A WhatsApp-delivered financial document lure carried Statement.exe into a multistage Windows intrusion. After unpacking, the loader screened the host, attempted elevation, and injected a downloader ...
Access practical and actionable anti-ransomware, exposure management and automated moving target defense insights and ...
A credential-based attack is an intrusion in which the attacker authenticates with a legitimate, stolen username and password rather than exploiting a software flaw — which means there is no malware ...
RevStealer is a Windows information stealer delivered inside a trojanized Electron desktop application that impersonates legitimate software. Morphisec Threat Labs observed it distributed through ...
Back in September 2025, we published “The NPM Worm That No One’s Talking About—But Everyone Should Be.” In February 2026, we followed it with “Can We Talk About This Now? Shai-Hulud Wave 2 Targeting ...
Most enterprise security stacks today are built around detection and response capabilities, identifying threats, generating alerts, and responding as quickly as possible. But modern ransomware attacks ...
As the geopolitical landscape continues to evolve, Morphisec Threat Labs is bringing technical focus to threats that have gone under-analyzed. Pay2Key, an Iranian-attributed ransomware group, has not ...
Artificial intelligence has revolutionized almost every aspect of business — and cybersecurity is no exception. Unfortunately, the same machine learning that helps defenders detect anomalies is now ...
Hey folks in the threat hunting world – it looks like our coverage of the Noodlophile infostealer has struck a nerve with its creators. Back in May 2025, Morphisec first uncovered this sneaky piece of ...
On January 20, 2026, Morphisec identified an active supply chain compromise affecting MicroWorld Technologies’ eScan antivirus product. Malicious updates were distributed through eScan’s legitimate ...
Attackers are no longer relying on phishing emails or malicious documents to compromise organizations. They’ve shifted their focus to something far more powerful…the trust developers place in ...
When Malware Hides in Plain Sight: How Morphisec Blocked a Tuoni C2 Attack Before It Became a Breach
Cybercriminals no longer just launch ransomware. They infiltrate quietly, blend in, harvest credentials, and wait (sometimes for months) before striking. That’s exactly what Morphisec Threat Labs ...
Some results have been hidden because they may be inaccessible to you
Show inaccessible results