Active Threats
Explore the latest active threats being deployed by malicious actors as of 2026. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
Unpacking the New “Matryoshka” ClickFix Variant: Typosquatting Campaign Delivers macOS Stealer
SOC Prime Bias: Medium
The Mac Security Blog
Update: Arctic Wolf Observes Threat Campaign Targeting BeyondTrust Remote Support Following CVE-2026-1731 PoC Availability
SOC Prime Bias: Critical
Arctic Wolf
How ClickFix Opens the Door to Stealthy StealC Information Stealer
SOC Prime Bias: Medium
levelblue.com
Operation MacroMaze: new APT28 campaign using basic tooling and legit infrastructure
SOC Prime Bias: Critical
lab52
LummaStealer Is Getting a Second Life Alongside CastleLoader
SOC Prime Bias: Medium
Bitdefender Labs
OysterLoader Uncovered: Inside a Multi-Stage Evasion Loader
SOC Prime Bias: High
Sekoia.io Blog
Odyssey Stealer: Inside a macOS Crypto-Stealing Operation
SOC Prime Bias: Medium
Censys
Cato CTRL Threat Research: Foxveil – New Malware Loader Abusing Cloudflare, Discord, and Netlify as Staging Infrastructure
SOC Prime Bias: Critical
Cato Networks
WSL in the Malware Ecosystem
SOC Prime Bias: Medium
SANS Internet Storm Center
Employee Monitoring and SimpleHelp Software Abused in Ransomware Operations
SOC Prime Bias: High
Huntress
