Threat Intelligence Center

Conventional wisdom suggests that military ceasefires reduce overall conflict activity. Cyberattacks, however, follow different patterns. Analysis of threat actor behavior from 313 Team, Conquerors Electronic Army, Cyber Toufan, and Handala reveals that ceasefires have minimal impact on offensive cyber operations.

Security researchers have identified the ClickFix campaign, a sophisticated social engineering attack targeting macOS users through counterfeit Apple support pages. The campaign delivers AMOS and Atomic Stealer malware, which can steal credentials and sensitive data from compromised systems. The attack leverages Script Editor and Terminal to execute malicious payloads after initial infection.

Project Glasswing represents a significant development for security leaders responsible for AI model governance and deployment. As Claude Mythos Preview gains adoption, understanding Glasswing's implications becomes essential for managing emerging risks in AI infrastructure.

Security researchers have uncovered Chaos malware being deployed against misconfigured cloud environments by the Silver Fox threat actor. The latest variant incorporates SOCKS proxy capabilities, enabling attackers to establish persistent backdoor access and move laterally through compromised infrastructure. This malware is part of a broader toolkit that includes AISURU, Kaiji, and ValleyRAT.

Researchers have identified a targeted attack campaign by Storm-2755 that poisons Office 365 search results to redirect employees to fraudulent payroll portals. The attack leverages Axios HTTP client 1.7.9 to intercept and manipulate search traffic, enabling credential theft and direct paycheck interception.

ClickFix is a malware campaign that exploits user trust by disguising malicious prompts as legitimate system messages or helpful notifications. Once executed, ClickFix deploys the LummaC2 infostealer, a credential-stealing tool designed to harvest sensitive data from infected systems.