ACR Stealer: Two observed intrusion chains amid increased threat activity
In this article From late April 2026 to mid-June 2026, Microsoft Defender Experts observed increased ACR Stealer activity across customer
malware
Russian cybercriminal used jailbroken Gemini CLI to rebuild botnet infrastructure in six minutes
A Russian-speaking threat actor known as “bandcampro” used a jailbroken Gemini CLI, Google’s open-source terminal-based AI agent, to deploy and
LabubaRAT malware infiltrates Windows systems while posing as NVIDIA software
LabubaRAT, a previously undocumented Rust-based remote access tool (RAT) masquerading as NVIDIA software that enables post-compromise operations on Windows systems,
OkoBot framework infection chain | Securelist
Introduction In January 2026, we identified multiple attacks involving unknown malware that captures the contents of cryptocurrency wallet windows. During
New macOS malware steals passwords by posing as Apple’s crash-reporting tool
Jamf Threat Labs has uncovered a new macOS infostealer named CrashStealer that disguises itself as Apple’s crash-reporting tool to steal
Threat landscape for SMBs in 2026: fake AI tools, phishing and more
Small and medium-sized businesses (SMBs) remain attractive targets for cybercriminals – in both mass cyberattacks and sophisticated campaigns targeting larger
The Gentlemen RaaS: rapid growth and a new ransomware variant
Introduction This year saw the emergence of The Gentlemen, a prominent example of a group operating under the ransomware-as-a-service (RaaS)
How the ToddyCat APT group gains access to Gmail accounts
Introduction We continue to share details on the malicious techniques and toolsets used by the ToddyCat APT group. In the
GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware
In this article In October 2025, Microsoft Threat Intelligence identified destructive wiping activity and uncovered a sophisticated Go programming language
Industrial threat report for Q1 2026
All threats The percentage of ICS computers on which malicious objects were blocked continued to decrease, reaching 19.6% in Q1