Threat actors use GSocket to keep access after Linux web flaws are fixed
Defender detections rose 356.2% from March to August 2026, and patching the original web flaw does not remove the client.
Stories per day · 30 days
6 RSS
Relatedsupply-chain2app-secret1apt1artex1camera-software1command-and-control1connectwise1credentials1dll-sideloading1entra-id1fake-font1financial-sector1ghostaction1github1glowcoma1gsocket1huntress1icmacos1
41 stories, newest first · one card per story
Stories tagged #persistence
Storm-3358 uses ARTEX against financial sector
Cambodia-based Storm-3358 cluster deploys agentic AI framework ARTEX to scan exploit and install RATs in financial organizations across Southeast Asia.
2
Camera software intrusions drop reverse shells and sideloaded DLLs
Huntress tied September and October cases to one C2 after CMS.exe launched a user-writable reverse shell and relocated WpcMon.exe.
2
ICMacOS macOS stealer gains RAT capabilities with reboot persistence
ICMacOS now includes WebSocket remote commands and LaunchAgent persistence that survives reboots.
Hackers used Compromised ConnectWise Backup Credentials to Hack 173 Microsoft 365 Accounts
Attackers used a stolen ConnectWise Cloud Backup secret to access 173 Microsoft 365 tenants.
7
GhostAction Hackers Hide Credential-Stealing Malware in Fake Font Files Across 94 GitHub Repositories
GhostAction hid credential-stealing Node.js malware in fake font files across 94 GitHub repositories.
5
SideCopy Hackers Target Indian Organizations With ReverseRAT Malware to Steal Data
SideCopy is spear-phishing Indian organizations with malicious shortcuts to deploy in-memory ReverseRAT for data theft.
3
Microsoft Power BI Phishing Campaign Deploys Rogue ScreenConnect RMMs for Persistent Access
Huntress found a Power BI phishing campaign that installs rogue ScreenConnect clients for persistent Windows access.
Attackers Use Power BI Phishing to Install Multiple RMMs and Maintain Persistent Access
Phishers abused Microsoft Power BI dashboards to push rogue ScreenConnect RMM clients, creating redundant persistent remote access on 20-plus endpoints.
Cisco Talos Warns Autonomous AI Agents Could Turn Pentests Into Stealthy Red Team Attacks
Cisco Talos warns autonomous AI agents may shift from noisy scans to stealthy, persistent intrusions.
7
FBI: FortiBleed attackers can lock organizations out of their own firewalls
FBI says FortiBleed operators hit over 80,000 FortiGate devices and can lock victims out of firewalls.
1
Four ways back in: the WordPress XSS campaign that hides its own admin account
Attackers are exploiting stored XSS in two WordPress plugins to install hidden admin backdoors.
15
More RMM Tools In the Wild, (Tue, Oct 6th)
Attackers phish victims with a fake PDF that installs Action1’s signed RMM agent for persistence.
WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, and Shared Memory
Sucuri details SC, a self-healing WordPress backdoor that rebuilds from files, the database, and RAM.
WordPress Malware Comes Back After Removal Using a Self-Healing Backdoor
Sucuri documented SC, a WordPress backdoor that restores itself from files, the database, memory, and Ethereum-based commands.
SC WordPress Malware Rebuilds Itself After Removal Using Database and Memory Persistence
SC WordPress malware rebuilds deleted backdoors from files, the database, cron, and shared memory.
SC WordPress Malware: A Self-Healing Mesh of Loaders, Drop-Ins, and a Blockchain-Controlled Backdoor
Sucuri documents SC, a self-healing WordPress malware mesh persisting across files, database, and shared memory, regenerating within seconds of cleanup.
Phishing Abuses RMM Tools for Persistent Access
Microsoft observed July 2026 phishing campaigns that installed MSP360 RMM and ScreenConnect for persistent access across industries.
SilverFox Hackers Built Fake Software Sites That Hide Malware From Security Researchers
Microsoft ties Silver Fox fake download sites to Windows malware mainly hitting Chinese-speaking users.
9
Microsoft Warns NeedyMantis Malware Enables Persistent Network Access
Microsoft warns China-linked NeedyMantis malware maintains persistent access in telecom, university, and government networks.
1
SilverFox Built Fake Software Sites That Know When Researchers Are Watching
Silver Fox operators delivered a Windows loader via WhatsApp while hiding payloads from security researchers.
4
Hackers Use NeedyMantis to Maintain Long-Term Access in Breached Networks
Microsoft says NeedyMantis malware maintained long-term access after targeted network breaches.
4
TrustSink Attack Uses Rogue MFA Provider to Steal Microsoft Entra Passwords During Legitimate Logins
Varonis disclosed TrustSink, a post-compromise Entra technique that steals passwords via a rogue MFA provider.
2
Python MaaS Infostealer Builder Steals Passwords, Credit Cards and Cookies From 17 Browsers
K7 Labs analyzed a Python malware-as-a-service builder that steals browser passwords, cards, and cookies from 17 Chromium browsers.
2