Research & Insights

Security Intelligence

In-depth threat analysis, malware research, and cybersecurity intelligence from our expert team. Real investigations, real IOCs, real-world impact.

Latest Research

Dissecting a Weaponized Atera Installer: How a Fake Bank Statement Grants Full Remote Access

Malware Analysis

12 min read

Dissecting a Weaponized Atera Installer: How a Fake Bank Statement Grants Full Remote Access

A trojanized Atera RMM installer disguised as a bank eStatement PDF grants attackers persistent remote access — terminal, remote desktop, and arbitrary code execution — all through legitimately signed, commercially trusted infrastructure. Zero public detections at time of analysis.

RMM AbusePhishingLuna MothMalware Analysis

April 7, 2026Read Full Analysis

Supply Chain

How TeamPCP Poisoned Security Scanners to Backdoor LiteLLM

On March 24, 2026, threat actor TeamPCP published backdoored versions of the LiteLLM Python package (3.4M daily downloads) after compromising Trivy and Checkmarx security scanners to steal PyPI credentials from CI/CD pipelines.

Supply Chain AttackPythonPyPI

Mar 26, 202615 min

AI Security

SWE-CI: Can AI Agents Actually Maintain Code Long-Term?

Most benchmarks for LLM coding agents share a fundamental blind spot: they only test whether an agent can produce a one-shot fix. This post explores SWE-CI, a benchmark testing long-term code maintenance by AI agents.

AILLMBenchmarks

Mar 19, 202610 min

Threat Intelligence

Quishing in the Wild: Anatomy of a Corporate HR Lure Using QR Codes, AWS S3, and Cloudflare Turnstile

A live QR phishing campaign targeting corporate employees via a weaponized PDF disguised as an employee handbook — a toolkit-grade, multi-stage attack built to defeat automated email scanners, security sandboxes, and network proxies.

PhishingQR CodeAWS

Mar 11, 202611 min

Exploit Research

Coruna: The iOS Exploit Kit That Went From Spyware Vendor to Mass Crypto Theft

Google GTIG and iVerify independently disclosed Coruna, an iOS exploit kit containing 23 exploits across 5 full chains targeting iOS 13 through 17.2.1. Originally built for a surveillance vendor, it proliferated to Russian espionage then Chinese crypto theft.

iOSExploit KitSpyware

Mar 8, 202614 min

Threat Intelligence

Dissecting a Real Estate BEC Phishing Chain: From Fake Stewart Title Closing Docs to Multi-Layer Encrypted AiTM Router

A BEC phishing email impersonating a Stewart Title escrow officer sends fake closing documents via a compromised law firm. Five-stage chain abusing Lovable, a CAPTCHA gate, triple-encrypted JavaScript with anti-debug traps, and a server-side AiTM credential router.

BECPhishingAiTM

Feb 25, 202613 min

Threat Intelligence

Dissecting a BEC Phishing Chain: From Fake Payment Advice to Real-Time Google AiTM Credential Harvester

A real-world BEC phishing email impersonating a payment advice notification. Three-stage attack chain abusing systeme.io, a fake CAPTCHA gate, and a real-time Adversary-in-the-Middle Google credential harvester with full 2FA interception.

BECPhishingAiTM

Feb 24, 202612 min

Vulnerability Research

LeakyLooker: 9 Critical Google Looker Studio Vulnerabilities Exposed

A series of nine critical cross-tenant vulnerabilities in Google Looker Studio turned its live data-source connectivity into a major attack surface. Attackers could execute arbitrary SQL, exfiltrate sensitive data, and modify records without victim interaction.

Google CloudLooker StudioVulnerability Research

Feb 10, 202610 min

Supply Chain

Poisoned Packages: How npm Lifecycle Scripts Became a Supply Chain Weapon

Microsoft Threat Intelligence published a technique profile on malicious npm lifecycle scripts — the mechanism behind multiple North Korean campaigns. This post breaks down how lifecycle scripts work as an attack vector and a layered defense strategy for dev teams.

Supply Chain AttacknpmJavaScript

Jan 28, 20269 min

Never Miss Threat Intelligence

Get the latest cybersecurity research and threat alerts delivered directly to your inbox.