#0001RReversinglabs19 days ago10 min▣LLM reportmedium Threat actors are increasingly weaponizing SVG files by embedding JavaScript that executes automatically in browsers, enabling phishing redirects, credential harvesting, and DOM-based attacks. ReversingLabs analyzed malicious SVG samples from 2026 spearphishing campaigns using fake voicemail attachments to redirect targets in healthcare, construction, and banking to malicious domains. Additional samples showed SVGs acting as full webpages loading external brute-force scripts, demonstrating the versatility of SVG-based attacks that bypass traditional security controls treating SVGs as benign images.
#0002RReversinglabs24 days ago10 min▣LLM reporthigh ClickFix is a social engineering technique that uses fake CAPTCHA pages to trick users into pasting malicious commands into Run dialogs or terminals, executing payloads in memory via LOLBins without triggering traditional AV or EDR signatures. The threat has commoditized through MaaS subscriptions ($250–$1,800), expanded its payload catalog beyond infostealers to include RATs, loaders, and rootkits, and is actively evolving with variants like CrashFix, FileFix, PromptFix, and ConsentFix. ReversingLabs released an open-source multi-condition YARA rule that detects ClickFix lures by correlating fake verification characteristics, PowerShell payload indicators, and clipboard manipulation before payload execution.
#0003RReversinglabs24 days ago10 min▣LLM reporthigh ClickFix is a mature Malware-as-a-Service attack methodology that uses fake verification prompts to silently poison the user's clipboard with malicious commands, which are then pasted into Windows Run or macOS Terminal. The execution chain relies entirely on living-off-the-land binaries (PowerShell, mshta.exe, curl, rundll32.exe), making it invisible to traditional EDR and AV tooling. A specific watering hole attack on a university site delivered zuhe.dll, a Go-based RAT, using blockchain-based C2 via Ethereum smart contracts to evade infrastructure takedowns.
#0004RReversinglabsabout 2 months ago6 min▣LLM reporthigh An active Microsoft 365 phishing campaign is abusing the OAuth 2.0 Device Authorization Grant flow to achieve account takeover without stealing passwords. The attack utilizes ClickFix-style landing pages with Unicode obfuscation and tricks victims into authorizing an attacker-controlled device via legitimate Microsoft authentication portals, coordinating the flow via a 4-second beaconing mechanism.
#0005RReversinglabsabout 2 months ago4 min▣LLM reportcritical ITScape (CVE-2026-46316) is a critical guest-to-host escape vulnerability located in the vGIC-ITS emulation of KVM/arm64. By exploiting a race condition that triggers a double-put use-after-free, an attacker with guest kernel privileges can execute arbitrary code on the host kernel, completely compromising the hypervisor and threatening multi-tenant cloud infrastructure.
#0006RReversinglabs2 months ago5 min▣LLM reporthigh Threat actors are leveraging short-form video platforms like TikTok and Instagram Reels to conduct social engineering campaigns. By posting fake tutorials for premium software and manipulating engagement algorithms, attackers trick users into executing malicious PowerShell commands that deploy Vidarstealer or direct them to fraudulent survey websites.
#0007RReversinglabs2 months ago7 min▣LLM reportcritical A highly coordinated supply chain attack compromised 56 npm packages across 286 versions by abusing the binding.gyp native build configuration to silently execute malicious code during installation. The multi-stage, heavily encrypted payload targets CI/CD environments to harvest cloud credentials, propagates via stolen OIDC tokens, and establishes persistence with a destructive dead man's switch.
#0008RReversinglabs2 months ago9 min▣LLM reportcritical A coordinated supply chain attack compromised the @redhat-cloud-services npm scope, resulting in the automated publication of 32 backdoored packages. The malware utilizes a sophisticated three-layer obfuscation pipeline to drop a credential stealer that targets cloud and CI/CD secrets, exfiltrates data via the GitHub API, and possesses worm-like self-propagation capabilities.
#0009RReversinglabs3 months ago5 min▣LLM reportcritical A supply chain attack dubbed 'megalodon' compromises GitHub Action YAML configurations by injecting base64-encoded malicious scripts to exfiltrate repository data. Analysis of the C2 infrastructure, identified as the NEXUS Listener framework, links this activity to a prior campaign that exploited CVE-2026-41940 in cPanel servers to deploy cryptominers and steal high-value cloud credentials.
#0010RReversinglabs3 months ago6 min▣LLM reportcritical CVE-2026-31431, dubbed Copy Fail, is a critical local privilege escalation vulnerability in the Linux kernel affecting distributions released since 2017. By abusing the AF_ALG socket interface and the authencesn cryptographic template, an attacker can perform a controlled write into the in-memory page cache of setuid binaries, gaining root access without altering on-disk files.
#0011RReversinglabs3 months ago5 min▣LLM reportcritical CVE-2026-31431, also known as Dirty Frag or Copy Fail, is a Linux kernel local privilege escalation vulnerability that allows attackers to write to read-only memory regions via page-cache abuse. Active exploitation was observed prior to the public embargo break, with threat actors deploying ELF binaries, Python scripts, and malicious PyPI packages to achieve root access, notably including adoption by the Multiverze trojan family.
#0012RReversinglabs3 months ago5 min▣LLM reporthigh Threat actors are executing account takeover campaigns by distributing malware disguised as video games via compromised Discord accounts. Upon gaining initial access to a victim's Google account, attackers abuse the Family Link parental control feature by changing the victim's age to under 13 and assigning a malicious parent account. This allows the attackers to reset the password, bypass 2-Step Verification, lock the legitimate user out completely, and demand a ransom for account recovery.
