Lumma

Vidar V1.5 in Go: Same Family, New Language, Heavy Sandbox Checks

AI-Assisted Cyberespionage Campaign Targets Government Systems

REVSTEALER ramps up: analysis of up-and-coming infostealer

Midnight Mimosa Malware Campaign Exploits Android Firmware Supply Chain

Chinese State-Linked Hackers Target US Critical Infrastructure with Automated Scanning and Cyber Espionage Tools

ClingSTUN Turns Vulnerable Edge Devices Into Attacker Infrastructure

ORKL Report

China Linked Warlock Ransomware Campaign Targets Critical Infrastructure

Microsoft’s MSHTA Legacy Tool Still Powers Malware Campaigns on Windows

MetaStealer Part 2, Google Cookie Refresher Madness and Stealer Drama

The Abuse of ITarian RMM by Dolphin Loader

2025 In Review

Host long and prosper🖖

Mapping Remus Infostealer

C2 in the Ether

Mapping latest Lumma infrastructure

Bulletproof Hosting Hunt

Prospering Lumma

Keeping up with the Infostealers

Gray Rabbits and the Tale of a One-Click Backdoor

Warden Stealer: The Rapid Rise of an Infostealer with an Appetite for AI Agent Data

Download Meccha Chameleon Cheats, Get Malware

GreyNoise Labs Weekly OAST (Well-known Out-of-band Interaction Domains) Report • Week Ending 2026-02-20

Anatomy of a Lumma Stealer Attack via Fake CAPTCHA Pages - Part 1

Dissecting Lumma Malware: Analyzing the Fake CAPTCHA and Obfuscation Techniques - Part 2

China and the Cyber Arms Race for AI Supremacy

Targeting the Systems Behind the Mission: OT Threats to US Critical Infrastructure and Military Operations

Lunex Uses BYOVD to Disable Security Monitoring and Deploy Persistent Stealer

CLOSEDQUORUM: Malware Puts AI in the C2 Loop

FamousSparrow Takes Flight with New SparroWocky Backdoor