Leaked DarkSword Kit Deploys GHOSTBLADE Stealer on iOS Devices
August 4, 2026
Censys found a Chinese-speaking actor using the leaked DarkSword exploit kit to deploy the GHOSTBLADE info-stealer on iOS devices and
Endpoint Security
Leaked DarkSword Kit Deploys GHOSTBLADE Stealer on iOS Devices
Censys found a Chinese-speaking actor using the leaked DarkSword exploit kit to deploy the GHOSTBLADE info-stealer on iOS devices and steal credentials.
DOUBLECUP ClickFix Loader Hides Malware in Browser Cache Images
The DOUBLECUP Russian loader-as-a-service uses ClickFix prompts and PNG steganography in browser cache to deliver CountLoader and the DeviceManager RAT.
Fake Roblox Xeno Executor Installers Deliver Info-Stealer RAT
Bitdefender found fake Roblox Xeno Executor installers pushing a Java RAT that steals browser data, crypto wallets, game tokens, and payment data from players.
Coldcard Firmware Flaw Linked to $88.6M Bitcoin Sweep
A Coldcard firmware flaw that sent seed generation to a software PRNG is tied to an $88.6 million Bitcoin sweep across 4,585 drained wallet addresses.
N-able Warns Attackers Reached Managed Endpoints via N-central Flaw
N-able warns attackers exploited CVE-2026-18577 to take over N-central servers and reach managed endpoints, planting Cloudflare tunnels for persistent access.
DPRK macOS Malvertising Uses ClickFix to Steal Wallets and Cloud Keys
North Korea-linked actors use fake macOS update pages and ClickFix prompts to deploy malware that drains crypto wallets and steals SSH, AWS, and Azure keys.
AnySign4PC Zero-Day Watering Holes Hit 72 South Korean Organizations
A state-sponsored campaign used hacked South Korean websites to exploit an AnySign4PC zero-day and infect visitors with SIGNBT and COPPERHEDGE backdoors.
Silver Fox BYOVD Chain Deploys ValleyRAT at Japanese Manufacturer
Silver Fox used a new three-driver BYOVD attack chain and dual watchdog persistence to deliver ValleyRAT at a Japanese manufacturer through invoice lures.
Fengwo Group Ad-Fraud Uses TV Sticks That Spoof as Phones
Bitsight found generic TV streaming sticks spoofing as phones and clicking ads on AI-generated sites in a Fengwo Group ad-fraud network worth $50,000 a day.
Nimbus Manticore Deploys NightLedger Backdoor Across Three Regions
Iran-linked Nimbus Manticore deployed the new NightLedger backdoor and WebSocket tunnelers against targets in the Middle East, Africa, and South Asia.
DOUBLECUP ClickFix Loader Hides Malware in Browser Cache Images
August 4, 2026
The DOUBLECUP Russian loader-as-a-service uses ClickFix prompts and PNG steganography in browser cache to deliver CountLoader and the DeviceManager RAT.
Fake Roblox Xeno Executor Installers Deliver Info-Stealer RAT
August 4, 2026
Bitdefender found fake Roblox Xeno Executor installers pushing a Java RAT that steals browser data, crypto wallets, game tokens, and
Coldcard Firmware Flaw Linked to $88.6M Bitcoin Sweep
August 3, 2026
A Coldcard firmware flaw that sent seed generation to a software PRNG is tied to an $88.6 million Bitcoin sweep
N-able Warns Attackers Reached Managed Endpoints via N-central Flaw
August 3, 2026
N-able warns attackers exploited CVE-2026-18577 to take over N-central servers and reach managed endpoints, planting Cloudflare tunnels for persistent access.
DPRK macOS Malvertising Uses ClickFix to Steal Wallets and Cloud Keys
July 31, 2026
North Korea-linked actors use fake macOS update pages and ClickFix prompts to deploy malware that drains crypto wallets and steals
AnySign4PC Zero-Day Watering Holes Hit 72 South Korean Organizations
July 31, 2026
A state-sponsored campaign used hacked South Korean websites to exploit an AnySign4PC zero-day and infect visitors with SIGNBT and COPPERHEDGE
Silver Fox BYOVD Chain Deploys ValleyRAT at Japanese Manufacturer
July 31, 2026
Silver Fox used a new three-driver BYOVD attack chain and dual watchdog persistence to deliver ValleyRAT at a Japanese manufacturer
Fengwo Group Ad-Fraud Uses TV Sticks That Spoof as Phones
July 31, 2026
Bitsight found generic TV streaming sticks spoofing as phones and clicking ads on AI-generated sites in a Fengwo Group ad-fraud
Nimbus Manticore Deploys NightLedger Backdoor Across Three Regions
July 29, 2026
Iran-linked Nimbus Manticore deployed the new NightLedger backdoor and WebSocket tunnelers against targets in the Middle East, Africa, and South
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.