eight seconds, using hand-built Python tooling rather than LLM-generated scripts. The campaign involved AWS credential harvesting, Secrets Manager access, EC2 enumeration, and direct SSH pivoting, with infrastructure tied to Akamai Connected Cloud/Linode. #CVE-2026-39987 #marimo #AWSSecretsManager #Linode

Confiant reported that SourTrade used malvertisements to spread unfinished malware while impersonating TradingView, Solana, and Luno to target retail traders and crypto investors. The investigation uncovered extensive malicious infrastructure, including typosquatting domains, email-connected domains, and IP addresses linked to the campaign, with many already flagged as malicious. #SourTrade #Confiant #TradingView #Solana #Luno

Gen Threat Labs uncovered CVE-2026-51990 in Sogou Input Method, where a crafted sgbiz: link could chain multiple weaknesses into one-click remote code execution. UNC3569 exploited the flaw in the wild to deliver the GRAYRABBIT backdoor through a malicious page, and Tencent has since patched the issue. #SogouInputMethod #CVE-2026-51990 #UNC3569 #GRAYRABBIT #Tencent

Zscaler ThreatLabz identified SloppyRAT, a new malware family likely used in ransomware-related attacks and delivered through a multi-stage ClickFix infection chain. It combines anti-analysis features, EtherHiding-based C2 resolution, certificate pinning, and extensive remote command execution capabilities, while also showing signs of ongoing development and coding flaws. #SloppyRAT #ClickFix #CastleLoader #CastleRAT #EtherHiding

Researchers introduced a plain-English prompt-crafting method that hides a policy-violating payload inside an obfuscated prose wrapper, allowing quick LLM gatekeepers to miss it while a stronger target model can recover and act on the embedded request. In tests against gpt-4o-mini-2024-07-18, gpt-oss-safeguard:20b, claude-3-haiku-20240307, and llama-guard3, the crafted prompts bypassed gatekeepers in all trials, and gpt-5-thinking-high recovered and executed the payload in most target tests. #gpt-4o-mini-2024-07-18 #gpt-oss-safeguard:20b #claude-3-haiku-20240307 #llama-guard3 #gpt-5-thinking-high

Socket uncovered a cross-browser extension campaign using malicious Chrome and Firefox add-ons to steal authenticated Axiom Trade and Padre session data, wallet-related state, tokens, and cookies from cryptocurrency traders. The operation spans J7Tracker, VREO, Orbit Tracker, GhostApe, and GhostApe Color, with exfiltration sent to threat actor-controlled Vercel and other infrastructure. #J7Tracker #VREO #OrbitTracker #GhostApe #AxiomTrade #Padre #Vercel

Volexity uncovered spear-phishing campaigns by UTA0560 and JungleBamboo that abused a Chrome zero-day exploit chain to target NGOs and other victims through malicious links and patched-but-unreleased Chromium flaws. UTA0560 used the chain to deploy GRIMWEDGE, while JungleBamboo used it to install SUPERSTOMP and the LONGTALE Chrome extension for credential theft and surveillance. #UTA0560 #JungleBamboo #GRIMWEDGE #SUPERSTOMP #LONGTALE #CVE-2026-85046 #CVE-2026-85880 #CVE-2026-87491

Wazuh detects AWS access key compromise by correlating CloudTrail and GuardDuty telemetry across validation, enumeration, persistence, and exfiltration stages. The article explains how attackers abuse exposed AWS access keys and how Wazuh rules can reconstruct the compromise chain to raise a high-confidence alert. #Wazuh #CloudTrail #GuardDuty #AWSCompromisedKeyQuarantineV2…

Unit 42 uncovered CL-CRI-1171, a long-running pay-per-install campaign that used OfferLoader to distribute multiple payloads through YouTube gaming videos and SEO-poisoned download pages. The operation delivered Insomnia RAT, ARKTunnel, and Docro Hijacker while hiding behind rotational domains, trojanized installers, and gating checks that filtered out scanners and analysts. #OfferLoader #CL-CRI-1171 #InsomniaRAT…

Proofpoint reported that multiple espionage-oriented threat actors rapidly adopted the BlueMoon exploit kit, which chains Chrome V8 and Windows vulnerabilities to deliver different payloads and backdoors. The activity affected US NGOs, US aerospace and defense-related organizations, Vietnamese manufacturing, and targets in Singapore and Indonesia, with notable payloads including GemStone and ShadowPad….

NSA, CISA, and the FBI warn that China-based AI companies are running industrial-scale knowledge distillation campaigns to extract proprietary capabilities from U.S. frontier AI models, including Claude, GPT, Gemini, and Grok. The advisory names DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI as major actors and describes evasive access methods such…

MacSync Stealer is a macOS information-stealing MaaS operation that uses ClickFix lures, malvertising, and multi-stage native Mach-O loaders to evade Apple defenses. It exfiltrates credentials, Keychain data, cookies, SSH keys, and crypto wallets through HTTPS C2 infrastructure and cleans up traces with self-deleting temporary files. #MacSync #ClickFix #drivinguber.com #newsinweb.com #com.utils.Launcher

The article analyzes network IoCs linked to five notorious ransomware families—LockBit, Cl0p, Akira, Medusa, and Qilin—using WHOIS, DNS, and traffic data to uncover additional infrastructure and related artifacts. It highlights 84 network IoCs, thousands of connected domains and IPs, and several potentially compromised or malicious assets, including answersite[.]com and Medusa-related subdomains. #LockBit #Cl0p #Akira #Medusa #Qilin #answersitecom