Search: “Google Sheets”

58 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Malware 37 Vulnerability 34 Threat actor 27 Ransomware 27 Policy & legal 27 Exploit / PoC 26 Phishing & fraud 17 Data breach 13 Industry 10 AI industry 7 AI safety & security 3 AI tools & infra 3 Model release 2 Research 2

SeverityAll critical 92 high 58 medium 41 low 32 info 15

APT36 Suspected in PATCHCORD Espionage Campaign Using Google Sheets C2

Acronis links the PATCHCORD espionage campaign targeting Afghan telecom and South Asian critical infrastructure to APT36 with moderate confidence.

Acronis Threat Research Unit documented PATCHCORD, a previously undocumented C/C++ backdoor delivered via fake VPN installers impersonating Afghan Telecom (AFTEL), which hijacks Edge, Chrome and Firefox shortcuts for persistence and executes in-memory shellcode. A related Go implant, SHEETCORD, abuses the Google Sheets API for per-victim C2 and was distributed via a domain impersonating India's National Informatics Centre, while a third tool, HACKERAI C2 Agent, uses GitHub Gists and shows signs of LLM-assisted coding. An exposed staging server revealed SuperShell, RAT frameworks, credential-harvesting tools and OpenSSH exploit code, and the researchers attribute the activity to APT36/Transparent Tribe at moderate confidence.

Security AffairsAug 16, 07:24 UTC · Aug 16, 2026Threat actor in the wild

Cyberattackers Exploit Google Sheets for Malware Control in Likely Espionage Campaign

The Hacker NewsOct 25, 05:16 UTC · Oct 25, 2024Malware

Google GTIG disrupted China-linked APT UNC2814 halting attacks on 53 orgs in 42 countries

Security AffairsFeb 26, 08:29 UTC · Feb 26, 2026Data breach

The Bateleur backdoor is the new weapon in the Carbank gang's arsenal

Security AffairsOct 9, 21:32 UTC · Oct 9, 2017Malware

Experts Detect Pakistan-Linked Cyber Campaigns Aimed at Indian Government Entities

The Hacker NewsFeb 10, 10:41 UTC · Feb 10, 2026Threat actor1

Google Disrupts ‘Prolific’ and ‘Elusive’ China

Infosecurity MagazineFeb 26, 12:09 UTC · Feb 26, 2026Malware

Google Uncovers APT41's Use of Open Source GC2 Tool to Target Media and Job Sites

The Hacker NewsApr 18, 04:37 UTC · Apr 18, 2023Threat actor

APT41 group spotted using open

Security AffairsApr 17, 13:37 UTC · Apr 17, 2023Threat actor

Transparent Tribe Uses AI to Mass-Produce Malware Implants in Campaign Targeting India

The Hacker NewsMar 6, 15:11 UTC · Mar 6, 2026Malware

Cloud Atlas group acquires PowerCloud, ReverseSocks, SSH

Kaspersky SecurelistMay 22, 09:12 UTC · May 22, 2026Vulnerability CVE-2018-0802

Google Disrupts UNC2814 GRIDTIDE Campaign After 53 Breaches Across 42 Countries

The Hacker NewsFeb 26, 06:43 UTC · Feb 26, 2026Threat actor in the wild

The n8n n8mare: How threat actors are misusing AI workflow automation

Cisco TalosApr 15, 10:00 UTC · Apr 15, 2026Threat actor

Simple Mail Transfer Pirates: How threat actors are abusing third

Cisco TalosSep 26, 13:00 UTC · Sep 26, 2024Threat actor

Veza integrates with Google Drive to secure access to enterprise files

Help Net SecurityJan 31, 00:00 UTC · Jan 31, 2024Ransomware

Former Black Basta Members Use Microsoft Teams and Python Scripts in 2025 Attacks

The Hacker NewsJul 16, 17:30 UTC · Jul 16, 2025Ransomware CVE-2024-21762 CVE-2024-55591 CVE-2024-577271

Fog ransomware attack on Asia financial org draws attention over use of employee monitoring software

The RecordJun 12, 17:06 UTC · Jun 12, 2025Ransomware

Chinese APT41 Exploits Google Calendar for Malware Command-and

The Hacker NewsMay 29, 15:26 UTC · May 29, 2025Malware

Dozens of Chrome Extensions Hacked, Exposing Millions of Users to Data Theft

The Hacker NewsJan 3, 04:53 UTC · Jan 3, 2025Malware

ClickFix attacks infecting PCs and Macs are going viral

ClickFix social engineering attacks are spreading widely, delivering malware to Windows and macOS users by tricking them into running malicious terminal commands that bypass Gatekeeper.

BlueVoyant reports the Lorem Ipsum malware operation pivoted to ClickFix in late May 2026, dropping code-signing infrastructure and broadening its victim pool from Microsoft Teams searchers to anyone browsing a compromised website. Jamf and independent researchers documented macOS ClickFix variants that bypass Gatekeeper protections. Cisco Talos observed attackers abusing published Google Sheets for control traffic, while Netskope counted 5,400 sites beaconing to one campaign; Sandworm has separately hosted control infrastructure in blockchain smart contracts.