Blog

Executive Summary Cofense Intelligence is tracking email campaigns targeting the hospitality accommodation industry with fake guest complaints, negative reviews, and inquiry-related messages that deliver blockchain technology-abusing malware, via a report published 7 October 2026. The campaigns use links to archive files containing malicious LNK shortcut files masquerading as JPG images, which ultimately install either EtherRAT…

Executive Summary On 5 October 2026, CloudSEK identified a Russian-speaking The Gentlemen ransomware affiliate who used the Model Context Protocol (MCP) to execute malicious commands during live intrusions, turning an AI coding assistant’s tool interface into an operational command-and-control channel. The operator, designating himself Azazel, also operated LEAKNED, an independent leak site that allegedly diverted…

Executive Summary On 28 September 2026, Huntress researchers reported threat actors exploiting ChatGPT Custom GPTs as a delivery mechanism for ClickFix lures and DLL-sideloaded malware, including a Remote Access Trojan (RAT). This campaign represents a novel abuse of legitimate AI platforms to socially engineer victims and bypass traditional security controls. Key Takeaways Key points provided…

Somewhere in your organization this week, someone saved themselves a few hours by pasting company data into an AI tool nobody reviewed. They didn’t file a ticket, and they don’t think they did anything wrong.  It’s tempting to treat that as a policy violation. It’s more useful to treat it as information. Every unsanctioned AI…

Executive Summary A joint law enforcement advisory conducted by the National Police Agency of Japan (NPA),  National Cybersecurity Office of Japan (NCO), US Federal Bureau of Investigation (FBI), US Department of Defense Cyber Crime Center (DC3), Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), Germany Federal Intelligence Service (BND), and Germany Federal Office for…