Latest cybersecurity reporting from selected sources.

Suspects accused of distributing malware and selling access to stolen Roblox accounts on Russian marketplaces

A new phishing campaign has been identified, delivering the Phantom information-stealing malware via an ISO attachment

Morphisec has observed a new operation embedding StealC V2 malware in Blender project files, targeting users via 3D assets and launching a multi-stage infection chain

Sandworm deployed data wipers against Ukrainian governmental entities and companies in the energy, logistics and grain sectors

The Coldriver hacking group reportedly shifted its operation quickly after the May 2025 public disclosure of its LostKeys malware

The backdoor is a sophisticated VBA-based malware targeting Microsoft Outlook

Russian military intelligence-linked hackers are using a new malware called “Authentic Antics” to secretly access Microsoft cloud email accounts, the UK's NCSC reports

New LOSTKEYS malware has been identified and linked to COLDRIVER by GTIG, stealing files and system data in targeted attacks

A large-scale phishing campaign using DarkWatchman and Sheriff malware has been observed targeting companies in Russia and Ukraine

Russian state actor Midnight Blizzard is using fake wine tasting events as a lure to spread malware for espionage purposes, according to Check Point

The cybercriminal uses the service of Proton66, an infamous Russian-based bulletproof hosting provider, to deploy malware

Crazy Evil, a group of crypto scammers, exploit NFTs and cryptocurrencies with malware targeting influencers and tech professionals

Diplomatic entities in Kazakhstan and Central Asia have been targeted by UAC-0063 using weaponized Word docs deploying HATVIBE malware

Microsoft detailed how Russian espionage group Secret Blizzard is leveraging infrastructure of other threat actors to target the Ukrainian military with custom malware

Russian-aligned TAG-110 uses custom tools to spy on governments, human rights groups and educational institutions in Europe and Asia

Google researchers have observed Russian threat actor UNC5812 using a malware campaign via Telegram to access the devices of Ukrainian military recruits

The malware issues commands via a hardcoded charcode table and Microsoft COM object interfaces

Recorded Future details a novel campaign that abuses legitimate internet services to deploy multiple malware variants for credential theft

Google has warned that the Russia-linked Coldriver has expanded its targeting of Western officials by deploying malware to exfiltrate sensitive data

Researchers say the specialized OT malware has similarities with Industroyer, which was used to take down power in Kiev, Ukraine, in 2016