This article investigates a Russian phishing campaign that uses a fake payment confirmation email to deploy the Phantom stealer malware. It details the multi-stage infection process, including the malicious ISO and executable files involved, and highlights the types of data targeted, such as credentials and cryptocurrency information.

Malcontent is a tool designed to detect supply-chain malware using context analysis and differential methods. It supports various file formats and programming languages, analyzing Linux programs primarily, but also works with macOS and Windows. It features three modes: analyze, diff, and scan, allowing for in-depth examination of program capabilities and risks.

MacPersistenceChecker is a macOS app that identifies all items set to run automatically on your system. It helps detect malware and unwanted software by scoring each persistence mechanism based on risk factors. Users can analyze and decide what to keep or remove.

The article details a supply chain attack on Notepad++, where attackers compromised the update infrastructure between June and September 2025. It outlines various infection chains, unique payloads, and the methods used to gather system information and install malicious software. Kaspersky's solutions successfully blocked these attacks as they unfolded.

The article details how an SSH LLM honeypot successfully lured a threat actor who downloaded exploits and attempted to connect a server to a botnet. By analyzing the threat actor’s actions and the scripts used, the author gained insights into the command and control infrastructure they employed. The findings led to actions against the associated IRC channels.

This article reviews new macOS malware discovered in 2025, detailing infection methods, persistence techniques, and the functionality of each specimen. The focus is primarily on information stealers, highlighting their rise in prevalence and the tactics used to distribute them. It also provides links to malware samples for analysis.

A new infostealer called SantaStealer has been launched, promoting itself on Telegram and underground forums. This malware collects sensitive data and aims to evade detection by operating in-memory, though initial samples reveal weaknesses in its design and execution.

This article details TangleCrypt, a new Windows malware packer linked to a ransomware attack. It discusses its methods for hiding payloads and the flaws in its implementation that may lead to crashes. Key features include its use of multiple encoding layers and basic anti-analysis techniques.

The article appears to be corrupted or improperly formatted, making it difficult to extract coherent information or insights regarding its content. As a result, the intended analysis or briefing on the "scattered spider threat" is not accessible.

The MCP server facilitates basic static triage of PE files using a large language model (LLM). Users can create markdown reports summarizing their analysis by providing sample paths and adjusting configuration settings in the triage.py script. The setup requires installing dependencies and includes features like integration with VT/AnyRun/Sandbox and hash lookups.