News
UAT-10608: React2 Shell Next. js Credential Harvesting
23+ hour, 23+ min ago (400+ words) SOC Prime SOC Prime Bias: Critical UAT-10608 Exposed: Automated Credential Theft at Scale Against Web Applications Cisco Talos reports a large-scale operation abusing the React2 Shell weakness in Next. js apps to steal credentials in bulk. The attackers use a purpose-built…...
APT-Q-27 Targets Web3 Support with. PIF Malware Chain
23+ hour, 23+ min ago (220+ words) SOC Prime Bias: Critical Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected…...
Kimsuky LNK Campaign Drops Python Backdoor via Dropbox C2
23+ hour, 22+ min ago (120+ words) SOC Prime Bias: Critical The Kimsuky threat actor drops two malicious files to the victim host: The attacker invokes these scripts directly using the native Windows script hosts to stay "living'off'the'land: Both executions generate a Process Creation event with the…...
Casbaneiro Campaign Uses Whats App, Click Fix and Horbot
1+ day, 23+ hour ago (274+ words) SOC Prime SOC Prime Bias: High Unpacking Augmented Marauder's Multi-Pronged Casbaneiro Campaigns Researchers reconstructed the end-to-end chain from the initial attachment through execution of the final payload. They analyzed an HTA stage that triggers mshta. exe, followed by a two-step…...
5 Browser and AI Security Risks Keeping Cx Os Awake
2+ day, 23+ hour ago (220+ words) SOC Prime Bias: High The report references behaviors such as chunked payload delivery that is reassembled in memory, credential-stealing extensions, AI-assisted spear-phishing, and prompt-injection attempts aimed at agentic browsing workflows. It also cites data points indicating a meaningful share of…...
Lite LLM Supply Chain Attack: Py PI Versions 1. 82. 71. 82. 8
2+ day, 23+ hour ago (106+ words) SOC Prime Bias: Critical Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected…...
Ether RAT: Ethereum Smart-Contract C2 and CDN-Like Beacons
2+ day, 23+ hour ago (146+ words) SOC Prime Bias: Critical Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected…...
UAC-0255 Attack Detection: Threat Actors Impersonate CERT-UA to Infect Ukrainian Public and Private Sector Organizations With AGEWHEEZE RAT
1+ week, 1+ day ago (254+ words) Add to my AI research Exclusive to SOC Prime users Europol notes that phishing remains the main distribution vector for data-stealing malware, reflecting how email- and URL-driven social engineering remains central to malware delivery. The same pattern is visible across…...
Glass Worm Supply-Chain Malware and Chrome RAT Threat
1+ week, 6+ day ago (392+ words) SOC Prime SOC Prime Bias: Critical Glass Worm Hides a RAT Inside a Malicious Chrome Extension Glass Worm abuses compromised npm, Py PI, Git Hub, and Open VSX packages to distribute a multi-stage malware platform. Its first stage launches a…...
CVE-2026-3910: Chrome V8 Zero-Day Used for In-the-Wild Attacks
3+ week, 6+ day ago (591+ words) Add to my AI research Exclusive to SOC Prime users Chrome zero-days continue to pose a major risk for cyber defenders. Earlier this year, Google patched CVE-2026-2441, the first actively exploited Chrome zero-day of 2026. Now, another emergency update has been…...