Threat Research

RSS

Threat Research

STAC6405

infostealer

RMM

Phishing

Incident responders, s'il vous plait: Invites lead to odd malware events

A phishing campaign targeting multiple organizations led to RMM installations – but not much else (yet). A threat actor experimenting, or an access-as-a-service attack underway?

Threat Research

Iran

initial access

Initial access techniques used by Iran-based threat actors

Analysis of attacks originating from Iran-linked threat groups reveals a preference for certain techniques

Sophos Counter Threat Unit Research Team

Threat Research

MacOS

infostealer

clickfix

MacSync

Social engineering

Evil evolution: ClickFix and macOS infostealers

Across three recent campaigns, Sophos X-Ops notes shifts in both lures and malware capabilities, as threat actors leveraging ClickFix techniques increasingly target macOS users with infostealers

Threat Research

hacktivism

Iran

israel

Operation Epic Fury

Hacktivist campaigns increase as United States, Iran, and Israel conflict intensifies

Rising tensions have sparked an increase in regional hacktivist activity, but impact has been minimal

Threat Research

advisory

NPM

Axios

Axios npm package compromised to deploy malware

Threat Research

NICKEL ALLEY

Contagious Interview

North Korea

clickfix

NICKEL ALLEY strategy: Fake it 'til you make it

Threat Research

advisory

vulnerability

Oracle

Oracle vulnerability (CVE-2026-21992) impacts core products

Threat Research

Android

Keenadu

Android devices ship with firmware-level malware

Threat Research

Patch Tuesday

x-ops

Microsoft

Windows

detection

March Patch Tuesday visits 15 product families

Threat Research

advisory

vulnerability

SD-WAN

Cisco SD-WAN vulnerabilities (CVE-2026-20127, CVE-2022-20775) in active exploitation

Threat Research

X-ops

Patch Tuesday

Microsoft

Windows

February’s Patch Tuesday assumes battle stations

A silver-white robot hand holding a silver tray on its fingertips, against a blurred background of a large room

Threat Research

LLM

OpenClaw

CISO

risk

Sophos X-Ops

The OpenClaw experiment is a warning shot for enterprise AI security

Threat Intelligence Executive Report – Volume 2025, Number 6

Threat Research

EDR killer

infostealer

Ransomware

Threat Intelligence Executive Report – Volume 2025, Number 6

…