New backdoors from Toy Ghouls
Introduction We continue tracking the activity of Toy Ghouls (also known as Bearlyfy, Laboo.boo, and Feral Wolf), a financially motivated group that has been targeting…
Category: securelist
ValleyRAT is spreading disguised as adware
Attackers typically try to pass off malware as legitimate applications or as potentially unwanted programs that users deliberately search for and download, such as cheats…
Industrial threat report for Q2 2026
All threats In Q2 2026, the percentage of ICS computers on which malicious objects were blocked continued to decrease, falling to 19.15%, its lowest level…
Q2 2026 Android threat landscape
IT threat evolution in Q2 2026. Mobile statisticsIT threat evolution in Q2 2026. Non-mobile statistics The mobile section of the quarterly cyberthreat report includes statistics on malware,…
Phishers are hijacking legitimate cloud infrastructure
Threat actors are increasingly exploiting legitimate cloud services to evade detection and streamline the deployment of their scam infrastructure. Cloud hosting services and decentralized networks…
When checking the URL isn’t enough: phishing via the Microsoft identity platform
One of the most common pieces of anti-phishing advice is to double-check the website’s domain name before providing your credentials. Typically, a fraudulent domain stands…
Security risks for OpenClaw users and how to mitigate them
OpenClaw, which was previously known as Clawdbot and Moltbot, is today one of the most successful and fast‑growing ecosystems for AI agents, recognized worldwide. The…
How a single image takes control of a Mac
Introduction ExifTool is a widely adopted utility for reading and writing metadata in image, PDF, audio, and video files. It is available both as a…
OceanLotus suspected of distributing ZiChatBot malware via wheel packages in PyPI
Introduction Through our daily threat hunting, we noticed that, beginning in July 2025, a series of malicious wheel packages were uploaded to PyPI (the Python…
Industrial threat report for Q4 2025
Statistics across all threats The percentage of ICS computers on which malicious objects were blocked has been decreasing since the beginning of 2024. In Q4…
ClipBanker Trojan masquerades as Proxifier software
At the start of the year, a certain Trojan caught our eye due to its incredibly long infection chain. In most cases, it kicks off…
An analysis of CrystalX commercial RAT with prankware features
Introduction In March 2026, we discovered an active campaign promoting previously unknown malware in private Telegram chats. The Trojan was offered as a MaaS (malware‑as‑a‑service) with…