Active Threats
Explore the latest active threats being deployed by malicious actors as of 2026. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
TensorLake npm SDK Used to Spread Credential-Stealing Malware
SOC Prime Bias: Critical
socket.dev
ClickFix Attack Delivers Payloads via Browser Cache
SOC Prime Bias: High
The Hacker News
Shai-Hulud Supply Chain Attack Targets TensorLake npm SDK
SOC Prime Bias: Critical
socket.dev
CVE-2026-88771 and CVE-2026-88772 Exploited in NetScaler Attacks
SOC Prime Bias: Critical
Unit 42
Citrix NetScaler Attacks Target ADC and Gateway Appliances
SOC Prime Bias: Critical
Google Cloud Blog
Blinder Tunnel Campaign Analysis: Tactics, Techniques, and Infrastructure
SOC Prime Bias: Critical
Unit 42
CVE-2026-21589: Atlassian Jira and Confluence Pre-Auth File Read Vulnerability
SOC Prime Bias: Critical
watchTowr Labs
GlassWorm Campaign Spreads Hidden Loaders Through VS Code Extensions
SOC Prime Bias: Critical
socket.dev
RMM Tool Abuse Continues to Grow Across Active Threat Campaigns
SOC Prime Bias: High
SANS Internet Storm Center
UAC-0277 Attacks Deliver LUNEXSTEALER via Malicious MSI and ClickFix
SOC Prime Bias: High
cert.gov.ua
