Threat Intelligence Center

Security researchers have documented a large-scale scareware campaign leveraging the CypherLoc malware family to target millions of users across multiple regions. CypherLoc employs deceptive tactics to convince users their systems are compromised, typically through fake security warnings and fraudulent system scan alerts.

Threat actor Storm-2949 has been observed exploiting Microsoft Self-Service Password Reset (SSPR) functionality to gain unauthorized access to Azure environments and steal sensitive data. The attack leverages the Kudu console, Microsoft Graph API, and legitimate remote access tools including ScreenConnect and VMAccess to establish persistence and move laterally within compromised tenants.

Security researchers have identified a supply chain attack in which Mini Shai-Hulud threat actors, operating under the TeamPCP umbrella, compromised a legitimate npm package maintainer account to distribute malicious versions of AntV, a widely-used data visualization framework. The attack leverages the Shai-Hulud Framework to deliver payloads to developers and cloud service environments.

Fortinet researchers have uncovered PureLogs, an infostealer malware stealing credentials from organizations across multiple industries and geographies. Associated with the PawsRunner framework, this threat specifically targets professional service firms including medical practices, law offices, and accounting firms.

Security researchers have identified a coordinated macOS infostealer campaign leveraging Atomic macOS Stealer, ClickFix, Filegrabber, and Reaper malware to target Mac users through credential harvesting. The attack chain impersonates legitimate vendors—Apple, Microsoft, and Google—to deceive users into surrendering authentication credentials and sensitive files.

Artificial intelligence is fundamentally changing how attackers operate. Growing businesses—those with expanding IT infrastructure but limited security teams—face a critical gap: attackers now use AI to identify and exploit vulnerabilities faster than traditional security tools can detect them.