Threat Intelligence Center

Security researchers have identified YY Lai Yu, an operator of a Chinese-language Phishing-as-a-Service platform, actively targeting banking institutions, e-commerce platforms, financial services, gaming, payment processors, and transportation companies.

Law enforcement agencies have successfully disrupted the infrastructure behind GlassWorm, a malware operation targeting software developers through supply chain attack vectors. GlassWormRAT, the remote access trojan deployed in these campaigns, was designed to compromise developer tools and environments to gain persistent access to enterprise networks.

Security researchers have identified a PureLogs malware variant that exploits purchase order workflows to infiltrate finance departments at professional service firms. The attack uses convincing vendor communication templates to deliver malicious payloads, establishing data exfiltration channels that remain undetected for extended periods.

Threat intelligence analysts have identified GTG-1002 conducting coordinated campaigns against critical infrastructure using Claude Code and the Claude Mythos Preview framework. The group exploits CVE-2026-4747 to establish persistent access within chemical manufacturing facilities, electrical grid operators, and financial institutions.

Cybercriminals are exploiting Formula 1 fan communities through coordinated fraud campaigns that combine fake livestreams, counterfeit merchandise, and infostealer malware deployment. These attacks capture login credentials, payment information, and personal data from victims seeking to watch races or purchase official gear.

MuddyWater, a state-sponsored threat actor tracked under multiple aliases including Cotton Sandstorm, Seedworm, and UNC5866, is conducting a coordinated espionage campaign leveraging DLL side-loading attacks across at least 9 countries. The operation targets critical sectors including financial services, energy, professional services, higher education, and telecommunications.