Research Center

CISA¹ and international partners warned that China-linked threat actors are stealing sensitive data from organizations worldwide, including U.S. critical infrastructure. They combine automated scanning tools and large-scale botnets with hands-on exploitation. The advisory names China-based Integrity Technology Group as the company enabling them with tools and hosting infrastructure.

TrendAI Research¹ traced four years of spearphishing against Ukrainian government agencies, defense organizations, border guard units, and logistics operators. They attribute it to Earth Sirrush, a Russia-aligned intrusion set that overlaps with CERT-UA’s UAC-0099 designation. The lures impersonated police and tax authorities, delivering archives and HTA files that installed infostealers and remote access tools.

PHP2Shell is a pair of critical flaws in the PHP runtime that can permit unauthenticated remote code execution. Researchers have demonstrated working exploitation against tested deployments, including mod_php configurations with ASLR enabled.

Zscaler’s ThreatLabz team tracked¹ Operation RapidRust, a campaign run by the Pakistan-linked threat group APT36, also known as “Transparent Tribe.” The group registered lookalike domains impersonating Indian news outlets to stage malicious PowerShell. That PowerShell delivered four new tools that steal files, spread to USB drives, and take commands from private GitHub repositories.

Zimperium’s zLabs team¹ uncovered RatHat, an Android malware strain linked to threat actors that appear to be operating in China. It spreads through smishing and malvertising. Once installed, it abuses Accessibility permissions to gain shell-level access and steal banking credentials, PINs, and one-time passcodes.

CloudSEK’s threat research team uncovered¹ BigBear 2.0, an Evilginx2-based phishing-as-a-service platform aimed exclusively at Microsoft 365. Victims who click a phishing link land on a reverse proxy that passes their traffic to the real Microsoft sign-in page while quietly keeping the password and the session cookie issued after MFA. Replaying that cookie hands an attacker a logged-in account without needing a password or a second factor again. The researchers gained admin access to the panel, which held 5,137 credential records from 461 organizations across more than 40 countries and is leased by its operator to at least five affiliate crews.

Microsoft’s Security Research team investigated¹ a high-volume phishing campaign that borrowed a trick from AI prompt injection research. The attacker inserted invisible Unicode tag characters — a technique known as “ASCII smuggling” — inside financial lure words like “funding.” The words still read normally to recipients, but filters matching the literal keyword no longer saw them. The messages pushed business loan and line-of-credit offers from hundreds of disposable finance-themed sender domains.

Microsoft Defender Experts¹ is tracking an active campaign that uses counterfeit software download sites to impersonate trusted vendors. Users looking for popular programs download installer archives that deliver malware instead. The malware sets up persistence, weakens security protections, and calls back to attacker-controlled infrastructure. Microsoft says the activity resembles the reported Silver Fox campaign but has not attributed it to a nation-state actor.