Security Risk Advisors

Trellix published research on September 17, 2026 detailing a SideCopy campaign that deploys a remote access trojan through a fileless, mshta.exe-driven execution chain. SideCopy has historically targeted Indian government entities and high-ranking personn

The FBI issued Public Service Announcement I-091726-PSA on September 17, 2026, reiterating its warning about ongoing fraud schemes in which scammers impersonate US and foreign law enforcement or government officials to extort money or personally identifia

According to researchers at Delphos and LastPass, a fake installer for LastPass Authenticator available on GitHub was discovered to be capable of installing a Windows kernel driver that disables antivirus and similar security software, followed by a passw

A joint advisory from Japanese, U.S., Australian, and German authorities details continued activity by the North Korean WaterPlum cyber actor group, commonly referred to as Contagious Interview, targeting software developers, web freelancers, and other IT

Kaspersky's Global Emergency Response Team investigated an April 2026 incident at a manufacturing organization in the Middle East where a threat actor used a compromised domain account to access the environment through FortiGate SSL VPN and ultimately obt

Securonix Threat Research identified TASK#STOMP, a script-driven Windows backdoor that uses VBScript, PowerShell, Task Scheduler, and the legitimate .NET compiler to establish persistent access while blending with normal Windows activity. The infection ch

Introduction Microsoft is retiring Microsoft-supported SMS and Voice authentication in Entra ID on February 1st, 2027. As of September 1st, 2026, passkeys have become the default authentication method, and once the retirement takes effect, organizations t

OpenSourceMalware published research on September 17, 2026 on WeaselBiscuit, a newly identified Node.js infostealer distributed through malicious npm packages, with packages first seen between September 12 and September 16, 2026. The name is researcher as

Air Security published research on September 17, 2026 describing Plugin4Shell, a high severity remote code execution vulnerability affecting the plugin systems of Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI. The vulnerability is a SHA pinnin

Huntress investigated two incidents involving Settra, a newer ransomware variant first observed in June 2026. The incidents occurred in July and September across consumer services and retail and manufacturing environments. Huntress could not confirm the i