Threat actor

SocGholish

1 mentions in 7 days · 1 in 30 days · 2 total · first seen Aug 16, 2026 · last 5d ago

Timeline2 articles

The Top 4 Threats We Found by Investigating Every Alert for a Quarter

Prophet Security's quarterly threat report finds identity attacks made up roughly half of confirmed malicious activity, with stolen authenticated sessions bypassing conditional access controls.

Between May 1 and July 31, 2026, Prophet Security investigated every alert in customer environments immediately on arrival; about 7% of completed investigations were confirmed malicious. Direct account/session attacks made up roughly 18% of confirmed activity, with replayed authenticated sessions bypassing conditional access since no re-authentication occurs. Infostealer activity affected about a quarter of investigated organizations, mostly delivered via browsers through compromised websites, malicious ads, sponsored search results and ClickFix fake CAPTCHA gates, with payloads including Lumma Stealer, Vidar, HijackLoader and AsyncRAT. Credential phishing was the largest category at about 28%, with adversary-in-the-middle relays revealed by seconds-long MFA approvals from distant countries and MFA fatigue attacks exploiting automatic unlock policies.

BleepingComputerSep 10, 14:00 UTC · 5d agoThreat actor in the wild

Crooks Are Buying Your Expired Domains and Using Them to Deliver Malware

Infoblox finds dropcatch expired domains fuel malware delivery and C2, with actor Sable Squirrel spending ~$7M on 10,000+ domains.

Infoblox Threat Intel reports that in H1 2026 dropcatch (re-registered expired) domains made up nearly 20% of all new registrations, about 65,000 per day, inheriting reputation and traffic that attackers exploit. Threat actor Sable Squirrel spent nearly $7 million on 10,000+ expired domains, running Vietnamese, Korean, Japanese and Australian streaming platforms (Xoilac, Cakhia, 90phut) that double as C2 servers for Quasar RAT, AsyncRAT, DCRat and Remcos RAT. Scavenger actors like Shady Squirrel acquire previously compromised domains and feed inherited traffic to SocGholish and tech support scam networks.

Security AffairsAug 16, 17:17 UTC · Aug 16, 2026Threat actor

Appears with

threat actor ClearFake 1 threat actor Sable Squirrel 1 threat actor Shady Squirrel 1 threat actor Stuffy Squirrel 1 threat actor Swiping Squirrel 1 malware AsyncRAT 1 malware HijackLoader 1 malware Lumma Stealer 1 malware Vidar 1 organization General Electric 1 organization Prophet Security 1 product AsyncRAT 1 product DCRat 1 product Microsoft 365 1 product Quasar RAT 1 product Remcos RAT 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.