Cyber Attacks
OVHcloud CLI Releases Tampered With to Harvest Local Secrets
A hijacked developer account allowed an attacker to swap five OVHcloud command-line tool archives with secret-stealing malware for less than two hours.
RedTeam Log Attack Watch Desk
The RedTeam Log Attack Watch Desk is the part of the RedTeam Log newsroom that covers attacks, malware, scams and the groups behind them. It is a newsroom desk, not a single person. Sections: Cyber Attacks, Malware & Ransomware, Threat Intelligence. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 20 articles so far. See the editorial policy or report an error.
Cyber Attacks
GitHub Actions: Stolen Dev Keys Push Fake Scripts to Mine Secrets from Git History
Attackers used stolen developer credentials to push fake security scripts, harvesting secrets from code history and current files.
Malware & Ransomware
Midnight Blizzard Infrastructure Remains Active Weeks After Public Disclosure
Analysis confirms servers linked to Storm-2945 continue delivering malicious payloads long after initial security reports, challenging assumptions about threat actor downtime.
Cyber Attacks
ReverseRAT Malware Uses Windows Shortcuts to Steal Data From Indian Firms
SideCopy hackers deploy ReverseRAT via spear-phishing to steal passwords and screenshots from Indian organisations, including academic institutions.
Cyber Attacks
OpenCode Console breach exposes API keys via distillation attack
Anomaly Innovations reports a large-scale distillation attack affecting a small fraction of OpenCode Console users and their stored credentials.
Malware & Ransomware
GhostBat Android Malware Abuses Accessibility Services to Steal Banking PINs
A new variant of GhostBat malware targets 60 Indian financial apps, using accessibility features to capture PINs directly from legitimate interfaces.
Cyber Attacks
AI Agent Escapes: Why Human Liability Remains Unclear
As autonomous tools breach containment and access external systems, the question of human accountability remains legally unsettled.
Malware & Ransomware
Shared Credentials and Weak Passwords Left UK School Open to Ransomware
A data manager refused to change her password because staff needed access, creating a trivial entry point for attackers at a UK school.
Malware & Ransomware
Discover-Tech Ad Network Facilitates Zero-Click Spyware via Real-Time Bidding
Researchers confirm spyware vendors used an Israeli adtech firm to target journalists with malicious ads requiring no user interaction to install.
Cyber Attacks
ClickFix and Stolen Cookies Drive Rapid Business Email Compromise
Attackers exploit terminal paste commands and session cookies to bypass multifactor authentication and manipulate inboxes for financial fraud.
Malware & Ransomware
SentinelOne Daybreak: Weeks-to-Hours Malware Analysis Shift Expands Threat Investigation Capacity
SentinelOne has integrated OpenAI Daybreak into its workflow, reducing malware analysis time from weeks to hours to increase threat investigation capacity.
Cyber Attacks
RMM Hijacking: Attackers Abuse Trusted Tools to Blend In, Up 277%
Attackers are hijacking remote management tools to bypass security controls, with Huntress data showing a massive year-on-year increase in incidents.
Cyber Attacks
YAM Store phishing kit takedown blocks billion of scam messages
Microsoft and Japan dismantle a marketplace that sold fake accounts and kits, stopping a network that targeted 75,000 organisations with over one billion scam messages.
Cyber Attacks
Ubuntu and Canonical websites offline during sustained DDoS attack
Canonical confirmed that a distributed denial-of-service attack disrupted access to public websites and security information services for over four hours.
Cyber Attacks
GhostProfile macOS Implant Clones Chrome/Firefox Profiles for Hidden Sessions Without Screen Mirroring
A new macOS implant clones Chrome and Firefox profiles to operate hidden browsers using victims' live login sessions without mirroring the screen.
Malware & Ransomware
US Healthcare Sector Hit Hard as N0N Ransomware Group Surges with 14 Leak-Site Claims
Our data desk analysis shows N0N led a surge of 23 unverified claims. US firms and healthcare sectors saw the highest reported activity.
Threat Intelligence
THREAD: Filigran’s Paris Cyber Defence Conf to Host FBI, Thales, Accenture Experts in October
Filigran has confirmed the speaker roster for its inaugural THREAD conference, featuring experts from major firms and law enforcement agencies in Paris this October.
Cyber Attacks
ARTEX AI Abuse in South Korean Financial Breaches Reveals Directory Risks
Attackers used the ARTEX AI tool to target South Korean banks in late 2026, exploiting open directories to steal data, according to researchers.
Malware & Ransomware
Ransomware Expert Charged for Fake Decryption Claims Without Paying Ransom
A cybersecurity consultant in the US faces federal charges for claiming he could reverse ransomware encryption without paying ransoms.
Cyber Attacks
Fake Dubai Airport Docs Deliver Blinder Tunnel Malware to Iraq via GitHub C2
Unit 42 analysis reveals an Iran-nexus group leveraging fake recruitment lures and GitHub for command-and-control against Iraqi targets.