Don’t eat the ChocoPoCs! How vulnerability researchers were repeatedly targeted by trojanised exploits

This article details a campaign targeting vulnerability researchers with "ChocoPoC" malware embedded inside trojanised Python dependencies. Exploiting the pressure to quickly test new vulnerabilities,...

sekoia.com

Sold to the Highest Bidder: The Escalation of ADINT from Geolocation Tracking to Intrusion Vector

sekoia.com

Unveiling ErrTraffic: inside a growing ClickFix malware distribution framework

This report details the ErrTraffic threat and its associated ecosystem, highlighting three specific campaigns and their operators' arsenal.

blog.sekoia.io

APT28, an evolution of tradecraft

Context Sekoia’s Threat Detection & Research (TDR) team has been tracking APT28 for several years. The intrusion set, also known as Fancy Bear, Forest Blizzard, Sofacy, Pawn Storm or Sednit and public...

blog.sekoia.io

FSB’s matryoshka #1/3 - Gamaredon’s gifts that keeps unpacking - GammaPhish and GammaWorm

Part 1 of our FSB Matryoshka series. Discover the context behind Gamaredon's cyberespionage campaigns, introducing GammaPhish and GammaWorm operations.

blog.sekoia.io

New widespread EvilTokens kit: device code phishing as-a-service - Part 1

Uncover the new sophisticated EvilTokens device code phishing as-a-service, with AI-augmented features facilitating BEC fraud

blog.sekoia.io

Silver Fox: The Only Tax Audit Where the Fine Print Installs Malware

Track the 2025-2026 shift of China-based Silver Fox from financial crime to APT espionage. Discover how they exploit tax-themed phishing and RMM tools to target South Asian entities.

blog.sekoia.io

OysterLoader Unmasked: The Multi-Stage Evasion Loader

Unmasking OysterLoader's evasion: from API hammering to custom LZMA. Explore the 4-stage infection chain and its ties to Rhysida ransomware.

blog.sekoia.io

Meet IClickFix: a widespread WordPress-targeting framework using the ClickFix tactic

Uncover IClickFix: a malicious framework exploiting the ClickFix tactic in widespread malware campaigns to deliver NetSupport RAT.

blog.sekoia.io

Leveraging Landlock telemetry for Linux detection engineering

This blogpost explore how Landlock as an interesting security mechanism and a valuable source of telemetry for detection engineering.

blog.sekoia.io

Phishing Campaigns "I Paid Twice" Targeting Booking.com Hotels and Customers

Sekoia.io exposes a Booking.com phishing campaign targeting hotels and customers using ClickFix and PureRAT malware.

blog.sekoia.io

TransparentTribe targets Indian military organisations with DeskRAT

TransparentTribe targets Indian military entities using DeskRAT, a Golang-based remote access Trojan. Learn how this new campaign works.

blog.sekoia.io

APT28 Operation Phantom Net Voxel

APT28 Operation Phantom Net Voxel: weaponized Office lures, COM-hijack DLL, PNG stego to Covenant Grunt via Koofr, BeardShell on icedrive.

blog.sekoia.io

Predators for Hire: A Global Overview of Commercial Surveillance Vendors

Explore the 2025 landscape of Adversary-in-the-Middle phishing threats with data, trends, and top detection insights.

blog.sekoia.io

Exploiting Vulnerabilities Using AI at Machine Speed, the Alarming Number of Unpatched Devices, and Anticipating How Adversaries Think

Sekoia.io on collaborating with Europol, dynamic behavior modelling for Gen AI threats, and pooling CTI from various sources

technadu.com

ViciousTrap - Infiltrate, Control, Lure: Turning edge devices into honeypots en masse.

Discover ViciousTrap, a newly identified threat who turning edge devices into honeypots en masse targeting

blog.sekoia.io

Interlock ransomware evolving under the radar

ClickFix ransomware attack uses deceptive prompts and PowerShell loaders to deploy threats like Interlock under the radar.

blog.sekoia.io

From Contagious to ClickFake Interview: Lazarus leveraging the ClickFix tactic

Discover how Lazarus leverages fake job sites in the ClickFake Interview campaign targeting crypto firms using the ClickFix tactic.

blog.sekoia.io

ClearFake’s New Widespread Variant: Increased Web3 Exploitation for Malware Delivery

ClearFake spreads malware via compromised websites, using fake CAPTCHAs, JavaScript injections, and drive-by downloads.

blog.sekoia.io

PolarEdge: Unveiling an uncovered ORB network

Discover PolarEdge, a newly identified botnet targeting edge devices via CVE-2023-20118, using a stealthy TLS backdoor.

blog.sekoia.io

Cyber threats impacting the financial sector in 2024 - focus on the main actors

Delve into Finance-related cyber threats in 2024. Our report highlights major actors and tactics impacting the financial sector.

blog.sekoia.io

RATatouille: Cooking Up Chaos in the I2P Kitchen

Discover the challenges of ClickFix12 and the newly identified I2PRAT. Uncover the advanced techniques employed by this multi-stage RAT.

blog.sekoia.io

Detection engineering at scale: one step closer (part two)

Discover the power of detection engineering and how it can help scale your cybersecurity projects efficiently.

blog.sekoia.io

Sr Technical Threat Researcher - Sekoia.io - CDI - Télétravail total

Sekoia.io recrute un(e) Sr Technical Threat Researcher !

welcometothejungle.com

Sr Technical Threat Researcher - Sekoia.io - CDI - Télétravail total

Sekoia.io recrute un(e) Sr Technical Threat Researcher !

welcometothejungle.com

Targeted supply chain attack against Chrome browser extensions

In this blog post, learn about the supply chain attack targeting Chrome browser extensions and the associated targeted phishing campaign.

blog.sekoia.io

Sneaky 2FA: exposing a new AiTM Phishing-as-a-Service

In this blog post, learn about Sneaky 2FA, a new Adversary-in-the-Middle (AiTM) phishing kit targeting Microsoft 365 accounts.

blog.sekoia.io