explorer.exe

• Fast and Furious – Nimbus Manticore Operations During the Iranian Conflict

  Fast and Furious – Nimbus Manticore Operations During the Iranian Conflict Key Findings Introduction During the recent geopolitical tensions in the Middle East, we reported on multiple Iran-nexus threat actors advancing Iran’s strategic objectives through cyber operati

• Inside AD CS Escalation: Unpacking Advanced Misuse Techniques and Tools

  Inside AD CS Escalation: Unpacking Advanced Misuse Techniques and Tools Unit 42 analyzes AD CS exploitation through template misconfigurations and shadow credential misuse while offering behavioral detection for defenders. The post Inside AD CS Escalation: Unpacking Advanced Mis

• Suspected China-Nexus Hackers Use Fake Indian Tax Filing Utility to Deploy DcRAT

  Suspected China-Nexus Hackers Use Fake Indian Tax Filing Utility to Deploy DcRAT A suspected China-nexus threat activity cluster has been observed targeting Indian taxpayers, tax professionals, and corporate finance teams to deliver a remote access trojan designed to steal sensi

• ACR Stealer: Two observed intrusion chains amid increased threat activity

  ACR Stealer: Two observed intrusion chains amid increased threat activity From late April 2026 to mid-June 2026, Microsoft Defender Experts observed increased ACR Stealer activity across customer environments. These campaigns are successfully using ClickFix lures to steal browse

• Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access

  Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access Microsoft Threat Intelligence identified an active multi-stage intrusion campaign targeting hospitality organizations in Europe and Asia. The campaign uses photo-themed ZIP archives

• InstallFix and Claude Code: How Fake Install Pages Lead to Real Compromise

  InstallFix and Claude Code: How Fake Install Pages Lead to Real Compromise Targeting multiple industries worldwide, the InstallFix campaign uses fake Claude AI installer pages to trick users into running malware that collects system information, disables security features, achie

All reports →