Cybercrime Blogs - Latest News & Insights

Threat Research & Intelligence

TDR Team

Cybercrime

July 1, 2026

Don’t eat the ChocoPoCs! How vulnerability researchers were repeatedly targeted by trojanised exploits

This article details a campaign targeting vulnerability researchers with "ChocoPoC" malware embedded inside trojanised Python dependencies. Exploiting the pressure to quickly test new vulnerabilities, threat actors distribute a persistent Remote Access Trojan (RAT) that exfiltrates data and harvests credentials from compromised developer environments.

By

Pierre LE BOURHIS

By

Quentin Bourgue

By

TDR Team

Threat Research & Intelligence

TDR Team

Cybercrime

AI

June 16, 2026

Unveiling ErrTraffic: inside a growing ClickFix malware distribution framework

This report details the ErrTraffic threat and its associated ecosystem, highlighting three specific campaigns and their operators' arsenal.

By

Jérémy SCION

By

Quentin Bourgue

By

TDR Team

Threat Research & Intelligence

TDR Team

Cybercrime

AI

April 7, 2026

EvilTokens: an AI-augmented Phishing-as-a-Service for automating BEC fraud - Part 2

Explore how EvilTokens uses AI-driven features to automate and scale BEC workflows. Uncover the PhaaS operations on Telegram.

By

Quentin Bourgue

By

TDR Team

Threat Research & Intelligence

TDR Team

Cybercrime

AI

March 30, 2026

New widespread EvilTokens kit: device code phishing as-a-service - Part 1

Uncover the new sophisticated EvilTokens device code phishing as-a-service, with AI-augmented features facilitating BEC fraud.

By

Quentin Bourgue

By

TDR Team

Threat Research & Intelligence

TDR Team

Cybercrime

February 12, 2026

OysterLoader Unmasked: The Multi-Stage Evasion Loader

Unmasking OysterLoader's evasion: from API hammering to custom LZMA. Explore the 4-stage infection chain and its ties to Rhysida ransomware.

By

Pierre LE BOURHIS

Threat Research & Intelligence

TDR Team

Cybercrime

January 29, 2026

Meet IClickFix: a widespread WordPress-targeting framework using the ClickFix tactic

Uncover IClickFix: a malicious framework exploiting the ClickFix tactic in widespread malware campaigns to deliver NetSupport RAT.

By

Quentin Bourgue

By

Amaury-Jacques GARÇON

By

TDR Team

Threat Research & Intelligence

TDR Team

Cybercrime

December 22, 2025

Advent Of Configuration Extraction – Part 4: Turning capa Into A Configuration Extractor For TinyShell variant

Learn how to extract TinyShell configuration data using capa, Capstone and Python to recover RC4-encrypted C2 settings from Linux malware.

By

Pierre LE BOURHIS

By

Jérémy SCION

By

TDR Team

Threat Research & Intelligence

TDR Team

Cybercrime

December 15, 2025

Advent of Configuration Extraction – Part 3: Mapping GOT/PLT and Disassembling the SNOWLIGHT Loader

In-depth analysis of the Snowlight malware loader, focusing on GOT/PLT mapping and ELF disassembly for configuration extraction.

By

Jérémy SCION

By

Pierre LE BOURHIS

By

TDR Team

Threat Research & Intelligence

TDR Team

Cybercrime

December 8, 2025

Advent of Configuration Extraction – Part 2: Unwrapping QuasarRAT’s Configuration

Learn how QuasarRAT configuration extraction works using pythonnet, dnlib and IL analysis to recover encrypted .NET malware settings.

By

Jérémy SCION

By

Pierre LE BOURHIS

By

TDR Team

Threat Research & Intelligence

TDR Team

Cybercrime

December 1, 2025

Advent of Configuration Extraction – Part 1: Pipeline Overview - First Steps with Kaiji Configuration Unboxing

Learn how TDR automates Kaiji configuration extraction using Assemblyline, introducing the malware analysis pipeline and MACO-based workflows

By

Jérémy SCION

By

Pierre LE BOURHIS

By

TDR Team

Threat Research & Intelligence

TDR Team

Cybercrime

November 6, 2025

Phishing Campaigns "I Paid Twice" Targeting Booking.com Hotels and Customers

Sekoia.io exposes a Booking.com phishing campaign targeting hotels and customers using ClickFix and PureRAT malware.

By

Jérémy SCION

By

Quentin Bourgue

By

TDR Team

Threat Research & Intelligence

TDR Team

Cybercrime

September 30, 2025

Silent Smishing : The Hidden Abuse of Cellular Router APIs

How attackers abuse Milesight cellular router APIs to run smishing at scale via unauthenticated SMS endpoints—targeting Belgium (CSAM/eBox).

By

Jérémy SCION

By

Marc NEBOUT

Threat Research & Intelligence

TDR Team

Cybercrime

June 11, 2025

Global analysis of Adversary-in-the-Middle phishing threats

This report explores current trends in the AitM phishing landscape and the prevalence of leading kits.

By

Quentin Bourgue

By

Grégoire CLERMONT

By

TDR Team

Threat Research & Intelligence

TDR Team

Cybercrime

May 27, 2025

The Sharp Taste of Mimo'lette: Analyzing Mimo’s Latest Campaign targeting Craft CMS

Analysis of the CVE-2025-32432 compromise chain by Mimo: exploitation, loader, crypto miner, proxyware, and detection opportunities.

By

Jérémy SCION

By

Pierre LE BOURHIS

By

TDR Team

Threat Research & Intelligence

TDR Team

Cybercrime

April 16, 2025

Interlock ransomware: Evolving under the radar with ClickFix

ClickFix ransomware attack uses deceptive prompts and PowerShell loaders to deploy threats like Interlock under the radar.

By

TDR Team

Threat Research & Intelligence

TDR Team

Cybercrime

February 11, 2025

RATatouille: Cooking Up Chaos in the I2P Kitchen

Discover the challenges of ClickFix12 and the newly identified I2PRAT. Uncover the advanced techniques employed by this multi-stage RAT.

By

Pierre LE BOURHIS