TL;DR: Two new AMOS (Atomic macOS Stealer) samples uploaded to MalwareBazaar reveal a significant evolution of the macOS stealer family. FGBOT fully decrypted the multi-layer encryption (SplitMix64 PRNG, triple S-box substitution, triplet encoding), live-downloaded and analyzed four second-stage pay
A 21-node Kubernetes cluster operated by French company Bucklog SARL (AS211590) is running a commercial Credential-Harvesting-as-a-Service operation across the 185.177.72.0/24 range. The cluster's custom monitoring panel tracks revenue in EUR, subscriber counts, and harvested credential metrics -- c
An evening hunt across MalwareBazaar fresh samples uncovered two active threat actor operations deploying QuasarRAT, DarkMe RAT, AgentTesla, and VenomRAT with live C2 infrastructure in Ukraine, Russia, and the United States. We fully decrypted five AES encryption key schemes from GitHub-staged paylo
TL;DR: A spearphishing campaign targeting Kuwait Air Force weapons procurement personnel delivers a multi-stage payload that exfiltrates desktop documents and Telegram Desktop session data to attacker-controlled MEGA cloud storage via rclone. There are no implants, no RATs, and no persistence -- jus
Hangzhou Meari Technology, the Chinese manufacturer behind the CloudEdge baby monitor and security camera platform (35 million registered users, 10+ white-label brands), operates four regional MQTT broker clusters that have never had their factory default credentials changed. We confirmed `admin:pub
An Iranian APT operator accidentally exposed their entire `/root` home directory via Python SimpleHTTPServer, revealing four custom C2 frameworks with full source code, six weaponized CVE exploits (including 2026-era zero-days), 785 GB of exfiltrated nation-state data from five sovereign targets, an
A cryptominer botnet operating since at least July 2023 uses unauthenticated Redis instances to inject persistent crontab entries that download and execute XMRig mining payloads from `b.clu-e.eu`. The operator has rotated payload infrastructure through five hosting providers across four countries ov
A Pay-Per-Install botnet operating since at least January 2026 has enrolled over 16,000 machines across 60+ countries using a trojanized copy of the legitimate BCUninstaller application. The operator uses a trivially predictable time-based Domain Generation Algorithm -- `floor(unixtimestamp / 500000