Ransomware threat actors tracked as Velvet Tempest are using the ClickFix technique and legitimate Windows utilities to deploy the DonutLoader malware and the CastleRAT backdoor.

IntroductionIn January 2026, Zscaler ThreatLabz observed activity by a suspected Iran-nexus threat actor targeting government officials in Iraq. ThreatLabz discovered previously undocumented malware ...

Transparent Tribe uses AI tools to mass-produce polyglot malware targeting India using Slack, Discord, and Google Sheets C2.

Threat actors are employing a new variation of the ClickFix social engineering technique called InstallFix to convince users ...

Windows 11 feeling bloated? Sophia Script lets you reshape the OS from the inside out. Here's how it works.

Microsoft reveals ClickFix campaign abusing Windows Terminal to deliver Lumma Stealer and steal browser credentials.

Signed malware backed by a stolen EV certificate deployed legitimate RMM tools to gain persistent access inside enterprise ...

Every now and then, most especially, a system administrator will need to restart a server or system. Usually, you can Remote Shut down or Restart Windows through the graphical user interface – ...

OpenAI has released its Codex desktop app for Windows, adding a native sandbox and PowerShell support, enabling developers to ...

OAuth redirection is being repurposed as a phishing delivery path. Trusted authentication flows are weaponized to move users ...