threat-intel TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor Microsoft has disclosed a new ClickFix variant, TerminalFix, that uses fake Cloudflare CAPTCHAs to trick users into executing malicious PowerShell commands via Windows Terminal or PowerShell. The campaign employs a multi-stage attack leveraging DLL sideloading, reconnaissance, and a reverse-tunnel backdoor to gain pers… The Hacker News · 11h ago High clickfixdll sideloadingreverse tunnel
malware DOUBLECUP's PNG Payload, (Mon, Aug 24th) A new DOUBLECUP malware campaign utilizes a clever technique to bypass traditional steganography detection. The malware, delivered via PNG images, uses a simple PowerShell script appended to the file, easily extracted us… SANS Internet Storm Center · 6d ago Medium powershellsteganographywindows
vulnerability Multiples vulnérabilités dans les produits Microsoft (17 août 2026) Multiple vulnerabilities have been discovered in Microsoft products, allowing attackers to execute arbitrary code remotely and elevate privileges. These issues primarily affect PowerShell versions, requiring immediate pa… CERT-FR · Aug 17, 2026 High CVE-2026-50523CVE-2026-69414microsoftpowershellvulnerability
threat-intel Ukraine warns fake CAPTCHAs are being used to make you hack yourself Ukraine's CERT-UA has warned that Russian hackers, specifically a branch of the Sandworm group, are using fake CAPTCHA challenges to trick users into executing PowerShell commands on their own computers, installing recon… Graham Cluley · Jul 21, 2026 High RUclickfixpowershellcaptcha
threat-intel ClickFix's Mushrooming Ecosystem Demands New Defense Tactics ClickFix, initially a social engineering attack vector, has evolved into a sophisticated malware-as-a-service (MaaS) ecosystem, outpacing traditional security defenses. Attackers are now utilizing a range of malware, inc… Dark Reading · Jul 14, 2026 High social engineeringmalware-as-a-serviceyara
threat-intel Attacker Uses Suspected AI-Generated PowerShell Script to Map Active Directory A threat actor leveraged an AI-generated PowerShell script to aggressively map an Active Directory environment, culminating in data exfiltration and a detailed inventory report. The attack chain, utilizing tools like s5c… The Hacker News · Jul 13, 2026 High aipowershellactive directory
malware Researcher Analyzes 3,000 Live ClickFix Payloads, Exposing API-Driven Malware Delivery This report details a concerning trend in malware delivery – the evolution of ClickFix, a technique where users are tricked into running malicious code by hand. Researchers have uncovered a new API-driven approach to gen… The Hacker News · Jul 1, 2026 High RUIRNOmalwarepayloadapi
threat-intel Gamaredon Expands Ukraine Attacks with New Malware and Cloud Service Abuse The Gamaredon APT group continued its aggressive cyberattacks against Ukraine throughout 2025, utilizing a range of new malware and exploiting vulnerabilities to steal sensitive information. The group expanded its tactic… The Hacker News · Jun 29, 2026 High CVE-2025-8088RUUAspear-phishingpersistencecloud-services
threat-intel Russian APT 'Gamaredon' Upgrades Its Arsenal, Requiring New Defenses The Russian cyber espionage group Gamaredon (also known as Aqua Blizzard) has significantly upgraded its arsenal and tactics, becoming a more effective threat actor, particularly in support of the war in Ukraine. The gro… Dark Reading · Jun 25, 2026 High RUUKaptespionagec2
malware New OXLOADER Loader Uses Malicious Google Ads to Deliver CastleStealer A new malware loader, dubbed OXLOADER, is being used to distribute the CastleStealer information stealer through malicious Google Ads. The campaign, codenamed REF8372, leverages deceptive advertising and PowerShell execu… The Hacker News · Jun 22, 2026 Medium RUUAgoogle adsmalware loadercastlestealer
ransomware From a VHDX File to a Remcos RAT, (Tue, Jun 16th) A malicious ZIP archive, containing a VHDX file, was discovered utilizing a multi-stage attack chain to deploy the Remcos RAT. The initial delivery involves a JavaScript payload that leverages WMI and PowerShell to execu… SANS Internet Storm Center · Jun 16, 2026 High DEratpowershellwmi
malware The Evil MSI Background is Back!, (Fri, Jun 5th) This report details a recent cyberattack utilizing a classic MSI-branded JPEG payload, a technique previously documented by the SANS Internet Storm Center. The attack began with a phishing email containing a WeTransfer l… SANS Internet Storm Center · Jun 5, 2026 High USphishingmalwarepowershell
malware Argamal: Malware hidden in hentai games A new malware campaign, dubbed "Argamal," is targeting users of hentai games. The campaign involves injecting a malicious implant into legitimate game files, leveraging COM hijacking to establish persistence and achieve… Securelist · Jun 3, 2026 High UShentaicom hijackingpersistence
