Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
700+ education and tech websites hijacked in huge ClickFix malware campaign
SOC Prime Bias: Critical
Malwarebytes
Fake “Secure Mail” Lures Deliver Malicious Files Posing as Credit Card Firms
SOC Prime Bias: Medium
ASEC
BlackToad Uses Network Manipulation in an AutoIt Payload
SOC Prime Bias: Medium
JUMPSEC
From Poisoned Search Results to GPU Mining: A Cryptojacking Campaign Using ScreenConnect and .NET Utilities
SOC Prime Bias: Medium
Microsoft Security Blog
Phishing Campaign Deploys JavaScript-Driven PureLogs Variant to Steal Sensitive Data
SOC Prime Bias: Medium
Fortinet Blog
Fake software on GitHub and SourceForge distribute Deno RAT by Gabriele Orini
SOC Prime Bias: Critical
Malwarebytes
From edge appliance to enterprise compromise: Multi-stage Linux intrusion via F5 and Confluence
SOC Prime Bias: Critical
Microsoft Security Blog
Claude Impersonation Page May Deliver ACR Stealer
SOC Prime Bias: Medium
SANS Internet Storm Center
Void Dokkaebi Uses Cython-Compiled InvisibleFerret Malware
SOC Prime Bias: Critical
Trend Micro
Payload Ransomware: In-Depth Technical Analysis
SOC Prime Bias: High
Darkatlas